Merge pull request #46 from AndreaPrestia/feat/mobile-rn-port

# feat(mobile): porting React Native + semplificazione UI cross-platform (Phase 1-4)

Author: AndreaPrestia

.github/workflows/ci.yml

@@ -61,6 +61,28 @@ jobs:
           VITE_API_BASE_URL: /api
         run: npm run build
 
+  mobile:
+    name: Mobile (typecheck + jest)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node 22
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - name: Install monorepo deps
+        run: npm ci --legacy-peer-deps
+
+      - name: Typecheck mobile
+        working-directory: mobile
+        run: npm run typecheck
+
+      - name: Jest mobile
+        working-directory: mobile
+        run: npm test -- --ci --reporters=default
+
   e2e:
     name: E2E (Playwright)
     runs-on: ubuntu-latest
@@ -82,17 +104,22 @@ jobs:
         run: docker compose up -d --build
 
       - name: Attendi che backend e frontend rispondano
+        env:
+          # Serve anche qui: il fallback esegue `docker compose logs` che re-interpola compose.yml.
+          Encryption__MasterKey: ${{ secrets.E2E_ENCRYPTION_KEY || 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=' }}
         run: |
-          for i in $(seq 1 60); do
-            if curl -sf http://localhost:8080/health > /dev/null && curl -sf http://localhost:5173/ > /dev/null; then
-              echo "Stack pronto."
+          for i in $(seq 1 120); do
+            if curl -sf http://localhost:8088/health > /dev/null && curl -sf http://localhost:5173/ > /dev/null; then
+              echo "Stack pronto dopo $((i*2))s."
               exit 0
             fi
             sleep 2
           done
-          echo "Stack non pronto in tempo." >&2
-          docker compose logs --tail=80 backend
-          docker compose logs --tail=40 frontend
+          echo "Stack non pronto in tempo (240s)." >&2
+          docker compose ps
+          docker compose logs --tail=200 backend
+          docker compose logs --tail=80 frontend
+          docker compose logs --tail=40 db
           exit 1
 
       - name: Install frontend deps
@@ -127,6 +154,9 @@ jobs:
 
       - name: Dump container logs on failure
         if: failure()
+        env:
+          # Serve anche qui per la stessa ragione (docker compose logs re-interpola).
+          Encryption__MasterKey: ${{ secrets.E2E_ENCRYPTION_KEY || 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=' }}
         run: |
           docker compose ps
           docker compose logs --tail=200 backend

.github/workflows/security.yml

@@ -31,7 +31,7 @@ jobs:
             context: .
             dockerfile: ./backend/Dockerfile
           - name: frontend
-            context: ./frontend
+            context: .
             dockerfile: ./frontend/Dockerfile
           - name: web
             context: ./web

backend/src/Accanto.Api/Controllers/AccountController.cs

@@ -3,6 +3,7 @@
 using Accanto.Application.Auth;
 using Accanto.Application.Auth.TwoFactor;
 using Accanto.Application.Notifications;
+using Accanto.Application.Push;
 using Accanto.Application.Security;
 using Accanto.Application.Wellbeing;
 using Accanto.Domain.Enums;
@@ -25,6 +26,8 @@ public class AccountController : ControllerBase
     private readonly ISecurityAuditLog _audit;
     private readonly ISecurityAuditQueryService _auditQuery;
     private readonly ICheckInService _checkIns;
+    private readonly IDevicePushTokenService _devicePushTokens;
+    private readonly ICircleMobilePushNotifier _mobilePush;
     private readonly ICurrentUser _currentUser;
 
     public AccountController(
@@ -36,6 +39,8 @@ public AccountController(
         ISecurityAuditLog audit,
         ISecurityAuditQueryService auditQuery,
         ICheckInService checkIns,
+        IDevicePushTokenService devicePushTokens,
+        ICircleMobilePushNotifier mobilePush,
         ICurrentUser currentUser)
     {
         _svc = svc;
@@ -46,9 +51,10 @@ public AccountController(
         _audit = audit;
         _auditQuery = auditQuery;
         _checkIns = checkIns;
+        _devicePushTokens = devicePushTokens;
+        _mobilePush = mobilePush;
         _currentUser = currentUser;
     }
-
     [HttpPost("change-password")]
     [EnableRateLimiting("auth-sensitive")]
     public async Task<IActionResult> ChangePassword([FromBody] ChangePasswordRequest request, CancellationToken ct)
@@ -174,6 +180,57 @@ public async Task<IActionResult> DeleteCheckIn(Guid id, CancellationToken ct)
         return NoContent();
     }
 
