feat(relay): ephemeral delivery, call wake-ups and TURN credentials

Protocol and relay groundwork for typing indicators and 1:1 calls.

- ContentHint.EPHEMERAL: delivered only to an online recipient, never
  queued or pushed; the sender gets Receipt.STATUS_DROPPED otherwise.
- ContentHint.CALL: a call offer is queued like a normal message, but an
  offline recipient is woken immediately — a PushKit VoIP push on iOS
  (priority 10, 45 s expiry) or a short-lived FCM data message on
  Android. The relay learns that a device is being called, not by whom.
- RegisterPush.voip_token stores the iOS VoIP token next to the regular
  APNs token (migration 0004).
- TurnRequest/TurnCredentials: logged-in devices receive time-limited
  coturn credentials (use-auth-secret REST scheme, HMAC-SHA1), so the
  TURN server is never an open relay. Configured with SEPOT_TURN_URLS and
  SEPOT_TURN_SECRET or SEPOT_TURN_SECRET_FILE; without them calls fall
  back to direct connections and STUN.

This commit is contained in:

Julius Joska

2026-10-03 22:43:53 +02:00

parent 4e3d7de32c

commit 69687d0acf

14 changed files with 698 additions and 27 deletions

									
										rust/sepot-relay/Cargo.toml
									
		+3
		
												View File
												
				@@ -27,6 +27,9 @@ ipnet = "2"

				serde = { version = "1", features = ["derive"] }

				serde_json = "1"

				base64 = "0.22"

				# TURN údaje pro hovory: coturn ověřuje HMAC-SHA1 (REST schéma use-auth-secret)

				hmac = "0.12"

				sha1 = "0.10"

				hex = "0.4"

				chrono = "0.4"

				rand = "0.9"