Add mobile sync API routes

apps/www/lib/hono-app.ts

@@ -22,8 +22,11 @@ import {
   githubOAuthTokenRouter,
   healthRouter,
   morphRouter,
+  mobileAnalyticsRouter,
   mobileHeartbeatRouter,
   mobileMachineSessionRouter,
+  mobilePushRouter,
+  mobileWorkspaceReadRouter,
   sandboxesRouter,
   teamsRouter,
   usersRouter,
@@ -138,8 +141,11 @@ app.route("/", githubPrsFileContentsBatchRouter);
 app.route("/", githubInstallStateRouter);
 app.route("/", githubOAuthTokenRouter);
 app.route("/", githubBranchesRouter);
+app.route("/", mobileAnalyticsRouter);
 app.route("/", mobileMachineSessionRouter);
 app.route("/", mobileHeartbeatRouter);
+app.route("/", mobilePushRouter);
+app.route("/", mobileWorkspaceReadRouter);
 app.route("/", morphRouter);
 app.route("/", iframePreflightRouter);
 app.route("/", environmentsRouter);

apps/www/lib/routes/index.ts

@@ -17,8 +17,11 @@ export { githubPrsRouter } from "./github.prs.route";
 export { githubInstallStateRouter } from "./github.install-state.route";
 export { healthRouter } from "./health.route";
 export { iframePreflightRouter } from "./iframe-preflight.route";
+export { mobileAnalyticsRouter } from "./mobile-analytics.route";
 export { mobileHeartbeatRouter } from "./mobile-heartbeat.route";
 export { mobileMachineSessionRouter } from "./mobile-machine-session.route";
+export { mobilePushRouter } from "./mobile-push.route";
+export { mobileWorkspaceReadRouter } from "./mobile-workspace-read.route";
 export { morphRouter } from "./morph.route";
 export { sandboxesRouter } from "./sandboxes.route";
 export { teamsRouter } from "./teams.route";

apps/www/lib/routes/mobile-analytics.route.test.ts

@@ -0,0 +1,56 @@
+import { OpenAPIHono } from "@hono/zod-openapi";
+import { describe, expect, it, vi } from "vitest";
+import { createMobileAnalyticsRouter } from "./mobile-analytics.route";
+
+describe("mobileAnalyticsRouter", () => {
+  it("accepts an analytics event", async () => {
+    const ingest = vi.fn(async () => {});
+    const app = new OpenAPIHono();
+    app.route(
+      "/",
+      createMobileAnalyticsRouter({
+        resolveAccessToken: async () => "access-token-123",
+        ingest,
+      }),
+    );
+
+    const response = await app.request("/mobile/analytics", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        event: "mobile_workspace_opened",
+        properties: { workspaceId: "ws_1", platform: "ios" },
+      }),
+    });
+
+    expect(response.status).toBe(200);
+    const body = (await response.json()) as { accepted: boolean };
+    expect(body.accepted).toBe(true);
+    expect(ingest).toHaveBeenCalledTimes(1);
+    const firstCall = (ingest.mock.calls as unknown[][])[0];
+    expect(firstCall?.[0]).toMatchObject({
+      accessToken: "access-token-123",
+      event: "mobile_workspace_opened",
+    });
+  });
+
+  it("rejects unauthenticated requests", async () => {
+    const app = new OpenAPIHono();
+    app.route(
+      "/",
+      createMobileAnalyticsRouter({
+        resolveAccessToken: async () => null,
+      }),
+    );
+
+    const response = await app.request("/mobile/analytics", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        event: "mobile_workspace_opened",
+      }),
+    });
+
+    expect(response.status).toBe(401);
+  });
+});

apps/www/lib/routes/mobile-analytics.route.ts

@@ -0,0 +1,90 @@
+import { OpenAPIHono, createRoute, z } from "@hono/zod-openapi";
+
+const AnalyticsBody = z
+  .object({
+    event: z.string(),
+    properties: z.record(z.string(), z.any()).optional(),
+  })
+  .openapi("MobileAnalyticsBody");
+
+const AnalyticsResponse = z
+  .object({
+    accepted: z.boolean(),
+  })
+  .openapi("MobileAnalyticsResponse");
+
+export function createMobileAnalyticsRouter(options?: {
+  resolveAccessToken?: (req: Request) => Promise<string | null>;
+  ingest?: (args: {
+    accessToken: string;
+    event: string;
+    properties?: Record<string, unknown>;
+  }) => Promise<void>;
+}) {
+  const router = new OpenAPIHono();
+
+  const resolveAccessToken =
+    options?.resolveAccessToken ??
+    (async (req: Request) => {
+      const { getAccessTokenFromRequest } = await import("@/lib/utils/auth");
+      return getAccessTokenFromRequest(req);
+    });
+  const ingest =
+    options?.ingest ??
+    (async (args: {
+      event: string;
+      properties?: Record<string, unknown>;
+    }) => {
+      // Stub: log and accept. Forward to PostHog later.
+      console.log("mobile-analytics:", args.event, args.properties ?? {});
+    });
+
+  router.openapi(
+    createRoute({
+      method: "post",
+      path: "/mobile/analytics",
+      summary: "Forward mobile analytics events",
+      tags: ["Mobile"],
+      request: {
+        body: {
+          content: {
+            "application/json": {
+              schema: AnalyticsBody,
+            },
+          },
+          required: true,
+        },
+      },
+      responses: {
+        200: {
+          description: "Event accepted",
+          content: {
+            "application/json": {
+              schema: AnalyticsResponse,
+            },
+          },
+        },
+        401: { description: "Unauthorized" },
+      },
+    }),
+    async (c) => {
+      const accessToken = await resolveAccessToken(c.req.raw);
+      if (!accessToken) {
+        return c.text("Unauthorized", 401);
+      }
+
+      const body = c.req.valid("json");
+      await ingest({
+        accessToken,
+        event: body.event,
+        properties: body.properties as Record<string, unknown> | undefined,
+      });
+
+      return c.json({ accepted: true });
+    },
+  );
+
+  return router;
+}
+
+export const mobileAnalyticsRouter = createMobileAnalyticsRouter();