+    // ---------- Mobile push devices (Expo) ----------
+
+    [HttpGet("push-devices")]
+    public async Task<ActionResult<IReadOnlyList<DevicePushTokenDto>>> ListPushDevices(CancellationToken ct)
+        => Ok(await _devicePushTokens.ListAsync(_currentUser.RequireUserId(), ct));
+
+    [HttpPost("push-devices")]
+    public async Task<ActionResult<DevicePushTokenDto>> RegisterPushDevice([FromBody] RegisterDevicePushTokenRequest request, CancellationToken ct)
+    {
+        var dto = await _devicePushTokens.RegisterAsync(_currentUser.RequireUserId(), request, ct);
+        return Ok(dto);
+    }
+
+    [HttpDelete("push-devices/{id:guid}")]
+    public async Task<IActionResult> DeletePushDeviceById(Guid id, CancellationToken ct)
+    {
+        await _devicePushTokens.RemoveByIdAsync(_currentUser.RequireUserId(), id, ct);
+        return NoContent();
+    }
+
+    /// <summary>
+    /// Cancellazione "by token" usata dal client mobile in fase di
+    /// logout: il device conosce il proprio token Expo ma non il GUID
+    /// del record DB.
+    /// </summary>
+    [HttpDelete("push-devices")]
+    public async Task<IActionResult> DeletePushDeviceByToken([FromBody] DeletePushDeviceRequest request, CancellationToken ct)
+    {
+        if (request is null || string.IsNullOrWhiteSpace(request.Token)) return BadRequest();
+        await _devicePushTokens.RemoveByTokenAsync(_currentUser.RequireUserId(), request.Token, ct);
+        return NoContent();
+    }
+
+    /// <summary>
+    /// Invia una notifica push di prova a tutti i device dell'utente
+    /// corrente. Bypassa le preferenze (testare la connessione non deve
+    /// essere silenziato dai topic flags). Utile per validare end-to-end
+    /// la pipeline (token registrato, Expo push service, APNs/FCM).
+    /// </summary>
+    [HttpPost("push-devices/test")]
+    [EnableRateLimiting("auth-sensitive")]
+    public async Task<IActionResult> SendTestPush(CancellationToken ct)
+    {
+        await _mobilePush.SendTestAsync(
+            _currentUser.RequireUserId(),
+            "Accanto",
+            "Notifica di prova: tutto funziona \ud83c\udf89",
+            ct);
+        return Accepted();
+    }
+
     private ClientInfo BuildClientInfo()
     {
         var ua = Request.Headers.UserAgent.ToString();

backend/src/Accanto.Api/Controllers/SharedUpdatesController.cs

@@ -51,5 +51,9 @@ public class SharedUpdateTemplatesController : ControllerBase
     public SharedUpdateTemplatesController(ISharedUpdateTemplateProvider provider) { _provider = provider; }
 
     [HttpGet]
-    public ActionResult<IReadOnlyList<SharedUpdateTemplateDto>> Get() => Ok(_provider.GetTemplates());
+    public ActionResult<IReadOnlyList<SharedUpdateTemplateDto>> Get()
+    {
+        var acceptLanguage = Request.Headers.AcceptLanguage.ToString();
+        return Ok(_provider.GetTemplates(acceptLanguage));
+    }
 }

backend/src/Accanto.Api/Middleware/RequireTwoFactorForOwnersMiddleware.cs

@@ -23,9 +23,14 @@ public sealed class RequireTwoFactorForOwnersMiddleware
 {
     // Path che restano accessibili anche con 2FA-required scaduto. Match per
     // prefisso, case-insensitive. Tenere il minimo indispensabile.
+    //
+    // NB: sia il path esatto (`/api/account/2fa` per la GET dello status)
+    // sia il subtree (`/api/account/2fa/setup`, `/enable`, `/disable`, ecc.)
+    // devono essere in bypass; altrimenti l'Owner scaduto non pu\u00f2 nemmeno
+    // leggere lo stato per uscire dal blocco (deadlock UI).
     private static readonly string[] BypassPrefixes =
     {
-        "/api/account/2fa/",      // setup, enable, disable, status, recovery codes
+        "/api/account/2fa",       // stato (GET) + tutti i sub-path (setup, enable, ...)
         "/api/account/me",        // serve per leggere lo stato e fare logout dal frontend
         "/api/auth/logout",
         "/api/auth/refresh",
@@ -146,8 +151,8 @@ private static async Task WriteForbiddenAsync(HttpContext ctx, DateTimeOffset de
         var pd = new ProblemDetails
         {
             Status = StatusCodes.Status403Forbidden,
-            Title = "Autenticazione a due fattori obbligatoria.",
-            Detail = $"In quanto Owner di almeno un care circle devi configurare 2FA. " +
+            Title = "Verifica in due passaggi obbligatoria.",
+            Detail = $"In quanto Owner di almeno un care circle devi attivare la verifica in due passaggi. " +
                      $"Grace scaduta il {deadline:o}. Visita /account/security/2fa per attivarla.",
             Type = "https://accanto.care/errors/two-factor-required"
         };

