fix(push-web): default VAPID subject to https://openclaw.ai instead of mailto:openclaw@localhost (#83134)

hclsys · hclsys · commit e76f2cd24f0a · 2026-05-18T00:28:12.000+08:00
Apple Web Push (Safari, iOS PWA) rejects VAPID JWTs whose `sub` is `mailto:openclaw@localhost` with `BadJwtToken`. The upstream `web-push` README documents this restriction: VAPID subjects must be either `https:` URLs or `mailto:` with a real domain — not `localhost`. The result on first install with no `OPENCLAW_VAPID_SUBJECT` override was that iOS PWA subscribers silently never received pushes. Switch the default to `https://openclaw.ai` (the project's public URL) so Apple's push endpoint accepts the JWT out of the box. Operators who want a real contact mailbox can still override with `OPENCLAW_VAPID_SUBJECT=mailto:ops@example.com`. Test updates: - `setVapidDetails` direct assertion now expects the new default. - The "generates and persists VAPID keys" regression assertion is relaxed to "valid VAPID subject (https: or mailto:) AND not localhost", which is the actual contract the issue describes.
diff --git a/src/infra/push-web.test.ts b/src/infra/push-web.test.ts
@@ -58,7 +58,12 @@ describe("resolveVapidKeys", () => {
     const keys = await resolveVapidKeys(tmpDir);
     expect(keys.publicKey).toBe("test-public-key-base64url");
     expect(keys.privateKey).toBe("test-private-key-base64url");
-    expect(keys.subject).toMatch(/^mailto:/);
+    // #83134: default must be a valid VAPID `sub` Apple Web Push accepts.
+    // `mailto:openclaw@localhost` was rejected with BadJwtToken; the
+    // upstream web-push README documents `https:` or `mailto:` with a
+    // real domain.
+    expect(keys.subject).toMatch(/^(https:\/\/|mailto:)/);
+    expect(keys.subject).not.toMatch(/localhost/);
 
     // Second call returns same keys.
     const keys2 = await resolveVapidKeys(tmpDir);
@@ -211,7 +216,7 @@ describe("sending", () => {
     expect(result.ok).toBe(true);
     expect(vi.mocked(webPush.setVapidDetails)).toHaveBeenCalledTimes(1);
     expect(vi.mocked(webPush.setVapidDetails)).toHaveBeenCalledWith(
-      "mailto:openclaw@localhost",
+      "https://openclaw.ai",
       "test-public-key-base64url",
       "test-private-key-base64url",
     );
diff --git a/src/infra/push-web.ts b/src/infra/push-web.ts
@@ -36,7 +36,13 @@ const WEB_PUSH_STATE_FILENAME = "push/web-push-subscriptions.json";
 const VAPID_KEYS_FILENAME = "push/vapid-keys.json";
 const MAX_ENDPOINT_LENGTH = 2048;
 const MAX_KEY_LENGTH = 512;
-const DEFAULT_VAPID_SUBJECT = "mailto:openclaw@localhost";
+// #83134: Apple Web Push (Safari + iOS PWA) rejects VAPID `aud` JWTs whose
+// `sub` is `mailto:openclaw@localhost` with `BadJwtToken`. The upstream
+// `web-push` README documents the same restriction. Use the project's public
+// `https://openclaw.ai` as the contact URL so Apple's push endpoint accepts
+// the JWT out of the box on first install; operators who want a real contact
+// can still override with `OPENCLAW_VAPID_SUBJECT=mailto:...`.
+const DEFAULT_VAPID_SUBJECT = "https://openclaw.ai";
 
 const withLock = createAsyncLock();
 
