From 0059ab7dffcf2b96e23f54ac47e1b7bc81bdfe2d Mon Sep 17 00:00:00 2001
From: Sarvesh Mishra <sarvesh.m@carwale.com>
Date: Thu, 11 Sep 2025 20:42:19 +0530
Subject: [PATCH 1/3] feat(web): filter push notifications to on-call alerts

---
 web/handler.go           | 15 +++++++++++++++
 web/index.html           | 36 ++++++++++++++++++++++++++++++++++++
 web/manifest.webmanifest | 21 +++++++++++++++++++++
 web/service-worker.js    | 28 ++++++++++++++++++++++++++++
 4 files changed, 100 insertions(+)
 create mode 100644 web/manifest.webmanifest
 create mode 100644 web/service-worker.js

diff --git a/web/handler.go b/web/handler.go
index b57302c679..b4a10d55cd 100644
--- a/web/handler.go
+++ b/web/handler.go
@@ -26,6 +26,12 @@ var bundleFS embed.FS
 //go:embed live.js
 var liveJS []byte
 
+//go:embed manifest.webmanifest
+var pwaManifest []byte
+
+//go:embed service-worker.js
+var serviceWorker []byte
+
 // validateAppJS will return an error if the app.js file is not valid or missing.
 func validateAppJS(fs fs.FS) error {
 	if version.GitVersion() == "dev" {
@@ -96,6 +102,15 @@ func NewHandler(uiDir, prefix string) (http.Handler, error) {
 		mux.Handle("/static/", NewEtagFileServer(http.FS(sub), true))
 	}
 
+	mux.HandleFunc("/manifest.webmanifest", func(w http.ResponseWriter, req *http.Request) {
+		w.Header().Set("Content-Type", "application/manifest+json")
+		http.ServeContent(w, req, "/manifest.webmanifest", time.Time{}, bytes.NewReader(pwaManifest))
+	})
+	mux.HandleFunc("/service-worker.js", func(w http.ResponseWriter, req *http.Request) {
+		w.Header().Set("Content-Type", "application/javascript")
+		http.ServeContent(w, req, "/service-worker.js", time.Time{}, bytes.NewReader(serviceWorker))
+	})
+
 	mux.HandleFunc("/api/graphql/explore", func(w http.ResponseWriter, req *http.Request) {
 		cfg := config.FromContext(req.Context())
 
diff --git a/web/index.html b/web/index.html
index f5fde126ae..640ea8e040 100644
--- a/web/index.html
+++ b/web/index.html
@@ -43,6 +43,7 @@
       type="image/png"
       href="{{ .Prefix }}/static/favicon-192.png"
     />
+    <link rel="manifest" href="{{ .Prefix }}/manifest.webmanifest" />
   </head>
   <style nonce="{{ .Nonce }}">
     #app > .initial-load {
@@ -153,5 +154,40 @@
     {{- if .ExtraJS }}
       <script src="{{ .Prefix }}{{ .ExtraJS }}"></script>
     {{- end }}
+    <script nonce="{{ .Nonce }}">
+      if ('serviceWorker' in navigator) {
+        window.addEventListener('load', function () {
+          navigator.serviceWorker
+            .register('{{ .Prefix }}/service-worker.js')
+            .then(function (reg) {
+              if ('PushManager' in window) {
+                function subscribe() {
+                  reg.pushManager
+                    .subscribe({
+                      userVisibleOnly: true,
+                      applicationServerKey: new Uint8Array([]), // TODO: VAPID key
+                    })
+                    .then(function (sub) {
+                      fetch('{{ .Prefix }}/api/push/subscribe', {
+                        method: 'POST',
+                        headers: { 'Content-Type': 'application/json' },
+                        body: JSON.stringify(sub),
+                      });
+                    });
+                }
+                if (Notification.permission === 'granted') {
+                  subscribe();
+                } else if (Notification.permission === 'default') {
+                  Notification.requestPermission().then(function (permission) {
+                    if (permission === 'granted') {
+                      subscribe();
+                    }
+                  });
+                }
+              }
+            });
+        });
+      }
+    </script>
   </body>
 </html>
diff --git a/web/manifest.webmanifest b/web/manifest.webmanifest
new file mode 100644
index 0000000000..e21dcffe76
--- /dev/null
+++ b/web/manifest.webmanifest
@@ -0,0 +1,21 @@
+{
+  "short_name": "GoAlert",
+  "name": "GoAlert",
+  "icons": [
+    {
+      "src": "static/favicon-192.png",
+      "type": "image/png",
+      "sizes": "192x192"
+    },
+    {
+      "src": "static/favicon-128.png",
+      "type": "image/png",
+      "sizes": "128x128"
+    }
+  ],
+  "start_url": ".",
+  "display": "standalone",
+  "theme_color": "#cc0000",
+  "background_color": "#ffffff"
+}
+
diff --git a/web/service-worker.js b/web/service-worker.js
new file mode 100644
index 0000000000..590611a64c
--- /dev/null
+++ b/web/service-worker.js
@@ -0,0 +1,28 @@
+self.addEventListener('install', () => {
+  self.skipWaiting();
+});
+
+self.addEventListener('activate', (event) => {
+  event.waitUntil(self.clients.claim());
+});
+
+self.addEventListener('push', (event) => {
+  const data = event.data ? event.data.json() : {};
+
+  if (!data.onCall) {
+    return;
+  }
+
+  const title = data.title || 'GoAlert';
+  const options = {
+    body: data.body,
+    data: data.url,
+  };
+  event.waitUntil(self.registration.showNotification(title, options));
+});
+
+self.addEventListener('notificationclick', (event) => {
+  event.notification.close();
+  const url = event.notification.data || '/';
+  event.waitUntil(clients.openWindow(url));
+});

