# NotifyMe review receiver

Open **https://notify.bro3.net/** and select **Create test session**.
Copy the generated HTTPS URL into `Notify Me → callback_url`, enter a synthetic
task `id`, and optionally connect text to `msg`. Run the workflow and select
**Check results** on the page. A valid callback returns **HTTP 200**.

The [text example](../examples/notify_me_example.json) uses only
`PrimitiveStringMultiline → NotifyMeNode`; it loads no models. Fill its blank
callback URL with your session URL. Repeating the workflow creates another event;
omitting `msg` sends an empty string. The node accepts only HTTPS and the exact
approved host, verifies TLS certificates, and does not follow redirects.

For a direct protocol check, replace `SESSION_TOKEN` with the token from your page:

```sh
curl https://notify.bro3.net/callback/SESSION_TOKEN \
  -H 'Content-Type: application/json' \
  --data '{"id":"review-001","msg":"Hello from NotifyMe"}'
```

Expected response:

```json
{"ok":true,"received":{"id":"review-001","msg":"Hello from NotifyMe"}}
```

Sessions are separate and possession of the unguessable session URL grants access
to that session. Use test data only. Sessions expire after one hour; up to 20
events / 64 KiB are kept in memory per session. **Delete session** removes them
immediately, and a service restart clears all sessions. The service does not log
request bodies, persist messages, fetch URLs, forward data, or list sessions.
The page updates on demand without reloading. Standard hosting/CDN request metadata
may still be processed by the hosting providers.

Only `id` and `msg` are accepted; both are optional strings. Limits: 256 characters
for `id`, 8,192 for `msg`, 16 KiB per request, and 100 active sessions. Invalid
requests return 4xx; only successfully accepted callbacks return 200.

Source: [`tools/review_receiver`](../tools/review_receiver). The receiver is an
optional standalone review tool, not imported by the node package. To run it:

```sh
python -m pip install -r tools/review_receiver/requirements.txt
python tools/review_receiver/server.py --host 127.0.0.1 --port 8766
```

For public hosting, place it behind an HTTPS reverse proxy for the approved domain.
The included Dockerfile runs as an unprivileged user. Keep the backend private;
only the HTTPS proxy should expose it. `GET /health` provides a health check.
Availability of this demo does not imply Manager or RunningHub approval.