WIP: Critical alerts

Bump react-router and react-router-dom in /web

.github/dependabot.yml

@@ -0,0 +1,26 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/web"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+    groups:
+      all:
+        patterns:
+          - "*"

.github/workflows/build.yaml

@@ -8,13 +8,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Install Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: '1.25.x'
+          go-version: '1.26.x'
       - name: Install node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: '24'
           cache: 'npm'

.github/workflows/docs.yaml

@@ -9,10 +9,10 @@ jobs:
     steps:
       -
         name: Checkout ntfy code
-        uses: actions/checkout@v3
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Checkout docs pages code
-        uses: actions/checkout@v3
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           repository: binwiederhier/ntfy-docs.github.io
           path: build/ntfy-docs.github.io

.github/workflows/release.yaml

@@ -25,19 +25,19 @@ jobs:
       NTFY_TEST_S3_URL: ${{ secrets.NTFY_TEST_S3_URL }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Install Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: '1.25.x'
+          go-version: '1.26.x'
       - name: Install node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: '24'
           cache: 'npm'
           cache-dependency-path: './web/package-lock.json'
       - name: Docker login
-        uses: docker/login-action@v2
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           username: ${{ github.repository_owner }}
           password: ${{ secrets.DOCKER_HUB_TOKEN }}

.github/workflows/test.yaml

@@ -25,13 +25,13 @@ jobs:
       NTFY_TEST_S3_URL: ${{ secrets.NTFY_TEST_S3_URL }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Install Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: '1.25.x'
+          go-version: '1.26.x'
       - name: Install node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: '24'
           cache: 'npm'

Dockerfile-build

@@ -45,6 +45,9 @@ ADD ./db ./db
 ADD ./message ./message
 ADD ./model ./model
 ADD ./webpush ./webpush
+ADD ./attachment ./attachment
+ADD ./mail ./mail
+ADD ./s3 ./s3
 RUN --mount=type=cache,target=/go/pkg/mod --mount=type=cache,target=/root/.cache/go-build make VERSION=$VERSION COMMIT=$COMMIT cli-linux-server
 
 FROM alpine

Makefile

@@ -146,11 +146,13 @@ web-build:
 			../server/site/config.js
 
 web-deps:
-	cd web && $(NPM) install
+	cd web && $(NPM) ci
+	# Use "npm ci" so that we don't change the package lock file
 	# If this fails for .svg files, optimize them with svgo
 
 web-deps-update:
-	cd web && $(NPM) update
+	cd web && $(NPM) update --before="$(shell date -d '7 days ago' +%Y-%m-%d)"
+	cd web && $(NPM) install
 
 web-fmt:
 	cd web && $(NPM) run format

attachment/store.go

@@ -30,6 +30,7 @@ type Store struct {
 	attachmentsWithSizes func() (map[string]int64, error) // Returns file ID -> size for active attachments
 	orphanGracePeriod    time.Duration                    // Don't delete orphaned objects younger than this
 	closeChan            chan struct{}
+	doneChan             chan struct{}
 	mu                   sync.RWMutex // Protects size and sizes
 }
 
@@ -44,7 +45,7 @@ func NewFileStore(dir string, totalSizeLimit int64, orphanGracePeriod time.Durat
 
 // NewS3Store creates a new S3-backed attachment cache. The s3URL must be in the format:
 //
-//	s3://ACCESS_KEY:SECRET_KEY@BUCKET[/PREFIX]?region=REGION[&endpoint=ENDPOINT]
+//	s3://ACCESS_KEY:SECRET_KEY@BUCKET[/PREFIX]?region=REGION[&endpoint=ENDPOINT][&disable_http2=true]
 func NewS3Store(s3URL string, totalSizeLimit int64, orphanGracePeriod time.Duration, attachmentsWithSizes func() (map[string]int64, error)) (*Store, error) {
 	config, err := s3.ParseURL(s3URL)
 	if err != nil {
@@ -61,6 +62,7 @@ func newStore(backend backend, totalSizeLimit int64, orphanGracePeriod time.Dura
 		attachmentsWithSizes: attachmentsWithSizes,
 		orphanGracePeriod:    orphanGracePeriod,
 		closeChan:            make(chan struct{}),
+		doneChan:             make(chan struct{}),
 	}
 	// Hydrate sizes from the database immediately so that Size()/Remaining()/Remove()
 	// are accurate from the start, without waiting for the first sync() call.
@@ -74,6 +76,8 @@ func newStore(backend backend, totalSizeLimit int64, orphanGracePeriod time.Dura
 			c.size += size
 		}
 		go c.syncLoop()
+	} else {
+		close(c.doneChan)
 	}
 	return c, nil
 }
@@ -216,12 +220,14 @@ func (c *Store) Remaining() int64 {
 	return remaining
 }
 
-// Close stops the background sync goroutine
+// Close stops the background sync goroutine and waits for it to finish
 func (c *Store) Close() {
 	close(c.closeChan)
+	<-c.doneChan
 }
 
 func (c *Store) syncLoop() {
+	defer close(c.doneChan)
 	if err := c.sync(); err != nil {
 		log.Tag(tagStore).Err(err).Warn("Attachment sync failed")
 	}

cmd/app.go

@@ -44,7 +44,7 @@ func New() *cli.App {
 		Name:                   "ntfy",
 		Usage:                  "Simple pub-sub notification service",
 		UsageText:              "ntfy [OPTION..]",
-		HideVersion:            true,
+		HideVersion:            false,
 		UseShortOptionHandling: true,
 		Reader:                 os.Stdin,
 		Writer:                 os.Stdout,

cmd/serve.go

@@ -52,6 +52,7 @@ var flagsServe = append(
 	altsrc.NewStringSliceFlag(&cli.StringSliceFlag{Name: "auth-users", Aliases: []string{"auth_users"}, EnvVars: []string{"NTFY_AUTH_USERS"}, Usage: "pre-provisioned declarative users"}),
 	altsrc.NewStringSliceFlag(&cli.StringSliceFlag{Name: "auth-access", Aliases: []string{"auth_access"}, EnvVars: []string{"NTFY_AUTH_ACCESS"}, Usage: "pre-provisioned declarative access control entries"}),
 	altsrc.NewStringSliceFlag(&cli.StringSliceFlag{Name: "auth-tokens", Aliases: []string{"auth_tokens"}, EnvVars: []string{"NTFY_AUTH_TOKENS"}, Usage: "pre-provisioned declarative access tokens"}),
+	altsrc.NewBoolFlag(&cli.BoolFlag{Name: "auth-access-cache", Aliases: []string{"auth_access_cache"}, EnvVars: []string{"NTFY_AUTH_ACCESS_CACHE"}, Value: user.DefaultAccessCacheEnabled, Usage: "enables the in-memory ACL cache (high-volume servers only)"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "attachment-cache-dir", Aliases: []string{"attachment_cache_dir"}, EnvVars: []string{"NTFY_ATTACHMENT_CACHE_DIR"}, Usage: "cache directory for attached files, or S3 URL (s3://ACCESS_KEY:SECRET_KEY@BUCKET[/PREFIX]?region=REGION[&endpoint=ENDPOINT])"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "attachment-total-size-limit", Aliases: []string{"attachment_total_size_limit", "A"}, EnvVars: []string{"NTFY_ATTACHMENT_TOTAL_SIZE_LIMIT"}, Value: util.FormatSize(server.DefaultAttachmentTotalSizeLimit), Usage: "limit of the on-disk attachment cache"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "attachment-file-size-limit", Aliases: []string{"attachment_file_size_limit", "Y"}, EnvVars: []string{"NTFY_ATTACHMENT_FILE_SIZE_LIMIT"}, Value: util.FormatSize(server.DefaultAttachmentFileSizeLimit), Usage: "per-file attachment size limit (e.g. 300k, 2M, 100M)"}),
@@ -71,6 +72,7 @@ var flagsServe = append(
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "smtp-sender-user", Aliases: []string{"smtp_sender_user"}, EnvVars: []string{"NTFY_SMTP_SENDER_USER"}, Usage: "SMTP user (if e-mail sending is enabled)"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "smtp-sender-pass", Aliases: []string{"smtp_sender_pass"}, EnvVars: []string{"NTFY_SMTP_SENDER_PASS"}, Usage: "SMTP password (if e-mail sending is enabled)"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "smtp-sender-from", Aliases: []string{"smtp_sender_from"}, EnvVars: []string{"NTFY_SMTP_SENDER_FROM"}, Usage: "SMTP sender address (if e-mail sending is enabled)"}),
+	altsrc.NewBoolFlag(&cli.BoolFlag{Name: "smtp-sender-verify", Aliases: []string{"smtp_sender_verify"}, EnvVars: []string{"NTFY_SMTP_SENDER_VERIFY"}, Value: false, Usage: "require verified email addresses for sending email notifications"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "smtp-server-listen", Aliases: []string{"smtp_server_listen"}, EnvVars: []string{"NTFY_SMTP_SERVER_LISTEN"}, Usage: "SMTP server address (ip:port) for incoming emails, e.g. :25"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "smtp-server-domain", Aliases: []string{"smtp_server_domain"}, EnvVars: []string{"NTFY_SMTP_SERVER_DOMAIN"}, Usage: "SMTP domain for incoming e-mail, e.g. ntfy.sh"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "smtp-server-addr-prefix", Aliases: []string{"smtp_server_addr_prefix"}, EnvVars: []string{"NTFY_SMTP_SERVER_ADDR_PREFIX"}, Usage: "SMTP email address prefix for topics to prevent spam (e.g. 'ntfy-')"}),
@@ -92,6 +94,8 @@ var flagsServe = append(
 	altsrc.NewIntFlag(&cli.IntFlag{Name: "visitor-message-daily-limit", Aliases: []string{"visitor_message_daily_limit"}, EnvVars: []string{"NTFY_VISITOR_MESSAGE_DAILY_LIMIT"}, Value: server.DefaultVisitorMessageDailyLimit, Usage: "max messages per visitor per day, derived from request limit if unset"}),
 	altsrc.NewIntFlag(&cli.IntFlag{Name: "visitor-email-limit-burst", Aliases: []string{"visitor_email_limit_burst"}, EnvVars: []string{"NTFY_VISITOR_EMAIL_LIMIT_BURST"}, Value: server.DefaultVisitorEmailLimitBurst, Usage: "initial limit of e-mails per visitor"}),
 	altsrc.NewStringFlag(&cli.StringFlag{Name: "visitor-email-limit-replenish", Aliases: []string{"visitor_email_limit_replenish"}, EnvVars: []string{"NTFY_VISITOR_EMAIL_LIMIT_REPLENISH"}, Value: util.FormatDuration(server.DefaultVisitorEmailLimitReplenish), Usage: "interval at which burst limit is replenished (one per x)"}),
+	altsrc.NewIntFlag(&cli.IntFlag{Name: "visitor-topic-creation-limit-burst", Aliases: []string{"visitor_topic_creation_limit_burst"}, EnvVars: []string{"NTFY_VISITOR_TOPIC_CREATION_LIMIT_BURST"}, Value: server.DefaultVisitorTopicCreationLimitBurst, Usage: "burst of new topic creations per visitor (0 = disabled)"}),
+	altsrc.NewStringFlag(&cli.StringFlag{Name: "visitor-topic-creation-limit-replenish", Aliases: []string{"visitor_topic_creation_limit_replenish"}, EnvVars: []string{"NTFY_VISITOR_TOPIC_CREATION_LIMIT_REPLENISH"}, Value: util.FormatDuration(server.DefaultVisitorTopicCreationLimitReplenish), Usage: "interval at which topic-creation tokens are refilled (one per x)"}),
 	altsrc.NewIntFlag(&cli.IntFlag{Name: "visitor-prefix-bits-ipv4", Aliases: []string{"visitor_prefix_bits_ipv4"}, EnvVars: []string{"NTFY_VISITOR_PREFIX_BITS_IPV4"}, Value: server.DefaultVisitorPrefixBitsIPv4, Usage: "number of bits of the IPv4 address to use for rate limiting (default: 32, full address)"}),
 	altsrc.NewIntFlag(&cli.IntFlag{Name: "visitor-prefix-bits-ipv6", Aliases: []string{"visitor_prefix_bits_ipv6"}, EnvVars: []string{"NTFY_VISITOR_PREFIX_BITS_IPV6"}, Value: server.DefaultVisitorPrefixBitsIPv6, Usage: "number of bits of the IPv6 address to use for rate limiting (default: 64, /64 subnet)"}),
 	altsrc.NewBoolFlag(&cli.BoolFlag{Name: "behind-proxy", Aliases: []string{"behind_proxy", "P"}, EnvVars: []string{"NTFY_BEHIND_PROXY"}, Value: false, Usage: "if set, use forwarded header (e.g. X-Forwarded-For, X-Client-IP) to determine visitor IP address (for rate limiting)"}),
@@ -165,6 +169,7 @@ func execServe(c *cli.Context) error {
 	authUsersRaw := c.StringSlice("auth-users")
 	authAccessRaw := c.StringSlice("auth-access")
 	authTokensRaw := c.StringSlice("auth-tokens")
+	authAccessCacheEnabled := c.Bool("auth-access-cache")
 	attachmentCacheDir := c.String("attachment-cache-dir")
 	attachmentTotalSizeLimitStr := c.String("attachment-total-size-limit")
 	attachmentFileSizeLimitStr := c.String("attachment-file-size-limit")
@@ -184,6 +189,7 @@ func execServe(c *cli.Context) error {
 	smtpSenderUser := c.String("smtp-sender-user")
 	smtpSenderPass := c.String("smtp-sender-pass")
 	smtpSenderFrom := c.String("smtp-sender-from")
+	smtpSenderVerify := c.Bool("smtp-sender-verify")
 	smtpServerListen := c.String("smtp-server-listen")
 	smtpServerDomain := c.String("smtp-server-domain")
 	smtpServerAddrPrefix := c.String("smtp-server-addr-prefix")
@@ -205,6 +211,8 @@ func execServe(c *cli.Context) error {
 	visitorMessageDailyLimit := c.Int("visitor-message-daily-limit")
 	visitorEmailLimitBurst := c.Int("visitor-email-limit-burst")
 	visitorEmailLimitReplenishStr := c.String("visitor-email-limit-replenish")
+	visitorTopicCreationLimitBurst := c.Int("visitor-topic-creation-limit-burst")
+	visitorTopicCreationLimitReplenishStr := c.String("visitor-topic-creation-limit-replenish")
 	visitorPrefixBitsIPv4 := c.Int("visitor-prefix-bits-ipv4")
 	visitorPrefixBitsIPv6 := c.Int("visitor-prefix-bits-ipv6")
 	behindProxy := c.Bool("behind-proxy")
@@ -250,6 +258,10 @@ func execServe(c *cli.Context) error {
 	if err != nil {
 		return fmt.Errorf("invalid visitor email limit replenish: %s", visitorEmailLimitReplenishStr)
 	}
+	visitorTopicCreationLimitReplenish, err := util.ParseDuration(visitorTopicCreationLimitReplenishStr)
+	if err != nil {
+		return fmt.Errorf("invalid visitor topic creation limit replenish: %s", visitorTopicCreationLimitReplenishStr)
+	}
 	webPushExpiryDuration, err := util.ParseDuration(webPushExpiryDurationStr)
 	if err != nil {
 		return fmt.Errorf("invalid web push expiry duration: %s", webPushExpiryDurationStr)
@@ -310,6 +322,8 @@ func execServe(c *cli.Context) error {
 		return errors.New("if listen-https is set, both key-file and cert-file must be set")
 	} else if smtpSenderAddr != "" && (baseURL == "" || smtpSenderFrom == "") {
 		return errors.New("if smtp-sender-addr is set, base-url, and smtp-sender-from must also be set")
+	} else if smtpSenderVerify && smtpSenderAddr == "" {
+		return errors.New("if smtp-sender-verify is set, smtp-sender-addr must also be set")
 	} else if smtpServerListen != "" && smtpServerDomain == "" {
 		return errors.New("if smtp-server-listen is set, smtp-server-domain must also be set")
 	} else if attachmentCacheDir != "" && baseURL == "" {
@@ -456,6 +470,7 @@ func execServe(c *cli.Context) error {
 	conf.AuthUsers = authUsers
 	conf.AuthAccess = authAccess
 	conf.AuthTokens = authTokens
+	conf.AuthAccessCacheEnabled = authAccessCacheEnabled
 	conf.AttachmentCacheDir = attachmentCacheDir
 	conf.AttachmentTotalSizeLimit = attachmentTotalSizeLimit
 	conf.AttachmentFileSizeLimit = attachmentFileSizeLimit
@@ -471,6 +486,7 @@ func execServe(c *cli.Context) error {
 	conf.SMTPSenderUser = smtpSenderUser
 	conf.SMTPSenderPass = smtpSenderPass
 	conf.SMTPSenderFrom = smtpSenderFrom
+	conf.SMTPSenderVerify = smtpSenderVerify
 	conf.SMTPServerListen = smtpServerListen
 	conf.SMTPServerDomain = smtpServerDomain
 	conf.SMTPServerAddrPrefix = smtpServerAddrPrefix
@@ -492,6 +508,8 @@ func execServe(c *cli.Context) error {
 	conf.VisitorMessageDailyLimit = visitorMessageDailyLimit
 	conf.VisitorEmailLimitBurst = visitorEmailLimitBurst
 	conf.VisitorEmailLimitReplenish = visitorEmailLimitReplenish
+	conf.VisitorTopicCreationLimitBurst = visitorTopicCreationLimitBurst
+	conf.VisitorTopicCreationLimitReplenish = visitorTopicCreationLimitReplenish
 	conf.VisitorPrefixBitsIPv4 = visitorPrefixBitsIPv4
 	conf.VisitorPrefixBitsIPv6 = visitorPrefixBitsIPv6
 	conf.BehindProxy = behindProxy

cmd/serve_unix.go

@@ -1,4 +1,4 @@
-//go:build linux || dragonfly || freebsd || netbsd || openbsd
+//go:build (darwin || linux || dragonfly || freebsd || netbsd || openbsd) && !noserver
 
 package cmd
 

cmd/user.go

@@ -378,6 +378,7 @@ func createUserManager(c *cli.Context) (*user.Manager, error) {
 		ProvisionEnabled:    false, // Hack: Do not re-provision users on manager initialization
 		BcryptCost:          user.DefaultUserPasswordBcryptCost,
 		QueueWriterInterval: user.DefaultUserStatsQueueWriterInterval,
+		AccessCacheEnabled:  false, // Do not cache for CLI commands
 	}
 	if databaseURL != "" {
 		host, dbErr := pg.Open(databaseURL)

cmd/user_test.go

@@ -1,14 +1,15 @@
 package cmd
 
 import (
+	"os"
+	"path/filepath"
+	"testing"
+
 	"github.com/stretchr/testify/require"
 	"github.com/urfave/cli/v2"
 	"heckel.io/ntfy/v2/server"
 	"heckel.io/ntfy/v2/test"
 	"heckel.io/ntfy/v2/user"
-	"os"
-	"path/filepath"
-	"testing"
 )
 
 func TestCLI_User_Add(t *testing.T) {
@@ -128,6 +129,7 @@ func newTestServerWithAuth(t *testing.T) (s *server.Server, conf *server.Config,
 	conf.File = configFile
 	conf.AuthFile = filepath.Join(t.TempDir(), "user.db")
 	conf.AuthDefault = user.PermissionDenyAll
+	conf.AuthAccessCacheEnabled = false
 	s, port = test.StartServerWithConfig(t, conf)
 	return
 }

docs/config.md

@@ -353,6 +353,14 @@ This generator helps you configure your self-hosted ntfy instance. It's not full
 <label>SMTP password</label>
 <input type="password" data-key="smtp-sender-pass" placeholder="Password">
 </div>
+<div class="cg-field cg-inline-field">
+<label>Require email verification</label>
+<div class="cg-btn-group">
+<label><input type="radio" name="cg-smtp-sender-verify" value="no" checked><span>No</span></label>
+<label><input type="radio" name="cg-smtp-sender-verify" value="yes"><span>Yes</span></label>
+</div>
+</div>
+<input type="checkbox" data-key="smtp-sender-verify" id="cg-smtp-sender-verify-hidden" style="display:none">
 </div>
 <div id="cg-email-in-section" class="cg-hidden">
 <div class="cg-field"><label><strong>Incoming (publishing)</strong></label></div>
@@ -538,7 +546,7 @@ As an alternative to the local filesystem, you can store attachments in an S3-co
 To use an S3-compatible storage for attachments, set `attachment-cache-dir` to an S3 URL with the following format:
 
 ```
-s3://ACCESS_KEY:SECRET_KEY@BUCKET[/PREFIX]?region=REGION[&endpoint=ENDPOINT]
+s3://ACCESS_KEY:SECRET_KEY@BUCKET[/PREFIX]?region=REGION[&endpoint=ENDPOINT][&disable_http2=true]
 ```
 
 Here are a few examples:
@@ -546,7 +554,7 @@ Here are a few examples:
 === "/etc/ntfy/server.yml (DigitalOcean Spaces)"
     ``` yaml
     base-url: "https://ntfy.example.com"
-    attachment-cache-dir: "s3://ACCESS_KEY:SECRET_KEY@my-bucket/attachments?region=nyc3&endpoint=https://nyc3.digitaloceanspaces.com"
+    attachment-cache-dir: "s3://ACCESS_KEY:SECRET_KEY@my-bucket/attachments?region=nyc3&endpoint=https://nyc3.digitaloceanspaces.com&disable_http2=true"
     ```
 
 === "/etc/ntfy/server.yml (AWS S3)"
@@ -564,6 +572,9 @@ Here are a few examples:
 Note that the access key and secret key may have to be URL encoded. For instance, a secret key `YmxhY+mxhYmxhC` (note the `+`) should
 be encoded as `YmxhY%2BmxhYmxhC` (note the `%2B`), so the URL would be `s3://ACCESS_KEY:YmxhY%2BmxhYmxhC@my-bucket/attachments...`.
 
+If you experience upload failures with HTTP/2 stream errors (common with DigitalOcean Spaces and some other S3-compatible providers),
+add `&disable_http2=true` to force HTTP/1.1 connections.
+
 !!! info
     ntfy.sh is hosted and sponsored by DigitalOcean. I can highly recommend their public cloud offering. It's been rock solid
     for 4 years. They offer an S3-compatible storage for $5/month and 250 GB of storage, with 1 TiB of bandwidth. 
@@ -1008,6 +1019,10 @@ To allow forwarding messages via e-mail, you can configure an **SMTP server for
 you can set the `X-Email` header to [send messages via e-mail](publish.md#e-mail-notifications) (e.g. 
 `curl -d "hi there" -H "X-Email: phil@example.com" ntfy.sh/mytopic`).
 
+!!! info
+    On ntfy.sh, anonymous email sending was disabled due to abuse. To use the email notification feature, 
+    you must verify your email in the web app's [Account section](https://ntfy.sh/account). 
+
 As of today, only SMTP servers with PLAIN auth and STARTLS are supported. To enable e-mail sending, you must set the 
 following settings:
 
@@ -1015,6 +1030,8 @@ following settings:
 * `smtp-sender-addr` is the hostname:port of the SMTP server
 * `smtp-sender-user` and `smtp-sender-pass` are the username and password of the SMTP user
 * `smtp-sender-from` is the e-mail address of the sender
+* `smtp-sender-verify` is a flag that forces email recipient verification when enabled. If set to true, 
+  only verified email recipients can be used in the `X-Email` header.
 
 Here's an example config using [Amazon SES](https://aws.amazon.com/ses/) for outgoing mail (this is how it is 
 configured for `ntfy.sh`):
@@ -1026,9 +1043,15 @@ configured for `ntfy.sh`):
     smtp-sender-user: "AKIDEADBEEFAFFE12345"
     smtp-sender-pass: "Abd13Kf+sfAk2DzifjafldkThisIsNotARealKeyOMG."
     smtp-sender-from: "ntfy@ntfy.sh"
+    smtp-sender-verify: true
     ```
 
-Please also refer to the [rate limiting](#rate-limiting) settings below, specifically `visitor-email-limit-burst` 
+By default, any user (including anonymous users) can send email notifications to any address. To require email
+address verification, set `smtp-sender-verify` to `true`. When enabled, anonymous users cannot send emails,
+and authenticated users can only send to email addresses they have verified in their account settings. Users can
+also use `yes`/`true`/`1` as the `X-Email` value to send to their first verified address.
+
+Please also refer to the [rate limiting](#rate-limiting) settings below, specifically `visitor-email-limit-burst`
 and `visitor-email-limit-burst`. Setting these conservatively is necessary to avoid abuse.
 
 ## E-mail publishing
@@ -1382,7 +1405,7 @@ or the root domain:
     }
     ```
 
-=== "Apache2"
+=== "Apache >= 2.4.47"
     ```
     # /etc/apache2/sites-*/ntfy.conf
 
@@ -1390,6 +1413,7 @@ or the root domain:
         ServerName ntfy.sh
 
         # Proxy connections to ntfy (requires "a2enmod proxy proxy_http")
+        # Use mod_proxy_http for websocket upgrade ('upgrade=websocket'), which requires Apache (httpd) >= 2.4.47.
         ProxyPass / http://127.0.0.1:2586/ upgrade=websocket
         ProxyPassReverse / http://127.0.0.1:2586/
 
@@ -1416,6 +1440,7 @@ or the root domain:
         Include /etc/letsencrypt/options-ssl-apache.conf
 
         # Proxy connections to ntfy (requires "a2enmod proxy proxy_http")
+        # Use mod_proxy_http for websocket upgrade ('upgrade=websocket'), which requires Apache (httpd) >= 2.4.47.
         ProxyPass / http://127.0.0.1:2586/ upgrade=websocket
         ProxyPassReverse / http://127.0.0.1:2586/
 
@@ -1428,6 +1453,68 @@ or the root domain:
     </VirtualHost>
     ```
 
+=== "Apache < 2.4.47"
+    ```
+    # /etc/apache2/sites-*/ntfy.conf
+
+    <VirtualHost *:80>
+        ServerName ntfy.sh
+
+        # Proxy connections to ntfy (requires "a2enmod proxy")
+        ProxyPass / http://127.0.0.1:2586/
+        ProxyPassReverse / http://127.0.0.1:2586/
+
+        # Enable mod_rewrite (requires "a2enmod rewrite")
+        RewriteEngine on
+        # WebSockets support (requires "a2enmod proxy_wstunnel")
+        # mod_proxy_wstunnel is deprecated as of Apache (httpd) 2.4.47. It also uses more resources since it relies on mod_rewrite.
+        RewriteCond %{HTTP:Upgrade} websocket [NC]
+        RewriteCond %{HTTP:Connection} upgrade [NC]
+        RewriteRule ^/?(.*) "ws://127.0.0.1:2586/$1" [P,L]
+
+        SetEnv proxy-nokeepalive 1
+        SetEnv proxy-sendchunked 1
+
+        # Higher than the max message size of 4096 bytes
+        LimitRequestBody 102400
+        
+        # Redirect HTTP to HTTPS, but only for GET topic addresses, since we want 
+        # it to work with curl without the annoying https:// prefix (requires "a2enmod alias")
+        <If "%{REQUEST_METHOD} == 'GET'">
+            RedirectMatch permanent "^/([-_A-Za-z0-9]{0,64})$" "https://%{SERVER_NAME}/$1"
+        </If>
+
+    </VirtualHost>
+    
+    <VirtualHost *:443>
+        ServerName ntfy.sh
+        
+        SSLEngine on
+        SSLCertificateFile /etc/letsencrypt/live/ntfy.sh/fullchain.pem
+        SSLCertificateKeyFile /etc/letsencrypt/live/ntfy.sh/privkey.pem
+        Include /etc/letsencrypt/options-ssl-apache.conf
+
+        # Proxy connections to ntfy (requires "a2enmod proxy")
+        ProxyPass / http://127.0.0.1:2586/
+        ProxyPassReverse / http://127.0.0.1:2586/
+
+        # Enable mod_rewrite (requires "a2enmod rewrite")
+        RewriteEngine on
+        # WebSockets support (requires "a2enmod proxy_wstunnel")
+        # mod_proxy_wstunnel is deprecated as of Apache (httpd) 2.4.47. It also uses more resources since it relies on mod_rewrite.
+        RewriteCond %{HTTP:Upgrade} websocket [NC]
+        RewriteCond %{HTTP:Connection} upgrade [NC]
+        RewriteRule ^/?(.*) "ws://127.0.0.1:2586/$1" [P,L]
+
+        SetEnv proxy-nokeepalive 1
+        SetEnv proxy-sendchunked 1
+
+        # Higher than the max message size of 4096 bytes 
+        LimitRequestBody 102400
+	
+    </VirtualHost>
+    ```
+
 === "caddy"
     ```
     # Note that this config is most certainly incomplete. Please help out and let me know what's missing
@@ -1832,6 +1919,17 @@ are enabled):
 * `visitor-email-limit-burst` is the initial bucket of emails each visitor has. This defaults to 16.
 * `visitor-email-limit-replenish` is the rate at which the bucket is refilled (one email per x). Defaults to 1h.
 
+### Topic creation limits
+To mitigate topic-enumeration / squatting attacks (where a single source pokes thousands of guessable
+topic names to inflate the server's in-memory topic map), there is a per-visitor limit on how many *new*
+topics each visitor can cause to be created. Touching topics that already exist in memory does not consume
+a token; only first-time insertions do.
+
+* `visitor-topic-creation-limit-burst` is the initial bucket of new-topic tokens. Set to 0 to disable
+  the limit entirely. Defaults to 100.
+* `visitor-topic-creation-limit-replenish` is the rate at which the bucket is refilled (one new topic per x).
+  Defaults to 1m.
+
 ### Firebase limits
 If [Firebase is configured](#firebase-fcm), all messages are also published to a Firebase topic (unless `Firebase: no` 
 is set). Firebase enforces [its own limits](https://firebase.google.com/docs/cloud-messaging/concept-options#topics_throttling)
@@ -2186,10 +2284,11 @@ variable before running the `ntfy` command (e.g. `export NTFY_LISTEN_HTTP=:80`).
 | `cache-batch-timeout`                      | `NTFY_CACHE_BATCH_TIMEOUT`                      | *duration*                                          | 0s                | Timeout for batched async writes to the message cache (if zero, writes are synchronous)                                                                                                                                                 |
 | `auth-file`                                | `NTFY_AUTH_FILE`                                | *filename*                                          | -                 | Auth database file used for access control (SQLite). If set, enables authentication and access control. Not required if `database-url` is set. See [access control](#access-control).                                                   |
 | `auth-default-access`                      | `NTFY_AUTH_DEFAULT_ACCESS`                      | `read-write`, `read-only`, `write-only`, `deny-all` | `read-write`      | Default permissions if no matching entries in the auth database are found. Default is `read-write`.                                                                                                                                     |
+| `auth-access-cache`                        | `NTFY_AUTH_ACCESS_CACHE`                        | *bool*                                              | false             | Enables an in-memory ACL cache so authorization checks no longer hit the database. Only worth enabling on high-volume servers.                                                                                                          |
 | `behind-proxy`                             | `NTFY_BEHIND_PROXY`                             | *bool*                                              | false             | If set, use forwarded header (e.g. X-Forwarded-For, X-Client-IP) to determine visitor IP address (for rate limiting)                                                                                                                    |
 | `proxy-forwarded-header`                   | `NTFY_PROXY_FORWARDED_HEADER`                   | *string*                                            | `X-Forwarded-For` | Use specified header to determine visitor IP address (for rate limiting)                                                                                                                                                                |
 | `proxy-trusted-hosts`                      | `NTFY_PROXY_TRUSTED_HOSTS`                      | *comma-separated host/IP/CIDR list*                 | -                 | Comma-separated list of trusted IP addresses, hosts, or CIDRs to remove from forwarded header                                                                                                                                           |
-| `attachment-cache-dir`                     | `NTFY_ATTACHMENT_CACHE_DIR`                     | *directory or S3 URL*                               | -                 | Cache directory for attached files, or S3 URL for object storage (format: `s3://KEY:SECRET@BUCKET[/PREFIX]?region=REGION[&endpoint=ENDPOINT]`).                                                                                         |
+| `attachment-cache-dir`                     | `NTFY_ATTACHMENT_CACHE_DIR`                     | *directory or S3 URL*                               | -                 | Cache directory for attached files, or S3 URL for object storage (format: `s3://KEY:SECRET@BUCKET[/PREFIX]?region=REGION[&endpoint=ENDPOINT][&disable_http2=true]`).                                                                    |
 | `attachment-total-size-limit`              | `NTFY_ATTACHMENT_TOTAL_SIZE_LIMIT`              | *size*                                              | 5G                | Limit of the on-disk attachment cache directory. If the limits is exceeded, new attachments will be rejected.                                                                                                                           |
 | `attachment-file-size-limit`               | `NTFY_ATTACHMENT_FILE_SIZE_LIMIT`               | *size*                                              | 15M               | Per-file attachment size limit (e.g. 300k, 2M, 100M). Larger attachment will be rejected.                                                                                                                                               |
 | `attachment-expiry-duration`               | `NTFY_ATTACHMENT_EXPIRY_DURATION`               | *duration*                                          | 3h                | Duration after which uploaded attachments will be deleted (e.g. 3h, 20h). Strongly affects `visitor-attachment-total-size-limit`.                                                                                                       |
@@ -2197,6 +2296,7 @@ variable before running the `ntfy` command (e.g. `export NTFY_LISTEN_HTTP=:80`).
 | `smtp-sender-user`                         | `NTFY_SMTP_SENDER_USER`                         | *string*                                            | -                 | SMTP user; only used if e-mail sending is enabled                                                                                                                                                                                       |
 | `smtp-sender-pass`                         | `NTFY_SMTP_SENDER_PASS`                         | *string*                                            | -                 | SMTP password; only used if e-mail sending is enabled                                                                                                                                                                                   |
 | `smtp-sender-from`                         | `NTFY_SMTP_SENDER_FROM`                         | *e-mail address*                                    | -                 | SMTP sender e-mail address; only used if e-mail sending is enabled                                                                                                                                                                      |
+| `smtp-sender-verify`                       | `NTFY_SMTP_SENDER_VERIFY`                       | *bool*                                              | `false`           | If true, require verified email addresses for email notifications; anonymous email sending is disabled                                                                                                                                  |
 | `smtp-server-listen`                       | `NTFY_SMTP_SERVER_LISTEN`                       | `[ip]:port`                                         | -                 | Defines the IP address and port the SMTP server will listen on, e.g. `:25` or `1.2.3.4:25`                                                                                                                                              |
 | `smtp-server-domain`                       | `NTFY_SMTP_SERVER_DOMAIN`                       | *domain name*                                       | -                 | SMTP server e-mail domain, e.g. `ntfy.sh`                                                                                                                                                                                               |
 | `smtp-server-addr-prefix`                  | `NTFY_SMTP_SERVER_ADDR_PREFIX`                  | *string*                                            | -                 | Optional prefix for the e-mail addresses to prevent spam, e.g. `ntfy-`                                                                                                                                                                  |
@@ -2221,6 +2321,8 @@ variable before running the `ntfy` command (e.g. `export NTFY_LISTEN_HTTP=:80`).
 | `visitor-request-limit-exempt-hosts`       | `NTFY_VISITOR_REQUEST_LIMIT_EXEMPT_HOSTS`       | *comma-separated host/IP/CIDR list*                 | -                 | Rate limiting: List of hostnames and IPs to be exempt from request rate limiting                                                                                                                                                        |
 | `visitor-subscription-limit`               | `NTFY_VISITOR_SUBSCRIPTION_LIMIT`               | *number*                                            | 30                | Rate limiting: Number of subscriptions per visitor (IP address)                                                                                                                                                                         |
 | `visitor-subscriber-rate-limiting`         | `NTFY_VISITOR_SUBSCRIBER_RATE_LIMITING`         | *bool*                                              | `false`           | Rate limiting: Enables subscriber-based rate limiting                                                                                                                                                                                   |
+| `visitor-topic-creation-limit-burst`       | `NTFY_VISITOR_TOPIC_CREATION_LIMIT_BURST`       | *number*                                            | 100               | Rate limiting: Initial bucket of new topic creations per visitor. 0 disables the limit.                                                                                                                                                 |
+| `visitor-topic-creation-limit-replenish`   | `NTFY_VISITOR_TOPIC_CREATION_LIMIT_REPLENISH`   | *duration*                                          | 1m                | Rate limiting: Rate at which the per-visitor topic-creation bucket is refilled (one new topic per x).                                                                                                                                   |
 | `visitor-prefix-bits-ipv4`                 | `NTFY_VISITOR_PREFIX_BITS_IPV4`                 | *number*                                            | 32                | Rate limiting: Number of bits to use for IPv4 visitor prefix, e.g. 24 for /24                                                                                                                                                           |
 | `visitor-prefix-bits-ipv6`                 | `NTFY_VISITOR_PREFIX_BITS_IPV6`                 | *number*                                            | 64                | Rate limiting: Number of bits to use for IPv6 visitor prefix, e.g. 48 for /48                                                                                                                                                           |
 | `web-root`                                 | `NTFY_WEB_ROOT`                                 | *path*, e.g. `/` or `/app`, or `disable`            | `/`               | Sets root of the web app (e.g. /, or /app), or disables it entirely (disable)                                                                                                                                                           |
@@ -2291,7 +2393,8 @@ OPTIONS:
    --auth-file value, --auth_file value, -H value                                                                         auth database file used for access control [$NTFY_AUTH_FILE]
    --auth-startup-queries value, --auth_startup_queries value                                                             queries run when the auth database is initialized [$NTFY_AUTH_STARTUP_QUERIES]
    --auth-default-access value, --auth_default_access value, -p value                                                     default permissions if no matching entries in the auth database are found (default: "read-write") [$NTFY_AUTH_DEFAULT_ACCESS]
-   --attachment-cache-dir value, --attachment_cache_dir value                                                             cache directory for attached files, or S3 URL (s3://ACCESS_KEY:SECRET_KEY@BUCKET[/PREFIX]?region=REGION[&endpoint=ENDPOINT]) [$NTFY_ATTACHMENT_CACHE_DIR]
+   --auth-access-cache, --auth_access_cache                                                                                enables the in-memory ACL cache (high-volume servers only) (default: false) [$NTFY_AUTH_ACCESS_CACHE]
+   --attachment-cache-dir value, --attachment_cache_dir value                                                             cache directory for attached files, or S3 URL (s3://ACCESS_KEY:SECRET_KEY@BUCKET[/PREFIX]?region=REGION[&endpoint=ENDPOINT][&disable_http2=true]) [$NTFY_ATTACHMENT_CACHE_DIR]
    --attachment-total-size-limit value, --attachment_total_size_limit value, -A value                                     limit of the on-disk attachment cache (default: "5G") [$NTFY_ATTACHMENT_TOTAL_SIZE_LIMIT]
    --attachment-file-size-limit value, --attachment_file_size_limit value, -Y value                                       per-file attachment size limit (e.g. 300k, 2M, 100M) (default: "15M") [$NTFY_ATTACHMENT_FILE_SIZE_LIMIT]
    --attachment-expiry-duration value, --attachment_expiry_duration value, -X value                                       duration after which uploaded attachments will be deleted (e.g. 3h, 20h) (default: "3h") [$NTFY_ATTACHMENT_EXPIRY_DURATION]
@@ -2328,6 +2431,8 @@ OPTIONS:
    --visitor-message-daily-limit value, --visitor_message_daily_limit value                                               max messages per visitor per day, derived from request limit if unset (default: 0) [$NTFY_VISITOR_MESSAGE_DAILY_LIMIT]
    --visitor-email-limit-burst value, --visitor_email_limit_burst value                                                   initial limit of e-mails per visitor (default: 16) [$NTFY_VISITOR_EMAIL_LIMIT_BURST]
    --visitor-email-limit-replenish value, --visitor_email_limit_replenish value                                           interval at which burst limit is replenished (one per x) (default: "1h") [$NTFY_VISITOR_EMAIL_LIMIT_REPLENISH]
+   --visitor-topic-creation-limit-burst value, --visitor_topic_creation_limit_burst value                                 burst of new topic creations per visitor (0 = disabled) (default: 100) [$NTFY_VISITOR_TOPIC_CREATION_LIMIT_BURST]
+   --visitor-topic-creation-limit-replenish value, --visitor_topic_creation_limit_replenish value                         interval at which topic-creation tokens are refilled (one per x) (default: "1m") [$NTFY_VISITOR_TOPIC_CREATION_LIMIT_REPLENISH]
    --visitor-prefix-bits-ipv4 value, --visitor_prefix_bits_ipv4 value                                                     number of bits of the IPv4 address to use for rate limiting (default: 32, full address) (default: 32) [$NTFY_VISITOR_PREFIX_BITS_IPV4]
    --visitor-prefix-bits-ipv6 value, --visitor_prefix_bits_ipv6 value                                                     number of bits of the IPv6 address to use for rate limiting (default: 64, /64 subnet) (default: 64) [$NTFY_VISITOR_PREFIX_BITS_IPV6]
    --behind-proxy, --behind_proxy, -P                                                                                     if set, use forwarded header (e.g. X-Forwarded-For, X-Client-IP) to determine visitor IP address (for rate limiting) (default: false) [$NTFY_BEHIND_PROXY]

docs/develop.md

@@ -255,6 +255,7 @@ Reference: <https://stackoverflow.com/questions/34160509/options-for-testing-ser
     go run main.go \
       --log-level debug \
       serve \
+        --base-url http://localhost \
         --web-push-public-key KEY \
         --web-push-private-key KEY \
         --web-push-email-address <email> \

docs/install.md

@@ -28,42 +28,130 @@ resources to get started. _I am not affiliated with Kris or Alex, I just liked t
 Please check out the [releases page](https://github.com/binwiederhier/ntfy/releases) for binaries and
 deb/rpm packages.
 
+### Download and run
+The steps below allow you to download ntfy server and run it in a pinch. But it won't be enough to install it permanently
+as a service starting at boot time.
+
 === "x86_64/amd64"
     ```bash
-    wget https://github.com/binwiederhier/ntfy/releases/download/v2.19.2/ntfy_2.19.2_linux_amd64.tar.gz
-    tar zxvf ntfy_2.19.2_linux_amd64.tar.gz
-    sudo cp -a ntfy_2.19.2_linux_amd64/ntfy /usr/local/bin/ntfy
-    sudo mkdir /etc/ntfy && sudo cp ntfy_2.19.2_linux_amd64/{client,server}/*.yml /etc/ntfy
+    wget https://github.com/binwiederhier/ntfy/releases/download/v2.24.0/ntfy_2.24.0_linux_amd64.tar.gz
+    tar zxvf ntfy_2.24.0_linux_amd64.tar.gz
+    sudo cp -a ntfy_2.24.0_linux_amd64/ntfy /usr/local/bin/ntfy
+    sudo mkdir /etc/ntfy && sudo cp ntfy_2.24.0_linux_amd64/{client,server}/*.yml /etc/ntfy
     sudo ntfy serve
     ```
 
 === "armv6"
     ```bash
-    wget https://github.com/binwiederhier/ntfy/releases/download/v2.19.2/ntfy_2.19.2_linux_armv6.tar.gz
-    tar zxvf ntfy_2.19.2_linux_armv6.tar.gz
-    sudo cp -a ntfy_2.19.2_linux_armv6/ntfy /usr/bin/ntfy
-    sudo mkdir /etc/ntfy && sudo cp ntfy_2.19.2_linux_armv6/{client,server}/*.yml /etc/ntfy
+    wget https://github.com/binwiederhier/ntfy/releases/download/v2.24.0/ntfy_2.24.0_linux_armv6.tar.gz
+    tar zxvf ntfy_2.24.0_linux_armv6.tar.gz
+    sudo cp -a ntfy_2.24.0_linux_armv6/ntfy /usr/bin/ntfy
+    sudo mkdir /etc/ntfy && sudo cp ntfy_2.24.0_linux_armv6/{client,server}/*.yml /etc/ntfy
     sudo ntfy serve
     ```
 
 === "armv7/armhf"
     ```bash
-    wget https://github.com/binwiederhier/ntfy/releases/download/v2.19.2/ntfy_2.19.2_linux_armv7.tar.gz
-    tar zxvf ntfy_2.19.2_linux_armv7.tar.gz
-    sudo cp -a ntfy_2.19.2_linux_armv7/ntfy /usr/bin/ntfy
-    sudo mkdir /etc/ntfy && sudo cp ntfy_2.19.2_linux_armv7/{client,server}/*.yml /etc/ntfy
+    wget https://github.com/binwiederhier/ntfy/releases/download/v2.24.0/ntfy_2.24.0_linux_armv7.tar.gz
+    tar zxvf ntfy_2.24.0_linux_armv7.tar.gz
+    sudo cp -a ntfy_2.24.0_linux_armv7/ntfy /usr/bin/ntfy
+    sudo mkdir /etc/ntfy && sudo cp ntfy_2.24.0_linux_armv7/{client,server}/*.yml /etc/ntfy
     sudo ntfy serve
     ```
 
 === "arm64"
     ```bash
-    wget https://github.com/binwiederhier/ntfy/releases/download/v2.19.2/ntfy_2.19.2_linux_arm64.tar.gz
-    tar zxvf ntfy_2.19.2_linux_arm64.tar.gz
-    sudo cp -a ntfy_2.19.2_linux_arm64/ntfy /usr/bin/ntfy
-    sudo mkdir /etc/ntfy && sudo cp ntfy_2.19.2_linux_arm64/{client,server}/*.yml /etc/ntfy
+    wget https://github.com/binwiederhier/ntfy/releases/download/v2.24.0/ntfy_2.24.0_linux_arm64.tar.gz
+    tar zxvf ntfy_2.24.0_linux_arm64.tar.gz
+    sudo cp -a ntfy_2.24.0_linux_arm64/ntfy /usr/bin/ntfy
+    sudo mkdir /etc/ntfy && sudo cp ntfy_2.24.0_linux_arm64/{client,server}/*.yml /etc/ntfy
     sudo ntfy serve
     ```
 
+### Install as a service
+If you want to install ntfy server permanently as a service, and your OS/distribution of choice doesn't offer a package,
+there are a few more steps to follow.
+
+Create the ntfy user and group:
+```bash
+useradd --system --home-dir /var/lib/ntfy --shell /bin/false --comment "User for the simple HTTP-based pub-sub notification service" ntfy
+```
+
+Depending on your init system, the following steps will diverge.
+
+#### On systemd systems
+Install the ntfy server unit file (which contains parameters to start the service at boot time):
+
+=== "x86_64/amd64"
+    ```bash
+    sudo mv ntfy_2.24.0_linux_amd64/server/ntfy.service /etc/systemd/system/
+    sudo chmod 644 /etc/systemd/system/ntfy.service
+    ```
+
+=== "armv6"
+    ```bash
+    sudo mv ntfy_2.24.0_linux_armv6/server/ntfy.service /etc/systemd/system/
+    sudo chmod 644 /etc/systemd/system/ntfy.service
+    ```
+
+=== "armv7/armhf"
+    ```bash
+    sudo mv ntfy_2.24.0_linux_armv7/server/ntfy.service /etc/systemd/system/
+    sudo chmod 644 /etc/systemd/system/ntfy.service
+    ```
+
+=== "arm64"
+    ```bash
+    sudo mv ntfy_2.24.0_linux_arm64/server/ntfy.service /etc/systemd/system/
+    sudo chmod 644 /etc/systemd/system/ntfy.service
+    ```
+
+Then notify systemd we have added a new service and start the service:
+
+```bash
+sudo systemctl daemon-reload
+sudo systemctl start ntfy
+```
+
+#### On OpenRC systems
+Install the ntfy server service script:
+
+=== "x86_64/amd64"
+    ```bash
+    sudo mv ntfy_2.24.0_linux_amd64/server/ntfy.openrc /etc/init.d/ntfy
+    sudo chmod 755 /etc/init.d/ntfy
+    ```
+
+=== "armv6"
+    ```bash
+    sudo mv ntfy_2.24.0_linux_armv6/server/ntfy.openrc /etc/init.d/ntfy
+    sudo chmod 755 /etc/init.d/ntfy
+    ```
+
+=== "armv7/armhf"
+    ```bash
+    sudo mv ntfy_2.24.0_linux_armv7/server/ntfy.openrc /etc/init.d/ntfy
+    sudo chmod 755 /etc/init.d/ntfy
+    ```
+
+=== "arm64"
+    ```bash
+    sudo mv ntfy_2.24.0_linux_arm64/server/ntfy.openrc /etc/init.d/ntfy
+    sudo chmod 755 /etc/init.d/ntfy
+    ```
+
+Start the ntfy server service:
+
+```bash
+sudo rc-service ntfy start
+```
+
+Add the ntfy server service to the default runlevel (so that it starts at boot time):
+
+```bash
+sudo rc-update add ntfy default
+```
+
 ## Debian/Ubuntu repository
 
 !!! info
@@ -116,7 +204,7 @@ Manually installing the .deb file:
 
 === "x86_64/amd64"
     ```bash
-    wget https://github.com/binwiederhier/ntfy/releases/download/v2.19.2/ntfy_2.19.2_linux_amd64.deb
+    wget https://github.com/binwiederhier/ntfy/releases/download/v2.24.0/ntfy_2.24.0_linux_amd64.deb
     sudo dpkg -i ntfy_*.deb
     sudo systemctl enable ntfy
     sudo systemctl start ntfy
@@ -124,7 +212,7 @@ Manually installing the .deb file:
 
 === "armv6"
     ```bash
-    wget https://github.com/binwiederhier/ntfy/releases/download/v2.19.2/ntfy_2.19.2_linux_armv6.deb
+    wget https://github.com/binwiederhier/ntfy/releases/download/v2.24.0/ntfy_2.24.0_linux_armv6.deb
     sudo dpkg -i ntfy_*.deb
     sudo systemctl enable ntfy
     sudo systemctl start ntfy
@@ -132,7 +220,7 @@ Manually installing the .deb file:
 
 === "armv7/armhf"
     ```bash
-    wget https://github.com/binwiederhier/ntfy/releases/download/v2.19.2/ntfy_2.19.2_linux_armv7.deb
+    wget https://github.com/binwiederhier/ntfy/releases/download/v2.24.0/ntfy_2.24.0_linux_armv7.deb
     sudo dpkg -i ntfy_*.deb
     sudo systemctl enable ntfy
     sudo systemctl start ntfy
@@ -140,7 +228,7 @@ Manually installing the .deb file:
 
 === "arm64"
     ```bash
-    wget https://github.com/binwiederhier/ntfy/releases/download/v2.19.2/ntfy_2.19.2_linux_arm64.deb
+    wget https://github.com/binwiederhier/ntfy/releases/download/v2.24.0/ntfy_2.24.0_linux_arm64.deb
     sudo dpkg -i ntfy_*.deb
     sudo systemctl enable ntfy
     sudo systemctl start ntfy
@@ -150,28 +238,28 @@ Manually installing the .deb file:
 
 === "x86_64/amd64"
     ```bash
-    sudo rpm -ivh https://github.com/binwiederhier/ntfy/releases/download/v2.19.2/ntfy_2.19.2_linux_amd64.rpm
+    sudo rpm -ivh https://github.com/binwiederhier/ntfy/releases/download/v2.24.0/ntfy_2.24.0_linux_amd64.rpm
     sudo systemctl enable ntfy 
     sudo systemctl start ntfy
     ```
 
 === "armv6"
     ```bash
-    sudo rpm -ivh https://github.com/binwiederhier/ntfy/releases/download/v2.19.2/ntfy_2.19.2_linux_armv6.rpm
+    sudo rpm -ivh https://github.com/binwiederhier/ntfy/releases/download/v2.24.0/ntfy_2.24.0_linux_armv6.rpm
     sudo systemctl enable ntfy
     sudo systemctl start ntfy
     ```
 
 === "armv7/armhf"
     ```bash
-    sudo rpm -ivh https://github.com/binwiederhier/ntfy/releases/download/v2.19.2/ntfy_2.19.2_linux_armv7.rpm
+    sudo rpm -ivh https://github.com/binwiederhier/ntfy/releases/download/v2.24.0/ntfy_2.24.0_linux_armv7.rpm
     sudo systemctl enable ntfy 
     sudo systemctl start ntfy
     ```
 
 === "arm64"
     ```bash
-    sudo rpm -ivh https://github.com/binwiederhier/ntfy/releases/download/v2.19.2/ntfy_2.19.2_linux_arm64.rpm
+    sudo rpm -ivh https://github.com/binwiederhier/ntfy/releases/download/v2.24.0/ntfy_2.24.0_linux_arm64.rpm
     sudo systemctl enable ntfy 
     sudo systemctl start ntfy
     ```
@@ -213,18 +301,18 @@ pkg install go-ntfy
 
 ## macOS
 The [ntfy CLI](subscribe/cli.md) (`ntfy publish` and `ntfy subscribe` only) is supported on macOS as well. 
-To install, please [download the tarball](https://github.com/binwiederhier/ntfy/releases/download/v2.19.2/ntfy_2.19.2_darwin_all.tar.gz), 
+To install, please [download the tarball](https://github.com/binwiederhier/ntfy/releases/download/v2.24.0/ntfy_2.24.0_darwin_all.tar.gz), 
 extract it and place it somewhere in your `PATH` (e.g. `/usr/local/bin/ntfy`). 
 
 If run as `root`, ntfy will look for its config at `/etc/ntfy/client.yml`. For all other users, it'll look for it at 
 `~/Library/Application Support/ntfy/client.yml` (sample included in the tarball).
 
 ```bash
-curl -L https://github.com/binwiederhier/ntfy/releases/download/v2.19.2/ntfy_2.19.2_darwin_all.tar.gz > ntfy_2.19.2_darwin_all.tar.gz
-tar zxvf ntfy_2.19.2_darwin_all.tar.gz
-sudo cp -a ntfy_2.19.2_darwin_all/ntfy /usr/local/bin/ntfy
+curl -L https://github.com/binwiederhier/ntfy/releases/download/v2.24.0/ntfy_2.24.0_darwin_all.tar.gz > ntfy_2.24.0_darwin_all.tar.gz
+tar zxvf ntfy_2.24.0_darwin_all.tar.gz
+sudo cp -a ntfy_2.24.0_darwin_all/ntfy /usr/local/bin/ntfy
 mkdir ~/Library/Application\ Support/ntfy 
-cp ntfy_2.19.2_darwin_all/client/client.yml ~/Library/Application\ Support/ntfy/client.yml
+cp ntfy_2.24.0_darwin_all/client/client.yml ~/Library/Application\ Support/ntfy/client.yml
 ntfy --help
 ```
 
@@ -245,7 +333,7 @@ brew install ntfy
 The ntfy server and CLI are fully supported on Windows. You can run the ntfy server directly or as a Windows service.
 To install, you can either
 
-* [Download the latest ZIP](https://github.com/binwiederhier/ntfy/releases/download/v2.19.2/ntfy_2.19.2_windows_amd64.zip),
+* [Download the latest ZIP](https://github.com/binwiederhier/ntfy/releases/download/v2.24.0/ntfy_2.24.0_windows_amd64.zip),
 extract it and place the `ntfy.exe` binary somewhere in your `%Path%`. 
 * Or install ntfy from the [Scoop](https://scoop.sh) main repository via `scoop install ntfy`
 

docs/integrations.md

@@ -89,6 +89,7 @@ I've added a ⭐ to projects or posts that have a significant following, or had
 - [ntfy-desktop](https://codeberg.org/zvava/ntfy-desktop) - Cross-platform desktop application for ntfy
 - [ntfy-desktop](https://github.com/Aetherinox/ntfy-desktop) - Desktop client for Windows, Linux, and MacOS with push notifications
 - [ntfy svelte front-end](https://github.com/novatorem/Ntfy) - Front-end built with svelte
+- [ntfy Desktop (Windows)](https://github.com/simoneferrari/ntfy-desktop) - Native Windows desktop client with multi-server support, toast notifications and message history, built with WPF and .NET (C#)
 - [wio-ntfy-ticker](https://github.com/nachotp/wio-ntfy-ticker) - Ticker display for a ntfy.sh topic
 - [ntfysh-windows](https://github.com/mshafer1/ntfysh-windows) - A ntfy client for Windows Desktop
 - [ntfyr](https://github.com/haxwithaxe/ntfyr) - A simple commandline tool to send notifications to ntfy
@@ -98,6 +99,7 @@ I've added a ⭐ to projects or posts that have a significant following, or had
 - [Daily Fact Ntfy](https://github.com/thiswillbeyourgithub/Daily_Fact_Ntfy) - Generate [llm](https://github.com/simonw/llm) generated fact every day about any topic you're interested in.
 - [ntfyexec](https://github.com/alecthomas/ntfyexec) - Send a notification through ntfy.sh if a command fails
 - [Ntfy Desktop](https://github.com/emmaexe/ntfyDesktop) - Fully featured desktop client for Linux, built with Qt and C++.
+- [Ntfy App](https://github.com/rubix-studios-pty-ltd/ntfy-app) - Tauri/Rust desktop client for Windows, Linux and MacOS with push notifications.
 