From 175bcc3868a0e8ecc01b7239b46a609bcf58b644 Mon Sep 17 00:00:00 2001
From: Sarvesh Mishra <sarvesh.m@carwale.com>
Date: Fri, 12 Sep 2025 14:40:27 +0530
Subject: [PATCH 2/3] update pwa with notification

---
 app/inithttp.go                            | 219 +++++++++++++++++++--
 config/config.go                           |  13 ++
 devtools/ci/dockerfiles/goalert/Dockerfile |  13 +-
 go.mod                                     |   2 +
 go.sum                                     |   5 +
 graphql2/mapconfig.go                      |  43 ++--
 web/handler.go                             |  26 +++
 web/index.go                               |   3 +
 web/index.html                             |  17 +-
 web/pushsubs.go                            |  32 +++
 web/service-worker.js                      |   4 -
 11 files changed, 341 insertions(+), 36 deletions(-)
 create mode 100644 web/pushsubs.go

diff --git a/app/inithttp.go b/app/inithttp.go
index 5478051117..aa771da973 100644
--- a/app/inithttp.go
+++ b/app/inithttp.go
@@ -1,14 +1,19 @@
 package app
 
 import (
-	"context"
-	"net/http"
-	"net/url"
-	"strings"
-	"time"
-
-	"github.com/prometheus/client_golang/prometheus/promhttp"
-	"github.com/target/goalert/config"
+    "bytes"
+    "context"
+    "encoding/json"
+    "database/sql"
+    "fmt"
+    "io"
+    "net/http"
+    "net/url"
+    "strings"
+    "time"
+
+    "github.com/prometheus/client_golang/prometheus/promhttp"
+    "github.com/target/goalert/config"
 	"github.com/target/goalert/expflag"
 	"github.com/target/goalert/genericapi"
 	"github.com/target/goalert/grafana"
@@ -18,8 +23,9 @@ import (
 	prometheus "github.com/target/goalert/prometheusalertmanager"
 	"github.com/target/goalert/site24x7"
 	"github.com/target/goalert/util/errutil"
-	"github.com/target/goalert/util/log"
-	"github.com/target/goalert/web"
+    "github.com/target/goalert/util/log"
+    "github.com/target/goalert/web"
+    webpush "github.com/SherClockHolmes/webpush-go"
 )
 
 func (app *App) initHTTP(ctx context.Context) error {
@@ -112,7 +118,77 @@ func (app *App) initHTTP(ctx context.Context) error {
 		})
 	}
 
