claudomator.git/internal/notify/vapid_test.go, branch story/task-project-fkclaudomator — task automation server
https://git.terst.org/claudomator.git/atom?h=story%2Ftask-project-fk2026-03-17T08:04:04+00:00fix: validate VAPID public key on load, regenerate if swapped2026-03-17T08:04:04+00:00Claudomator Agentagent@claudomator2026-03-17T08:04:04+00:00urn:sha1:b9039dbf194f66738766cb4296ba6d141d6d433e
The DB may contain keys generated before the swap fix, with the private
key stored as the public key. Add ValidateVAPIDPublicKey() and use it in
serve.go to detect and regenerate invalid stored keys on startup.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
fix: swap VAPID key return order in GenerateVAPIDKeys wrapper2026-03-17T02:12:31+00:00Claudomator Agentagent@claudomator2026-03-17T02:12:31+00:00urn:sha1:94e45575a34e8672f8b405c54cabd8e524281fef
webpush.GenerateVAPIDKeys() returns (privateKey, publicKey) but the
claudomator wrapper declared (publicKey, privateKey), causing the
32-byte private key to be sent to browsers as the applicationServerKey.
Browsers require a 65-byte uncompressed P256 point, so they rejected
it with "The provided applicationServerKey is not valid."
Adds a regression test that asserts public key is 87 chars/65 bytes
with 0x04 prefix and private key is 43 chars/32 bytes.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>