PushChannel class

Push notification channel using a configured driver (e.g., OneSignal).

Sends notifications via push notification service when:

• Driver is available/supported
• Notification defines toPush() message
• User preferences allow push notifications

This channel is SELF-ADDRESSED

It POSTs to an endpoint that derives the recipient from the authenticated session, and the request carries no recipient field: a client-triggered send that could choose its target is a harassment vector, and that omission is what makes exposing this at all safe. So the only person this channel can page is the authenticated one.

The Notifiable in send therefore selects the preference matrix and the message, never the recipient. A notifiable that is not the authenticated user is refused; it cannot quietly become the caller.

This channel ships SWITCHED OFF

notifications.push.self_test_enabled gates the whole send, and an absent key is off. Making the platform emit a push on a client's say-so is a capability, not a detail, and it stays cold until an app has something that needs it: an endpoint reachable by anything holding a token, whose only effect is an outbound push, should not be live before the first caller exists. The backend half of this package's contract carries the same switch (magic-starter.onesignal.self_test_enabled) and refuses on its own; either half alone is a half-measure, since a client that refuses locally leaves the endpoint reachable and a server that refuses leaves the client posting requests that always fail.