feat: Seaca mobile API, enrollment, FCM push and admin UI (0.9.0)

Adds mobile device registration by admin codes, refresh tokens, push channel in notification policy, and Settings section for managing Seaca clients. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-10 13:19:14 +10:00
parent 86c602cf07
commit 563b836acc
32 changed files with 1916 additions and 45 deletions
@@ -0,0 +1,97 @@
+"""Управление зарегистрированными устройствами Seaca."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from datetime import datetime, timezone
+
+from sqlalchemy import select
+from sqlalchemy.orm import Session
+
+from app.models.mobile_device import MobileDevice
+from app.models.user import User
+from app.services.mobile_tokens import revoke_refresh_tokens_for_device
+
+
+@dataclass(frozen=True)
+class MobileDeviceSummary:
+    id: int
+    user_id: int
+    username: str
+    device_uuid: str
+    display_name: str
+    platform: str
+    app_version: str | None
+    has_fcm_token: bool
+    enrolled_at: datetime
+    last_seen_at: datetime | None
+    revoked_at: datetime | None
+    is_active: bool
+
+
+def list_mobile_devices(db: Session) -> list[MobileDeviceSummary]:
+    rows = db.scalars(select(MobileDevice).order_by(MobileDevice.enrolled_at.desc())).all()
+    user_ids = {r.user_id for r in rows}
+    usernames: dict[int, str] = {}
+    if user_ids:
+        for user in db.scalars(select(User).where(User.id.in_(user_ids))).all():
+            usernames[user.id] = user.username
+    return [_to_summary(row, usernames.get(row.user_id, "?")) for row in rows]
+
+
+def _to_summary(row: MobileDevice, username: str) -> MobileDeviceSummary:
+    return MobileDeviceSummary(
+        id=row.id,
+        user_id=row.user_id,
+        username=username,
+        device_uuid=row.device_uuid,
+        display_name=row.display_name or "",
+        platform=row.platform or "android",
+        app_version=row.app_version,
+        has_fcm_token=bool((row.fcm_token or "").strip()),
+        enrolled_at=row.enrolled_at,
+        last_seen_at=row.last_seen_at,
+        revoked_at=row.revoked_at,
+        is_active=row.revoked_at is None,
+    )
+
+
+def get_device_or_raise(db: Session, device_id: int) -> MobileDevice:
+    row = db.get(MobileDevice, device_id)
+    if row is None:
+        raise ValueError("device not found")
+    return row
+
+
+def assert_device_active(device: MobileDevice) -> None:
+    if device.revoked_at is not None:
+        raise PermissionError("device has been revoked")
+
+
+def touch_device(db: Session, device: MobileDevice, *, commit: bool = False) -> None:
+    device.last_seen_at = datetime.now(timezone.utc)
+    if commit:
+        db.commit()
+
+
+def revoke_device(db: Session, device_id: int) -> MobileDeviceSummary:
+    device = get_device_or_raise(db, device_id)
+    if device.revoked_at is None:
+        device.revoked_at = datetime.now(timezone.utc)
+        revoke_refresh_tokens_for_device(db, device.id)
+    db.commit()
+    db.refresh(device)
+    user = db.get(User, device.user_id)
+    username = user.username if user else "?"
+    return _to_summary(device, username)
+
+
+def update_fcm_token(db: Session, device: MobileDevice, fcm_token: str) -> None:
+    cleaned = (fcm_token or "").strip()
+    if not cleaned:
+        raise ValueError("fcm_token is required")
+    now = datetime.now(timezone.utc)
+    device.fcm_token = cleaned
+    device.fcm_token_updated_at = now
+    device.last_seen_at = now
+    db.commit()
@@ -0,0 +1,277 @@
+"""Создание и проверка кодов регистрации Seaca."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from datetime import datetime, timedelta, timezone
+
+from sqlalchemy import func, select
+from sqlalchemy.orm import Session
+
+from app.models.mobile_device import MobileDevice
+from app.models.mobile_enrollment_code import MobileEnrollmentCode
+from app.models.mobile_settings import LOGIN_MODE_CODE_ONLY, LOGIN_MODE_PASSWORD, LOGIN_MODES
+from app.models.user import User
+from app.services.mobile_settings import get_effective_mobile_settings
+from app.services.mobile_tokens import (
+    generate_enrollment_code,
+    hash_mobile_secret,
+    revoke_refresh_tokens_for_device,
+    store_refresh_token,
+)
+from app.services.user_auth import authenticate_user
+
+
+@dataclass(frozen=True)
+class EnrollmentCodeSummary:
+    id: int
+    label: str
+    code_prefix: str
+    target_user_id: int | None
+    target_username: str | None
+    login_mode: str
+    max_uses: int
+    use_count: int
+    expires_at: datetime
+    revoked_at: datetime | None
+    created_at: datetime
+    is_active: bool
+
+
+@dataclass(frozen=True)
+class EnrollResult:
+    access_token: str
+    refresh_token: str
+    device_id: int