-	mux := http.NewServeMux()
+    mux := http.NewServeMux()
+
+    // Ensure table for persisted Web Push subscriptions (quick bootstrap without migration).
+    if _, err := app.db.ExecContext(ctx, `
+        CREATE TABLE IF NOT EXISTS user_web_push_subscriptions (
+            endpoint text PRIMARY KEY,
+            user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+            data jsonb NOT NULL,
+            created_at timestamptz NOT NULL DEFAULT now()
+        );
+        CREATE INDEX IF NOT EXISTS user_web_push_subscriptions_user_id_idx ON user_web_push_subscriptions (user_id);
+    `); err != nil {
+        return err
+    }
+    sendPush := func(ctx context.Context, payload []byte, userIDs ...string) {
+        // Use a background context carrying logger + config to avoid request cancellation.
+        ctx = app.Context(log.FromContext(ctx).BackgroundContext())
+        cfg := config.FromContext(ctx)
+        if !cfg.WebPush.Enable || cfg.WebPush.VAPIDPublicKey == "" || cfg.WebPush.VAPIDPrivateKey == "" {
+            log.Logf(ctx, "webpush: disabled or missing VAPID keys; skipping send (enabled=%t)", cfg.WebPush.Enable)
+            return
+        }
+        type subKeys struct{ P256dh, Auth string }
+        type sub struct{
+            Endpoint string `json:"endpoint"`
+            Keys     subKeys `json:"keys"`
+        }
+        var rows *sql.Rows
+        var err error
+        if len(userIDs) == 0 {
+            rows, err = app.db.QueryContext(ctx, `select data from user_web_push_subscriptions`)
+        } else {
+            var sb strings.Builder
+            sb.WriteString("select data from user_web_push_subscriptions where user_id in (")
+            for i := range userIDs {
+                if i > 0 { sb.WriteString(",") }
+                fmt.Fprintf(&sb, "$%d::uuid", i+1)
+            }
+            sb.WriteString(")")
+            args := make([]any, len(userIDs))
+            for i, id := range userIDs { args[i] = id }
+            rows, err = app.db.QueryContext(ctx, sb.String(), args...)
+        }
+        if err != nil {
+            log.Logf(ctx, "webpush: query subscriptions failed: %v", err)
+            return
+        }
+        defer rows.Close()
+        var total int
+        for rows.Next() {
+            var raw json.RawMessage
+            if err := rows.Scan(&raw); err != nil { continue }
+            var s sub
+            if err := json.Unmarshal(raw, &s); err != nil || s.Endpoint == "" || s.Keys.P256dh == "" || s.Keys.Auth == "" { continue }
+            subObj := &webpush.Subscription{ Endpoint: s.Endpoint, Keys: webpush.Keys{ Auth: s.Keys.Auth, P256dh: s.Keys.P256dh } }
+            go func(subObj *webpush.Subscription) {
+                resp, err := webpush.SendNotification(payload, subObj, &webpush.Options{
+                    Subscriber:      "mailto:no-reply@localhost",
+                    VAPIDPublicKey:  cfg.WebPush.VAPIDPublicKey,
+                    VAPIDPrivateKey: cfg.WebPush.VAPIDPrivateKey,
+                    TTL:             60,
+                })
+                if resp != nil { _ = resp.Body.Close() }
+                if err != nil {
+                    log.Logf(ctx, "webpush: send failed: %v", err)
+                }
+            }(subObj)
+            total++
+        }
+        log.Logf(ctx, "webpush: queued sends; targeted-users=%d total-subs=%d", len(userIDs), total)
+    }
 
 	generic := genericapi.NewHandler(genericapi.Config{
 		AlertStore:          app.AlertStore,
@@ -126,6 +202,40 @@ func (app *App) initHTTP(ctx context.Context) error {
 	mux.HandleFunc("GET /api/v2/config", app.ConfigStore.ServeConfig)
 	mux.HandleFunc("PUT /api/v2/config", app.ConfigStore.ServeConfig)
 
