feat: add private r2 bucket

internal/handler/soketi_webhook.go

@@ -10,14 +10,26 @@ import (
 	"strings"
 
 	"github.com/prabhupadasays/spsays-bff/internal/repository"
+	"github.com/prabhupadasays/spsays-bff/pkg/realtime"
 	"go.uber.org/zap"
 )
 
-// notifChannelPrefix is the public per-user channel the frontend subscribes to
-// for realtime notifications. Because it's keyed by user, a `channel_vacated`
-// webhook on it means that user's *last* connection dropped — i.e. they went
-// offline (across all their tabs) — so we can evict their feed seen-set.
-const notifChannelPrefix = "notifications."
+// userIDFromNotifChannel extracts the user id from a per-user notifications
+// channel, matching both the private name and the legacy public one.
+//
+// Because these channels are keyed by user, a `channel_vacated` webhook on one
+// means that user's *last* connection dropped — i.e. they went offline across
+// all their tabs — so we can evict their feed seen-set. Both names are matched
+// for the duration of the private-channel migration: clients running a
+// service-worker-cached bundle still sit on the legacy channel, and matching
+// only one name would silently stop evicting for half the users.
+func userIDFromNotifChannel(channel string) (string, bool) {
+	if uid, ok := strings.CutPrefix(channel, realtime.UserChannelPrefix); ok {
+		return uid, uid != ""
+	}
+	uid, ok := strings.CutPrefix(channel, realtime.LegacyUserChannelPrefix)
+	return uid, ok && uid != ""
+}
 
 // SoketiWebhookHandler receives Soketi (Pusher-compatible) webhooks. Soketi
 // signs each delivery with the app secret (X-Pusher-Signature = hex
@@ -83,7 +95,7 @@ func (h *SoketiWebhookHandler) Handle(w http.ResponseWriter, r *http.Request) {
 		if e.Name != "channel_vacated" {
 			continue
 		}
-		if uid, ok := strings.CutPrefix(e.Channel, notifChannelPrefix); ok && uid != "" {
+		if uid, ok := userIDFromNotifChannel(e.Channel); ok {
 			h.feed.Reset(ctx, uid)
 			cleared++
 		}