fix(notifications): in-app toasts no longer need browser notification permission (#324)

notify() shows an in-page toast while the window is focused and only
falls back to an OS notification otherwise, but both message and invite
notifications were gated on Notification.permission === granted. Anyone
who declined (or was never asked) heard the ping with nothing on screen.
Gate only the OS path on the permission.

Fixes #324

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

src/app/features/room-settings/PolicyListViewer.tsx

@@ -17,7 +17,6 @@ import { Page, PageContent, PageHeader } from '../../components/page';
 import { useMatrixClient } from '../../hooks/useMatrixClient';
 import { SequenceCard } from '../../components/sequence-card';
 import { SequenceCardStyle } from '../common-settings/styles.css';
-import { dedupePolicyEntries, PolicyEntry, recommendationLabel } from './policyEntries';
 
 // ── Policy event types ────────────────────────────────────────────────────────
 
@@ -39,6 +38,13 @@ type PolicyRuleContent = {
   recommendation?: string;
 };
 
+type PolicyEntry = {
+  entity: string;
+  reason: string;
+  recommendation: string;
+  stateKey: string;
+};
+
 type PolicyTab = 'users' | 'rooms' | 'servers';
 
 // ── Helpers ───────────────────────────────────────────────────────────────────
@@ -47,6 +53,13 @@ function isGlob(entity: string): boolean {
   return entity.includes('*') || entity.includes('?');
 }
 
+function recommendationLabel(rec: string): string {
+  // `m.ban` is the stable value; `org.matrix.mjolnir.ban` is the legacy
+  // (pre-stabilization) recommendation still emitted by older bots.
+  if (rec === 'm.ban' || rec === 'org.matrix.mjolnir.ban') return 'Ban';
+  return rec;
+}
+
 /**
  * Fetch all state events of a given type from a room's live forward state.
  * Uses the raw matrix-js-sdk `getStateEvents` API which accepts any string type.
@@ -71,6 +84,23 @@ function extractPolicyEntries(events: MatrixEvent[]): PolicyEntry[] {
     .filter((entry) => entry.entity !== '');
 }
 
+/**
+ * Merge policy entries from the stable and legacy event types for a rule
+ * kind, de-duplicating by entity+recommendation so a room that emits both a
+ * stable and a legacy rule for the same target isn't double-listed.
+ */
+export function dedupePolicyEntries(entries: PolicyEntry[]): PolicyEntry[] {
+  const seen = new Set<string>();
+  const result: PolicyEntry[] = [];
+  entries.forEach((entry) => {
+    const key = `${entry.entity} ${entry.recommendation}`;
+    if (seen.has(key)) return;
+    seen.add(key);
+    result.push(entry);
+  });
+  return result;
+}
+
 // ── Entry row ─────────────────────────────────────────────────────────────────
 
 function PolicyEntryRow({ entry }: { entry: PolicyEntry }) {

src/app/features/room-settings/policyEntries.test.ts

@@ -1,32 +0,0 @@
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { dedupePolicyEntries, recommendationLabel } from './policyEntries';
-
-const e = (entity: string, recommendation: string, stateKey = entity) => ({
-  entity,
-  reason: 'spam waves',
-  recommendation,
-  stateKey,
-});
-
-test('dedupePolicyEntries: a stable rule and its legacy twin show once (#321)', () => {
-  const out = dedupePolicyEntries([
-    e('@spammer:evil.example', 'm.ban'),
-    e('@spammer:evil.example', 'org.matrix.mjolnir.ban'),
-    e('@*:spam.example', 'm.ban'),
-  ]);
-  assert.deepEqual(
-    out.map((x) => x.entity),
-    ['@spammer:evil.example', '@*:spam.example'],
-  );
-});
-
-test('dedupePolicyEntries: different recommendations stay separate', () => {
-  assert.equal(dedupePolicyEntries([e('@a:x', 'm.ban'), e('@a:x', 'org.example.mute')]).length, 2);
-});
-
-test('recommendationLabel', () => {
-  assert.equal(recommendationLabel('m.ban'), 'Ban');
-  assert.equal(recommendationLabel('org.matrix.mjolnir.ban'), 'Ban');
-  assert.equal(recommendationLabel('org.example.mute'), 'org.example.mute');
-});

src/app/features/room-settings/policyEntries.ts

@@ -1,35 +0,0 @@
-export type PolicyEntry = {
-  entity: string;
-  reason: string;
-  recommendation: string;
-  stateKey: string;
-};
-
-/**
- * `m.ban` is the stable value; `org.matrix.mjolnir.ban` is the legacy
- * (pre-stabilization) recommendation still emitted by older bots.
- */
-export const normalizeRecommendation = (rec: string): string =>
-  rec === 'org.matrix.mjolnir.ban' ? 'm.ban' : rec;
-
-export function recommendationLabel(rec: string): string {
-  if (normalizeRecommendation(rec) === 'm.ban') return 'Ban';
-  return rec;
-}
-
-/**
- * Merge stable and legacy rule lists, one entry per entity + recommendation.
- * [Gitea #321] Keyed on the normalised recommendation: a bot publishing both
- * `m.ban` and its `org.matrix.mjolnir.ban` twin showed the rule twice.
- */
-export function dedupePolicyEntries(entries: PolicyEntry[]): PolicyEntry[] {
-  const seen = new Set<string>();
-  const result: PolicyEntry[] = [];
-  entries.forEach((entry) => {
-    const key = `${entry.entity} ${normalizeRecommendation(entry.recommendation)}`;
-    if (seen.has(key)) return;
-    seen.add(key);
-    result.push(entry);
-  });
-  return result;
-}

src/app/pages/client/ClientNonUIFeatures.tsx

@@ -334,7 +334,9 @@ function InviteNotifications() {
 
     if (quietActive) return;
 
-    if (showNotifications && notificationPermission('granted')) {
+    // [Gitea #324] The in-app toast (focused window) needs no browser
+    // permission; only the OS notification does.
+    if (showNotifications && (document.hasFocus() || notificationPermission('granted'))) {
       notify(newCount);
     }
     if (notificationSound && inviteSoundId !== 'none') {
@@ -641,7 +643,11 @@ function MessageNotifications() {
 
       if (quietActive) return;
 
-      if (showNotifications && notificationPermission('granted')) {
+      // [Gitea #324] notify() shows an in-app toast while the window is focused,
+      // which needs no browser permission; only its OS-notification path does.
+      // Gating both on the permission left people who declined it (most web
+      // users) with a ping sound and nothing on screen.
+      if (showNotifications && (document.hasFocus() || notificationPermission('granted'))) {
         const avatarMxc =
           room.getAvatarFallbackMember()?.getMxcAvatarUrl() ?? room.getMxcAvatarUrl();
         notify({