+    username: str
+    role: str
+
+
+def _as_utc(dt: datetime) -> datetime:
+    if dt.tzinfo is None:
+        return dt.replace(tzinfo=timezone.utc)
+    return dt.astimezone(timezone.utc)
+
+
+def _code_is_usable(row: MobileEnrollmentCode, *, now: datetime) -> bool:
+    if row.revoked_at is not None:
+        return False
+    if _as_utc(row.expires_at) <= now:
+        return False
+    if row.use_count >= row.max_uses:
+        return False
+    return True
+
+
+def list_enrollment_codes(db: Session) -> list[EnrollmentCodeSummary]:
+    rows = db.scalars(
+        select(MobileEnrollmentCode).order_by(MobileEnrollmentCode.created_at.desc())
+    ).all()
+    usernames: dict[int, str] = {}
+    user_ids = {r.target_user_id for r in rows if r.target_user_id}
+    if user_ids:
+        for user in db.scalars(select(User).where(User.id.in_(user_ids))).all():
+            usernames[user.id] = user.username
+    now = datetime.now(timezone.utc)
+    return [
+        EnrollmentCodeSummary(
+            id=row.id,
+            label=row.label or "",
+            code_prefix=row.code_prefix,
+            target_user_id=row.target_user_id,
+            target_username=usernames.get(row.target_user_id) if row.target_user_id else None,
+            login_mode=row.login_mode,
+            max_uses=row.max_uses,
+            use_count=row.use_count,
+            expires_at=row.expires_at,
+            revoked_at=row.revoked_at,
+            created_at=row.created_at,
+            is_active=_code_is_usable(row, now=now),
+        )
+        for row in rows
+    ]
+
+
+def create_enrollment_code(
+    db: Session,
+    *,
+    created_by_user_id: int | None,
+    label: str,
+    target_user_id: int | None,
+    login_mode: str,
+    max_uses: int,
+    expires_in_hours: int,
+) -> tuple[EnrollmentCodeSummary, str]:
+    if login_mode not in LOGIN_MODES:
+        raise ValueError(f"login_mode must be one of: {sorted(LOGIN_MODES)}")
+    if login_mode == LOGIN_MODE_CODE_ONLY and target_user_id is None:
+        raise ValueError("code_only requires target_user_id")
+    if max_uses < 1 or max_uses > 100:
+        raise ValueError("max_uses must be between 1 and 100")
+    if expires_in_hours < 1 or expires_in_hours > 24 * 30:
+        raise ValueError("expires_in_hours must be between 1 and 720")
+
+    if target_user_id is not None:
+        user = db.get(User, target_user_id)
+        if user is None or not user.is_active:
+            raise ValueError("target user not found or inactive")
+
+    plaintext, prefix, code_hash = generate_enrollment_code()
+    expires_at = datetime.now(timezone.utc) + timedelta(hours=expires_in_hours)
+    row = MobileEnrollmentCode(
+        label=(label or "").strip(),
+        code_hash=code_hash,
+        code_prefix=prefix,
+        created_by_user_id=created_by_user_id,
+        target_user_id=target_user_id,
+        login_mode=login_mode,
+        max_uses=max_uses,
+        use_count=0,
+        expires_at=expires_at,
+    )
+    db.add(row)
+    db.flush()
+    target_username = None
+    if row.target_user_id:
+        u = db.get(User, row.target_user_id)
+        target_username = u.username if u else None
+    summary = EnrollmentCodeSummary(
+        id=row.id,
+        label=row.label or "",
+        code_prefix=row.code_prefix,
+        target_user_id=row.target_user_id,
+        target_username=target_username,
+        login_mode=row.login_mode,
+        max_uses=row.max_uses,
+        use_count=row.use_count,
+        expires_at=row.expires_at,
+        revoked_at=row.revoked_at,
+        created_at=row.created_at,
+        is_active=True,
+    )
+    return summary, plaintext
+
+
+def revoke_enrollment_code(db: Session, code_id: int) -> None:
+    row = db.get(MobileEnrollmentCode, code_id)
+    if row is None:
+        raise ValueError("enrollment code not found")
+    if row.revoked_at is None:
+        row.revoked_at = datetime.now(timezone.utc)
+    db.commit()
+
+
+def _count_active_devices(db: Session, user_id: int) -> int:
+    return (
+        db.scalar(
+            select(func.count())
+            .select_from(MobileDevice)
+            .where(MobileDevice.user_id == user_id, MobileDevice.revoked_at.is_(None))
+        )
+        or 0
+    )
+
+
+def enroll_device(
+    db: Session,
+    *,
+    enrollment_code: str,
+    username: str | None,
+    password: str | None,
+    device_uuid: str,
+    display_name: str,
+    platform: str,
+    app_version: str | None,
+    fcm_token: str | None,
+    create_access_token,
+) -> EnrollResult:
+    from app.auth.jwt_auth import create_access_token as _create_access_token
+
+    token_factory = create_access_token or _create_access_token
+
+    mobile_cfg = get_effective_mobile_settings(db)