 ## Projects + scripts 
 
@@ -107,6 +109,7 @@ I've added a ⭐ to projects or posts that have a significant following, or had
 - [ntfy-long-zsh-command](https://github.com/robfox92/ntfy-long-zsh-command) - Notifies you once a long-running command completes (zsh)
 - [ntfy-shellscripts](https://github.com/nickexyz/ntfy-shellscripts) - A few scripts for the ntfy project (Shell)
 - [alertmanager-ntfy-relay](https://github.com/therobbielee/alertmanager-ntfy-relay) - ntfy.sh relay for Alertmanager (Go)
+- [oci-notifications-ntfy-relay](https://github.com/Ryan02I5/oci-notifications-ntfy-relay) - Minimal OCI Notifications / Oracle Functions relay to ntfy topics (Python)
 - [QuickStatus](https://github.com/corneliusroot/QuickStatus) - A shell script to alert to any immediate problems upon login (Shell)
 - [ntfy.el](https://github.com/shombando/ntfy) - Send notifications from Emacs (Emacs)
 - [backup-projects](https://gist.github.com/anthonyaxenov/826ba65abbabd5b00196bc3e6af76002) - Stupidly simple backup script for own projects (Shell)
@@ -189,6 +192,7 @@ I've added a ⭐ to projects or posts that have a significant following, or had
 
 ## Blog + forum posts
 
+- [Push alerts for WHM using ntfy](https://rubixstudios.com.au/insights/push-alerts-for-whm-using-ntfy) - rubixstudios.com.au - 5/2026
 - [Device notifications via HTTP with ntfy](https://alistairshepherd.uk/writing/ntfy/) - alistairshepherd.uk - 6/2025
 - [Notifications about (almost) anything with ntfy.sh](https://hamatti.org/posts/notifications-about-almost-anything-with-ntfy-sh/) - hamatti.org - 6/2025
 - [I set up a self-hosted notification service for everything, and I'll never look back](https://www.xda-developers.com/set-up-self-hosted-notification-service/) ⭐ - xda-developers.com - 5/2025

docs/privacy.md

@@ -1,6 +1,6 @@
 # Privacy policy
 
-**Last updated:** January 2, 2026
+**Last updated:** March 31, 2026
 
 This privacy policy describes how ntfy ("we", "us", or "our") collects, uses, and handles your information
 when you use the ntfy.sh service, web app, and mobile applications (Android and iOS).
@@ -19,7 +19,8 @@ If you create an account on ntfy.sh, we collect:
 
 - **Username** - A unique identifier you choose
 - **Password** - Stored as a secure bcrypt hash (we never store your plaintext password)
-- **Email address** - Only if you subscribe to a paid plan (for billing purposes)
+- **Email address** - If you subscribe to a paid plan (for billing purposes via Stripe), or if you add a verified
+  email address for use with the email notification feature
 - **Phone number** - Only if you enable the phone call notification feature (verified via SMS/call)
 
 You can use ntfy without creating an account. Anonymous usage is fully supported.
@@ -143,6 +144,7 @@ No cookies are used for tracking. The web app does not have a backend beyond the
 | Attachments            | 3 hours (configurable by server operators)        |
 | User accounts          | Until you delete your account                     |
 | Access tokens          | Until you revoke them or delete your account      |
+| Email addresses        | Until you remove them or delete your account      |
 | Phone numbers          | Until you remove them or delete your account      |
 | Web push subscriptions | 60 days of inactivity, then automatically removed |
 | Server logs            | Varies; debugging logs are typically temporary    |

docs/publish.md

@@ -492,6 +492,11 @@ You can set the priority with the header `X-Priority` (or any of its aliases: `P
   <figcaption>Detail view of priority notifications</figcaption>
 </figure>
 
+On **iOS**, max priority (`5`) messages are delivered as [critical alerts](https://developer.apple.com/documentation/usernotifications/unnotificationinterruptionlevel/critical),
+which break through silent mode and Do Not Disturb and play a sound at full volume. You must grant ntfy
+permission to send critical alerts (the app asks for it on first launch; it can also be toggled in
+**iOS Settings > Notifications > ntfy**).
+
 ## Tags & emojis 🥳 🎉
 _Supported on:_ :material-android: :material-apple: :material-firefox:
 
@@ -932,7 +937,7 @@ Here's an example of how it will look on Android:
 </figure>
 
 ## Attachments
-_Supported on:_ :material-android: :material-firefox:
+_Supported on:_ :material-android: :material-apple: :material-firefox:
 
 You can **send images and other files to your phone** as attachments to a notification. The attachments are then downloaded
 onto your phone (depending on size and setting automatically), and can be used from the Downloads folder.
@@ -3213,12 +3218,18 @@ You can forward messages to e-mail by specifying an address in the header. This
 you'd like to persist longer, or to blast-notify yourself on all possible channels. 
 
 Usage is easy: Simply pass the `X-Email` header (or any of its aliases: `X-E-mail`, `Email`, `E-mail`, `Mail`, or `e`).
-Only one e-mail address is supported.
+Only one e-mail address is supported. If the server has [`smtp-sender-verify`](config.md#e-mail-notifications) enabled (ntfy.sh has this enabled),
+you can also pass `yes`, `true`, or `1` to send to your first verified email address.
 
-Since ntfy does not provide auth (yet), the rate limiting is pretty strict (see [limitations](#limitations)). In the 
-default configuration, you get **16 e-mails per visitor** (IP address) and then after that one per hour. On top of 
+ntfy allows anonymous email sending (if enabled), so the rate limiting is pretty strict (see [limitations](#limitations)). In the
+default configuration, you get **16 e-mails per visitor** (IP address) and then after that one per hour. On top of
 that, your IP address appears in the e-mail body. This is to prevent abuse.
 
+!!! info
+    On ntfy.sh, anonymous email sending was disabled due to abuse. To use the email notification feature,
+    you must verify your email in the web app's [Account section](https://ntfy.sh/account). The daily limit for
+    free users is **5 emails per visitor per day**.
+
 === "Command line (curl)"
     ```
     curl \
@@ -3658,7 +3669,7 @@ all the supported fields:
 | `icon`        | -        | *string*                         | `https://example.com/icon.png`            | URL to use as notification [icon](#icons)                                                 |
 | `filename`    | -        | *string*                         | `file.jpg`                                | File name of the attachment                                                               |
 | `delay`       | -        | *string*                         | `30min`, `9am`                            | Timestamp or duration for delayed delivery                                                |
-| `email`       | -        | *e-mail address*                 | `phil@example.com`                        | E-mail address for e-mail notifications                                                   |
+| `email`       | -        | *e-mail address or 'yes'*        | `phil@example.com` or `yes`               | E-mail address for e-mail notifications, or `yes` to use first verified address           |
 | `call`        | -        | *phone number or 'yes'*          | `+1222334444` or `yes`                    | Phone number to use for [voice call](#phone-calls)                                        |
 | `sequence_id` | -        | *string*                         | `my-sequence-123`                         | Sequence ID for [updating/deleting notifications](#updating-deleting-notifications)   |
 
@@ -4871,7 +4882,7 @@ table in their canonical form.
 | `X-Markdown`    | `Markdown`, `md`                           | Enable [Markdown formatting](#markdown-formatting) in the notification body                   |
 | `X-Icon`        | `Icon`                                     | URL to use as notification [icon](#icons)                                                     |
 | `X-Filename`    | `Filename`, `file`, `f`                    | Optional [attachment](#attachments) filename, as it appears in the client                     |
-| `X-Email`       | `X-E-Mail`, `Email`, `E-Mail`, `mail`, `e` | E-mail address for [e-mail notifications](#e-mail-notifications)                              |
+| `X-Email`       | `X-E-Mail`, `Email`, `E-Mail`, `mail`, `e` | E-mail address (or `yes`) for [e-mail notifications](#e-mail-notifications)                   |
 | `X-Call`        | `Call`                                     | Phone number for [phone calls](#phone-calls)                                                  |
 | `X-Cache`       | `Cache`                                    | Allows disabling [message caching](#message-caching)                                          |
 | `X-Firebase`    | `Firebase`                                 | Allows disabling [sending to Firebase](#disable-firebase)                                     |

docs/releases.md

@@ -6,12 +6,162 @@ and the [ntfy Android app](https://github.com/binwiederhier/ntfy-android/release
 
 | Component        | Version | Release date |
 |------------------|---------|--------------|
-| ntfy server      | v2.19.2 | Mar 16, 2026 |
+| ntfy server      | v2.24.0 | June 4, 2026 |
 | ntfy Android app | v1.24.0 | Mar 5, 2026  |
-| ntfy iOS app     | v1.3    | Nov 26, 2023 |
+| ntfy iOS app     | v1.7.0  | May 30, 2026 |
 
 Please check out the release notes for [upcoming releases](#not-released-yet) below.
 
+### ntfy server v2.24.0
+Released June 4, 2026
+
+The main feature for this release is an in-memory ACL cache (`auth-access-cache`) that can help bring down the read load
+on the production database. The topic authorization queries are consistently the highest ranking queries on the database,
+so this will help quite a bit. The current database load is quite low, but I'm expecting it to increase as more users join
+and use ntfy.
+
+**Security issues:**
+
+* Fix case-insensitive ACL topic matching on SQLite: an access control rule for `secret` no longer also matches a request for `SECRET`. SQLite's `LIKE` is case-insensitive for ASCII by default. PostgreSQL was unaffected. It's honestly incredible that this issue remained undetected for so long, especially while ntfy.sh was running on SQLite (it now runs on PostgreSQL).
+
+**Features:**
+
+* Add opt-in in-memory ACL cache (`auth-access-cache`) that serves topic authorization without a database round-trip; off by default, intended for high-volume servers
+* Add `ntfy --version` flag to the CLI ([#1722](https://github.com/binwiederhier/ntfy/issues/1722), [#1748](https://github.com/binwiederhier/ntfy/pull/1748), thanks to [@sskender](https://github.com/sskender) for the contribution, and [@Saucy9607](https://github.com/Saucy9607) for reporting)
+
+**Bug fixes + maintenance:**
+
+* Extend account token automatically from the PWA service worker, so installed PWAs don't get logged out ([#1669](https://github.com/binwiederhier/ntfy/pull/1669), [#1203](https://github.com/binwiederhier/ntfy/issues/1203), [#1533](https://github.com/binwiederhier/ntfy/issues/1533), thanks to [@nihalgonsalves](https://github.com/nihalgonsalves) for the contribution)
+* Fix `rel` attribute on auto-linked notification URLs so `noreferrer`/`noopener` are actually applied ([#1720](https://github.com/binwiederhier/ntfy/pull/1720), thanks to [@dmitrylyzo](https://github.com/dmitrylyzo) for the contribution)
+* Add systemd sandboxing/hardening to the `ntfy.service` unit ([#1467](https://github.com/binwiederhier/ntfy/pull/1467), thanks to [@Velocifyer](https://github.com/Velocifyer) for the contribution)
+* Fix `cmd` package build on macOS (darwin) so the server compiles from source ([#1631](https://github.com/binwiederhier/ntfy/issues/1631), [#1696](https://github.com/binwiederhier/ntfy/pull/1696), thanks to [@ShipItAndPray](https://github.com/ShipItAndPray) for the contribution, and [@XYenon](https://github.com/XYenon) for reporting)
+
+## ntfy iOS app v1.7.0
+Released May 30, 2026
+
+This release brings **image and attachment support** to the iOS app, finally closing one of the longest-standing iOS
+feature gaps. Images sent via the `Attach` header (or as a PUT body) are now previewed inline in the notification banner
+and inside the app, and other attachments can be downloaded, previewed via Quick Look, and shared from the notification
+row. There's also a new "Download attachments" setting to control auto-download by size.
+
+**Features:**
+
+* Show image previews in notifications and inline in the notification list, with tap-to-zoom Quick Look preview and share sheet ([ntfy-ios#40](https://github.com/binwiederhier/ntfy-ios/pull/40), [#276](https://github.com/binwiederhier/ntfy/issues/276), [#1226](https://github.com/binwiederhier/ntfy/issues/1226), thanks to [@am7590](https://github.com/am7590) for the contribution)
+* Download non-image attachments on demand with progress indication, persist them locally, and reuse files already fetched by the notification service extension ([ntfy-ios#40](https://github.com/binwiederhier/ntfy-ios/pull/40), thanks to [@am7590](https://github.com/am7590) for the contribution)
+* Add "Download attachments" setting with size thresholds (Never, Under 100 KB / 500 KB / 1 MB / 5 MB / 10 MB / 50 MB, Always) to control automatic attachment downloads ([ntfy-ios#40](https://github.com/binwiederhier/ntfy-ios/pull/40), thanks to [@am7590](https://github.com/am7590) for the contribution)
+
+**Bug fixes + maintenance:**
+
+* Improve background download reliability so attachments continue downloading when the app is suspended ([ntfy-ios#40](https://github.com/binwiederhier/ntfy-ios/pull/40), thanks to [@am7590](https://github.com/am7590) for the contribution)
+* Reorganize notification and subscription views into their own folders and split out `NotificationRowView` for readability ([ntfy-ios#40](https://github.com/binwiederhier/ntfy-ios/pull/40), thanks to [@am7590](https://github.com/am7590) for the contribution)
+
+## ntfy server v2.23.0
+Released May 17, 2026
+
+**Features:**
+
+* Add per-visitor rate limit on new topic creations (`visitor-topic-creation-limit-burst` / `visitor-topic-creation-limit-replenish`, defaults 100 burst / 1m replenish) to mitigate topic-enumeration / squatting attacks that inflate the in-memory topic map
+
+**Bug fixes + maintenance:**
+
+* Remove `stacktrace-js`, `stacktrace-gps`, `humanize-duration`, and `js-base64` from the web app to reduce dependency and security footprint
+* Restrict the publish dialog's local file preview to safe image types (png/jpg/gif/webp) to prevent same-origin script execution from blob URLs when previewing a crafted SVG ([GHSA-j8hr-p342-xrmh](https://github.com/binwiederhier/ntfy/security/advisories/GHSA-j8hr-p342-xrmh), thanks to [@Venukamatchi](https://github.com/Venukamatchi) for reporting)
+
+## ntfy iOS app v1.6.0
+Released May 12, 2026
+
+**Bug fixes + maintenance:**
+
+* Fix crash in iOS v1.5.1 ([#1736](https://github.com/binwiederhier/ntfy/issues/1736), thanks to [@russ-who](https://github.com/russ-who) for reporting and [@am7590](https://github.com/am7590) for fixing)
+
+**Features:**
+
+* Tap a notification to open its click URL, or copy the message text if no click URL is set; inline URLs in message text are now tappable as well ([ntfy-ios#37](https://github.com/binwiederhier/ntfy-ios/pull/37), thanks to [@am7590](https://github.com/am7590) for the contribution)
+
+## ntfy iOS app v1.5.1
+Released April 27, 2026
+
+This release continues the iOS stability push from v1.4.1, with improved background polling reliability, better error
+handling and logging, and a few small UI fixes. The minimum supported iOS version is now iOS 15.
+
+**Features:**
+
+* Bump minimum iOS version to iOS 15 ([ntfy-ios#36](https://github.com/binwiederhier/ntfy-ios/pull/36), thanks to [@am7590](https://github.com/am7590) for the contribution)
+
+**Bug fixes + maintenance:**
+
+* Improve background poll reliability by waiting for polls to finish before calling the fetch completion handler, and saving notifications on the Core Data context queue ([ntfy-ios#34](https://github.com/binwiederhier/ntfy-ios/pull/34), thanks to [@am7590](https://github.com/am7590) for the contribution)
+* Make `poll_request` parsing more tolerant and surface concrete poll errors instead of failing silently ([ntfy-ios#34](https://github.com/binwiederhier/ntfy-ios/pull/34), thanks to [@am7590](https://github.com/am7590) for the contribution)
+* Poll subscriptions when the subscribed topics list appears, for more reactive updates ([ntfy-ios#34](https://github.com/binwiederhier/ntfy-ios/pull/34), thanks to [@am7590](https://github.com/am7590) for the contribution)
+* Fix bug where tapping "Add user" a second time would briefly open and then dismiss the add user view ([ntfy-ios#35](https://github.com/binwiederhier/ntfy-ios/pull/35), thanks to [@am7590](https://github.com/am7590) for the contribution)
+* Split `SettingsView` into separate files to improve readability ([ntfy-ios#35](https://github.com/binwiederhier/ntfy-ios/pull/35), thanks to [@am7590](https://github.com/am7590) for the contribution)
+* Add Firebase subscribe/unsubscribe logging to aid debugging ([ntfy-ios#34](https://github.com/binwiederhier/ntfy-ios/pull/34), thanks to [@am7590](https://github.com/am7590) for the contribution)
+
+## ntfy server v2.22.0
+Released April 21, 2026
+
+**Bug fixes + maintenance:**
+
+* Tighten web push endpoint allow-list regex to prevent SSRF via unanchored pattern matching ([GHSA-w9hq-5jg7-q4j7](https://github.com/binwiederhier/ntfy/security/advisories/GHSA-w9hq-5jg7-q4j7), thanks to [@MightyNawaf](https://github.com/MightyNawaf) for reporting)
+* Fix web app not allowing access tokens to be changed to never expire ([#1693](https://github.com/binwiederhier/ntfy/issues/1693)/[#1694](https://github.com/binwiederhier/ntfy/pull/1694), thanks to [@lastsamurai26](https://github.com/lastsamurai26) for reporting and to [@ShipItAndPray](https://github.com/ShipItAndPray) for fixing)
+* Fix web app crashing on account page for tokens without a last access time ([#1651](https://github.com/binwiederhier/ntfy/issues/1651), [#1684](https://github.com/binwiederhier/ntfy/issues/1684), thanks to [@Pulsar7](https://github.com/Pulsar7) and [@rzhli](https://github.com/rzhli) for reporting)
+
+## ntfy iOS app v1.4.1
+Released April 14, 2026
+
+This is the first iOS release in 3 years, focusing on stability fixes as per the [iOS improvement plan](https://github.com/binwiederhier/ntfy/issues/1680).
+
+**Bug fixes + maintenance:**
+
+* Fix crash when deleting notifications ([ntfy-ios#33](https://github.com/binwiederhier/ntfy-ios/pull/33), [#1642](https://github.com/binwiederhier/ntfy/issues/1642), [#377](https://github.com/binwiederhier/ntfy/issues/377), thanks to [@am7590](https://github.com/am7590) for the contribution)
+* Fix topic normalization for base URLs and refresh list after sending test notification ([ntfy-ios#32](https://github.com/binwiederhier/ntfy-ios/pull/32), [#337](https://github.com/binwiederhier/ntfy/issues/337), thanks to [@am7590](https://github.com/am7590) for the contribution)
+
+## ntfy server v2.21.0
+Released March 30, 2026
+
+This release adds the ability to verify email addresses using the `smtp-sender-verify` flag. This is a change that is
+required because ntfy.sh was used to send unsolicited emails and the AWS SES account was suspended. Going forward,
+ntfy.sh won't be able to send emails unless the email address was verified ahead of time.
+
+**Features:**
+
+* Add verified email recipients feature with `smtp-sender-verify` config flag, allowing server admins to require email
+  address verification before sending email notifications ([#1681](https://github.com/binwiederhier/ntfy/pull/1681))
+
+## ntfy server v2.20.1
+Released March 27, 2026
+
+This is a small bugfix release that only affects high volume S3 backends that struggle with HTTP/2.
+
+**Bug fixes + maintenance:**
+
+* [Attachments](config.md#attachments): Add `disable_http2=true` S3 URL option to work around HTTP/2 stream errors with DigitalOcean Spaces and other S3-compatible providers ([#1678](https://github.com/binwiederhier/ntfy/issues/1678)/[#1679](https://github.com/binwiederhier/ntfy/pull/1679))
+
+## ntfy server v2.20.0
+Released March 26, 2026
+
+This release is another step towards making it possible to help scale ntfy up and out 🔥! With this release, you can store
+attachments in an S3-compatible object store as an alterative to the directory. See [attachment store](config.md#attachments)
+for details.
+
+!!! warning
+    With this release, ntfy will take full control over the attachment directory or S3 bucket. Files/objects in the configured `attachment-cache-dir`
+    that match the message ID format (12 chars, matching `^[A-Za-z0-9]{12}$`), and have no entries in the message database will be deleted.
+    **Do not use a directory or S3 bucket as `attachment-cache-dir` that is also used for something else.**
+
+    This is a small behavioral change that was necessary because the old logic often left attachments behind and would not clean them
+    up. Unless you have re-used the attachment directory for anything else (which is hopefully never done), this should not affect
+    you at all.
+
+**Features:**
+
+* Add S3-compatible object storage as an alternative [attachment store](config.md#attachments) via `attachment-cache-dir` config option ([#1656](https://github.com/binwiederhier/ntfy/pull/1656)/[#1672](https://github.com/binwiederhier/ntfy/pull/1672))
+
+**Bug fixes + maintenance:**
+
+* Reject invalid e-mail addresses (e.g. multiple comma-separated recipients) with HTTP 400
+* Add OpenRC init service file ([#1650](https://github.com/binwiederhier/ntfy/pull/1650), thanks to [@ageru](https://github.com/ageru) for the contribution)
+
 ## ntfy server v2.19.2
 Released March 16, 2026
 
@@ -1798,25 +1948,48 @@ and the [ntfy Android app](https://github.com/binwiederhier/ntfy-android/release
 
 ## Not released yet
 
-### ntfy server v2.20.x (UNRELEASED)
-
-This release is another step towards making it possible to help scale ntfy up and out 🔥! With this release, you can store
-attachments in an S3-compatible object store as an alterative to the directory. See [attachment store](config.md#attachments)
-for details.
-
-!!! warning
-    With this release, ntfy will take full control over the attachment directory or S3 bucket. Files/objects in the configured `attachment-cache-dir`
-    that match the message ID format (12 chars, matching `^[A-Za-z0-9]{12}$`), and have no entries in the message database will be deleted.
-    **Do not use a directory or S3 bucket as `attachment-cache-dir` that is also used for something else.**
-    
-    This is a small behavioral change that was necessary because the old logic often left attachments behind and would not clean them
-    up. Unless you have re-used the attachment directory for anything else (which is hopefully never done), this should not affect
-    you at all.
+### ntfy server v2.25.0 (UNRELEASED)
 
 **Features:**
 
-* Add S3-compatible object storage as an alternative [attachment store](config.md#attachments) via `attachment-cache-dir` config option ([#1656](https://github.com/binwiederhier/ntfy/pull/1656)/[#1672](https://github.com/binwiederhier/ntfy/pull/1672))
+* Send priority 5 (max/urgent) messages as iOS critical alerts (APNs critical sound + `interruption-level`), so they bypass silent mode and Do Not Disturb ([ntfy-ios#44](https://github.com/binwiederhier/ntfy-ios/pull/44), thanks to [@am7590](https://github.com/am7590) for the iOS app contribution)
+
+### ntfy Android v1.25.x (UNRELEASED)
+
+This release makes the "connection lost" alert configurable and turns it off by default. Folks did not like it and many reached out
+or even gave ntfy bad reviews. I heard you! You can re-enable the alert in the advanced settings.
+
+The release also tries to be smarter about not retrying the connection at all if the app is in flight mode, or has no network. If there
+is no network, ntfy will now stop the foreground service entirely.
+
+Another change related to the networking is that we now force-reconnect when the connection is changed, e.g. during transitions
+from Wi-Fi to cellular network, or vice versa. That should allow for faster transitions during hand-overs.
+
+We also increase the client-side WebSocket ping interval from 1 minute to 3 minutes, which should slightly improve battery life,
+especially when paired with increaseing the server-side `keepalive-interval` in your self-hosted server. 
+
+**Features:**
+
+* Add configurable "Alert when connection is lost" setting ([#1665](https://github.com/binwiederhier/ntfy/issues/1665), [#1662](https://github.com/binwiederhier/ntfy/issues/1662), [#1652](https://github.com/binwiederhier/ntfy/issues/1652), [#1655](https://github.com/binwiederhier/ntfy/issues/1655), thanks to [@tintamarre](https://github.com/tintamarre), [@sjozs](https://github.com/sjozs), [@TheRealOne78](https://github.com/TheRealOne78), and [@DAE51D](https://github.com/DAE51D) for reporting)
+* Suppress connection alerts and stop foreground service when there is no network ([ntfy-android#165](https://github.com/binwiederhier/ntfy-android/pull/165), thanks to [@tintamarre](https://github.com/tintamarre) for the contribution)
+* Restart the foreground service immediately when network returns, even if the app process was killed while offline
+* Improve battery life by increasing WebSocket client ping interval from 1 min to 3 min, and reconnect instantly on Wi-Fi/cellular/VPN transitions ([ntfy-android#113](https://github.com/binwiederhier/ntfy-android/pull/113), thanks to [@ftilde](https://github.com/ftilde) for the investigation)
+* Disable UnifiedPush components when UnifiedPush is disabled in settings ([ntfy-android#168](https://github.com/binwiederhier/ntfy-android/pull/168), thanks to [@p1gp1g](https://github.com/p1gp1g) for the contribution)
 
 **Bug fixes + maintenance:**
 
-* Reject invalid e-mail addresses (e.g. multiple comma-separated recipients) with HTTP 400
+* Undo automatic phone number linking for numbers in message body ([ntfy-android#170](https://github.com/binwiederhier/ntfy-android/pull/170), thanks to [@acortelyou](https://github.com/acortelyou) for the contribution)
+* Fix subscription icons disappearing after a few days due to Android clearing cache ([#1322](https://github.com/binwiederhier/ntfy/issues/1322), thanks to [@mcanning](https://github.com/mcanning) for reporting)
+
+### ntfy iOS app v1.8.0 (UNRELEASED)
+
+**Features:**
+
+* Deliver priority 5 (max/urgent) notifications as critical alerts that bypass silent mode and Do Not Disturb ([ntfy-ios#44](https://github.com/binwiederhier/ntfy-ios/pull/44), thanks to [@am7590](https://github.com/am7590) for the contribution)
+* Apply the attachment auto-download size setting to all attachment types, not just images ([ntfy-ios#43](https://github.com/binwiederhier/ntfy-ios/pull/43), thanks to [@am7590](https://github.com/am7590) for the contribution)
+
+**Bug fixes + maintenance:**
+
+* Restore the native swipe-to-go-back gesture in the topic detail view ([ntfy-ios#45](https://github.com/binwiederhier/ntfy-ios/pull/45), thanks to [@am7590](https://github.com/am7590) for the contribution)
+* Fix saved attachments being left "in use" so they couldn't be deleted in the Files app ([ntfy-ios#43](https://github.com/binwiederhier/ntfy-ios/pull/43), thanks to [@am7590](https://github.com/am7590) for the contribution)
+* Improve poll request subscription matching for protected topics so notifications resolve to the real message content, with better logging ([ntfy-ios#43](https://github.com/binwiederhier/ntfy-ios/pull/43), thanks to [@am7590](https://github.com/am7590) for the contribution)

docs/static/js/config-generator.js

@@ -125,6 +125,7 @@
     { key: "smtp-sender-from", env: "NTFY_SMTP_SENDER_FROM", section: "smtp-out" },
     { key: "smtp-sender-user", env: "NTFY_SMTP_SENDER_USER", section: "smtp-out" },
     { key: "smtp-sender-pass", env: "NTFY_SMTP_SENDER_PASS", section: "smtp-out" },
+    { key: "smtp-sender-verify", env: "NTFY_SMTP_SENDER_VERIFY", section: "smtp-out", type: "bool" },
     { key: "smtp-server-listen", env: "NTFY_SMTP_SERVER_LISTEN", section: "smtp-in" },
     { key: "smtp-server-domain", env: "NTFY_SMTP_SERVER_DOMAIN", section: "smtp-in" },
     { key: "smtp-server-addr-prefix", env: "NTFY_SMTP_SERVER_ADDR_PREFIX", section: "smtp-in" },
@@ -171,6 +172,7 @@
       requireLoginHidden: modal.querySelector("#cg-require-login-hidden"),
       signupHidden: modal.querySelector("#cg-enable-signup-hidden"),
       proxyCheckbox: modal.querySelector("#cg-behind-proxy"),
+      smtpSenderVerifyHidden: modal.querySelector("#cg-smtp-sender-verify-hidden"),
       dbStep: modal.querySelector("#cg-wizard-db"),
       navDb: modal.querySelector("#cg-nav-database"),
       navEmail: modal.querySelector("#cg-nav-email"),
@@ -743,6 +745,10 @@
     const signupYes = modal.querySelector("input[name=\"cg-enable-signup\"][value=\"yes\"]");
     if (signupYes && signupHidden) signupHidden.checked = signupYes.checked;
 
+    // SMTP sender verify radio → hidden checkbox
+    const smtpVerifyYes = modal.querySelector("input[name=\"cg-smtp-sender-verify\"][value=\"yes\"]");
+    if (smtpVerifyYes && els.smtpSenderVerifyHidden) els.smtpSenderVerifyHidden.checked = smtpVerifyYes.checked;
+
     return loginModeVal;
   }
 

go.mod

@@ -1,25 +1,25 @@
 module heckel.io/ntfy/v2
 
-go 1.25.0
+go 1.25.8
 
 require (
-	cloud.google.com/go/firestore v1.21.0 // indirect
-	cloud.google.com/go/storage v1.61.3 // indirect
+	cloud.google.com/go/firestore v1.22.0 // indirect
+	cloud.google.com/go/storage v1.62.2 // indirect
 	github.com/BurntSushi/toml v1.6.0 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
-	github.com/emersion/go-smtp v0.18.0
+	github.com/emersion/go-smtp v0.24.0
 	github.com/gabriel-vasile/mimetype v1.4.13
 	github.com/gorilla/websocket v1.5.3
-	github.com/mattn/go-sqlite3 v1.14.37
+	github.com/mattn/go-sqlite3 v1.14.44
 	github.com/olebedev/when v1.1.0
 	github.com/stretchr/testify v1.11.1
 	github.com/urfave/cli/v2 v2.27.7
-	golang.org/x/crypto v0.49.0
+	golang.org/x/crypto v0.52.0
 	golang.org/x/oauth2 v0.36.0 // indirect
 	golang.org/x/sync v0.20.0
-	golang.org/x/term v0.41.0
+	golang.org/x/term v0.43.0
 	golang.org/x/time v0.15.0
-	google.golang.org/api v0.272.0
+	google.golang.org/api v0.283.0
 	gopkg.in/yaml.v2 v2.4.0
 )
 
@@ -28,29 +28,29 @@ replace github.com/emersion/go-smtp => github.com/emersion/go-smtp v0.17.0 // Pi
 require github.com/pkg/errors v0.9.1 // indirect
 
 require (
-	firebase.google.com/go/v4 v4.19.0
+	firebase.google.com/go/v4 v4.20.0
 	github.com/SherClockHolmes/webpush-go v1.4.0
-	github.com/jackc/pgx/v5 v5.9.0
+	github.com/jackc/pgx/v5 v5.10.0
 	github.com/microcosm-cc/bluemonday v1.0.27
 	github.com/prometheus/client_golang v1.23.2
 	github.com/stripe/stripe-go/v74 v74.30.0
-	golang.org/x/sys v0.42.0
-	golang.org/x/text v0.35.0
+	golang.org/x/sys v0.45.0
+	golang.org/x/text v0.37.0
 )
 
 require (
-	cel.dev/expr v0.25.1 // indirect
+	cel.dev/expr v0.25.2 // indirect
 	cloud.google.com/go v0.123.0 // indirect
-	cloud.google.com/go/auth v0.18.3-0.20260310051336-87cdcc9f7568 // indirect
+	cloud.google.com/go/auth v0.20.0 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
 	cloud.google.com/go/compute/metadata v0.9.0 // indirect
-	cloud.google.com/go/iam v1.5.3 // indirect
-	cloud.google.com/go/longrunning v0.8.0 // indirect
-	cloud.google.com/go/monitoring v1.24.3 // indirect
+	cloud.google.com/go/iam v1.11.0 // indirect
+	cloud.google.com/go/longrunning v1.0.0 // indirect
+	cloud.google.com/go/monitoring v1.29.0 // indirect
 	github.com/AlekSi/pointer v1.2.0 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.32.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.56.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.56.0 // indirect
 	github.com/MicahParks/keyfunc v1.9.0 // indirect
 	github.com/aymerick/douceur v0.2.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
@@ -61,7 +61,7 @@ require (
 	github.com/envoyproxy/go-control-plane/envoy v1.37.0 // indirect
 	github.com/envoyproxy/protoc-gen-validate v1.3.3 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/go-jose/go-jose/v4 v4.1.3 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
@@ -69,8 +69,8 @@ require (
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.3.14 // indirect
-	github.com/googleapis/gax-go/v2 v2.19.0 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.16 // indirect
+	github.com/googleapis/gax-go/v2 v2.22.0 // indirect
 	github.com/gorilla/css v1.0.1 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
@@ -79,28 +79,27 @@ require (
 	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.67.5 // indirect
+	github.com/prometheus/common v0.68.1 // indirect
 	github.com/prometheus/procfs v0.20.1 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
-	github.com/spiffe/go-spiffe/v2 v2.6.0 // indirect
+	github.com/spiffe/go-spiffe/v2 v2.7.0 // indirect
 	github.com/stretchr/objx v0.5.2 // indirect
 	github.com/xrash/smetrics v0.0.0-20250705151800-55b8f293f342 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/detectors/gcp v1.42.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 // indirect
-	go.opentelemetry.io/otel v1.42.0 // indirect
-	go.opentelemetry.io/otel/metric v1.42.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.42.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.42.0 // indirect
-	go.opentelemetry.io/otel/trace v1.42.0 // indirect
-	go.yaml.in/yaml/v2 v2.4.4 // indirect
-	golang.org/x/net v0.52.0 // indirect
+	go.opentelemetry.io/contrib/detectors/gcp v1.44.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.69.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 // indirect
+	go.opentelemetry.io/otel v1.44.0 // indirect
+	go.opentelemetry.io/otel/metric v1.44.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.44.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.44.0 // indirect
+	go.opentelemetry.io/otel/trace v1.44.0 // indirect
+	golang.org/x/net v0.55.0 // indirect
 	google.golang.org/appengine/v2 v2.0.6 // indirect
-	google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260319201613-d00831a3d3e7 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7 // indirect
-	google.golang.org/grpc v1.79.3 // indirect
+	google.golang.org/genproto v0.0.0-20260526163538-3dc84a4a5aaa // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
+	google.golang.org/grpc v1.81.1 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

go.sum

@@ -1,41 +1,41 @@
-cel.dev/expr v0.25.1 h1:1KrZg61W6TWSxuNZ37Xy49ps13NUovb66QLprthtwi4=
-cel.dev/expr v0.25.1/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4=
+cel.dev/expr v0.25.2 h1:K6j46C81hXtZQfuX60cVWQFBJahKSE2gfRbNuvr5bFs=
+cel.dev/expr v0.25.2/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4=
 cloud.google.com/go v0.123.0 h1:2NAUJwPR47q+E35uaJeYoNhuNEM9kM8SjgRgdeOJUSE=
 cloud.google.com/go v0.123.0/go.mod h1:xBoMV08QcqUGuPW65Qfm1o9Y4zKZBpGS+7bImXLTAZU=
-cloud.google.com/go/auth v0.18.3-0.20260310051336-87cdcc9f7568 h1:PJt3KrySfZkKdcEV2wlyNkfAPbMZGjtnv5oLrT4tWPg=
-cloud.google.com/go/auth v0.18.3-0.20260310051336-87cdcc9f7568/go.mod h1:/Tt0rLCp4FHXEBtdyYqvIZPcJzbpJ/fmqtgIaXseDK4=
+cloud.google.com/go/auth v0.20.0 h1:kXTssoVb4azsVDoUiF8KvxAqrsQcQtB53DcSgta74CA=
+cloud.google.com/go/auth v0.20.0/go.mod h1:942/yi/itH1SsmpyrbnTMDgGfdy2BUqIKyd0cyYLc5Q=
 cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
 cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
 cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
 cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
-cloud.google.com/go/firestore v1.21.0 h1:BhopUsx7kh6NFx77ccRsHhrtkbJUmDAxNY3uapWdjcM=
-cloud.google.com/go/firestore v1.21.0/go.mod h1:1xH6HNcnkf/gGyR8udd6pFO4Z7GWJSwLKQMx/u6UrP4=
-cloud.google.com/go/iam v1.5.3 h1:+vMINPiDF2ognBJ97ABAYYwRgsaqxPbQDlMnbHMjolc=
-cloud.google.com/go/iam v1.5.3/go.mod h1:MR3v9oLkZCTlaqljW6Eb2d3HGDGK5/bDv93jhfISFvU=
-cloud.google.com/go/logging v1.13.2 h1:qqlHCBvieJT9Cdq4QqYx1KPadCQ2noD4FK02eNqHAjA=
-cloud.google.com/go/logging v1.13.2/go.mod h1:zaybliM3yun1J8mU2dVQ1/qDzjbOqEijZCn6hSBtKak=
-cloud.google.com/go/longrunning v0.8.0 h1:LiKK77J3bx5gDLi4SMViHixjD2ohlkwBi+mKA7EhfW8=
-cloud.google.com/go/longrunning v0.8.0/go.mod h1:UmErU2Onzi+fKDg2gR7dusz11Pe26aknR4kHmJJqIfk=
-cloud.google.com/go/monitoring v1.24.3 h1:dde+gMNc0UhPZD1Azu6at2e79bfdztVDS5lvhOdsgaE=
-cloud.google.com/go/monitoring v1.24.3/go.mod h1:nYP6W0tm3N9H/bOw8am7t62YTzZY+zUeQ+Bi6+2eonI=
-cloud.google.com/go/storage v1.61.3 h1:VS//ZfBuPGDvakfD9xyPW1RGF1Vy3BWUoVZXgW1KMOg=
-cloud.google.com/go/storage v1.61.3/go.mod h1:JtqK8BBB7TWv0HVGHubtUdzYYrakOQIsMLffZ2Z/HWk=
-cloud.google.com/go/trace v1.11.7 h1:kDNDX8JkaAG3R2nq1lIdkb7FCSi1rCmsEtKVsty7p+U=
-cloud.google.com/go/trace v1.11.7/go.mod h1:TNn9d5V3fQVf6s4SCveVMIBS2LJUqo73GACmq/Tky0s=
-firebase.google.com/go/v4 v4.19.0 h1:f5NMlC2YHFsncz00c2+ecBr+ZYlRMhKIhj1z8Iz0lD8=
-firebase.google.com/go/v4 v4.19.0/go.mod h1:P7UfBpzc8+Z3MckX79+zsWzKVfpGryr6HLbAe7gCWfs=
+cloud.google.com/go/firestore v1.22.0 h1:avooeboIq37vKXobrbPUFhFBxS/c3FqmWoX0xs8dO6E=
+cloud.google.com/go/firestore v1.22.0/go.mod h1:PaM4i7i7ruALSKmlpHXXZaPObcZw0W7ie5UOPr72iTU=
+cloud.google.com/go/iam v1.11.0 h1:KieQ9Pb+LLPak1O3Rv3GgCxhnmkYf7Xyh0P5HfF1jFM=
+cloud.google.com/go/iam v1.11.0/go.mod h1:KP+nKGugNJW4LcLx1uEZcq1ok5sQHFaQehQNl4QDgV4=
+cloud.google.com/go/logging v1.18.0 h1:KhzZq+1cSkPH9YUaKLLhLtQxIHitVayBmk0sGfoM9+k=
+cloud.google.com/go/logging v1.18.0/go.mod h1:ZGKnpBaURITh+g/uom2VhbiFoFWvejcrHPDhxFtU/gI=
+cloud.google.com/go/longrunning v1.0.0 h1:lwzWEYD8+NkYV7dhexOz6kmlvajZA70+bW/xMhRVVdY=
+cloud.google.com/go/longrunning v1.0.0/go.mod h1:8nqFBPOO1U/XkhWl0I19AMZEphrHi73VNABIpKYaTwM=
+cloud.google.com/go/monitoring v1.29.0 h1:AHhDsFaSax1/4k+qlIDX/SDGe6hggnfXJ9dkgD9qBPY=
+cloud.google.com/go/monitoring v1.29.0/go.mod h1:72NOVjJXHY/HBfoLT0+qlCZBT059+9VXLeAnL2PeeVM=
+cloud.google.com/go/storage v1.62.2 h1:WgR4U9n7bIzXkkVnwPKKE8bkaKUNsHG+0MAAlh9DGU4=
+cloud.google.com/go/storage v1.62.2/go.mod h1:cpYz/kRVZ+UQAF1uHeea10/9ewcRbxGoGNKsS9daSXA=
+cloud.google.com/go/trace v1.16.0 h1:GmQovzFc5F0CNfl0VLgL64aoTtu7xsM0YajW2GlG9+E=
+cloud.google.com/go/trace v1.16.0/go.mod h1:r+bdAn16dKLSV1G2D5v3e58IlQlizfxWrUfjx7kM7X0=
+firebase.google.com/go/v4 v4.20.0 h1:ighpjeAC45rY/95cUQ+ojIKlKcTnz2YC0ldam56z2YU=
+firebase.google.com/go/v4 v4.20.0/go.mod h1:hqhkQtZkThGH42TnaYi7A8EFR1E0FEuB5oHvJ1Q57t8=
 github.com/AlekSi/pointer v1.2.0 h1:glcy/gc4h8HnG2Z3ZECSzZ1IX1x2JxRVuDzaJwQE0+w=
 github.com/AlekSi/pointer v1.2.0/go.mod h1:gZGfd3dpW4vEc/UlyfKKi1roIqcCgwOIvb0tSNSBle0=
 github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=
 github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0 h1:DHa2U07rk8syqvCge0QIGMCE1WxGj9njT44GH7zNJLQ=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0/go.mod h1:P4WPRUkOhJC13W//jWpyfJNDAIpvRbAUIYLX/4jtlE0=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 h1:UnDZ/zFfG1JhH/DqxIZYU/1CUAlTUScoXD/LcM2Ykk8=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0/go.mod h1:IA1C1U7jO/ENqm/vhi7V9YYpBsp+IMyqNrEN94N7tVc=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.55.0 h1:7t/qx5Ost0s0wbA/VDrByOooURhp+ikYwv20i9Y07TQ=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.55.0/go.mod h1:vB2GH9GAYYJTO3mEn8oYwzEdhlayZIdQz6zdzgUIRvA=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0 h1:0s6TxfCu2KHkkZPnBfsQ2y5qia0jl3MMrmBhu3nCOYk=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0/go.mod h1:Mf6O40IAyB9zR/1J8nGDDPirZQQPbYJni8Yisy7NTMc=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.32.0 h1:rIkQfkCOVKc1OiRCNcSDD8ml5RJlZbH/Xsq7lbpynwc=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.32.0/go.mod h1:RD2SsorTmYhF6HkTmDw7KmPYQk8OBYwTkuasChwv7R4=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.56.0 h1:O2sXMyJh8b7devAGdE+163xtRurt0RVpB6DIzX5vGfg=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.56.0/go.mod h1:hEpiGU18xf70qb3jbTcIggWAiEfX/cOIVc2OTe4OegA=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.56.0 h1:ZIT85vKP7LBS84XJ0WdJ3dPOX3iz4j3c0+lpajGQMyo=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.56.0/go.mod h1:rqP9UEhOXv9WhQ7Gjz+G5y/pf8+BJZW5/Ts0AhE0PwE=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.56.0 h1:0YP0+/ixwu+Uqeu/FGiBZNQ19huiUxxiPXIc9WsLKuQ=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.56.0/go.mod h1:6ZZMQhZKDvUvkJw2rc+oDP90tMMzuU/J+5HG1ZmPOmE=
 github.com/MicahParks/keyfunc v1.9.0 h1:lhKd5xrFHLNOWrDc4Tyb/Q1AJ4LCzQ48GVJyVIID3+o=
 github.com/MicahParks/keyfunc v1.9.0/go.mod h1:IdnCilugA0O/99dW+/MkvlyrsX8+L8+x95xuVNtM5jw=
 github.com/SherClockHolmes/webpush-go v1.4.0 h1:ocnzNKWN23T9nvHi6IfyrQjkIc0oJWv1B1pULsf9i3s=
@@ -70,8 +70,8 @@ github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/gabriel-vasile/mimetype v1.4.13 h1:46nXokslUBsAJE/wMsp5gtO500a4F3Nkz9Ufpk2AcUM=
 github.com/gabriel-vasile/mimetype v1.4.13/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
-github.com/go-jose/go-jose/v4 v4.1.3 h1:CVLmWDhDVRa6Mi/IgCgaopNosCaHz7zrMeF9MlZRkrs=
-github.com/go-jose/go-jose/v4 v4.1.3/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
+github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
@@ -96,10 +96,10 @@ github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
 github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/enterprise-certificate-proxy v0.3.14 h1:yh8ncqsbUY4shRD5dA6RlzjJaT4hi3kII+zYw8wmLb8=
-github.com/googleapis/enterprise-certificate-proxy v0.3.14/go.mod h1:vqVt9yG9480NtzREnTlmGSBmFrA+bzb0yl0TxoBQXOg=
-github.com/googleapis/gax-go/v2 v2.19.0 h1:fYQaUOiGwll0cGj7jmHT/0nPlcrZDFPrZRhTsoCr8hE=
-github.com/googleapis/gax-go/v2 v2.19.0/go.mod h1:w2ROXVdfGEVFXzmlciUU4EdjHgWvB5h2n6x/8XSTTJA=
+github.com/googleapis/enterprise-certificate-proxy v0.3.16 h1:F/VPrx0YPBdksZJQdCAp0WUsqnNmZpUZszzfYt0M5Dw=
+github.com/googleapis/enterprise-certificate-proxy v0.3.16/go.mod h1:9Yb0eAkH/Xqhvv3zbeKf/+wMJqCeocWc6KIhDvEAuYE=
+github.com/googleapis/gax-go/v2 v2.22.0 h1:PjIWBpgGIVKGoCXuiCoP64altEJCj3/Ei+kSU5vlZD4=
+github.com/googleapis/gax-go/v2 v2.22.0/go.mod h1:irWBbALSr0Sk3qlqb9SyJ1h68WjgeFuiOzI4Rqw5+aY=
 github.com/gorilla/css v1.0.1 h1:ntNaBIghp6JmvWnxbZKANoLyuXTPZ4cAMlo6RyhlbO8=
 github.com/gorilla/css v1.0.1/go.mod h1:BvnYkspnSzMmwRK+b8/xgNPLiIuNZr6vbZBTPQ2A3b0=
 github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
@@ -108,8 +108,8 @@ github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsI
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
-github.com/jackc/pgx/v5 v5.9.0 h1:T/dI+2TvmI2H8s/KH1/lXIbz1CUFk3gn5oTjr0/mBsE=
-github.com/jackc/pgx/v5 v5.9.0/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4=
+github.com/jackc/pgx/v5 v5.10.0 h1:VhSvgU2jSli8o3AqIEOTJr7rZwAEUVo4E4XhR94Zfr0=
+github.com/jackc/pgx/v5 v5.10.0/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4=
 github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
 github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
 github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
@@ -120,8 +120,8 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
-github.com/mattn/go-sqlite3 v1.14.37 h1:3DOZp4cXis1cUIpCfXLtmlGolNLp2VEqhiB/PARNBIg=
-github.com/mattn/go-sqlite3 v1.14.37/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
+github.com/mattn/go-sqlite3 v1.14.44 h1:3VSe+xafpbzsLbdr2AWlAZk9yRHiBhTBakioXaCKTF8=
+github.com/mattn/go-sqlite3 v1.14.44/go.mod h1:pjEuOr8IwzLJP2MfGeTb0A35jauH+C2kbHKBr7yXKVQ=
 github.com/microcosm-cc/bluemonday v1.0.27 h1:MpEUotklkwCSLeH+Qdx1VJgNqLlpY2KXwXFM08ygZfk=
 github.com/microcosm-cc/bluemonday v1.0.27/go.mod h1:jFi9vgW+H7c3V0lb6nR74Ib/DIB5OBs92Dimizgw2cA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
@@ -139,16 +139,16 @@ github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h
 github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
 github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
 github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
-github.com/prometheus/common v0.67.5 h1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTUGI4=
-github.com/prometheus/common v0.67.5/go.mod h1:SjE/0MzDEEAyrdr5Gqc6G+sXI67maCxzaT3A2+HqjUw=
+github.com/prometheus/common v0.68.1 h1:omjRRl4QP4komogpXuhfeOiisQg7xdy8VM1UY+pStaY=
+github.com/prometheus/common v0.68.1/go.mod h1:ZzL3f6u94qUxh9p+tJTrF+FvBS1XXbbRAZCQkytAL0Y=
 github.com/prometheus/procfs v0.20.1 h1:XwbrGOIplXW/AU3YhIhLODXMJYyC1isLFfYCsTEycfc=
 github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4UlK79eF5TGGo=
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
 github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/spiffe/go-spiffe/v2 v2.6.0 h1:l+DolpxNWYgruGQVV0xsfeya3CsC7m8iBzDnMpsbLuo=
-github.com/spiffe/go-spiffe/v2 v2.6.0/go.mod h1:gm2SeUoMZEtpnzPNs2Csc0D/gX33k1xIx7lEzqblHEs=
+github.com/spiffe/go-spiffe/v2 v2.7.0 h1:uXe1MflJoHw58wAUvxVlcM7WpKtijWG7I1UidcGh6g4=
+github.com/spiffe/go-spiffe/v2 v2.7.0/go.mod h1:47Q0Q9/AqGha8QLHp+kxpH4Wca7X7EnOtlIJy3mxZ3U=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
@@ -165,24 +165,26 @@ github.com/xrash/smetrics v0.0.0-20250705151800-55b8f293f342/go.mod h1:Ohn+xnUBi
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/contrib/detectors/gcp v1.42.0 h1:kpt2PEJuOuqYkPcktfJqWWDjTEd/FNgrxcniL7kQrXQ=
-go.opentelemetry.io/contrib/detectors/gcp v1.42.0/go.mod h1:W9zQ439utxymRrXsUOzZbFX4JhLxXU4+ZnCt8GG7yA8=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 h1:yI1/OhfEPy7J9eoa6Sj051C7n5dvpj0QX8g4sRchg04=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0/go.mod h1:NoUCKYWK+3ecatC4HjkRktREheMeEtrXoQxrqYFeHSc=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 h1:OyrsyzuttWTSur2qN/Lm0m2a8yqyIjUVBZcxFPuXq2o=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0/go.mod h1:C2NGBr+kAB4bk3xtMXfZ94gqFDtg/GkI7e9zqGh5Beg=
-go.opentelemetry.io/otel v1.42.0 h1:lSQGzTgVR3+sgJDAU/7/ZMjN9Z+vUip7leaqBKy4sho=
-go.opentelemetry.io/otel v1.42.0/go.mod h1:lJNsdRMxCUIWuMlVJWzecSMuNjE7dOYyWlqOXWkdqCc=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.40.0 h1:ZrPRak/kS4xI3AVXy8F7pipuDXmDsrO8Lg+yQjBLjw0=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.40.0/go.mod h1:3y6kQCWztq6hyW8Z9YxQDDm0Je9AJoFar2G0yDcmhRk=
-go.opentelemetry.io/otel/metric v1.42.0 h1:2jXG+3oZLNXEPfNmnpxKDeZsFI5o4J+nz6xUlaFdF/4=
-go.opentelemetry.io/otel/metric v1.42.0/go.mod h1:RlUN/7vTU7Ao/diDkEpQpnz3/92J9ko05BIwxYa2SSI=
-go.opentelemetry.io/otel/sdk v1.42.0 h1:LyC8+jqk6UJwdrI/8VydAq/hvkFKNHZVIWuslJXYsDo=
-go.opentelemetry.io/otel/sdk v1.42.0/go.mod h1:rGHCAxd9DAph0joO4W6OPwxjNTYWghRWmkHuGbayMts=
-go.opentelemetry.io/otel/sdk/metric v1.42.0 h1:D/1QR46Clz6ajyZ3G8SgNlTJKBdGp84q9RKCAZ3YGuA=
-go.opentelemetry.io/otel/sdk/metric v1.42.0/go.mod h1:Ua6AAlDKdZ7tdvaQKfSmnFTdHx37+J4ba8MwVCYM5hc=
-go.opentelemetry.io/otel/trace v1.42.0 h1:OUCgIPt+mzOnaUTpOQcBiM/PLQ/Op7oq6g4LenLmOYY=
-go.opentelemetry.io/otel/trace v1.42.0/go.mod h1:f3K9S+IFqnumBkKhRJMeaZeNk9epyhnCmQh/EysQCdc=
+go.opentelemetry.io/contrib/detectors/gcp v1.44.0 h1:NmLfL734pJhM0JKaYd2Y28+nY9dPRWYAAbxhRCrKXPw=
+go.opentelemetry.io/contrib/detectors/gcp v1.44.0/go.mod h1:tNAsgd8avTGke1+MndXlU5Cru4PQ9Ai/cCNWQv/ZJ/s=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.69.0 h1:2yEATaop1/a1I4psnSLgWVPLWwCzkqWakgJy7xTDVy0=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.69.0/go.mod h1:D7J12YRapIekYyPWgGPlA/23pRmpSEZC5xJC/TTLI9U=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 h1:8tvICD4vSTOOsNrsI4Ljf6C+6UKvpTEH5XY3JMoyPoo=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0/go.mod h1:z9+yiacE0IHRqM4qFfkbt/JYlmYXgss8GY/jXoNuPJI=
+go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU=
+go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.43.0 h1:TC+BewnDpeiAmcscXbGMfxkO+mwYUwE/VySwvw88PfA=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.43.0/go.mod h1:J/ZyF4vfPwsSr9xJSPyQ4LqtcTPULFR64KwTikGLe+A=
+go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc=
+go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo=
+go.opentelemetry.io/otel/metric/x v0.66.0 h1:YkCrx1zLOChi9ZcZ6euupOcsgzbVlec7D/xoEU1+cTA=
+go.opentelemetry.io/otel/metric/x v0.66.0/go.mod h1:d1+BDj9t96do0/1LoU1ayfCv79ZgNE41qbhBvnMOBZk=
+go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58=
+go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0=
+go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI=
+go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA=
+go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk=
+go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
@@ -193,8 +195,8 @@ golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliY
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
-golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
+golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
+golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
@@ -209,8 +211,8 @@ golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
-golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
+golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
+golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -234,8 +236,8 @@ golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
-golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
+golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -245,8 +247,8 @@ golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
-golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=
-golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
+golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
+golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -258,8 +260,8 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
-golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
+golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
+golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -270,20 +272,20 @@ golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
-gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
-google.golang.org/api v0.272.0 h1:eLUQZGnAS3OHn31URRf9sAmRk3w2JjMx37d2k8AjJmA=
-google.golang.org/api v0.272.0/go.mod h1:wKjowi5LNJc5qarNvDCvNQBn3rVK8nSy6jg2SwRwzIA=
+gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
+gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
+google.golang.org/api v0.283.0 h1:0lkp8u0MPwJVHqRL+nJlMAoZVVzbmiXmFHXMOTmSPik=
+google.golang.org/api v0.283.0/go.mod h1:6Wssta4c5n9qHq5CBhmlai5h/PUa1djdDAIhYEHyvcM=
 google.golang.org/appengine/v2 v2.0.6 h1:LvPZLGuchSBslPBp+LAhihBeGSiRh1myRoYK4NtuBIw=
 google.golang.org/appengine/v2 v2.0.6/go.mod h1:WoEXGoXNfa0mLvaH5sV3ZSGXwVmy8yf7Z1JKf3J3wLI=
-google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 h1:XzmzkmB14QhVhgnawEVsOn6OFsnpyxNPRY9QV01dNB0=
-google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:L43LFes82YgSonw6iTXTxXUX1OlULt4AQtkik4ULL/I=
-google.golang.org/genproto/googleapis/api v0.0.0-20260319201613-d00831a3d3e7 h1:41r6JMbpzBMen0R/4TZeeAmGXSJC7DftGINUodzTkPI=
-google.golang.org/genproto/googleapis/api v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:EIQZ5bFCfRQDV4MhRle7+OgjNtZ6P1PiZBgAKuxXu/Y=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7 h1:ndE4FoJqsIceKP2oYSnUZqhTdYufCYYkqwtFzfrhI7w=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE=
-google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
+google.golang.org/genproto v0.0.0-20260526163538-3dc84a4a5aaa h1:mfj8IS4EA4VAR9a6QDVxTQkLY64iBybb5QI1B4pXrpE=
+google.golang.org/genproto v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:fuT7yonGw1Iq2oa+YC0fyqPPQJkgo/54gPNC6VitOkI=
+google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa h1:Kjn0N0tCrDgiAFW+lGO4JZ3ck44CehvJQMAwj9QF0G8=
+google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:q4lMZS6kskjT5HvCPrnnypcDPVJqT/f4nfxmkE7gryY=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa h1:mZHHdPZl0dbGHCflZgAq/Q468DWVFcU2whhB2KAo8fk=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ=
+google.golang.org/grpc v1.81.1/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=

mail/sender.go

@@ -0,0 +1,154 @@
+package mail
+
+import (
+	"fmt"
+	"mime"
+	"net"
+	"net/smtp"
+	"strings"
+	"sync"
+	"time"
+
+	"heckel.io/ntfy/v2/log"
+	"heckel.io/ntfy/v2/util"
+)
+
+const (
+	verifyCodeExpiry  = 10 * time.Minute
+	verifyCodeLength  = 6
+	verifyCodeSubject = "ntfy email verification"
+)
+
+// Config holds the SMTP configuration for the mail sender
+type Config struct {
+	SMTPAddr string // SMTP server address (host:port)
+	SMTPUser string // SMTP auth username
+	SMTPPass string // SMTP auth password
+	From     string // Sender email address
+}
+
+// Sender sends emails and manages email verification codes
+type Sender struct {
+	config    *Config
+	codes     map[string]verifyCode // Verification codes, keyed by email
+	mu        sync.Mutex
+	closeChan chan struct{}
+}
+
+type verifyCode struct {
+	code    string
+	expires time.Time
+}
+
+// NewSender creates a new mail Sender with the given SMTP config
+func NewSender(config *Config) *Sender {
+	s := &Sender{
+		config:    config,
+		codes:     make(map[string]verifyCode),
+		closeChan: make(chan struct{}),
+	}
+	go s.expireLoop()
+	return s
+}
+
+// Close stops the background expiry loop
+func (s *Sender) Close() {
+	close(s.closeChan)
+}
+
+// Addr returns the SMTP server address
+func (s *Sender) Addr() string {
+	return s.config.SMTPAddr
+}
+
+// User returns the SMTP username
+func (s *Sender) User() string {
+	return s.config.SMTPUser
+}
+
+// From returns the sender email address
+func (s *Sender) From() string {
+	return s.config.From
+}
+
+// SendRaw sends a raw email message via SMTP
+func (s *Sender) SendRaw(to string, message []byte) error {
+	host, _, err := net.SplitHostPort(s.config.SMTPAddr)
+	if err != nil {
+		return err
+	}
+	var auth smtp.Auth
+	if s.config.SMTPUser != "" {
+		auth = smtp.PlainAuth("", s.config.SMTPUser, s.config.SMTPPass, host)
+	}
+	return smtp.SendMail(s.config.SMTPAddr, auth, s.config.From, []string{to}, message)
+}
+
+// Send sends a plain text email via SMTP
+func (s *Sender) Send(to, subject, body string) error {
+	date := time.Now().UTC().Format(time.RFC1123Z)
+	encodedSubject := mime.BEncoding.Encode("utf-8", subject)
+	message := `From: ntfy <{from}>
+To: {to}
+Date: {date}
+Subject: {subject}
+Content-Type: text/plain; charset="utf-8"
+
+{body}`
+	message = strings.ReplaceAll(message, "{from}", s.config.From)
+	message = strings.ReplaceAll(message, "{to}", to)
+	message = strings.ReplaceAll(message, "{date}", date)
+	message = strings.ReplaceAll(message, "{subject}", encodedSubject)
+	message = strings.ReplaceAll(message, "{body}", body)
+	log.Tag("mail").Field("email_to", to).Debug("Sending email")
+	return s.SendRaw(to, []byte(message))
+}
+
+// SendVerification generates a random code, stores it in-memory, and sends a verification email
+func (s *Sender) SendVerification(to string) error {
+	code := util.RandomString(verifyCodeLength)
+	s.mu.Lock()
+	s.codes[to] = verifyCode{
+		code:    code,
+		expires: time.Now().Add(verifyCodeExpiry),
+	}
+	s.mu.Unlock()
+	body := fmt.Sprintf("Your ntfy email verification code is: %s\n\nThis code expires in 10 minutes.", code)
+	return s.Send(to, verifyCodeSubject, body)
+}
+
+// CheckVerification checks if the code matches and hasn't expired. Removes the entry on success.
+func (s *Sender) CheckVerification(email, code string) bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	vc, ok := s.codes[email]
+	if !ok || time.Now().After(vc.expires) || vc.code != code {
+		return false
+	}
+	delete(s.codes, email)
+	return true
+}
+
+func (s *Sender) expireLoop() {
+	ticker := time.NewTicker(time.Minute)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ticker.C:
+			s.expireVerificationCodes()
+		case <-s.closeChan:
+			return
+		}
+	}
+}
+
+func (s *Sender) expireVerificationCodes() {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	now := time.Now()
+	for email, vc := range s.codes {
+		if now.After(vc.expires) {
+			delete(s.codes, email)
+		}
+	}
+}

s3/client.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"context"
 	"crypto/md5" //nolint:gosec // MD5 is required by the S3 protocol for Content-MD5 headers
+	"crypto/tls"
 	"encoding/base64"
 	"encoding/xml"
 	"errors"
@@ -61,7 +62,11 @@ type Client struct {
 func New(config *Config) *Client {
 	httpClient := config.HTTPClient
 	if httpClient == nil {
-		httpClient = http.DefaultClient
+		if config.DisableHTTP2 {
+			httpClient = newHTTP1Client()
+		} else {
+			httpClient = http.DefaultClient
+		}
 	}
 	return &Client{
 		config: config,
@@ -300,3 +305,20 @@ func (c *Client) do(ctx context.Context, op, method, reqURL string, body []byte,
 	}
 	return respBody, nil
 }
+
+// newHTTP1Client creates an HTTP client that forces HTTP/1.1 by disabling HTTP/2
+// ALPN negotiation. This works around HTTP/2 stream errors with some S3-compatible
+// providers (e.g. DigitalOcean Spaces) that can cause non-retryable failures on
+// streaming uploads when the server resets the stream mid-transfer.
+// See https://github.com/rclone/rclone/issues/4673, https://github.com/golang/go/issues/42777
+func newHTTP1Client() *http.Client {
+	return &http.Client{
+		Transport: &http.Transport{
+			TLSClientConfig: &tls.Config{
+				MinVersion: tls.VersionTLS12,
+			},
+			ForceAttemptHTTP2: false,
+			TLSNextProto:      make(map[string]func(string, *tls.Conn) http.RoundTripper),
+		},
+	}
+}

s3/client_test.go

@@ -92,6 +92,18 @@ func TestParseURL_EmptyBucket(t *testing.T) {
 	require.Contains(t, err.Error(), "bucket")
 }
 