backend/src/Accanto.Application/ApplicationServiceCollectionExtensions.cs

@@ -9,6 +9,7 @@
 using Accanto.Application.Documents;
 using Accanto.Application.Invites;
 using Accanto.Application.Notifications;
+using Accanto.Application.Push;
 using Accanto.Application.Security;
 using Accanto.Application.SharedUpdates;
 using Accanto.Application.Timeline;
@@ -42,6 +43,7 @@ public static IServiceCollection AddAccantoApplication(this IServiceCollection s
         services.AddScoped<IAuditService, AuditService>();
         services.AddScoped<ISecurityAuditQueryService, SecurityAuditQueryService>();
         services.AddScoped<INotificationPreferenceService, NotificationPreferenceService>();
+        services.AddScoped<IDevicePushTokenService, DevicePushTokenService>();
         services.AddScoped<ICheckInService, CheckInService>();
 
         services.AddSingleton<IDoctorQuestionTemplateProvider, StaticDoctorQuestionTemplateProvider>();

backend/src/Accanto.Application/Common/Persistence/IAccantoDbContext.cs

@@ -15,6 +15,7 @@ public interface IAccantoDbContext
     Microsoft.EntityFrameworkCore.DbSet<PushSubscription> PushSubscriptions { get; }
     Microsoft.EntityFrameworkCore.DbSet<AuditLogEntry> AuditLogEntries { get; }
     Microsoft.EntityFrameworkCore.DbSet<UserNotificationPreference> UserNotificationPreferences { get; }
+    Microsoft.EntityFrameworkCore.DbSet<DevicePushToken> DevicePushTokens { get; }
     Microsoft.EntityFrameworkCore.DbSet<RefreshToken> RefreshTokens { get; }
     Microsoft.EntityFrameworkCore.DbSet<PasswordResetToken> PasswordResetTokens { get; }
     Microsoft.EntityFrameworkCore.DbSet<SecurityAuditLogEntry> SecurityAuditLogEntries { get; }

backend/src/Accanto.Application/DoctorQuestions/DoctorQuestionService.cs

@@ -4,6 +4,7 @@
 using Accanto.Application.Common.Persistence;
 using Accanto.Application.Common.Validation;
 using Accanto.Application.Email;
+using Accanto.Application.Push;
 using Accanto.Domain.Entities;
 using Accanto.Domain.Enums;
 using FluentValidation;
@@ -17,6 +18,7 @@ public class DoctorQuestionService : IDoctorQuestionService
     private readonly ICareCircleAuthorization _auth;
     private readonly IAuditLog _audit;
     private readonly ICircleEmailNotifier _email;
+    private readonly ICircleMobilePushNotifier _mobilePush;
     private readonly IValidator<CreateDoctorQuestionRequest> _createValidator;
     private readonly IValidator<UpdateDoctorQuestionRequest> _updateValidator;
 
@@ -25,13 +27,15 @@ public DoctorQuestionService(
         ICareCircleAuthorization auth,
         IAuditLog audit,
         ICircleEmailNotifier email,
+        ICircleMobilePushNotifier mobilePush,
         IValidator<CreateDoctorQuestionRequest> createValidator,
         IValidator<UpdateDoctorQuestionRequest> updateValidator)
     {
         _db = db;
         _auth = auth;
         _audit = audit;
         _email = email;
+        _mobilePush = mobilePush;
         _createValidator = createValidator;
         _updateValidator = updateValidator;
     }
@@ -97,6 +101,18 @@ public async Task<DoctorQuestionDto> UpdateAsync(Guid userId, Guid careCircleId,
                 $"Domanda al medico aggiornata in {circleName}",
                 EmailTemplates.DoctorQuestionAnswered(circleName, q.Question),
                 CancellationToken.None);
+            _ = _mobilePush.NotifyCircleAsync(
+                careCircleId,
+                userId,
+                NotificationTopic.DoctorQuestionAnswered,
+                circleName,
+                "Una domanda al medico è stata aggiornata",
+                new Dictionary<string, string>
+                {
+                    ["circleId"] = careCircleId.ToString(),
+                    ["questionId"] = q.Id.ToString()
+                },
+                CancellationToken.None);
         }
 
         return Map(q);

