feat: graduate web-push from experiment to always-on (#24310)

* Removes experiment `web-push`.
* Falls back to NoopWebpusher in case of error
* Checks browser capability in FE
* Adds note to agents getting-started docs regarding webpush without TLS

> 🤖

coderd/apidoc/docs.go

@@ -16176,7 +16176,6 @@ const docTemplate = `{
                 "auto-fill-parameters",
                 "notifications",
                 "workspace-usage",
-                "web-push",
                 "oauth2",
                 "agents",
                 "mcp-server-http",
@@ -16189,7 +16188,6 @@ const docTemplate = `{
                 "ExperimentMCPServerHTTP": "Enables the MCP HTTP server functionality.",
                 "ExperimentNotifications": "Sends notifications via SMTP and webhooks following certain events.",
                 "ExperimentOAuth2": "Enables OAuth2 provider functionality.",
-                "ExperimentWebPush": "Enables web push notifications through the browser.",
                 "ExperimentWorkspaceBuildUpdates": "Enables publishing workspace build updates to the all builds pubsub channel.",
                 "ExperimentWorkspaceUsage": "Enables the new workspace usage tracking."
             },
@@ -16198,7 +16196,6 @@ const docTemplate = `{
                 "This should not be taken out of experiments until we have redesigned the feature.",
                 "Sends notifications via SMTP and webhooks following certain events.",
                 "Enables the new workspace usage tracking.",
-                "Enables web push notifications through the browser.",
                 "Enables OAuth2 provider functionality.",
                 "Enables agent-powered chat functionality.",
                 "Enables the MCP HTTP server functionality.",
@@ -16209,7 +16206,6 @@ const docTemplate = `{
                 "ExperimentAutoFillParameters",
                 "ExperimentNotifications",
                 "ExperimentWorkspaceUsage",
-                "ExperimentWebPush",
                 "ExperimentOAuth2",
                 "ExperimentAgents",
                 "ExperimentMCPServerHTTP",

coderd/apidoc/swagger.json

@@ -14636,7 +14636,6 @@
 				"auto-fill-parameters",
 				"notifications",
 				"workspace-usage",
-				"web-push",
 				"oauth2",
 				"agents",
 				"mcp-server-http",
@@ -14649,7 +14648,6 @@
 				"ExperimentMCPServerHTTP": "Enables the MCP HTTP server functionality.",
 				"ExperimentNotifications": "Sends notifications via SMTP and webhooks following certain events.",
 				"ExperimentOAuth2": "Enables OAuth2 provider functionality.",
-				"ExperimentWebPush": "Enables web push notifications through the browser.",
 				"ExperimentWorkspaceBuildUpdates": "Enables publishing workspace build updates to the all builds pubsub channel.",
 				"ExperimentWorkspaceUsage": "Enables the new workspace usage tracking."
 			},
@@ -14658,7 +14656,6 @@
 				"This should not be taken out of experiments until we have redesigned the feature.",
 				"Sends notifications via SMTP and webhooks following certain events.",
 				"Enables the new workspace usage tracking.",
-				"Enables web push notifications through the browser.",
 				"Enables OAuth2 provider functionality.",
 				"Enables agent-powered chat functionality.",
 				"Enables the MCP HTTP server functionality.",
@@ -14669,7 +14666,6 @@
 				"ExperimentAutoFillParameters",
 				"ExperimentNotifications",
 				"ExperimentWorkspaceUsage",
-				"ExperimentWebPush",
 				"ExperimentOAuth2",
 				"ExperimentAgents",
 				"ExperimentMCPServerHTTP",

coderd/coderd.go

@@ -1624,7 +1624,6 @@ func New(options *Options) *API {
 							})
 						})
 						r.Route("/webpush", func(r chi.Router) {
-							r.Use(httpmw.RequireExperimentWithDevBypass(api.Experiments, codersdk.ExperimentWebPush))
 							r.Post("/subscription", api.postUserWebpushSubscription)
 							r.Delete("/subscription", api.deleteUserWebpushSubscription)
 							r.Post("/test", api.postUserPushNotificationTest)

coderd/webpush/webpush.go

@@ -386,9 +386,11 @@ func (n *Webpusher) PublicKey() string {
 	return n.VAPIDPublicKey
 }
 
-// NoopWebpusher is a Dispatcher that does nothing except return an error.
-// This is returned when web push notifications are disabled, or if there was an
-// error generating the VAPID keys.
+// NoopWebpusher is a Dispatcher that always fails, returning Msg as
+// the error. It is used as a fallback when VAPID key setup fails.
+// The underlying error is not included to avoid leaking internal
+// details (e.g. database errors) in API responses; it is logged at
+// the call site instead.
 type NoopWebpusher struct {
 	Msg string
 }

coderd/webpush/webpush_test.go

@@ -405,3 +405,21 @@ func setupPushTestWithOptions(ctx context.Context, t *testing.T, db database.Sto
 
 	return manager, db, server.URL
 }
+
+func TestNoopWebpusher(t *testing.T) {
+	t.Parallel()
+
+	noop := &webpush.NoopWebpusher{
+		Msg: "push disabled",
+	}
+
+	dispatchErr := noop.Dispatch(context.Background(), uuid.New(), codersdk.WebpushMessage{})
+	require.Error(t, dispatchErr)
+	require.Contains(t, dispatchErr.Error(), "push disabled")
+
+	testErr := noop.Test(context.Background(), codersdk.WebpushSubscription{})
+	require.Error(t, testErr)
+	require.Contains(t, testErr.Error(), "push disabled")
+
+	require.Empty(t, noop.PublicKey())
+}