+func TestParseURL_DisableHTTP2(t *testing.T) {
+	cfg, err := ParseURL("s3://AKID:SECRET@my-bucket?region=us-east-1&disable_http2=true")
+	require.Nil(t, err)
+	require.True(t, cfg.DisableHTTP2)
+}
+
+func TestParseURL_DisableHTTP2_NotSet(t *testing.T) {
+	cfg, err := ParseURL("s3://AKID:SECRET@my-bucket?region=us-east-1")
+	require.Nil(t, err)
+	require.False(t, cfg.DisableHTTP2)
+}
+
 // --- Unit tests: URL construction ---
 
 func TestConfig_BucketURL_PathStyle(t *testing.T) {

s3/types.go

@@ -11,14 +11,15 @@ import (
 
 // Config holds the parsed fields from an S3 URL. Use ParseURL to create one from a URL string.
 type Config struct {
-	Endpoint   string // host[:port] only, e.g. "s3.us-east-1.amazonaws.com"
-	PathStyle  bool
-	Bucket     string
-	Prefix     string
-	Region     string
-	AccessKey  string
-	SecretKey  string
-	HTTPClient *http.Client // if nil, http.DefaultClient is used
+	Endpoint     string // host[:port] only, e.g. "s3.us-east-1.amazonaws.com"
+	PathStyle    bool
+	Bucket       string
+	Prefix       string
+	Region       string
+	AccessKey    string
+	SecretKey    string
+	DisableHTTP2 bool         // Force HTTP/1.1 to work around HTTP/2 issues with some S3-compatible providers
+	HTTPClient   *http.Client // if nil, a default client is created (respecting DisableHTTP2)
 }
 
 // BucketURL returns the base URL for bucket-level operations.

s3/util.go

@@ -10,6 +10,7 @@ import (
 	"net/http"
 	"net/url"
 	"sort"
+	"strconv"
 	"strings"
 )
 
@@ -41,9 +42,11 @@ const (
 
 // ParseURL parses an S3 URL of the form:
 //
-//	s3://ACCESS_KEY:SECRET_KEY@BUCKET[/PREFIX]?region=REGION[&endpoint=ENDPOINT]
+//	s3://ACCESS_KEY:SECRET_KEY@BUCKET[/PREFIX]?region=REGION[&endpoint=ENDPOINT][&disable_http2=true]
 //
 // When endpoint is specified, path-style addressing is enabled automatically.
+// When disable_http2=true is set, the client forces HTTP/1.1 to work around
+// HTTP/2 stream errors with some S3-compatible providers (e.g. DigitalOcean Spaces).
 func ParseURL(s3URL string) (*Config, error) {
 	u, err := url.Parse(s3URL)
 	if err != nil {
@@ -80,14 +83,16 @@ func ParseURL(s3URL string) (*Config, error) {
 		endpoint = fmt.Sprintf("s3.%s.amazonaws.com", region)
 		pathStyle = false
 	}
+	disableHTTP2, _ := strconv.ParseBool(u.Query().Get("disable_http2"))
 	return &Config{
-		Endpoint:  endpoint,
-		PathStyle: pathStyle,
-		Bucket:    bucket,
-		Prefix:    prefix,
-		Region:    region,
-		AccessKey: accessKey,
-		SecretKey: secretKey,
+		Endpoint:     endpoint,
+		PathStyle:    pathStyle,
+		Bucket:       bucket,
+		Prefix:       prefix,
+		Region:       region,
+		AccessKey:    accessKey,
+		SecretKey:    secretKey,
+		DisableHTTP2: disableHTTP2,
 	}, nil
 }
 

server/config.go

@@ -69,6 +69,8 @@ const (
 	DefaultVisitorMessageDailyLimit             = 0
 	DefaultVisitorEmailLimitBurst               = 16
 	DefaultVisitorEmailLimitReplenish           = time.Hour
+	DefaultVisitorTopicCreationLimitBurst       = 100
+	DefaultVisitorTopicCreationLimitReplenish   = time.Minute
 	DefaultVisitorAccountCreationLimitBurst     = 3
 	DefaultVisitorAccountCreationLimitReplenish = 24 * time.Hour
 	DefaultVisitorAuthFailureLimitBurst         = 30
@@ -114,6 +116,8 @@ type Config struct {
 	AuthTokens                           map[string][]*user.Token
 	AuthBcryptCost                       int
 	AuthStatsQueueWriterInterval         time.Duration
+	AuthAccessCacheEnabled               bool          // Enables the in-memory ACL cache (high volume servers only)
+	AuthAccessCacheReloadInterval        time.Duration // Reload interval for access cache, relevant for ACL writes from CLI
 	AttachmentCacheDir                   string
 	AttachmentTotalSizeLimit             int64
 	AttachmentFileSizeLimit              int64
@@ -135,6 +139,7 @@ type Config struct {
 	SMTPSenderUser                       string
 	SMTPSenderPass                       string
 	SMTPSenderFrom                       string
+	SMTPSenderVerify                     bool
 	SMTPServerListen                     string
 	SMTPServerDomain                     string
 	SMTPServerAddrPrefix                 string
@@ -162,6 +167,8 @@ type Config struct {
 	VisitorMessageDailyLimit             int
 	VisitorEmailLimitBurst               int
 	VisitorEmailLimitReplenish           time.Duration
+	VisitorTopicCreationLimitBurst       int           // Burst of new topic creations per visitor
+	VisitorTopicCreationLimitReplenish   time.Duration // Interval at which topic-creation tokens are refilled
 	VisitorAccountCreationLimitBurst     int
 	VisitorAccountCreationLimitReplenish time.Duration
 	VisitorAuthFailureLimitBurst         int
@@ -218,6 +225,8 @@ func NewConfig() *Config {
 		AuthDefault:                          user.PermissionReadWrite,
 		AuthBcryptCost:                       user.DefaultUserPasswordBcryptCost,
 		AuthStatsQueueWriterInterval:         user.DefaultUserStatsQueueWriterInterval,
+		AuthAccessCacheEnabled:               user.DefaultAccessCacheEnabled,
+		AuthAccessCacheReloadInterval:        user.DefaultAccessCacheReloadInterval,
 		AttachmentCacheDir:                   "",
 		AttachmentTotalSizeLimit:             DefaultAttachmentTotalSizeLimit,
 		AttachmentFileSizeLimit:              DefaultAttachmentFileSizeLimit,
@@ -239,6 +248,7 @@ func NewConfig() *Config {
 		SMTPSenderUser:                       "",
 		SMTPSenderPass:                       "",
 		SMTPSenderFrom:                       "",
+		SMTPSenderVerify:                     false,
 		SMTPServerListen:                     "",
 		SMTPServerDomain:                     "",
 		SMTPServerAddrPrefix:                 "",
@@ -264,6 +274,8 @@ func NewConfig() *Config {
 		VisitorMessageDailyLimit:             DefaultVisitorMessageDailyLimit,
 		VisitorEmailLimitBurst:               DefaultVisitorEmailLimitBurst,
 		VisitorEmailLimitReplenish:           DefaultVisitorEmailLimitReplenish,
+		VisitorTopicCreationLimitBurst:       DefaultVisitorTopicCreationLimitBurst,
+		VisitorTopicCreationLimitReplenish:   DefaultVisitorTopicCreationLimitReplenish,
 		VisitorAccountCreationLimitBurst:     DefaultVisitorAccountCreationLimitBurst,
 		VisitorAccountCreationLimitReplenish: DefaultVisitorAccountCreationLimitReplenish,
 		VisitorAuthFailureLimitBurst:         DefaultVisitorAuthFailureLimitBurst,

server/errors.go

@@ -143,6 +143,9 @@ var (
 	errHTTPBadRequestTemplateFileInvalid             = &errHTTP{40048, http.StatusBadRequest, "invalid request: template file invalid", "https://ntfy.sh/docs/publish/#message-templating", nil}
 	errHTTPBadRequestSequenceIDInvalid               = &errHTTP{40049, http.StatusBadRequest, "invalid request: sequence ID invalid", "https://ntfy.sh/docs/publish/#updating-deleting-notifications", nil}
 	errHTTPBadRequestEmailAddressInvalid             = &errHTTP{40050, http.StatusBadRequest, "invalid request: invalid e-mail address", "https://ntfy.sh/docs/publish/#e-mail-notifications", nil}
+	errHTTPBadRequestEmailVerificationCodeInvalid    = &errHTTP{40051, http.StatusBadRequest, "invalid request: email verification code invalid or expired", "", nil}
+	errHTTPBadRequestEmailAddressNotVerified         = &errHTTP{40052, http.StatusBadRequest, "invalid request: email address not verified", "https://ntfy.sh/docs/publish/#e-mail-notifications", nil}
+	errHTTPBadRequestAnonymousEmailNotAllowed        = &errHTTP{40053, http.StatusBadRequest, "invalid request: anonymous email sending is not allowed", "https://ntfy.sh/docs/publish/#e-mail-notifications", nil}
 	errHTTPNotFound                                  = &errHTTP{40401, http.StatusNotFound, "page not found", "", nil}
 	errHTTPUnauthorized                              = &errHTTP{40101, http.StatusUnauthorized, "unauthorized", "https://ntfy.sh/docs/publish/#authentication", nil}
 	errHTTPForbidden                                 = &errHTTP{40301, http.StatusForbidden, "forbidden", "https://ntfy.sh/docs/publish/#authentication", nil}
@@ -152,6 +155,7 @@ var (
 	errHTTPConflictPhoneNumberExists                 = &errHTTP{40904, http.StatusConflict, "conflict: phone number already exists", "", nil}
 	errHTTPConflictProvisionedUserChange             = &errHTTP{40905, http.StatusConflict, "conflict: cannot change or delete provisioned user", "", nil}
 	errHTTPConflictProvisionedTokenChange            = &errHTTP{40906, http.StatusConflict, "conflict: cannot change or delete provisioned token", "", nil}
+	errHTTPConflictEmailExists                       = &errHTTP{40907, http.StatusConflict, "conflict: email address already exists", "", nil}
 	errHTTPGonePhoneVerificationExpired              = &errHTTP{41001, http.StatusGone, "phone number verification expired or does not exist", "", nil}
 	errHTTPEntityTooLargeAttachment                  = &errHTTP{41301, http.StatusRequestEntityTooLarge, "attachment too large, or bandwidth limit reached", "https://ntfy.sh/docs/publish/#limitations", nil}
 	errHTTPEntityTooLargeMatrixRequest               = &errHTTP{41302, http.StatusRequestEntityTooLarge, "Matrix request is larger than the max allowed length", "", nil}
@@ -166,6 +170,7 @@ var (
 	errHTTPTooManyRequestsLimitMessages              = &errHTTP{42908, http.StatusTooManyRequests, "limit reached: daily message quota reached", "https://ntfy.sh/docs/publish/#limitations", nil}
 	errHTTPTooManyRequestsLimitAuthFailure           = &errHTTP{42909, http.StatusTooManyRequests, "limit reached: too many auth failures", "https://ntfy.sh/docs/publish/#limitations", nil} // FIXME document limit
 	errHTTPTooManyRequestsLimitCalls                 = &errHTTP{42910, http.StatusTooManyRequests, "limit reached: daily phone call quota reached", "https://ntfy.sh/docs/publish/#limitations", nil}
+	errHTTPTooManyRequestsLimitTopicCreation         = &errHTTP{42911, http.StatusTooManyRequests, "limit reached: too many new topics, please wait", "https://ntfy.sh/docs/publish/#limitations", nil}
 	errHTTPInternalError                             = &errHTTP{50001, http.StatusInternalServerError, "internal server error", "", nil}
 	errHTTPInternalErrorInvalidPath                  = &errHTTP{50002, http.StatusInternalServerError, "internal server error: invalid path", "", nil}
 	errHTTPInternalErrorMissingBaseURL               = &errHTTP{50003, http.StatusInternalServerError, "internal server error: base-url must be be configured for this feature", "https://ntfy.sh/docs/config/", nil}

server/ntfy.openrc

@@ -0,0 +1,49 @@
+#!/sbin/openrc-run
+
+# OpenRC service configuration for ntfy Server. 
+# Should be placed in /etc/init.d/ as "ntfy" or "ntfy-server" (no extension), owned by root:root and with permissions 755.
+# Assumes an ntfy system user and group have been created, for example using this command:
+# useradd --system --home-dir /var/lib/ntfy --shell /bin/false --comment "User for the simple HTTP-based pub-sub notification service" ntfy
+
+name=$RC_SVCNAME
+description="ntfy server"
+
+command="/usr/local/bin/ntfy"
+command_background=true
+command_args="serve"
+command_user="ntfy:ntfy"
+extra_started_commands="reload"
+
+pidfile="/run/${RC_SVCNAME}/${RC_SVCNAME}.pid"
+
+# Changes the hard number of open files (nofile) limit to 2048 for the service.
+rc_ulimit="-n 2048"
+
+# Allows the service to bind to privileged ports (<1024).
+capabilities="^cap_net_bind_service"
+
+error_log="/var/log/ntfy.log"
+
+# Service dependencies
+depend() {
+	use net
+	after firewall
+}
+
+# Check for - and if necessary - create required files and folders. Might require some adjustment dependings on the content of the server.yml file.
+start_pre() {
+	checkpath -f --owner "$command_user" --mode 0644 \
+		/var/log/ntfy.log
+	checkpath -d --owner "$command_user" --mode 0750 \
+		/run/ntfy/
+	checkpath -d --owner "$command_user" --mode 0755 \
+		/var/lib/ntfy/
+	checkpath -d --owner "$command_user" --mode 0750 \
+		/var/cache/ntfy/
+}
+
+reload() {
+	ebegin "Reloading $RC_SVCNAME's configuration"
+	start-stop-daemon --signal SIGHUP --pidfile "${pidfile}"
+	eend $? "Failed to reload $RC_SVCNAME's configuration"
+}

server/ntfy.service

@@ -10,6 +10,18 @@ ExecReload=/bin/kill --signal HUP $MAINPID
 Restart=on-failure
 AmbientCapabilities=CAP_NET_BIND_SERVICE
 LimitNOFILE=10000
+PrivateDevices=true
+ProtectClock=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+RestrictRealtime=true
+ProtectHostname=true
+
+# These will be added in a future update.
+# ProtectSystem=full
+# PrivateTmp=true
+
 
 [Install]
 WantedBy=multi-user.target

server/server.go

@@ -36,6 +36,7 @@ import (
 	"heckel.io/ntfy/v2/db"
 	"heckel.io/ntfy/v2/db/pg"
 	"heckel.io/ntfy/v2/log"
+	"heckel.io/ntfy/v2/mail"
 	"heckel.io/ntfy/v2/message"
 	"heckel.io/ntfy/v2/model"
 	"heckel.io/ntfy/v2/payments"
@@ -57,6 +58,7 @@ type Server struct {
 	smtpServer        *smtp.Server
 	smtpServerBackend *smtpBackend
 	smtpSender        mailer
+	mailSender        *mail.Sender
 	topics            map[string]*topic
 	visitors          map[string]*visitor // ip:<ip> or user:<user>
 	firebaseClient    *firebaseClient
@@ -112,6 +114,8 @@ var (
 	apiAccountReservationPath                            = "/v1/account/reservation"
 	apiAccountPhonePath                                  = "/v1/account/phone"
 	apiAccountPhoneVerifyPath                            = "/v1/account/phone/verify"
+	apiAccountEmailPath                                  = "/v1/account/email"
+	apiAccountEmailVerifyPath                            = "/v1/account/email/verify"
 	apiAccountBillingPortalPath                          = "/v1/account/billing/portal"
 	apiAccountBillingWebhookPath                         = "/v1/account/billing/webhook"
 	apiAccountBillingSubscriptionPath                    = "/v1/account/billing/subscription"
@@ -173,8 +177,15 @@ const (
 // subscriber (if configured).
 func New(conf *Config) (*Server, error) {
 	var mailer mailer
+	var mailSender *mail.Sender
 	if conf.SMTPSenderAddr != "" {
-		mailer = &smtpSender{config: conf}
+		mailSender = mail.NewSender(&mail.Config{
+			SMTPAddr: conf.SMTPSenderAddr,
+			SMTPUser: conf.SMTPSenderUser,
+			SMTPPass: conf.SMTPSenderPass,
+			From:     conf.SMTPSenderFrom,
+		})
+		mailer = &smtpSender{config: conf, sender: mailSender}
 	}
 	var stripe stripeAPI
 	if payments.Available && conf.StripeSecretKey != "" {
@@ -236,16 +247,18 @@ func New(conf *Config) (*Server, error) {
 	var userManager *user.Manager
 	if conf.AuthFile != "" || pool != nil {
 		authConfig := &user.Config{
-			Filename:            conf.AuthFile,
-			DatabaseURL:         conf.DatabaseURL,
-			StartupQueries:      conf.AuthStartupQueries,
-			DefaultAccess:       conf.AuthDefault,
-			ProvisionEnabled:    true, // Enable provisioning of users and access
-			Users:               conf.AuthUsers,
-			Access:              conf.AuthAccess,
-			Tokens:              conf.AuthTokens,
-			BcryptCost:          conf.AuthBcryptCost,
-			QueueWriterInterval: conf.AuthStatsQueueWriterInterval,
+			Filename:                  conf.AuthFile,
+			DatabaseURL:               conf.DatabaseURL,
+			StartupQueries:            conf.AuthStartupQueries,
+			DefaultAccess:             conf.AuthDefault,
+			ProvisionEnabled:          true, // Enable provisioning of users and access
+			Users:                     conf.AuthUsers,
+			Access:                    conf.AuthAccess,
+			Tokens:                    conf.AuthTokens,
+			BcryptCost:                conf.AuthBcryptCost,
+			QueueWriterInterval:       conf.AuthStatsQueueWriterInterval,
+			AccessCacheEnabled:        conf.AuthAccessCacheEnabled,
+			AccessCacheReloadInterval: conf.AuthAccessCacheReloadInterval,
 		}
 		if pool != nil {
 			userManager, err = user.NewPostgresManager(pool, authConfig)
@@ -278,6 +291,7 @@ func New(conf *Config) (*Server, error) {
 		attachment:      attachmentStore,
 		firebaseClient:  firebaseClient,
 		smtpSender:      mailer,
+		mailSender:      mailSender,
 		topics:          topics,
 		userManager:     userManager,
 		messages:        messages,
@@ -429,18 +443,25 @@ func (s *Server) Stop() {
 	if s.smtpServer != nil {
 		s.smtpServer.Close()
 	}
+	if s.mailSender != nil {
+		s.mailSender.Close()
+	}
 	if s.attachment != nil {
 		s.attachment.Close()
 	}
 	s.closeDatabases()
-	close(s.closeChan)
+	if s.closeChan != nil {
+		close(s.closeChan)
+	}
 }
 
 func (s *Server) closeDatabases() {
 	if s.userManager != nil {
 		s.userManager.Close()
 	}
-	s.messageCache.Close()
+	if s.messageCache != nil {
+		s.messageCache.Close()
+	}
 	if s.webPush != nil {
 		s.webPush.Close()
 	}
@@ -590,6 +611,12 @@ func (s *Server) handleInternal(w http.ResponseWriter, r *http.Request, v *visit
 		return s.ensureUser(s.ensureCallsEnabled(s.withAccountSync(s.handleAccountPhoneNumberAdd)))(w, r, v)
 	} else if r.Method == http.MethodDelete && r.URL.Path == apiAccountPhonePath {
 		return s.ensureUser(s.ensureCallsEnabled(s.withAccountSync(s.handleAccountPhoneNumberDelete)))(w, r, v)
+	} else if r.Method == http.MethodPut && r.URL.Path == apiAccountEmailVerifyPath {
+		return s.ensureUser(s.ensureEmailsEnabled(s.withAccountSync(s.handleAccountEmailVerify)))(w, r, v)
+	} else if r.Method == http.MethodPut && r.URL.Path == apiAccountEmailPath {
+		return s.ensureUser(s.ensureEmailsEnabled(s.withAccountSync(s.handleAccountEmailAdd)))(w, r, v)
+	} else if r.Method == http.MethodDelete && r.URL.Path == apiAccountEmailPath {
+		return s.ensureUser(s.ensureEmailsEnabled(s.withAccountSync(s.handleAccountEmailDelete)))(w, r, v)
 	} else if r.Method == http.MethodPost && apiWebPushPath == r.URL.Path {
 		return s.ensureWebPushEnabled(s.limitRequests(s.handleWebPushUpdate))(w, r, v)
 	} else if r.Method == http.MethodDelete && apiWebPushPath == r.URL.Path {
@@ -696,6 +723,7 @@ func (s *Server) configResponse() *apiConfigResponse {
 		EnablePayments:     s.config.StripeSecretKey != "",
 		EnableCalls:        s.config.TwilioAccount != "",
 		EnableEmails:       s.config.SMTPSenderFrom != "",
+		EnableEmailVerify:  s.config.SMTPSenderVerify,
 		EnableReservations: s.config.EnableReservations,
 		EnableWebPush:      s.config.WebPushPublicKey != "",
 		BillingContact:     s.config.BillingContact,
@@ -861,9 +889,17 @@ func (s *Server) handlePublishInternal(r *http.Request, v *visitor) (*model.Mess
 		return nil, errHTTPInsufficientStorageUnifiedPush.With(t)
 	} else if !util.ContainsIP(s.config.VisitorRequestExemptPrefixes, v.ip) && !vrate.MessageAllowed() {
 		return nil, errHTTPTooManyRequestsLimitMessages.With(t)
-	} else if email != "" && !vrate.EmailAllowed() {
-		return nil, errHTTPTooManyRequestsLimitEmails.With(t)
-	} else if call != "" {
+	}
+	if email != "" {
+		var httpErr *errHTTP
+		email, httpErr = s.convertEmailAddress(v.User(), email)
+		if httpErr != nil {
+			return nil, httpErr.With(t)
+		} else if !vrate.EmailAllowed() {
+			return nil, errHTTPTooManyRequestsLimitEmails.With(t)
+		}
+	}
+	if call != "" {
 		var httpErr *errHTTP
 		call, httpErr = s.convertPhoneNumber(v.User(), call)
 		if httpErr != nil {
@@ -1071,7 +1107,7 @@ func (s *Server) sendToFirebase(v *visitor, m *model.Message) {
 }
 
 func (s *Server) sendEmail(v *visitor, m *model.Message, email string) {
-	logvm(v, m).Tag(tagEmail).Field("email", email).Debug("Sending email to %s", email)
+	logvm(v, m).Tag(tagEmail).Field("email", email).Info("Sending email to %s", email)
 	if err := s.smtpSender.Send(v, m, email); err != nil {
 		logvm(v, m).Tag(tagEmail).Field("email", email).Err(err).Warn("Unable to send email to %s: %v", email, err.Error())
 		minc(metricEmailsPublishedFailure)
@@ -1169,7 +1205,7 @@ func (s *Server) parsePublishParams(r *http.Request, m *model.Message) (cache bo
 		m.Icon = icon
 	}
 	email = readParam(r, "x-email", "x-e-mail", "email", "e-mail", "mail", "e")
-	if email != "" && !emailAddressRegex.MatchString(email) {
+	if email != "" && !emailAddressRegex.MatchString(email) && !toBool(email) {
 		return false, false, "", "", "", false, "", errHTTPBadRequestEmailAddressInvalid
 	}
 	if s.smtpSender == nil && email != "" {
@@ -1509,7 +1545,7 @@ func (s *Server) handleSubscribeHTTP(w http.ResponseWriter, r *http.Request, v *
 		return errHTTPTooManyRequestsLimitSubscriptions
 	}
 	defer v.RemoveSubscription()
-	topics, topicsStr, err := s.topicsFromPath(r.URL.Path)
+	topics, topicsStr, err := s.topicsFromPath(v, r.URL.Path)
 	if err != nil {
 		return err
 	}
@@ -1612,7 +1648,7 @@ func (s *Server) handleSubscribeWS(w http.ResponseWriter, r *http.Request, v *vi
 	defer v.RemoveSubscription()
 	logvr(v, r).Tag(tagWebsocket).Debug("WebSocket connection opened")
 	defer logvr(v, r).Tag(tagWebsocket).Debug("WebSocket connection closed")
-	topics, topicsStr, err := s.topicsFromPath(r.URL.Path)
+	topics, topicsStr, err := s.topicsFromPath(v, r.URL.Path)
 	if err != nil {
 		return err
 	}
@@ -1882,24 +1918,26 @@ func (s *Server) handleOptions(w http.ResponseWriter, _ *http.Request, _ *visito
 }
 
 // topicFromPath returns the topic from a root path (e.g. /mytopic), creating it if it doesn't exist.
-func (s *Server) topicFromPath(path string) (*topic, error) {
+// The visitor is consulted for the per-visitor topic-creation rate limit; pass nil to bypass (internal use).
+func (s *Server) topicFromPath(v *visitor, path string) (*topic, error) {
 	parts := strings.Split(path, "/")
 	if len(parts) < 2 {
 		return nil, errHTTPBadRequestTopicInvalid
 	}
-	return s.topicFromID(parts[1])
+	return s.topicFromID(v, parts[1])
 }
 
 // topicsFromPath returns the topic from a root path (e.g. /mytopic,mytopic2), creating it if it doesn't exist.
-func (s *Server) topicsFromPath(path string) ([]*topic, string, error) {
+// The visitor is consulted for the per-visitor topic-creation rate limit; pass nil to bypass (internal use).
+func (s *Server) topicsFromPath(v *visitor, path string) ([]*topic, string, error) {
 	parts := strings.Split(path, "/")
 	if len(parts) < 2 {
 		return nil, "", errHTTPBadRequestTopicInvalid
 	}
 	topicIDs := util.SplitNoEmpty(parts[1], ",")
-	topics, err := s.topicsFromIDs(topicIDs...)
+	topics, err := s.topicsFromIDs(v, topicIDs...)
 	if err != nil {
-		return nil, "", errHTTPBadRequestTopicInvalid
+		return nil, "", err
 	}
 	return topics, parts[1], nil
 }
@@ -1914,7 +1952,9 @@ func (s *Server) sequenceIDFromPath(path string) (string, *errHTTP) {
 }
 
 // topicsFromIDs returns the topics with the given IDs, creating them if they don't exist.
-func (s *Server) topicsFromIDs(ids ...string) ([]*topic, error) {
+// If v is non-nil, its per-visitor topic-creation rate limiter is consulted before each new
+// insertion into the in-memory topic map. Pass nil to bypass the limit (internal use only).
+func (s *Server) topicsFromIDs(v *visitor, ids ...string) ([]*topic, error) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	topics := make([]*topic, 0)
@@ -1926,6 +1966,9 @@ func (s *Server) topicsFromIDs(ids ...string) ([]*topic, error) {
 			if len(s.topics) >= s.config.TotalTopicLimit {
 				return nil, errHTTPTooManyRequestsLimitTotalTopics
 			}
+			if v != nil && !v.TopicCreationAllowed() {
+				return nil, errHTTPTooManyRequestsLimitTopicCreation
+			}
 			s.topics[id] = newTopic(id)
 		}
 		topics = append(topics, s.topics[id])
@@ -1934,8 +1977,9 @@ func (s *Server) topicsFromIDs(ids ...string) ([]*topic, error) {
 }
 
 // topicFromID returns the topic with the given ID, creating it if it doesn't exist.
-func (s *Server) topicFromID(id string) (*topic, error) {
-	topics, err := s.topicsFromIDs(id)
+// The visitor is consulted for the per-visitor topic-creation rate limit; pass nil to bypass (internal use).
+func (s *Server) topicFromID(v *visitor, id string) (*topic, error) {
+	topics, err := s.topicsFromIDs(v, id)
 	if err != nil {
 		return nil, err
 	}
@@ -2205,7 +2249,7 @@ func (s *Server) authorizeTopic(next handleFunc, perm user.Permission) handleFun
 		if s.userManager == nil {
 			return next(w, r, v)
 		}
-		topics, _, err := s.topicsFromPath(r.URL.Path)
+		topics, _, err := s.topicsFromPath(v, r.URL.Path)
 		if err != nil {
 			return err
 		}

server/server.yml

@@ -116,6 +116,8 @@
 # - auth-tokens is a list of access tokens that are automatically created when the server starts.
 #   Each entry is in the format "<username>:<token>[:<label>]", e.g. "phil:tk_1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef:My token".
 #   Use 'ntfy token generate' to generate a new access token.
+# - auth-access-cache enables an in-memory snapshot of the access control table that authorizes every
+#   request without a database round-trip.
 #
 # Debian/RPM package users:
 #   Use /var/lib/ntfy/user.db as user database to avoid permission issues. The package
@@ -131,6 +133,7 @@
 # auth-users:
 # auth-access:
 # auth-tokens:
+# auth-access-cache: false
 
 # If set, the X-Forwarded-For header (or whatever is configured in proxy-forwarded-header) is used to determine
 # the visitor IP address instead of the remote address of the connection.
@@ -193,11 +196,14 @@
 # - smtp-sender-addr is the hostname:port of the SMTP server
 # - smtp-sender-from is the e-mail address of the sender
 # - smtp-sender-user/smtp-sender-pass are the username and password of the SMTP user (leave blank for no auth)
+# - smtp-sender-verify is a flag that forces email recipient verification when enabled. If set to true,
+#   only verified email recipients can be used in the X-Email header.
 #
 # smtp-sender-addr:
 # smtp-sender-from:
 # smtp-sender-user:
 # smtp-sender-pass:
+# smtp-sender-verify: false
 
 # If enabled, ntfy will launch a lightweight SMTP server for incoming messages. Once configured, users can send
 # emails to a topic e-mail address to publish messages to a topic.
@@ -355,6 +361,15 @@
 # visitor-email-limit-burst: 16
 # visitor-email-limit-replenish: "1h"
 
+# Rate limiting: Allowed new topic creations per visitor. A "creation" is when a request
+# causes a previously-unknown topic ID to be added to the in-memory topic map. Touches of
+# existing topics do not consume tokens. Mitigates topic-enumeration / squatting attacks.
+# - visitor-topic-creation-limit-burst is the initial bucket of new-topic tokens (0 = disabled)
+# - visitor-topic-creation-limit-replenish is the rate at which the bucket is refilled
+#
+# visitor-topic-creation-limit-burst: 100
+# visitor-topic-creation-limit-replenish: "1m"
+
 # Rate limiting: IPv4/IPv6 address prefix bits used for rate limiting
 # - visitor-prefix-bits-ipv4: number of bits of the IPv4 address to use for rate limiting (default: 32, full address)
 # - visitor-prefix-bits-ipv6: number of bits of the IPv6 address to use for rate limiting (default: 64, /64 subnet)

server/server_account.go

@@ -160,6 +160,15 @@ func (s *Server) handleAccountGet(w http.ResponseWriter, r *http.Request, v *vis
 				response.PhoneNumbers = phoneNumbers
 			}
 		}
+		if s.mailSender != nil {
+			emails, err := s.userManager.Emails(u.ID)
+			if err != nil {
+				return err
+			}
+			if len(emails) > 0 {
+				response.Emails = emails
+			}
+		}
 	} else {
 		response.Username = user.Everyone
 		response.Role = string(user.RoleAnonymous)
@@ -476,7 +485,7 @@ func (s *Server) handleAccountReservationAdd(w http.ResponseWriter, r *http.Requ
 		return err
 	}
 	// Kill existing subscribers
-	t, err := s.topicFromID(req.Topic)
+	t, err := s.topicFromID(v, req.Topic)
 	if err != nil {
 		return err
 	}
@@ -606,6 +615,103 @@ func (s *Server) handleAccountPhoneNumberDelete(w http.ResponseWriter, r *http.R
 	return s.writeJSON(w, newSuccessResponse())
 }
 
+func (s *Server) handleAccountEmailVerify(w http.ResponseWriter, r *http.Request, v *visitor) error {
+	u := v.User()
+	req, err := readJSONWithLimit[apiAccountEmailVerifyRequest](r.Body, jsonBodyBytesLimit, false)
+	if err != nil {
+		return err
+	} else if !emailAddressRegex.MatchString(req.Email) {
+		return errHTTPBadRequestEmailAddressInvalid
+	}
+	// Check user is allowed to add emails
+	if u == nil {
+		return errHTTPUnauthorized
+	} else if u.IsUser() && u.Tier != nil && u.Tier.EmailLimit == 0 {
+		return errHTTPUnauthorized
+	} else if u.IsUser() && u.Tier == nil && s.config.VisitorEmailLimitBurst == 0 {
+		return errHTTPUnauthorized
+	}
+	// Check if email already exists
+	emails, err := s.userManager.Emails(u.ID)
+	if err != nil {
+		return err
+	} else if util.Contains(emails, req.Email) {
+		return errHTTPConflictEmailExists
+	}
+	// Check email rate limit (counts against the user's email quota)
+	if !v.EmailAllowed() {
+		return errHTTPTooManyRequestsLimitEmails
+	}
+	// Send verification email
+	logvr(v, r).Tag(tagAccount).Field("email", req.Email).Info("Sending email verification")
+	if err := s.mailSender.SendVerification(req.Email); err != nil {
+		return err
+	}
+	return s.writeJSON(w, newSuccessResponse())
+}
+
+func (s *Server) handleAccountEmailAdd(w http.ResponseWriter, r *http.Request, v *visitor) error {
+	u := v.User()
+	req, err := readJSONWithLimit[apiAccountEmailAddRequest](r.Body, jsonBodyBytesLimit, false)
+	if err != nil {
+		return err
+	} else if !emailAddressRegex.MatchString(req.Email) {
+		return errHTTPBadRequestEmailAddressInvalid
+	} else if !s.mailSender.CheckVerification(req.Email, req.Code) {
+		return errHTTPBadRequestEmailVerificationCodeInvalid
+	}
+	logvr(v, r).Tag(tagAccount).Field("email", req.Email).Info("Adding email as verified")
+	if err := s.userManager.AddEmail(u.ID, req.Email); err != nil {
+		return err
+	}
+	return s.writeJSON(w, newSuccessResponse())
+}
+
+func (s *Server) handleAccountEmailDelete(w http.ResponseWriter, r *http.Request, v *visitor) error {
+	u := v.User()
+	req, err := readJSONWithLimit[apiAccountEmailVerifyRequest](r.Body, jsonBodyBytesLimit, false)
+	if err != nil {
+		return err
+	}
+	if !emailAddressRegex.MatchString(req.Email) {
+		return errHTTPBadRequestEmailAddressInvalid
+	}
+	logvr(v, r).Tag(tagAccount).Field("email", req.Email).Debug("Deleting verified email")
+	if err := s.userManager.RemoveEmail(u.ID, req.Email); err != nil {
+		return err
+	}
+	return s.writeJSON(w, newSuccessResponse())
+}
+
+// convertEmailAddress checks the email address against the user's verified email list.
+// If smtp-sender-verify is false (default), the email is passed through as-is for
+// backwards compatibility. If true, the user must be authenticated and the email must be
+// in their verified list. "yes"/"true"/"1" resolves to the first verified email.
+func (s *Server) convertEmailAddress(u *user.User, email string) (string, *errHTTP) {
+	if !s.config.SMTPSenderVerify {
+		if toBool(email) {
+			return "", errHTTPBadRequestEmailAddressInvalid
+		}
+		return email, nil
+	} else if u == nil {
+		return "", errHTTPBadRequestAnonymousEmailNotAllowed
+	} else if s.userManager == nil {
+		return email, nil
+	}
+	emails, err := s.userManager.Emails(u.ID)
+	if err != nil {
+		return "", errHTTPInternalError
+	} else if len(emails) == 0 {
+		return "", errHTTPBadRequestEmailAddressNotVerified
+	}
+	if toBool(email) {
+		return emails[0], nil
+	} else if util.Contains(emails, email) {
+		return email, nil
+	}
+	return "", errHTTPBadRequestEmailAddressNotVerified
+}
+
 // publishSyncEventAsync kicks of a Go routine to publish a sync message to the user's sync topic
 func (s *Server) publishSyncEventAsync(v *visitor) {
 	go func() {
@@ -622,7 +728,7 @@ func (s *Server) publishSyncEvent(v *visitor) error {
 		return nil
 	}
 	logv(v).Field("sync_topic", u.SyncTopic).Trace("Publishing sync event to user's sync topic")
-	syncTopic, err := s.topicFromID(u.SyncTopic)
+	syncTopic, err := s.topicFromID(nil, u.SyncTopic) // internal: no rate limit
 	if err != nil {
 		return err
 	}

server/server_account_test.go

@@ -9,6 +9,7 @@ import (
 	"heckel.io/ntfy/v2/util"
 	"io"
 	"net/netip"
+	"os"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -360,6 +361,15 @@ func TestAccount_ExtendToken(t *testing.T) {
 		require.Nil(t, err)
 		require.Equal(t, "some label", token.Label)
 		require.Equal(t, expires.Unix(), token.Expires)
+
+		body = fmt.Sprintf(`{"token":"%s", "expires": 0}`, token.Token)
+		rr = request(t, s, "PATCH", "/v1/account/token", body, map[string]string{
+			"Authorization": util.BearerAuth(token.Token),
+		})
+		require.Equal(t, 200, rr.Code)
+		token, err = util.UnmarshalJSON[apiAccountTokenResponse](io.NopCloser(rr.Body))
+		require.Nil(t, err)
+		require.Equal(t, int64(0), token.Expires)
 	})
 }
 
@@ -673,7 +683,6 @@ func TestAccount_Reservation_Delete_Messages_And_Attachments(t *testing.T) {
 		t.Parallel()
 		conf := newTestConfigWithAuthFile(t, databaseURL)
 		conf.AuthDefault = user.PermissionReadWrite
-		conf.AttachmentOrphanGracePeriod = 0 // For testing: delete orphans immediately
 		s := newTestServer(t, conf)
 
 		// Create user with tier
@@ -741,7 +750,11 @@ func TestAccount_Reservation_Delete_Messages_And_Attachments(t *testing.T) {
 		require.Equal(t, 200, rr.Code)
 
 		// Verify that messages and attachments were deleted
-		// This does not explicitly call the manager!
+		// This does not explicitly call the manager! We backdate the files so sync's
+		// grace period doesn't protect them.
+		past := time.Now().Add(-2 * time.Hour)
+		os.Chtimes(filepath.Join(s.config.AttachmentCacheDir, m1.ID), past, past)
+		os.Chtimes(filepath.Join(s.config.AttachmentCacheDir, m2.ID), past, past)
 		waitFor(t, func() bool {
 			s.attachment.Sync() // File cleanup is done by sync, not by the manager
 			ms, err := s.messageCache.Messages("mytopic1", model.SinceAllMessages, false)

server/server_firebase.go

@@ -241,16 +241,29 @@ func createAPNSAlertConfig(m *model.Message, data map[string]string) *messaging.
 	for k, v := range data {
 		apnsData[k] = v
 	}
+	aps := &messaging.Aps{
+		MutableContent: true,
+		Alert: &messaging.ApsAlert{
+			Title: m.Title,
+			Body:  maybeTruncateAPNSBodyMessage(m.Message),
+		},
+	}
+	headers := map[string]string{"apns-push-type": "alert"}
+
+	// Critical alerts (iOS): max priority messages bypass silent mode / Do Not Disturb. The iOS
+	// Notification Service Extension re-applies the critical sound based on priority, but we also
+	// flag the raw payload as critical (sound dict + interruption-level), so it stays critical even
+	// if the NSE never runs (e.g. when it exceeds its time budget or is dropped under memory pressure).
+	if m.Priority >= 5 {
+		aps.CriticalSound = &messaging.CriticalSound{Critical: true, Name: "default", Volume: 1.0}
+		aps.CustomData = map[string]any{"interruption-level": "critical"}
+		headers["apns-priority"] = "10"
+	}
 	return &messaging.APNSConfig{
+		Headers: headers,
 		Payload: &messaging.APNSPayload{
 			CustomData: apnsData,
-			Aps: &messaging.Aps{
-				MutableContent: true,
-				Alert: &messaging.ApsAlert{
-					Title: m.Title,
-					Body:  maybeTruncateAPNSBodyMessage(m.Message),
-				},
-			},
+			Aps:        aps,
 		},
 	}
 }

server/server_firebase_test.go

@@ -165,6 +165,9 @@ func TestToFirebaseMessage_Message_Normal_Allowed(t *testing.T) {
 		Priority: "high",
 	}, fbm.Android)
 	require.Equal(t, &messaging.APNSConfig{
+		Headers: map[string]string{
+			"apns-push-type": "alert",
+		},
 		Payload: &messaging.APNSPayload{
 			Aps: &messaging.Aps{
 				MutableContent: true,
@@ -248,6 +251,42 @@ func TestToFirebaseMessage_Message_Normal_Not_Allowed(t *testing.T) {
 	}, fbm.Data)
 	require.Equal(t, "", fbm.APNS.Payload.Aps.Alert.Title)
 	require.Equal(t, "New message", fbm.APNS.Payload.Aps.Alert.Body)
+	// Priority is kept when downgrading to a poll request (see toPollRequest), so a priority 5
+	// message still wakes iOS as a critical alert to poll for the message.
+	require.Equal(t, "10", fbm.APNS.Headers["apns-priority"])
+	require.True(t, fbm.APNS.Payload.Aps.CriticalSound.Critical)
+	require.Equal(t, "critical", fbm.APNS.Payload.Aps.CustomData["interruption-level"])
+}
+
+func TestToFirebaseMessage_Message_Critical(t *testing.T) {
+	m := model.NewDefaultMessage("mytopic", "this is urgent")
+	m.Priority = 5
+	m.Title = "wake up"
+	fbm, err := toFirebaseMessage(m, &testAuther{Allow: true})
+	require.Nil(t, err)
+
+	// Critical alerts use apns-priority 10, a critical sound dict, and interruption-level "critical"
+	// so the iOS device treats the message as critical (bypassing silent mode / Do Not Disturb).
+	require.Equal(t, "alert", fbm.APNS.Headers["apns-push-type"])
+	require.Equal(t, "10", fbm.APNS.Headers["apns-priority"])
+	require.NotNil(t, fbm.APNS.Payload.Aps.CriticalSound)
+	require.True(t, fbm.APNS.Payload.Aps.CriticalSound.Critical)
+	require.Equal(t, "default", fbm.APNS.Payload.Aps.CriticalSound.Name)
+	require.Equal(t, 1.0, fbm.APNS.Payload.Aps.CriticalSound.Volume)
+	require.Equal(t, "critical", fbm.APNS.Payload.Aps.CustomData["interruption-level"])
+}
+
+func TestToFirebaseMessage_Message_NotCritical(t *testing.T) {
+	m := model.NewDefaultMessage("mytopic", "this is normal")
+	m.Priority = 4
+	fbm, err := toFirebaseMessage(m, &testAuther{Allow: true})
+	require.Nil(t, err)
+
+	// Priority < 5 is a regular alert: no critical sound and no interruption-level.
+	require.Equal(t, "alert", fbm.APNS.Headers["apns-push-type"])
+	require.Empty(t, fbm.APNS.Headers["apns-priority"])
+	require.Nil(t, fbm.APNS.Payload.Aps.CriticalSound)
+	require.Nil(t, fbm.APNS.Payload.Aps.CustomData)
 }
 
 func TestToFirebaseMessage_PollRequest(t *testing.T) {
@@ -257,6 +296,9 @@ func TestToFirebaseMessage_PollRequest(t *testing.T) {
 	require.Equal(t, "mytopic", fbm.Topic)
 	require.Nil(t, fbm.Android)
 	require.Equal(t, &messaging.APNSConfig{
+		Headers: map[string]string{
+			"apns-push-type": "alert",
+		},
 		Payload: &messaging.APNSPayload{
 			Aps: &messaging.Aps{
 				MutableContent: true,

server/server_middleware.go

@@ -28,7 +28,7 @@ func (s *Server) limitRequests(next handleFunc) handleFunc {
 // limitRequestsWithTopic limits requests with a topic and stores the rate-limiting-subscriber and topic into request.Context
 func (s *Server) limitRequestsWithTopic(next handleFunc) handleFunc {
 	return func(w http.ResponseWriter, r *http.Request, v *visitor) error {
-		t, err := s.topicFromPath(r.URL.Path)
+		t, err := s.topicFromPath(v, r.URL.Path)
 		if err != nil {
 			return err
 		}
@@ -103,6 +103,15 @@ func (s *Server) ensureCallsEnabled(next handleFunc) handleFunc {
 	}
 }
 
+func (s *Server) ensureEmailsEnabled(next handleFunc) handleFunc {
+	return func(w http.ResponseWriter, r *http.Request, v *visitor) error {
+		if s.mailSender == nil || s.userManager == nil {
+			return errHTTPNotFound
+		}
+		return next(w, r, v)
+	}
+}
+
 func (s *Server) ensurePaymentsEnabled(next handleFunc) handleFunc {
 	return func(w http.ResponseWriter, r *http.Request, v *visitor) error {
 		if s.config.StripeSecretKey == "" || s.stripe == nil {

server/server_payments_test.go

@@ -14,6 +14,7 @@ import (
 	"heckel.io/ntfy/v2/util"
 	"io"
 	"net/netip"
+	"os"
 	"path/filepath"
 	"strings"
 	"sync"
@@ -443,7 +444,6 @@ func TestPayments_Webhook_Subscription_Updated_Downgrade_From_PastDue_To_Active(
 		c := newTestConfigWithAuthFile(t, databaseURL)
 		c.StripeSecretKey = "secret key"
 		c.StripeWebhookKey = "webhook key"
-		c.AttachmentOrphanGracePeriod = 0 // For testing: delete orphans immediately
 		s := newTestServer(t, c)
 		s.stripe = stripeMock
 
@@ -544,7 +544,11 @@ func TestPayments_Webhook_Subscription_Updated_Downgrade_From_PastDue_To_Active(
 		require.Equal(t, 1, len(r)) // "ztopic" reservation was deleted
 		require.Equal(t, "atopic", r[0].Topic)
 
-		// Verify that messages and attachments were deleted
+		// Verify that messages and attachments were deleted. We backdate the
+		// attachment files so sync's grace period doesn't protect them.
+		past := time.Now().Add(-2 * time.Hour)
+		os.Chtimes(filepath.Join(s.config.AttachmentCacheDir, a2.ID), past, past)
+		os.Chtimes(filepath.Join(s.config.AttachmentCacheDir, z2.ID), past, past)
 		time.Sleep(time.Second)
 		s.execManager()
 		s.attachment.Sync() // File cleanup is done by sync, not by the manager

server/server_test.go

@@ -1567,6 +1567,177 @@ func TestServer_PublishEmailAddressInvalid(t *testing.T) {
 	})
 }
 
+func TestServer_PublishEmailVerify_VerifiedAddress(t *testing.T) {
+	forEachBackend(t, func(t *testing.T, databaseURL string) {
+		conf := newTestConfigWithAuthFile(t, databaseURL)
+		conf.SMTPSenderVerify = true
+		s := newTestServer(t, conf)
+		s.smtpSender = &testMailer{}
+		defer s.closeDatabases()
+
+		require.Nil(t, s.userManager.AddUser("phil", "phil", user.RoleUser, false))
+		u, err := s.userManager.User("phil")
+		require.Nil(t, err)
+		require.Nil(t, s.userManager.AddEmail(u.ID, "phil@example.com"))
+
+		// Verified address should succeed
+		response := request(t, s, "PUT", "/mytopic", "hi", map[string]string{
+			"Email":         "phil@example.com",
+			"Authorization": util.BasicAuth("phil", "phil"),
+		})
+		require.Equal(t, 200, response.Code)
+
+		// Unverified address should fail
+		response = request(t, s, "PUT", "/mytopic", "hi", map[string]string{
+			"Email":         "other@example.com",
+			"Authorization": util.BasicAuth("phil", "phil"),
+		})
+		require.Equal(t, 400, response.Code)
+		require.Equal(t, 40052, toHTTPError(t, response.Body.String()).Code)
+	})
+}
+
+func TestServer_PublishEmailVerify_BoolValue(t *testing.T) {
+	forEachBackend(t, func(t *testing.T, databaseURL string) {
+		conf := newTestConfigWithAuthFile(t, databaseURL)
+		conf.SMTPSenderVerify = true
+		s := newTestServer(t, conf)
+		s.smtpSender = &testMailer{}
+		defer s.closeDatabases()
+
+		require.Nil(t, s.userManager.AddUser("phil", "phil", user.RoleUser, false))
+		u, err := s.userManager.User("phil")
+		require.Nil(t, err)
+		require.Nil(t, s.userManager.AddEmail(u.ID, "phil@example.com"))
+
+		// "yes" should resolve to first verified email
+		response := request(t, s, "PUT", "/mytopic", "hi", map[string]string{
+			"Email":         "yes",
+			"Authorization": util.BasicAuth("phil", "phil"),
+		})
+		require.Equal(t, 200, response.Code)
+
+		// "true" and "1" should also work
+		for _, val := range []string{"true", "1"} {
+			response = request(t, s, "PUT", "/mytopic", "hi", map[string]string{
+				"Email":         val,
+				"Authorization": util.BasicAuth("phil", "phil"),
+			})
+			require.Equal(t, 200, response.Code, "expected 200 for email: %s", val)
+		}
+	})
+}
+
+func TestServer_PublishEmailVerify_BoolValue_NoVerify(t *testing.T) {
+	forEachBackend(t, func(t *testing.T, databaseURL string) {
+		s := newTestServer(t, newTestConfig(t, databaseURL))
+		s.smtpSender = &testMailer{}
+
+		// "yes" without smtp-sender-verify should fail with invalid address
+		response := request(t, s, "PUT", "/mytopic", "hi", map[string]string{
+			"Email": "yes",
+		})
+		require.Equal(t, 400, response.Code)
+		require.Equal(t, 40050, toHTTPError(t, response.Body.String()).Code)
+	})
+}
+
+func TestServer_PublishEmailVerify_Anonymous(t *testing.T) {
+	forEachBackend(t, func(t *testing.T, databaseURL string) {
+		conf := newTestConfigWithAuthFile(t, databaseURL)
+		conf.SMTPSenderVerify = true
+		s := newTestServer(t, conf)
+		s.smtpSender = &testMailer{}
+		defer s.closeDatabases()
+
+		// Anonymous user should be rejected
+		response := request(t, s, "PUT", "/mytopic", "hi", map[string]string{
+			"Email": "test@example.com",
+		})
+		require.Equal(t, 400, response.Code)
+		require.Equal(t, 40053, toHTTPError(t, response.Body.String()).Code)
+	})
+}
+
+func TestServer_PublishEmailVerify_NoVerifiedEmails(t *testing.T) {
+	forEachBackend(t, func(t *testing.T, databaseURL string) {
+		conf := newTestConfigWithAuthFile(t, databaseURL)
+		conf.SMTPSenderVerify = true
+		s := newTestServer(t, conf)
+		s.smtpSender = &testMailer{}
+		defer s.closeDatabases()
+
+		require.Nil(t, s.userManager.AddUser("phil", "phil", user.RoleUser, false))
+
+		// Authenticated user with no verified emails should fail
+		response := request(t, s, "PUT", "/mytopic", "hi", map[string]string{
+			"Email":         "phil@example.com",
+			"Authorization": util.BasicAuth("phil", "phil"),
+		})
+		require.Equal(t, 400, response.Code)
+		require.Equal(t, 40052, toHTTPError(t, response.Body.String()).Code)
+	})
+}
+
+func TestServer_PublishEmailVerify_Disabled_Backwards_Compatible(t *testing.T) {
+	forEachBackend(t, func(t *testing.T, databaseURL string) {
+		s := newTestServer(t, newTestConfig(t, databaseURL))
+		s.smtpSender = &testMailer{}
+
+		// Without smtp-sender-verify, any email address should work (backwards compatible)
+		response := request(t, s, "PUT", "/mytopic", "hi", map[string]string{
+			"Email": "anyone@example.com",
+		})
+		require.Equal(t, 200, response.Code)
+	})
+}
+
+func TestServer_AccountEmailVerify_UserWithoutTier(t *testing.T) {
+	// This test verifies that an authenticated user WITHOUT a tier can verify emails
+	// when the default visitor email limit allows it.
+	forEachBackend(t, func(t *testing.T, databaseURL string) {
+		conf := newTestConfigWithAuthFile(t, databaseURL)
+		conf.SMTPSenderVerify = true
+		conf.SMTPSenderAddr = "localhost:25" // Dummy SMTP server (will fail to send, but that's ok)
+		conf.SMTPSenderFrom = "noreply@example.com"
+		s := newTestServer(t, conf)
+		defer s.closeDatabases()
+
+		// Create a user without a tier
+		require.Nil(t, s.userManager.AddUser("ben", "ben", user.RoleUser, false))
+
+		// Verify email request should NOT return 401
+		response := request(t, s, "PUT", "/v1/account/email/verify", `{"email":"ben@example.com"}`, map[string]string{
+			"Authorization": util.BasicAuth("ben", "ben"),
+		})
+		// The request will fail (SMTP not available), but it must NOT be a 401
+		require.NotEqual(t, 401, response.Code)
+	})
+}
+
+func TestServer_AccountEmailVerify_UserWithoutTier_EmailLimitZero(t *testing.T) {
+	// This test verifies that a tier-less user is rejected when the server's
+	// visitor email limit is zero (email sending disabled).
+	forEachBackend(t, func(t *testing.T, databaseURL string) {
+		conf := newTestConfigWithAuthFile(t, databaseURL)
+		conf.SMTPSenderVerify = true
+		conf.SMTPSenderAddr = "localhost:25"
+		conf.SMTPSenderFrom = "noreply@example.com"
+		conf.VisitorEmailLimitBurst = 0
+		s := newTestServer(t, conf)
+		defer s.closeDatabases()
+
+		// Create a user without a tier
+		require.Nil(t, s.userManager.AddUser("ben", "ben", user.RoleUser, false))
+
+		// Should be rejected with 401 since email sending is disabled
+		response := request(t, s, "PUT", "/v1/account/email/verify", `{"email":"ben@example.com"}`, map[string]string{
+			"Authorization": util.BasicAuth("ben", "ben"),
+		})
+		require.Equal(t, 401, response.Code)
+	})
+}
+
 func TestServer_PublishAndExpungeTopicAfter16Hours(t *testing.T) {
 	forEachBackend(t, func(t *testing.T, databaseURL string) {
 		t.Parallel()
@@ -2285,7 +2456,6 @@ func TestServer_PublishAttachmentAndExpire(t *testing.T) {
 
 		c := newTestConfig(t, databaseURL)
 		c.AttachmentExpiryDuration = time.Millisecond // Hack
-		c.AttachmentOrphanGracePeriod = 0             // For testing: delete orphans immediately
 		s := newTestServer(t, c)
 
 		// Publish and make sure we can retrieve it
@@ -2300,7 +2470,9 @@ func TestServer_PublishAttachmentAndExpire(t *testing.T) {
 		require.Equal(t, 200, response.Code)
 		require.Equal(t, content, response.Body.String())
 
