From f41e08e2d7e8f5a417a653c5e0a6d82453575a8d Mon Sep 17 00:00:00 2001
From: Tenzin khenrab <khenrab@Mac.dlink>
Date: Fri, 11 Sep 2026 14:50:10 +0530
Subject: [PATCH] Add error handling and sanitize VAPID keys

---
 .../Api/PushSubscriptionController.php        | 41 ++++++++++++-------
 backend/app/Services/WebPushService.php       | 23 +++++++----
 2 files changed, 40 insertions(+), 24 deletions(-)

diff --git a/backend/app/Http/Controllers/Api/PushSubscriptionController.php b/backend/app/Http/Controllers/Api/PushSubscriptionController.php
index 7169e1a..e0a7f10 100644
--- a/backend/app/Http/Controllers/Api/PushSubscriptionController.php
+++ b/backend/app/Http/Controllers/Api/PushSubscriptionController.php
@@ -22,7 +22,8 @@ public function __construct(WebPushService $webPushService)
      */
     public function getVapidPublicKey(): JsonResponse
     {
-        $publicKey = config('services.webpush.vapid_public_key', env('VAPID_PUBLIC_KEY'));
+        $rawKey = config('services.webpush.vapid_public_key', env('VAPID_PUBLIC_KEY'));
+        $publicKey = $rawKey ? trim($rawKey, " \"'") : null;
 
         return response()->json([
             'vapid_public_key' => $publicKey,
@@ -43,22 +44,32 @@ public function store(Request $request): JsonResponse
         ]);
 
         $user = $request->user();
+        if (! $user) {
+            return response()->json(['error' => 'Unauthenticated.'], 401);
+        }
 
-        $subscription = PushSubscription::updateOrCreate(
-            ['endpoint' => $request->input('endpoint')],
-            [
-                'user_id' => $user->id,
-                'public_key' => $request->input('keys.p256dh'),
-                'auth_token' => $request->input('keys.auth'),
-                'content_encoding' => $request->input('content_encoding', 'aes128gcm'),
-                'locale' => $request->input('locale', 'bo'),
-            ]
-        );
+        try {
+            $subscription = PushSubscription::updateOrCreate(
+                ['endpoint' => $request->input('endpoint')],
+                [
+                    'user_id' => $user->id,
+                    'public_key' => $request->input('keys.p256dh'),
+                    'auth_token' => $request->input('keys.auth'),
+                    'content_encoding' => $request->input('content_encoding', 'aes128gcm'),
+                    'locale' => $request->input('locale', 'bo'),
+                ]
+            );
 
-        return response()->json([
-            'message' => 'Push subscription saved successfully.',
-            'subscription' => $subscription,
-        ]);
+            return response()->json([
+                'message' => 'Push subscription saved successfully.',
+                'subscription' => $subscription,
+            ]);
+        } catch (\Throwable $e) {
+            \Illuminate\Support\Facades\Log::error('[PushSubscription] Store error: ' . $e->getMessage());
+            return response()->json([
+                'error' => 'Failed to save push subscription: ' . $e->getMessage(),
+            ], 500);
+        }
     }
 
     /**
diff --git a/backend/app/Services/WebPushService.php b/backend/app/Services/WebPushService.php
index 337332e..9d4e449 100644
--- a/backend/app/Services/WebPushService.php
+++ b/backend/app/Services/WebPushService.php
@@ -18,15 +18,20 @@ public function __construct()
         $subject = config('services.webpush.vapid_subject', env('VAPID_SUBJECT', 'mailto:admin@monlam.ai'));
 
         if ($publicKey && $privateKey) {
-            $auth = [
-                'VAPID' => [
-                    'subject' => $subject,
-                    'publicKey' => $publicKey,
-                    'privateKey' => $privateKey,
-                ],
-            ];
-            $this->webPush = new WebPush($auth);
-            $this->webPush->setReuseVAPIDHeaders(true);
+            try {
+                $auth = [
+                    'VAPID' => [
+                        'subject' => trim($subject),
+                        'publicKey' => trim($publicKey),
+                        'privateKey' => trim($privateKey),
+                    ],
+                ];
+                $this->webPush = new WebPush($auth);
+                $this->webPush->setReuseVAPIDHeaders(true);
+            } catch (\Throwable $e) {
+                Log::error('[WebPush] Initialization failed: ' . $e->getMessage());
+                $this->webPush = null;
+            }
         }
     }