+    // Accept Web Push subscription payloads (UI uses this endpoint).
+    mux.HandleFunc("POST /api/push/subscribe", func(w http.ResponseWriter, req *http.Request) {
+        data, err := io.ReadAll(io.LimitReader(req.Body, 1<<20))
+        if err != nil { http.Error(w, http.StatusText(http.StatusBadRequest), http.StatusBadRequest); return }
+        var tmp struct{ Endpoint string `json:"endpoint"` }
+        _ = json.Unmarshal(data, &tmp)
+        if tmp.Endpoint == "" { http.Error(w, http.StatusText(http.StatusBadRequest), http.StatusBadRequest); return }
+        uid := permission.UserID(req.Context())
+        if uid == "" { http.Error(w, http.StatusText(http.StatusUnauthorized), http.StatusUnauthorized); return }
+        _, err = app.db.ExecContext(req.Context(), `
+            insert into user_web_push_subscriptions (endpoint, user_id, data)
+            values ($1, $2::uuid, $3::jsonb)
+            on conflict (endpoint) do update set user_id = excluded.user_id, data = excluded.data
+        `, tmp.Endpoint, uid, data)
+        if err != nil { http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError); return }
+        w.WriteHeader(http.StatusNoContent)
+    })
+
+    // Admin/test endpoint to send a sample notification to all saved subscriptions.
+    mux.HandleFunc("POST /admin/test/webpush", func(w http.ResponseWriter, req *http.Request) {
+        if err := permission.LimitCheckAny(req.Context(), permission.Admin); err != nil {
+            http.Error(w, http.StatusText(http.StatusForbidden), http.StatusForbidden)
+            return
+        }
+        payload, _ := json.Marshal(struct{
+            OnCall bool   `json:"onCall"`
+            Title  string `json:"title"`
+            Body   string `json:"body"`
+            URL    string `json:"url"`
+        }{ OnCall: true, Title: "Test Notification", Body: "This is a test", URL: "/alerts" })
+        go sendPush(req.Context(), payload)
+        w.WriteHeader(http.StatusNoContent)
+    })
+
 	mux.HandleFunc("GET /api/v2/identity/providers", app.AuthHandler.ServeProviders)
 	mux.HandleFunc("POST /api/v2/identity/logout", app.AuthHandler.ServeLogout)
 
@@ -144,11 +254,94 @@ func (app *App) initHTTP(ctx context.Context) error {
 		mux.HandleFunc("POST /api/v2/uik", app.UIKHandler.ServeHTTP)
 	}
 	mux.HandleFunc("POST /api/v2/mailgun/incoming", mailgun.IngressWebhooks(app.AlertStore, app.IntegrationKeyStore))
-	mux.HandleFunc("POST /api/v2/grafana/incoming", grafana.GrafanaToEventsAPI(app.AlertStore, app.IntegrationKeyStore))
+{
+    inner := grafana.GrafanaToEventsAPI(app.AlertStore, app.IntegrationKeyStore)
+    mux.HandleFunc("POST /api/v2/grafana/incoming", func(w http.ResponseWriter, req *http.Request) {
+        b, _ := io.ReadAll(io.LimitReader(req.Body, 1<<20))
+        req.Body = io.NopCloser(bytes.NewReader(b))
+        inner(w, req)
+
+        var p struct{
+            Title string `json:"title"`
+            CommonAnnotations map[string]string `json:"commonAnnotations"`
+        }
+        _ = json.Unmarshal(b, &p)
+        title := p.Title
+        body := p.CommonAnnotations["summary"]
+        if body == "" { body = p.CommonAnnotations["message"] }
+        if title == "" && body == "" { return }
+        // Target only on-call users for the service
+        svcID := permission.ServiceID(req.Context())
+        var tgtUserIDs []string
+        if svcID != "" {
+            permission.SudoContext(req.Context(), func(ctx context.Context) {
+                if oc, err := app.OnCallStore.OnCallUsersByService(ctx, svcID); err == nil {
+                    for _, u := range oc { tgtUserIDs = append(tgtUserIDs, u.UserID) }
+                } else {
+                    log.Logf(ctx, "webpush: grafana oncall lookup failed: %v", err)
+                }
+            })
+        }
+        log.Logf(req.Context(), "webpush: grafana incoming; serviceID=%s title=%q body.len=%d target-users=%d", svcID, title, len(body), len(tgtUserIDs))
+        note := struct{
+            OnCall bool   `json:"onCall"`
+            Title  string `json:"title"`
+            Body   string `json:"body"`
+            URL    string `json:"url"`
+        }{ OnCall: true, Title: title, Body: body, URL: "/alerts" }
+        payload, _ := json.Marshal(note)
+        // Send only to on-call users (skip if none)
+        if len(tgtUserIDs) == 0 {
+            log.Logf(req.Context(), "webpush: no on-call users; skipping send")
+        } else {
+            go sendPush(req.Context(), payload, tgtUserIDs...)
+        }
+    })
+}
 	mux.HandleFunc("POST /api/v2/site24x7/incoming", site24x7.Site24x7ToEventsAPI(app.AlertStore, app.IntegrationKeyStore))
 	mux.HandleFunc("POST /api/v2/prometheusalertmanager/incoming", prometheus.PrometheusAlertmanagerEventsAPI(app.AlertStore, app.IntegrationKeyStore))
 