-		// Prune and makes sure it's gone
+		// Prune and makes sure it's gone. We backdate the file so sync's grace
+		// period doesn't protect it, then run the manager + sync explicitly.
+		require.Nil(t, os.Chtimes(file, time.Now().Add(-2*time.Hour), time.Now().Add(-2*time.Hour)))
 		waitFor(t, func() bool {
 			s.execManager()
 			s.attachment.Sync() // File cleanup is done by sync, not by the manager
@@ -2413,6 +2585,7 @@ func TestServer_PublishAttachmentWithTierBasedLimits(t *testing.T) {
 		require.Nil(t, s.userManager.AddTier(&user.Tier{
 			Code:                     "test",
 			MessageLimit:             100,
+			MessageExpiryDuration:    time.Hour,
 			AttachmentFileSizeLimit:  50_000,
 			AttachmentTotalSizeLimit: 200_000,
 			AttachmentExpiryDuration: 30 * time.Second,
@@ -2676,7 +2849,7 @@ func TestServer_PublishWhileUpdatingStatsWithLotsOfMessages(t *testing.T) {
 		messages := make([]*model.Message, 0)
 		for i := 0; i < count; i++ {
 			topicID := fmt.Sprintf("topic%d", i)
-			_, err := s.topicsFromIDs(topicID) // Add topic to internal s.topics array
+			_, err := s.topicsFromIDs(nil, topicID) // Add topic to internal s.topics array
 			require.Nil(t, err)
 			messages = append(messages, model.NewDefaultMessage(topicID, "some message"))
 		}
@@ -2700,7 +2873,7 @@ func TestServer_PublishWhileUpdatingStatsWithLotsOfMessages(t *testing.T) {
 		response := request(t, s, "PUT", "/mytopic", "some body", nil)
 		m := toMessage(t, response.Body.String())
 		require.Equal(t, "some body", m.Message)
-		require.True(t, time.Since(start) < 500*time.Millisecond)
+		require.True(t, time.Since(start) < 2*time.Second)
 		log.Info("Done: Publishing message; took %s", time.Since(start).Round(time.Millisecond))
 
 		// Wait for all Goroutines
@@ -2975,6 +3148,67 @@ func TestServer_SubscriberRateLimiting_ProtectedTopics_WithDefaultReadWrite(t *t
 	})
 }
 
+func TestServer_VisitorTopicCreationLimit(t *testing.T) {
+	forEachBackend(t, func(t *testing.T, databaseURL string) {
+		c := newTestConfig(t, databaseURL)
+		c.VisitorTopicCreationLimitBurst = 5
+		c.VisitorTopicCreationLimitReplenish = time.Hour // Effectively no refill during the test
+		s := newTestServer(t, c)
+
+		// First 5 brand-new topics succeed
+		for i := 0; i < 5; i++ {
+			rr := request(t, s, "PUT", fmt.Sprintf("/fresh-topic-%d", i), "hi", nil)
+			require.Equal(t, 200, rr.Code)
+		}
+		// 6th brand-new topic is throttled (42911)
+		rr := request(t, s, "PUT", "/fresh-topic-6", "hi", nil)
+		require.Equal(t, 429, rr.Code)
+		require.Contains(t, rr.Body.String(), `"code":42911`)
+
+		// Republishing to an existing topic doesn't consume a token
+		for i := 0; i < 3; i++ {
+			rr := request(t, s, "PUT", "/fresh-topic-0", "again", nil)
+			require.Equal(t, 200, rr.Code)
+		}
+	})
+}
+
+func TestServer_VisitorTopicCreationLimit_Refill(t *testing.T) {
+	forEachBackend(t, func(t *testing.T, databaseURL string) {
+		t.Parallel()
+		c := newTestConfig(t, databaseURL)
+		c.VisitorTopicCreationLimitBurst = 2
+		c.VisitorTopicCreationLimitReplenish = 300 * time.Millisecond
+		s := newTestServer(t, c)
+
+		// Burn the burst
+		for i := 0; i < 2; i++ {
+			rr := request(t, s, "PUT", fmt.Sprintf("/refill-topic-%d", i), "hi", nil)
+			require.Equal(t, 200, rr.Code)
+		}
+		rr := request(t, s, "PUT", "/refill-topic-blocked", "hi", nil)
+		require.Equal(t, 429, rr.Code)
+
+		// Wait for a token to be replenished
+		time.Sleep(400 * time.Millisecond)
+
+		rr = request(t, s, "PUT", "/refill-topic-after", "hi", nil)
+		require.Equal(t, 200, rr.Code)
+	})
+}
+
+func TestServer_VisitorTopicCreationLimit_Disabled(t *testing.T) {
+	forEachBackend(t, func(t *testing.T, databaseURL string) {
+		c := newTestConfig(t, databaseURL)
+		c.VisitorTopicCreationLimitBurst = 0 // 0 disables the limit
+		s := newTestServer(t, c)
+		for i := 0; i < 25; i++ {
+			rr := request(t, s, "PUT", fmt.Sprintf("/nolimit-topic-%d", i), "hi", nil)
+			require.Equal(t, 200, rr.Code)
+		}
+	})
+}
+
 func TestServer_MessageHistoryAndStatsEndpoint(t *testing.T) {
 	forEachBackend(t, func(t *testing.T, databaseURL string) {
 		c := newTestConfig(t, databaseURL)
@@ -4193,7 +4427,7 @@ func newTestConfigWithAuthFile(t *testing.T, databaseURL string) *Config {
 func newTestServer(t *testing.T, config *Config) *Server {
 	server, err := New(config)
 	require.Nil(t, err)
-	t.Cleanup(server.closeDatabases)
+	t.Cleanup(server.Stop)
 	return server
 }
 

server/server_webpush.go

@@ -7,7 +7,6 @@ import (
 	"fmt"
 	"net/http"
 	"regexp"
-	"strings"
 
 	"github.com/SherClockHolmes/webpush-go"
 	"heckel.io/ntfy/v2/log"
@@ -24,37 +23,40 @@ const (
 	webPushTopicSubscribeLimit = 50
 )
 
-var (
-	webPushAllowedEndpointsPatterns = []string{
-		"https://*.google.com/",
-		"https://*.googleapis.com/",
-		"https://*.mozilla.com/",
-		"https://*.mozaws.net/",
-		"https://*.windows.com/",
-		"https://*.microsoft.com/",
-		"https://*.apple.com/",
-	}
-	webPushAllowedEndpointsRegex *regexp.Regexp
-)
+// webPushAllowedEndpointsRegexes is the host-level allow-list of web push services ntfy
+// will deliver to. Each regex anchors the scheme and matches the stable service host,
+// followed by the authority/path boundary "/". Instance-specific labels (e.g. the
+// "wns2-<region>" prefix on Windows Notification Service hosts) are wildcarded with
+// a single-label pattern ([^/]+) that cannot span into the path.
+// See GHSA-w9hq-5jg7-q4j7 for why wildcarding the entire host is insufficient.
+var webPushAllowedEndpointsRegexes = []*regexp.Regexp{
+	regexp.MustCompile(`^https://fcm\.googleapis\.com/`),
+	regexp.MustCompile(`^https://jmt17\.google\.com/`),
+	regexp.MustCompile(`^https://updates\.push\.services\.mozilla\.com/`),
+	regexp.MustCompile(`^https://[^/]+\.mozaws\.net/`),
+	regexp.MustCompile(`^https://web\.push\.apple\.com/`),
+	regexp.MustCompile(`^https://[^/]+\.notify\.windows\.com/`),
+}
 
-func init() {
-	for i, pattern := range webPushAllowedEndpointsPatterns {
-		webPushAllowedEndpointsPatterns[i] = strings.ReplaceAll(strings.ReplaceAll(pattern, ".", "\\."), "*", ".+")
+func webPushEndpointAllowed(endpoint string) bool {
+	for _, re := range webPushAllowedEndpointsRegexes {
+		if re.MatchString(endpoint) {
+			return true
+		}
 	}
-	allPatterns := fmt.Sprintf("^(%s)", strings.Join(webPushAllowedEndpointsPatterns, "|"))
-	webPushAllowedEndpointsRegex = regexp.MustCompile(allPatterns)
+	return false
 }
 
 func (s *Server) handleWebPushUpdate(w http.ResponseWriter, r *http.Request, v *visitor) error {
 	req, err := readJSONWithLimit[apiWebPushUpdateSubscriptionRequest](r.Body, jsonBodyBytesLimit, false)
 	if err != nil || req.Endpoint == "" || req.P256dh == "" || req.Auth == "" {
 		return errHTTPBadRequestWebPushSubscriptionInvalid
-	} else if !webPushAllowedEndpointsRegex.MatchString(req.Endpoint) {
+	} else if !webPushEndpointAllowed(req.Endpoint) {
 		return errHTTPBadRequestWebPushEndpointUnknown
 	} else if len(req.Topics) > webPushTopicSubscribeLimit {
 		return errHTTPBadRequestWebPushTopicCountTooHigh
 	}
-	topics, err := s.topicsFromIDs(req.Topics...)
+	topics, err := s.topicsFromIDs(v, req.Topics...)
 	if err != nil {
 		return err
 	}

server/server_webpush_test.go

@@ -87,6 +87,78 @@ func TestServer_WebPush_TopicAdd_InvalidEndpoint(t *testing.T) {
 	})
 }
 
+func TestServer_WebPush_EndpointRegex(t *testing.T) {
+	// Synthetic endpoint samples representing each supported push service host shape.
+	allowed := []string{
+		// Google FCM (legacy send, webpush, preprod webpush)
+		"https://fcm.googleapis.com/fcm/send/FAKETOKEN:APA91b-placeholder-not-a-real-token",
+		"https://fcm.googleapis.com/wp/FAKETOKEN:APA91b-placeholder-not-a-real-token",
+		"https://fcm.googleapis.com/preprod/wp/FAKETOKEN:APA91b-placeholder-not-a-real-token",
+		"https://jmt17.google.com/fcm/send/FAKETOKEN:APA91b-placeholder-not-a-real-token",
+		// Mozilla autopush (v1 legacy, v2 current, plus AWS-hosted infra)
+		"https://updates.push.services.mozilla.com/wpush/v1/placeholder-not-a-real-token",
+		"https://updates.push.services.mozilla.com/wpush/v2/placeholder-not-a-real-token",
+		"https://autopush.mozaws.net/wpush/v1/placeholder-not-a-real-token",
+		// Apple Web Push
+		"https://web.push.apple.com/placeholder-not-a-real-token",
+		// Microsoft WNS: instance-specific "wns2-<region>" prefix is wildcarded
+		"https://wns2-bn3p.notify.windows.com/w/?token=placeholder",
+		"https://wns2-ch1p.notify.windows.com/w/?token=placeholder",
+		"https://wns2-par02p.notify.windows.com/w/?token=placeholder",
+		"https://wns2-pn1p.notify.windows.com/w/?token=placeholder",
+		"https://wns2-am3p.notify.windows.com/w/?token=placeholder",
+	}
+	denied := []string{
+		// HTTP (not HTTPS)
+		"http://fcm.googleapis.com/fcm/send/abc",
+		// Unrelated host
+		"https://attacker.example.com/webpush",
+		// GHSA-w9hq-5jg7-q4j7 bypass: allowed host embedded in path
+		"https://attacker.com/x.google.com/push",
+		"https://attacker.example.com/fcm.googleapis.com/fcm/send/abc",
+		"https://evil.test/web.push.apple.com/3/device/abc",
+		"https://ntfytest.requestcatcher.com/path.google.com/push",
+		"https://ntfytest.requestcatcher.com/a.google.com/toto",
+		"https://ntfytest.requestcatcher.com/bypass.google.com/test",
+		"https://webhook.site/86e94e2e-2af4-4a31-a80b-e2f335cc6495/path.google.com/push",
+		"https://webhook.site/86e94e2e-2af4-4a31-a80b-e2f335cc6495/bypass.google.com/",
+		// Allowed host as a prefix of a different host (no separating slash)
+		"https://fcm.googleapis.com.attacker.com/fcm/send/abc",
+		"https://web.push.apple.com.evil.test/tok",
+		// Allowed host as a suffix of a different host (no separating dot)
+		"https://evilgoogle.com/",
+		"https://notapple.com/",
+		// Credentials/userinfo in the URL pointing at a different host
+		"https://fcm.googleapis.com@attacker.com/fcm/send/abc",
+		// Previously allowed by the wildcard allowlist but not actually used by Web Push
+		"https://api.push.apple.com/3/device/abc",
+		"https://android.googleapis.com/send/xyz",
+		"https://login.microsoft.com/anything",
+		// Bare notify.windows.com with no subdomain label
+		"https://notify.windows.com/w/?token=abc",
+	}
+	for _, endpoint := range allowed {
+		require.Truef(t, webPushEndpointAllowed(endpoint), "expected endpoint to be allowed: %s", endpoint)
+	}
+	for _, endpoint := range denied {
+		require.Falsef(t, webPushEndpointAllowed(endpoint), "expected endpoint to be denied: %s", endpoint)
+	}
+}
+
+func TestServer_WebPush_TopicAdd_BypassAttempt(t *testing.T) {
+	// Regression test for GHSA-w9hq-5jg7-q4j7: the allow-list regex previously had no
+	// end anchor, so a URL like https://attacker.example.com/x.google.com/... passed
+	// validation and caused the server to deliver push payloads to attacker-controlled
+	// endpoints (SSRF + message exfiltration via attacker-supplied p256dh key).
+	forEachBackend(t, func(t *testing.T, databaseURL string) {
+		s := newTestServer(t, newTestConfigWithWebPush(t, databaseURL))
+
+		response := request(t, s, "POST", "/v1/webpush", payloadForTopics(t, []string{"test-topic"}, "https://attacker.example.com/x.google.com/push"), nil)
+		require.Equal(t, 400, response.Code)
+		require.Equal(t, `{"code":40039,"http":400,"error":"invalid request: web push endpoint unknown"}`+"\n", response.Body.String())
+	})
+}
+
 func TestServer_WebPush_TopicAdd_TooManyTopics(t *testing.T) {
 	forEachBackend(t, func(t *testing.T, databaseURL string) {
 		s := newTestServer(t, newTestConfigWithWebPush(t, databaseURL))

server/smtp_sender.go

@@ -5,13 +5,12 @@ import (
 	"encoding/json"
 	"fmt"
 	"mime"
-	"net"
-	"net/smtp"
 	"strings"
 	"sync"
 	"time"
 
 	"heckel.io/ntfy/v2/log"
+	"heckel.io/ntfy/v2/mail"
 	"heckel.io/ntfy/v2/model"
 	"heckel.io/ntfy/v2/util"
 )
@@ -23,6 +22,7 @@ type mailer interface {
 
 type smtpSender struct {
 	config  *Config
+	sender  *mail.Sender
 	success int64
 	failure int64
 	mu      sync.Mutex
@@ -30,31 +30,22 @@ type smtpSender struct {
 
 func (s *smtpSender) Send(v *visitor, m *model.Message, to string) error {
 	return s.withCount(v, m, func() error {
-		host, _, err := net.SplitHostPort(s.config.SMTPSenderAddr)
+		message, err := formatMail(s.config.BaseURL, v.ip.String(), s.sender.From(), to, m)
 		if err != nil {
 			return err
 		}
-		message, err := formatMail(s.config.BaseURL, v.ip.String(), s.config.SMTPSenderFrom, to, m)
-		if err != nil {
-			return err
-		}
-		var auth smtp.Auth
-		if s.config.SMTPSenderUser != "" {
-			auth = smtp.PlainAuth("", s.config.SMTPSenderUser, s.config.SMTPSenderPass, host)
-		}
 		ev := logvm(v, m).
 			Tag(tagEmail).
 			Fields(log.Context{
-				"email_via":  s.config.SMTPSenderAddr,
-				"email_user": s.config.SMTPSenderUser,
+				"email_via":  s.sender.Addr(),
+				"email_user": s.sender.User(),
 				"email_to":   to,
 			})
 		if ev.IsTrace() {
 			ev.Field("email_body", message).Trace("Sending email")
-		} else if ev.IsDebug() {
-			ev.Debug("Sending email")
 		}
-		return smtp.SendMail(s.config.SMTPSenderAddr, auth, s.config.SMTPSenderFrom, []string{to}, []byte(message))
+		ev.Info("Sending email")
+		return s.sender.SendRaw(to, []byte(message))
 	})
 }
 

server/types.go

@@ -226,6 +226,15 @@ type apiAccountPhoneNumberAddRequest struct {
 	Code   string `json:"code"` // Only set when adding a phone number
 }
 
+type apiAccountEmailVerifyRequest struct {
+	Email string `json:"email"`
+}
+
+type apiAccountEmailAddRequest struct {
+	Email string `json:"email"`
+	Code  string `json:"code"`
+}
+
 type apiAccountTier struct {
 	Code string `json:"code"`
 	Name string `json:"name"`
@@ -282,6 +291,7 @@ type apiAccountResponse struct {
 	Reservations  []*apiAccountReservation   `json:"reservations,omitempty"`
 	Tokens        []*apiAccountTokenResponse `json:"tokens,omitempty"`
 	PhoneNumbers  []string                   `json:"phone_numbers,omitempty"`
+	Emails        []string                   `json:"emails,omitempty"`
 	Tier          *apiAccountTier            `json:"tier,omitempty"`
 	Limits        *apiAccountLimits          `json:"limits,omitempty"`
 	Stats         *apiAccountStats           `json:"stats,omitempty"`
@@ -302,6 +312,7 @@ type apiConfigResponse struct {
 	EnablePayments     bool     `json:"enable_payments"`
 	EnableCalls        bool     `json:"enable_calls"`
 	EnableEmails       bool     `json:"enable_emails"`
+	EnableEmailVerify  bool     `json:"enable_email_verify"`
 	EnableReservations bool     `json:"enable_reservations"`
 	EnableWebPush      bool     `json:"enable_web_push"`
 	BillingContact     string   `json:"billing_contact"`

server/visitor.go

@@ -2,6 +2,7 @@ package server
 
 import (
 	"fmt"
+	"math"
 	"net/netip"
 	"sync"
 	"time"
@@ -53,22 +54,23 @@ const (
 
 // visitor represents an API user, and its associated rate.Limiter used for rate limiting
 type visitor struct {
-	config              *Config
-	messageCache        *message.Cache
-	userManager         *user.Manager      // May be nil
-	ip                  netip.Addr         // Visitor IP address
-	user                *user.User         // Only set if authenticated user, otherwise nil
-	requestLimiter      *rate.Limiter      // Rate limiter for (almost) all requests (including messages)
-	messagesLimiter     *util.FixedLimiter // Rate limiter for messages
-	emailsLimiter       *util.RateLimiter  // Rate limiter for emails
-	callsLimiter        *util.FixedLimiter // Rate limiter for calls
-	subscriptionLimiter *util.FixedLimiter // Fixed limiter for active subscriptions (ongoing connections)
-	bandwidthLimiter    *util.RateLimiter  // Limiter for attachment bandwidth downloads
-	accountLimiter      *rate.Limiter      // Rate limiter for account creation, may be nil
-	authLimiter         *rate.Limiter      // Limiter for incorrect login attempts, may be nil
-	firebase            time.Time          // Next allowed Firebase message
-	seen                time.Time          // Last seen time of this visitor (needed for removal of stale visitors)
-	mu                  sync.RWMutex
+	config               *Config
+	messageCache         *message.Cache
+	userManager          *user.Manager      // May be nil
+	ip                   netip.Addr         // Visitor IP address
+	user                 *user.User         // Only set if authenticated user, otherwise nil
+	requestLimiter       *rate.Limiter      // Rate limiter for (almost) all requests (including messages)
+	messagesLimiter      *util.FixedLimiter // Rate limiter for messages
+	emailsLimiter        *util.RateLimiter  // Rate limiter for emails
+	callsLimiter         *util.FixedLimiter // Rate limiter for calls
+	subscriptionLimiter  *util.FixedLimiter // Fixed limiter for active subscriptions (ongoing connections)
+	topicCreationLimiter *rate.Limiter      // Rate limiter for inserting new topics into the in-memory topic map
+	bandwidthLimiter     *util.RateLimiter  // Limiter for attachment bandwidth downloads
+	accountLimiter       *rate.Limiter      // Rate limiter for account creation, may be nil
+	authLimiter          *rate.Limiter      // Limiter for incorrect login attempts, may be nil
+	firebase             time.Time          // Next allowed Firebase message
+	seen                 time.Time          // Last seen time of this visitor (needed for removal of stale visitors)
+	mu                   sync.RWMutex
 }
 
 type visitorInfo struct {
@@ -123,21 +125,22 @@ func newVisitor(conf *Config, messageCache *message.Cache, userManager *user.Man
 		calls = user.Stats.Calls
 	}
 	v := &visitor{
-		config:              conf,
-		messageCache:        messageCache,
-		userManager:         userManager, // May be nil
-		ip:                  ip,
-		user:                user,
-		firebase:            time.Unix(0, 0),
-		seen:                time.Now(),
-		subscriptionLimiter: util.NewFixedLimiter(int64(conf.VisitorSubscriptionLimit)),
-		requestLimiter:      nil, // Set in resetLimiters
-		messagesLimiter:     nil, // Set in resetLimiters, may be nil
-		emailsLimiter:       nil, // Set in resetLimiters
-		callsLimiter:        nil, // Set in resetLimiters, may be nil
-		bandwidthLimiter:    nil, // Set in resetLimiters
-		accountLimiter:      nil, // Set in resetLimiters, may be nil
-		authLimiter:         nil, // Set in resetLimiters, may be nil
+		config:               conf,
+		messageCache:         messageCache,
+		userManager:          userManager, // May be nil
+		ip:                   ip,
+		user:                 user,
+		firebase:             time.Unix(0, 0),
+		seen:                 time.Now(),
+		subscriptionLimiter:  util.NewFixedLimiter(int64(conf.VisitorSubscriptionLimit)),
+		requestLimiter:       nil, // Set in resetLimiters
+		messagesLimiter:      nil, // Set in resetLimiters, may be nil
+		emailsLimiter:        nil, // Set in resetLimiters
+		callsLimiter:         nil, // Set in resetLimiters, may be nil
+		topicCreationLimiter: nil, // Set in resetLimiters
+		bandwidthLimiter:     nil, // Set in resetLimiters
+		accountLimiter:       nil, // Set in resetLimiters, may be nil
+		authLimiter:          nil, // Set in resetLimiters, may be nil
 	}
 	v.resetLimitersNoLock(messages, emails, calls, false)
 	return v
@@ -152,14 +155,13 @@ func (v *visitor) Context() log.Context {
 func (v *visitor) contextNoLock() log.Context {
 	info := v.infoLightNoLock()
 	fields := log.Context{
-		"visitor_id":                     visitorID(v.ip, v.user, v.config),
-		"visitor_ip":                     v.ip.String(),
-		"visitor_seen":                   util.FormatTime(v.seen),
-		"visitor_messages":               info.Stats.Messages,
-		"visitor_messages_limit":         info.Limits.MessageLimit,
-		"visitor_messages_remaining":     info.Stats.MessagesRemaining,
-		"visitor_request_limiter_limit":  v.requestLimiter.Limit(),
-		"visitor_request_limiter_tokens": v.requestLimiter.Tokens(),
+		"visitor_id":                 visitorID(v.ip, v.user, v.config),
+		"visitor_ip":                 v.ip.String(),
+		"visitor_seen":               util.FormatTime(v.seen),
+		"visitor_messages":           info.Stats.Messages,
+		"visitor_messages_limit":     info.Limits.MessageLimit,
+		"visitor_messages_remaining": info.Stats.MessagesRemaining,
+		"visitor_requests_remaining": int64(math.Floor(v.requestLimiter.Tokens())),
 	}
 	if v.config.SMTPSenderFrom != "" {
 		fields["visitor_emails"] = info.Stats.Emails
@@ -172,8 +174,10 @@ func (v *visitor) contextNoLock() log.Context {
 		fields["visitor_calls_remaining"] = info.Stats.CallsRemaining
 	}
 	if v.authLimiter != nil {
-		fields["visitor_auth_limiter_limit"] = v.authLimiter.Limit()
-		fields["visitor_auth_limiter_tokens"] = v.authLimiter.Tokens()
+		fields["visitor_auth_attempts_remaining"] = int64(math.Floor(v.authLimiter.Tokens()))
+	}
+	if v.topicCreationLimiter != nil {
+		fields["visitor_topic_creations_remaining"] = int64(math.Floor(v.topicCreationLimiter.Tokens()))
 	}
 	if v.user != nil {
 		fields["user_id"] = v.user.ID
@@ -246,6 +250,17 @@ func (v *visitor) SubscriptionAllowed() bool {
 	return v.subscriptionLimiter.Allow()
 }
 
+// TopicCreationAllowed returns true if the visitor is allowed to cause a new topic to be
+// inserted into the server's in-memory topic map. Returns true if no limiter is configured.
+func (v *visitor) TopicCreationAllowed() bool {
+	v.mu.RLock() // limiters could be replaced!
+	defer v.mu.RUnlock()
+	if v.topicCreationLimiter == nil {
+		return true
+	}
+	return v.topicCreationLimiter.Allow()
+}
+
 // AuthAllowed returns true if an auth request can be attempted (> 1 token available)
 func (v *visitor) AuthAllowed() bool {
 	v.mu.RLock() // limiters could be replaced!
@@ -385,6 +400,11 @@ func (v *visitor) resetLimitersNoLock(messages, emails, calls int64, enqueueUpda
 	v.messagesLimiter = util.NewFixedLimiterWithValue(limits.MessageLimit, messages)
 	v.emailsLimiter = util.NewRateLimiterWithValue(limits.EmailLimitReplenish, limits.EmailLimitBurst, emails)
 	v.callsLimiter = util.NewFixedLimiterWithValue(limits.CallLimit, calls)
+	if v.config.VisitorTopicCreationLimitBurst > 0 && v.config.VisitorTopicCreationLimitReplenish > 0 {
+		v.topicCreationLimiter = rate.NewLimiter(rate.Every(v.config.VisitorTopicCreationLimitReplenish), v.config.VisitorTopicCreationLimitBurst)
+	} else {
+		v.topicCreationLimiter = nil // Disabled
+	}
 	v.bandwidthLimiter = util.NewBytesLimiter(int(limits.AttachmentBandwidthLimit), oneDay)
 	if v.user == nil {
 		v.accountLimiter = rate.NewLimiter(rate.Every(v.config.VisitorAccountCreationLimitReplenish), v.config.VisitorAccountCreationLimitBurst)
@@ -440,13 +460,17 @@ func configBasedVisitorLimits(conf *Config) *visitorLimits {
 	if conf.VisitorMessageDailyLimit > 0 {
 		messagesLimit = int64(conf.VisitorMessageDailyLimit)
 	}
+	var emailLimit int64
+	if conf.VisitorEmailLimitBurst > 0 {
+		emailLimit = replenishDurationToDailyLimit(conf.VisitorEmailLimitReplenish) // Approximation!
+	}
 	return &visitorLimits{
 		Basis:                    visitorLimitBasisIP,
 		RequestLimitBurst:        conf.VisitorRequestLimitBurst,
 		RequestLimitReplenish:    rate.Every(conf.VisitorRequestLimitReplenish),
 		MessageLimit:             messagesLimit,
 		MessageExpiryDuration:    conf.CacheDuration,
-		EmailLimit:               replenishDurationToDailyLimit(conf.VisitorEmailLimitReplenish), // Approximation!
+		EmailLimit:               emailLimit,
 		EmailLimitBurst:          conf.VisitorEmailLimitBurst,
 		EmailLimitReplenish:      rate.Every(conf.VisitorEmailLimitReplenish),
 		CallLimit:                visitorDefaultCallsLimit,

user/access_cache.go

@@ -0,0 +1,278 @@
+package user
+
+import (
+	"regexp"
+	"strings"
+	"sync"
+	"time"
+
+	"heckel.io/ntfy/v2/db"
+	"heckel.io/ntfy/v2/log"
+)
+
+// accessCache is an in-memory index over the entire user_access table.
+//
+// exact[username][escapedTopic] returns the matching entry in O(1) for the common
+// case where the requested topic appears verbatim in some rule. The key is the
+// stored form of the topic (i.e. with \_ escapes), so Lookup escapes incoming
+// topics through escapeUnderscore before probing.
+//
+// pattern[username] is the linear-scan list of %-bearing rules for that user.
+// Walked per request; trivially small in practice. Wildcards are NOT u_everyone-
+// only -- any user can create them.
+type accessCache struct {
+	exact   map[string]map[string]aclEntry
+	pattern map[string][]aclEntry
+	seq     uint64       // Bumped on every reload; lets a full reload detect a per-user reload that raced its scan
+	mu      sync.RWMutex // Protect exact, pattern, and seq
+}
+
+// testHookReloadScanned, if non-nil, is invoked by Reload after the DB scan but
+// before the result is applied. Tests use it to inject a concurrent mutation
+// into the full-reload race window; it is always nil in production.
+var testHookReloadScanned func()
+
+// aclEntry mirrors one user_access row. length feeds better()'s "longer
+// pattern wins" tie-break; the stored topic/pattern string itself is not kept
+// on the entry (the exact map already keys on it; surfacing wildcard "topics"
+// like "up%" alongside real ones would invite misuse). pattern is the
+// compiled regex form of the LIKE pattern; nil for exact entries.
+type aclEntry struct {
+	length  int
+	pattern *regexp.Regexp
+	read    bool
+	write   bool
+}
+
+func newAccessCache() *accessCache {
+	return &accessCache{
+		exact:   make(map[string]map[string]aclEntry),
+		pattern: make(map[string][]aclEntry),
+	}
+}
+
+// Lookup returns the effective (read, write, found) permission for the given
+// (username, topic), preserving the priority ordering of the original SQL query:
+//  1. specific user beats Everyone
+//  2. longer pattern beats shorter (more specific wins)
+//  3. write beats read at equal length (write is "stronger")
+func (c *accessCache) Lookup(username, topic string) (read, write, found bool) {
+	escapedTopic := escapeUnderscore(topic)
+	c.mu.RLock()
+	if username != Everyone {
+		if entry, found := c.lookupNoLock(username, topic, escapedTopic); found {
+			c.mu.RUnlock()
+			maybeLogACLDecision(username, username, topic, entry.read, entry.write)
+			return entry.read, entry.write, true
+		}
+	}
+	if entry, found := c.lookupNoLock(Everyone, topic, escapedTopic); found {
+		c.mu.RUnlock()
+		maybeLogACLDecision(username, Everyone, topic, entry.read, entry.write)
+		return entry.read, entry.write, true
+	}
+	c.mu.RUnlock()
+	maybeLogACLDecision(username, "", topic, false, false)
+	return false, false, false
+}
+
+// Reload scans (user_name, topic, read, write) rows and merges them into the
+// cache. With no usernames the cache is replaced wholesale; otherwise the
+// query is invoked with those usernames as positional args and only the
+// listed users' slices are touched (a username absent from the result drops
+// them from both maps). Runs against the primary so a reload after a
+// mutation sees the just-written rows.
+//
+// Since Reload can be triggered from different places and for different scopes (full
+// and user-specific), the function may cause races and lost-updates. This is solved
+// with the sequence number.
+func (c *accessCache) Reload(d *db.DB, query string, usernames ...string) error {
+	started := time.Now()
+	scope := "full"
+	if len(usernames) > 0 {
+		scope = "users=" + strings.Join(usernames, ",")
+	}
+	// Read the sequence number before the SQL query so we can detect races later
+	c.mu.RLock()
+	seqBefore := c.seq
+	c.mu.RUnlock()
+	args := make([]any, len(usernames))
+	for i, u := range usernames {
+		args[i] = u
+	}
+	// Query the database for all ACL entries
+	rows, err := d.Query(query, args...)
+	if err != nil {
+		return err
+	}
+	defer rows.Close()
+	exacts := make(map[string]map[string]aclEntry)
+	patterns := make(map[string][]aclEntry)
+	updatedEntries := 0
+	for rows.Next() {
+		var username, escapedTopic string
+		var read, write bool
+		if err := rows.Scan(&username, &escapedTopic, &read, &write); err != nil {
+			return err
+		}
+		entry, hasWildcard, err := toACLEntry(escapedTopic, read, write)
+		if err != nil {
+			return err
+		}
+		if hasWildcard {
+			patterns[username] = append(patterns[username], entry)
+		} else {
+			if exacts[username] == nil {
+				exacts[username] = make(map[string]aclEntry)
+			}
+			exacts[username][escapedTopic] = entry
+		}
+		updatedEntries++
+	}
+	if err := rows.Err(); err != nil {
+		return err
+	}
+	if testHookReloadScanned != nil {
+		testHookReloadScanned()
+	}
+	// Replace or update the internal maps
+	c.mu.Lock()
+	if len(usernames) == 0 {
+		if c.seq != seqBefore {
+			c.mu.Unlock()
+			log.Tag(tag).
+				Field("reload_scope", scope).
+				Field("duration_ms", time.Since(started).Milliseconds()).
+				Warn("ACL cache reload skipped due to race")
+			return nil
+		}
+		c.exact = exacts
+		c.pattern = patterns
+	} else {
+		for _, u := range usernames {
+			if e, ok := exacts[u]; ok {
+				c.exact[u] = e
+			} else {
+				delete(c.exact, u)
+			}
+			if p, ok := patterns[u]; ok {
+				c.pattern[u] = p
+			} else {
+				delete(c.pattern, u)
+			}
+		}
+	}
+	c.seq++
+	c.mu.Unlock()
+	log.Tag(tag).
+		Field("reload_scope", scope).
+		Field("updated_entries", updatedEntries).
+		Field("duration_ms", time.Since(started).Milliseconds()).
+		Debug("ACL cache reloaded")
+	return nil
+}
+
+// lookupNoLock returns the highest-priority entry for a single user. When
+// more than one of that user's rules matches the requested topic, the winner
+// is chosen by:
+//
+//  1. longer stored pattern beats shorter (a more specific rule wins over a
+//     more general one)
+//  2. at equal length, write beats read (a stronger permission wins the tie)
+//
+// Exact and wildcard rules are ranked together under the same criteria, so
+// an exact "foo" (length 3) beats a wildcard "f%" (length 2), but a wildcard
+// "foo%" (length 4) beats an exact "foo" (length 3).
+func (c *accessCache) lookupNoLock(username, topic, escapedTopic string) (*aclEntry, bool) {
+	var best aclEntry
+	var found bool
+	if exact, exists := c.exact[username]; exists {
+		if entry, exists := exact[escapedTopic]; exists {
+			best, found = entry, true
+		}
+	}
+	for _, pattern := range c.pattern[username] {
+		if !pattern.pattern.MatchString(topic) {
+			continue
+		} else if !found || better(pattern, best) {
+			best, found = pattern, true
+		}
+	}
+	return &best, found
+}
+
+// toACLEntry builds an aclEntry from one user_access row's values. The
+// isWildcard return tells the caller which storage slot the entry belongs in:
+// the per-user wildcard slice if true, the per-user exact map if false.
+// Wildcards have their LIKE pattern pre-compiled into entry.pattern; exact
+// entries leave entry.pattern nil.
+func toACLEntry(escapedTopic string, read, write bool) (entry aclEntry, hasWildcard bool, err error) {
+	entry = aclEntry{
+		length: len(escapedTopic),
+		read:   read,
+		write:  write,
+	}
+	if !strings.Contains(escapedTopic, "%") {
+		return entry, false, nil
+	}
+	pattern, err := compileLikeToRegex(escapedTopic)
+	if err != nil {
+		return entry, true, err
+	}
+	entry.pattern = pattern
+	return entry, true, nil
+}
+
+// better implements the (length DESC, write DESC) tie-break used by the original
+// query's ORDER BY for entries owned by the same user.
+func better(a, b aclEntry) bool {
+	if a.length != b.length {
+		return a.length > b.length
+	} else if a.write != b.write {
+		return a.write
+	}
+	return false
+}
+
+// compileLikeToRegex converts a stored ntfy LIKE pattern into an equivalent Go
+// regexp. In ntfy's stored form, % is the only wildcard (translated from *) and
+// \_ is a literal underscore; no other backslashes occur. Topics themselves are
+// restricted to [A-Za-z0-9_-] (see AllowedTopic), so neither % nor stray
+// backslashes appear in user-supplied input.
+func compileLikeToRegex(pattern string) (*regexp.Regexp, error) {
+	var sb strings.Builder
+	sb.WriteString("^")
+	i := 0
+	for i < len(pattern) {
+		switch {
+		case pattern[i] == '\\' && i+1 < len(pattern) && pattern[i+1] == '_':
+			sb.WriteString(regexp.QuoteMeta("_"))
+			i += 2
+		case pattern[i] == '%':
+			sb.WriteString(".*")
+			i++
+		default:
+			sb.WriteString(regexp.QuoteMeta(string(pattern[i])))
+			i++
+		}
+	}
+	sb.WriteString("$")
+	return regexp.Compile(sb.String())
+}
+
+// maybeLogACLDecision logs an ACL lookup result
+func maybeLogACLDecision(requestUser, matchedUser, topic string, read, write bool) {
+	ev := log.Tag(tag).
+		Field("user_name", requestUser).
+		Field("topic", topic).
+		Field("read", read).
+		Field("write", write)
+	if !ev.IsTrace() {
+		return
+	}
+	if matchedUser == "" {
+		ev.Trace("ACL no match")
+		return
+	}
+	ev.Field("matched_user", matchedUser).Trace("ACL match")
+}

user/access_cache_test.go

@@ -0,0 +1,312 @@
+package user
+
+import (
+	"regexp"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// Cache-only unit tests. Integration with the Manager (loading from the DB,
+// reload-after-mutation, end-to-end Authorize behavior) is covered by the
+// existing TestStoreAuthorizeTopicAccess* tests in manager_test.go via
+// forEachStoreBackend.
+
+func TestCompileLikeToRegex_Exact(t *testing.T) {
+	r := mustCompileLikeToRegex(t, "foo")
+	require.True(t, r.MatchString("foo"))
+	require.False(t, r.MatchString("foox"))
+	require.False(t, r.MatchString("xfoo"))
+}
+
+func TestCompileLikeToRegex_TrailingPercent(t *testing.T) {
+	r := mustCompileLikeToRegex(t, "up%")
+	require.True(t, r.MatchString("up"))
+	require.True(t, r.MatchString("up123"))
+	require.False(t, r.MatchString("xup"))
+}
+
+func TestCompileLikeToRegex_LeadingAndEmbeddedPercent(t *testing.T) {
+	r := mustCompileLikeToRegex(t, "%test%")
+	require.True(t, r.MatchString("test"))
+	require.True(t, r.MatchString("mytest"))
+	require.True(t, r.MatchString("testxxx"))
+	require.True(t, r.MatchString("xtestx"))
+	require.False(t, r.MatchString("nope"))
+}
+
+func TestCompileLikeToRegex_EscapedUnderscore(t *testing.T) {
+	// "my\_topic" is the stored form of a literal "my_topic" -- the underscore
+	// must match itself, NOT act as a SQL one-character wildcard.
+	r := mustCompileLikeToRegex(t, `my\_topic`)
+	require.True(t, r.MatchString("my_topic"))
+	require.False(t, r.MatchString("myXtopic"))
+	require.False(t, r.MatchString("mytopic"))
+}
+
+func TestCompileLikeToRegex_EscapedUnderscoreAdjacentToPercent(t *testing.T) {
+	// "nz\_vip\_%" is the stored form of "nz_vip_*" -- literal "nz_vip_" prefix
+	// followed by any suffix.
+	r := mustCompileLikeToRegex(t, `nz\_vip\_%`)
+	require.True(t, r.MatchString("nz_vip_"))
+	require.True(t, r.MatchString("nz_vip_alpha"))
+	require.False(t, r.MatchString("nz_vipX"))
+	require.False(t, r.MatchString("nzvip_alpha"))
+}
+
+func TestCompileLikeToRegex_RegexMetaCharsInTopic(t *testing.T) {
+	// Topics in ntfy can include '-', which is benign, but make sure
+	// regex metacharacters in the pattern are escaped properly anyway.
+	r := mustCompileLikeToRegex(t, "foo-bar")
+	require.True(t, r.MatchString("foo-bar"))
+	require.False(t, r.MatchString("foo.bar")) // would match if '-' leaked into a character class
+}
+
+func TestACLCache_LookupBeforeReload(t *testing.T) {
+	// A freshly-constructed cache has empty exact and wildcards maps. The
+	// cache treats this as "no rule found", which the caller resolves via
+	// DefaultAccess.
+	c := newAccessCache()
+	read, write, found := c.Lookup("phil", "mytopic")
+	require.False(t, found)
+	require.False(t, read)
+	require.False(t, write)
+}
+
+func TestACLCache_ExactMatchHit(t *testing.T) {
+	c := newAccessCache()
+	loadCache(t, c, []rawACLRow{
+		{user: "phil", topic: "mytopic", read: true, write: true},
+	})
+	read, write, found := c.Lookup("phil", "mytopic")
+	require.True(t, found)
+	require.True(t, read)
+	require.True(t, write)
+}
+
+func TestACLCache_ExactMatchMiss(t *testing.T) {
+	c := newAccessCache()
+	loadCache(t, c, []rawACLRow{
+		{user: "phil", topic: "mytopic", read: true, write: true},
+	})
+	_, _, found := c.Lookup("phil", "othertopic")
+	require.False(t, found)
+}
+
+func TestACLCache_LiteralUnderscoreExactMatch(t *testing.T) {
+	// Stored as "my\_topic" (toSQLWildcard of "my_topic"). A literal underscore
+	// in the requested topic must match, while any other single char must not.
+	c := newAccessCache()
+	loadCache(t, c, []rawACLRow{
+		{user: "phil", topic: `my\_topic`, read: true, write: false},
+	})
+	read, write, found := c.Lookup("phil", "my_topic")
+	require.True(t, found)
+	require.True(t, read)
+	require.False(t, write)
+
+	_, _, found = c.Lookup("phil", "myXtopic")
+	require.False(t, found)
+}
+
+func TestACLCache_WildcardMatch(t *testing.T) {
+	c := newAccessCache()
+	loadCache(t, c, []rawACLRow{
+		{user: Everyone, topic: "up%", read: false, write: true},
+	})
+	read, write, found := c.Lookup("phil", "up42")
+	require.True(t, found)
+	require.False(t, read)
+	require.True(t, write)
+}
+
+func TestACLCache_SpecificUserBeatsEveryone(t *testing.T) {
+	c := newAccessCache()
+	loadCache(t, c, []rawACLRow{
+		{user: Everyone, topic: "mytopic", read: true, write: false},
+		{user: "phil", topic: "mytopic", read: false, write: false}, // deny-all for phil
+	})
+	read, write, found := c.Lookup("phil", "mytopic")
+	require.True(t, found)
+	require.False(t, read)
+	require.False(t, write)
+}
+
+func TestACLCache_SpecificUserBeatsEveryoneEvenWhenShorter(t *testing.T) {
+	// The SQL's "user_name DESC" sort key takes precedence over LENGTH(topic).
+	// Concretely: a specific user with a shorter matching rule still wins over
+	// Everyone with a longer matching rule.
+	c := newAccessCache()
+	loadCache(t, c, []rawACLRow{
+		{user: Everyone, topic: "foo", read: true, write: true}, // exact, length 3
+		{user: "phil", topic: "f%", read: false, write: false},  // wildcard, length 2, deny-all
+	})
+	read, write, found := c.Lookup("phil", "foo")
+	require.True(t, found)
+	require.False(t, read)
+	require.False(t, write)
+}
+
+func TestACLCache_SpecificUserBeatsEveryoneRegardlessOfWrite(t *testing.T) {
+	// Same-length rules but conflicting permissions across user boundary: the
+	// specific user always wins, even if its permission set is weaker (or
+	// stronger, in either direction).
+	c := newAccessCache()
+	loadCache(t, c, []rawACLRow{
+		{user: Everyone, topic: "mytopic", read: true, write: true}, // wide-open
+		{user: "phil", topic: "mytopic", read: true, write: false},  // read-only for phil
+	})
+	read, write, found := c.Lookup("phil", "mytopic")
+	require.True(t, found)
+	require.True(t, read)
+	require.False(t, write)
+}
+
+func TestACLCache_AnonymousReadsEveryone(t *testing.T) {
+	c := newAccessCache()
+	loadCache(t, c, []rawACLRow{
+		{user: Everyone, topic: "announcements", read: true, write: false},
+	})
+	read, write, found := c.Lookup(Everyone, "announcements")
+	require.True(t, found)
+	require.True(t, read)
+	require.False(t, write)
+}
+
+func TestACLCache_LongerPatternWinsForSameUser(t *testing.T) {
+	// Both rules belong to the same user (Everyone). The more specific (longer)
+	// "mytopic%" should beat the catch-all "%".
+	c := newAccessCache()
+	loadCache(t, c, []rawACLRow{
+		{user: Everyone, topic: "%", read: true, write: false},
+		{user: Everyone, topic: "mytopic%", read: true, write: true},
+	})
+	read, write, found := c.Lookup(Everyone, "mytopicX")
+	require.True(t, found)
+	require.True(t, read)
+	require.True(t, write)
+}
+
+func TestACLCache_ExactBeatsShorterWildcardSameUser(t *testing.T) {
+	// Same user, two matching rules: exact "foo" (length 3) and wildcard "f%"
+	// (length 2). The longer one wins, which is the exact rule -- mirroring
+	// the SQL's "LENGTH(topic) DESC" tie-break. Crucially, the cache must seed
+	// "best" from the exact map probe before walking wildcards, otherwise a
+	// shorter wildcard could overwrite a longer exact.
+	c := newAccessCache()
+	loadCache(t, c, []rawACLRow{
+		{user: "phil", topic: "foo", read: true, write: true},  // exact, length 3
+		{user: "phil", topic: "f%", read: false, write: false}, // wildcard, length 2, deny-all
+	})
+	read, write, found := c.Lookup("phil", "foo")
+	require.True(t, found)
+	require.True(t, read)
+	require.True(t, write)
+}
+
+func TestACLCache_LongerWildcardBeatsExactSameUser(t *testing.T) {
+	// Same user, two matching rules: exact "foo" (length 3) and wildcard "foo%"
+	// (length 4). The wildcard wins on length DESC. Exercises the "swap best
+	// to wildcard when better() returns true" path.
+	c := newAccessCache()
+	loadCache(t, c, []rawACLRow{
+		{user: "phil", topic: "foo", read: false, write: false}, // exact, length 3, deny-all
+		{user: "phil", topic: "foo%", read: true, write: true},  // wildcard, length 4
+	})
+	read, write, found := c.Lookup("phil", "foo")
+	require.True(t, found)
+	require.True(t, read)
+	require.True(t, write)
+}
+
+func TestACLCache_WriteBeatsReadAtEqualLength(t *testing.T) {
+	// Two wildcard rules of identical length for the same user. The write rule
+	// should win the tie-break. The two-rows-with-same-topic shape is
+	// impossible via real upsert (pkey would conflict), so we inject the entries
+	// directly into the cache's wildcard slice.
+	c := newAccessCache()
+	c.mu.Lock()
+	c.exact = map[string]map[string]aclEntry{}
+	c.pattern = map[string][]aclEntry{
+		Everyone: {
+			{length: len("ab%"), read: true, write: false, pattern: mustCompileLikeToRegex(t, "ab%")},
+			{length: len("ab%"), read: false, write: true, pattern: mustCompileLikeToRegex(t, "ab%")},
+		},
+	}
+	c.mu.Unlock()
+	_, write, found := c.Lookup(Everyone, "abc")
+	require.True(t, found)
+	require.True(t, write)
+}
+
+func TestACLCache_ConcurrentLookupAndReload(t *testing.T) {
+	// Lock-based swap must be safe under concurrent reads. The race detector
+	// catches any unsafe shared mutation.
+	c := newAccessCache()
+	loadCache(t, c, []rawACLRow{
+		{user: Everyone, topic: "mytopic", read: true, write: true},
+	})
+
+	var stop atomic.Bool
+	var wg sync.WaitGroup
+	wg.Add(2)
+	go func() {
+		defer wg.Done()
+		for !stop.Load() {
+			_, _, _ = c.Lookup(Everyone, "mytopic")
+		}
+	}()
+	go func() {
+		defer wg.Done()
+		for i := 0; i < 100; i++ {
+			loadCache(t, c, []rawACLRow{
+				{user: Everyone, topic: "mytopic", read: i%2 == 0, write: i%2 == 1},
+			})
+		}
+		stop.Store(true)
+	}()
+	wg.Wait()
+}
+
+// rawACLRow models the rows that reload would Scan from the DB but avoids
+// actually opening a DB for these unit tests.
+type rawACLRow struct {
+	user  string
+	topic string
+	read  bool
+	write bool
+}
+
+// loadCache writes the given rows into the cache under its write lock,
+// preserving the same exact/wildcard partitioning that reload would produce.
+func loadCache(t *testing.T, c *accessCache, rows []rawACLRow) {
+	t.Helper()
+	exact := make(map[string]map[string]aclEntry)
+	wildcards := make(map[string][]aclEntry)
+	for _, r := range rows {
+		e := aclEntry{length: len(r.topic), read: r.read, write: r.write}
+		if strings.Contains(r.topic, "%") {
+			e.pattern = mustCompileLikeToRegex(t, r.topic)
+			wildcards[r.user] = append(wildcards[r.user], e)
+		} else {
+			if exact[r.user] == nil {
+				exact[r.user] = make(map[string]aclEntry)
+			}
+			exact[r.user][r.topic] = e
+		}
+	}
+	c.mu.Lock()
+	c.exact = exact
+	c.pattern = wildcards
+	c.mu.Unlock()
+}
+
+func mustCompileLikeToRegex(t *testing.T, pattern string) *regexp.Regexp {
+	t.Helper()
+	r, err := compileLikeToRegex(pattern)
+	require.NoError(t, err)
+	return r
+}

user/manager.go

@@ -38,6 +38,8 @@ const (
 const (
 	DefaultUserStatsQueueWriterInterval = 33 * time.Second
 	DefaultUserPasswordBcryptCost       = 10
+	DefaultAccessCacheEnabled           = false
+	DefaultAccessCacheReloadInterval    = 87 * time.Second
 )
 
 var (
@@ -48,12 +50,14 @@ var (
 
 // Manager handles user authentication, authorization, and management
 type Manager struct {
-	config     *Config
-	db         *db.DB
-	queries    queries
-	statsQueue map[string]*Stats       // "Queue" to asynchronously write user stats to the database (UserID -> Stats)
-	tokenQueue map[string]*TokenUpdate // "Queue" to asynchronously write token access stats to the database (Token ID -> TokenUpdate)
-	mu         sync.Mutex
+	config      *Config
+	db          *db.DB
+	queries     queries
+	statsQueue  map[string]*Stats       // "Queue" to asynchronously write user stats to the database (UserID -> Stats)
+	tokenQueue  map[string]*TokenUpdate // "Queue" to asynchronously write token access stats to the database (Token ID -> TokenUpdate)
+	accessCache *accessCache            // In-memory snapshot of user_access; refreshed by maybeReloadAccessCache after every ACL mutation
+	quit        chan struct{}           // Closed by Close() to signal background goroutines to stop
+	mu          sync.Mutex
 }
 
 var _ Auther = (*Manager)(nil)
@@ -65,20 +69,65 @@ func newManager(d *db.DB, queries queries, config *Config) (*Manager, error) {
 	if config.QueueWriterInterval.Seconds() <= 0 {
 		config.QueueWriterInterval = DefaultUserStatsQueueWriterInterval
 	}
+	if config.AccessCacheReloadInterval <= 0 {
+		config.AccessCacheReloadInterval = DefaultAccessCacheReloadInterval
+	}
 	manager := &Manager{
 		config:     config,
 		db:         d,
 		statsQueue: make(map[string]*Stats),
 		tokenQueue: make(map[string]*TokenUpdate),
+		quit:       make(chan struct{}),
 		queries:    queries,
 	}
 	if err := manager.maybeProvisionUsersAccessAndTokens(); err != nil {
 		return nil, err
 	}
-	go manager.asyncQueueWriter(manager.config.QueueWriterInterval)
+	if config.AccessCacheEnabled {
+		manager.accessCache = newAccessCache()
+		if err := manager.maybeReloadAccessCache(); err != nil {
+			return nil, err
+		}
+		go manager.asyncAccessCacheReloadLoop(manager.config.AccessCacheReloadInterval)
+	}
+	go manager.asyncQueueWriteLoop(manager.config.QueueWriterInterval)
 	return manager, nil
 }
 
+// maybeReloadAccessCache refreshes the in-memory access cache from the
+// primary database. No-op when the cache is disabled. With no usernames it
+// does a full bulk reload; with one or more it refreshes only those users'
+// slices in a single DB round-trip via an IN clause.
+func (a *Manager) maybeReloadAccessCache(usernames ...string) error {
+	if a.accessCache == nil {
+		return nil
+	}
+	if len(usernames) == 0 {
+		return a.accessCache.Reload(a.db, a.queries.selectAccessCacheAll)
+	}
+	return a.accessCache.Reload(a.db, a.queries.selectAccessCacheUsers(len(usernames)), usernames...)
+}
+
+// asyncAccessCacheReloadLoop periodically bulk-reloads the access cache so that
+// writes made by other processes against the same database (most notably the
+// `ntfy access` CLI subcommand running while a server holds the cache) become
+// visible within the configured interval. This Manager's own mutations do
+// not depend on the poller -- they refresh affected users synchronously.
+func (a *Manager) asyncAccessCacheReloadLoop(interval time.Duration) {
+	ticker := time.NewTicker(interval)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-a.quit:
+			return
+		case <-ticker.C:
+			if err := a.maybeReloadAccessCache(); err != nil {
+				log.Tag(tag).Err(err).Warn("Reloading ACL cache failed")
+			}
+		}
+	}
+}
+
 // Authenticate checks username and password and returns a User if correct, and the user has not been
 // marked as deleted. The method returns in constant-ish time, regardless of whether the user exists or
 // the password is correct or incorrect.
@@ -151,9 +200,14 @@ func (a *Manager) RemoveUser(username string) error {
 	if err := a.CanChangeUser(username); err != nil {
 		return err
 	}
-	return db.ExecTx(a.db, func(tx *sql.Tx) error {
+	err := db.ExecTx(a.db, func(tx *sql.Tx) error {
 		return a.removeUserTx(tx, username)
 	})
+	if err != nil {
+		return err
+	}
+	// Reload user-specific parts of the access cache
+	return a.maybeReloadAccessCache(username, Everyone)
 }
 
 // removeUserTx deletes the user with the given username
@@ -174,7 +228,7 @@ func (a *Manager) MarkUserRemoved(user *User) error {
 	if !AllowedUsername(user.Name) {
 		return ErrInvalidArgument
 	}
-	return db.ExecTx(a.db, func(tx *sql.Tx) error {
+	err := db.ExecTx(a.db, func(tx *sql.Tx) error {
 		if err := a.resetUserAccessTx(tx, user.Name); err != nil {
 			return err
 		}
@@ -187,14 +241,27 @@ func (a *Manager) MarkUserRemoved(user *User) error {
 		}
 		return nil
 	})
+	if err != nil {
+		return err
+	}
+	// Reload user-specific parts of the access cache
+	return a.maybeReloadAccessCache(user.Name, Everyone)
 }
 
 // RemoveDeletedUsers deletes all users that have been marked deleted
 func (a *Manager) RemoveDeletedUsers() error {
-	if _, err := a.db.Exec(a.queries.deleteUsersMarked, time.Now().Unix()); err != nil {
+	res, err := a.db.Exec(a.queries.deleteUsersMarked, time.Now().Unix())
+	if err != nil {
 		return err
 	}
-	return nil
+	affected, err := res.RowsAffected()
+	if err != nil {
+		return err
+	} else if affected == 0 {
+		return nil
+	}
+	// Full cache reload, because we don't know which users were affected.
+	return a.maybeReloadAccessCache()
 }
 
 // ChangePassword changes a user's password
@@ -225,9 +292,14 @@ func (a *Manager) ChangeRole(username string, role Role) error {
 	if err := a.CanChangeUser(username); err != nil {
 		return err
 	}
-	return db.ExecTx(a.db, func(tx *sql.Tx) error {
+	err := db.ExecTx(a.db, func(tx *sql.Tx) error {
 		return a.changeRoleTx(tx, username, role)
 	})
+	if err != nil {
+		return err
+	}
+	// Full cache reload: Role changes are extremely rare.
+	return a.maybeReloadAccessCache()
 }
 
 // changeRoleTx changes a user's role
@@ -351,14 +423,20 @@ func (a *Manager) EnqueueUserStats(userID string, stats *Stats) {
 	a.statsQueue[userID] = stats
 }
 
-func (a *Manager) asyncQueueWriter(interval time.Duration) {
+func (a *Manager) asyncQueueWriteLoop(interval time.Duration) {
 	ticker := time.NewTicker(interval)
-	for range ticker.C {
-		if err := a.writeUserStatsQueue(); err != nil {
-			log.Tag(tag).Err(err).Warn("Writing user stats queue failed")
-		}
-		if err := a.writeTokenUpdateQueue(); err != nil {
-			log.Tag(tag).Err(err).Warn("Writing token update queue failed")
+	defer ticker.Stop()
+	for {
+		select {
+		case <-a.quit:
+			return
+		case <-ticker.C:
+			if err := a.writeUserStatsQueue(); err != nil {
+				log.Tag(tag).Err(err).Warn("Writing user stats queue failed")
+			}
+			if err := a.writeTokenUpdateQueue(); err != nil {
+				log.Tag(tag).Err(err).Warn("Writing token update queue failed")
+			}
 		}
 	}
 }
@@ -588,9 +666,14 @@ func (a *Manager) resolvePerms(base, perm Permission) error {
 // read/write access to a topic. The parameter topicPattern may include wildcards (*). The ACL entry
 // owner may either be a user (username), or the system (empty).
 func (a *Manager) AllowAccess(username string, topicPattern string, permission Permission) error {
-	return db.ExecTx(a.db, func(tx *sql.Tx) error {
+	err := db.ExecTx(a.db, func(tx *sql.Tx) error {
 		return a.allowAccessTx(tx, username, topicPattern, permission, false)
 	})
+	if err != nil {
+		return err
+	}
+	// Only this user's row set changed; refresh their slice only.
+	return a.maybeReloadAccessCache(username)
 }
 
 func (a *Manager) allowAccessTx(tx *sql.Tx, username string, topicPattern string, permission Permission, provisioned bool) error {
@@ -606,9 +689,20 @@ func (a *Manager) allowAccessTx(tx *sql.Tx, username string, topicPattern string
 // ResetAccess removes an access control list entry for a specific username/topic, or (if topic is
 // empty) for an entire user. The parameter topicPattern may include wildcards (*).
 func (a *Manager) ResetAccess(username string, topicPattern string) error {
-	return db.ExecTx(a.db, func(tx *sql.Tx) error {
+	err := db.ExecTx(a.db, func(tx *sql.Tx) error {
 		return a.resetAccessTx(tx, username, topicPattern)
 	})
+	if err != nil {
+		return err
+	}
+	// Empty username -> deleteAllAccess affected every user, bulk reload.
+	// Otherwise refresh the named user plus Everyone, since resetUserAccessTx
+	// and deleteTopicAccess both touch rows owned by the user (typically the
+	// Everyone row from their reservations).
+	if username == "" {
+		return a.maybeReloadAccessCache()
+	}
+	return a.maybeReloadAccessCache(username, Everyone)
 }
 
 func (a *Manager) resetAccessTx(tx *sql.Tx, username string, topicPattern string) error {
@@ -650,10 +744,20 @@ func (a *Manager) AllowReservation(username string, topic string) error {
 // authorizeTopicAccess returns the read/write permissions for the given username and topic.
 // The found return value indicates whether an ACL entry was found at all.
 //
-// - The query may return two rows (one for everyone, and one for the user), but prioritizes the user.
-// - Furthermore, the query prioritizes more specific permissions (longer!) over more generic ones, e.g. "test*" > "*"
-// - It also prioritizes write permissions over read permissions
+// Priority:
+//   - Specific user beats Everyone
+//   - Longer pattern beats shorter (a more specific rule beats a more general one,
+//     e.g. "test*" > "*")
+//   - Write beats read at equal length
+//
+// When AccessCacheEnabled is true (config), the lookup is served entirely from
+// the in-memory snapshot maintained by accessCache. Otherwise the original SQL
+// query is executed against the database on every call.
 func (a *Manager) authorizeTopicAccess(usernameOrEveryone, topic string) (read, write, found bool, err error) {
+	if a.accessCache != nil {
+		read, write, found = a.accessCache.Lookup(usernameOrEveryone, topic)
+		return read, write, found, nil
+	}
 	rows, err := a.db.ReadOnly().Query(a.queries.selectTopicPerms, Everyone, usernameOrEveryone, topic)
 	if err != nil {
 		return false, false, false, err
@@ -731,7 +835,7 @@ func (a *Manager) AddReservation(username string, topic string, everyone Permiss
 	if !AllowedUsername(username) || username == Everyone || !AllowedTopic(topic) {
 		return ErrInvalidArgument
 	}
-	return db.ExecTx(a.db, func(tx *sql.Tx) error {
+	err := db.ExecTx(a.db, func(tx *sql.Tx) error {
 		if limit > 0 {
 			hasReservation, err := a.hasReservationTx(tx, username, topic)
 			if err != nil {
@@ -755,6 +859,11 @@ func (a *Manager) AddReservation(username string, topic string, everyone Permiss
 		}
 		return nil
 	})
+	if err != nil {
+		return err
+	}
+	// Both user's and Everyone's rows changed.
+	return a.maybeReloadAccessCache(username, Everyone)
 }
 
