[OpenNMS/opennms] 4a08db: NMS-20200: Fix browser notifications in Firefox an...

  Branch: refs/heads/release-36.x
  Home:   https://github.com/OpenNMS/opennms
  Commit: 4a08db5818b938a02911b288725adf5ccf030738
      https://github.com/OpenNMS/opennms/commit/4a08db5818b938a02911b288725adf5ccf030738
  Author: Marshall Massengill <[email protected]>
  Date:   2026-08-13 (Thu, 13 Aug 2026)

  Changed paths:
    M core/web-assets/src/main/assets/js/apps/notifications/index.js
    M docs/modules/operation/pages/deep-dive/notifications/introduction.adoc
    M docs/modules/operation/pages/quick-start/notifications.adoc
    M opennms-base-assembly/src/main/filtered/etc/notificationCommands.xml
    M opennms-services/src/main/java/org/opennms/netmgt/notifd/BrowserNotificationStrategy.java
    M opennms-services/src/main/java/org/opennms/netmgt/notifd/browser/BrowserNotificationMessage.java
    M opennms-webapp/src/main/java/org/opennms/web/notification/NotificationStreamServlet.java
    M opennms-webapp/src/main/webapp/WEB-INF/applicationContext-spring-security.xml
    M opennms-webapp/src/main/webapp/WEB-INF/web.xml
    M opennms-webapp/src/main/webapp/account/selfService/index.jsp
    A opennms-webapp/src/main/webapp/includes/notification-optin.jsp
    A opennms-webapp/src/main/webapp/notification-sw.js
    M opennms-webapp/src/main/webapp/notification/index.jsp
    M smoke-test/src/main/resources/opennms-overlay/etc/notificationCommands.xml
    M smoke-test/src/test/java/org/opennms/smoketest/NotificationsPageIT.java
    M smoke-test/src/test/java/org/opennms/smoketest/UserIT.java

  Log Message:
  -----------
  NMS-20200: Fix browser notifications in Firefox and on Chrome (#8769)

* NMS-20200: Fix browser notifications in Firefox and on Chrome for Android

The browser notification command has been broken in Firefox since Firefox 72 and
has never worked on Chrome for Android. Both failures were silent.

Firefox rejects Notification.requestPermission() without transient user
activation, and the client called it from a jQuery ready handler on page load, so
a user who had not already granted permission had no way to grant it. The prompt
now hangs off an explicit opt-in control, rendered by
includes/notification-optin.jsp on the Notifications and account self-service
pages, which also reports the blocked, unsupported and insecure-origin cases.

Chrome for Android throws from the page-scoped Notification constructor and
requires ServiceWorkerRegistration.showNotification(). notification-sw.js is
served from the webapp root so its scope covers the context; it registers no
fetch handler and so never intercepts or caches application requests. The
page-scoped constructor is kept as a fallback for browsers without service worker
support.

Also in this path:

* NotificationStreamServlet built its payload with JSONObject.append(), wrapping
  every value in an array. It rendered only because JavaScript coerces a
  single-element array to its string.
* Clicking a notification did nothing. The browser command now passes noticeid,
  resolved from the notification parameter map, and a click opens the notice.
  Notifd passes 0 for test triggers and -1 for resolution notices, neither of
  which has a notice page, so those fall back to the outstanding notice list.
* Reconnect was a flat 1s retry from every open tab for the duration of an
  OpenNMS restart, and now backs off with jitter to 30s.
* Dropped an unused net.sf.json import.

Two constructs are avoided deliberately in the client: .find() on a jQuery object
and the Promise global. The corejs transform rewrites both, into an
Array.prototype.find helper and a broken Promise reference, each of which throws
at runtime while building and linting cleanly.

worker-src 'self' is named explicitly in the CSP. It was already permitted
through the child-src/script-src fallback chain, but relying on that risks a
browser falling back to default-src 'none'.

Notification APIs are secure-context only, so none of this functions over plain
HTTP regardless of the above.

* NMS-20200: Handle Safari's callback-only requestPermission()

Safari gained the promise form of Notification.requestPermission() late; older
versions are callback-only and return undefined, so calling .then() on the result
threw inside the click handler and the opt-in silently did nothing. Accept either
shape, guarding against browsers that honour both from invoking the callback
twice.

* NMS-20200: Address review findings on the browser notification client

Guard connect() on an existing socket and check in each handler that the
socket is still the current one. A socket dropped by disconnect() still
delivers its close, which would otherwise clear the reference to a newer
socket and schedule a further connect, leaving one open and unreachable.

Fall back to an "OpenNMS" title when head is absent, which is what a
command with no -subject produces once org.json drops the null key.



To unsubscribe from these emails, change your notification settings at https://github.com/OpenNMS/opennms/settings/notifications


_______________________________________________
Please read the OpenNMS Mailing List FAQ:
http://www.opennms.org/wiki/index.php?page=MailingListFaq
opennms-cvs mailing list

To *unsubscribe* or change your subscription options, see the bottom of this page:
https://lists.sourceforge.net/lists/listinfo/opennms-cvs