backend/src/Accanto.Application/Email/EmailTemplates.cs

@@ -39,30 +39,30 @@ public static string PasswordChanged() =>
 
     public static string TwoFactorRequiredForOwner(string circleName, DateTimeOffset deadlineUtc) =>
         Layout(
-            "2FA obbligatorio per ruolo Owner",
+            "Verifica in due passaggi obbligatoria per ruolo Owner",
             $"<p>Sei diventato Owner del cerchio di cura <strong>{H(circleName)}</strong>.</p>" +
-            $"<p>Per ragioni di sicurezza l'autenticazione a due fattori (2FA) è obbligatoria " +
+            $"<p>Per ragioni di sicurezza la verifica in due passaggi è obbligatoria " +
             $"per chi è Owner di almeno un care circle.</p>" +
             $"<p><strong>Hai tempo fino al {H(deadlineUtc.ToString("dd/MM/yyyy HH:mm"))} UTC</strong> " +
             $"per attivarla; dopo tale data l'accesso alle funzionalità del cerchio sarà bloccato " +
             $"finché non avrai completato la configurazione.</p>" +
-            $"<p>Vai su <em>Account → Sicurezza → Autenticazione a due fattori</em> per attivarla " +
+            $"<p>Vai su <em>Account → Verifica in due passaggi</em> per attivarla " +
             $"con la tua app authenticator preferita.</p>");
 
     public static string TwoFactorEnabled() =>
         Layout(
-            "2FA attivata",
-            "<p>L'autenticazione a due fattori è stata appena attivata sul tuo account Accanto.</p>" +
+            "Verifica in due passaggi attivata",
+            "<p>La verifica in due passaggi è stata appena attivata sul tuo account Accanto.</p>" +
             "<p>Conserva i codici di recupero in un luogo sicuro e offline: ti serviranno se perdi " +
             "l'accesso alla tua app authenticator.</p>" +
-            "<p>Se non sei stato tu, accedi subito e disattiva 2FA (serve la password) oppure " +
+            "<p>Se non sei stato tu, accedi subito e disattivala (serve la password) oppure " +
             "contatta supporto.</p>");
 
     public static string TwoFactorDisabled() =>
         Layout(
-            "2FA disattivata",
-            "<p>L'autenticazione a due fattori è stata appena disattivata sul tuo account Accanto.</p>" +
-            "<p>Se non sei stato tu, accedi subito, cambia la password e riattiva 2FA il prima possibile.</p>");
+            "Verifica in due passaggi disattivata",
+            "<p>La verifica in due passaggi è stata appena disattivata sul tuo account Accanto.</p>" +
+            "<p>Se non sei stato tu, accedi subito, cambia la password e riattivala il prima possibile.</p>");
 
     private static string Layout(string title, string innerHtml) =>
         "<!doctype html><html><body style=\"font-family:Inter,Segoe UI,Arial,sans-serif;color:#222;max-width:560px;margin:0 auto;padding:24px\">" +

backend/src/Accanto.Application/Invites/InviteService.cs

@@ -5,6 +5,7 @@
 using Accanto.Application.Common.Exceptions;
 using Accanto.Application.Common.Persistence;
 using Accanto.Application.Email;
+using Accanto.Application.Push;
 using Accanto.Domain.Entities;
 using Accanto.Domain.Enums;
 using FluentValidation;
@@ -22,6 +23,7 @@ public class InviteService : IInviteService
     private readonly ICareCircleAuthorization _auth;
     private readonly IAuditLog _audit;
     private readonly ICircleEmailNotifier _email;
+    private readonly ICircleMobilePushNotifier _mobilePush;
     private readonly IOwnerTwoFactorOnboarding _ownerOnboarding;
     private readonly IValidator<CreateInviteRequest> _createValidator;
 
@@ -30,13 +32,15 @@ public InviteService(
         ICareCircleAuthorization auth,
         IAuditLog audit,
         ICircleEmailNotifier email,
+        ICircleMobilePushNotifier mobilePush,
         IOwnerTwoFactorOnboarding ownerOnboarding,
         IValidator<CreateInviteRequest> createValidator)
     {
         _db = db;
         _auth = auth;
         _audit = audit;
         _email = email;
+        _mobilePush = mobilePush;
         _ownerOnboarding = ownerOnboarding;
         _createValidator = createValidator;
     }
@@ -176,6 +180,16 @@ public async Task<Guid> AcceptAsync(Guid userId, string token, CancellationToken
                 $"Nuova persona nel cerchio {circleName}",
                 EmailTemplates.InviteAccepted(circleName, newMemberName),
                 CancellationToken.None);
+            _ = _mobilePush.NotifyUserAsync(
+                ownerId,
+                NotificationTopic.InviteAccepted,
+                circleName,
+                $"{newMemberName} è entrato nel cerchio",
+                new Dictionary<string, string>
+                {
+                    ["circleId"] = invite.CareCircleId.ToString()
+                },
+                CancellationToken.None);
         }
 
         return invite.CareCircleId;