Device registration

Store push targets so Push.deliver can reach a user on every platform.

The framework owns routing and dead-token detection. Your app owns the device list. soli generate devices scaffolds the usual shape.

Generate

soli generate devices
soli db:migrate up

Piece	Role
`Device` model	platform, token, optional web subscription; upsert by token
`POST /devices`	Register after login (session required)
`push_targets_for` / `prune_tokens`	Wire into `Push.deliver`
`deliver_to_user`	Deliver + prune in one helper
`skip_csrf("/devices/*")`	Shell POSTs often lack Origin

Layout

<%- csrf_meta_tag() %>
<% user_id = session_get("user_id") %>
<%- native_channel("user:#{str(user_id)}") rescue "" unless user_id.nil? %>

HTTP contract

POST /devices
Cookie: <session>
Content-Type: application/json
X-CSRF-Token: <from csrf_meta_tag, when posting from a page>

{ "platform": "android", "token": "…" }

Platforms: ios, android, web, macos, apple, fcm. Returns 201.

CSRF

Native shells often send a session cookie without Origin. The generator adds skip_csrf("/devices/*"); the controller still requires login. Generated shells also set Origin/Referer. From a page:

await soli.nativeBridge.registerDevice({
  platform: "web",
  subscription: pushSubscriptionJson
})
// or { platform: "android", token: fcmToken }

Sending

result = deliver_to_user(user.id, {
  "title": "New ping",
  "body":  "Ana replied",
  "url":   "/pings/3"
}, {
  "apns": apns_options,
  "fcm":  fcm_options
})
# prunes dead tokens from result["prune"] automatically

result = Push.deliver("user:#{str(user.id)}", payload, {
  "targets": Device.push_targets_for(user.id),
  "apns": apns_options,
  "fcm": fcm_options
})
Device.prune_tokens(result["prune"] || [])

Always act on prune. Tokens the service reports as gone should be deleted.

Checklist

SOLI_SESSION_SECRET (32+)
soli generate devices + migrate
Layout: csrf_meta_tag + native_channel
Register tokens after login (shell or registerDevice)
deliver_to_user with APNs/FCM/VAPID credentials
Generate a client pointed at the deployment