NukeBase

Push Notifications

Send notifications to your users' phones and computers, even when your app isn't open. Free to send, no app store, no email provider.

Push is built into the engine, like the file store. There's nothing to install or mount, and nothing runs until your app first uses it. It works in two halves:

  • Devices are ordinary data. When someone turns notifications on, the browser's subscription is saved wherever your app chooses: under the user, a team, a group of fans. Your security rules decide who may save it where, like any other write.
  • Sending points at an area. sendPush(["teams", teamId, "pushTokens"], …) notifies every device saved there.

The engine handles the hard parts:

  • Keys. Your app's signing keys (VAPID) are created the first time push is used and kept in your database. Or hardcode your own with configurePush.
  • Encryption. Every message is encrypted for the device it's going to (RFC 8291).
  • Cleanup. A device that was uninstalled or turned notifications off is removed from the exact place it was found.
  • No duplicates. A phone saved under both a user and a team gets one notification when you send to both.
  • The service worker. /sw.js ships with the engine and is updated by nukebase update.

No npm packages are needed: the engine uses Node's built-in crypto.

Where it works

Device / browserWorks?Notes
Android: Chrome, Edge, Firefox, SamsungYesWorks in the browser. Installing the app is optional.
Windows, Mac, Linux: Chrome, Edge, FirefoxYesNotifications arrive while the browser is running.
Mac: Safari 16+Yes
iPhone / iPad: Safari, iOS 16.4+After installOnly after the user taps Share, then Add to Home Screen, and opens the app from there. client.push.status() returns "install-first" until then.
Facebook / Instagram / TikTok in-app browsersNoThese browsers can't install apps or receive push. status() returns "unsupported", so ask the user to open the page in Safari or Chrome.

Plan for people who never turn it on. Many users won't install the app or allow notifications. Use push for helpful nudges. Anything a user must not miss (receipts, password resets, legal notices) still needs email.

Quick start

1. Let users save their device (rules)

server/rules.js
"users": {
  "$uid": {
    "pushTokens": { "write": "$uid == admin.uid" }   // each user saves only their own devices
  }
}

2. Add a button to your page

Browsers only show the permission prompt after a tap, so put it behind a button, never on page load.

public/index.html
document.querySelector("#notify").onclick = async () => {
  const status = await client.push.enable(["users", myUid, "pushTokens"]);
  if (status === "on") showMessage("Notifications are on");
  if (status === "install-first") showMessage("Tap Share, then Add to Home Screen, then open the app from your Home Screen");
  if (status === "blocked") showMessage("Notifications are blocked in your settings for this site");
};

3. Send from the server

server/app.js
module.exports = ({ get, set, addDbTrigger, sendPush /* , … */ }) => {

  // anywhere on the server: a trigger, a callable, a timer
  sendPush(["users", uid, "pushTokens"], {
    title: "Your order is ready",
    body: "Pick it up any time before 5pm.",
    url: "/orders"
  });
↑