Module vectors 

The Web Push test vectors the workspace shares.

These are not decorative constants. RFC8291_UA_PUBLIC and RFC8291_AUTH_SECRET are RFC 8291 Appendix A’s user agent: a real point on the P-256 curve and a real 16-byte auth secret, so a subscription built from them is one the adapter accepts and a body encrypted to them can be opened again with RFC8291_UA_PRIVATE. A made-up p256dh is refused — which is the point of the checks that use them, and the reason a test cannot simply invent a value.

They used to be copied into crates/adapter-webpush, crates/adapter-apns, crates/cli and crates/cli-acceptance, each with a comment saying it was “the same one” another crate used and nothing making that true. crates/cli-acceptance/tests/vector_guard.rs now fails the build if any source outside this module writes one of them down again.

Constants

RFC8291_AUTH_SECRET

RFC 8291 Appendix A: the subscription’s 16-byte auth secret.

RFC8291_PLAINTEXT

RFC 8291 §5: the plaintext the published example encrypts.

RFC8291_UA_PRIVATE

RFC 8291 Appendix A: the user agent’s private key. Only a test has this — it is what lets the decrypt side of a round trip exist.

RFC8291_UA_PUBLIC

RFC 8291 Appendix A: the user agent’s public key — the p256dh a browser puts in subscription.keys, base64url of the 65-byte uncompressed P-256 point.

TEST_P256_PEM

A throwaway P-256 private key in PKCS#8 PEM, generated for these tests only — not an Apple, Google or Mozilla key.

TEST_VAPID_SUBJECT

A mailto: VAPID subject (RFC 8292 §2.1).

WEB_PUSH_ENDPOINT

A Web Push endpoint of the shape a browser hands over: an origin plus a long, subscription-specific path. Whoever holds the whole thing can push to that browser, which is what makes it credential material.

WEB_PUSH_ENDPOINT_CAPABILITY

The subscription-specific part of WEB_PUSH_ENDPOINT’s path: the bearer capability, and so the string a test asserts is absent from output. Distinctive on purpose — it cannot be matched by accident.

WEB_PUSH_ORIGIN

The push service origin of WEB_PUSH_ENDPOINT — what a VAPID token claims as its aud, and the most a report may print of an endpoint.

Functions

web_push_subscription_json

The subscription exactly as JSON.stringify(subscription) gives it — the shape an operator pastes into fz push send --recipient.