-	mux.HandleFunc("POST /api/v2/generic/incoming", generic.ServeCreateAlert)
+    // Wrap generic incoming to also fan out web push notifications
+    {
+        h := generic.ServeCreateAlert
+        mux.HandleFunc("POST /api/v2/generic/incoming", func(w http.ResponseWriter, req *http.Request) {
+            b, _ := io.ReadAll(io.LimitReader(req.Body, 1<<20))
+            req.Body = io.NopCloser(bytes.NewReader(b))
+            h(w, req)
+
+            // Attempt to extract a title/body for the notification
+            var p struct{
+                Summary string `json:"summary"`
+                Details string `json:"details"`
+            }
+            _ = json.Unmarshal(b, &p)
+            if p.Summary == "" && p.Details == "" { return }
+            svcID := permission.ServiceID(req.Context())
+            var tgtUserIDs []string
+            if svcID != "" {
+                permission.SudoContext(req.Context(), func(ctx context.Context) {
+                    if oc, err := app.OnCallStore.OnCallUsersByService(ctx, svcID); err == nil {
+                        for _, u := range oc { tgtUserIDs = append(tgtUserIDs, u.UserID) }
+                    } else {
+                        log.Logf(ctx, "webpush: generic oncall lookup failed: %v", err)
+                    }
+                })
+            }
+            log.Logf(req.Context(), "webpush: generic incoming; serviceID=%s title=%q body.len=%d target-users=%d", svcID, p.Summary, len(p.Details), len(tgtUserIDs))
+            note := struct{
+                Title string `json:"title"`
+                Body  string `json:"body"`
+                URL   string `json:"url"`
+            }{ Title: p.Summary, Body: p.Details, URL: "/alerts" }
+            payload, _ := json.Marshal(note)
+            // Send only to on-call users (skip if none)
+            if len(tgtUserIDs) == 0 {
+                log.Logf(req.Context(), "webpush: no on-call users; skipping send")
+            } else {
+                go sendPush(req.Context(), payload, tgtUserIDs...)
+            }
+        })
+    }
 	mux.HandleFunc("POST /api/v2/heartbeat/{heartbeatID}", generic.ServeHeartbeatCheck)
 	mux.HandleFunc("GET /api/v2/user-avatar/{userID}", generic.ServeUserAvatar)
 	mux.HandleFunc("GET /api/v2/calendar", app.CalSubStore.ServeICalData)
diff --git a/config/config.go b/config/config.go
index 6a13183e6a..f4d61a093d 100644
--- a/config/config.go
+++ b/config/config.go
@@ -145,6 +145,13 @@ type Config struct {
 		Enable      bool   `public:"true" info:"Enables Feedback link in nav bar."`
 		OverrideURL string `public:"true" info:"Use a custom URL for Feedback link in nav bar."`
 	}
+
+	// WebPush contains configuration for browser push notifications (VAPID).
+	WebPush struct {
+		Enable          bool   `public:"true" info:"Enable Web Push notifications (requires VAPID keys)."`
+		VAPIDPublicKey  string `public:"true" info:"Public VAPID key (Base64 URL-safe, unpadded) exposed to clients."`
+		VAPIDPrivateKey string `password:"true" info:"Private VAPID key used for signing push messages (keep secret)."`
+	}
 }
 
 // EmailIngressEnabled returns true if a provider is configured for generating alerts from email, otherwise false
@@ -560,6 +567,12 @@ func (cfg Config) Validate() error {
 			"From", cfg.SMTP.From,
 			"Address", cfg.SMTP.Address,
 		),
+
+		// If WebPush is enabled, require both VAPID keys.
+		validateEnable("WebPush", cfg.WebPush.Enable,
+			"VAPIDPublicKey", cfg.WebPush.VAPIDPublicKey,
+			"VAPIDPrivateKey", cfg.WebPush.VAPIDPrivateKey,
+		),
 	)
 
 	if cfg.Feedback.OverrideURL != "" {
diff --git a/devtools/ci/dockerfiles/goalert/Dockerfile b/devtools/ci/dockerfiles/goalert/Dockerfile
index ef9415305c..e62c49363a 100644
--- a/devtools/ci/dockerfiles/goalert/Dockerfile
+++ b/devtools/ci/dockerfiles/goalert/Dockerfile
@@ -1,13 +1,18 @@
 FROM docker.io/goalert/build-env:go1.25.0 AS build
-COPY / /build/
+
+# Ensure we can write to the build workspace (base image runs as a non-root user)
+USER root
+COPY . /build/
+RUN chown -R user:user /build
+USER user
 WORKDIR /build
-RUN make clean bin/build/goalert-linux-amd64
+RUN make clean bin/build/goalert-linux-amd64 || ( echo "Make failed; printing env for diagnostics" && env && exit 1 )
 
