[Bug]: Using a download manager on public shares can trigger thousands of push-notifications / trigger fair use limit

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Using a download manager to download files from a shared link on a poor network connection can cause thousands of push-notifications triggering the fair use push limit ("the gateway limits the number of push notifications per server and the limit was reached for this server.").

It seems as if every connection / resume of a download triggeres the "File was [successfully] downloaded" notification.

Steps to reproduce

1. Enable push notifications for public shared directories / files.
2. Upload some large files to a directory (in this case on an external smb-storage, 55GiB and 15GiB)
3. Share that directory via a public link (read-only + download allowed). Open the public share. Access the "Download"-Button for a file in that directory via the three-dot-menu. Pass the generated actual download URL (https://<nc>/s/<share>/download?path=%2F&files=video.mp4&downloadStartSecret=<secret>) to a download manager that is capable to resume a download.
4. To reproduce:
   • a) Be on a poor, instable network connection that makes it neccessary for the download manager to reconnect/resume regularly (or interrupt it by pressing pause & resume)
   • b) use a download manager that uses multiple parallell connections to get the file, e.g.: axel -a -n 4 "https://<nc>/s/<share>/download?path=%2F&files=video.mp4&downloadStartSecret=<secret>")

a) The "File was downloaded via public share" push notification triggered for every resume.
b) The "File was downloaded via public share" push ntificatin is triggered for every parallell connection (plus x), e.g. the example above with axel causes instantly 5 push notifications.

Expected behavior

There should be exactly one Push-Notification for one download. Or maybe two (Download started via public link, Download finished via public link). If a client resumes the download there should be no additional push notifications.

The NC Push Gateway should restore the fair-use state automatically after some time.

Nextcloud Server version

30

Operating system

RHEL/CentOS

PHP engine version

PHP 8.3

Web server

Apache (supported)

Database engine version

PostgreSQL

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "log_type": "file",
        "logfile": "\/var\/log\/nextcloud.log",
        "loglevel": 0,
        "logdateformat": "F d, Y H:i:s",
        "syslog_tag": "Nextcloud",
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "***REMOVED SENSITIVE VALUE***"
        ],
        "overwritehost": "***REMOVED SENSITIVE VALUE***",
        "overwriteprotocol": "https",
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "pgsql",
        "version": "30.0.6.2",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "maintenance": false,
        "skeletondirectory": "",
        "overwrite.cli.url": "***REMOVED SENSITIVE VALUE***",
        "htaccess.RewriteBase": "\/",
        "logtimezone": "Europe\/Berlin",
        [snapp]
        "simpleSignUpLink.shown": false,
        "updater.release.channel": "stable",
        "memcache.local": "\\OC\\Memcache\\Redis",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 6379,
            "timeout": 0
        },
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "default_phone_region": "DE",
        "trashbin_retention_obligation": "auto, 5",
        "app_install_overwrite": [
            "user_backend_sql_raw"
        ],
        "deferred_script_loading": true,
        "memories.db.triggers.fcu": true,
        "memories.exiftool_no_local": true,
        "memories.vod.path": "\/var\/www\/nextcloud\/apps\/memories\/bin-ext\/go-vod-amd64",
        "defaultapp": "dashboard",
        "files.chunked_upload.max_size": 104857600
    }
}

List of activated Apps

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

Additional info

No response

No source files or tests are named in the report. Start by tracing the public-share download URL and the push notification emitted when a download resumes or uses parallel connections. Done means a single notification per download rather than one per connection or resume, with the fair-use state behavior clarified and covered by tests.