fix(notifications): address Gemini review — tighten validation, sanitize Click, support Basic auth, non-optimistic UI clear

Acted on 4 of 6 findings from the gemini-3-flash-preview second-opinion
review (the other 2 were verified-wrong or judged not worth the
complexity — see HANDOFF.md).

core/src/notifications/ntfy.ts:
- validateTopicUrl now enforces ntfy's actual topic-name constraints:
  exactly one path segment, 1–64 chars, charset [A-Za-z0-9_-]. Prevents
  users from saving topic URLs that look fine but silently 404 at
  publish time (cf. binwiederhier/ntfy#1451 for the 64-char limit and
  binwiederhier/ntfy's topic-name regex for the charset).
- Click header now passes through sanitizeHeader, closing the same
  CRLF-injection vector that Title/Tags already had.
- Authorization header construction now factors through a small
  buildAuthHeaderValue helper: a value that already starts with a scheme
  token ("Bearer xyz", "Basic dXNlcjpwYXNz") is used verbatim, so users
  of private ntfy servers that want Basic auth can paste the full header
  value. Bare tokens still get the "Bearer " prefix automatically.

frontend/SettingsPanel.svelte:
- clearNtfyAuthToken() was optimistic: it flipped hasAuthToken=false
  locally before awaiting the network call. If the request failed the
  UI lied about server state, and worse — a subsequent Save() with
  authToken:undefined would silently re-arm the original token. Now
  awaits the response, surfaces failures via the existing ntfySaveError
  banner, and only mutates local state on success. Adds a
  ntfyClearingToken loading flag so the button disables + spins during
  the request.

Tests: +6 in ntfy.test.ts (multi-segment rejection, charset rejection,
length boundary, 64-char acceptance, Basic auth pass-through, Click
sanitization). All 442 tests pass; biome clean; svelte-check clean;
manual ntfy.sh end-to-end re-verified.

1 files changed, 44 insertions, 12 deletions

diff --git a/packages/core/src/notifications/ntfy.ts b/packages/core/src/notifications/ntfy.ts
index 07ce33b..1f5101c 100644
--- a/packages/core/src/notifications/ntfy.ts
+++ b/packages/core/src/notifications/ntfy.ts
@@ -28,9 +28,17 @@ export type FetchLike = (
 ) => Promise<{ ok: boolean; status: number; statusText?: string; text(): Promise<string> }>;
 
 /**
- * Validate a ntfy topic URL. Accepts only `http(s)://host/topic` with a
- * non-empty topic path. Returns `null` on success, a human-readable error
- * string on failure.
+ * ntfy topic-name rules: 1–64 chars, ASCII alphanumerics + `-` and `_`. Sourced
+ * from the ntfy server (cf. binwiederhier/ntfy issue #1451 — longer names
+ * silently 404). Matching this client-side keeps users from saving topic URLs
+ * that look fine but only fail at publish time.
+ */
+const NTFY_TOPIC_RE = /^[A-Za-z0-9_-]{1,64}$/;
+
+/**
+ * Validate a ntfy topic URL. Accepts only `http(s)://host/topic` where
+ * `topic` is a single path segment of 1–64 chars matching `[A-Za-z0-9_-]`.
+ * Returns `null` on success, a human-readable error string on failure.
  */
 export function validateTopicUrl(topicUrl: string): string | null {
 	const trimmed = topicUrl.trim();
@@ -44,9 +52,15 @@ export function validateTopicUrl(topicUrl: string): string | null {
 	if (url.protocol !== "http:" && url.protocol !== "https:") {
 		return "Topic URL must use http:// or https://";
 	}
-	// Path must be a non-empty topic (more than just "/")
+	// Path must be exactly one topic segment.
 	const topic = url.pathname.replace(/^\/+|\/+$/g, "");
 	if (!topic) return "Topic URL must include a topic name (e.g. https://ntfy.sh/my-topic)";
+	if (topic.includes("/")) {
+		return "Topic URL must point at a single topic (no extra path segments)";
+	}
+	if (!NTFY_TOPIC_RE.test(topic)) {
+		return "Topic name must be 1–64 characters, letters/numbers/underscore/hyphen only";
+	}
 	return null;
 }
 
@@ -79,17 +93,17 @@ export async function sendNtfy(
 	}
 
 	const headers: Record<string, string> = {
-		// ntfy treats the title/priority/tags/click headers as ASCII-only. Strip
-		// control chars from the title; the body is sent UTF-8 verbatim.
+		// ntfy is tolerant of non-ASCII in the Title header but many proxies
+		// aren't — sanitizeHeader strips CR/LF/control chars (injection guard)
+		// and leaves UTF-8 in place. Body is sent verbatim as UTF-8.
 		Title: sanitizeHeader(event.title),
 		Priority: String(priority),
 		"Content-Type": "text/plain; charset=utf-8",
 	};
 	if (tags.length > 0) headers.Tags = tags.map(sanitizeHeader).join(",");
-	if (event.clickUrl) headers.Click = event.clickUrl;
-	if (config.authToken && config.authToken.trim() !== "") {
-		headers.Authorization = `Bearer ${config.authToken.trim()}`;
-	}
+	if (event.clickUrl) headers.Click = sanitizeHeader(event.clickUrl);
+	const authValue = buildAuthHeaderValue(config.authToken);
+	if (authValue) headers.Authorization = authValue;
 
 	// Per-request abort so a hung server doesn't pin a Bun worker forever.
 	const controller = new AbortController();
@@ -119,9 +133,27 @@ export async function sendNtfy(
 	}
 }
 
+/**
+ * Build the `Authorization` header value from the user-configured token.
+ *
+ * - Empty/blank ⇒ no header.
+ * - Already starts with `Bearer ` / `Basic ` / etc. (RFC 7235 scheme + space)
+ *   ⇒ used verbatim. Lets users paste a complete header for Basic auth or
+ *   any other scheme their private ntfy server supports.
+ * - Otherwise ⇒ prefixed with `Bearer ` (the common case).
+ */
+function buildAuthHeaderValue(rawToken: string): string | null {
+	const trimmed = (rawToken ?? "").trim();
+	if (!trimmed) return null;
+	if (/^[A-Za-z][A-Za-z0-9._~+/-]*\s+\S/.test(trimmed)) {
+		// Already includes a scheme token (e.g. "Bearer xyz", "Basic dXNlcjpw").
+		return sanitizeHeader(trimmed);
+	}
+	return `Bearer ${sanitizeHeader(trimmed)}`;
+}
+
 function sanitizeHeader(value: string): string {
-	// Strip CR/LF (header injection guard) and trim. ntfy is tolerant of
-	// non-ASCII in titles, but we still drop control chars.
+	// Strip CR/LF (header injection guard) and other control chars, then trim.
 	// biome-ignore lint/suspicious/noControlCharactersInRegex: intentional
 	return value.replace(/[\r\n\u0000-\u001f]+/g, " ").trim();
 }