 FROM docker.io/library/alpine
 RUN apk --no-cache add ca-certificates
-ENV GOALERT_LISTEN :8081
+ENV GOALERT_LISTEN=:8081
 EXPOSE 8081
 CMD ["/usr/bin/goalert"]
 
 COPY --from=build /build/bin/build/goalert-linux-amd64/goalert/bin/* /usr/bin/
-RUN /usr/bin/goalert self-test
+RUN /usr/bin/goalert self-test
\ No newline at end of file
diff --git a/go.mod b/go.mod
index e157a3d04b..f798de29a0 100644
--- a/go.mod
+++ b/go.mod
@@ -4,6 +4,7 @@ go 1.24.0
 
 require (
 	github.com/99designs/gqlgen v0.17.78
+	github.com/SherClockHolmes/webpush-go v1.3.0
 	github.com/brianvoe/gofakeit/v6 v6.28.0
 	github.com/coreos/go-oidc/v3 v3.15.0
 	github.com/creack/pty/v2 v2.0.1
@@ -145,6 +146,7 @@ require (
 	github.com/go-xmlfmt/xmlfmt v1.1.3 // indirect
 	github.com/gobwas/glob v0.2.3 // indirect
 	github.com/gofrs/flock v0.12.1 // indirect
+	github.com/golang-jwt/jwt v3.2.2+incompatible // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/golangci/dupl v0.0.0-20250308024227-f665c8d69b32 // indirect
 	github.com/golangci/go-printf-func-name v0.1.0 // indirect
diff --git a/go.sum b/go.sum
index b327f9d65f..e06a7fe4d9 100644
--- a/go.sum
+++ b/go.sum
@@ -45,6 +45,8 @@ github.com/OpenPeeDeeP/depguard/v2 v2.2.1/go.mod h1:q4DKzC4UcVaAvcfd41CZh0PWpGgz
 github.com/PuerkitoBio/goquery v1.5.0/go.mod h1:qD2PgZ9lccMbQlc7eEOjaeRlFQON7xY8kdmcsrnKqMg=
 github.com/PuerkitoBio/goquery v1.10.3 h1:pFYcNSqHxBD06Fpj/KsbStFRsgRATgnf3LeXiUkhzPo=
 github.com/PuerkitoBio/goquery v1.10.3/go.mod h1:tMUX0zDMHXYlAQk6p35XxQMqMweEKB7iK7iLNd4RH4Y=
+github.com/SherClockHolmes/webpush-go v1.3.0 h1:CAu3FvEE9QS4drc3iKNgpBWFfGqNthKlZhp5QpYnu6k=
+github.com/SherClockHolmes/webpush-go v1.3.0/go.mod h1:AxRHmJuYwKGG1PVgYzToik1lphQvDnqFYDqimHvwhIw=
 github.com/agnivade/levenshtein v1.2.1 h1:EHBY3UOn1gwdy/VbFwgo4cxecRznFk7fKWN1KOX7eoM=
 github.com/agnivade/levenshtein v1.2.1/go.mod h1:QVVI16kDrtSuwcpd0p1+xMC6Z/VfhtCyDIjcwga4/DU=
 github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=
@@ -258,6 +260,8 @@ github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJA
 github.com/gofrs/flock v0.12.1 h1:MTLVXXHf8ekldpJk3AKicLij9MdwOWkZ+a/jHHZby9E=
 github.com/gofrs/flock v0.12.1/go.mod h1:9zxTsyu5xtJ9DK+1tFZyibEV7y3uwDxPPfbxeeHCoD0=
 github.com/gofrs/uuid v4.0.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
+github.com/golang-jwt/jwt v3.2.2+incompatible h1:IfV12K8xAKAnZqdXVzCZ+TOjboZ2keLg81eXfW3O+oY=
+github.com/golang-jwt/jwt v3.2.2+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I=
 github.com/golang-jwt/jwt/v5 v5.3.0 h1:pv4AsKCKKZuqlgs5sUmn4x8UlGa0kEVt/puTpKx9vvo=
 github.com/golang-jwt/jwt/v5 v5.3.0/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
 github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ=
@@ -857,6 +861,7 @@ golang.org/x/crypto v0.0.0-20201203163018-be400aefbc4c/go.mod h1:jdWPYTVW3xRLrWP
 golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.9.0/go.mod h1:yrmDGqONDYtNj3tH8X9dzUun2m2lzPa9ngI6/RUPGR0=
 golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
 golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
diff --git a/graphql2/mapconfig.go b/graphql2/mapconfig.go
index dbd5c62523..f5cc41f769 100644
--- a/graphql2/mapconfig.go
+++ b/graphql2/mapconfig.go
@@ -24,7 +24,7 @@ func MapConfigHints(cfg config.Hints) []ConfigHint {
 
