MCM-16 — Web Push Notification

← Back to Notification System overview

As a FinOps User,
I want my browser to show a push notification when a budget threshold is exceeded, even if I have minimised the MCM tab,
so that I can respond to cost overruns without continuously watching the dashboard.

Acceptance Criteria

• On first login (or via an "Enable Browser Notifications" prompt in user preferences), the browser requests Push Notification permission using the Web Push API (VAPID).
• The user can enable or disable Web Push notifications at any time from their profile settings, with per-category granularity (see Notification Preferences).
• The platform saves the PushSubscription endpoint on the server, scoped to the user and device.
• When a qualifying event fires, the server sends a push message via the Web Push protocol to all active subscriptions for that user.
• Each push notification shows: MCM logo, notification title, short body text, and a timestamp.
• Clicking the push notification opens the MCM tab (or a new tab if none is open) and navigates directly to the relevant resource page.
• Push notifications are delivered even when the MCM tab is closed, provided the browser is running.
• If the user has not granted permission, the feature degrades silently — no repeated prompts after a first denial.
• Subscriptions that return a 410 Gone response from the push service are automatically removed from the server.

---

Technical Design

This story adds Web Push delivery using the browser's Push API with VAPID keys, rotated at most every 12 months. Accepting the permission prompt saves a PushSubscription (endpoint, keys, user, device) via POST /api/push-subscriptions; a 410 Gone response from the push service on a later send triggers immediate removal via DELETE /api/push-subscriptions/{id} as part of the send path itself, not a separate cleanup job. Permission is requested at most once — a denial is respected permanently unless the user re-enables the channel from profile settings.

---

UI / Frontend Changes

• "Enable Browser Notifications" prompt in user profile settings, triggering the browser's native Push permission dialog on first login.
• Per-category toggle for Web Push, alongside In-App and Email, in the Notification Preferences matrix.
• Native OS/browser push notification UI (MCM logo, title, short body, timestamp) rather than a custom in-app component.
• No repeated permission prompts after a first denial — the enable control in profile settings is the only re-entry point.
• Clicking a push notification opens or focuses the MCM tab and deep-links to the relevant resource page.