+    if not mobile_cfg.devices_allowed:
+        raise PermissionError("mobile enrollment is disabled")
+
+    cleaned_uuid = (device_uuid or "").strip()
+    if len(cleaned_uuid) < 8:
+        raise ValueError("device_uuid is required")
+
+    if mobile_cfg.min_app_version and app_version:
+        if _version_lt(app_version, mobile_cfg.min_app_version):
+            raise ValueError(f"app version {app_version} is below minimum {mobile_cfg.min_app_version}")
+
+    now = datetime.now(timezone.utc)
+    code_hash = hash_mobile_secret(enrollment_code.strip())
+    code_row = db.scalar(
+        select(MobileEnrollmentCode).where(MobileEnrollmentCode.code_hash == code_hash)
+    )
+    if code_row is None or not _code_is_usable(code_row, now=now):
+        raise ValueError("invalid or expired enrollment code")
+
+    if code_row.login_mode == LOGIN_MODE_PASSWORD:
+        if not username or not password:
+            raise ValueError("username and password required")
+        user = authenticate_user(db, username, password)
+        if user is None:
+            raise ValueError("invalid username or password")
+    else:
+        user = db.get(User, code_row.target_user_id) if code_row.target_user_id else None
+        if user is None or not user.is_active:
+            raise ValueError("enrollment code user is invalid")
+
+    if code_row.target_user_id is not None and user.id != code_row.target_user_id:
+        raise ValueError("enrollment code is bound to another user")
+
+    active_count = _count_active_devices(db, user.id)
+    if active_count >= mobile_cfg.max_devices_per_user:
+        raise ValueError("device limit reached for this user")
+
+    existing = db.scalar(select(MobileDevice).where(MobileDevice.device_uuid == cleaned_uuid))
+    if existing is not None:
+        if existing.revoked_at is None and existing.user_id != user.id:
+            raise ValueError("device_uuid already registered to another user")
+        if existing.revoked_at is None:
+            revoke_refresh_tokens_for_device(db, existing.id)
+            existing.revoked_at = now
+            existing = None
+
+    device = MobileDevice(
+        user_id=user.id,
+        device_uuid=cleaned_uuid,
+        display_name=(display_name or "").strip() or "Android",
+        platform=(platform or "android").strip() or "android",
+        app_version=(app_version or "").strip() or None,
+        fcm_token=(fcm_token or "").strip() or None,
+        fcm_token_updated_at=now if fcm_token else None,
+        enrollment_code_id=code_row.id,
+        last_seen_at=now,
+    )
+    db.add(device)
+    code_row.use_count += 1
+    db.flush()
+
+    refresh_plain = store_refresh_token(db, device_id=device.id)
+    access_token = token_factory(user.username, user.role, device_id=device.id)
+    db.commit()
+
+    return EnrollResult(
+        access_token=access_token,
+        refresh_token=refresh_plain,
+        device_id=device.id,
+        username=user.username,
+        role=user.role,
+    )
+
+
+def _version_lt(current: str, minimum: str) -> bool:
+    def parse(v: str) -> tuple[int, ...]:
+        parts: list[int] = []
+        for piece in v.strip().split("."):
+            try:
+                parts.append(int(piece))
+            except ValueError:
+                parts.append(0)
+        return tuple(parts)
+
+    return parse(current) < parse(minimum)
@@ -0,0 +1,206 @@
+"""Push-уведомления Seaca через Firebase Cloud Messaging (HTTP v1)."""
+
+from __future__ import annotations
+
+import json
+import logging
+from dataclasses import dataclass
+from pathlib import Path
+
+import httpx
+from sqlalchemy import select
+from sqlalchemy.orm import Session
+
+from app.config import get_settings
+from app.models import Event, Problem
+from app.models.mobile_device import MobileDevice
+from app.services.notification_severity import severity_meets_minimum
+from app.services.notification_policy import get_effective_notification_policy
+
+logger = logging.getLogger(__name__)
+
+FCM_SCOPE = "https://www.googleapis.com/auth/firebase.messaging"
+
+
+class MobileNotConfiguredError(Exception):
+    """FCM отключён или не задан service account."""
+
+
+class MobileSendError(Exception):
+    def __init__(self, message: str, *, status_code: int | None = None) -> None:
+        super().__init__(message)
+        self.status_code = status_code
+
+
+@dataclass(frozen=True)
+class FcmConfig:
+    enabled: bool
+    project_id: str
+    service_account_path: str
+
+    @property
+    def configured(self) -> bool:
+        return bool(self.project_id.strip() and self.service_account_path.strip())
+
+    @property
+    def active(self) -> bool:
+        return self.enabled and self.configured
+