 // RemoveReservations deletes the access control entries associated with the given username/topic,
@@ -769,7 +878,7 @@ func (a *Manager) RemoveReservations(username string, topics ...string) error {
 			return ErrInvalidArgument
 		}
 	}
-	return db.ExecTx(a.db, func(tx *sql.Tx) error {
+	err := db.ExecTx(a.db, func(tx *sql.Tx) error {
 		for _, topic := range topics {
 			if err := a.removeReservationAccessTx(tx, username, topic); err != nil {
 				return err
@@ -777,6 +886,12 @@ func (a *Manager) RemoveReservations(username string, topics ...string) error {
 		}
 		return nil
 	})
+	if err != nil {
+		return err
+	}
+	// Mirror the DB: rows for this user and any Everyone rows owned by this
+	// user are gone. Refresh both slices.
+	return a.maybeReloadAccessCache(username, Everyone)
 }
 
 // Reservations returns all user-owned topics, and the associated everyone-access
@@ -872,7 +987,7 @@ func (a *Manager) ReservationOwner(topic string) (string, error) {
 // It returns the list of topics whose reservations were removed. The read and removal are
 // performed atomically in a single transaction to avoid issues with stale replica data.
 func (a *Manager) RemoveExcessReservations(username string, limit int64) ([]string, error) {
-	return db.QueryTx(a.db, func(tx *sql.Tx) ([]string, error) {
+	removedTopics, err := db.QueryTx(a.db, func(tx *sql.Tx) ([]string, error) {
 		reservations, err := a.reservationsTx(tx, username)
 		if err != nil {
 			return nil, err
@@ -890,6 +1005,17 @@ func (a *Manager) RemoveExcessReservations(username string, limit int64) ([]stri
 		}
 		return removedTopics, nil
 	})
+	if err != nil {
+		return nil, err
+	}
+	if len(removedTopics) > 0 {
+		// removeReservationAccessTx deletes rows owned by this user and the
+		// matching Everyone rows, so we refresh the access cache.
+		if err := a.maybeReloadAccessCache(username, Everyone); err != nil {
+			return nil, err
+		}
+	}
+	return removedTopics, nil
 }
 
 // otherAccessCount returns the number of access entries for the given topic that are not owned by the user
@@ -1294,6 +1420,56 @@ func (a *Manager) readPhoneNumber(rows *sql.Rows) (string, error) {
 	return phoneNumber, nil
 }
 
+// Emails returns all verified email addresses for the user with the given user ID
+func (a *Manager) Emails(userID string) ([]string, error) {
+	rows, err := a.db.ReadOnly().Query(a.queries.selectEmails, userID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	emails := make([]string, 0)
+	for {
+		email, err := a.readEmail(rows)
+		if errors.Is(err, ErrEmailNotFound) {
+			break
+		} else if err != nil {
+			return nil, err
+		}
+		emails = append(emails, email)
+	}
+	return emails, nil
+}
+
+// AddEmail adds a verified email address to the user with the given user ID
+func (a *Manager) AddEmail(userID, email string) error {
+	if _, err := a.db.Exec(a.queries.insertEmail, userID, email); err != nil {
+		if isUniqueConstraintError(err) {
+			return ErrEmailExists
+		}
+		return err
+	}
+	return nil
+}
+
+// RemoveEmail deletes a verified email address from the user with the given user ID
+func (a *Manager) RemoveEmail(userID, email string) error {
+	_, err := a.db.Exec(a.queries.deleteEmail, userID, email)
+	return err
+}
+
+func (a *Manager) readEmail(rows *sql.Rows) (string, error) {
+	var email string
+	if !rows.Next() {
+		return "", ErrEmailNotFound
+	}
+	if err := rows.Scan(&email); err != nil {
+		return "", err
+	} else if err := rows.Err(); err != nil {
+		return "", err
+	}
+	return email, nil
+}
+
 // ChangeBilling updates a user's billing fields
 func (a *Manager) ChangeBilling(username string, billing *Billing) error {
 	if _, err := a.db.Exec(a.queries.updateBilling, nullString(billing.StripeCustomerID), nullString(billing.StripeSubscriptionID), nullString(string(billing.StripeSubscriptionStatus)), nullString(string(billing.StripeSubscriptionInterval)), nullInt64(billing.StripeSubscriptionPaidUntil.Unix()), nullInt64(billing.StripeSubscriptionCancelAt.Unix()), username); err != nil {
@@ -1465,8 +1641,14 @@ func (a *Manager) maybeProvisionTokens(tx *sql.Tx, provisionUsernames []string,
 	return nil
 }
 
-// Close closes the underlying database
+// Close stops background goroutines and closes the underlying database.
 func (a *Manager) Close() error {
+	select {
+	case <-a.quit:
+		// Already closed
+	default:
+		close(a.quit)
+	}
 	return a.db.Close()
 }
 

user/manager_postgres.go

@@ -1,6 +1,9 @@
 package user
 
 import (
+	"fmt"
+	"strings"
+
 	"heckel.io/ntfy/v2/db"
 )
 
@@ -77,6 +80,11 @@ const (
 		WHERE (u.user_name = $1 OR u.user_name = $2) AND $3 LIKE a.topic ESCAPE '\'
 		ORDER BY u.user_name DESC, LENGTH(a.topic) DESC, CASE WHEN a.write THEN 1 ELSE 0 END DESC
 	`
+	postgresSelectAccessCacheAllQuery = `
+		SELECT u.user_name, a.topic, a.read, a.write
+		FROM user_access a
+		JOIN "user" u ON u.id = a.user_id
+	`
 	postgresSelectUserAllAccessQuery = `
 		SELECT user_id, topic, read, write, provisioned
 		FROM user_access
@@ -208,6 +216,11 @@ const (
 	postgresInsertPhoneNumberQuery  = `INSERT INTO user_phone (user_id, phone_number) VALUES ($1, $2)`
 	postgresDeletePhoneNumberQuery  = `DELETE FROM user_phone WHERE user_id = $1 AND phone_number = $2`
 
+	// Email queries
+	postgresSelectEmailsQuery = `SELECT email FROM user_email WHERE user_id = $1 ORDER BY email`
+	postgresInsertEmailQuery  = `INSERT INTO user_email (user_id, email) VALUES ($1, $2)`
+	postgresDeleteEmailQuery  = `DELETE FROM user_email WHERE user_id = $1 AND email = $2`
+
 	// Billing queries
 	postgresUpdateBillingQuery = `
 		UPDATE "user"
@@ -216,6 +229,21 @@ const (
 	`
 )
 
+// postgresSelectAccessCacheUsersQuery builds the per-users cache-load query
+// with a "$1, $2, ..." IN clause sized for n usernames.
+func postgresSelectAccessCacheUsersQuery(n int) string {
+	var sb strings.Builder
+	sb.WriteString(`SELECT u.user_name, a.topic, a.read, a.write FROM user_access a JOIN "user" u ON u.id = a.user_id WHERE u.user_name IN (`)
+	for i := 0; i < n; i++ {
+		if i > 0 {
+			sb.WriteString(",")
+		}
+		fmt.Fprintf(&sb, "$%d", i+1)
+	}
+	sb.WriteString(")")
+	return sb.String()
+}
+
 // NewPostgresManager creates a new Manager backed by a PostgreSQL database using an existing connection pool.
 var postgresQueries = queries{
 	selectUserByID:               postgresSelectUserByIDQuery,
@@ -240,6 +268,8 @@ var postgresQueries = queries{
 	deleteUsersMarked:            postgresDeleteUsersMarkedQuery,
 	deleteUsersProvisioned:       postgresDeleteUsersProvisionedQuery,
 	selectTopicPerms:             postgresSelectTopicPermsQuery,
+	selectAccessCacheAll:         postgresSelectAccessCacheAllQuery,
+	selectAccessCacheUsers:       postgresSelectAccessCacheUsersQuery,
 	selectUserAllAccess:          postgresSelectUserAllAccessQuery,
 	selectUserAccess:             postgresSelectUserAccessQuery,
 	selectUserReservations:       postgresSelectUserReservationsQuery,
@@ -274,6 +304,9 @@ var postgresQueries = queries{
 	selectPhoneNumbers:           postgresSelectPhoneNumbersQuery,
 	insertPhoneNumber:            postgresInsertPhoneNumberQuery,
 	deletePhoneNumber:            postgresDeletePhoneNumberQuery,
+	selectEmails:                 postgresSelectEmailsQuery,
+	insertEmail:                  postgresInsertEmailQuery,
+	deleteEmail:                  postgresDeleteEmailQuery,
 	updateBilling:                postgresUpdateBillingQuery,
 }
 

user/manager_postgres_schema.go

@@ -72,6 +72,11 @@ const (
 			phone_number TEXT NOT NULL,
 			PRIMARY KEY (user_id, phone_number)
 		);
+		CREATE TABLE IF NOT EXISTS user_email (
+			user_id TEXT NOT NULL REFERENCES "user"(id) ON DELETE CASCADE,
+			email TEXT NOT NULL,
+			PRIMARY KEY (user_id, email)
+		);
 		CREATE TABLE IF NOT EXISTS schema_version (
 			store TEXT PRIMARY KEY,
 			version INT NOT NULL
@@ -84,21 +89,55 @@ const (
 
 // Schema table management queries for Postgres
 const (
-	postgresCurrentSchemaVersion     = 6
+	postgresCurrentSchemaVersion     = 7
 	postgresSelectSchemaVersionQuery = `SELECT version FROM schema_version WHERE store = 'user'`
 	postgresInsertSchemaVersionQuery = `INSERT INTO schema_version (store, version) VALUES ('user', $1)`
 )
 
+const (
+	postgresMigrate6To7UpdateQueries = `
+		CREATE TABLE IF NOT EXISTS user_email (
+			user_id TEXT NOT NULL REFERENCES "user"(id) ON DELETE CASCADE,
+			email TEXT NOT NULL,
+			PRIMARY KEY (user_id, email)
+		);
+	`
+	postgresUpdateSchemaVersionQuery = `UPDATE schema_version SET version = $1 WHERE store = 'user'`
+)
+
+var postgresMigrations = map[int]func(db *sql.DB) error{
+	6: postgresMigrateFrom6,
+}
+
 func setupPostgres(db *sql.DB) error {
 	var schemaVersion int
 	err := db.QueryRow(postgresSelectSchemaVersionQuery).Scan(&schemaVersion)
 	if err != nil {
 		return setupNewPostgres(db)
 	}
-	if schemaVersion > postgresCurrentSchemaVersion {
+	if schemaVersion == postgresCurrentSchemaVersion {
+		return nil
+	} else if schemaVersion > postgresCurrentSchemaVersion {
 		return fmt.Errorf("unexpected schema version: version %d is higher than current version %d", schemaVersion, postgresCurrentSchemaVersion)
 	}
-	// Note: PostgreSQL migrations will be added when needed
+	for i := schemaVersion; i < postgresCurrentSchemaVersion; i++ {
+		fn, ok := postgresMigrations[i]
+		if !ok {
+			return fmt.Errorf("cannot find migration step from schema version %d to %d", i, i+1)
+		} else if err := fn(db); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func postgresMigrateFrom6(db *sql.DB) error {
+	if _, err := db.Exec(postgresMigrate6To7UpdateQueries); err != nil {
+		return err
+	}
+	if _, err := db.Exec(postgresUpdateSchemaVersionQuery, 7); err != nil {
+		return err
+	}
 	return nil
 }
 

user/manager_sqlite.go

@@ -4,6 +4,7 @@ import (
 	"database/sql"
 	"fmt"
 	"path/filepath"
+	"strings"
 
 	_ "github.com/mattn/go-sqlite3" // SQLite driver
 
@@ -83,6 +84,11 @@ const (
 		WHERE (u.user = ? OR u.user = ?) AND ? LIKE a.topic ESCAPE '\'
 		ORDER BY u.user DESC, LENGTH(a.topic) DESC, a.write DESC
 	`
+	sqliteSelectAccessCacheAllQuery = `
+		SELECT u.user, a.topic, a.read, a.write
+		FROM user_access a
+		JOIN user u ON u.id = a.user_id
+	`
 	sqliteSelectUserAllAccessQuery = `
 		SELECT user_id, topic, read, write, provisioned
 		FROM user_access
@@ -207,6 +213,11 @@ const (
 	sqliteInsertPhoneNumberQuery  = `INSERT INTO user_phone (user_id, phone_number) VALUES (?, ?)`
 	sqliteDeletePhoneNumberQuery  = `DELETE FROM user_phone WHERE user_id = ? AND phone_number = ?`
 
+	// Email queries
+	sqliteSelectEmailsQuery = `SELECT email FROM user_email WHERE user_id = ? ORDER BY email`
+	sqliteInsertEmailQuery  = `INSERT INTO user_email (user_id, email) VALUES (?, ?)`
+	sqliteDeleteEmailQuery  = `DELETE FROM user_email WHERE user_id = ? AND email = ?`
+
 	// Billing queries
 	sqliteUpdateBillingQuery = `
 		UPDATE user
@@ -215,6 +226,21 @@ const (
 	`
 )
 
+// sqliteSelectAccessCacheUsersQuery builds the per-users cache-load query
+// with a "?, ?, ..." IN clause sized for n usernames.
+func sqliteSelectAccessCacheUsersQuery(n int) string {
+	var sb strings.Builder
+	sb.WriteString(`SELECT u.user, a.topic, a.read, a.write FROM user_access a JOIN user u ON u.id = a.user_id WHERE u.user IN (`)
+	for i := 0; i < n; i++ {
+		if i > 0 {
+			sb.WriteString(",")
+		}
+		sb.WriteString("?")
+	}
+	sb.WriteString(")")
+	return sb.String()
+}
+
 var sqliteQueries = queries{
 	selectUserByID:               sqliteSelectUserByIDQuery,
 	selectUserByName:             sqliteSelectUserByNameQuery,
@@ -238,6 +264,8 @@ var sqliteQueries = queries{
 	deleteUsersMarked:            sqliteDeleteUsersMarkedQuery,
 	deleteUsersProvisioned:       sqliteDeleteUsersProvisionedQuery,
 	selectTopicPerms:             sqliteSelectTopicPermsQuery,
+	selectAccessCacheAll:         sqliteSelectAccessCacheAllQuery,
+	selectAccessCacheUsers:       sqliteSelectAccessCacheUsersQuery,
 	selectUserAllAccess:          sqliteSelectUserAllAccessQuery,
 	selectUserAccess:             sqliteSelectUserAccessQuery,
 	selectUserReservations:       sqliteSelectUserReservationsQuery,
@@ -272,6 +300,9 @@ var sqliteQueries = queries{
 	selectPhoneNumbers:           sqliteSelectPhoneNumbersQuery,
 	insertPhoneNumber:            sqliteInsertPhoneNumberQuery,
 	deletePhoneNumber:            sqliteDeletePhoneNumberQuery,
+	selectEmails:                 sqliteSelectEmailsQuery,
+	insertEmail:                  sqliteInsertEmailQuery,
+	deleteEmail:                  sqliteDeleteEmailQuery,
 	updateBilling:                sqliteUpdateBillingQuery,
 }
 
@@ -281,7 +312,13 @@ func NewSQLiteManager(filename, startupQueries string, config *Config) (*Manager
 	if !util.FileExists(parentDir) {
 		return nil, fmt.Errorf("user database directory %s does not exist or is not accessible", parentDir)
 	}
-	d, err := sql.Open("sqlite3", filename)
+	// Open with case-sensitive LIKE. ACL topic matching is done via LIKE (see
+	// selectTopicPerms), and SQLite's LIKE is case-insensitive for ASCII by
+	// default -- without this, an ACL rule for "secret" would also match a
+	// request for "SECRET", which is a security iisue. PostgreSQL's LIKE is
+	// already case-sensitive, so this only affects SQLite. The pragma is
+	// applied to every pooled connection by the driver.
+	d, err := sql.Open("sqlite3", fmt.Sprintf("%s?_case_sensitive_like=on", filename))
 	if err != nil {
 		return nil, err
 	}

user/manager_sqlite_schema.go

@@ -85,6 +85,12 @@ const (
 			PRIMARY KEY (user_id, phone_number),
 			FOREIGN KEY (user_id) REFERENCES user (id) ON DELETE CASCADE
 		);
+		CREATE TABLE IF NOT EXISTS user_email (
+			user_id TEXT NOT NULL,
+			email TEXT NOT NULL,
+			PRIMARY KEY (user_id, email),
+			FOREIGN KEY (user_id) REFERENCES user (id) ON DELETE CASCADE
+		);
 		CREATE TABLE IF NOT EXISTS schemaVersion (
 			id INT PRIMARY KEY,
 			version INT NOT NULL
@@ -101,7 +107,7 @@ const (
 
 // Schema version table management for SQLite
 const (
-	sqliteCurrentSchemaVersion     = 6
+	sqliteCurrentSchemaVersion     = 7
 	sqliteInsertSchemaVersionQuery = `INSERT INTO schemaVersion VALUES (1, ?)`
 	sqliteUpdateSchemaVersionQuery = `UPDATE schemaVersion SET version = ? WHERE id = 1`
 	sqliteSelectSchemaVersionQuery = `SELECT version FROM schemaVersion WHERE id = 1`
@@ -220,6 +226,16 @@ const (
 		UPDATE user_access SET topic = REPLACE(topic, '_', '\_');
 	`
 
+	// 6 -> 7
+	sqliteMigrate6To7UpdateQueries = `
+		CREATE TABLE IF NOT EXISTS user_email (
+			user_id TEXT NOT NULL,
+			email TEXT NOT NULL,
+			PRIMARY KEY (user_id, email),
+			FOREIGN KEY (user_id) REFERENCES user (id) ON DELETE CASCADE
+		);
+	`
+
 	// 5 -> 6
 	sqliteMigrate5To6UpdateQueries = `
 		PRAGMA foreign_keys=off;
@@ -322,6 +338,7 @@ var (
 		3: sqliteMigrateFrom3,
 		4: sqliteMigrateFrom4,
 		5: sqliteMigrateFrom5,
+		6: sqliteMigrateFrom6,
 	}
 )
 
@@ -463,3 +480,16 @@ func sqliteMigrateFrom5(sqlDB *sql.DB) error {
 		return nil
 	})
 }
+
+func sqliteMigrateFrom6(sqlDB *sql.DB) error {
+	log.Tag(tag).Info("Migrating user database schema: from 6 to 7")
+	return db.ExecTx(sqlDB, func(tx *sql.Tx) error {
+		if _, err := tx.Exec(sqliteMigrate6To7UpdateQueries); err != nil {
+			return err
+		}
+		if _, err := tx.Exec(sqliteUpdateSchemaVersionQuery, 7); err != nil {
+			return err
+		}
+		return nil
+	})
+}

user/manager_test.go

@@ -1137,6 +1137,60 @@ func TestUser_PhoneNumberAdd_Multiple_Users_Same_Number(t *testing.T) {
 	})
 }
 
+func TestUser_EmailAddListRemove(t *testing.T) {
+	forEachBackend(t, func(t *testing.T, newManager newManagerFunc) {
+		a := newTestManager(t, newManager, PermissionDenyAll)
+
+		require.Nil(t, a.AddUser("phil", "phil", RoleUser, false))
+		phil, err := a.User("phil")
+		require.Nil(t, err)
+		require.Nil(t, a.AddEmail(phil.ID, "phil@example.com"))
+
+		emails, err := a.Emails(phil.ID)
+		require.Nil(t, err)
+		require.Equal(t, 1, len(emails))
+		require.Equal(t, "phil@example.com", emails[0])
+
+		require.Nil(t, a.RemoveEmail(phil.ID, "phil@example.com"))
+		emails, err = a.Emails(phil.ID)
+		require.Nil(t, err)
+		require.Equal(t, 0, len(emails))
+
+		// Paranoia check: We do NOT want to keep emails in there
+		rows, err := testDB(a).Query(`SELECT * FROM user_email`)
+		require.Nil(t, err)
+		require.False(t, rows.Next())
+		require.Nil(t, rows.Close())
+	})
+}
+
+func TestUser_EmailAdd_Multiple_Users_Same_Email(t *testing.T) {
+	forEachBackend(t, func(t *testing.T, newManager newManagerFunc) {
+		a := newTestManager(t, newManager, PermissionDenyAll)
+
+		require.Nil(t, a.AddUser("phil", "phil", RoleUser, false))
+		require.Nil(t, a.AddUser("ben", "ben", RoleUser, false))
+		phil, err := a.User("phil")
+		require.Nil(t, err)
+		ben, err := a.User("ben")
+		require.Nil(t, err)
+		require.Nil(t, a.AddEmail(phil.ID, "shared@example.com"))
+		require.Nil(t, a.AddEmail(ben.ID, "shared@example.com"))
+	})
+}
+
+func TestUser_EmailAdd_Duplicate(t *testing.T) {
+	forEachBackend(t, func(t *testing.T, newManager newManagerFunc) {
+		a := newTestManager(t, newManager, PermissionDenyAll)
+
+		require.Nil(t, a.AddUser("phil", "phil", RoleUser, false))
+		phil, err := a.User("phil")
+		require.Nil(t, err)
+		require.Nil(t, a.AddEmail(phil.ID, "phil@example.com"))
+		require.ErrorIs(t, a.AddEmail(phil.ID, "phil@example.com"), ErrEmailExists)
+	})
+}
+
 func TestManager_Topic_Wildcard_With_Asterisk_Underscore(t *testing.T) {
 	forEachBackend(t, func(t *testing.T, newManager newManagerFunc) {
 		a := newTestManager(t, newManager, PermissionDenyAll)
@@ -2115,6 +2169,300 @@ func TestStoreAuthorizeTopicAccessDenyAll(t *testing.T) {
 	})
 }
 
+// TestAuthorizeTopicAccess_CacheAndDirectDBAgree wires up two Managers on the
+// same backend storage -- one with AccessCacheEnabled=true (in-memory cache
+// path) and one with AccessCacheEnabled=false (direct SQL path) -- then runs
+// an identical battery of authorizeTopicAccess queries against both and
+// asserts byte-identical (read, write, found) responses for every query.
+// This protects the in-memory implementation from drifting away from the
+// SQL behavior it is meant to mirror.
+func TestAuthorizeTopicAccess_CacheAndDirectDBAgree(t *testing.T) {
+	forEachBackend(t, func(t *testing.T, newManager newManagerFunc) {
+		// Seed via a Manager with the cache enabled. Writes go to the shared
+		// backend; both Managers will see them after the writes commit.
+		writer := newManager(&Config{
+			DefaultAccess:      PermissionDenyAll,
+			BcryptCost:         bcrypt.MinCost,
+			AccessCacheEnabled: true,
+		})
+		t.Cleanup(func() { writer.Close() })
+
+		require.Nil(t, writer.AddUser("phil", "mypass", RoleAdmin, false))
+		require.Nil(t, writer.AddUser("ben", "mypass", RoleUser, false))
+		require.Nil(t, writer.AddUser("alice", "mypass", RoleUser, false))
+
+		// A mix that exercises every branch of the priority logic:
+		//   - exact and wildcard rules for the same user
+		//   - exact and wildcard rules under Everyone
+		//   - Everyone rules that are longer than the matching user rule
+		//   - literal underscores (stored as "\_")
+		//   - deny-all permissions
+		require.Nil(t, writer.AllowAccess("ben", "mytopic", PermissionReadWrite))
+		require.Nil(t, writer.AllowAccess("ben", "readme", PermissionRead))
+		require.Nil(t, writer.AllowAccess("ben", "writeme", PermissionWrite))
+		require.Nil(t, writer.AllowAccess("ben", "ben_topic", PermissionReadWrite))
+		require.Nil(t, writer.AllowAccess("ben", "mytopic*", PermissionRead))
+		require.Nil(t, writer.AllowAccess("alice", "alice_*", PermissionWrite))
+		require.Nil(t, writer.AllowAccess("alice", "secret", PermissionDenyAll))
+		require.Nil(t, writer.AllowAccess(Everyone, "announcements", PermissionRead))
+		require.Nil(t, writer.AllowAccess(Everyone, "up*", PermissionWrite))
+		require.Nil(t, writer.AllowAccess(Everyone, "mytopic", PermissionDenyAll))
+
+		// Build a reader Manager with the cache OFF, pointing at the same backend.
+		reader := newManager(&Config{
+			DefaultAccess:      PermissionDenyAll,
+			BcryptCost:         bcrypt.MinCost,
+			AccessCacheEnabled: false,
+		})
+		t.Cleanup(func() { reader.Close() })
+
+		// Probe matrix: every (user, topic) pair that exercises some branch.
+		cases := []struct {
+			user, topic string
+		}{
+			// Anonymous reads.
+			{Everyone, "announcements"},
+			{Everyone, "up42"},
+			{Everyone, "up"},
+			{Everyone, "downstream"},
+			{Everyone, "mytopic"},
+			{Everyone, "nope"},
+			// Specific user, only-user rules.
+			{"ben", "mytopic"},
+			{"ben", "readme"},
+			{"ben", "writeme"},
+			{"ben", "ben_topic"},
+			{"ben", "benXtopic"}, // underscore in rule means "X" must NOT match
+			// Specific user falls through to Everyone.
+			{"ben", "announcements"},
+			{"ben", "up5"},
+			{"alice", "announcements"},
+			// Wildcards with literal underscores.
+			{"alice", "alice_anything"},
+			{"alice", "alice_"},
+			{"alice", "aliceX"}, // does NOT match alice_*
+			// Exact-vs-wildcard overlap for the same user (ben has both
+			// "mytopic" exact and "mytopic*" wildcard).
+			{"ben", "mytopic"},   // exact wins on length
+			{"ben", "mytopicX"},  // only wildcard matches
+			{"ben", "mytopicYZ"}, // only wildcard matches
+			// Deny-all override.
+			{"alice", "secret"},
+			// No matching rule anywhere.
+			{"ben", "completely_unmatched"},
+			{"alice", "completely_unmatched"},
+			{Everyone, "completely_unmatched"},
+		}
+
+		// Sanity: the two Managers must agree on every probe.
+		for _, tc := range cases {
+			cRead, cWrite, cFound, cErr := writer.authorizeTopicAccess(tc.user, tc.topic)
+			dRead, dWrite, dFound, dErr := reader.authorizeTopicAccess(tc.user, tc.topic)
+			require.Nil(t, cErr, "cache path errored for (%s, %s)", tc.user, tc.topic)
+			require.Nil(t, dErr, "direct-DB path errored for (%s, %s)", tc.user, tc.topic)
+			require.Equal(t, dFound, cFound, "found mismatch for (%s, %s)", tc.user, tc.topic)
+			require.Equal(t, dRead, cRead, "read mismatch for (%s, %s)", tc.user, tc.topic)
+			require.Equal(t, dWrite, cWrite, "write mismatch for (%s, %s)", tc.user, tc.topic)
+		}
+	})
+}
+
+// TestAccessCacheReloadInterval_PicksUpExternalWrite proves that the
+// background reloader actually closes the cross-process coherence gap: a
+// write made through a *different* Manager on the same backend becomes
+// visible to a cache-enabled Manager within roughly one reload interval,
+// without that Manager being told about the write.
+func TestAccessCacheReloadInterval_PicksUpExternalWrite(t *testing.T) {
+	const interval = 25 * time.Millisecond
+	forEachBackend(t, func(t *testing.T, newManager newManagerFunc) {
+		// reader holds the cache and polls; writer plays the role of an
+		// out-of-band process (e.g. `ntfy access` CLI) writing to the same
+		// backend.
+		reader := newManager(&Config{
+			DefaultAccess:             PermissionDenyAll,
+			BcryptCost:                bcrypt.MinCost,
+			AccessCacheEnabled:        true,
+			AccessCacheReloadInterval: interval,
+		})
+		t.Cleanup(func() { reader.Close() })
+
+		writer := newManager(&Config{
+			DefaultAccess:      PermissionDenyAll,
+			BcryptCost:         bcrypt.MinCost,
+			AccessCacheEnabled: false,
+		})
+		t.Cleanup(func() { writer.Close() })
+
+		require.Nil(t, writer.AddUser("phil", "mypass", RoleUser, false))
+		// Sanity: before the write, the reader sees no rule for this topic.
+		_, _, found, err := reader.authorizeTopicAccess("phil", "via-poller")
+		require.Nil(t, err)
+		require.False(t, found)
+
+		// Write through the second Manager. reader's cache is unaware.
+		require.Nil(t, writer.AllowAccess("phil", "via-poller", PermissionReadWrite))
+
+		// Wait for the poller to catch up. The interval is 25ms; allow a
+		// generous multiple to keep this test from flaking on slow CI.
+		require.Eventually(t, func() bool {
+			read, write, found, err := reader.authorizeTopicAccess("phil", "via-poller")
+			return err == nil && found && read && write
+		}, 2*time.Second, 10*time.Millisecond, "reader's cache never observed the external write")
+	})
+}
+
+// TestAccessCache_RemoveExcessReservationsInvalidatesCache models finding #1:
+// RemoveExcessReservations deletes user_access rows but must also refresh the
+// in-memory cache. Otherwise the owner keeps cached read/write access to a
+// reservation that was removed (e.g. on a tier downgrade) until the next
+// periodic reload -- and if another user re-reserves the freed topic in the
+// meantime, the former owner can read/write the new owner's reserved topic.
+func TestAccessCache_RemoveExcessReservationsInvalidatesCache(t *testing.T) {
+	forEachBackend(t, func(t *testing.T, newManager newManagerFunc) {
+		// A deliberately long reload interval ensures the background poller
+		// cannot mask a missing synchronous invalidation: the mutation itself
+		// must refresh the cache.
+		a := newTestManagerFromConfig(t, newManager, &Config{
+			DefaultAccess:             PermissionDenyAll,
+			BcryptCost:                bcrypt.MinCost,
+			AccessCacheEnabled:        true,
+			AccessCacheReloadInterval: time.Hour,
+		})
+		require.Nil(t, a.AddUser("ben", "mypass", RoleUser, false))
+		require.Nil(t, a.AddReservation("ben", "topic1", PermissionDenyAll, 2))
+		require.Nil(t, a.AddReservation("ben", "topic2", PermissionDenyAll, 2))
+
+		// Both reservations grant ben full read/write; confirm the cache agrees.
+		for _, topic := range []string{"topic1", "topic2"} {
+			read, write, found, err := a.authorizeTopicAccess("ben", topic)
+			require.Nil(t, err)
+			require.True(t, found)
+			require.True(t, read)
+			require.True(t, write)
+		}
+
+		// Downgrade ben to a single reservation; one topic is removed from the DB.
+		removed, err := a.RemoveExcessReservations("ben", 1)
+		require.Nil(t, err)
+		require.Len(t, removed, 1)
+
+		// The removed reservation's grant must be gone from the cache, not just
+		// from the database.
+		read, write, found, err := a.authorizeTopicAccess("ben", removed[0])
+		require.Nil(t, err)
+		require.False(t, found, "stale ACL for removed reservation %q still served from cache", removed[0])
+		require.False(t, read)
+		require.False(t, write)
+
+		// The surviving reservation must still be served from the cache.
+		survivor := "topic1"
+		if removed[0] == "topic1" {
+			survivor = "topic2"
+		}
+		read, write, found, err = a.authorizeTopicAccess("ben", survivor)
+		require.Nil(t, err)
+		require.True(t, found)
+		require.True(t, read)
+		require.True(t, write)
+	})
+}
+
+// TestAccessCache_FullReloadDoesNotClobberConcurrentRevoke models finding #2:
+// a periodic full reload scans the whole user_access table outside the cache
+// lock. If a local ACL mutation revokes a grant and refreshes that user's slice
+// while the scan is in flight, applying the now-stale full snapshot must not
+// resurrect the revoked grant. The testHookReloadScanned seam injects the revoke
+// into exactly that race window.
+func TestAccessCache_FullReloadDoesNotClobberConcurrentRevoke(t *testing.T) {
+	forEachBackend(t, func(t *testing.T, newManager newManagerFunc) {
+		a := newTestManagerFromConfig(t, newManager, &Config{
+			DefaultAccess:             PermissionDenyAll,
+			BcryptCost:                bcrypt.MinCost,
+			AccessCacheEnabled:        true,
+			AccessCacheReloadInterval: time.Hour, // keep the background poller out of this test
+		})
+		require.Nil(t, a.AddUser("phil", "mypass", RoleUser, false))
+		require.Nil(t, a.AllowAccess("phil", "secret", PermissionReadWrite))
+
+		// Sanity: the grant is served from the cache.
+		_, _, found, err := a.authorizeTopicAccess("phil", "secret")
+		require.Nil(t, err)
+		require.True(t, found)
+
+		// Arm the seam: when the full reload below finishes scanning (and still
+		// sees the grant), revoke it via a per-user reload before the full reload
+		// applies its now-stale snapshot. The re-entrant per-user reload that
+		// ResetAccess triggers is a no-op here (fired guard), and the whole thing
+		// runs single-threaded in this goroutine.
+		fired := false
+		testHookReloadScanned = func() {
+			if fired {
+				return
+			}
+			fired = true
+			require.Nil(t, a.ResetAccess("phil", "secret"))
+		}
+		defer func() { testHookReloadScanned = nil }()
+
+		// Trigger the full reload. Without the seq guard it would swap in its
+		// stale snapshot and resurrect the grant.
+		require.Nil(t, a.maybeReloadAccessCache())
+
+		_, _, found, err = a.authorizeTopicAccess("phil", "secret")
+		require.Nil(t, err)
+		require.False(t, found, "stale full reload resurrected a revoked grant")
+	})
+}
+
+// TestAuthorizeTopicAccess_TopicMatchingIsCaseSensitive guards against ACL
+// topic matching being case-insensitive. SQLite's LIKE is case-insensitive for
+// ASCII by default, which would let a request for "SECRET" match an ACL rule
+// for "secret" -- a security hole. PostgreSQL's LIKE is already case-sensitive.
+// NewSQLiteManager opens the database with case_sensitive_like enabled to close
+// this gap. This exercises the direct-DB path (cache disabled), which is the
+// path that runs the LIKE query; the in-memory cache is independently
+// case-sensitive (Go map keys / case-sensitive regex).
+func TestAuthorizeTopicAccess_TopicMatchingIsCaseSensitive(t *testing.T) {
+	forEachBackend(t, func(t *testing.T, newManager newManagerFunc) {
+		a := newManager(&Config{
+			DefaultAccess:      PermissionDenyAll,
+			BcryptCost:         bcrypt.MinCost,
+			AccessCacheEnabled: false, // exercise the direct-DB LIKE path
+		})
+		t.Cleanup(func() { a.Close() })
+
+		require.Nil(t, a.AddUser("ben", "mypass", RoleUser, false))
+		require.Nil(t, a.AllowAccess("ben", "secret", PermissionReadWrite)) // exact rule
+		require.Nil(t, a.AllowAccess("ben", "team*", PermissionReadWrite))  // wildcard rule, stored as "team%"
+
+		// The exact rule is honored verbatim.
+		read, write, found, err := a.authorizeTopicAccess("ben", "secret")
+		require.Nil(t, err)
+		require.True(t, found)
+		require.True(t, read)
+		require.True(t, write)
+
+		// Case variants of the exact rule must NOT match.
+		for _, topic := range []string{"SECRET", "Secret", "sEcReT"} {
+			_, _, found, err := a.authorizeTopicAccess("ben", topic)
+			require.Nil(t, err)
+			require.False(t, found, "ACL rule for \"secret\" must not match %q (case-insensitive match is a security hole)", topic)
+		}
+
+		// The wildcard rule is honored for the matching case.
+		_, _, found, err = a.authorizeTopicAccess("ben", "team-rocket")
+		require.Nil(t, err)
+		require.True(t, found)
+
+		// Case variants of the wildcard prefix must NOT match.
+		for _, topic := range []string{"TEAM-rocket", "Team-rocket", "TEAMING"} {
+			_, _, found, err := a.authorizeTopicAccess("ben", topic)
+			require.Nil(t, err)
+			require.False(t, found, "wildcard rule for \"team*\" must not match %q", topic)
+		}
+	})
+}
+
 func TestStoreReservations(t *testing.T) {
 	forEachStoreBackend(t, func(t *testing.T, manager *Manager) {
 		require.Nil(t, manager.AddUser("phil", "mypass", RoleUser, false))
@@ -2328,6 +2676,27 @@ func TestStorePhoneNumbers(t *testing.T) {
 	})
 }
 
+func TestStoreEmails(t *testing.T) {
+	forEachStoreBackend(t, func(t *testing.T, manager *Manager) {
+		require.Nil(t, manager.AddUser("phil", "mypass", RoleUser, false))
+		u, err := manager.User("phil")
+		require.Nil(t, err)
+
+		require.Nil(t, manager.AddEmail(u.ID, "phil@example.com"))
+		require.Nil(t, manager.AddEmail(u.ID, "phil2@example.com"))
+
+		emails, err := manager.Emails(u.ID)
+		require.Nil(t, err)
+		require.Len(t, emails, 2)
+
+		require.Nil(t, manager.RemoveEmail(u.ID, "phil@example.com"))
+		emails, err = manager.Emails(u.ID)
+		require.Nil(t, err)
+		require.Len(t, emails, 1)
+		require.Equal(t, "phil2@example.com", emails[0])
+	})
+}
+
 func TestStoreChangeSettings(t *testing.T) {
 	forEachStoreBackend(t, func(t *testing.T, manager *Manager) {
 		require.Nil(t, manager.AddUser("phil", "mypass", RoleUser, false))

user/types.go

@@ -245,16 +245,18 @@ const (
 
 // Config holds the configuration for the user Manager
 type Config struct {
-	Filename            string              // Database filename, e.g. "/var/lib/ntfy/user.db" (SQLite)
-	DatabaseURL         string              // Database connection string (PostgreSQL)
-	StartupQueries      string              // Queries to run on startup, e.g. to create initial users or tiers (SQLite only)
-	DefaultAccess       Permission          // Default permission if no ACL matches
-	ProvisionEnabled    bool                // Hack: Enable auto-provisioning of users and access grants, disabled for "ntfy user" commands
-	Users               []*User             // Predefined users to create on startup
-	Access              map[string][]*Grant // Predefined access grants to create on startup (username -> []*Grant)
-	Tokens              map[string][]*Token // Predefined users to create on startup (username -> []*Token)
-	QueueWriterInterval time.Duration       // Interval for the async queue writer to flush stats and token updates to the database
-	BcryptCost          int                 // Cost of generated passwords; lowering makes testing faster
+	Filename                  string              // Database filename, e.g. "/var/lib/ntfy/user.db" (SQLite)
+	DatabaseURL               string              // Database connection string (PostgreSQL)
+	StartupQueries            string              // Queries to run on startup, e.g. to create initial users or tiers (SQLite only)
+	DefaultAccess             Permission          // Default permission if no ACL matches
+	ProvisionEnabled          bool                // Hack: Enable auto-provisioning of users and access grants, disabled for "ntfy user" commands
+	Users                     []*User             // Predefined users to create on startup
+	Access                    map[string][]*Grant // Predefined access grants to create on startup (username -> []*Grant)
+	Tokens                    map[string][]*Token // Predefined users to create on startup (username -> []*Token)
+	QueueWriterInterval       time.Duration       // Interval for the async queue writer to flush stats and token updates to the database
+	BcryptCost                int                 // Cost of generated passwords; lowering makes testing faster
+	AccessCacheEnabled        bool                // Enables the in-memory ACL cache (high volume servers only)
+	AccessCacheReloadInterval time.Duration       // Reload interval for access cache, relevant for ACL writes from CLI
 }
 
 // Error constants used by the package
@@ -271,6 +273,8 @@ var (
 	ErrPhoneNumberNotFound    = errors.New("phone number not found")
 	ErrTooManyReservations    = errors.New("new tier has lower reservation limit")
 	ErrPhoneNumberExists      = errors.New("phone number already exists")
+	ErrEmailNotFound          = errors.New("email not found")
+	ErrEmailExists            = errors.New("email already exists")
 	ErrProvisionedUserChange  = errors.New("cannot change or delete provisioned user")
 	ErrProvisionedTokenChange = errors.New("cannot change or delete provisioned token")
 )
@@ -301,7 +305,9 @@ type queries struct {
 	deleteUsersProvisioned       string
 
 	// Access queries
-	selectTopicPerms            string
+	selectTopicPerms            string             // Direct-DB authorizeTopicAccess query; used when the in-memory cache is disabled
+	selectAccessCacheAll        string             // Bulk load: (user_name, topic, read, write) for the in-memory ACL cache
+	selectAccessCacheUsers      func(n int) string // Returns a per-users load query whose IN clause is sized for n usernames
 	selectUserAllAccess         string
 	selectUserAccess            string
 	selectUserReservations      string
@@ -343,6 +349,11 @@ type queries struct {
 	insertPhoneNumber  string
 	deletePhoneNumber  string
 
+	// Email queries
+	selectEmails string
+	insertEmail  string
+	deleteEmail  string
+
 	// Billing queries
 	updateBilling string
 }

web/package.json

@@ -18,19 +18,15 @@
     "@mui/material": "latest",
     "dexie": "^3.2.1",
     "dexie-react-hooks": "^1.1.1",
-    "humanize-duration": "^3.27.3",
     "i18next": "^21.6.14",
     "i18next-browser-languagedetector": "^6.1.4",
-    "i18next-http-backend": "^1.4.0",
-    "js-base64": "^3.7.2",
+    "i18next-http-backend": "^3.0.5",
     "react": "latest",
     "react-dom": "latest",
     "react-i18next": "^11.16.2",
     "react-infinite-scroll-component": "^6.1.0",
     "react-remark": "^2.1.0",
-    "react-router-dom": "^6.2.2",
-    "stacktrace-gps": "^3.0.4",
-    "stacktrace-js": "^2.0.2",
+    "react-router-dom": "^6.30.4",
     "stylis": "^4.3.0",
     "stylis-plugin-rtl": "^2.1.1"
   },
@@ -44,7 +40,7 @@
     "eslint-plugin-react": "^7.32.2",
     "eslint-plugin-react-hooks": "^4.6.0",
     "prettier": "^2.8.8",
-    "vite": "^6.3.5",
+    "vite": "^6.4.2",
     "vite-plugin-pwa": "^1.0.0"
   },
   "browserslist": {

web/public/static/langs/be.json

@@ -0,0 +1 @@
+{}

web/public/static/langs/ca.json

@@ -12,5 +12,33 @@
     "signup_form_username": "Nom d'usuari",
     "signup_form_password": "Contrasenya",
     "signup_form_confirm_password": "Confirma la contrasenya",
-    "signup_form_button_submit": "Dona't d'alta"
+    "signup_form_button_submit": "Dona't d'alta",
+    "signup_form_toggle_password_visibility": "Canvia la visibilitat de la contrasenya",
+    "signup_already_have_account": "Ja tens un compte? Inicia sessió!",
+    "signup_disabled": "Les inscripcions estan deshabilitades",
+    "signup_error_username_taken": "El nom d'usuari {{username}} ja està en ús",
+    "signup_error_creation_limit_reached": "Límit de creació de comptes assolit",
+    "login_title": "Inicia sessió al teu compte ntfy",
+    "login_form_button_submit": "Iniciar sessió",
+    "login_link_signup": "Crear compte",
+    "login_disabled": "L'accès està desactivat",
+    "action_bar_show_menu": "Mostrar el menú",
+    "action_bar_logo_alt": "logotip de ntfy",
+    "action_bar_change_display_name": "Canviar nom de pantalla",
+    "action_bar_reservation_add": "Reservar tema",
+    "action_bar_reservation_edit": "Canviar la reserva",
+    "action_bar_reservation_delete": "Eliminar la reserva",
+    "action_bar_reservation_limit_reached": "Límit assolit",
+    "action_bar_send_test_notification": "Enviar notificació de prova",
+    "action_bar_clear_notifications": "Esborrar totes les notificacions",
+    "action_bar_mute_notifications": "Silenciar notificacions",
+    "action_bar_unmute_notifications": "Reactivar notificacions",
+    "action_bar_unsubscribe": "Cancel·lar la subscripció",
+    "action_bar_toggle_mute": "Silenciar/reactivar notificacions",
+    "action_bar_toggle_action_menu": "Obrir/tancar el menú d'accions",
+    "action_bar_profile_settings": "Configuracions",
+    "action_bar_profile_logout": "Tancar sessió",
+    "action_bar_sign_in": "Iniciar sessió",
+    "action_bar_sign_up": "Crear compte",
+    "message_bar_type_message": "Escriu un missatge aquí"
 }

web/public/static/langs/en.json

@@ -215,6 +215,19 @@
   "account_basics_phone_numbers_dialog_check_verification_button": "Confirm code",
   "account_basics_phone_numbers_dialog_channel_sms": "SMS",
   "account_basics_phone_numbers_dialog_channel_call": "Call",
+  "account_basics_emails_title": "Email addresses",
+  "account_basics_emails_description": "For email notifications",
+  "account_basics_emails_no_emails_yet": "No verified emails yet",
+  "account_basics_emails_copied_to_clipboard": "Email address copied to clipboard",
+  "account_basics_emails_dialog_title": "Add email address",
+  "account_basics_emails_dialog_description": "To receive email notifications, you need to add and verify at least one email address. A verification code will be sent to your email.",
+  "account_basics_emails_dialog_email_label": "Email address",
+  "account_basics_emails_dialog_email_placeholder": "e.g. user@example.com",
+  "account_basics_emails_dialog_verify_button": "Add email",
+  "account_basics_emails_dialog_code_label": "Verification code",
+  "account_basics_emails_dialog_code_placeholder": "e.g. 123456",
+  "account_basics_emails_dialog_code_invalid": "Verification code is invalid or expired",
+  "account_basics_emails_dialog_check_verification_button": "Confirm",
   "account_basics_cannot_edit_or_delete_provisioned_user": "A provisioned user cannot be edited or deleted",
   "account_usage_title": "Usage",
   "account_usage_of_limit": "of {{limit}}",
@@ -238,6 +251,7 @@
   "account_usage_messages_title": "Published messages",
   "account_usage_emails_title": "Emails sent",
   "account_usage_calls_title": "Phone calls made",
+  "account_usage_emails_none": "No email notifications can be sent with this account",
   "account_usage_calls_none": "No phone calls can be made with this account",
   "account_usage_reservations_title": "Reserved topics",
   "account_usage_reservations_none": "No reserved topics for this account",

web/public/static/langs/en_GB.json

@@ -0,0 +1,6 @@
+{
+    "common_cancel": "Cancel",
+    "common_save": "Save",
+    "common_add": "Add",
+    "common_back": "Back"
+}

web/public/static/langs/es.json

@@ -52,7 +52,7 @@
     "publish_dialog_topic_placeholder": "Nombre del tópico, ej. phil_alerts",
     "publish_dialog_title_label": "Título",
     "publish_dialog_message_label": "Mensaje",
-    "publish_dialog_tags_placeholder": "Lista de etiquetas separadas por comas, por ejemplo: warning, srv1-backup",
+    "publish_dialog_tags_placeholder": "Lista de etiquetas separadas por comas, ej.: aviso, srv1-backup",
     "publish_dialog_click_label": "Click URL",
     "publish_dialog_click_placeholder": "URL que se abre cuando se hace click en la notificación",
     "publish_dialog_email_label": "Email",
@@ -120,7 +120,7 @@
     "publish_dialog_priority_low": "Prioridad baja",
     "publish_dialog_priority_high": "Prioridad alta",
     "publish_dialog_delay_label": "Retraso",
-    "publish_dialog_title_placeholder": "Título de la notificación, ej. Alerta de espacio en disco",
+    "publish_dialog_title_placeholder": "Título de la notificación, ej. \"Alerta de espacio en disco\"",
     "publish_dialog_details_examples_description": "Para ver ejemplos y una descripción detallada de todas las funciones de envío, consulte la <docsLink>documentación</docsLink>.",
     "publish_dialog_attach_placeholder": "Adjuntar un archivo por URL, por ejemplo, https://f-droid.org/F-Droid.apk",
     "publish_dialog_filename_placeholder": "Nombre del archivo adjunto",
@@ -153,7 +153,7 @@
     "priority_low": "baja",
     "notifications_actions_not_supported": "Acción no soportada en la aplicación web",
     "notifications_actions_http_request_title": "Enviar HTTP {{method}} a {{url}}",
-    "error_boundary_unsupported_indexeddb_description": "La aplicación web ntfy necesita IndexedDB para funcionar y su navegador no soporta IndexedDB en modo de navegación privada. <br/> <br/> Si bien esto es desafortunado, tampoco tiene mucho sentido usar la aplicación web ntfy en modo de navegación privada de todos modos, porque todo está almacenado en el almacenamiento del navegador. Puede leer más sobre esto <githubLink>en este issue de GitHub</githubLink>, o hablar con nosotros en <discordLink>Discord</discordLink> o <matrixLink>Matrix</matrixLink>.",
+    "error_boundary_unsupported_indexeddb_description": "La aplicación web de ntfy necesita IndexedDB para funcionar y su navegador no soporta IndexedDB en modo de navegación privada.<br/> <br/>Mismo que no sea ideal, tampoco tiene mucho sentido usar la aplicación web de ntfy en modo de navegación privada de todos modos, porque todo está guardado en el almacenamiento del navegador. Puede leer más sobre esto <githubLink>en este issue de GitHub</githubLink>, o hablar con nosotros en <discordLink>Discord</discordLink> o <matrixLink>Matrix</matrixLink>.",
     "action_bar_show_menu": "Mostrar menú",
     "action_bar_logo_alt": "logo de ntfy",
     "action_bar_toggle_action_menu": "Abrir/cerrar el menú de acción",
@@ -207,7 +207,7 @@
     "action_bar_account": "Cuenta",
     "action_bar_change_display_name": "Cambiar nombre de usuario",
     "action_bar_reservation_add": "Reservar tema",
-    "action_bar_reservation_edit": "Modificar reserva",
+    "action_bar_reservation_edit": "Alterar la reserva",
     "action_bar_reservation_delete": "Quitar reserva",
     "action_bar_reservation_limit_reached": "Límite alcanzado",
     "action_bar_profile_logout": "Cerrar sesión",

