Merge feat/container-execution into master

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

1 files changed, 21 insertions, 0 deletions

diff --git a/internal/notify/vapid_test.go b/internal/notify/vapid_test.go
index 6157854..a45047d 100644
--- a/internal/notify/vapid_test.go
+++ b/internal/notify/vapid_test.go
@@ -5,6 +5,27 @@ import (
 	"testing"
 )
 
+// TestValidateVAPIDPublicKey verifies that ValidateVAPIDPublicKey accepts valid
+// public keys and rejects private keys, empty strings, and invalid base64.
+func TestValidateVAPIDPublicKey(t *testing.T) {
+	pub, priv, err := GenerateVAPIDKeys()
+	if err != nil {
+		t.Fatalf("GenerateVAPIDKeys: %v", err)
+	}
+	if !ValidateVAPIDPublicKey(pub) {
+		t.Error("valid public key should pass validation")
+	}
+	if ValidateVAPIDPublicKey(priv) {
+		t.Error("private key (32 bytes) should fail public key validation")
+	}
+	if ValidateVAPIDPublicKey("") {
+		t.Error("empty string should fail validation")
+	}
+	if ValidateVAPIDPublicKey("notbase64!!!") {
+		t.Error("invalid base64 should fail validation")
+	}
+}
+
 // TestGenerateVAPIDKeys_PublicKeyIs65Bytes verifies that the public key returned
 // by GenerateVAPIDKeys is a 65-byte uncompressed P256 EC point (base64url, no padding = 87 chars)
 // and the private key is 32 bytes (43 chars). Previously the return values were swapped.