+
+def get_effective_fcm_config() -> FcmConfig:
+    settings = get_settings()
+    return FcmConfig(
+        enabled=bool(settings.sac_fcm_enabled),
+        project_id=(settings.sac_fcm_project_id or "").strip(),
+        service_account_path=(settings.sac_fcm_service_account_json or "").strip(),
+    )
+
+
+def _load_service_account(path: str) -> dict:
+    file_path = Path(path)
+    if not file_path.is_file():
+        raise MobileNotConfiguredError(f"FCM service account file not found: {path}")
+    with file_path.open(encoding="utf-8") as handle:
+        return json.load(handle)
+
+
+def _fcm_access_token(service_account_path: str) -> str:
+    try:
+        from google.oauth2 import service_account
+        from google.auth.transport.requests import Request
+    except ImportError as exc:
+        raise MobileNotConfiguredError("google-auth package is required for FCM") from exc
+
+    creds = service_account.Credentials.from_service_account_file(
+        service_account_path,
+        scopes=[FCM_SCOPE],
+    )
+    creds.refresh(Request())
+    if not creds.token:
+        raise MobileSendError("Failed to obtain FCM access token")
+    return creds.token
+
+
+def _active_device_tokens(db: Session | None) -> list[str]:
+    if db is None:
+        return []
+    rows = db.scalars(
+        select(MobileDevice).where(
+            MobileDevice.revoked_at.is_(None),
+            MobileDevice.fcm_token.is_not(None),
+        )
+    ).all()
+    tokens: list[str] = []
+    for row in rows:
+        token = (row.fcm_token or "").strip()
+        if token:
+            tokens.append(token)
+    return tokens
+
+
+def _send_fcm_data(tokens: list[str], data: dict[str, str], *, title: str, body: str) -> None:
+    if not tokens:
+        return
+    cfg = get_effective_fcm_config()
+    if not cfg.active:
+        return
+
+    access_token = _fcm_access_token(cfg.service_account_path)
+    url = f"https://fcm.googleapis.com/v1/projects/{cfg.project_id}/messages:send"
+    headers = {
+        "Authorization": f"Bearer {access_token}",
+        "Content-Type": "application/json",
+    }
+
+    with httpx.Client(timeout=12.0) as client:
+        for token in tokens:
+            payload = {
+                "message": {
+                    "token": token,
+                    "notification": {"title": title, "body": body},
+                    "data": data,
+                    "android": {"priority": "high"},
+                }
+            }
+            try:
+                response = client.post(url, headers=headers, json=payload)
+                response.raise_for_status()
+            except httpx.HTTPStatusError as exc:
+                detail = exc.response.text[:200] if exc.response is not None else str(exc)
+                logger.warning("FCM send failed for token prefix %s: %s", token[:8], detail)
+            except Exception:
+                logger.exception("FCM send failed")
+
+
+def _event_payload(event: Event) -> tuple[str, str, dict[str, str]]:
+    title = f"[{event.severity}] {event.title}"
+    body = (event.summary or "")[:200]
+    data = {
+        "kind": "event",
+        "id": str(event.id),
+        "severity": event.severity,
+        "type": event.type,
+    }
+    return title, body, data
+
+
+def _problem_payload(problem: Problem) -> tuple[str, str, dict[str, str]]:
+    title = f"[{problem.severity}] {problem.title}"
+    body = (problem.summary or "")[:200]
+    data = {
+        "kind": "problem",
+        "id": str(problem.id),
+        "severity": problem.severity,
+        "status": problem.status,
+    }
+    return title, body, data
+
+
+def notify_event(event: Event, *, db: Session | None = None, apply_policy_gate: bool = True) -> None:
+    policy = get_effective_notification_policy(db)
+    if apply_policy_gate and not severity_meets_minimum(event.severity, policy.min_severity):
+        return
+    tokens = _active_device_tokens(db)
+    if not tokens:
+        return
+    title, body, data = _event_payload(event)
+    _send_fcm_data(tokens, data, title=title, body=body)
+
+
+def notify_problem(
+    problem: Problem,
+    event: Event | None = None,
+    *,
+    db: Session | None = None,
+    apply_policy_gate: bool = True,
+) -> None:
+    policy = get_effective_notification_policy(db)
+    if apply_policy_gate and not severity_meets_minimum(problem.severity, policy.min_severity):
+        return
+    tokens = _active_device_tokens(db)
+    if not tokens:
+        return
+    title, body, data = _problem_payload(problem)
+    _send_fcm_data(tokens, data, title=title, body=body)
+
+
+def send_test_push(*, db: Session, device_id: int) -> None:
+    cfg = get_effective_fcm_config()
+    if not cfg.enabled:
