/ 
Punk-Push-0.02
/ Punk::Push::Subscription

NAME

Punk::Push::Subscription - what a browser hands you, checked

SYNOPSIS

my $sub = Punk::Push::Subscription->new($c->req->json);

DESCRIPTION

The shape PushSubscription.toJSON() produces:

{
  "endpoint": "https://fcm.googleapis.com/fcm/send/...",
  "keys": { "p256dh": "<base64url>", "auth": "<base64url>" }
}

This is a security boundary, not a formality

These values arrive from a browser and go into a crypto routine and an outbound HTTP request.

The endpoint must be an absolute https URL. It is a URL this server will POST to, on a schedule the client chose, with a body the client cannot read - which is a server-side request forgery primitive if it is not constrained.

p256dh must decode to exactly 65 bytes beginning 0x04, an uncompressed P-256 point, and auth to exactly 16. Both are checked on the decoded bytes, because a base64url decoder that ignores a bad character turns a corrupt key into a short one, and the length is what catches that.

AUTHOR

LNATION <email@lnation.org>

LICENSE AND COPYRIGHT

This software is Copyright (c) 2026 by LNATION <email@lnation.org>.

This is free software, licensed under:

The Artistic License 2.0 (GPL Compatible)