feat(pwa): Web Push on @profullstack/notifications, key served at run time - #533
Merged
Merged
Conversation
… time - drop web-push; approvals are sent with sendPushToMany (same VAPID key format, no key regeneration), 404/410 subscriptions are still deleted, and web-push's 4-week TTL is kept - GET /api/push/vapid-public-key serves the public key at run time (503 when unset) instead of rendering it into the dashboard - public/push.js runs on @profullstack/notifications/client (served from node_modules at /vendor/notifications-client.js): it fetches the key when subscribing and shows pushSupport()'s reason when push cannot work - /push/subscribe takes PushSubscription.toJSON() (validated with parseSubscription) and still the old flat shape; /push/unsubscribe also answers DELETE - VAPID_PUBLIC / VAPID_PRIVATE keep working; VAPID_PUBLIC_KEY / VAPID_PRIVATE_KEY are accepted too Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Contributor
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
ThreatCrush Security Scan0 finding(s) in the 11 file(s) this pull request changes. Nothing in the files this pull request changes. 101 pre-existing finding(s) elsewhere in the repository — **HIGH/CRITICAL**: 8 | **MEDIUM**: 82 | **LOW**: 11Not introduced by this pull request. The full set is in the Security tab.
…and 81 more. Full results in the Security tab. Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Moves app.moshcode.sh's Web Push off
web-pushand onto@profullstack/notifications@0.1.0.Why: on pairux.com push broke silently because the VAPID public key was compiled into the client and was empty in production. Here the key was rendered into the dashboard's
data-vapid; now the browser fetches it at run time and says why when push can't work.Changes (apps/pwa only)
src/lib/deliver.mjs:sendPushToManyreplaceswebpush.sendNotification. The payload is the same, the key format is the same (no regeneration), 404/410 subscriptions are still deleted (onGone), and web-push's default 4-week TTL is kept.GET /api/push/vapid-public-key:vapidPublicKeyResponse(...). Returns 200{ publicKey }, or 503 when the keys are missing.public/push.js: now an ES module using@profullstack/notifications/client(served from node_modules at/vendor/notifications-client.js, like xterm). It fetches the key at subscribe time. When push can't work here, it shows thepushSupport()reason (HTTPS, iOS Home Screen, blocked) under the button./push/subscribetakesPushSubscription.toJSON(), validated byparseSubscription. The old flat shape still works./push/unsubscribealso answersDELETE, which is what the package client sends.VAPID_PUBLIC/VAPID_PRIVATEstill work, andVAPID_PUBLIC_KEY/VAPID_PRIVATE_KEYare also accepted.Tests: new
test/push-notifications.test.mjscovers:Full suite: 3343 tests, 3339 pass, 0 fail, 4 skipped (baseline on main: 3338 tests, 3334 pass, 0 fail).
🤖 Generated with Claude Code