+        raise MobileNotConfiguredError("FCM отключён (SAC_FCM_ENABLED=false)")
+    if not cfg.configured:
+        raise MobileNotConfiguredError("Не задан SAC_FCM_PROJECT_ID или SAC_FCM_SERVICE_ACCOUNT_JSON")
+
+    device = db.get(MobileDevice, device_id)
+    if device is None or device.revoked_at is not None:
+        raise ValueError("device not found or revoked")
+    token = (device.fcm_token or "").strip()
+    if not token:
+        raise ValueError("device has no FCM token")
+
+    _send_fcm_data(
+        [token],
+        {"kind": "test", "id": "0"},
+        title="SAC: тестовое push",
+        body="Канал Seaca (FCM) работает.",
+    )
@@ -0,0 +1,58 @@
+from dataclasses import dataclass
+
+from sqlalchemy.orm import Session
+
+from app.models.mobile_settings import MOBILE_SETTINGS_ROW_ID, MobileSettings
+
+
+@dataclass(frozen=True)
+class MobileSettingsConfig:
+    devices_allowed: bool
+    max_devices_per_user: int
+    min_app_version: str | None
+    source: str = "db"
+
+
+def get_effective_mobile_settings(db: Session) -> MobileSettingsConfig:
+    row = db.get(MobileSettings, MOBILE_SETTINGS_ROW_ID)
+    if row is None:
+        return MobileSettingsConfig(
+            devices_allowed=False,
+            max_devices_per_user=3,
+            min_app_version=None,
+            source="default",
+        )
+    return MobileSettingsConfig(
+        devices_allowed=bool(row.devices_allowed),
+        max_devices_per_user=max(1, int(row.max_devices_per_user or 3)),
+        min_app_version=(row.min_app_version or "").strip() or None,
+        source="db",
+    )
+
+
+def upsert_mobile_settings(
+    db: Session,
+    *,
+    devices_allowed: bool,
+    max_devices_per_user: int,
+    min_app_version: str | None,
+) -> MobileSettingsConfig:
+    if max_devices_per_user < 1 or max_devices_per_user > 50:
+        raise ValueError("max_devices_per_user must be between 1 and 50")
+    cleaned_version = (min_app_version or "").strip() or None
+    row = db.get(MobileSettings, MOBILE_SETTINGS_ROW_ID)
+    if row is None:
+        row = MobileSettings(
+            id=MOBILE_SETTINGS_ROW_ID,
+            devices_allowed=devices_allowed,
+            max_devices_per_user=max_devices_per_user,
+            min_app_version=cleaned_version,
+        )
+        db.add(row)
+    else:
+        row.devices_allowed = devices_allowed
+        row.max_devices_per_user = max_devices_per_user
+        row.min_app_version = cleaned_version
+    db.commit()
+    db.refresh(row)
+    return get_effective_mobile_settings(db)
@@ -0,0 +1,68 @@
+"""Хеширование enrollment/refresh токенов и генерация."""
+
+from __future__ import annotations
+
+import hashlib
+import secrets
+from datetime import datetime, timedelta, timezone
+
+from sqlalchemy import select
+from sqlalchemy.orm import Session
+
+from app.config import get_settings
+from app.models.mobile_refresh_token import MobileRefreshToken
+
+
+def hash_mobile_secret(raw: str) -> str:
+    return hashlib.sha256(raw.encode("utf-8")).hexdigest()
+
+
+def generate_enrollment_code() -> tuple[str, str, str]:
+    """(plaintext, prefix, hash)"""
+    raw = f"sacmob_{secrets.token_urlsafe(18)}"
+    prefix = raw[:12]
+    return raw, prefix, hash_mobile_secret(raw)
+
+
+def generate_refresh_token() -> tuple[str, str]:
+    """(plaintext, hash)"""
+    raw = secrets.token_urlsafe(48)
+    return raw, hash_mobile_secret(raw)
+
+
+def store_refresh_token(db: Session, *, device_id: int) -> str:
+    settings = get_settings()
+    days = max(1, int(settings.sac_mobile_refresh_expire_days))
+    plaintext, token_hash = generate_refresh_token()
+    expires_at = datetime.now(timezone.utc) + timedelta(days=days)
+    row = MobileRefreshToken(
+        device_id=device_id,
+        token_hash=token_hash,
+        expires_at=expires_at,
+    )
+    db.add(row)
+    return plaintext
+
+
+def revoke_refresh_tokens_for_device(db: Session, device_id: int) -> None:
+    now = datetime.now(timezone.utc)
+    rows = db.scalars(
+        select(MobileRefreshToken).where(
+            MobileRefreshToken.device_id == device_id,
+            MobileRefreshToken.revoked_at.is_(None),
+        )
+    ).all()
+    for row in rows:
+        row.revoked_at = now
+
+
+def find_valid_refresh_token(db: Session, raw_token: str) -> MobileRefreshToken | None:
+    token_hash = hash_mobile_secret(raw_token)
+    now = datetime.now(timezone.utc)
+    return db.scalar(
+        select(MobileRefreshToken).where(
+            MobileRefreshToken.token_hash == token_hash,
+            MobileRefreshToken.revoked_at.is_(None),
+            MobileRefreshToken.expires_at > now,
+        )
+    )
@@ -17,7 +17,8 @@ from app.services.notification_settings import (
    VALID_SEVERITIES,
 )