web/public/static/langs/hu.json

@@ -1,227 +1,409 @@
 {
-    "action_bar_send_test_notification": "Teszt értesítés küldése",
-    "action_bar_clear_notifications": "Összes értesítés törlése",
-    "alert_not_supported_description": "A böngésződ nem támogatja az értesítések fogadását",
+    "action_bar_send_test_notification": "Tesztértesítés küldése",
+    "action_bar_clear_notifications": "Az összes értesítés törlése",
+    "alert_not_supported_description": "A böngésző nem támogatja az értesítéseket",
     "action_bar_settings": "Beállítások",
     "action_bar_unsubscribe": "Leiratkozás",
-    "message_bar_type_message": "Írd ide az üzenetet",
-    "message_bar_error_publishing": "Hiba történt az értesítés elküldése közben",
-    "nav_button_all_notifications": "Összes értesítés",
+    "message_bar_type_message": "Írj ide egy üzenetet",
+    "message_bar_error_publishing": "Hiba az értesítés közzétételénél",
+    "nav_button_all_notifications": "Minden értesítés",
     "nav_topics_title": "Feliratkozott témák",
     "alert_notification_permission_required_title": "Az értesítések le vannak tiltva",
-    "alert_notification_permission_required_description": "Engedélyezd a böngésződnek, hogy asztali értesítéseket jelenítsen meg",
+    "alert_notification_permission_required_description": "Engedélyezze a böngészőjében az asztali értesítések megjelenítését",
     "nav_button_settings": "Beállítások",
     "nav_button_documentation": "Dokumentáció",
-    "nav_button_publish_message": "Értesítés küldése",
-    "alert_notification_permission_required_button": "Engedélyezés",
-    "alert_not_supported_title": "Az értesítések nincsenek támogatva",
-    "notifications_copied_to_clipboard": "Vágólapra másolva",
+    "nav_button_publish_message": "Értesítés közzététele",
+    "alert_notification_permission_required_button": "Jelentkezz most",
+    "alert_not_supported_title": "Az értesítések nem támogatottak",
+    "notifications_copied_to_clipboard": "A vágólapra másolva",
     "notifications_tags": "Címkék",
-    "notifications_attachment_copy_url_title": "Másolja vágólapra a csatolmány URL-ét",
+    "notifications_attachment_copy_url_title": "Copy attachment URL to clipboard",
     "notifications_attachment_copy_url_button": "URL másolása",
-    "notifications_attachment_open_title": "Menjen a(z) {{url}} címre",
-    "notifications_attachment_open_button": "Csatolmány megnyitása",
-    "notifications_attachment_link_expired": "A letöltési link lejárt",
-    "notifications_attachment_link_expires": "A hivatkozás {{date}}-kor jár le",
-    "nav_button_subscribe": "Feliratkozás témára",
-    "notifications_click_copy_url_title": "Másolja vágólapra a hivatkozás URL-ét",
-    "notifications_actions_open_url_title": "Menjen a(z) {{url}} címre",
-    "notifications_actions_not_supported": "A művelet nem támogatott a webes alkalmazásban",
-    "notifications_actions_http_request_title": "Küldjön HTTP {{method}} kérést a(z) {{url}} címre",
-    "notifications_none_for_topic_title": "Még nem érkezett értesítés erre a témára.",
-    "notifications_none_for_any_title": "Még nem érkezett egy értesítés sem.",
-    "notifications_none_for_any_description": "Értesítés beküldéséhez csak küldj egy PUT, vagy POST kérést a téma URL-ére. Itt egy példa az egyik témádhoz.",
-    "notifications_no_subscriptions_title": "Úgy tűnik, még nem iratkoztál fel egy témára sem.",
-    "publish_dialog_message_published": "Értesítés elküldve",
+    "notifications_attachment_open_title": "Ugrás a{{url}}-ra",
+    "notifications_attachment_open_button": "Melléklet megnyitása",
+    "notifications_attachment_link_expired": "A letöltési link érvényessége lejárt",
+    "notifications_attachment_link_expires": "A link érvényessége lejár:{{date}}",
+    "nav_button_subscribe": "Iratkozz fel a témára",
+    "notifications_click_copy_url_title": "A link URL-jét a vágólapra másolja",
+    "notifications_actions_open_url_title": "Ugrás a{{url}}-ra",
+    "notifications_actions_not_supported": "Ez a művelet nem támogatott a webalkalmazásban",
+    "notifications_actions_http_request_title": "HTTP-kérés küldése {{method}} címre {{url}}",
+    "notifications_none_for_topic_title": "Erre a témára még nem kaptál értesítést.",
+    "notifications_none_for_any_title": "Nem érkezett hozzád értesítés.",
+    "notifications_none_for_any_description": "Ha értesítéseket szeretnél küldeni egy témához, egyszerűen hajts végre egy PUT vagy POST műveletet a téma URL-jére. Íme egy példa az egyik témádra vonatkozóan.",
+    "notifications_no_subscriptions_title": "Úgy tűnik, még nincs előfizetésed.",
+    "publish_dialog_message_published": "Értesítés közzététele",
     "notifications_example": "Példa",
-    "notifications_no_subscriptions_description": "Kattints a \"{{linktext}}\" linkre egy téma létrehozásához, vagy rá feliratkozáshoz. Ezután PUT, vagy POST kéréssel fogsz tudni értesítéseket küldeni rá, amik utána meg fognak itt jelenni.",
+    "notifications_no_subscriptions_description": "Kattints a „{{linktext}}” linkre egy téma létrehozásához vagy feliratkozáshoz. Ezt követően PUT vagy POST kéréssel küldhetsz üzeneteket, és itt fogod megkapni az értesítéseket.",
     "publish_dialog_priority_low": "Alacsony prioritás",
-    "publish_dialog_priority_default": "Közepes prioritás",
-    "publish_dialog_priority_high": "Magas prioritás",
-    "notifications_more_details": "További információkért keresd fel a <websiteLink>weboldalunkat</websiteLink> vagy olvasd el a <docsLink>dokumentációt</docsLink>.",
-    "publish_dialog_title_no_topic": "Értesítés küldése",
-    "publish_dialog_attachment_limits_file_and_quota_reached": "túllépi a fájlméret korlátot ({{fileSizeLimit}}) és a kvótát is ({{remainingBytes}} maradt)",
-    "publish_dialog_attachment_limits_quota_reached": "túllépi a kvótát, {{remainingBytes}} maradt",
-    "publish_dialog_priority_min": "Legkisebb prioritás",
-    "publish_dialog_base_url_label": "A szolgáltatás URL-e",
-    "publish_dialog_base_url_placeholder": "A szolgáltatás URL-e, pl: https://example.com",
-    "publish_dialog_topic_label": "Téma neve",
-    "publish_dialog_priority_max": "Legmagasabb prioritás",
-    "publish_dialog_topic_placeholder": "Téma neve, pl: jozsi_riasztasai",
+    "publish_dialog_priority_default": "Alapértelmezett prioritás",
+    "publish_dialog_priority_high": "Kiemelt fontosságú",
+    "notifications_more_details": "További információkért látogasson el a<websiteLink>weboldalra, vagy tekintse meg a</websiteLink>vagy a<docsLink>dokumentációt.",
+    "publish_dialog_title_no_topic": "Értesítés közzététele",
+    "publish_dialog_attachment_limits_file_and_quota_reached": "meghaladja a{{fileSizeLimit}}fájlkorlátot és kvótát,{{remainingBytes}}maradt",
+    "publish_dialog_attachment_limits_quota_reached": "meghaladja a kvótát, {{remainingBytes}} maradt",
+    "publish_dialog_priority_min": "Minimális prioritás",
+    "publish_dialog_base_url_label": "Szolgáltatás URL-je",
+    "publish_dialog_base_url_placeholder": "Szolgáltatás URL-címe, pl. https://example.com",
+    "publish_dialog_topic_label": "A téma neve",
+    "publish_dialog_priority_max": "Legfőbb prioritás",
+    "publish_dialog_topic_placeholder": "Téma neve, pl. phil_alerts",
     "publish_dialog_title_label": "Cím",
-    "publish_dialog_title_placeholder": "Értesítés címe, pl: Fogy a szabad hely",
+    "publish_dialog_title_placeholder": "Értesítés címe, pl. Lemezterület-figyelmeztetés",
     "publish_dialog_message_label": "Üzenet",
     "publish_dialog_message_placeholder": "Írj ide egy üzenetet",
     "publish_dialog_tags_label": "Címkék",
-    "publish_dialog_tags_placeholder": "Címkék vesszővel elválasztva, pl: fontos,srv1-backup",
-    "publish_dialog_priority_label": "Prioritás",
-    "publish_dialog_click_label": "URL",
-    "publish_dialog_click_placeholder": "Webcím, ami megnyílik, ha az értesítésre kattintanak",
-    "publish_dialog_email_label": "Email",
-    "publish_dialog_email_placeholder": "Email cím, amire továbbítjuk az értesítést, pl: jozsi@example.com",
-    "publish_dialog_attach_label": "Csatolmány URL-e",
+    "publish_dialog_tags_placeholder": "Vesszővel elválasztott címkék listája, pl.: warning, srv1-backup",
+    "publish_dialog_priority_label": "Elsőbbség",
+    "publish_dialog_click_label": "Kattintson az URL-re",
+    "publish_dialog_click_placeholder": "Az értesítésre kattintáskor megnyíló URL",
+    "publish_dialog_email_label": "E-mail",
+    "publish_dialog_email_placeholder": "A bejelentés továbbításának címe, pl.: phil@example.com",
+    "publish_dialog_attach_label": "A melléklet URL-címe",
     "publish_dialog_filename_label": "Fájlnév",
-    "publish_dialog_filename_placeholder": "Csatolmány fájlneve",
+    "publish_dialog_filename_placeholder": "A melléklet fájlneve",
     "publish_dialog_delay_label": "Késleltetés",
-    "publish_dialog_delay_placeholder": "Késleltetett küldés, pl: {{unixTimestamp}}, {{relativeTime}}, vagy \"{{naturalLanguage}}\" (Csak angolul)",
-    "publish_dialog_other_features": "Egyéb lehetőségek:",
-    "publish_dialog_chip_click_label": "Kattintási URL",
+    "publish_dialog_delay_placeholder": "Szállítás késleltetése, pl. {{unixTimestamp}}, {{relativeTime}}vagy „{{naturalLanguage}}” (csak angolul)",
+    "publish_dialog_other_features": "Egyéb jellemzők:",
+    "publish_dialog_chip_click_label": "Kattintson az URL-re",
     "publish_dialog_chip_attach_file_label": "Helyi fájl csatolása",
-    "publish_dialog_chip_delay_label": "Késleltetett kézbesítés",
-    "publish_dialog_chip_topic_label": "Téma megváltoztatása",
-    "publish_dialog_button_cancel_sending": "Küldés megállítása",
-    "publish_dialog_button_cancel": "Mégsem",
-    "publish_dialog_checkbox_publish_another": "Küldök még egyet",
+    "publish_dialog_chip_delay_label": "Szállítás késleltetése",
+    "publish_dialog_chip_topic_label": "Téma váltása",
+    "publish_dialog_button_cancel_sending": "Elküldés visszavonása",
+    "publish_dialog_button_cancel": "Mégse",
+    "publish_dialog_checkbox_publish_another": "Újabb közzététel",
     "publish_dialog_attached_file_title": "Csatolt fájl:",
-    "publish_dialog_attached_file_filename_placeholder": "Csatolmány fájlneve",
-    "publish_dialog_drop_file_here": "Ejtsd ide a fájlt",
-    "emoji_picker_search_placeholder": "Emoji keresése",
-    "publish_dialog_details_examples_description": "Példákért és az összes küldési képesség részletes leírásához olvasd el a <docsLink>dokumentációt</docsLink>.",
+    "publish_dialog_attached_file_filename_placeholder": "A melléklet fájlneve",
+    "publish_dialog_drop_file_here": "Helyezze ide a fájlt",
+    "emoji_picker_search_placeholder": "Emoji keresés",
+    "publish_dialog_details_examples_description": "Példákért és az összes küldési funkció részletes leírásáért kérjük, olvassa el a <docsLink>dokumentációt</docsLink>.",
     "subscribe_dialog_subscribe_use_another_label": "Használjon másik szervert",
-    "subscribe_dialog_subscribe_button_subscribe": "Feliratkozás",
-    "subscribe_dialog_login_title": "Be kell jelentkezni",
-    "subscribe_dialog_subscribe_description": "A témák nem mindig vannak jelszóval védve, ezért olyan nevet válassz, ami nehezen található ki. Miután feliratkoztál, küldhetsz értesítéseket.",
-    "subscribe_dialog_login_description": "Ez a téma jelszóval védett. Jelentkezz be a feliratkozáshoz.",
-    "subscribe_dialog_login_username_label": "Felhasználónév, pl: jozsi",
+    "subscribe_dialog_subscribe_button_subscribe": "Iratkozz fel",
+    "subscribe_dialog_login_title": "Bejelentkezés szükséges",
+    "subscribe_dialog_subscribe_description": "A témák nem jelszóval védhetők, ezért válasszon olyan nevet, amelyet nem könnyű kitalálni. A feliratkozás után PUT/POST értesítéseket küldhet.",
+    "subscribe_dialog_login_description": "Ez a téma jelszóval védett. Kérjük, adja meg a felhasználónevét és a jelszavát a feliratkozáshoz.",
+    "subscribe_dialog_login_username_label": "Felhasználónév, pl. phil",
     "subscribe_dialog_login_password_label": "Jelszó",
     "common_back": "Vissza",
-    "subscribe_dialog_login_button_login": "Belépés",
+    "subscribe_dialog_login_button_login": "Bejelentkezés",
     "subscribe_dialog_error_user_anonymous": "névtelen",
-    "subscribe_dialog_error_user_not_authorized": "A(z) {{username}} felhasználónak nincs hozzáférése",
-    "prefs_notifications_min_priority_description_any": "Minden értesítést mutat, prioritástól függetlenül",
-    "prefs_notifications_min_priority_description_max": "Csak az 5-ös (legmagasabb) prioritású értesítések jelennek meg",
-    "prefs_notifications_min_priority_any": "Bármilyen prioritás",
-    "prefs_notifications_min_priority_low_and_higher": "Alacsony prioritás, vagy magasabb",
-    "prefs_notifications_min_priority_high_and_higher": "Magas, vagy legmagasabb prioritás",
-    "prefs_notifications_min_priority_max_only": "Csak a legmagasabb prioritás",
-    "prefs_notifications_sound_title": "Értesítés hangja",
-    "prefs_notifications_sound_description_none": "Az értesítések nem fognak hangot adni, amikor megérkeznek",
-    "prefs_notifications_sound_no_sound": "Hang nélkül",
-    "prefs_notifications_delete_after_one_week": "1 hét után",
-    "prefs_notifications_delete_after_one_month": "1 hónap után",
-    "prefs_notifications_delete_after_never_description": "Az értesítések soha nem lesznek automatikusan törölve",
-    "prefs_notifications_delete_after_three_hours_description": "A 3 óránál régebbi értesítések automatikus törlése",
-    "prefs_notifications_delete_after_one_day_description": "Az egy napnál régebbi értesítések automatikus törlése",
-    "prefs_users_description": "Itt tudsz hozzáadni/eltávolítani felhasználókat a védett témákról. Fontos, hogy a felhasználónevet és a jelszót a böngésző helyi tárolójába fogjuk menteni.",
+    "subscribe_dialog_error_user_not_authorized": "A{{username}}felhasználó nem rendelkezik jogosultsággal",
+    "prefs_notifications_min_priority_description_any": "Az összes értesítés megjelenítése, prioritástól függetlenül",
+    "prefs_notifications_min_priority_description_max": "Értesítések megjelenítése, ha a prioritás 5 (maximális)",
+    "prefs_notifications_min_priority_any": "Bármely prioritás",
+    "prefs_notifications_min_priority_low_and_higher": "Alacsony prioritás és annál magasabb",
+    "prefs_notifications_min_priority_high_and_higher": "Magas prioritás és annál magasabb",
+    "prefs_notifications_min_priority_max_only": "Csak a legmagasabb prioritású",
+    "prefs_notifications_sound_title": "Értesítési hang",
+    "prefs_notifications_sound_description_none": "Az értesítések érkezésekor nem hallatszik hang",
+    "prefs_notifications_sound_no_sound": "Nincs hang",
+    "prefs_notifications_delete_after_one_week": "Egy hét elteltével",
+    "prefs_notifications_delete_after_one_month": "Egy hónap elteltével",
+    "prefs_notifications_delete_after_never_description": "Az értesítések soha nem kerülnek automatikusan törlésre",
+    "prefs_notifications_delete_after_three_hours_description": "Az értesítések három óra elteltével automatikusan törlődnek",
+    "prefs_notifications_delete_after_one_day_description": "Az értesítések egy nap elteltével automatikusan törlődnek",
+    "prefs_users_description": "Itt adhat hozzá vagy távolíthat el felhasználókat a védett témákhoz. Felhívjuk figyelmét, hogy a felhasználónév és a jelszó a böngésző helyi tárolójában kerülnek elmentésre.",
     "prefs_users_table_user_header": "Felhasználó",
-    "prefs_users_table_base_url_header": "Szerver címe",
+    "prefs_users_table_base_url_header": "Szolgáltatás URL-je",
     "prefs_users_dialog_title_edit": "Felhasználó szerkesztése",
-    "prefs_users_dialog_username_label": "Felhasználónév, pl: jozsi",
+    "prefs_users_dialog_username_label": "Felhasználónév, pl. phil",
     "prefs_users_dialog_password_label": "Jelszó",
     "common_add": "Hozzáadás",
-    "prefs_users_dialog_base_url_label": "Szerver címe, pl: https://ntfy.sh",
+    "prefs_users_dialog_base_url_label": "Szolgáltatási URL, pl. https://ntfy.sh",
     "notifications_loading": "Értesítések betöltése …",
-    "publish_dialog_progress_uploading": "Feltöltés …",
-    "notifications_click_copy_url_button": "Hivatkozás másolása",
-    "notifications_click_open_button": "Hivatkozás megnyitása",
-    "publish_dialog_progress_uploading_detail": "Feltöltés folyamatban: {{loaded}}/{{total}} ({{percent}}%) …",
-    "notifications_none_for_topic_description": "Értesítés beküldéséhez csak küldj egy PUT, vagy POST kérést a téma URL-ére.",
-    "prefs_notifications_delete_after_one_day": "1 nap után",
-    "publish_dialog_attach_placeholder": "Csatolandó fájl címe, pl: https://f-droid.org/F-Droid.apk",
-    "publish_dialog_chip_email_label": "Továbbítás email-ben",
-    "publish_dialog_chip_attach_url_label": "Fájl csatolása URL-lel",
+    "publish_dialog_progress_uploading": "Feltöltés…",
+    "notifications_click_copy_url_button": "Link másolása",
+    "notifications_click_open_button": "Link megnyitása",
+    "publish_dialog_progress_uploading_detail": "{{loaded}}/{{total}}feltöltése  ({{percent}}%) …",
+    "notifications_none_for_topic_description": "Ha értesítéseket szeretnél küldeni erre a témára, egyszerűen hajts végre egy PUT vagy POST műveletet a téma URL-jére.",
+    "prefs_notifications_delete_after_one_day": "Egy nap elteltével",
+    "publish_dialog_attach_placeholder": "Fájl csatolása URL-címen keresztül, pl. https://f-droid.org/F-Droid.apk",
+    "publish_dialog_chip_email_label": "Továbbítás e-mailben",
+    "publish_dialog_chip_attach_url_label": "Fájl csatolása URL-címen keresztül",
     "publish_dialog_button_send": "Küldés",
-    "subscribe_dialog_subscribe_title": "Feliratkozás témára",
-    "subscribe_dialog_subscribe_button_cancel": "Mégsem",
-    "prefs_notifications_min_priority_title": "Legkisebb megjelenítendő prioritás",
-    "prefs_notifications_min_priority_description_x_or_higher": "Csak akkor jelenik meg egy értesítés, ha a prioritása {{number}} ({{name}}), vagy fontosabb",
-    "prefs_notifications_min_priority_default_and_higher": "Közepes prioritás, vagy magasabb",
-    "prefs_notifications_delete_after_one_week_description": "Az egy hétnél régebbi értesítések automatikus törlése",
+    "subscribe_dialog_subscribe_title": "Iratkozz fel a témára",
+    "subscribe_dialog_subscribe_button_cancel": "Mégse",
+    "prefs_notifications_min_priority_title": "Legalacsonyabb prioritás",
+    "prefs_notifications_min_priority_description_x_or_higher": "Értesítéseket jelenít meg, ha a prioritás {{number}} ({{name}}) vagy annál magasabb",
+    "prefs_notifications_min_priority_default_and_higher": "Alapértelmezett prioritás és annál magasabb",
+    "prefs_notifications_delete_after_one_week_description": "Az értesítések egy hét elteltével automatikusan törlődnek",
     "prefs_users_add_button": "Felhasználó hozzáadása",
-    "subscribe_dialog_subscribe_topic_placeholder": "Téma neve, pl: jozsi_riasztasai",
+    "subscribe_dialog_subscribe_topic_placeholder": "Téma neve, pl. phil_alerts",
     "prefs_notifications_title": "Értesítések",
-    "error_boundary_button_copy_stack_trace": "Verem nyomkövetés másolása",
-    "prefs_notifications_delete_after_title": "Régi értesítések törlése",
-    "prefs_notifications_delete_after_three_hours": "3 óra után",
-    "error_boundary_title": "Jaj ne, az ntfy összeomlott",
+    "error_boundary_button_copy_stack_trace": "A veremnyomtatvány másolása",
+    "prefs_notifications_delete_after_title": "Értesítések törlése",
+    "prefs_notifications_delete_after_three_hours": "Három óra múlva",
+    "error_boundary_title": "Jaj, ne, az ntfy összeomlott",
     "prefs_notifications_delete_after_never": "Soha",
-    "prefs_notifications_delete_after_one_month_description": "Az egy hónapnál régebbi értesítések automatikus törlése",
+    "prefs_notifications_delete_after_one_month_description": "Az értesítések egy hónap elteltével automatikusan törlődnek",
     "prefs_appearance_title": "Megjelenés",
-    "priority_default": "közepes",
+    "priority_default": "alapértelmezett",
     "priority_high": "magas",
-    "priority_max": "legmagasabb",
-    "priority_min": "legkisebb",
-    "error_boundary_gathering_info": "Több információ…",
-    "publish_dialog_attachment_limits_file_reached": "túllépi a fájlméret korlátot ({{fileSizeLimit}})",
+    "priority_max": "legnagyobb",
+    "priority_min": "Nekem",
+    "error_boundary_gathering_info": "További információk …",
+    "publish_dialog_attachment_limits_file_reached": "meghaladja a{{fileSizeLimit}}fájlkorlátot",
     "prefs_users_title": "Felhasználók kezelése",
-    "common_cancel": "Mégsem",
+    "common_cancel": "Mégse",
     "common_save": "Mentés",
     "prefs_users_dialog_title_add": "Felhasználó hozzáadása",
     "prefs_appearance_language_title": "Nyelv",
     "priority_low": "alacsony",
-    "error_boundary_stack_trace": "Verem nyomkövetés",
-    "publish_dialog_title_topic": "A {{topic}} téma értesítése",
-    "prefs_notifications_sound_description_some": "Az értesítéseket a(z) {{sound}} hang fogja jelezni",
-    "error_boundary_description": "Ennek nem szabadott volna megtörténnie. Nagyon sajnáljuk.<br/>Ha van egy perced, <githubLink>jelentsd be GitHubon</githubLink>, vagy tudasd velünk <discordLink>Discordon</discordLink>, vagy <matrixLink>Matrixon</matrixLink>.",
-    "action_bar_show_menu": "Menü mutatása",
-    "action_bar_toggle_mute": "Üzenetek némítása/bekapcsolása",
+    "error_boundary_stack_trace": "Hibajelentés",
+    "publish_dialog_title_topic": "Közzététel a {{topic}}-ban",
+    "prefs_notifications_sound_description_some": "Az értesítések érkezéskor a {{sound}} hangot játsszák le",
+    "error_boundary_description": "Ez természetesen nem lenne szabad, hogy megtörténjen. Nagyon sajnáljuk a kellemetlenséget.<br/>Ha van egy perced, kérlek, <githubLink>jelentsd be a hibát a GitHubon</githubLink>, vagy értesíts minket a <discordLink>Discordon</discordLink> vagy a <matrixLink>Matrixon</matrixLink>.",
+    "action_bar_show_menu": "Menü megjelenítése",
+    "action_bar_toggle_mute": "Értesítések némítása/némításának feloldása",
     "notifications_list_item": "Értesítés",
-    "error_boundary_unsupported_indexeddb_description": "A ntfy web alkalmazás működéséhez szükséges az IndexedDB funkció, az ön böngészője nem támogatja az IndexedDB használatát privát böngészés közben.<br/><br/>Miközben privát mód sajnos nem lehetséges, szeretnénk értesíteni hogy magabiztosan használhatja normál módban mert a böngésző minden adatot az ön gépén tárol. Tovább tájékozódhat <githubLink>ezen a Github oldalon</githubLink>, vagy beszéljen velünk <discordLink>Discord-on</discordLink> vagy <matrixLink>Matrix-on</matrixLink>.",
-    "notifications_priority_x": "Prioritás {{prioritás}}",
-    "message_bar_show_dialog": "Küldött üzenetek megjelenítése",
+    "error_boundary_unsupported_indexeddb_description": "Az ntfy webalkalmazás működéséhez szükség van az IndexedDB-re, a böngésződ azonban nem támogatja az IndexedDB-t inkognitó módban.<br/><br/>Bár ez sajnálatos, valójában nem is lenne túl értelmes az ntfy webalkalmazást inkognitó módban használni, mivel minden a böngésző tárolójában kerül elmentésre. További információkat erről a GitHub-problémában találsz, vagy lépj kapcsolatba velünk a Discordon vagy a Matrixon.",
+    "notifications_priority_x": "Prioritás {{priority}}",
+    "message_bar_show_dialog": "Közzétételi párbeszédpanel megjelenítése",
     "action_bar_logo_alt": "ntfy logó",
-    "action_bar_toggle_action_menu": "Tevékenységkezelő nyitása/zárása",
-    "message_bar_publish": "Üzenet küldése",
-    "nav_button_muted": "Értesítések némítva",
-    "nav_button_connecting": "csatlakozás",
-    "notifications_list": "Értesítés lista",
-    "notifications_mark_read": "Jelölés olvasottként",
+    "action_bar_toggle_action_menu": "Műveleti menü megnyitása/bezárása",
+    "message_bar_publish": "Üzenet közzététele",
+    "nav_button_muted": "Értesítések elnémítva",
+    "nav_button_connecting": "összekötő",
+    "notifications_list": "Értesítések listája",
+    "notifications_mark_read": "Olvasottként jelölés",
     "notifications_delete": "Törlés",
     "notifications_new_indicator": "Új értesítés",
-    "notifications_attachment_image": "Csatolt kép",
-    "notifications_attachment_file_image": "Kép fájl",
-    "notifications_attachment_file_video": "Videó fájl",
-    "notifications_attachment_file_audio": "Hang fájl",
-    "notifications_attachment_file_app": "Android alkalmazás fájl",
+    "notifications_attachment_image": "Melléklet kép",
+    "notifications_attachment_file_image": "képfájl",
+    "notifications_attachment_file_video": "videofájl",
+    "notifications_attachment_file_audio": "hangfájl",
+    "notifications_attachment_file_app": "Android-alkalmazásfájl",
     "notifications_attachment_file_document": "egyéb dokumentum",
     "publish_dialog_emoji_picker_show": "Emoji kiválasztása",
     "publish_dialog_topic_reset": "Téma visszaállítása",
-    "publish_dialog_click_reset": "URL kattintás törlése",
-    "publish_dialog_email_reset": "Email továbbítás törlése",
-    "publish_dialog_attach_reset": "Csatolt URL törlése",
-    "publish_dialog_delay_reset": "Késleltetett kézbesítés törlése",
-    "publish_dialog_attached_file_remove": "Csatolt fájl törlése",
+    "publish_dialog_click_reset": "Az URL-re kattintás eltávolítása",
+    "publish_dialog_email_reset": "Az e-mail továbbításának megszüntetése",
+    "publish_dialog_attach_reset": "A melléklet URL-jének eltávolítása",
+    "publish_dialog_delay_reset": "A késleltetett kézbesítés eltávolítása",
+    "publish_dialog_attached_file_remove": "A csatolt fájl eltávolítása",
     "emoji_picker_search_clear": "Keresés törlése",
-    "prefs_notifications_sound_play": "Kijelölt hang lejátszása",
-    "prefs_users_table": "Felhasználó táblázat",
+    "prefs_notifications_sound_play": "A kiválasztott hang lejátszása",
+    "prefs_users_table": "Felhasználók táblázata",
     "prefs_users_edit_button": "Felhasználó szerkesztése",
     "prefs_users_delete_button": "Felhasználó törlése",
-    "error_boundary_unsupported_indexeddb_title": "Privát böngészés nem támogatott",
-    "subscribe_dialog_subscribe_base_url_label": "Szolgáltató URL",
+    "error_boundary_unsupported_indexeddb_title": "A magánböngészés nem támogatott",
+    "subscribe_dialog_subscribe_base_url_label": "Szolgáltatás URL-je",
     "signup_form_username": "Felhasználónév",
     "signup_form_password": "Jelszó",
-    "signup_form_button_submit": "Regisztráció",
+    "signup_form_button_submit": "Regisztrálj",
     "login_form_button_submit": "Bejelentkezés",
-    "login_link_signup": "Regisztráció",
-    "login_disabled": "Bejelentkezés kikapcsolva",
-    "action_bar_change_display_name": "Megjelenített név módosítása",
+    "login_link_signup": "Regisztrálj",
+    "login_disabled": "A bejelentkezés le van tiltva",
+    "action_bar_change_display_name": "A megjelenített név módosítása",
     "action_bar_profile_logout": "Kijelentkezés",
     "action_bar_sign_in": "Bejelentkezés",
-    "action_bar_sign_up": "Regisztráció",
+    "action_bar_sign_up": "Regisztrálj",
     "action_bar_profile_title": "Profil",
     "nav_button_account": "Fiók",
-    "common_copy_to_clipboard": "Másolás vágólapra",
-    "action_bar_reservation_limit_reached": "Limit elérve",
-    "login_title": "Jelentkezz be a ntfy felhasználódba",
-    "signup_title": "Hozz létre egy ntfy felhasználói fiókot",
+    "common_copy_to_clipboard": "Másolás a vágólapra",
+    "action_bar_reservation_limit_reached": "Elérte a határt",
+    "login_title": "Jelentkezzen be az ntfy-fiókjába",
+    "signup_title": "Hozzon létre egy ntfy-fiókot",
     "signup_form_confirm_password": "Jelszó megerősítése",
-    "signup_already_have_account": "Már van felhasználód? Jelentkezz be!",
+    "signup_already_have_account": "Van már fiókod? Jelentkezz be!",
     "action_bar_account": "Fiók",
     "action_bar_profile_settings": "Beállítások",
-    "signup_error_username_taken": "A felhasználónév {{username}} már foglalt",
-    "signup_error_creation_limit_reached": "Felhasználói regisztráció limit elérve",
+    "signup_error_username_taken": "A{{username}}felhasználónév már foglalt",
+    "signup_error_creation_limit_reached": "Elérte a fiók létrehozásának korlátját",
     "action_bar_mute_notifications": "Értesítések némítása",
-    "action_bar_unmute_notifications": "Értesítések némításának feloldása",
-    "alert_notification_permission_denied_title": "Az értesítések blokkolva vannak",
-    "alert_notification_permission_denied_description": "Kérjük kapcsold őket vissza a böngésződben",
-    "alert_notification_ios_install_required_title": "iOS telepítés szükséges",
-    "alert_not_supported_context_description": "Az értesítések kizárólag HTTPS-en keresztül támogatottak. Ez a <mdnLink>Notifications API</mdnLink> korlátozása.",
-    "signup_form_toggle_password_visibility": "Jelszó láthatóságának kapcsolása",
+    "action_bar_unmute_notifications": "Értesítések hangjának visszaállítása",
+    "alert_notification_permission_denied_title": "Az értesítések letiltva vannak",
+    "alert_notification_permission_denied_description": "Kérjük, kapcsolja be őket újra a böngészőjében",
+    "alert_notification_ios_install_required_title": "iOS-telepítés szükséges",
+    "alert_not_supported_context_description": "Az értesítések kizárólag HTTPS-en keresztül támogatottak. Ez a <mdnLink>Értesítési API</mdnLink>korlátozása.",
+    "signup_form_toggle_password_visibility": "A jelszó láthatóságának beállítása",
     "signup_disabled": "A regisztráció le van tiltva",
-    "action_bar_reservation_add": "Téma fenntartása",
+    "action_bar_reservation_add": "Téma elmentése",
     "action_bar_reservation_edit": "Foglalás módosítása",
     "action_bar_reservation_delete": "Foglalás törlése",
-    "nav_upgrade_banner_label": "Frissítés ntfy Pro-ra",
-    "nav_upgrade_banner_description": "Témák, több üzenet és e-mail, valamint nagyobb mellékletek megőrzése",
-    "alert_notification_ios_install_required_description": "Kattintson a Megosztás ikonra, majd a Hozzáadás a kezdőképernyőhöz gombra, hogy engedélyezze az értesítéseket iOS rendszeren"
+    "nav_upgrade_banner_label": "Frissíts az ntfy Pro-ra",
+    "nav_upgrade_banner_description": "További témák, több üzenet és e-mail, valamint nagyobb mellékletek",
+    "alert_notification_ios_install_required_description": "Kattints a Megosztás ikonra, majd a „Hozzáadás a kezdőképernyőhöz” gombra az értesítések engedélyezéséhez iOS rendszeren",
+    "notifications_actions_failed_notification": "Sikertelen művelet",
+    "display_name_dialog_title": "A megjelenített név módosítása",
+    "display_name_dialog_description": "Állítson be egy alternatív nevet egy témához, amely az előfizetési listában jelenik meg. Ez megkönnyíti a bonyolult nevű témák azonosítását.",
+    "display_name_dialog_placeholder": "Megjelenítendő név",
+    "reserve_dialog_checkbox_label": "Téma lefoglalása és a hozzáférés beállítása",
+    "publish_dialog_call_label": "Telefonhívás",
+    "publish_dialog_call_item": "Hívja a{{number}}telefonszámot",
+    "publish_dialog_call_reset": "Hívás törlése",
+    "publish_dialog_chip_call_label": "Telefonhívás",
+    "publish_dialog_chip_call_no_verified_numbers_tooltip": "Nincs ellenőrzött telefonszám",
+    "publish_dialog_checkbox_markdown": "Markdown formátum",
+    "subscribe_dialog_subscribe_use_another_background_info": "A webalkalmazás bezárása esetén a többi szerverről érkező értesítések nem érkeznek meg",
+    "subscribe_dialog_subscribe_button_generate_topic_name": "Név generálása",
+    "subscribe_dialog_error_topic_already_reserved": "A téma már lefoglalva",
+    "account_basics_title": "Fiók",
+    "account_basics_username_title": "Felhasználónév",
+    "account_basics_username_description": "Hé, ez te vagy ❤",
+    "account_basics_username_admin_tooltip": "Ön rendszergazda",
+    "account_basics_password_title": "Jelszó",
+    "account_basics_password_description": "Fiókjának jelszavának módosítása",
+    "account_basics_password_dialog_title": "Jelszó módosítása",
+    "account_basics_password_dialog_current_password_label": "Jelenlegi jelszó",
+    "account_basics_password_dialog_new_password_label": "Új jelszó",
+    "account_basics_password_dialog_confirm_password_label": "Jelszó megerősítése",
+    "account_basics_password_dialog_button_submit": "Jelszó módosítása",
+    "account_basics_password_dialog_current_password_incorrect": "Helytelen jelszó",
+    "account_basics_phone_numbers_title": "Telefonszámok",
+    "account_basics_phone_numbers_dialog_description": "A hívásértesítési funkció használatához legalább egy telefonszámot hozzá kell adnia és igazolnia kell. Az igazolás SMS-ben vagy telefonhívás útján történhet.",
+    "account_basics_phone_numbers_description": "Telefonos értesítések esetén",
+    "account_basics_phone_numbers_no_phone_numbers_yet": "Még nincs telefonszám",
+    "account_basics_phone_numbers_copied_to_clipboard": "A telefonszámot a vágólapra másoltam",
+    "account_basics_phone_numbers_dialog_title": "Telefonszám hozzáadása",
+    "account_basics_phone_numbers_dialog_number_label": "Telefonszám",
+    "account_basics_phone_numbers_dialog_number_placeholder": "pl. +1222333444",
+    "account_basics_phone_numbers_dialog_verify_button_sms": "SMS küldése",
+    "account_basics_phone_numbers_dialog_verify_button_call": "Hívj fel",
+    "account_basics_phone_numbers_dialog_code_label": "Ellenőrző kód",
+    "account_basics_phone_numbers_dialog_code_placeholder": "pl. 123456",
+    "account_basics_phone_numbers_dialog_check_verification_button": "Kód megerősítése",
+    "account_basics_phone_numbers_dialog_channel_sms": "SMS",
+    "account_basics_phone_numbers_dialog_channel_call": "Hívás",
+    "account_basics_cannot_edit_or_delete_provisioned_user": "A hozzárendelt felhasználót nem lehet szerkeszteni vagy törölni",
+    "account_usage_title": "Használat",
+    "account_usage_of_limit": "a{{limit}}",
+    "account_usage_unlimited": "Korlátlan",
+    "account_usage_limits_reset_daily": "A használati korlátok minden nap éjfélkor (UTC) visszaállnak",
+    "account_basics_tier_title": "Számlatípus",
+    "account_basics_tier_description": "Fiókod erősségi szintje",
+    "account_basics_tier_admin": "Admin",
+    "account_basics_tier_admin_suffix_with_tier": "(a{{tier}}szinttel)",
+    "account_basics_tier_admin_suffix_no_tier": "(nincs besorolás)",
+    "account_basics_tier_basic": "Alapvető",
+    "account_basics_tier_free": "Ingyenes",
+    "account_basics_tier_interval_monthly": "havonta",
+    "account_basics_tier_interval_yearly": "éves szinten",
+    "account_basics_tier_upgrade_button": "Frissíts Pro verzióra",
+    "account_basics_tier_change_button": "Változás",
+    "account_basics_tier_paid_until": "Az előfizetés{{date}}-ig fizetve, és automatikusan megújul",
+    "account_basics_tier_payment_overdue": "A fizetési határidő lejárt. Kérjük, frissítse a fizetési módját, ellenkező esetben fiókját hamarosan alacsonyabb szintre soroljuk át.",
+    "account_basics_tier_canceled_subscription": "Előfizetését töröltük, és{{date}}-tól ingyenes fiókra váltunk.",
+    "account_basics_tier_manage_billing_button": "Számlázás kezelése",
+    "account_usage_messages_title": "Közzétett üzenetek",
+    "account_usage_emails_title": "Elküldött e-mailek",
+    "account_usage_calls_title": "Kezdeményezett telefonhívások",
+    "account_usage_calls_none": "Ebből a fiókból nem lehet telefonálni",
+    "account_usage_reservations_title": "Fenntartott témák",
+    "account_usage_reservations_none": "Ehhez a fiókhoz nincs fenntartott téma",
+    "account_usage_attachment_storage_title": "Mellékletek tárolása",
+    "account_usage_attachment_storage_description": "{{filesize}}fájlonként, törlésre kerül{{expiry}}után",
+    "account_usage_basis_ip_description": "A fiók használati statisztikái és korlátai az Ön IP-címén alapulnak, ezért előfordulhat, hogy más felhasználókkal is megosztásra kerülnek. A fent feltüntetett korlátok a jelenlegi sávszélesség-korlátozások alapján számított hozzávetőleges értékek.",
+    "account_usage_cannot_create_portal_session": "A számlázási portál nem nyitható meg",
+    "account_delete_title": "Fiók törlése",
+    "account_delete_description": "Fiókjának végleges törlése",
+    "account_delete_dialog_description": "Ezzel véglegesen törlöd a fiókodat, beleértve a szerveren tárolt összes adatot is. A törlés után a felhasználóneved 7 napig nem lesz elérhető. Ha biztosan folytatni szeretnéd, kérjük, erősítsd meg a jelszavadat az alábbi mezőben.",
+    "account_delete_dialog_label": "Jelszó",
+    "account_delete_dialog_button_cancel": "Mégse",
+    "account_delete_dialog_button_submit": "Fiók végleges törlése",
+    "account_delete_dialog_billing_warning": "A fiók törlésével a fizetési előfizetés is azonnal megszűnik. Ezt követően már nem fogsz hozzáférni a fizetési irányítópanelhez.",
+    "account_upgrade_dialog_title": "Fiókcsomag módosítása",
+    "account_upgrade_dialog_interval_monthly": "Havi",
+    "account_upgrade_dialog_interval_yearly": "Évente",
+    "account_upgrade_dialog_interval_yearly_discount_save": "{{discount}}% mentése",
+    "account_upgrade_dialog_interval_yearly_discount_save_up_to": "akár {{discount}}%-os megtakarítás",
+    "account_upgrade_dialog_cancel_warning": "Ezzel <strong>előfizetése megszűnik</strong>, és fiókja alacsonyabb szintre kerül {{date}}. Ezen a napon a témákhoz tartozó foglalások, valamint a szerveren tárolt üzenetek <strong>törlésre kerülnek</strong>.",
+    "account_upgrade_dialog_proration_info": "<strong>Arányos elszámolás</strong>: Fizetős csomagok közötti áttérés esetén az árkülönbözetet<strong>azonnal felszámítjuk</strong>. Alacsonyabb csomagra való áttérés esetén a fennmaradó egyenleget a jövőbeli számlázási időszakok fedezésére használjuk fel.",
+    "account_upgrade_dialog_reservations_warning_one": "A kiválasztott csomag kevesebb témafoglalást engedélyez, mint a jelenlegi csomagod. A csomagváltás előtt <strong>kérjük, törölj legalább egy foglalást</strong>. A foglalásokat a <Link>Beállítások</Link>menüpontban törölheted.",
+    "account_upgrade_dialog_reservations_warning_other": "A kiválasztott csomag kevesebb témafoglalást engedélyez, mint a jelenlegi csomagod. A csomagváltás előtt <strong>kérjük, törölj legalább {{count}} foglalást</strong>. A foglalásokat a <Link>Beállítások</Link>menüpontban törölheted.",
+    "account_upgrade_dialog_tier_features_reservations_one": "{{reservations}} fenntartott téma",
+    "account_upgrade_dialog_tier_features_reservations_other": "{{reservations}} fenntartott témák",
+    "account_upgrade_dialog_tier_features_no_reservations": "Nincsenek fenntartott témák",
+    "account_upgrade_dialog_tier_features_messages_one": "{{messages}} napi üzenet",
+    "account_upgrade_dialog_tier_features_messages_other": "{{messages}} napi üzenetek",
+    "account_upgrade_dialog_tier_features_emails_one": "{{emails}} napi hírlevél",
+    "account_upgrade_dialog_tier_features_emails_other": "{{emails}} napi e-mailek",
+    "account_upgrade_dialog_tier_features_calls_one": "{{calls}} napi telefonhívás",
+    "account_upgrade_dialog_tier_features_calls_other": "{{calls}} napi telefonhívás",
+    "account_upgrade_dialog_tier_features_no_calls": "Tilos telefonálni",
+    "account_upgrade_dialog_tier_features_attachment_file_size": "{{filesize}} fájlonként",
+    "account_upgrade_dialog_tier_features_attachment_total_size": "{{totalsize}} teljes tárhely",
+    "account_upgrade_dialog_tier_price_per_month": "hónap",
+    "account_upgrade_dialog_tier_price_billed_monthly": "{{price}}évente. Havonta számlázzuk.",
+    "account_upgrade_dialog_tier_price_billed_yearly": "{{price}} éves számlázás. Megtakarítás: {{save}}.",
+    "account_upgrade_dialog_tier_selected_label": "Kiválasztott",
+    "account_upgrade_dialog_tier_current_label": "Jelenlegi",
+    "account_upgrade_dialog_billing_contact_email": "Számlázással kapcsolatos kérdéseivel kérjük, forduljon közvetlenül hozzánk.",
+    "account_upgrade_dialog_billing_contact_website": "Számlázással kapcsolatos kérdéseivel kérjük, keresse fel a<Link>weboldalunkat</Link>.",
+    "account_upgrade_dialog_button_cancel": "Mégse",
+    "account_upgrade_dialog_button_redirect_signup": "Regisztrálj most",
+    "account_upgrade_dialog_button_pay_now": "Fizessen most, és iratkozzon fel",
+    "account_upgrade_dialog_button_cancel_subscription": "Előfizetés lemondása",
+    "account_upgrade_dialog_button_update_subscription": "Előfizetés frissítése",
+    "account_tokens_title": "Hozzáférési tokenek",
+    "account_tokens_description": "Az ntfy API-n keresztül történő közzététel és feliratkozás során használjon hozzáférési tokeneket, így nem kell megadnia a fiókja bejelentkezési adatait. További információkért tekintse meg a <Link>dokumentációt</Link>.",
+    "account_tokens_table_token_header": "Token",
+    "account_tokens_table_label_header": "Címke",
+    "account_tokens_table_last_access_header": "Utolsó hozzáférés",
+    "account_tokens_table_expires_header": "Lejár",
+    "account_tokens_table_never_expires": "Soha nem jár le",
+    "account_tokens_table_current_session": "Aktuális böngészőmunkamenet",
+    "account_tokens_table_copied_to_clipboard": "Az hozzáférési token másolva",
+    "account_tokens_table_cannot_delete_or_edit": "A jelenlegi munkamenet-tokent nem lehet szerkeszteni vagy törölni",
+    "account_tokens_table_cannot_delete_or_edit_provisioned_token": "A létrehozott token nem szerkeszthető vagy törölhető",
+    "account_tokens_table_create_token_button": "Hozzon létre hozzáférési tokent",
+    "account_tokens_table_last_origin_tooltip": "A{{ip}}IP-címről kattintson a kereséshez",
+    "account_tokens_dialog_title_create": "Hozzon létre hozzáférési tokent",
+    "account_tokens_dialog_title_edit": "Hozzáférési token szerkesztése",
+    "account_tokens_dialog_title_delete": "Hozzáférési token törlése",
+    "account_tokens_dialog_label": "Címke, pl. Radarr értesítések",
+    "account_tokens_dialog_button_create": "Token létrehozása",
+    "account_tokens_dialog_button_update": "Token frissítése",
+    "account_tokens_dialog_button_cancel": "Mégse",
+    "account_tokens_dialog_expires_label": "Az hozzáférési token érvényessége",
+    "account_tokens_dialog_expires_unchanged": "A lejárati dátumot ne módosítsa",
+    "account_tokens_dialog_expires_x_hours": "A token érvényessége {{hours}} óra múlva lejár",
+    "account_tokens_dialog_expires_x_days": "A token érvényessége {{days}} nap múlva lejár",
+    "account_tokens_dialog_expires_never": "A token soha nem jár le",
+    "account_tokens_delete_dialog_title": "Hozzáférési token törlése",
+    "account_tokens_delete_dialog_description": "Mielőtt törölne egy hozzáférési tokent, győződjön meg arról, hogy egyetlen alkalmazás vagy szkript sem használja azt éppen. <strong>Ez a művelet visszafordíthatatlan</strong>.",
+    "account_tokens_delete_dialog_submit_button": "A token végleges törlése",
+    "prefs_notifications_web_push_title": "Háttérben futó értesítések",
+    "prefs_notifications_web_push_enabled_description": "Az értesítések akkor is beérkeznek, ha a webalkalmazás nem fut (Web Push segítségével)",
+    "prefs_notifications_web_push_disabled_description": "Értesítéseket kapunk, amikor a webalkalmazás fut (WebSocket-en keresztül)",
+    "prefs_notifications_web_push_enabled": "Engedélyezve a{{server}}esetében",
+    "prefs_notifications_web_push_disabled": "Fogyatékkal élők",
+    "prefs_users_description_no_sync": "A felhasználónevek és jelszavak nem kerülnek szinkronizálásra a fiókjával.",
+    "prefs_users_table_cannot_delete_or_edit": "A bejelentkezett felhasználót nem lehet törölni vagy szerkeszteni",
+    "prefs_appearance_theme_title": "Téma",
+    "prefs_appearance_theme_system": "Rendszer (alapértelmezett)",
+    "prefs_appearance_theme_dark": "Sötét mód",
+    "prefs_appearance_theme_light": "Világos mód",
+    "prefs_reservations_title": "Fenntartott témák",
+    "prefs_reservations_description": "Itt foglalhat le témákat személyes használatra. A téma lefoglalásával tulajdonjogot szerez a témára, és megadhatja a többi felhasználó számára a témához való hozzáférési jogosultságokat.",
+    "prefs_reservations_limit_reached": "Elérted a fenntartott témák számának korlátját.",
+    "prefs_reservations_add_button": "Foglalt téma hozzáadása",
+    "prefs_reservations_edit_button": "Téma szerkesztése",
+    "prefs_reservations_delete_button": "A téma hozzáférésének visszaállítása",
+    "prefs_reservations_table": "Foglalt témák táblázata",
+    "prefs_reservations_table_topic_header": "Téma",
+    "prefs_reservations_table_access_header": "Hozzáférés",
+    "prefs_reservations_table_everyone_deny_all": "Csak én tudok hírleveleket kiadni és feliratkozni rájuk",
+    "prefs_reservations_table_everyone_read_only": "Én is közzétehetek és feliratkozhatok, mindenki feliratkozhat",
+    "prefs_reservations_table_everyone_write_only": "Én is közzétehetek és feliratkozhatok, mindenki közzétehet",
+    "prefs_reservations_table_everyone_read_write": "Bárki közzétehet és feliratkozhat",
+    "prefs_reservations_table_not_subscribed": "Nincs feliratkozva",
+    "prefs_reservations_table_click_to_subscribe": "Kattintson a feliratkozáshoz",
+    "prefs_reservations_dialog_title_add": "Téma elmentése",
+    "prefs_reservations_dialog_title_edit": "Foglalt téma szerkesztése",
+    "prefs_reservations_dialog_title_delete": "Témafoglalás törlése",
+    "prefs_reservations_dialog_description": "A téma lefoglalásával a téma tulajdonjogát szerezheti meg, és meghatározhatja a többi felhasználó hozzáférési jogosultságait a témához.",
+    "prefs_reservations_dialog_topic_label": "Téma",
+    "prefs_reservations_dialog_access_label": "Hozzáférés",
+    "reservation_delete_dialog_description": "A foglalás törlésével lemondasz a téma feletti tulajdonjogodról, és mások is lefoglalhatják azt. A meglévő üzeneteket és mellékleteket megtarthatod vagy törölheted.",
+    "reservation_delete_dialog_action_keep_title": "A gyorsítótárban tárolt üzenetek és mellékletek megőrzése",
+    "reservation_delete_dialog_action_keep_description": "A szerveren gyorsítótárba mentett üzenetek és mellékletek nyilvánosan láthatóvá válnak azok számára, akik ismerik a téma nevét.",
+    "reservation_delete_dialog_action_delete_title": "A gyorsítótárban tárolt üzenetek és mellékletek törlése",
+    "reservation_delete_dialog_action_delete_description": "A gyorsítótárban tárolt üzenetek és mellékletek véglegesen törlésre kerülnek. Ez a művelet visszafordíthatatlan.",
+    "reservation_delete_dialog_submit_button": "Foglalás törlése",
+    "error_boundary_button_reload_ntfy": "Töltsd be nekem",
+    "web_push_subscription_expiring_title": "Az értesítések felfüggesztésre kerülnek",
+    "web_push_subscription_expiring_body": "Nyissa meg az ntfy alkalmazást, hogy továbbra is értesítéseket kapjon",
+    "web_push_unknown_notification_title": "Ismeretlen értesítés érkezett a szerverről",
+    "web_push_unknown_notification_body": "Előfordulhat, hogy a webalkalmazás megnyitásával frissítenie kell az ntfy-t"
 }

web/public/static/langs/it.json

@@ -307,7 +307,7 @@
     "account_delete_dialog_label": "Password",
     "account_upgrade_dialog_tier_features_no_reservations": "Nessun argomento riservato",
     "account_upgrade_dialog_tier_features_messages_one": "{{messages}} messaggi giornalieri",
-    "account_upgrade_dialog_reservations_warning_one": "Il livello selezionato consente meno argomenti riservati rispetto al livello corrente. Prima di cambiare il livello, <strong> si prega di eliminare almeno una prenotazione</strong>. È possibile rimuovere le prenotazioni nel <Link>Impostazioni</Link>.",
+    "account_upgrade_dialog_reservations_warning_one": "Il livello selezionato consente meno argomenti riservati rispetto al livello corrente. Prima di cambiare il livello, <strong>si prega di eliminare almeno una prenotazione</strong>. È possibile rimuovere le prenotazioni nel <Link>Impostazioni</Link>.",
     "alert_notification_permission_denied_title": "Le notifiche sono bloccate",
     "alert_notification_permission_denied_description": "Per favore riabilitale nel tuo browser",
     "subscribe_dialog_subscribe_use_another_background_info": "Le notifiche dagli altri server non saranno ricevute quando la web app non è in esecuzione",
@@ -403,5 +403,7 @@
     "web_push_subscription_expiring_body": "Apri ntfy per continuare a ricevere notifiche",
     "web_push_unknown_notification_title": "Notifica sconosciuta ricevuta dal server",
     "account_tokens_dialog_expires_x_hours": "Il token scade tra {{hours}} ore",
-    "prefs_reservations_table": "Tabella argomenti riservati"
+    "prefs_reservations_table": "Tabella argomenti riservati",
+    "account_basics_cannot_edit_or_delete_provisioned_user": "Un utente autorizzato non può essere modificato o eliminato",
+    "account_tokens_table_cannot_delete_or_edit_provisioned_token": "Impossibile modificare o eliminare il token fornito"
 }

web/public/static/langs/lt.json

@@ -0,0 +1 @@
+{}

web/public/static/langs/lv.json

@@ -0,0 +1,125 @@
+{
+    "common_cancel": "Atcelt",
+    "common_save": "Saglabāt",
+    "common_add": "Pievienot",
+    "common_back": "Atpakaļ",
+    "signup_form_username": "Lietotājvārds",
+    "signup_form_password": "Parole",
+    "action_bar_settings": "Iestatījumi",
+    "action_bar_account": "Konts",
+    "action_bar_profile_title": "Profils",
+    "action_bar_profile_settings": "Iestatījumi",
+    "action_bar_profile_logout": "Iziet",
+    "nav_button_account": "Konts",
+    "nav_button_settings": "Iestatījumi",
+    "nav_button_documentation": "Dokumentācija",
+    "nav_button_connecting": "savienojas",
+    "notifications_list_item": "Paziņojums",
+    "notifications_delete": "Dzēst",
+    "notifications_tags": "Birkas",
+    "notifications_example": "Piemērs",
+    "publish_dialog_title_label": "Virsraksts",
+    "publish_dialog_message_label": "Ziņojums",
+    "publish_dialog_tags_label": "Birkas",
+    "publish_dialog_priority_label": "Prioritāte",
+    "publish_dialog_email_label": "E-pasta adrese",
+    "publish_dialog_filename_label": "Datnes nosaukums",
+    "publish_dialog_delay_label": "Aizkave",
+    "publish_dialog_button_cancel": "Atcelt",
+    "publish_dialog_button_send": "Sūtīt",
+    "subscribe_dialog_subscribe_button_cancel": "Atcelt",
+    "subscribe_dialog_subscribe_button_subscribe": "Abonēt",
+    "subscribe_dialog_login_password_label": "Parole",
+    "subscribe_dialog_error_user_anonymous": "anonīms lietotājs",
+    "account_basics_title": "Konts",
+    "account_basics_username_title": "Lietotājvārds",
+    "account_basics_password_title": "Parole",
+    "account_basics_phone_numbers_dialog_channel_sms": "Nosūtīt īsziņu",
+    "account_basics_phone_numbers_dialog_channel_call": "Zvanīt",
+    "account_usage_title": "Lietojums",
+    "account_usage_unlimited": "Neierobežots",
+    "account_basics_tier_admin": "Administrators",
+    "account_basics_tier_basic": "Pamata",
+    "account_basics_tier_free": "Bezmaksas",
+    "account_basics_tier_interval_monthly": "ikmēnesi",
+    "account_basics_tier_interval_yearly": "katru gadu",
+    "account_basics_tier_change_button": "Mainīt",
+    "account_delete_dialog_label": "Parole",
+    "account_delete_dialog_button_cancel": "Atcelt",
+    "account_upgrade_dialog_interval_monthly": "Ikmēnesi",
+    "account_upgrade_dialog_interval_yearly": "Katru gadu",
+    "account_upgrade_dialog_tier_price_per_month": "mēnesī",
+    "account_upgrade_dialog_tier_selected_label": "Atlasīts",
+    "account_upgrade_dialog_tier_current_label": "Pašreizējais",
+    "account_upgrade_dialog_button_cancel": "Atcelt",
+    "account_tokens_table_token_header": "Pilnvara",
+    "account_tokens_table_expires_header": "Derīgs līdz",
+    "account_tokens_dialog_button_cancel": "Atcelt",
+    "prefs_notifications_title": "Paziņojumi",
+    "prefs_notifications_delete_after_never": "Nekad",
+    "prefs_notifications_web_push_disabled": "Atspējots",
+    "prefs_users_table_user_header": "Lietotājs",
+    "prefs_users_dialog_password_label": "Parole",
+    "prefs_appearance_title": "Izskats",
+    "prefs_appearance_language_title": "Valoda",
+    "prefs_appearance_theme_title": "Motīvs",
+    "prefs_reservations_table_topic_header": "Tēma",
+    "prefs_reservations_table_access_header": "Piekļuve",
+    "prefs_reservations_dialog_topic_label": "Tēma",
+    "prefs_reservations_dialog_access_label": "Piekļuve",
+    "priority_min": "minimālā",
+    "priority_low": "zema",
+    "priority_default": "noklusējuma",
+    "priority_high": "augsta",
+    "priority_max": "maksimālā",
+    "signup_form_confirm_password": "Atkārtot paroli",
+    "signup_form_button_submit": "Izveidot kontu",
+    "login_link_signup": "Izveidot kontu",
+    "action_bar_show_menu": "Rādīt izvēlni",
+    "action_bar_logo_alt": "ntfy logotips",
+    "action_bar_reservation_add": "Rezervēt tēmu",
+    "action_bar_reservation_edit": "Mainīt rezervāciju",
+    "action_bar_reservation_delete": "Noņemt rezervāciju",
+    "action_bar_reservation_limit_reached": "Sasniegts limits",
+    "action_bar_mute_notifications": "Apklusināt paziņojumus",
+    "action_bar_sign_up": "Izveidot kontu",
+    "message_bar_publish": "Publicēt ziņojumu",
+    "nav_topics_title": "Abonētās tēmas",
+    "nav_button_all_notifications": "Visi paziņojumi",
+    "nav_button_publish_message": "Publicēt paziņojumu",
+    "nav_button_muted": "Paziņojumi apklusināti",
+    "alert_notification_permission_required_button": "Dot tagad",
+    "notifications_list": "Paziņojumu saraksts",
+    "notifications_priority_x": "{{priority}} prioritāte",
+    "notifications_new_indicator": "Jauns paziņojums",
+    "notifications_attachment_image": "Pielikuma attēls",
+    "notifications_attachment_copy_url_button": "Kopēt URL adresi",
+    "notifications_attachment_open_button": "Atvērt pielikumu",
+    "notifications_attachment_file_image": "attēla datne",
+    "notifications_attachment_file_video": "video datne",
+    "notifications_attachment_file_audio": "audio datne",
+    "notifications_attachment_file_document": "cits datnes tips",
+    "notifications_click_copy_url_button": "Kopēt saiti",
+    "notifications_click_open_button": "Atvērt saiti",
+    "notifications_actions_failed_notification": "Neveiksmīga darbība",
+    "publish_dialog_title_no_topic": "Publicēt paziņojumu",
+    "publish_dialog_progress_uploading": "Augšupielādē …",
+    "publish_dialog_message_published": "Paziņojums publicēts",
+    "publish_dialog_emoji_picker_show": "Atlasīt emocijzīmi",
+    "publish_dialog_priority_min": "Minimāla prioritāte",
+    "publish_dialog_priority_low": "Zema prioritāte",
+    "publish_dialog_priority_default": "Noklusējuma prioritāte",
+    "publish_dialog_priority_high": "Augsta prioritāte",
+    "publish_dialog_priority_max": "Maksimāla prioritāte",
+    "publish_dialog_base_url_label": "Pakalpojuma URL adrese",
+    "publish_dialog_topic_label": "Tēmas nosaukums",
+    "publish_dialog_topic_reset": "Atiestatīt tēmu",
+    "publish_dialog_click_label": "Klikšķināma URL adrese",
+    "publish_dialog_call_label": "Tālruņa zvans",
+    "publish_dialog_attach_label": "Pielikuma URL adrese",
+    "publish_dialog_filename_placeholder": "Pielikuma datnes nosaukums",
+    "publish_dialog_other_features": "Citas funkcijas:",
+    "publish_dialog_chip_call_label": "Tālruņa zvans",
+    "publish_dialog_chip_delay_label": "Aizkavēt piegādi",
+    "publish_dialog_chip_topic_label": "Mainīt tēmu"
+}

web/public/static/langs/mk.json

@@ -92,5 +92,9 @@
     "notifications_click_open_button": "Отвори линк",
     "notifications_actions_open_url_title": "Оди на {{url}}",
     "notifications_actions_not_supported": "Дејството не е поддржано во веб-апликацијата",
-    "notifications_actions_http_request_title": "Испрати HTTP {{method}} на {{url}}"
+    "notifications_actions_http_request_title": "Испрати HTTP {{method}} на {{url}}",
+    "notifications_none_for_any_title": "Не сте добиле никакви известувања.",
+    "notifications_actions_failed_notification": "Неуспешно дејство",
+    "notifications_none_for_topic_title": "Сè уште не сте добиле никакви известувања за оваа тема.",
+    "publish_dialog_filename_label": "Име на фајл"
 }

web/public/static/langs/ml.json

@@ -0,0 +1 @@
+{}

web/public/static/langs/pt.json

@@ -2,7 +2,7 @@
     "action_bar_clear_notifications": "Limpar todas as notificações",
     "action_bar_send_test_notification": "Enviar notificação de teste",
     "action_bar_unsubscribe": "Anular subscrição",
-    "action_bar_toggle_mute": "Ativa/Desativa notificações",
+    "action_bar_toggle_mute": "Ativar/Desativar notificações",
     "action_bar_toggle_action_menu": "Abrir/fechar menu de ação",
     "message_bar_type_message": "Escreva uma mensagem aqui",
     "message_bar_error_publishing": "Erro ao publicar notificação",
@@ -70,11 +70,11 @@
     "publish_dialog_topic_label": "Nome do tópico",
     "publish_dialog_topic_placeholder": "Nome do tópico, por exemplo: \"avisos_do_filipe\"",
     "publish_dialog_topic_reset": "Limpar tópico",
-    "publish_dialog_title_placeholder": "Título da notificação, por exemplo: \"Alerta de espaço em disco\"",
+    "publish_dialog_title_placeholder": "Título da notificação, p.ex: \"Alerta de espaço em disco\"",
     "publish_dialog_message_label": "Mensagem",
     "publish_dialog_message_placeholder": "Escreva uma mensagem aqui",
     "publish_dialog_tags_label": "Etiquetas",
-    "publish_dialog_tags_placeholder": "Lista de etiquetas, separadas por vírgula, por exemplo: aviso, srv1-backup",
+    "publish_dialog_tags_placeholder": "Lista de etiquetas separadas por vírgula, p.ex.: aviso, srv1-backup",
     "publish_dialog_priority_label": "Prioridade",
     "publish_dialog_click_label": "URL de clique",
     "publish_dialog_click_placeholder": "URL que é aberto quando a notificação é clicada",
@@ -404,5 +404,7 @@
     "web_push_subscription_expiring_title": "As notificações serão pausadas",
     "web_push_subscription_expiring_body": "Abra o ntfy para continuar recebendo notificações",
     "web_push_unknown_notification_title": "Notificação desconhecida recebida do servidor",
-    "web_push_unknown_notification_body": "Talvez seja necessário atualizar o ntfy abrindo a aplicação da Web"
+    "web_push_unknown_notification_body": "Talvez seja necessário atualizar o ntfy abrindo a aplicação da Web",
+    "account_basics_cannot_edit_or_delete_provisioned_user": "Não se pode editar ou eliminar um usuário predefinido",
+    "account_tokens_table_cannot_delete_or_edit_provisioned_token": "Não se pode editar ou eliminar um token predefinido"
 }