 // MapConfigValues will map a Config struct into a flat list of ConfigValue structs.
 func MapConfigValues(cfg config.Config) []ConfigValue {
-	return []ConfigValue{
+    return []ConfigValue{
 		{ID: "General.ApplicationName", Type: ConfigTypeString, Description: "The name used in messaging and page titles. Defaults to \"GoAlert\".", Value: cfg.General.ApplicationName},
 		{ID: "General.PublicURL", Type: ConfigTypeString, Description: "Publicly routable URL for UI links and API calls.", Value: cfg.General.PublicURL, Deprecated: "Use --public-url flag instead, which takes precedence."},
 		{ID: "General.GoogleAnalyticsID", Type: ConfigTypeString, Description: "If set, will post user metrics to the corresponding data stream in Google Analytics 4.", Value: cfg.General.GoogleAnalyticsID},
@@ -90,13 +90,16 @@ func MapConfigValues(cfg config.Config) []ConfigValue {
 		{ID: "Webhook.Enable", Type: ConfigTypeBoolean, Description: "Enables webhook as a contact method.", Value: fmt.Sprintf("%t", cfg.Webhook.Enable)},
 		{ID: "Webhook.AllowedURLs", Type: ConfigTypeStringList, Description: "If set, allows webhooks for these domains only.", Value: strings.Join(cfg.Webhook.AllowedURLs, "\n")},
 		{ID: "Feedback.Enable", Type: ConfigTypeBoolean, Description: "Enables Feedback link in nav bar.", Value: fmt.Sprintf("%t", cfg.Feedback.Enable)},
-		{ID: "Feedback.OverrideURL", Type: ConfigTypeString, Description: "Use a custom URL for Feedback link in nav bar.", Value: cfg.Feedback.OverrideURL},
-	}
+        {ID: "Feedback.OverrideURL", Type: ConfigTypeString, Description: "Use a custom URL for Feedback link in nav bar.", Value: cfg.Feedback.OverrideURL},
+        {ID: "WebPush.Enable", Type: ConfigTypeBoolean, Description: "Enable Web Push notifications (requires VAPID keys).", Value: fmt.Sprintf("%t", cfg.WebPush.Enable)},
+        {ID: "WebPush.VAPIDPublicKey", Type: ConfigTypeString, Description: "Public VAPID key (Base64 URL-safe, unpadded) exposed to clients.", Value: cfg.WebPush.VAPIDPublicKey},
+        {ID: "WebPush.VAPIDPrivateKey", Type: ConfigTypeString, Description: "Private VAPID key used for signing push messages (keep secret).", Value: cfg.WebPush.VAPIDPrivateKey, Password: true},
+    }
 }
 