apps/www/lib/routes/mobile-heartbeat.route.ts

@@ -14,15 +14,22 @@ const HeartbeatWorkspace = z.object({
   lastEventAt: z.number().optional(),
 });
 
+const HeartbeatDirectConnect = z.object({
+  directPort: z.number(),
+  directTlsPins: z.array(z.string()),
+  ticketSecret: z.string(),
+});
+
 const HeartbeatBody = z
   .object({
     machineId: z.string(),
     displayName: z.string(),
     tailscaleHostname: z.string().optional(),
     tailscaleIPs: z.array(z.string()),
-    status: z.enum(["online", "offline", "unknown"]),
+    status: z.string(),
     lastSeenAt: z.number().optional(),
     lastWorkspaceSyncAt: z.number().optional(),
+    directConnect: HeartbeatDirectConnect.optional(),
     workspaces: z.array(HeartbeatWorkspace),
   })
   .openapi("MobileHeartbeatBody");
@@ -48,9 +55,10 @@ export async function publishMobileHeartbeatToConvex(args: {
   displayName: string;
   tailscaleHostname?: string;
   tailscaleIPs: string[];
-  status: "online" | "offline" | "unknown";
+  status: string;
   lastSeenAt: number;
   lastWorkspaceSyncAt?: number;
+  directConnect?: z.infer<typeof HeartbeatDirectConnect>;
   workspaces: Array<z.infer<typeof HeartbeatWorkspace>>;
 }) {
   const { convexUrl, deployKey } = getConvexHeartbeatConfig();
@@ -138,6 +146,7 @@ export function createMobileHeartbeatRouter(options?: {
         status: body.status,
         lastSeenAt: body.lastSeenAt ?? now(),
         lastWorkspaceSyncAt: body.lastWorkspaceSyncAt ?? now(),
+        directConnect: body.directConnect,
         workspaces: body.workspaces,
       });
 

apps/www/lib/routes/mobile-push.route.test.ts

@@ -0,0 +1,88 @@
+import { OpenAPIHono } from "@hono/zod-openapi";
+import { describe, expect, it, vi } from "vitest";
+import { createMobilePushRouter } from "./mobile-push.route";
+
+describe("mobilePushRouter", () => {
+  function makeApp(overrides?: Parameters<typeof createMobilePushRouter>[0]) {
+    const app = new OpenAPIHono();
+    app.route(
+      "/",
+      createMobilePushRouter({
+        resolveAccessToken: async () => "access-token-123",
+        ...overrides,
+      }),
+    );
+    return app;
+  }
+
+  it("registers a push token", async () => {
+    const registerToken = vi.fn(async () => {});
+    const app = makeApp({ registerToken });
+
+    const response = await app.request("/mobile/push/register", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        token: "apns-device-token-abc",
+        environment: "development",
+        platform: "ios",
+        bundleId: "dev.cmux.app",
+        deviceId: "device-xyz",
+      }),
+    });
+
+    expect(response.status).toBe(200);
+    const body = (await response.json()) as { ok: boolean };
+    expect(body.ok).toBe(true);
+    expect(registerToken).toHaveBeenCalledTimes(1);
+  });
+
+  it("removes a push token", async () => {
+    const removeToken = vi.fn(async () => {});
+    const app = makeApp({ removeToken });
+
+    const response = await app.request("/mobile/push/remove", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ token: "apns-device-token-abc" }),
+    });
+
+    expect(response.status).toBe(200);
+    const body = (await response.json()) as { ok: boolean };
+    expect(body.ok).toBe(true);
+    expect(removeToken).toHaveBeenCalledTimes(1);
+  });
+
+  it("sends a test push", async () => {
+    const sendTestPush = vi.fn(async () => 0);
+    const app = makeApp({ sendTestPush });
+
+    const response = await app.request("/mobile/push/test", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ title: "Hello", body: "World" }),
+    });
+
+    expect(response.status).toBe(200);
+    const body = (await response.json()) as { scheduledCount: number };
+    expect(body.scheduledCount).toBe(0);
+    expect(sendTestPush).toHaveBeenCalledTimes(1);
+  });
+
+  it("rejects unauthenticated requests", async () => {
+    const app = makeApp({ resolveAccessToken: async () => null });
+
+    const response = await app.request("/mobile/push/register", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        token: "apns-device-token-abc",
+        environment: "production",
+        platform: "ios",
+        bundleId: "dev.cmux.app",
+      }),
+    });
+
+    expect(response.status).toBe(401);
+  });
+});