web/public/static/langs/pt_BR.json

@@ -59,11 +59,11 @@
     "publish_dialog_topic_label": "Nome do tópico",
     "publish_dialog_topic_placeholder": "Nome do tópico, por exemplo, phil_alerts",
     "publish_dialog_title_label": "Título",
-    "publish_dialog_title_placeholder": "Título da notificação, por exemplo Alerta de espaço em disco",
+    "publish_dialog_title_placeholder": "Título da notificação, p.ex.: \"Alerta de espaço em disco\"",
     "publish_dialog_message_label": "Mensagem",
     "publish_dialog_message_placeholder": "Digite uma mensagem aqui",
     "publish_dialog_tags_label": "Etiquetas",
-    "publish_dialog_tags_placeholder": "Lista de etiquetas, separadas por vírgula, por exemplo: srv1-backup",
+    "publish_dialog_tags_placeholder": "Lista de etiquetas, separadas por vírgula, p.ex.: aviso, srv1-backup",
     "publish_dialog_priority_label": "Prioridade",
     "publish_dialog_click_label": "Clique em URL",
     "publish_dialog_click_placeholder": "URL que é aberto quando a notificação é clicada",
@@ -112,7 +112,7 @@
     "common_add": "Adicionar",
     "common_save": "Salvar",
     "prefs_appearance_title": "Aparência",
-    "prefs_appearance_language_title": "LInguagem",
+    "prefs_appearance_language_title": "Idioma",
     "priority_min": "minima",
     "priority_low": "baixa",
     "priority_default": "padrão",
@@ -120,7 +120,7 @@
     "priority_max": "máxima",
     "error_boundary_title": "Ah não, ntfy parou de funcionar",
     "error_boundary_gathering_info": "Coletar mais informações …",
-    "error_boundary_description": "Isto obviamente não deveria ter acontecido. Lamentamos muito por isto.<br/>Se tiver um minuto, por favor <githubLink> relate isto no GitHub</githubLink>, ou informe-nos através de <discordLink>Discord</discordLink> ou <matrixLink>Matrix</matrixLink>.",
+    "error_boundary_description": "Isto obviamente não deveria ter acontecido. Lamentamos muito por isso.<br/>Se tiver um minuto, por favor <githubLink>relate isto no GitHub</githubLink>, ou informe-nos através de <discordLink>Discord</discordLink> ou <matrixLink>Matrix</matrixLink>.",
     "error_boundary_button_copy_stack_trace": "Copiar rastreamento de pilha",
     "error_boundary_stack_trace": "Rastreamento de pilha",
     "publish_dialog_attachment_limits_file_and_quota_reached": "excede {{fileSizeLimit}} limite de arquivo e cota, {{remainingBytes}} restante",
@@ -404,5 +404,7 @@
     "web_push_subscription_expiring_title": "As notificações serão pausadas",
     "web_push_subscription_expiring_body": "Abra o ntfy para continuar recebendo notificações",
     "web_push_unknown_notification_title": "Notificação desconhecida recebida do servidor",
-    "web_push_unknown_notification_body": "Talvez seja necessário atualizar o ntfy abrindo o aplicativo da Web"
+    "web_push_unknown_notification_body": "Talvez seja necessário atualizar o ntfy abrindo o aplicativo da Web",
+    "account_basics_cannot_edit_or_delete_provisioned_user": "Um usuário provisionado não pode ser editado ou apagado",
+    "account_tokens_table_cannot_delete_or_edit_provisioned_token": "Não é possível editar ou apagar o token provisionado"
 }

web/public/static/langs/ru.json

@@ -9,7 +9,7 @@
     "notifications_none_for_any_description": "Чтобы отправить уведомление на тему, просто сделаете PUT или POST-запрос на её URL-адрес. Вот пример с использованием одной из ваших тем.",
     "notifications_no_subscriptions_title": "Похоже, что у вас ещё нет подписок.",
     "alert_notification_permission_required_description": "Предоставьте браузеру разрешение на отображение уведомлений на рабочем столе",
-    "notifications_no_subscriptions_description": "Нажмите на ссылку \"{{linktext}}\", чтобы создать или подписаться на тему. После этого Вы сможете отправлять сообщения используя PUT или POST-запросы и получать уведомления здесь.",
+    "notifications_no_subscriptions_description": "Нажмите на ссылку \"{{linktext}}\", чтобы создать или подписаться на тему. После этого вы сможете отправлять сообщения используя PUT или POST-запросы и получать уведомления здесь.",
     "notifications_example": "Пример",
     "notifications_more_details": "Для более подробной информации, посетите <websiteLink>наш сайт</websiteLink> или <docsLink>документацию</docsLink>.",
     "notifications_loading": "Идет загрузка уведомлений …",
@@ -66,9 +66,9 @@
     "notifications_click_open_button": "Открыть ссылку",
     "subscribe_dialog_subscribe_title": "Подписаться на тему",
     "publish_dialog_button_cancel": "Отмена",
-    "subscribe_dialog_subscribe_description": "Темы могут быть не защищены паролем, поэтому укажите сложное имя. После подписки Вы сможете отправлять уведомления используя PUT/POST-запросы.",
+    "subscribe_dialog_subscribe_description": "Темы могут быть не защищены паролем, поэтому укажите сложное имя. После подписки вы сможете отправлять уведомления используя PUT/POST-запросы.",
     "prefs_users_description": "Вы можете управлять пользователями для защищённых тем. Учтите, что имя учётные данные хранятся в локальном хранилище браузера.",
-    "error_boundary_description": "Это не должно было случиться. Нам очень жаль. <br/>Если Вы можете уделить минуту своего времени, пожалуйста <githubLink>сообщите об этом на GitHub</githubLink>, или дайте нам знать через <discordLink>Discord</discordLink> или <matrixLink>Matrix</matrixLink>.",
+    "error_boundary_description": "Это не должно было случиться. Нам очень жаль. <br/>Если вы можете уделить минуту своего времени, пожалуйста <githubLink>сообщите об этом на GitHub</githubLink>, или дайте нам знать через <discordLink>Discord</discordLink> или <matrixLink>Matrix</matrixLink>.",
     "publish_dialog_email_placeholder": "Адрес для пересылки уведомления. Например, phil@example.com",
     "publish_dialog_attach_placeholder": "Прикрепите файл по URL. Например, https://f-droid.org/F-Droid.apk",
     "publish_dialog_filename_label": "Имя файла",
@@ -155,19 +155,19 @@
     "action_bar_show_menu": "Показать меню",
     "action_bar_logo_alt": "Логотип ntfy",
     "emoji_picker_search_clear": "Сбросить поиск",
-    "account_upgrade_dialog_cancel_warning": "Это действие <strong>отменит Вашу подписку</strong> и переведет Вашую учетную запись на бесплатное обслуживание {{date}}. При наступлении этой даты, все резервирования и сообщения в кэше <strong>будут удалены</strong>.",
+    "account_upgrade_dialog_cancel_warning": "Это действие <strong>отменит вашу подписку</strong> и переведет вашую учетную запись на бесплатное обслуживание {{date}}. При наступлении этой даты, все резервирования и сообщения в кэше <strong>будут удалены</strong>.",
     "account_tokens_table_create_token_button": "Создать токен доступа",
     "account_tokens_table_last_origin_tooltip": "С IP-адреса {{ip}}, нажмите для подробностей",
     "account_tokens_dialog_title_edit": "Изменить токен доступа",
     "account_delete_dialog_button_cancel": "Отмена",
-    "account_delete_dialog_billing_warning": "Удаление учетной записи также отменяет все платные подписки. У Вас не будет доступа к порталу оплаты.",
+    "account_delete_dialog_billing_warning": "Удаление учетной записи также отменяет все платные подписки. У вас не будет доступа к порталу оплаты.",
     "account_delete_dialog_description": "Это действие безвозвратно удалит вашу учётную запись, включая все данные, хранящиеся на сервере. После удаления имя пользователя вашей учётной записи не будет доступно для регистрации в течение 7 дней. Если вы точно хотите продолжить, пожалуйста, введите свой пароль ниже.",
     "account_delete_dialog_label": "Пароль",
     "reservation_delete_dialog_action_keep_description": "Сообщения и вложения которые находятся в кэше сервера станут доступны всем, кто знает имя темы.",
     "prefs_reservations_table": "Список зарезервированных тем",
     "prefs_reservations_table_access_header": "Доступ",
     "prefs_reservations_table_everyone_write_only": "Я могу публиковать и подписываться, все остальные могут публиковать",
-    "prefs_reservations_dialog_description": "Резервирование дает Вам возможность управлять темой и настраивать правила доступа к ней для пользователей.",
+    "prefs_reservations_dialog_description": "Резервирование дает вам возможность управлять темой и настраивать правила доступа к ней для пользователей.",
     "reservation_delete_dialog_action_delete_title": "Удалить сообщения в кэше и вложения",
     "reservation_delete_dialog_action_delete_description": "Сообщения в кэше и вложения будут безвозвратно удалены. Это действие невозможно отменить.",
     "prefs_reservations_table_not_subscribed": "Не подписан",
@@ -178,10 +178,10 @@
     "prefs_reservations_dialog_title_delete": "Удалить резервирование",
     "prefs_reservations_dialog_title_edit": "Изменение резервированной темы",
     "prefs_reservations_table_topic_header": "Тема",
-    "prefs_users_description_no_sync": "Пользователи и пароли не синхронизируются с Вашей учетной записью.",
+    "prefs_users_description_no_sync": "Пользователи и пароли не синхронизируются с вашей учетной записью.",
     "prefs_users_delete_button": "Удалить пользователя",
     "prefs_users_table_cannot_delete_or_edit": "Невозможно удалить или редактировать залогиненного пользователя",
-    "account_upgrade_dialog_reservations_warning_one": "Выбранная подписка разрешает меньше зарезервированных тем, чем есть у Вас на данный момент. Перед сменой подписки, <strong>пожалуйста удалите хотя бы одну зарезервированную тему</strong>. Вы можете это сделать в <Link>Настройках</Link>.",
+    "account_upgrade_dialog_reservations_warning_one": "Выбранная подписка разрешает меньше зарезервированных тем, чем есть у вас на данный момент. Перед сменой подписки, <strong>пожалуйста удалите хотя бы одну зарезервированную тему</strong>. Вы можете это сделать в <Link>Настройках</Link>.",
     "account_upgrade_dialog_proration_info": "<strong>Пересчёт оплаты</strong>: при расширении подписки, разница в цене от текущей <strong>спишется сразу</strong>. При упрощении подписки, неиспользованные средства пойдут в оплату баланса по следующим счетам.",
     "account_upgrade_dialog_tier_features_attachment_file_size": "{{filesize}} на файл",
     "account_tokens_table_never_expires": "Никогда",
@@ -191,7 +191,7 @@
     "error_boundary_unsupported_indexeddb_title": "Работа в приватном режиме не поддерживается",
     "account_tokens_dialog_button_create": "Создать токен",
     "account_tokens_delete_dialog_submit_button": "Безвозвратно удалить токен",
-    "account_upgrade_dialog_reservations_warning_other": "Выбранная подписка разрешает меньше зарезервированных тем, чем есть у Вас на данный момент. Перед сменой подписки, <strong>пожалуйста удалите хотя бы {{count}} зарезервированных тем</strong>. Вы можете это сделать в <Link>Настройках</Link>.",
+    "account_upgrade_dialog_reservations_warning_other": "Выбранная подписка разрешает меньше зарезервированных тем, чем есть у вас на данный момент. Перед сменой подписки, <strong>пожалуйста удалите хотя бы {{count}} зарезервированных тем</strong>. Вы можете это сделать в <Link>Настройках</Link>.",
     "account_upgrade_dialog_tier_features_messages_other": "{{messages}} сообщений в день",
     "account_upgrade_dialog_tier_features_attachment_total_size": "{{totalsize}} суммарный объем",
     "account_upgrade_dialog_tier_selected_label": "Выбранная",
@@ -268,7 +268,7 @@
     "notifications_attachment_file_document": "другой тип файла",
     "notifications_actions_not_supported": "Действие не поддерживается в веб-приложении",
     "display_name_dialog_title": "Изменить псевдоним",
-    "display_name_dialog_description": "Создайте псевдоним для темы, который будет отображаться в списке Ваших подписок. Это помогает легче находить темы со сложными именами.",
+    "display_name_dialog_description": "Создайте псевдоним для темы, который будет отображаться в списке ваших подписок. Это помогает легче находить темы со сложными именами.",
     "reserve_dialog_checkbox_label": "Зарезервировать тему и настроить доступ",
     "publish_dialog_emoji_picker_show": "Выбрать смайлик",
     "publish_dialog_click_reset": "Удалить ссылку",
@@ -312,7 +312,7 @@
     "account_upgrade_dialog_button_cancel_subscription": "Отменить подписку",
     "account_upgrade_dialog_button_update_subscription": "Изменить подписку",
     "account_tokens_title": "Токены доступа",
-    "account_tokens_description": "Используйте токены доступа для публикации и подписки через ntfy API чтобы не пересылать данные Вашей учетной записи. Смотрите <Link>документацию</Link> чтобы узнать больше.",
+    "account_tokens_description": "Используйте токены доступа для публикации и подписки через ntfy API чтобы не пересылать данные вашей учетной записи. Смотрите <Link>документацию</Link> чтобы узнать больше.",
     "account_tokens_table_token_header": "Токен",
     "account_tokens_table_label_header": "Название",
     "account_tokens_table_last_access_header": "Последний доступ",
@@ -340,7 +340,7 @@
     "account_basics_password_dialog_confirm_password_label": "Подтвердите пароль",
     "account_basics_password_dialog_button_submit": "Сменить пароль",
     "account_basics_tier_title": "Тип учётной записи",
-    "error_boundary_unsupported_indexeddb_description": "Веб-приложение ntfy использует IndexedDB, который не поддерживается Вашим браузером в приватном режиме.<br/><br/>Хотя это и не лучший вариант, использовать веб-приложение ntfy в приватном режиме не имеет особого смысла, так как все данные храняться в локальном хранилище браузера. Вы можете узнать больше в <githubLink>этом отчете на GitHub</githubLink> или связавшись с нами через <discordLink>Discord</discordLink> или <matrixLink>Matrix</matrixLink>.",
+    "error_boundary_unsupported_indexeddb_description": "Веб-приложение ntfy использует IndexedDB, который не поддерживается вашим браузером в приватном режиме.<br/><br/>Хотя это и не лучший вариант, использовать веб-приложение ntfy в приватном режиме не имеет особого смысла, так как все данные храняться в локальном хранилище браузера. Вы можете узнать больше в <githubLink>этом отчете на GitHub</githubLink> или связавшись с нами через <discordLink>Discord</discordLink> или <matrixLink>Matrix</matrixLink>.",
     "account_basics_tier_interval_monthly": "ежемесячно",
     "account_basics_tier_interval_yearly": "ежегодно",
     "account_upgrade_dialog_interval_yearly": "Ежегодно",

web/public/static/langs/sl.json

@@ -0,0 +1,116 @@
+{
+    "common_cancel": "Prekliči",
+    "common_save": "Shrani",
+    "common_add": "Dodaj",
+    "common_back": "Nazaj",
+    "common_copy_to_clipboard": "Kopiraj v odložišče",
+    "signup_title": "Ustvari ntfy račun",
+    "signup_form_username": "Uporabniško ime",
+    "signup_form_password": "Geslo",
+    "signup_form_confirm_password": "Potrditev gesla",
+    "signup_form_button_submit": "Registracija",
+    "signup_form_toggle_password_visibility": "Prikaži geslo",
+    "signup_already_have_account": "Že imate račun? Prijavite se!",
+    "signup_disabled": "Registracija je onemogočena",
+    "signup_error_username_taken": "Uporabniško ime {{username}} je zasedeno",
+    "signup_error_creation_limit_reached": "Omejitev registracije novih računov je presežena",
+    "login_title": "Prijava v vaš ntfy račun",
+    "login_form_button_submit": "Prijava",
+    "login_link_signup": "Registracija",
+    "login_disabled": "Prijava je onemogočena",
+    "action_bar_show_menu": "Prikaži menu",
+    "action_bar_logo_alt": "ntfy logotip",
+    "action_bar_settings": "Nastavitve",
+    "action_bar_account": "Račun",
+    "action_bar_change_display_name": "Spremenite prikazno ime",
+    "action_bar_reservation_add": "Rezerviraj temo",
+    "action_bar_reservation_edit": "Spremenite rezervacijo",
+    "action_bar_reservation_delete": "Odstranite rezervacijo",
+    "action_bar_reservation_limit_reached": "Omejitev dosežena",
+    "action_bar_send_test_notification": "Pošljite testno obvestilo",
+    "action_bar_clear_notifications": "Počistite vsa obvestila",
+    "action_bar_mute_notifications": "Izklopite zvok obvestil",
+    "action_bar_unmute_notifications": "Vklopite zvok obvestil",
+    "action_bar_unsubscribe": "Odjava",
+    "action_bar_toggle_mute": "Vklopite/izklopite zvok obvestil",
+    "action_bar_toggle_action_menu": "Odprite/zaprite akcijski menu",
+    "action_bar_profile_title": "Profil",
+    "action_bar_profile_settings": "Nastavitve",
+    "action_bar_profile_logout": "Odjavite se",
+    "action_bar_sign_in": "Prijavite se",
+    "action_bar_sign_up": "Registrirajte se",
+    "message_bar_type_message": "Vpišite sporočilo",
+    "message_bar_error_publishing": "Napaka pri objavi obvestila",
+    "message_bar_show_dialog": "Prikaži pogovorno okno za objavo",
+    "message_bar_publish": "Objavi sporočilo",
+    "nav_topics_title": "Naročene teme",
+    "nav_button_all_notifications": "Vsa obvestila",
+    "nav_button_account": "Račun",
+    "nav_button_settings": "Nastavitve",
+    "nav_button_documentation": "Dokumentacija",
+    "nav_button_publish_message": "Objavi obvestilo",
+    "publish_dialog_title_no_topic": "Objavi obvestilo",
+    "publish_dialog_progress_uploading": "Nalaganje …",
+    "publish_dialog_progress_uploading_detail": "Nalaganje {{loaded}}/{{total}} ({{percent}}%) …",
+    "publish_dialog_message_published": "Obvestilo objavljeno",
+    "publish_dialog_attachment_limits_file_and_quota_reached": "presega {{fileSizeLimit}} omejitev velikosti datoteke in kvote, {{remainingBytes}} še preostalo",
+    "publish_dialog_attachment_limits_file_reached": "presega {{fileSizeLimit}} omejitev velikosti datoteke",
+    "publish_dialog_attachment_limits_quota_reached": "presega kvoto, {{remainingBytes}} še preostalo",
+    "publish_dialog_emoji_picker_show": "Izberite emoji",
+    "publish_dialog_priority_min": "Najnižja prioriteta",
+    "publish_dialog_priority_low": "Nizka prioriteta",
+    "publish_dialog_priority_default": "Privzeta prioriteta",
+    "publish_dialog_priority_high": "Visoka prioriteta",
+    "publish_dialog_priority_max": "Najvišja prioriteta",
+    "publish_dialog_base_url_label": "URL storitve",
+    "publish_dialog_base_url_placeholder": "URL storitve, npr. https://example.com",
+    "publish_dialog_topic_label": "Naziv teme",
+    "publish_dialog_topic_placeholder": "Naziv teme, npr. janez_alarmi",
+    "publish_dialog_topic_reset": "Ponastavitev temo",
+    "publish_dialog_title_label": "Naslov",
+    "publish_dialog_title_placeholder": "Naslov obvestila, npr. Primanjkuje prostora",
+    "publish_dialog_message_label": "Sporočilo",
+    "publish_dialog_message_placeholder": "Vpišite sporočilo",
+    "publish_dialog_tags_label": "Značke",
+    "publish_dialog_tags_placeholder": "Z vejico ločen seznam značk, npr. opozorilo, srv1-kopija",
+    "publish_dialog_priority_label": "Prioriteta",
+    "publish_dialog_click_label": "URL za klik",
+    "publish_dialog_click_placeholder": "URL ki se odpre, ko kliknete na obvestilo",
+    "publish_dialog_click_reset": "Odstranite URL za klik",
+    "publish_dialog_email_label": "E-naslov",
+    "publish_dialog_email_placeholder": "E-naslov za posredovanje obvestil, npr. janez@example.com",
+    "publish_dialog_email_reset": "Odstranite e-naslov za posredovanje",
+    "publish_dialog_call_label": "Telefonski klic",
+    "publish_dialog_call_item": "Pokličite telefonsko številko {{number}}",
+    "publish_dialog_call_reset": "Odstranite telefonski klic",
+    "publish_dialog_attach_label": "URL priponke",
+    "publish_dialog_attach_placeholder": "Pripnite datoteko preko URL povezave, npr. https://f-droid.org/F-Droid.apk",
+    "publish_dialog_attach_reset": "Odstranite URL priponke",
+    "publish_dialog_filename_label": "Ime datoteke",
+    "publish_dialog_filename_placeholder": "Ime priponke",
+    "publish_dialog_delay_label": "Zamik",
+    "publish_dialog_delay_placeholder": "Zamik dostave, npr. {{unixTimestamp}}, {{relativeTime}}, ali \"{{naturalLanguage}}\" (v angleškem jeziku)",
+    "publish_dialog_delay_reset": "Odstranite zamik dostave",
+    "publish_dialog_other_features": "Ostale funkcije:",
+    "publish_dialog_chip_click_label": "URL za klik",
+    "publish_dialog_chip_email_label": "Posredujte na e-naslov",
+    "publish_dialog_chip_call_label": "Telefonski klic",
+    "publish_dialog_chip_call_no_verified_numbers_tooltip": "Ni verificiranih telefonskih številk",
+    "publish_dialog_chip_attach_url_label": "Pripnite datoteko preko URL",
+    "publish_dialog_chip_attach_file_label": "Pripnite lokalno datoteko",
+    "publish_dialog_chip_delay_label": "Zamik dostave",
+    "publish_dialog_chip_topic_label": "Spremenite temo",
+    "publish_dialog_details_examples_description": "Za vzorčne primere in natančnejše opise vseh funkcij pošiljanja se posvetujte z <docsLink>dokumentacijo</docsLink>.",
+    "publish_dialog_button_cancel_sending": "Prekličite pošiljanje",
+    "publish_dialog_button_cancel": "Prekliči",
+    "publish_dialog_button_send": "Pošlji",
+    "publish_dialog_checkbox_markdown": "Oblikovanje kot Markdown",
+    "publish_dialog_checkbox_publish_another": "Objavite še eno",
+    "publish_dialog_attached_file_title": "Priponka:",
+    "publish_dialog_attached_file_filename_placeholder": "Ime priponke",
+    "publish_dialog_attached_file_remove": "Odstranite priponko",
+    "publish_dialog_drop_file_here": "Povleci in spusti",
+    "emoji_picker_search_placeholder": "Išči emoji",
+    "emoji_picker_search_clear": "Ponastavi iskanje",
+    "subscribe_dialog_subscribe_title": "Naročite se na temo"
+}

web/public/static/langs/uk.json

@@ -11,7 +11,7 @@
     "nav_button_muted": "Сповіщення вимкнено",
     "nav_button_connecting": "підключення",
     "alert_notification_permission_required_title": "Сповіщення вимкнено",
-    "alert_notification_permission_required_description": "Дозвольте браузеру показувати сповіщення.",
+    "alert_notification_permission_required_description": "Дозвольте браузеру показувати сповіщення на робочому столі",
     "alert_notification_permission_required_button": "Дозволити",
     "alert_not_supported_title": "Сповіщення не підтримуються",
     "notifications_list_item": "Сповіщення",
@@ -34,11 +34,11 @@
     "publish_dialog_topic_placeholder": "Назва теми, наприклад phil_alerts",
     "publish_dialog_topic_reset": "Скинути тему",
     "publish_dialog_title_label": "Заголовок",
-    "publish_dialog_title_placeholder": "Заголовок сповіщення, наприклад Сповіщення про дисковий простір",
+    "publish_dialog_title_placeholder": "Заголовок сповіщення, наприклад, Попередження про недостатньо місця на диску",
     "publish_dialog_message_label": "Повідомлення",
     "publish_dialog_message_placeholder": "Введіть повідомлення",
     "publish_dialog_tags_label": "Теги",
-    "publish_dialog_tags_placeholder": "Список тегів розділений комою, наприклад warning, srv1-backup",
+    "publish_dialog_tags_placeholder": "Список тегів розділений комою, наприклад, warning, srv1-backup",
     "publish_dialog_click_placeholder": "URL-адреса, яка відкривається після натискання сповіщення",
     "publish_dialog_email_label": "Електронна пошта",
     "publish_dialog_attach_placeholder": "Прикріпіть файл за URL-адресою, наприклад https://f-droid.org/F-Droid.apk",
@@ -300,7 +300,7 @@
     "account_upgrade_dialog_tier_features_attachment_total_size": "{{totalsize}} загальне сховище",
     "account_upgrade_dialog_tier_current_label": "Поточний",
     "account_upgrade_dialog_tier_selected_label": "Вибране",
-    "account_upgrade_dialog_cancel_warning": "Це <strong> скасує вашу підписку</strong> і знизить версію вашого облікового запису {{date}}. У цю дату резервування тем, а також повідомлення, кешовані на сервері <strong>, буде видалено</strong>.",
+    "account_upgrade_dialog_cancel_warning": "Ця дія <strong>скасує вашу підписку</strong>, і знизить версію вашого облікового запису {{date}}. Відповідно, в цю дату, резервування тем, а також повідомлення, кешовані на сервері, <strong>буде видалено</strong>.",
     "account_upgrade_dialog_tier_features_reservations_other": "{{reservations}} зарезервовані теми",
     "account_upgrade_dialog_tier_features_no_reservations": "Немає зарезервованих тем",
     "account_upgrade_dialog_tier_features_messages_other": "{{messages}} повідомлень в день",
@@ -397,12 +397,14 @@
     "prefs_notifications_web_push_disabled_description": "Сповіщення надходитимуть якщо вебзастосунок запущений (за допомоги WebSocket)",
     "prefs_notifications_web_push_enabled": "Увімкнено для {{server}}",
     "prefs_notifications_web_push_disabled": "Вимкнено",
-    "prefs_appearance_theme_title": "Тема",
+    "prefs_appearance_theme_title": "Тема оформлення",
     "prefs_appearance_theme_system": "Система (за замовчуванням)",
     "prefs_appearance_theme_light": "Світлий режим",
     "error_boundary_button_reload_ntfy": "Перезавантажити ntfy",
     "web_push_subscription_expiring_title": "Сповіщення буде призупинено",
     "web_push_subscription_expiring_body": "Відкрийте ntfy, щоб продовжити отримувати сповіщення",
     "web_push_unknown_notification_body": "Можливо вам потрібно оновити ntfy шляхом відкриття вебзастосунку",
-    "alert_notification_ios_install_required_title": "потрібно встановити на iOS"
+    "alert_notification_ios_install_required_title": "Необхідне встановлення на iOS",
+    "account_basics_cannot_edit_or_delete_provisioned_user": "Автоматично створеного користувача не можна редагувати чи видалити",
+    "account_tokens_table_cannot_delete_or_edit_provisioned_token": "Автоматично створений токен не можна редагувати чи видалити"
 }

web/public/static/langs/zh_Hans.json

@@ -115,8 +115,8 @@
     "subscribe_dialog_error_user_anonymous": "匿名",
     "prefs_notifications_title": "通知",
     "prefs_notifications_sound_title": "通知提示音",
-    "prefs_notifications_sound_description_none": "收到通知时不播放任何声音",
-    "prefs_notifications_sound_description_some": "收到通知时播放 {{sound}} 声音",
+    "prefs_notifications_sound_description_none": "收到通知时不播放任何提示音",
+    "prefs_notifications_sound_description_some": "收到通知时播放 {{sound}} 提示音",
     "prefs_notifications_sound_no_sound": "静音",
     "prefs_notifications_sound_play": "播放选中声音",
     "prefs_notifications_min_priority_title": "最低优先级",
@@ -152,9 +152,9 @@
     "prefs_appearance_title": "外观",
     "prefs_appearance_language_title": "语言",
     "prefs_appearance_theme_title": "主題",
-    "prefs_appearance_theme_system": "系統 (預設)",
-    "prefs_appearance_theme_dark": "黑暗模式",
-    "prefs_appearance_theme_light": "光亮模式",
+    "prefs_appearance_theme_system": "系统 (默认)",
+    "prefs_appearance_theme_dark": "深色模式",
+    "prefs_appearance_theme_light": "浅色模式",
     "priority_min": "最低",
     "priority_low": "低",
     "priority_default": "默认",

web/public/static/langs/zh_Hant.json

@@ -1,34 +1,34 @@
 {
-    "account_basics_password_description": "更改你的帳戶密碼",
-    "account_basics_password_dialog_button_submit": "更改密碼",
+    "account_basics_password_description": "變更帳戶密碼",
+    "account_basics_password_dialog_button_submit": "變更密碼",
     "account_basics_password_dialog_confirm_password_label": "確認密碼",
     "account_basics_password_dialog_current_password_incorrect": "密碼錯誤",
-    "account_basics_password_dialog_current_password_label": "當前密碼",
+    "account_basics_password_dialog_current_password_label": "目前密碼",
     "account_basics_password_dialog_new_password_label": "新密碼",
-    "account_basics_password_dialog_title": "更改密碼",
+    "account_basics_password_dialog_title": "變更密碼",
     "account_basics_password_title": "密碼",
-    "account_basics_phone_numbers_copied_to_clipboard": "電話號碼已複製到剪貼板",
+    "account_basics_phone_numbers_copied_to_clipboard": "電話號碼已複製到剪貼簿",
     "account_basics_phone_numbers_description": "電話通知",
     "account_basics_phone_numbers_dialog_channel_call": "撥打",
-    "account_basics_phone_numbers_dialog_channel_sms": "短信",
+    "account_basics_phone_numbers_dialog_channel_sms": "簡訊",
     "account_basics_phone_numbers_dialog_check_verification_button": "確認碼",
     "account_basics_phone_numbers_dialog_code_label": "驗證碼",
     "account_basics_phone_numbers_dialog_code_placeholder": "例如：123456",
-    "account_basics_phone_numbers_dialog_description": "要使用來電通知功能，你需要新增並驗證至少一個電話號碼。可以通過短信或電話驗證。",
+    "account_basics_phone_numbers_dialog_description": "若要使用來電通知功能，請先新增並驗證至少一個電話號碼。你可以透過簡訊或電話完成驗證。",
     "account_basics_phone_numbers_dialog_number_label": "電話號碼",
     "account_basics_phone_numbers_dialog_number_placeholder": "例如：+1222333444",
     "account_basics_phone_numbers_dialog_title": "新增電話號碼",
     "account_basics_phone_numbers_dialog_verify_button_call": "撥打電話",
-    "account_basics_phone_numbers_dialog_verify_button_sms": "發送資訊",
-    "account_basics_phone_numbers_no_phone_numbers_yet": "無可執行的電話號碼",
+    "account_basics_phone_numbers_dialog_verify_button_sms": "傳送簡訊",
+    "account_basics_phone_numbers_no_phone_numbers_yet": "尚無電話號碼",
     "account_basics_phone_numbers_title": "電話號碼",
     "account_basics_tier_admin_suffix_no_tier": "（無等級）",
     "account_basics_tier_admin_suffix_with_tier": "（有 {{tier}} 等級）",
     "account_basics_tier_admin": "管理員",
     "account_basics_tier_basic": "基礎版",
     "account_basics_tier_canceled_subscription": "你的訂閱已取消，並將在 {{date}} 降級為免費帳戶。",
-    "account_basics_tier_change_button": "改變",
-    "account_basics_tier_description": "你帳戶的權限級別",
+    "account_basics_tier_change_button": "變更",
+    "account_basics_tier_description": "你的帳戶權限等級",
     "account_basics_tier_free": "免費",
     "account_basics_tier_interval_monthly": "每月",
     "account_basics_tier_interval_yearly": "每年",
@@ -40,149 +40,149 @@
     "account_basics_title": "帳戶",
     "account_basics_username_admin_tooltip": "你是管理員",
     "account_basics_username_description": "嘿，那是你 ❤",
-    "account_basics_username_title": "用戶名",
+    "account_basics_username_title": "使用者名稱",
     "account_delete_description": "永久刪除你的帳戶",
-    "account_delete_dialog_billing_warning": "刪除你的帳戶也會立即取消你的計費訂閱。你將無法再訪問計費儀錶板。",
+    "account_delete_dialog_billing_warning": "刪除你的帳戶也會立即取消你的計費訂閱。你將無法再存取計費儀錶板。",
     "account_delete_dialog_button_cancel": "取消",
     "account_delete_dialog_button_submit": "永久刪除帳戶",
-    "account_delete_dialog_description": "這將永久刪除你的帳戶，包括存儲在伺服器上的所有數據。刪除後，你的用戶名將在 7 天內不可用。如果你真的想繼續，請在下面的框中使用你的密碼作確認。",
+    "account_delete_dialog_description": "這將永久刪除你的帳戶，包括儲存在伺服器上的所有資料。刪除後，你的使用者名稱將在 7 天內不可用。如果你真的想繼續，請在下面的框中使用你的密碼作確認。",
     "account_delete_dialog_label": "密碼",
     "account_delete_title": "刪除帳戶",
-    "account_tokens_delete_dialog_description": "在刪除訪問令牌之前，請確保沒有應用程序或腳本正在活躍使用它。 <strong>此操作無法撤銷</strong>。",
-    "account_tokens_delete_dialog_submit_button": "永久删除令牌",
-    "account_tokens_delete_dialog_title": "刪除訪問令牌",
-    "account_tokens_description": "通過 ntfy API 發布和訂閱時使用訪問令牌，因此你不必發送你的帳戶憑證。查看<Link>文檔</Link>以了解更多資訊。",
+    "account_tokens_delete_dialog_description": "在刪除存取權杖之前，請確認沒有應用程式或指令碼正在使用此權杖。<strong>此操作無法復原</strong>。",
+    "account_tokens_delete_dialog_submit_button": "永久刪除權杖",
+    "account_tokens_delete_dialog_title": "刪除存取權杖",
+    "account_tokens_description": "透過 ntfy API 發布和訂閱時，請使用存取權杖，這樣就不必傳送你的帳戶憑證。請參閱<Link>說明</Link>以瞭解更多資訊。",
     "account_tokens_dialog_button_cancel": "取消",
-    "account_tokens_dialog_button_create": "創建令牌",
-    "account_tokens_dialog_button_update": "更新令牌",
-    "account_tokens_dialog_expires_label": "訪問令牌過期於",
-    "account_tokens_dialog_expires_never": "令牌永不過期",
+    "account_tokens_dialog_button_create": "建立權杖",
+    "account_tokens_dialog_button_update": "更新權杖",
+    "account_tokens_dialog_expires_label": "存取權杖到期時間",
+    "account_tokens_dialog_expires_never": "權杖永不過期",
     "account_tokens_dialog_expires_unchanged": "保持過期日期不變",
-    "account_tokens_dialog_expires_x_days": "令牌在 {{days}} 天後過期",
-    "account_tokens_dialog_expires_x_hours": "令牌在 {{hours}} 小時後過期",
+    "account_tokens_dialog_expires_x_days": "權杖將在 {{days}} 天後到期",
+    "account_tokens_dialog_expires_x_hours": "權杖將在 {{hours}} 小時後到期",
     "account_tokens_dialog_label": "標籤，例如：Radarr 通知",
-    "account_tokens_dialog_title_create": "創建訪問令牌",
-    "account_tokens_dialog_title_delete": "刪除訪問令牌",
-    "account_tokens_dialog_title_edit": "編輯訪問令牌",
-    "account_tokens_table_cannot_delete_or_edit": "無法編輯或刪除當前會話令牌",
-    "account_tokens_table_copied_to_clipboard": "已複製訪問令牌",
-    "account_tokens_table_create_token_button": "創建訪問令牌",
-    "account_tokens_table_current_session": "當前瀏覽器會話",
+    "account_tokens_dialog_title_create": "建立存取權杖",
+    "account_tokens_dialog_title_delete": "刪除存取權杖",
+    "account_tokens_dialog_title_edit": "編輯存取權杖",
+    "account_tokens_table_cannot_delete_or_edit": "無法編輯或刪除目前的工作階段權杖",
+    "account_tokens_table_copied_to_clipboard": "已複製存取權杖",
+    "account_tokens_table_create_token_button": "建立存取權杖",
+    "account_tokens_table_current_session": "目前的瀏覽器工作階段",
     "account_tokens_table_expires_header": "過期",
     "account_tokens_table_label_header": "標籤",
-    "account_tokens_table_last_access_header": "最後訪問",
-    "account_tokens_table_last_origin_tooltip": "於IP地址 {{ip}}，點擊查找",
+    "account_tokens_table_last_access_header": "最後存取",
+    "account_tokens_table_last_origin_tooltip": "來自 IP 位址 {{ip}}，點選即可查詢",
     "account_tokens_table_never_expires": "永不過期",
-    "account_tokens_table_token_header": "令牌",
-    "account_tokens_title": "訪問令牌",
-    "account_upgrade_dialog_billing_contact_email": "有關賬單問題，請直接<Link>聯繫我們 </Link>。",
-    "account_upgrade_dialog_billing_contact_website": "有關賬單問題，請參考我們的<Link>網站 </Link>。",
+    "account_tokens_table_token_header": "權杖",
+    "account_tokens_title": "存取權杖",
+    "account_upgrade_dialog_billing_contact_email": "如有帳單問題，請直接<Link>聯絡我們</Link>。",
+    "account_upgrade_dialog_billing_contact_website": "如有帳單問題，請參考我們的<Link>網站</Link>。",
     "account_upgrade_dialog_button_cancel_subscription": "取消訂閱",
     "account_upgrade_dialog_button_cancel": "取消",
     "account_upgrade_dialog_button_pay_now": "立即付款並訂閱",
     "account_upgrade_dialog_button_redirect_signup": "立即註冊",
     "account_upgrade_dialog_button_update_subscription": "更新訂閱",
-    "account_upgrade_dialog_cancel_warning": "這將<strong>取消你的訂閱</strong>，並在 {{date}} 降級你的帳戶。在那一天，主題保留以及緩存在伺服器上的訊息<strong>將被刪除</strong>。",
+    "account_upgrade_dialog_cancel_warning": "這將<strong>取消你的訂閱</strong>，並在 {{date}} 降級你的帳戶。在那一天，主題保留以及快取在伺服器上的訊息<strong>將被刪除</strong>。",
     "account_upgrade_dialog_interval_monthly": "每月",
     "account_upgrade_dialog_interval_yearly_discount_save_up_to": "節省高達 {{discount}}%",
     "account_upgrade_dialog_interval_yearly_discount_save": "節省 {{discount}}%",
     "account_upgrade_dialog_interval_yearly": "每年",
-    "account_upgrade_dialog_proration_info": "<strong>按比例分配</strong>：在付費計劃之間升級時，差價將被<strong>立刻收取</strong>。在降級到較低級別時，餘額將被用於支付未來的賬單周期。",
-    "account_upgrade_dialog_reservations_warning_one": "所選等級允許的保留主題少於當前等級。在更改你的等級之前，<strong>請至少刪除 1 項保留</strong>。你可以在<Link>設置</Link>中刪除保留。",
-    "account_upgrade_dialog_reservations_warning_other": "所選等級允許的保留主題少於當前等級。在更改你的等級之前，<strong>請至少刪除 {{count}} 項保留</strong>。你可以在<Link>設置</Link>中刪除保留。",
-    "account_upgrade_dialog_tier_current_label": "當前",
-    "account_upgrade_dialog_tier_features_attachment_file_size": "每個文件 {{filesize}}",
-    "account_upgrade_dialog_tier_features_attachment_total_size": "{{totalsize}} 總存儲空間",
-    "account_upgrade_dialog_tier_features_calls_one": "每日一通電話",
-    "account_upgrade_dialog_tier_features_calls_other": "每日{{calls}} 通電話",
-    "account_upgrade_dialog_tier_features_emails_one": "每日一封郵件",
-    "account_upgrade_dialog_tier_features_emails_other": "每日 {{emails}} 條郵件",
-    "account_upgrade_dialog_tier_features_messages_one": "每日一條訊息",
-    "account_upgrade_dialog_tier_features_messages_other": "每日 {{messages}} 條訊息",
+    "account_upgrade_dialog_proration_info": "<strong>按比例計費</strong>：升級到其他付費方案時，系統會<strong>立即收取</strong>差價。降級到較低等級時，餘額會用於支付未來的帳單週期。",
+    "account_upgrade_dialog_reservations_warning_one": "所選等級允許的保留主題少於目前等級。在變更你的等級之前，<strong>請至少刪除 1 項保留</strong>。你可以在<Link>設定</Link>中移除保留。",
+    "account_upgrade_dialog_reservations_warning_other": "所選等級允許的保留主題少於目前等級。在變更你的等級之前，<strong>請至少刪除 {{count}} 項保留</strong>。你可以在<Link>設定</Link>中移除保留。",
+    "account_upgrade_dialog_tier_current_label": "目前",
+    "account_upgrade_dialog_tier_features_attachment_file_size": "每個檔案 {{filesize}}",
+    "account_upgrade_dialog_tier_features_attachment_total_size": "{{totalsize}} 總儲存空間",
+    "account_upgrade_dialog_tier_features_calls_one": "每日 {{calls}} 通電話",
+    "account_upgrade_dialog_tier_features_calls_other": "每日 {{calls}} 通電話",
+    "account_upgrade_dialog_tier_features_emails_one": "每日 {{emails}} 封電子郵件",
+    "account_upgrade_dialog_tier_features_emails_other": "每日 {{emails}} 封電子郵件",
+    "account_upgrade_dialog_tier_features_messages_one": "每日 {{messages}} 則訊息",
+    "account_upgrade_dialog_tier_features_messages_other": "每日 {{messages}} 則訊息",
     "account_upgrade_dialog_tier_features_no_calls": "沒有電話",
     "account_upgrade_dialog_tier_features_no_reservations": "無保留主題",
-    "account_upgrade_dialog_tier_features_reservations_one": "保留一條主題",
-    "account_upgrade_dialog_tier_features_reservations_other": "保留 {{reservations}} 條主題",
+    "account_upgrade_dialog_tier_features_reservations_one": "保留 {{reservations}} 個主題",
+    "account_upgrade_dialog_tier_features_reservations_other": "保留 {{reservations}} 個主題",
     "account_upgrade_dialog_tier_price_billed_monthly": "{{price}} 每年。按月計費。",
-    "account_upgrade_dialog_tier_price_billed_yearly": "{{價格}} 按年計費。節省 {{save}}。",
+    "account_upgrade_dialog_tier_price_billed_yearly": "{{price}} 按年計費。節省 {{save}}。",
     "account_upgrade_dialog_tier_price_per_month": "月",
     "account_upgrade_dialog_tier_selected_label": "已選",
-    "account_upgrade_dialog_title": "更改帳戶等級",
-    "account_usage_attachment_storage_description": "每個文件 {{filesize}}，在 {{expiry}} 後刪除",
-    "account_usage_attachment_storage_title": "附件存儲",
-    "account_usage_basis_ip_description": "此帳戶的使用統計資訊和限制基於你的 IP 地址，因此可能會與其他用戶共享。上面顯示的限制是基於現有速率限制的近似值。",
+    "account_upgrade_dialog_title": "變更帳戶等級",
+    "account_usage_attachment_storage_description": "每個檔案 {{filesize}}，在 {{expiry}} 後刪除",
+    "account_usage_attachment_storage_title": "附件儲存",
+    "account_usage_basis_ip_description": "此帳戶會依你的 IP 位址計算使用統計與限制，因此可能會與其他使用者共用。上方限制是根據現有速率限制估算的近似值。",
     "account_usage_calls_none": "此帳號無法撥打電話",
     "account_usage_calls_title": "已撥打電話",
-    "account_usage_cannot_create_portal_session": "無法打開計費門戶",
-    "account_usage_emails_title": "已發送電子郵件",
-    "account_usage_limits_reset_daily": "使用限制每天午夜 (UTC) 重置",
+    "account_usage_cannot_create_portal_session": "無法開啟計費入口網站",
+    "account_usage_emails_title": "已傳送電子郵件",
+    "account_usage_limits_reset_daily": "使用限制每天午夜 (UTC) 重設",
     "account_usage_messages_title": "已發布訊息",
-    "account_usage_of_limit": "{{limit}} 的",
+    "account_usage_of_limit": "/ {{limit}}",
     "account_usage_reservations_none": "此帳戶沒有保留主題",
     "account_usage_reservations_title": "保留主題",
     "account_usage_title": "使用量",
     "account_usage_unlimited": "無限",
     "action_bar_account": "帳戶",
-    "action_bar_change_display_name": "更改顯示名稱",
+    "action_bar_change_display_name": "變更顯示名稱",
     "action_bar_clear_notifications": "清除所有通知",
-    "action_bar_logo_alt": "ntfy 標識",
+    "action_bar_logo_alt": "ntfy 標誌",
     "action_bar_mute_notifications": "靜音",
     "action_bar_profile_logout": "登出",
     "action_bar_profile_settings": "設定",
     "action_bar_profile_title": "個人資料",
     "action_bar_reservation_add": "保留主題",
     "action_bar_reservation_delete": "移除保留",
-    "action_bar_reservation_edit": "更改保留",
+    "action_bar_reservation_edit": "變更保留",
     "action_bar_reservation_limit_reached": "達到限制",
-    "action_bar_send_test_notification": "發送測試通知",
+    "action_bar_send_test_notification": "傳送測試通知",
     "action_bar_settings": "設定",
     "action_bar_show_menu": "顯示選單",
-    "action_bar_sign_in": "登錄",
+    "action_bar_sign_in": "登入",
     "action_bar_sign_up": "註冊",
     "action_bar_toggle_action_menu": "開啟或關閉操作選單",
     "action_bar_toggle_mute": "通知靜音/解除通知靜音",
     "action_bar_unmute_notifications": "取消靜音",
     "action_bar_unsubscribe": "取消訂閱",
-    "alert_notification_ios_install_required_description": "要接收通知，請在 iOS 上點擊共享，然後添加到主屏幕",
+    "alert_notification_ios_install_required_description": "若要接收通知，請在 iOS 上點選 [分享]，然後選擇 [加入主畫面]",
     "alert_notification_ios_install_required_title": "需要安裝 iOS 應用程式",
-    "alert_notification_permission_denied_description": "你已禁用通知。要重新啟用通知，請在瀏覽器設置中啟用通知",
-    "alert_notification_permission_denied_title": "已禁用通知",
+    "alert_notification_permission_denied_description": "你已停用通知。若要重新啟用通知，請在瀏覽器設定中開啟通知",
+    "alert_notification_permission_denied_title": "已停用通知",
     "alert_notification_permission_required_button": "現在授予",
-    "alert_notification_permission_required_description": "授予瀏覽器顯示桌面通知的權限",
-    "alert_notification_permission_required_title": "已禁用通知",
+    "alert_notification_permission_required_description": "請授予瀏覽器顯示桌面通知的權限",
+    "alert_notification_permission_required_title": "已停用通知",
     "alert_not_supported_context_description": "通知僅支援 HTTPS。這是 <mdnLink>Notifications API</mdnLink> 的限制。",
     "alert_not_supported_description": "你的瀏覽器不支援通知",
     "alert_not_supported_title": "不支援通知",
     "common_add": "新增",
-    "common_back": "返回",
+    "common_back": "上一頁",
     "common_cancel": "取消",
-    "common_copy_to_clipboard": "複製到剪貼板",
-    "common_save": "保存",
-    "display_name_dialog_description": "為訂閱列表中顯示的主題設置一個替代名稱。這有助於更輕鬆地識別名稱複雜的主題。",
+    "common_copy_to_clipboard": "複製到剪貼簿",
+    "common_save": "儲存",
+    "display_name_dialog_description": "為訂閱清單中顯示的主題設定替代名稱。這有助於更輕鬆地識別名稱複雜的主題。",
     "display_name_dialog_placeholder": "顯示名稱",
-    "display_name_dialog_title": "更改顯示名稱",
-    "emoji_picker_search_clear": "清除搜索",
-    "emoji_picker_search_placeholder": "查找表情符號",
-    "error_boundary_button_copy_stack_trace": "複製堆疊追踪",
-    "error_boundary_button_reload_ntfy": "重新加載 ntfy",
-    "error_boundary_description": "這顯然不應該發生。對此非常抱歉。<br/>如果你有時間，請<githubLink>在GitHub</githubLink>上報告，或通過<discordLink>Discord</discordLink>或<matrixLink>Matrix</matrixLink>告訴我們。",
+    "display_name_dialog_title": "變更顯示名稱",
+    "emoji_picker_search_clear": "清除搜尋",
+    "emoji_picker_search_placeholder": "搜尋表情符號",
+    "error_boundary_button_copy_stack_trace": "複製堆疊追蹤",
+    "error_boundary_button_reload_ntfy": "重新載入 ntfy",
+    "error_boundary_description": "這顯然不應該發生。對此非常抱歉。<br/>如果你有時間，請在<githubLink>GitHub</githubLink>回報，或透過<discordLink>Discord</discordLink>或<matrixLink>Matrix</matrixLink>聯絡我們。",
     "error_boundary_gathering_info": "收集更多資訊……",
-    "error_boundary_stack_trace": "堆疊追踪",
+    "error_boundary_stack_trace": "堆疊追蹤",
     "error_boundary_title": "天啊，ntfy 崩潰了",
-    "error_boundary_unsupported_indexeddb_description": "Ntfy Web應用程式需要IndexedDB才能運行，且你的瀏覽器在隱私瀏覽模式下不支援IndexedDB。<br/><br/>儘管這很不幸，但在隱私瀏覽模式下使用ntfy Web應用程式也沒有多大意義，因為所有東西都存儲在瀏覽器存儲中。你可以在<githubLink>本GitHub問題</githubLink>中閱讀有關它的更多資訊，或者在<discordLink>Discord</discordLink>或<matrixLink>Matrix</matrixLink>上與我們交談。",
+    "error_boundary_unsupported_indexeddb_description": "ntfy Web 應用程式需要 IndexedDB 才能運作，而你的瀏覽器在隱私瀏覽模式下不支援 IndexedDB。<br/><br/>很遺憾，不過在隱私瀏覽模式下使用 ntfy Web 應用程式其實也不太合理，因為所有資料都儲存在瀏覽器儲存空間中。你可以在<githubLink>這個 GitHub issue</githubLink>中閱讀更多資訊，或透過<discordLink>Discord</discordLink>或<matrixLink>Matrix</matrixLink>與我們討論。",
     "error_boundary_unsupported_indexeddb_title": "不支援隱私瀏覽",
-    "login_disabled": "登錄已禁用",
-    "login_form_button_submit": "登錄",
+    "login_disabled": "登入已停用",
+    "login_form_button_submit": "登入",
     "login_link_signup": "註冊",
-    "login_title": "請登錄你的 ntfy 帳戶",
-    "message_bar_error_publishing": "發佈通知時出錯",
+    "login_title": "請登入你的 ntfy 帳戶",
+    "message_bar_error_publishing": "發布通知時發生錯誤",
     "message_bar_publish": "發布訊息",
-    "message_bar_show_dialog": "顯示發布對話框",
+    "message_bar_show_dialog": "顯示發布對話方塊",
     "message_bar_type_message": "在此處輸入訊息",
     "nav_button_account": "帳戶",
     "nav_button_all_notifications": "全部通知",
-    "nav_button_connecting": "正在連接",
-    "nav_button_documentation": "文檔",
+    "nav_button_connecting": "正在連線",
+    "nav_button_documentation": "說明",
     "nav_button_muted": "已暫停通知",
     "nav_button_publish_message": "發布通知",
     "nav_button_settings": "設定",
@@ -191,44 +191,44 @@
     "nav_upgrade_banner_description": "保留主題，更多訊息和郵件，以及更大的附件",
     "nav_upgrade_banner_label": "升級到 ntfy Pro",
     "notifications_actions_failed_notification": "通知失敗",
-    "notifications_actions_http_request_title": "發送 HTTP {{method}} 到 {{url}}",
-    "notifications_actions_not_supported": "網頁應用程序不支援此操作",
+    "notifications_actions_http_request_title": "傳送 HTTP {{method}} 到 {{url}}",
+    "notifications_actions_not_supported": "網頁應用程式不支援此操作",
     "notifications_actions_open_url_title": "轉到 {{url}}",
-    "notifications_attachment_copy_url_button": "複製連結地址",
-    "notifications_attachment_copy_url_title": "將附件中連結地址複製到剪貼板",
-    "notifications_attachment_file_app": "安卓應用程式",
-    "notifications_attachment_file_audio": "聲音文件",
-    "notifications_attachment_file_document": "其他文件",
-    "notifications_attachment_file_image": "圖片文件",
-    "notifications_attachment_file_video": "影片文件",
+    "notifications_attachment_copy_url_button": "複製 URL",
+    "notifications_attachment_copy_url_title": "將附件 URL 複製到剪貼簿",
+    "notifications_attachment_file_app": "Android 應用程式檔案",
+    "notifications_attachment_file_audio": "音訊檔案",
+    "notifications_attachment_file_document": "其他檔案",
+    "notifications_attachment_file_image": "圖片檔案",
+    "notifications_attachment_file_video": "影片檔案",
     "notifications_attachment_image": "附件圖片",
     "notifications_attachment_link_expired": "下載連結已過期",
     "notifications_attachment_link_expires": "連結在 {{date}} 過期",
-    "notifications_attachment_open_button": "打開附件",
+    "notifications_attachment_open_button": "開啟附件",
     "notifications_attachment_open_title": "轉到 {{url}}",
-    "notifications_click_copy_url_button": "複製鏈結",
-    "notifications_click_copy_url_title": "複製鏈結地址到剪貼板",
-    "notifications_click_open_button": "打開鏈結",
-    "notifications_copied_to_clipboard": "複製到剪貼板",
+    "notifications_click_copy_url_button": "複製連結",
+    "notifications_click_copy_url_title": "將連結 URL 複製到剪貼簿",
+    "notifications_click_open_button": "開啟連結",
+    "notifications_copied_to_clipboard": "複製到剪貼簿",
     "notifications_delete": "刪除",
-    "notifications_example": "示例",
+    "notifications_example": "範例",
     "notifications_list_item": "通知",
-    "notifications_list": "通知列表",
-    "notifications_loading": "正在加載通知……",
+    "notifications_list": "通知清單",
+    "notifications_loading": "正在載入通知……",
     "notifications_mark_read": "標記為已讀",
-    "notifications_more_details": "有關更多資訊，請查看<websiteLink>網站</websiteLink>或<docsLink>文檔</docsLink>。",
+    "notifications_more_details": "如需更多資訊，請參閱<websiteLink>網站</websiteLink>或<docsLink>說明</docsLink>。",
     "notifications_new_indicator": "新通知",
-    "notifications_none_for_any_description": "要向此主題發送通知，只需使用 PUT 或 POST 到主題鏈結即可。以下是使用你的主題的示例。",
+    "notifications_none_for_any_description": "若要向此主題傳送通知，只要將 PUT 或 POST 請求傳送到主題 URL 即可。以下是使用你的主題的範例。",
     "notifications_none_for_any_title": "你尚未收到任何通知。",
-    "notifications_none_for_topic_description": "要向此主題發送通知，只需使用 PUT 或 POST 到主題連結即可。",
+    "notifications_none_for_topic_description": "若要向此主題傳送通知，只要將 PUT 或 POST 請求傳送到主題 URL 即可。",
     "notifications_none_for_topic_title": "你尚未收到有關此主題的任何通知。",
-    "notifications_no_subscriptions_description": "點擊 \"{{linktext}}\" 連結以建立或訂閱主題。之後，你可以使用 PUT 或 POST 發送訊息，你將在這裡收到通知。",
-    "notifications_no_subscriptions_title": "看起來你還未有任何訂閱。",
-    "notifications_priority_x": "優先級 {{priority}}",
+    "notifications_no_subscriptions_description": "點選「{{linktext}}」連結以建立或訂閱主題。之後，你可以使用 PUT 或 POST 傳送訊息，並在這裡收到通知。",
+    "notifications_no_subscriptions_title": "看起來你還沒有任何訂閱。",
+    "notifications_priority_x": "優先順序 {{priority}}",
     "notifications_tags": "標記",
     "prefs_appearance_language_title": "語言",
-    "prefs_appearance_theme_dark": "黑暗模式",
-    "prefs_appearance_theme_light": "光亮模式",
+    "prefs_appearance_theme_dark": "深色模式",
+    "prefs_appearance_theme_light": "淺色模式",
     "prefs_appearance_theme_system": "系統 (預設)",
     "prefs_appearance_theme_title": "主題",
     "prefs_appearance_title": "外觀",
@@ -238,171 +238,171 @@
     "prefs_notifications_delete_after_one_day": "一天後",
     "prefs_notifications_delete_after_one_month_description": "一個月後自動刪除通知",
     "prefs_notifications_delete_after_one_month": "一個月後",
-    "prefs_notifications_delete_after_one_week_description": "一周後自動刪除通知",
-    "prefs_notifications_delete_after_one_week": "一周後",
+    "prefs_notifications_delete_after_one_week_description": "一週後自動刪除通知",
+    "prefs_notifications_delete_after_one_week": "一週後",
     "prefs_notifications_delete_after_three_hours_description": "三小時後自動刪除通知",
     "prefs_notifications_delete_after_three_hours": "三小時後",
     "prefs_notifications_delete_after_title": "刪除通知",
-    "prefs_notifications_min_priority_any": "任意優先級",
-    "prefs_notifications_min_priority_default_and_higher": "默認優先級或更高",
-    "prefs_notifications_min_priority_description_any": "顯示所有通知，無論優先級如何",
-    "prefs_notifications_min_priority_description_max": "僅顯示最高優先級的通知",
-    "prefs_notifications_min_priority_description_x_or_higher": "僅顯示優先級為{{number}}（{{name}}）或以上的通知",
-    "prefs_notifications_min_priority_high_and_higher": "高優先級或更高",
-    "prefs_notifications_min_priority_low_and_higher": "低優先級或更高",
-    "prefs_notifications_min_priority_max_only": "僅最高優先級",
-    "prefs_notifications_min_priority_title": "最低優先級",
+    "prefs_notifications_min_priority_any": "任何優先順序",
+    "prefs_notifications_min_priority_default_and_higher": "預設優先順序或更高",
+    "prefs_notifications_min_priority_description_any": "顯示所有通知，無論優先順序如何",
+    "prefs_notifications_min_priority_description_max": "僅顯示最高優先順序的通知",
+    "prefs_notifications_min_priority_description_x_or_higher": "僅顯示優先順序為 {{number}}（{{name}}）或以上的通知",
+    "prefs_notifications_min_priority_high_and_higher": "高優先順序或更高",
+    "prefs_notifications_min_priority_low_and_higher": "低優先順序或更高",
+    "prefs_notifications_min_priority_max_only": "僅最高優先順序",
+    "prefs_notifications_min_priority_title": "最低優先順序",
     "prefs_notifications_sound_description_none": "收到通知時不播放任何聲音",
     "prefs_notifications_sound_description_some": "收到通知時播放 {{sound}} 聲音",
     "prefs_notifications_sound_no_sound": "靜音",
-    "prefs_notifications_sound_play": "播放選中聲音",
+    "prefs_notifications_sound_play": "播放選取的聲音",
     "prefs_notifications_sound_title": "通知提示音",
     "prefs_notifications_title": "通知",
-    "prefs_notifications_web_push_disabled_description": "當網頁程式在運行時將會收到通知 (透過 WebSocket)",
-    "prefs_notifications_web_push_disabled": "己暫用",
-    "prefs_notifications_web_push_enabled_description": "即使網頁程式未有運街亦會收到通知 (via Web Push)",
-    "prefs_notifications_web_push_enabled": "己為 {{server}} 啟用",
+    "prefs_notifications_web_push_disabled_description": "網頁應用程式執行時會收到通知（透過 WebSocket）",
+    "prefs_notifications_web_push_disabled": "已停用",
+    "prefs_notifications_web_push_enabled_description": "即使網頁應用程式未執行，也會收到通知（透過 Web Push）",
+    "prefs_notifications_web_push_enabled": "已為 {{server}} 啟用",
     "prefs_notifications_web_push_title": "背景通知",
     "prefs_reservations_add_button": "新增保留主題",
-    "prefs_reservations_delete_button": "重置主題訪問",
-    "prefs_reservations_description": "你可以在此處保留主題名稱供個人使用。保留主題使你擁有該主題的所有權，並允許你為其他用戶定義對該主題的訪問權限。",
-    "prefs_reservations_dialog_access_label": "訪問",
-    "prefs_reservations_dialog_description": "保留主題使你擁有該主題的所有權，並允許你為其他用戶定義對該主題的訪問權限。",
+    "prefs_reservations_delete_button": "重設主題存取權限",
+    "prefs_reservations_description": "你可以在此保留主題名稱供個人使用。保留主題代表你擁有該主題的所有權，並可為其他使用者定義該主題的存取權限。",
+    "prefs_reservations_dialog_access_label": "存取權限",
+    "prefs_reservations_dialog_description": "保留主題代表你擁有該主題的所有權，並可為其他使用者定義該主題的存取權限。",
     "prefs_reservations_dialog_title_add": "保留主題",
     "prefs_reservations_dialog_title_delete": "刪除主題保留",
     "prefs_reservations_dialog_title_edit": "編輯保留主題",
     "prefs_reservations_dialog_topic_label": "主題",
-    "prefs_reservations_edit_button": "編輯主題訪問",
+    "prefs_reservations_edit_button": "編輯主題存取權限",
     "prefs_reservations_limit_reached": "你已達到保留主題限制。",
-    "prefs_reservations_table_access_header": "訪問",
-    "prefs_reservations_table_click_to_subscribe": "點擊以訂閱",
-    "prefs_reservations_table_everyone_deny_all": "只有我可以發佈和訂閱",
-    "prefs_reservations_table_everyone_read_only": "我可以發佈和訂閱，每個人都可以訂閱",
-    "prefs_reservations_table_everyone_read_write": "每個人都可以發佈和訂閱",
-    "prefs_reservations_table_everyone_write_only": "我可以發佈和訂閱，每個人都可以發佈",
+    "prefs_reservations_table_access_header": "存取權限",
+    "prefs_reservations_table_click_to_subscribe": "點選以訂閱",
+    "prefs_reservations_table_everyone_deny_all": "只有我可以發布和訂閱",
+    "prefs_reservations_table_everyone_read_only": "我可以發布和訂閱，每個人都可以訂閱",
+    "prefs_reservations_table_everyone_read_write": "每個人都可以發布和訂閱",
+    "prefs_reservations_table_everyone_write_only": "我可以發布和訂閱，每個人都可以發布",
     "prefs_reservations_table_not_subscribed": "未訂閱",
     "prefs_reservations_table_topic_header": "主題",
     "prefs_reservations_table": "保留主題表格",
     "prefs_reservations_title": "保留主題",
     "prefs_users_add_button": "新增使用者",
-    "prefs_users_delete_button": "刪除用戶",
-    "prefs_users_description_no_sync": "用戶和密碼不會同步到你的賬戶。",
-    "prefs_users_description": "在此處新增/刪除受保護主題的使用者。請注意，使用者名和密碼將存儲在瀏覽器的本地存儲中。",
-    "prefs_users_dialog_base_url_label": "服務連結地址，例如 https://ntfy.sh",
+    "prefs_users_delete_button": "刪除使用者",
+    "prefs_users_description_no_sync": "使用者和密碼不會同步到你的帳戶。",
+    "prefs_users_description": "在此新增或刪除受保護主題的使用者。請注意，使用者名稱和密碼會儲存在瀏覽器的本機儲存空間中。",
+    "prefs_users_dialog_base_url_label": "服務 URL，例如 https://ntfy.sh",
     "prefs_users_dialog_password_label": "密碼",
     "prefs_users_dialog_title_add": "新增使用者",
     "prefs_users_dialog_title_edit": "編輯使用者",
-    "prefs_users_dialog_username_label": "使用者名，例如 phil",
-    "prefs_users_edit_button": "編輯用戶",
-    "prefs_users_table_base_url_header": "服務連結地址",
-    "prefs_users_table_cannot_delete_or_edit": "無法刪除或編輯已登錄用戶",
-    "prefs_users_table_user_header": "用戶",
-    "prefs_users_table": "用戶表",
+    "prefs_users_dialog_username_label": "使用者名稱，例如 phil",
+    "prefs_users_edit_button": "編輯使用者",
+    "prefs_users_table_base_url_header": "服務 URL",
+    "prefs_users_table_cannot_delete_or_edit": "無法刪除或編輯已登入使用者",
+    "prefs_users_table_user_header": "使用者",
+    "prefs_users_table": "使用者表格",
     "prefs_users_title": "管理使用者",
     "priority_default": "預設",
     "priority_high": "高",
     "priority_low": "低",
     "priority_max": "最高",
     "priority_min": "最低",
-    "publish_dialog_attached_file_filename_placeholder": "附件文件名",
-    "publish_dialog_attached_file_remove": "刪除附件文件",
-    "publish_dialog_attached_file_title": "附件文件：",
-    "publish_dialog_attach_label": "附件連結地址",
-    "publish_dialog_attachment_limits_file_and_quota_reached": "超過 {{fileSizeLimit}} 文件限制和配額，剩餘 {{remainingBytes}}",
-    "publish_dialog_attachment_limits_file_reached": "超過 {{fileSizeLimit}} 文件限制",
+    "publish_dialog_attached_file_filename_placeholder": "附件檔名",
+    "publish_dialog_attached_file_remove": "刪除附件檔案",
+    "publish_dialog_attached_file_title": "附件檔案：",
+    "publish_dialog_attach_label": "附件 URL",
+    "publish_dialog_attachment_limits_file_and_quota_reached": "超過 {{fileSizeLimit}} 的檔案限制和配額，剩餘 {{remainingBytes}}",
+    "publish_dialog_attachment_limits_file_reached": "超過 {{fileSizeLimit}} 的檔案限制",
     "publish_dialog_attachment_limits_quota_reached": "超過配額，剩餘 {{remainingBytes}}",
-    "publish_dialog_attach_placeholder": "使用鏈結地址附加文件，例如 https://f-droid.org/F-Droid.apk",
-    "publish_dialog_attach_reset": "移除附件鏈結地址",
-    "publish_dialog_base_url_label": "服務鏈結地址",
-    "publish_dialog_base_url_placeholder": "服務鏈結地址，例如 https://example.com",
-    "publish_dialog_button_cancel_sending": "取消發送",
+    "publish_dialog_attach_placeholder": "透過 URL 附加檔案，例如 https://f-droid.org/F-Droid.apk",
+    "publish_dialog_attach_reset": "移除附件 URL",
+    "publish_dialog_base_url_label": "服務 URL",
+    "publish_dialog_base_url_placeholder": "服務 URL，例如 https://example.com",
+    "publish_dialog_button_cancel_sending": "取消傳送",
     "publish_dialog_button_cancel": "取消",
-    "publish_dialog_button_send": "發送",
+    "publish_dialog_button_send": "傳送",
     "publish_dialog_call_item": "撥打電話 {{number}}",
     "publish_dialog_call_label": "撥號",
     "publish_dialog_call_reset": "清空撥號",
     "publish_dialog_checkbox_markdown": "格式化為 Markdown",
     "publish_dialog_checkbox_publish_another": "發布另一個",
-    "publish_dialog_chip_attach_file_label": "本地文件附件",
-    "publish_dialog_chip_attach_url_label": "鏈結附件地址",
+    "publish_dialog_chip_attach_file_label": "本機檔案附件",
+    "publish_dialog_chip_attach_url_label": "透過 URL 附加檔案",
     "publish_dialog_chip_call_label": "撥號",
     "publish_dialog_chip_call_no_verified_numbers_tooltip": "未驗證的電話號碼",
-    "publish_dialog_chip_click_label": "點擊鏈結地址",
+    "publish_dialog_chip_click_label": "點選 URL",
     "publish_dialog_chip_delay_label": "延期投遞",
-    "publish_dialog_chip_email_label": "轉發郵件",
+    "publish_dialog_chip_email_label": "轉寄電子郵件",
     "publish_dialog_chip_topic_label": "變更主題",
-    "publish_dialog_click_label": "點擊鏈結地址",
-    "publish_dialog_click_placeholder": "點擊通知時打開鏈結地址",
-    "publish_dialog_click_reset": "移除點擊連結地址",
+    "publish_dialog_click_label": "點選 URL",
+    "publish_dialog_click_placeholder": "點選通知時開啟的 URL",
+    "publish_dialog_click_reset": "移除點選 URL",
     "publish_dialog_delay_label": "延期",
     "publish_dialog_delay_placeholder": "延期投遞，例如 {{unixTimestamp}}、{{relativeTime}}或「{{naturalLanguage}}」（僅限英語）",
     "publish_dialog_delay_reset": "刪除延期投遞",
-    "publish_dialog_details_examples_description": "有關所有發送功能的範例和詳細說明，請參閱<docsLink>文檔</docsLink>。",
-    "publish_dialog_drop_file_here": "將文件拖拽至此",
+    "publish_dialog_details_examples_description": "如需所有傳送功能的範例和詳細說明，請參閱<docsLink>說明</docsLink>。",
+    "publish_dialog_drop_file_here": "將檔案拖曳到這裡",
     "publish_dialog_email_label": "電子郵件",
-    "publish_dialog_email_placeholder": "將通知轉發到的地址，例如 phil@example.com",
-    "publish_dialog_email_reset": "移除電子郵件轉發",
+    "publish_dialog_email_placeholder": "要轉寄通知的電子郵件地址，例如 phil@example.com",
+    "publish_dialog_email_reset": "移除電子郵件轉寄",
     "publish_dialog_emoji_picker_show": "選擇表情符號",
-    "publish_dialog_filename_label": "文件名",
-    "publish_dialog_filename_placeholder": "附件文件名",
+    "publish_dialog_filename_label": "檔名",
+    "publish_dialog_filename_placeholder": "附件檔名",
     "publish_dialog_message_label": "訊息",
     "publish_dialog_message_placeholder": "在此輸入訊息",
     "publish_dialog_message_published": "已發布通知",
-    "publish_dialog_other_features": "其它功能：",
-    "publish_dialog_priority_default": "默認優先級",
-    "publish_dialog_priority_high": "高優先級",
-    "publish_dialog_priority_label": "優先級",
-    "publish_dialog_priority_low": "低優先級",
-    "publish_dialog_priority_max": "最高優先級",
-    "publish_dialog_priority_min": "最低優先級",
+    "publish_dialog_other_features": "其他功能：",
+    "publish_dialog_priority_default": "預設優先順序",
+    "publish_dialog_priority_high": "高優先順序",
+    "publish_dialog_priority_label": "優先順序",
+    "publish_dialog_priority_low": "低優先順序",
+    "publish_dialog_priority_max": "最高優先順序",
+    "publish_dialog_priority_min": "最低優先順序",
     "publish_dialog_progress_uploading_detail": "正在上傳 {{loaded}}/{{total}} ({{percent}}%) ……",
     "publish_dialog_progress_uploading": "正在上傳……",
     "publish_dialog_tags_label": "標記",
-    "publish_dialog_tags_placeholder": "英文逗號分隔標記列表，例如 warning, srv1-backup",
+    "publish_dialog_tags_placeholder": "以英文逗號分隔的標記清單，例如 warning, srv1-backup",
     "publish_dialog_title_label": "主題",
     "publish_dialog_title_no_topic": "發布通知",
     "publish_dialog_title_placeholder": "主題標題，例如：磁碟空間警告",
     "publish_dialog_title_topic": "發布到 {{topic}}",
     "publish_dialog_topic_label": "主題名稱",
     "publish_dialog_topic_placeholder": "主題名稱，例如 phil_alerts",
-    "publish_dialog_topic_reset": "重置主題",
-    "reservation_delete_dialog_action_delete_description": "緩存的郵件和附件將被永久刪除。此操作無法撤銷。",
-    "reservation_delete_dialog_action_delete_title": "刪除緩存的郵件和附件",
-    "reservation_delete_dialog_action_keep_description": "緩存在伺服器上的訊息和附件將對知道主題名稱的人公開可見。",
-    "reservation_delete_dialog_action_keep_title": "保留緩存的郵件和附件",
-    "reservation_delete_dialog_description": "刪除保留會放棄對該主題的所有權，並允許其他人保留它。你可以保留或刪除現有郵件和附件。",
+    "publish_dialog_topic_reset": "重設主題",
+    "reservation_delete_dialog_action_delete_description": "系統會永久刪除快取的訊息和附件。此操作無法復原。",
+    "reservation_delete_dialog_action_delete_title": "刪除快取的訊息和附件",
+    "reservation_delete_dialog_action_keep_description": "只要知道主題名稱，任何人都能看到伺服器快取的訊息和附件。",
+    "reservation_delete_dialog_action_keep_title": "保留快取的訊息和附件",
+    "reservation_delete_dialog_description": "刪除保留會放棄該主題的所有權，並允許其他人保留。你可以保留或刪除現有訊息和附件。",
     "reservation_delete_dialog_submit_button": "刪除保留",
-    "reserve_dialog_checkbox_label": "保留主題並配置訪問",
-    "signup_already_have_account": "已有帳戶？登錄！",
-    "signup_disabled": "註冊已禁用",
-    "signup_error_creation_limit_reached": "已達到帳戶創建限制",
-    "signup_error_username_taken": "用戶名 {{username}} 已被取用",
+    "reserve_dialog_checkbox_label": "保留主題並設定存取權限",
+    "signup_already_have_account": "已有帳戶？請登入！",
+    "signup_disabled": "註冊已停用",
+    "signup_error_creation_limit_reached": "已達到帳戶建立限制",
+    "signup_error_username_taken": "使用者名稱 {{username}} 已被取用",
     "signup_form_button_submit": "註冊",
     "signup_form_confirm_password": "確認密碼",
     "signup_form_password": "密碼",
     "signup_form_toggle_password_visibility": "切換密碼可見性",
-    "signup_form_username": "用戶名",
-    "signup_title": "創建一個 ntfy 帳戶",
+    "signup_form_username": "使用者名稱",
+    "signup_title": "建立 ntfy 帳戶",
     "subscribe_dialog_error_topic_already_reserved": "主題已保留",
     "subscribe_dialog_error_user_anonymous": "匿名",
     "subscribe_dialog_error_user_not_authorized": "未授權 {{username}} 使用者",
     "subscribe_dialog_login_button_login": "登入",
-    "subscribe_dialog_login_description": "本主題受密碼保護，請輸入用戶名和密碼以訂閱。",
+    "subscribe_dialog_login_description": "此主題受到密碼保護，請輸入使用者名稱和密碼以訂閱。",
     "subscribe_dialog_login_password_label": "密碼",
-    "subscribe_dialog_login_title": "請登錄",
-    "subscribe_dialog_login_username_label": "用戶名，例如 phil",
-    "subscribe_dialog_subscribe_base_url_label": "服務地址地址",
+    "subscribe_dialog_login_title": "請登入",
+    "subscribe_dialog_login_username_label": "使用者名稱，例如 phil",
+    "subscribe_dialog_subscribe_base_url_label": "服務 URL",
     "subscribe_dialog_subscribe_button_cancel": "取消",
-    "subscribe_dialog_subscribe_button_generate_topic_name": "生成名稱",
+    "subscribe_dialog_subscribe_button_generate_topic_name": "產生名稱",
     "subscribe_dialog_subscribe_button_subscribe": "訂閱",
     "subscribe_dialog_subscribe_description": "主題可能不受密碼保護，因此請選擇一個不容易被猜中的名字。訂閱後，你可以使用 PUT/POST 通知。",
     "subscribe_dialog_subscribe_title": "訂閱主題",
-    "subscribe_dialog_subscribe_topic_placeholder": "主題名，例如 phil_alerts",
-    "subscribe_dialog_subscribe_use_another_background_info": "當網頁程式未開啟， 將不會收到來自其他伺服器的通知",
+    "subscribe_dialog_subscribe_topic_placeholder": "主題名稱，例如 phil_alerts",
+    "subscribe_dialog_subscribe_use_another_background_info": "網頁應用程式未開啟時，不會收到來自其他伺服器的通知",
     "subscribe_dialog_subscribe_use_another_label": "使用其他伺服器",
-    "web_push_subscription_expiring_body": "開啟ntfy以繼續接收通知",
+    "web_push_subscription_expiring_body": "開啟 ntfy 以繼續接收通知",
     "web_push_subscription_expiring_title": "通知會被暫停",
-    "web_push_unknown_notification_body": "你可能需要開啟網頁來更新ntfy",
+    "web_push_unknown_notification_body": "你可能需要開啟網頁來更新 ntfy",
     "web_push_unknown_notification_title": "接收到不明通知",
     "account_basics_cannot_edit_or_delete_provisioned_user": "已佈建的使用者無法編輯或刪除",
     "account_tokens_table_cannot_delete_or_edit_provisioned_token": "無法編輯或刪除已佈建的權杖"

