From ae84ddf4491765e7eae497a124e9ce7d444e577c Mon Sep 17 00:00:00 2001
From: Noah Petherbridge <root@kirsle.net>
Date: Sat, 14 Sep 2024 12:07:18 -0700
Subject: [PATCH] Web Push Notifications: Disable script when impersonated

If an admin needs to impersonate a regular user (to diagnose a support
issue or investigate a reported conversation thread), the web push
script is disabled so that the admin doesn't get subscribed to push
notifications for that user.
---
 web/templates/account/settings.html | 2 +-
 web/templates/base.html             | 5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/web/templates/account/settings.html b/web/templates/account/settings.html
index 68ee054..b833302 100644
--- a/web/templates/account/settings.html
+++ b/web/templates/account/settings.html
@@ -1563,7 +1563,7 @@ window.addEventListener("DOMContentLoaded", (event) => {
         $pushDeniedHelp = document.querySelector("#push-denied-help");
     
     // Is the Notification API unavailable?
-    if (typeof(window.Notification) === "undefined") {
+    if (typeof(window.Notification) === "undefined" || typeof(PushNotificationSubscribe) === "undefined") {
         $pushStatusDefault.innerHTML = `<i class="fa fa-xmark mr-1"></i> Notification API unavailable`;
         $pushStatusDefault.style.display = "";
         return;
diff --git a/web/templates/base.html b/web/templates/base.html
index bbc56a0..3ede998 100644
--- a/web/templates/base.html
+++ b/web/templates/base.html
@@ -381,7 +381,10 @@
     <script type="text/javascript" src="/static/js/vue-3.2.45.js"></script>
     <script type="text/javascript" src="/static/js/htmx-1.9.12.min.js"></script>
     <script type="text/javascript" src="/static/js/slim-forms.js?build={{.BuildHash}}"></script>
-    <script type="text/javascript" src="/static/js/web-push.js?build={{.BuildHash}}"></script>
+    {{if not .SessionImpersonated -}}
+        {{- /* Disable web push script if impersonated, so an admin doesn't subscribe to user's notifications */ -}}
+        <script type="text/javascript" src="/static/js/web-push.js?build={{.BuildHash}}"></script>
+    {{- end}}
     {{template "scripts" .}}
 
     <!-- Likes modal -->