-DEFAULT_CHANNELS = frozenset({CHANNEL_TELEGRAM, CHANNEL_WEBHOOK, CHANNEL_EMAIL})
+CHANNEL_MOBILE = "mobile"
+DEFAULT_CHANNELS = frozenset({CHANNEL_TELEGRAM, CHANNEL_WEBHOOK, CHANNEL_EMAIL, CHANNEL_MOBILE})


@dataclass(frozen=True)
@@ -26,6 +27,7 @@ class NotificationPolicyConfig:
    use_telegram: bool
    use_webhook: bool
    use_email: bool
+    use_mobile: bool
    source: str  # env | db

    def allows_channel(self, channel: str) -> bool:
@@ -35,21 +37,24 @@ class NotificationPolicyConfig:
            return self.use_webhook
        if channel == CHANNEL_EMAIL:
            return self.use_email
+        if channel == CHANNEL_MOBILE:
+            return self.use_mobile
        return False


-def _parse_channels_csv(value: str) -> tuple[bool, bool, bool]:
+def _parse_channels_csv(value: str) -> tuple[bool, bool, bool, bool]:
    parts = {p.strip().lower() for p in value.split(",") if p.strip()}
    return (
        CHANNEL_TELEGRAM in parts or "tg" in parts,
        CHANNEL_WEBHOOK in parts,
        CHANNEL_EMAIL in parts or "mail" in parts or "smtp" in parts,
+        CHANNEL_MOBILE in parts or "push" in parts or "fcm" in parts,
    )