web/public/sw.js

@@ -4,6 +4,7 @@ import { NavigationRoute, registerRoute } from "workbox-routing";
 import { NetworkFirst } from "workbox-strategies";
 import { clientsClaim } from "workbox-core";
 import { dbAsync } from "../src/app/db";
+import session from "../src/app/Session";
 import { ACTION_HTTP, ACTION_VIEW } from "../src/app/actions";
 import { badge, icon, messageWithSequenceId, notificationTag, toNotificationParams } from "../src/app/notificationUtils";
 import initI18n from "../src/app/i18n";
@@ -11,8 +12,9 @@ import {
   EVENT_MESSAGE,
   EVENT_MESSAGE_CLEAR,
   EVENT_MESSAGE_DELETE,
-  WEBPUSH_EVENT_MESSAGE,
-  WEBPUSH_EVENT_SUBSCRIPTION_EXPIRING,
+  SW_PERIODIC_SYNC_EXTEND_TOKEN_TAG,
+  SW_WEBPUSH_EVENT_MESSAGE,
+  SW_WEBPUSH_EVENT_SUBSCRIPTION_EXPIRING,
 } from "../src/app/events";
 
 /**
@@ -35,6 +37,7 @@ const broadcastChannel = new BroadcastChannel("web-push-broadcast");
  */
 const handlePushMessage = async (data) => {
   const { subscription_id: subscriptionId, message } = data;
+
   const db = await dbAsync();
 
   console.log("[ServiceWorker] Message received", data);
@@ -43,9 +46,24 @@ const handlePushMessage = async (data) => {
   const subscription = await db.subscriptions.get(subscriptionId);
   if (!subscription) {
     console.log("[ServiceWorker] Subscription not found", subscriptionId);
+    handlePushUnknown(data);
     return;
   }
 
+  // NOTE: As soon as possible, to avoid this Safari error:
+  // > Push event handling completed without showing any notification via
+  // > ServiceWorkerRegistration.showNotification(). This may trigger removal of
+  // > the push subscription.
+  await self.registration.showNotification(
+    ...toNotificationParams({
+      message,
+      defaultTitle: message.topic,
+      topicRoute: new URL(message.topic, self.location.origin).toString(),
+      baseUrl: subscription.baseUrl,
+      topic: subscription.topic,
+    })
+  );
+
   // Delete existing notification with same sequence ID (if any)
   const sequenceId = message.sequence_id || message.id;
   if (sequenceId) {
@@ -71,17 +89,71 @@ const handlePushMessage = async (data) => {
   // Broadcast the message to potentially play a sound
   broadcastChannel.postMessage(message);
 
-  await self.registration.showNotification(
-    ...toNotificationParams({
-      message,
-      defaultTitle: message.topic,
-      topicRoute: new URL(message.topic, self.location.origin).toString(),
-      baseUrl: subscription.baseUrl,
-      topic: subscription.topic,
-    })
-  );
+  await maybeExtendToken();
 };
 
+const refreshTokenThreshold = 1000 * 60 * 60; // 1 hour
+const maybeExtendToken = async () => {
+  if (import.meta.env.DEV) {
+    console.warn("[ServiceWorker] Skipping token extension in development since no config.base_url exists");
+    return;
+  }
+
+  const token = await session.tokenAsync();
+  if (!token) {
+    console.debug("[ServiceWorker] No session token, skipping token extension");
+    return;
+  }
+
+  const lastExtendedAt = await session.lastExtendedAtAsync();
+  const now = Date.now();
+
+  if (lastExtendedAt && now - lastExtendedAt < refreshTokenThreshold) {
+    console.debug(`[ServiceWorker] Token extended ${Math.floor((now - lastExtendedAt) / 1000 / 60)} minutes ago, skipping`);
+    return;
+  }
+
+  console.log("[ServiceWorker] Extending user access token");
+
+  // duplicated from utils.js#accountTokenUrl since we can't import that here
+  // as long as there's mp3 and other incompatible imports there
+  const tokenUrl = `${config.base_url}/v1/account/token`;
+
+  try {
+    const response = await fetch(tokenUrl, {
+      method: "PATCH",
+      headers: {
+        Authorization: `Bearer ${token}`,
+      },
+    });
+
+    if (response.ok) {
+      await session.setLastExtendedAtAsync();
+      console.log(`[ServiceWorker] Token extended successfully`);
+    } else {
+      console.error(`[ServiceWorker] Failed to extend token: ${response.status} ${response.statusText}`);
+    }
+  } catch (e) {
+    console.error("[ServiceWorker] Failed to extend token", e);
+  }
+};
+
+/**
+ * Registers a periodic-sync listener for `extend_token` (see hooks.js).
+ * This extends the token regardless of whether the browser is open.
+ *
+ * CAVEATS:
+ * - Chromium-only
+ * - Only when the PWA is _installed_ (not just running in a browser tab)
+ * - Only when notifications are granted
+ */
+self.addEventListener("periodicsync", (event) => {
+  if (event.tag === SW_PERIODIC_SYNC_EXTEND_TOKEN_TAG) {
+    console.log(`[ServiceWorker] Received periodicsync event "${SW_PERIODIC_SYNC_EXTEND_TOKEN_TAG}"`);
+    event.waitUntil(maybeExtendToken());
+  }
+});
+
 /**
  * Handle a message_delete event: delete the notification from the database.
  */
@@ -192,7 +264,7 @@ const handlePush = async (data) => {
   // - Web app: hooks.js:handleNotification()
   // - Web app: sw.js:handleMessage(), sw.js:handleMessageClear(), ...
 
-  if (data.event === WEBPUSH_EVENT_MESSAGE) {
+  if (data.event === SW_WEBPUSH_EVENT_MESSAGE) {
     const { message } = data;
     if (message.event === EVENT_MESSAGE) {
       return await handlePushMessage(data);
@@ -201,7 +273,7 @@ const handlePush = async (data) => {
     } else if (message.event === EVENT_MESSAGE_CLEAR) {
       return await handlePushMessageClear(data);
     }
-  } else if (data.event === WEBPUSH_EVENT_SUBSCRIPTION_EXPIRING) {
+  } else if (data.event === SW_WEBPUSH_EVENT_SUBSCRIPTION_EXPIRING) {
     return await handlePushSubscriptionExpiring(data);
   }
 

web/src/app/AccountApi.js

@@ -2,6 +2,8 @@ import i18n from "i18next";
 import {
   accountBillingPortalUrl,
   accountBillingSubscriptionUrl,
+  accountEmailUrl,
+  accountEmailVerifyUrl,
   accountPasswordUrl,
   accountPhoneUrl,
   accountPhoneVerifyUrl,
@@ -135,8 +137,8 @@ class AccountApi {
       token,
       label,
     };
-    if (expires > 0) {
-      body.expires = Math.floor(Date.now() / 1000) + expires;
+    if (expires >= 0) {
+      body.expires = expires > 0 ? Math.floor(Date.now() / 1000) + expires : 0;
     }
     console.log(`[AccountApi] Creating user access token ${url}`);
     await fetchOrThrow(url, {
@@ -153,6 +155,7 @@ class AccountApi {
       method: "PATCH",
       headers: withBearerAuth({}, session.token()),
     });
+    await session.setLastExtendedAtAsync();
   }
 
   async deleteToken(token) {
@@ -339,6 +342,43 @@ class AccountApi {
     });
   }
 
+  async verifyEmail(email) {
+    const url = accountEmailVerifyUrl(config.base_url);
+    console.log(`[AccountApi] Sending email verification ${url}`);
+    await fetchOrThrow(url, {
+      method: "PUT",
+      headers: withBearerAuth({}, session.token()),
+      body: JSON.stringify({
+        email,
+      }),
+    });
+  }
+
+  async addEmail(email, code) {
+    const url = accountEmailUrl(config.base_url);
+    console.log(`[AccountApi] Adding email with verification code ${url}`);
+    await fetchOrThrow(url, {
+      method: "PUT",
+      headers: withBearerAuth({}, session.token()),
+      body: JSON.stringify({
+        email,
+        code,
+      }),
+    });
+  }
+
+  async deleteEmail(email) {
+    const url = accountEmailUrl(config.base_url);
+    console.log(`[AccountApi] Deleting email ${url}`);
+    await fetchOrThrow(url, {
+      method: "DELETE",
+      headers: withBearerAuth({}, session.token()),
+      body: JSON.stringify({
+        email,
+      }),
+    });
+  }
+
   async sync() {
     try {
       if (!session.token()) {

web/src/app/Session.js

@@ -36,6 +36,7 @@ class Session {
     await this.db.kv.bulkPut([
       { key: "user", value: username },
       { key: "token", value: token },
+      { key: "lastExtendedAt", value: Date.now() },
     ]);
     localStorage.setItem("user", username);
     localStorage.setItem("token", token);
@@ -52,6 +53,18 @@ class Session {
     return (await this.db.kv.get({ key: "user" }))?.value;
   }
 
+  async tokenAsync() {
+    return (await this.db.kv.get({ key: "token" }))?.value;
+  }
+
+  async lastExtendedAtAsync() {
+    return (await this.db.kv.get({ key: "lastExtendedAt" }))?.value;
+  }
+
+  async setLastExtendedAtAsync() {
+    await this.db.kv.put({ key: "lastExtendedAt", value: Date.now() });
+  }
+
   exists() {
     return this.username() && this.token();
   }

web/src/app/errors.js

@@ -47,6 +47,14 @@ export class IncorrectPasswordError extends Error {
   }
 }
 
+export class EmailVerificationCodeInvalidError extends Error {
+  static CODE = 40051; // errHTTPBadRequestEmailVerificationCodeInvalid
+
+  constructor() {
+    super("Email verification code invalid or expired");
+  }
+}
+
 export const throwAppError = async (response) => {
   if (response.status === 401 || response.status === 403) {
     console.log(`[Error] HTTP ${response.status}`, response);
@@ -63,6 +71,8 @@ export const throwAppError = async (response) => {
       throw new AccountCreateLimitReachedError();
     } else if (error.code === IncorrectPasswordError.CODE) {
       throw new IncorrectPasswordError();
+    } else if (error.code === EmailVerificationCodeInvalidError.CODE) {
+      throw new EmailVerificationCodeInvalidError();
     } else if (error?.error) {
       throw new Error(`Error ${error.code}: ${error.error}`);
     }

web/src/app/events.js

@@ -8,8 +8,10 @@ export const EVENT_MESSAGE_DELETE = "message_delete";
 export const EVENT_MESSAGE_CLEAR = "message_clear";
 export const EVENT_POLL_REQUEST = "poll_request";
 
-export const WEBPUSH_EVENT_MESSAGE = "message";
-export const WEBPUSH_EVENT_SUBSCRIPTION_EXPIRING = "subscription_expiring";
+export const SW_WEBPUSH_EVENT_MESSAGE = "message";
+export const SW_WEBPUSH_EVENT_SUBSCRIPTION_EXPIRING = "subscription_expiring";
+
+export const SW_PERIODIC_SYNC_EXTEND_TOKEN_TAG = "extend_token";
 
 // Check if an event is a notification event (message, delete, or read)
 export const isNotificationEvent = (event) => event === EVENT_MESSAGE || event === EVENT_MESSAGE_DELETE || event === EVENT_MESSAGE_CLEAR;

web/src/app/notificationUtils.js

@@ -35,7 +35,7 @@ export const formatMessage = (m) => {
   return m.message || "";
 };
 
-const imageRegex = /\.(png|jpe?g|gif|webp)$/i;
+export const imageRegex = /\.(png|jpe?g|gif|webp)$/i;
 export const isImage = (attachment) => {
   if (!attachment) return false;
 

web/src/app/utils.js

@@ -1,4 +1,3 @@
-import { Base64 } from "js-base64";
 import beep from "../sounds/beep.mp3";
 import juntos from "../sounds/juntos.mp3";
 import pristine from "../sounds/pristine.mp3";
@@ -34,6 +33,8 @@ export const accountBillingSubscriptionUrl = (baseUrl) => `${baseUrl}/v1/account
 export const accountBillingPortalUrl = (baseUrl) => `${baseUrl}/v1/account/billing/portal`;
 export const accountPhoneUrl = (baseUrl) => `${baseUrl}/v1/account/phone`;
 export const accountPhoneVerifyUrl = (baseUrl) => `${baseUrl}/v1/account/phone/verify`;
+export const accountEmailUrl = (baseUrl) => `${baseUrl}/v1/account/email`;
+export const accountEmailVerifyUrl = (baseUrl) => `${baseUrl}/v1/account/email/verify`;
 
 export const validUrl = (url) => url.match(/^https?:\/\/.+/);
 
@@ -61,9 +62,14 @@ export const unmatchedTags = (tags) => {
   return tags.filter((tag) => !(tag in emojisMapped));
 };
 
-export const encodeBase64 = (s) => Base64.encode(s);
+export const encodeBase64 = (s) => {
+  const bytes = new TextEncoder().encode(s);
+  let binary = "";
+  for (let i = 0; i < bytes.length; i += 1) binary += String.fromCharCode(bytes[i]);
+  return btoa(binary);
+};
 
-export const encodeBase64Url = (s) => Base64.encodeURI(s);
+export const encodeBase64Url = (s) => encodeBase64(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 
 export const bearerAuth = (token) => `Bearer ${token}`;
 
@@ -136,9 +142,10 @@ export const hashCode = (s) => {
 
 /**
  * convert `i18n.language` style str (e.g.: `en_US`) to kebab-case (e.g.: `en-US`),
- * which is expected by `<html lang>` and `Intl.DateTimeFormat`
+ * which is expected by `<html lang>` and `Intl.DateTimeFormat`. Falls back to "en"
+ * if the input is missing or not a string.
  */
-export const getKebabCaseLangStr = (language) => language.replace(/_/g, "-");
+export const getKebabCaseLangStr = (language) => (typeof language === "string" && language.length > 0 ? language.replace(/_/g, "-") : "en");
 
 export const formatShortDateTime = (timestamp, language) =>
   new Intl.DateTimeFormat(getKebabCaseLangStr(language), {
@@ -149,6 +156,32 @@ export const formatShortDateTime = (timestamp, language) =>
 export const formatShortDate = (timestamp, language) =>
   new Intl.DateTimeFormat(getKebabCaseLangStr(language), { dateStyle: "short" }).format(new Date(timestamp * 1000));
 
+export const formatShortDuration = (ms, language) => {
+  const seconds = Math.round(ms / 1000);
+  const units = [
+    { unit: "year", s: 31536000 },
+    { unit: "month", s: 2592000 },
+    { unit: "week", s: 604800 },
+    { unit: "day", s: 86400 },
+    { unit: "hour", s: 3600 },
+    { unit: "minute", s: 60 },
+    { unit: "second", s: 1 },
+  ];
+  const match = units.find((u) => seconds >= u.s) ?? units[units.length - 1];
+  const value = Math.round(seconds / match.s);
+  // [lang, "en"] makes Intl fall back to English for well-formed-but-unsupported tags;
+  // the try/catch covers malformed tags (RangeError) so the web app never crashes here.
+  try {
+    return new Intl.NumberFormat([getKebabCaseLangStr(language), "en"], {
+      style: "unit",
+      unit: match.unit,
+      unitDisplay: "long",
+    }).format(value);
+  } catch {
+    return new Intl.NumberFormat("en", { style: "unit", unit: match.unit, unitDisplay: "long" }).format(value);
+  }
+};
+
 export const formatBytes = (bytes, decimals = 2) => {
   if (bytes === 0) return "0 bytes";
   const k = 1024;
@@ -176,7 +209,7 @@ export const formatPrice = (n) => {
 };
 
 export const openUrl = (url) => {
-  window.open(url, "_blank", "noopener,noreferrer");
+  window.open(url, "_blank", "noreferrer");
 };
 
 export const sounds = {

web/src/components/Account.jsx

@@ -39,13 +39,12 @@ import EditIcon from "@mui/icons-material/Edit";
 import { Trans, useTranslation } from "react-i18next";
 import DeleteOutlineIcon from "@mui/icons-material/DeleteOutline";
 import InfoOutlinedIcon from "@mui/icons-material/InfoOutlined";
-import humanizeDuration from "humanize-duration";
 import CelebrationIcon from "@mui/icons-material/Celebration";
 import CloseIcon from "@mui/icons-material/Close";
 import { ContentCopy, Public } from "@mui/icons-material";
 import AddIcon from "@mui/icons-material/Add";
 import routes from "./routes";
-import { copyToClipboard, formatBytes, formatShortDate, formatShortDateTime, openUrl } from "../app/utils";
+import { copyToClipboard, formatBytes, formatShortDate, formatShortDateTime, formatShortDuration, openUrl } from "../app/utils";
 import accountApi, { LimitBasis, Role, SubscriptionInterval, SubscriptionStatus } from "../app/AccountApi";
 import { Pref, PrefGroup } from "./Pref";
 import db from "../app/db";
@@ -53,7 +52,7 @@ import UpgradeDialog from "./UpgradeDialog";
 import { AccountContext } from "./App";
 import DialogFooter from "./DialogFooter";
 import { Paragraph } from "./styles";
-import { IncorrectPasswordError, UnauthorizedError } from "../app/errors";
+import { EmailVerificationCodeInvalidError, IncorrectPasswordError, UnauthorizedError } from "../app/errors";
 import { ProChip } from "./SubscriptionPopup";
 import session from "../app/Session";
 
@@ -84,6 +83,7 @@ const Basics = () => {
       <PrefGroup>
         <Username />
         <ChangePassword />
+        <Emails />
         <PhoneNumbers />
         <AccountType />
       </PrefGroup>
@@ -354,6 +354,200 @@ const AccountType = () => {
   );
 };
 
+const Emails = () => {
+  const { t } = useTranslation();
+  const { account } = useContext(AccountContext);
+  const [dialogKey, setDialogKey] = useState(0);
+  const [dialogOpen, setDialogOpen] = useState(false);
+  const [snackOpen, setSnackOpen] = useState(false);
+  const labelId = "prefVerifiedEmails";
+
+  const handleDialogOpen = () => {
+    setDialogKey((prev) => prev + 1);
+    setDialogOpen(true);
+  };
+
+  const handleDialogClose = () => {
+    setDialogOpen(false);
+  };
+
+  const handleCopy = (email) => {
+    copyToClipboard(email);
+    setSnackOpen(true);
+  };
+
+  const handleDelete = async (email) => {
+    try {
+      await accountApi.deleteEmail(email);
+    } catch (e) {
+      console.log(`[Account] Error deleting email`, e);
+      if (e instanceof UnauthorizedError) {
+        await session.resetAndRedirect(routes.login);
+      }
+    }
+  };
+
+  if (!config.enable_email_verify) {
+    return null;
+  }
+
+  if (account?.limits.emails === 0) {
+    return (
+      <Pref
+        title={
+          <>
+            {t("account_basics_emails_title")}
+            {config.enable_payments && <ProChip />}
+          </>
+        }
+        description={t("account_basics_emails_description")}
+      >
+        <em>{t("account_usage_emails_none")}</em>
+      </Pref>
+    );
+  }
+
+  return (
+    <Pref labelId={labelId} title={t("account_basics_emails_title")} description={t("account_basics_emails_description")}>
+      <div aria-labelledby={labelId}>
+        {account?.emails?.map((email) => (
+          <Chip
+            key={email}
+            label={
+              <Tooltip title={t("common_copy_to_clipboard")}>
+                <span>{email}</span>
+              </Tooltip>
+            }
+            variant="outlined"
+            onClick={() => handleCopy(email)}
+            onDelete={() => handleDelete(email)}
+          />
+        ))}
+        {!account?.emails && <em>{t("account_basics_emails_no_emails_yet")}</em>}
+        <IconButton onClick={handleDialogOpen}>
+          <AddIcon />
+        </IconButton>
+      </div>
+      <AddEmailDialog key={`addEmailDialog${dialogKey}`} open={dialogOpen} onClose={handleDialogClose} />
+      <Portal>
+        <Snackbar
+          open={snackOpen}
+          autoHideDuration={3000}
+          onClose={() => setSnackOpen(false)}
+          message={t("account_basics_emails_copied_to_clipboard")}
+        />
+      </Portal>
+    </Pref>
+  );
+};
+
+const AddEmailDialog = (props) => {
+  const theme = useTheme();
+  const { t } = useTranslation();
+  const [error, setError] = useState("");
+  const [email, setEmail] = useState("");
+  const [code, setCode] = useState("");
+  const [sending, setSending] = useState(false);
+  const [verificationCodeSent, setVerificationCodeSent] = useState(false);
+  const fullScreen = useMediaQuery(theme.breakpoints.down("sm"));
+
+  const verifyEmail = async () => {
+    try {
+      setSending(true);
+      await accountApi.verifyEmail(email);
+      setVerificationCodeSent(true);
+    } catch (e) {
+      console.log(`[Account] Error sending email verification`, e);
+      if (e instanceof UnauthorizedError) {
+        await session.resetAndRedirect(routes.login);
+      } else {
+        setError(e.message);
+      }
+    } finally {
+      setSending(false);
+    }
+  };
+
+  const checkVerifyEmail = async () => {
+    try {
+      setSending(true);
+      await accountApi.addEmail(email, code);
+      props.onClose();
+    } catch (e) {
+      console.log(`[Account] Error confirming email verification`, e);
+      if (e instanceof UnauthorizedError) {
+        await session.resetAndRedirect(routes.login);
+      } else if (e instanceof EmailVerificationCodeInvalidError) {
+        setError(t("account_basics_emails_dialog_code_invalid"));
+      } else {
+        setError(e.message);
+      }
+    } finally {
+      setSending(false);
+    }
+  };
+
+  const handleDialogSubmit = async () => {
+    if (!verificationCodeSent) {
+      await verifyEmail();
+    } else {
+      await checkVerifyEmail();
+    }
+  };
+
+  const handleCancel = () => {
+    if (verificationCodeSent) {
+      setVerificationCodeSent(false);
+      setCode("");
+    } else {
+      props.onClose();
+    }
+  };
+
+  return (
+    <Dialog open={props.open} onClose={props.onCancel} fullScreen={fullScreen}>
+      <DialogTitle>{t("account_basics_emails_dialog_title")}</DialogTitle>
+      <DialogContent>
+        <DialogContentText>{t("account_basics_emails_dialog_description")}</DialogContentText>
+        {!verificationCodeSent && (
+          <TextField
+            margin="dense"
+            label={t("account_basics_emails_dialog_email_label")}
+            aria-label={t("account_basics_emails_dialog_email_label")}
+            placeholder={t("account_basics_emails_dialog_email_placeholder")}
+            type="email"
+            value={email}
+            onChange={(ev) => setEmail(ev.target.value)}
+            fullWidth
+            variant="standard"
+          />
+        )}
+        {verificationCodeSent && (
+          <TextField
+            margin="dense"
+            label={t("account_basics_emails_dialog_code_label")}
+            aria-label={t("account_basics_emails_dialog_code_label")}
+            placeholder={t("account_basics_emails_dialog_code_placeholder")}
+            type="text"
+            value={code}
+            onChange={(ev) => setCode(ev.target.value)}
+            fullWidth
+            inputProps={{ inputMode: "numeric", pattern: "[0-9]*" }}
+            variant="standard"
+          />
+        )}
+      </DialogContent>
+      <DialogFooter status={error}>
+        <Button onClick={handleCancel}>{verificationCodeSent ? t("common_back") : t("common_cancel")}</Button>
+        <Button onClick={handleDialogSubmit} disabled={sending || !/^[^\s,;]+@[^\s,;]+$/.test(email)}>
+          {!verificationCodeSent && t("account_basics_emails_dialog_verify_button")}
+          {verificationCodeSent && t("account_basics_emails_dialog_check_verification_button")}
+        </Button>
+      </DialogFooter>
+    </Dialog>
+  );
+};
+
 const PhoneNumbers = () => {
   const { t } = useTranslation();
   const { account } = useContext(AccountContext);
@@ -701,10 +895,7 @@ const Stats = () => {
           title={t("account_usage_attachment_storage_title")}
           description={t("account_usage_attachment_storage_description", {
             filesize: formatBytes(account.limits.attachment_file_size),
-            expiry: humanizeDuration(account.limits.attachment_expiry_duration * 1000, {
-              language: i18n.resolvedLanguage,
-              fallbacks: ["en"],
-            }),
+            expiry: formatShortDuration(account.limits.attachment_expiry_duration * 1000, i18n.resolvedLanguage),
           })}
         >
           <div>
@@ -750,7 +941,9 @@ const Stats = () => {
         )}
       </PrefGroup>
       {account.role === Role.USER && account.limits.basis === LimitBasis.IP && (
-        <Typography variant="body1">{t("account_usage_basis_ip_description")}</Typography>
+        <Typography variant="body1" sx={{ pt: 3 }}>
+          {t("account_usage_basis_ip_description")}
+        </Typography>
       )}
     </Card>
   );
@@ -859,87 +1052,94 @@ const TokensTable = (props) => {
         </TableRow>
       </TableHead>
       <TableBody>
-        {tokens.map((token) => (
-          <TableRow key={token.token} sx={{ "&:last-child td, &:last-child th": { border: 0 } }}>
-            <TableCell
-              component="th"
-              scope="row"
-              sx={{ paddingLeft: 0, whiteSpace: "nowrap" }}
-              aria-label={t("account_tokens_table_token_header")}
-            >
-              <span>
-                <span style={{ fontFamily: "Monospace", fontSize: "0.9rem" }}>{token.token.slice(0, 12)}</span>
-                ...
-                <Tooltip title={t("common_copy_to_clipboard")} placement="right">
-                  <IconButton onClick={() => handleCopy(token.token)}>
-                    <ContentCopy />
-                  </IconButton>
-                </Tooltip>
-              </span>
-            </TableCell>
-            <TableCell aria-label={t("account_tokens_table_label_header")}>
-              {token.token === session.token() && <em>{t("account_tokens_table_current_session")}</em>}
-              {token.token !== session.token() && (token.label || "-")}
-            </TableCell>
-            <TableCell sx={{ whiteSpace: "nowrap" }} aria-label={t("account_tokens_table_expires_header")}>
-              {token.expires ? formatShortDateTime(token.expires, i18n.language) : <em>{t("account_tokens_table_never_expires")}</em>}
-            </TableCell>
-            <TableCell sx={{ whiteSpace: "nowrap" }} aria-label={t("account_tokens_table_last_access_header")}>
-              <div style={{ display: "flex", alignItems: "center" }}>
-                <span>{formatShortDateTime(token.last_access, i18n.language)}</span>
-                <Tooltip
-                  title={t("account_tokens_table_last_origin_tooltip", {
-                    ip: token.last_origin,
-                  })}
-                >
-                  <IconButton onClick={() => openUrl(`https://whatismyipaddress.com/ip/${token.last_origin}`)}>
-                    <Public />
-                  </IconButton>
-                </Tooltip>
-              </div>
-            </TableCell>
-            <TableCell align="right" sx={{ whiteSpace: "nowrap" }}>
-              {token.token !== session.token() && !token.provisioned && (
-                <>
-                  <Tooltip title={t("account_tokens_dialog_title_edit")}>
-                    <IconButton onClick={() => handleEditClick(token)} aria-label={t("account_tokens_dialog_title_edit")}>
-                      <EditIcon />
+        {tokens.map((token) => {
+          const hasLastAccess = Number.isFinite(token.last_access) && token.last_access > 0;
+          const hasLastOrigin = !!token.last_origin;
+
+          return (
+            <TableRow key={token.token} sx={{ "&:last-child td, &:last-child th": { border: 0 } }}>
+              <TableCell
+                component="th"
+                scope="row"
+                sx={{ paddingLeft: 0, whiteSpace: "nowrap" }}
+                aria-label={t("account_tokens_table_token_header")}
+              >
+                <span>
+                  <span style={{ fontFamily: "Monospace", fontSize: "0.9rem" }}>{token.token.slice(0, 12)}</span>
+                  ...
+                  <Tooltip title={t("common_copy_to_clipboard")} placement="right">
+                    <IconButton onClick={() => handleCopy(token.token)}>
+                      <ContentCopy />
                     </IconButton>
                   </Tooltip>
-                  <Tooltip title={t("account_tokens_dialog_title_delete")}>
-                    <IconButton onClick={() => handleDeleteClick(token)} aria-label={t("account_tokens_dialog_title_delete")}>
-                      <CloseIcon />
-                    </IconButton>
+                </span>
+              </TableCell>
+              <TableCell aria-label={t("account_tokens_table_label_header")}>
+                {token.token === session.token() && <em>{t("account_tokens_table_current_session")}</em>}
+                {token.token !== session.token() && (token.label || "-")}
+              </TableCell>
+              <TableCell sx={{ whiteSpace: "nowrap" }} aria-label={t("account_tokens_table_expires_header")}>
+                {token.expires ? formatShortDateTime(token.expires, i18n.language) : <em>{t("account_tokens_table_never_expires")}</em>}
+              </TableCell>
+              <TableCell sx={{ whiteSpace: "nowrap" }} aria-label={t("account_tokens_table_last_access_header")}>
+                <div style={{ display: "flex", alignItems: "center" }}>
+                  {hasLastAccess ? <span>{formatShortDateTime(token.last_access, i18n.language)}</span> : <em>-</em>}
+                  {hasLastOrigin && (
+                    <Tooltip
+                      title={t("account_tokens_table_last_origin_tooltip", {
+                        ip: token.last_origin,
+                      })}
+                    >
+                      <IconButton onClick={() => openUrl(`https://whatismyipaddress.com/ip/${token.last_origin}`)}>
+                        <Public />
+                      </IconButton>
+                    </Tooltip>
+                  )}
+                </div>
+              </TableCell>
+              <TableCell align="right" sx={{ whiteSpace: "nowrap" }}>
+                {token.token !== session.token() && !token.provisioned && (
+                  <>
+                    <Tooltip title={t("account_tokens_dialog_title_edit")}>
+                      <IconButton onClick={() => handleEditClick(token)} aria-label={t("account_tokens_dialog_title_edit")}>
+                        <EditIcon />
+                      </IconButton>
+                    </Tooltip>
+                    <Tooltip title={t("account_tokens_dialog_title_delete")}>
+                      <IconButton onClick={() => handleDeleteClick(token)} aria-label={t("account_tokens_dialog_title_delete")}>
+                        <CloseIcon />
+                      </IconButton>
+                    </Tooltip>
+                  </>
+                )}
+                {token.token === session.token() && (
+                  <Tooltip title={t("account_tokens_table_cannot_delete_or_edit")}>
+                    <span>
+                      <IconButton disabled>
+                        <EditIcon />
+                      </IconButton>
+                      <IconButton disabled>
+                        <CloseIcon />
+                      </IconButton>
+                    </span>
                   </Tooltip>
-                </>
-              )}
-              {token.token === session.token() && (
-                <Tooltip title={t("account_tokens_table_cannot_delete_or_edit")}>
-                  <span>
-                    <IconButton disabled>
-                      <EditIcon />
-                    </IconButton>
-                    <IconButton disabled>
-                      <CloseIcon />
-                    </IconButton>
-                  </span>
-                </Tooltip>
-              )}
-              {token.provisioned && (
-                <Tooltip title={t("account_tokens_table_cannot_delete_or_edit_provisioned_token")}>
-                  <span>
-                    <IconButton disabled>
-                      <EditIcon />
-                    </IconButton>
-                    <IconButton disabled>
-                      <CloseIcon />
-                    </IconButton>
-                  </span>
-                </Tooltip>
-              )}
-            </TableCell>
-          </TableRow>
-        ))}
+                )}
+                {token.provisioned && (
+                  <Tooltip title={t("account_tokens_table_cannot_delete_or_edit_provisioned_token")}>
+                    <span>
+                      <IconButton disabled>
+                        <EditIcon />
+                      </IconButton>
+                      <IconButton disabled>
+                        <CloseIcon />
+                      </IconButton>
+                    </span>
+                  </Tooltip>
+                )}
+              </TableCell>
+            </TableRow>
+          );
+        })}
       </TableBody>
       <Portal>
         <Snackbar

web/src/components/AttachmentIcon.jsx

@@ -31,18 +31,24 @@ const AttachmentIcon = (props) => {
     imageFile = fileDocument;
     imageLabel = t("notifications_attachment_file_document");
   }
+  const icon = (
+    <Box
+      component="img"
+      src={imageFile}
+      alt={imageLabel}
+      loading="lazy"
+      sx={{
+        width: "28px",
+        height: "28px",
+      }}
+    />
+  );
+  if (!props.href) {
+    return icon;
+  }
   return (
-    <Link href={props.href} target="_blank">
-      <Box
-        component="img"
-        src={imageFile}
-        alt={imageLabel}
-        loading="lazy"
-        sx={{
-          width: "28px",
-          height: "28px",
-        }}
-      />
+    <Link href={props.href} target="_blank" rel="noopener noreferrer">
+      {icon}
     </Link>
   );
 };

web/src/components/ErrorBoundary.jsx

@@ -1,6 +1,5 @@
 import * as React from "react";
-import StackTrace from "stacktrace-js";
-import { CircularProgress, Link, Button } from "@mui/material";
+import { Link, Button } from "@mui/material";
 import { Trans, withTranslation } from "react-i18next";
 import { copyToClipboard } from "../app/utils";
 
@@ -9,8 +8,7 @@ class ErrorBoundaryImpl extends React.Component {
     super(props);
     this.state = {
       error: false,
-      originalStack: null,
-      niceStack: null,
+      stack: null,
       unsupportedIndexedDB: false,
     };
   }
@@ -32,23 +30,17 @@ class ErrorBoundaryImpl extends React.Component {
   }
 
   handleError(error, info) {
-    // Immediately render original stack trace
-    const prettierOriginalStack = info.componentStack
+    const componentStack = info.componentStack
       .trim()
       .split("\n")
       .map((line) => `  at ${line}`)
       .join("\n");
+    const parts = [error.toString()];
+    if (error.stack) parts.push(error.stack);
+    parts.push(componentStack);
     this.setState({
       error: true,
-      originalStack: `${error.toString()}\n${prettierOriginalStack}`,
-    });
-
-    // Fetch additional info and a better stack trace
-    StackTrace.fromError(error).then((stack) => {
-      console.error("[ErrorBoundary] Stacktrace fetched", stack);
-      const stackString = stack.map((el) => `  at ${el.functionName} (${el.fileName}:${el.columnNumber}:${el.lineNumber})`).join("\n");
-      const niceStack = `${error.toString()}\n${stackString}`;
-      this.setState({ niceStack });
+      stack: parts.join("\n"),
     });
   }
 
@@ -60,12 +52,7 @@ class ErrorBoundaryImpl extends React.Component {
   }
 
   copyStack() {
-    let stack = "";
-    if (this.state.niceStack) {
-      stack += `${this.state.niceStack}\n\n`;
-    }
-    stack += `${this.state.originalStack}\n`;
-    copyToClipboard(stack);
+    copyToClipboard(`${this.state.stack}\n`);
   }
 
   renderUnsupportedIndexedDB() {
@@ -112,14 +99,7 @@ class ErrorBoundaryImpl extends React.Component {
           </Button>
         </div>
         <h3>{t("error_boundary_stack_trace")}</h3>
-        {this.state.niceStack ? (
-          <pre>{this.state.niceStack}</pre>
-        ) : (
-          <>
-            <CircularProgress size="20px" sx={{ verticalAlign: "text-bottom" }} /> {t("error_boundary_gathering_info")}
-          </>
-        )}
-        <pre>{this.state.originalStack}</pre>
+        <pre>{this.state.stack}</pre>
       </div>
     );
   }

web/src/components/Navigation.jsx

@@ -117,7 +117,8 @@ const NavList = (props) => {
 
   const isAdmin = account?.role === Role.ADMIN;
   const isPaid = account?.billing?.subscription;
-  const showUpgradeBanner = config.enable_payments && !isAdmin && !isPaid;
+  const hasTier = !!account?.tier;
+  const showUpgradeBanner = config.enable_payments && !isAdmin && !isPaid && !hasTier;
   const showSubscriptionsList = props.subscriptions?.length > 0;
   const showNotificationPermissionRequired = useNotificationPermissionListener(() => notifier.notRequested());
   const showNotificationPermissionDenied = useNotificationPermissionListener(() => notifier.denied());

web/src/components/Notifications.jsx

@@ -164,7 +164,7 @@ const autolink = (s) => {
   const parts = s.split(/(\bhttps?:\/\/[-A-Z0-9+\u0026\u2019@#/%?=()~_|!:,.;]*[-A-Z0-9+\u0026@#/%=~()_|]\b)/gi);
   for (let i = 1; i < parts.length; i += 2) {
     parts[i] = (
-      <Link key={i} href={parts[i]} underline="hover" target="_blank" rel="noreferrer,noopener">
+      <Link key={i} href={parts[i]} underline="hover" target="_blank" rel="noreferrer">
         {shortUrl(parts[i])}
       </Link>
     );

web/src/components/PublishDialog.jsx

@@ -30,6 +30,7 @@ import priority3 from "../img/priority-3.svg";
 import priority4 from "../img/priority-4.svg";
 import priority5 from "../img/priority-5.svg";
 import { formatBytes, maybeWithAuth, topicShortUrl, topicUrl, validTopic, validUrl } from "../app/utils";
+import { imageRegex } from "../app/notificationUtils";
 import AttachmentIcon from "./AttachmentIcon";
 import DialogFooter from "./DialogFooter";
 import api from "../app/Api";
@@ -805,7 +806,7 @@ const AttachmentBox = (props) => {
           borderRadius: "4px",
         }}
       >
-        <AttachmentIcon type={file.type} href={URL.createObjectURL(file)} />
+        <AttachmentIcon type={file.type} href={imageRegex.test(file.name) ? URL.createObjectURL(file) : undefined} />
         <Box sx={{ marginLeft: 1, textAlign: "left" }}>
           <ExpandingTextField
             minWidth={140}

web/src/components/hooks.js

@@ -13,7 +13,7 @@ import versionChecker from "../app/VersionChecker";
 import { UnauthorizedError } from "../app/errors";
 import notifier from "../app/Notifier";
 import prefs from "../app/Prefs";
-import { EVENT_MESSAGE_DELETE, EVENT_MESSAGE_CLEAR } from "../app/events";
+import { EVENT_MESSAGE_DELETE, EVENT_MESSAGE_CLEAR, SW_PERIODIC_SYNC_EXTEND_TOKEN_TAG } from "../app/events";
 
 /**
  * Wire connectionManager and subscriptionManager so that subscriptions are updated when the connection
@@ -283,6 +283,52 @@ export const useStandaloneWebPushAutoSubscribe = () => {
   }, [isLaunchedPWA]);
 };
 
+/**
+ * Registers a periodicsync listener for `extend_token` (see sw.js).
+ * This extends the token regardless of whether the browser is open.
+ *
+ * CAVEATS:
+ * - Chromium-only
+ * - Only when the PWA is _installed_ (not just running in a browser tab)
+ * - Only when notifications are granted
+ *
+ * This is an experimental feature:
+ * https://developer.mozilla.org/en-US/docs/Web/API/Web_Periodic_Background_Synchronization_API
+ */
+const usePeriodicTokenExtend = () => {
+  const isLaunchedPWA = useIsLaunchedPWA();
+  const pushPossible = useNotificationPermissionListener(() => notifier.pushPossible());
+
+  useEffect(() => {
+    (async () => {
+      if (!isLaunchedPWA) {
+        console.debug("[usePeriodicTokenExtend] Skipping: Not running as PWA");
+        return;
+      }
+
+      if (!pushPossible) {
+        console.debug("[usePeriodicTokenExtend] Skipping: Web push not possible or granted");
+        return;
+      }
+
+      try {
+        const registration = await navigator.serviceWorker.ready;
+        if (!registration.periodicSync) {
+          console.debug("[usePeriodicTokenExtend] Skipping: Periodic Sync not supported");
+          return;
+        }
+
+        console.log(`[usePeriodicTokenExtend] Turning on periodicsync "${SW_PERIODIC_SYNC_EXTEND_TOKEN_TAG}"`);
+        await registration.periodicSync.register(SW_PERIODIC_SYNC_EXTEND_TOKEN_TAG, {
+          minInterval: 12 * 60 * 60 * 1000, // 12 hours
+        });
+      } catch (error) {
+        console.log("[usePeriodicTokenExtend] Periodic Sync could not be registered", error);
+      }
+    })();
+  }, [isLaunchedPWA, pushPossible]);
+};
+
 /**
  * Start the poller and the pruner. This is done in a side effect as opposed to just in Pruner.js
  * and Poller.js, because side effect imports are not a thing in JS, and "Optimize imports" cleans
@@ -305,6 +351,7 @@ const stopWorkers = () => {
 
 export const useBackgroundProcesses = () => {
   useStandaloneWebPushAutoSubscribe();
+  usePeriodicTokenExtend();
 
   useEffect(() => {
     console.log("[useBackgroundProcesses] mounting");