-
Notifications
You must be signed in to change notification settings - Fork 11
Add support for d14n and SubscribeAll mechanism
#65
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
Maelkum
wants to merge
31
commits into
main
Choose a base branch
from
maelkum/d14n-support
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from all commits
Commits
Show all changes
31 commits
Select commit
Hold shift + click to select a range
6d71b6a
Installation service renamed
Maelkum bc99727
Rename subscription service
Maelkum ccdb7a5
Misc
Maelkum 671be7e
Update protos for message API
Maelkum bcd6e8d
Introduce processing of different envelop types
Maelkum 86859a9
DB connect extra context
Maelkum de197c3
Processing v4 envelopes added
Maelkum 76500fc
Deliver messages (not right now though)
Maelkum fc93ce3
Added idempotency key
Maelkum 5075223
Include timestamp
Maelkum dc2f6a0
Add refresh client
Maelkum 2449a8d
Add client refresh
Maelkum 1ec7d11
Tweak delivery function
Maelkum a5daf5d
Update message usage in delivery services
Maelkum 69dd9aa
Update tests
Maelkum 6c91070
Add configurable test DB
Maelkum 8b2a835
Minor tweaks
Maelkum befc058
Update test
Maelkum 81f28fd
Update protos
Maelkum 99e7d43
Fix typo in env var name
Maelkum b34a88d
Add safety check so the linter does not complain
Maelkum 41e0c7e
Topic field initialized both for v3 + minor tweaks
Maelkum ef7f3e5
Improve cancellation handling and add locking for connection refresh
Maelkum 8ee7a4b
Don't do any queries if message should not be pushed
Maelkum 56d1b46
Don't return error on processing envelopes on failure to send, just l…
Maelkum ce14918
Remove cursor support
Maelkum 99e4cad
Add a wrapper for envelopes for channel processing
Maelkum 25cc620
Update comment
Maelkum 83f0699
Unify handling for message payloads
Maelkum 8cd7c65
Add a migration guide
Maelkum 7ce66aa
Fix handling for V4 welcome messages
Maelkum File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -5,6 +5,7 @@ | |
| *.so | ||
| *.dylib | ||
| mise.toml | ||
| cmd/server/server | ||
|
|
||
| # Test binary, built with `go test -c` | ||
| *.test | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,54 @@ | ||
| # Migration | ||
|
|
||
| This document describes how to run the Notification Server against different versions of XMTP nodes, especially moving from V3 to V4 version of the XMTP node. | ||
|
|
||
| ## Legacy - V3 | ||
|
|
||
| The V3 version of the XMTP node is the version of the XMTP node running in production as of 11. March 2026. | ||
| The source code for the node can be found at https://github.com/xmtp/xmtp-node-go. | ||
|
|
||
| This is the default node that Notification Server will expect to find on the other side. | ||
| Notification Server will try to communicate with it using the well established, legacy, V3 GRPC API, found [here](https://github.com/xmtp/proto/blob/main/proto/message_api/v1/message_api.proto). | ||
|
|
||
| The Notification Server will issue a `SubscribeAll` call to the V3 server and receive all messages flowing through the network. | ||
|
|
||
| ## Decentralization (D14N) API - V4 | ||
|
|
||
| The V4 version is the new, decentralized version of the XMTP node, whose implementation can be found at https://github.com/xmtp/xmtpd. | ||
| Soon it is a goal of XMTP network to completely switch to this node implementation for powering the network, so at some point message traffic will stop flowing through the legacy, v3 node, and will happen only on V4. | ||
|
|
||
| The API for the V4 node can be found [here](https://github.com/xmtp/proto/blob/main/proto/xmtpv4/message_api/message_api.proto). | ||
|
|
||
| ### Running the Notification Server Against D14N Node | ||
|
|
||
| In order to run the Notification Server against the new node version, it is sufficient to specify `--d14n` CLI flag. | ||
| All remaining CLI flags are backwards compatible. | ||
|
|
||
| This will instruct the Notification Server to connect to the specified node, but will attempt to communicate with it using the new API, and will understand the different data types that the Node will send as a response. | ||
|
|
||
| It is possible to run two instances of the Notification Server, each pointed at a different network - V3 and V4. | ||
| Nodes can share the same underlying database from which they can pull installation and subscription data. | ||
|
|
||
| ### Data Format Difference | ||
|
|
||
| As the two networks operate somewhat differently, they have different data formats. | ||
| Note that HTTP delivery mechanism provides more detailed contextual information about the message than APNs and FCM delivery methods. | ||
|
|
||
| #### APNs and FCM | ||
|
|
||
| Payloads sent by the Notification Server for APNs and FCM are exactly the same, running against the V3 or V4 API. | ||
|
|
||
| #### HTTP Delivery | ||
|
|
||
| If HTTP Delivery method is selected, Notification Server will POST the message payload to the specified address. | ||
|
|
||
| The payload is unchanged if the Notification Server is running against the V3 node. | ||
| If Notification Server is subscribed to a V4 node, the payload is slightly different, and can be found in the `message_v4` field. | ||
|
|
||
| If the Notification Server payload is sent to a single server, data origin can be determined based on the data receivedČ | ||
| - `message` - legacy, V3 message | ||
| - `message_v4` - D14N, V4 message | ||
|
|
||
| Seeing which field is populated can also make it easy on the data consumer to determine how to interpret the data. | ||
|
|
||
| These types are defined and can be inspected in more detail [here](pkg/interfaces/interfaces.go) - check the `SendRequest` type definition. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🌐 Web query:
GHSA-9h8m-3fm2-qjrq GO-2026-4394 go.opentelemetry.io/otel/sdk💡 Result:
GHSA-9h8m-3fm2-qjrq / GO-2026-4394 (CVE-2026-24051) affects
go.opentelemetry.io/otel/sdkon macOS/Darwin: the SDK’s resource detection (sdk/resource/host_id.go) executes theioregcommand via the system search PATH, allowing local PATH hijacking that can lead to arbitrary code execution in the application’s context. [1][2]>= 1.21.0, < 1.40.0[1][2]1.40.0(patch commitd45961b...) [1][2]go.opentelemetry.io/otel/sdkto v1.40.0+. [1][2]Sources:
[1] GitHub Advisory (GHSA-9h8m-3fm2-qjrq / CVE-2026-24051) (github.com)
[2] OSV entry for GO-2026-4394 (osv.dev)
Citations:
Upgrade to
go.opentelemetry.io/otel/sdkv1.40.0 or later to fix vulnerability GHSA-9h8m-3fm2-qjrq.Version v1.39.0 is affected by CVE-2026-24051, a PATH hijacking vulnerability in the SDK's resource detection (
sdk/resource/host_id.go) on macOS/Darwin that can lead to arbitrary code execution. The first patched release is v1.40.0.🧰 Tools
🪛 OSV Scanner (2.3.3)
[HIGH] 73-73: go.opentelemetry.io/otel/sdk 1.39.0: OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking in go.opentelemetry.io/otel/sdk
(GO-2026-4394)
[HIGH] 73-73: go.opentelemetry.io/otel/sdk 1.39.0: OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking
(GHSA-9h8m-3fm2-qjrq)
🤖 Prompt for AI Agents