 def _policy_from_env() -> NotificationPolicyConfig:
    settings = get_settings()
-    use_tg, use_wh, use_em = _parse_channels_csv(settings.notify_channels)
+    use_tg, use_wh, use_em, use_mob = _parse_channels_csv(settings.notify_channels)
    min_sev = settings.notify_min_severity.strip() or "warning"
    if min_sev not in VALID_SEVERITIES:
        min_sev = "warning"
@@ -58,6 +63,7 @@ def _policy_from_env() -> NotificationPolicyConfig:
        use_telegram=use_tg,
        use_webhook=use_wh,
        use_email=use_em,
+        use_mobile=use_mob,
        source="env",
    )

@@ -86,6 +92,7 @@ def get_effective_notification_policy(db: Session | None = None) -> Notification
        use_telegram=bool(row.use_telegram),
        use_webhook=bool(row.use_webhook),
        use_email=bool(row.use_email),
+        use_mobile=bool(getattr(row, "use_mobile", False)),
        source="db",
    )

@@ -104,6 +111,7 @@ def upsert_notification_policy(
    use_telegram: bool,
    use_webhook: bool,
    use_email: bool,
+    use_mobile: bool = False,
 ) -> NotificationPolicyConfig:
    if min_severity not in VALID_SEVERITIES:
        raise ValueError(f"invalid min_severity: {min_severity}")
@@ -116,6 +124,7 @@ def upsert_notification_policy(
            use_telegram=use_telegram,
            use_webhook=use_webhook,
            use_email=use_email,
+            use_mobile=use_mobile,
        )
        db.add(row)
    else:
@@ -123,6 +132,7 @@ def upsert_notification_policy(
        row.use_telegram = use_telegram
        row.use_webhook = use_webhook
        row.use_email = use_email
+        row.use_mobile = use_mobile

    _sync_channel_min_severity(db, min_severity)
    db.commit()
@@ -5,7 +5,7 @@ import logging
 from sqlalchemy.orm import Session

 from app.models import Event, Problem
-from app.services import email_notify, telegram_notify, webhook_notify
+from app.services import email_notify, mobile_notify, telegram_notify, webhook_notify
 from app.services.notification_cooldown import should_notify_event, should_notify_problem
 from app.services.notification_policy import get_effective_notification_policy
 from app.services.notification_severity import severity_meets_minimum
@@ -35,6 +35,8 @@ def _dispatch_event_channels(event: Event, *, db: Session | None, policy) -> Non
        webhook_notify.notify_event(event, db=db, apply_policy_gate=False)
    if policy.use_email:
        email_notify.notify_event(event, db=db, apply_policy_gate=False)
+    if policy.use_mobile:
+        mobile_notify.notify_event(event, db=db, apply_policy_gate=False)


 def _dispatch_problem_channels(problem: Problem, event: Event | None, *, db: Session | None, policy) -> None:
@@ -44,6 +46,8 @@ def _dispatch_problem_channels(problem: Problem, event: Event | None, *, db: Ses
        webhook_notify.notify_problem(problem, event, db=db, apply_policy_gate=False)
    if policy.use_email:
        email_notify.notify_problem(problem, event, db=db, apply_policy_gate=False)
+    if policy.use_mobile:
+        mobile_notify.notify_problem(problem, event, db=db, apply_policy_gate=False)


 def notify_event(event: Event, *, db: Session | None = None) -> None:
@@ -72,6 +76,8 @@ def _dispatch_lifecycle_channels(event: Event, *, db: Session | None, policy) ->
        webhook_notify.notify_event(event, db=db, apply_policy_gate=False)
    if policy.use_email:
        email_notify.notify_event(event, db=db, apply_policy_gate=False)
+    if policy.use_mobile:
+        mobile_notify.notify_event(event, db=db, apply_policy_gate=False)


 def notify_daily_report(event: Event, *, db: Session | None = None) -> None: