Browser notices: a tab is handed notices older than the one-week limit #577

New issue

Closed

opened 2026-10-01 10:47:47 +00:00 by tiagoagueda · 0 comments

tiagoagueda commented

2026-10-01 10:47:47 +00:00

Owner

Found on 2026-09-29 in a read-only review of postulo at 95348908d, reading the in-tab inbox of the browser notifier.

Checked again on 2026-10-01 against main at 0a5cad587: still present.

A browser notice nobody collects is meant to be thrown away after KEPT_FOR (a week), but old notices are deleted only when a new notice is left for the same person. collect has no age filter, so a person who is sent nothing else meets a stale notice, possibly weeks old, as a fresh desktop notification the next time they open a tab.

Where: notifications/inbox.py:29-36 (leave, the only place created_at__lt=now - KEPT_FOR is deleted); notifications/inbox.py:56-73 (collect, which filters on shown_at__isnull=True alone); notifications/models.py:18-20 (BrowserNotice's docstring: "one nobody collects is thrown away after KEPT_FOR").
What happens: a person whose browser notifier runs in tab-only mode has a reminder notice waiting, does not open Postulo for a month, and nothing else is announced to them. The first tab they open calls notifications:waiting, collect returns the month-old notice, and app.js shows it as a desktop notification. Shown notices are likewise kept until the next leave, however long that is.
Why it matters: the model promises a nudge that expires; the person gets a stale nudge about something the reminder list already shows, and the table holds rows past the retention it states.
Fix: in collect, delete the person's notices older than KEPT_FOR (and those already shown) before reading, or read with created_at__gte=timezone.now() - KEPT_FOR; better still, reap every account's expired and shown notices in the scheduler pass beside errands.forget_old(), so the table is kept to its promise whether or not anyone opens a tab.

Done when

A test in tests/test_browser_notifier.py that leaves a notice, back-dates its created_at past inbox.KEPT_FOR, and asserts inbox.collect(user) returns nothing and the row is gone.

Found on 2026-09-29 in a read-only review of postulo at 95348908d, reading the in-tab inbox of the browser notifier. Checked again on 2026-10-01 against `main` at `0a5cad587`: still present. A browser notice nobody collects is meant to be thrown away after `KEPT_FOR` (a week), but old notices are deleted only when a new notice is left for the same person. `collect` has no age filter, so a person who is sent nothing else meets a stale notice, possibly weeks old, as a fresh desktop notification the next time they open a tab. - **Where:** `notifications/inbox.py:29-36` (`leave`, the only place `created_at__lt=now - KEPT_FOR` is deleted); `notifications/inbox.py:56-73` (`collect`, which filters on `shown_at__isnull=True` alone); `notifications/models.py:18-20` (`BrowserNotice`'s docstring: "one nobody collects is thrown away after `KEPT_FOR`"). - **What happens:** a person whose browser notifier runs in tab-only mode has a reminder notice waiting, does not open Postulo for a month, and nothing else is announced to them. The first tab they open calls `notifications:waiting`, `collect` returns the month-old notice, and `app.js` shows it as a desktop notification. Shown notices are likewise kept until the next `leave`, however long that is. - **Why it matters:** the model promises a nudge that expires; the person gets a stale nudge about something the reminder list already shows, and the table holds rows past the retention it states. - **Fix:** in `collect`, delete the person's notices older than `KEPT_FOR` (and those already shown) before reading, or read with `created_at__gte=timezone.now() - KEPT_FOR`; better still, reap every account's expired and shown notices in the scheduler pass beside `errands.forget_old()`, so the table is kept to its promise whether or not anyone opens a tab. ## Done when - A test in `tests/test_browser_notifier.py` that leaves a notice, back-dates its `created_at` past `inbox.KEPT_FOR`, and asserts `inbox.collect(user)` returns nothing and the row is gone.

tiagoagueda added this to the 0.6.0 milestone

2026-10-01 10:47:47 +00:00

tiagoagueda added the

tier

bug

labels

2026-10-01 10:47:47 +00:00

tiagoagueda referenced this issue from a commit

2026-10-04 02:35:50 +00:00

Keep a browser notice to the week it is promised

tiagoagueda closed this issue

2026-10-04 02:35:50 +00:00