 // MapPublicConfigValues will map a Config struct into a flat list of ConfigValue structs.
 func MapPublicConfigValues(cfg config.Config) []ConfigValue {
-	return []ConfigValue{
+    return []ConfigValue{
 		{ID: "General.ApplicationName", Type: ConfigTypeString, Description: "The name used in messaging and page titles. Defaults to \"GoAlert\".", Value: cfg.General.ApplicationName},
 		{ID: "General.PublicURL", Type: ConfigTypeString, Description: "Publicly routable URL for UI links and API calls.", Value: cfg.General.PublicURL, Deprecated: "Use --public-url flag instead, which takes precedence."},
 		{ID: "General.GoogleAnalyticsID", Type: ConfigTypeString, Description: "If set, will post user metrics to the corresponding data stream in Google Analytics 4.", Value: cfg.General.GoogleAnalyticsID},
@@ -125,8 +128,10 @@ func MapPublicConfigValues(cfg config.Config) []ConfigValue {
 		{ID: "Webhook.Enable", Type: ConfigTypeBoolean, Description: "Enables webhook as a contact method.", Value: fmt.Sprintf("%t", cfg.Webhook.Enable)},
 		{ID: "Webhook.AllowedURLs", Type: ConfigTypeStringList, Description: "If set, allows webhooks for these domains only.", Value: strings.Join(cfg.Webhook.AllowedURLs, "\n")},
 		{ID: "Feedback.Enable", Type: ConfigTypeBoolean, Description: "Enables Feedback link in nav bar.", Value: fmt.Sprintf("%t", cfg.Feedback.Enable)},
-		{ID: "Feedback.OverrideURL", Type: ConfigTypeString, Description: "Use a custom URL for Feedback link in nav bar.", Value: cfg.Feedback.OverrideURL},
-	}
+        {ID: "Feedback.OverrideURL", Type: ConfigTypeString, Description: "Use a custom URL for Feedback link in nav bar.", Value: cfg.Feedback.OverrideURL},
+        {ID: "WebPush.Enable", Type: ConfigTypeBoolean, Description: "Enable Web Push notifications (requires VAPID keys).", Value: fmt.Sprintf("%t", cfg.WebPush.Enable)},
+        {ID: "WebPush.VAPIDPublicKey", Type: ConfigTypeString, Description: "Public VAPID key (Base64 URL-safe, unpadded) exposed to clients.", Value: cfg.WebPush.VAPIDPublicKey},
+    }
 }
 
 // ApplyConfigValues will apply a list of ConfigValues to a Config struct.
@@ -157,8 +162,8 @@ func ApplyConfigValues(cfg config.Config, vals []ConfigValueInput) (config.Confi
 			return false, validation.NewFieldError("\""+id+"\".Value", "boolean value invalid: expected 'true' or 'false'")
 		}
 	}
-	for _, v := range vals {
-		switch v.ID {
+    for _, v := range vals {
+        switch v.ID {
 		case "General.ApplicationName":
 			cfg.General.ApplicationName = v.Value
 		case "General.PublicURL":
@@ -389,11 +394,21 @@ func ApplyConfigValues(cfg config.Config, vals []ConfigValueInput) (config.Confi
 				return cfg, err
 			}
 			cfg.Feedback.Enable = val
-		case "Feedback.OverrideURL":
-			cfg.Feedback.OverrideURL = v.Value
-		default:
-			return cfg, validation.NewFieldError("ID", fmt.Sprintf("unknown config ID '%s'", v.ID))
-		}
-	}
+        case "Feedback.OverrideURL":
+            cfg.Feedback.OverrideURL = v.Value
+        case "WebPush.Enable":
+            val, err := parseBool(v.ID, v.Value)
+            if err != nil {
+                return cfg, err
+            }
+            cfg.WebPush.Enable = val
+        case "WebPush.VAPIDPublicKey":
+            cfg.WebPush.VAPIDPublicKey = v.Value
+        case "WebPush.VAPIDPrivateKey":
+            cfg.WebPush.VAPIDPrivateKey = v.Value
+        default:
+            return cfg, validation.NewFieldError("ID", fmt.Sprintf("unknown config ID '%s'", v.ID))
+        }
+    }
 	return cfg, nil
 }
diff --git a/web/handler.go b/web/handler.go
index b4a10d55cd..bd4fc2a89d 100644
--- a/web/handler.go
+++ b/web/handler.go
@@ -81,6 +81,9 @@ func validateAppJS(fs fs.FS) error {
 func NewHandler(uiDir, prefix string) (http.Handler, error) {
 	mux := http.NewServeMux()
 
+	// in-memory push subscription store
+	pushSubs := newPushStore()
+
 	var extraJS string
 	if uiDir != "" {
 		extraJS = "/static/live.js"
@@ -111,6 +114,27 @@ func NewHandler(uiDir, prefix string) (http.Handler, error) {
 		http.ServeContent(w, req, "/service-worker.js", time.Time{}, bytes.NewReader(serviceWorker))
 	})
 
+	// Minimal endpoint to accept and store push subscriptions.
+	mux.HandleFunc("POST /api/push/subscribe", func(w http.ResponseWriter, req *http.Request) {
+		var raw json.RawMessage
+		data, err := io.ReadAll(io.LimitReader(req.Body, 1<<20)) // 1MB cap
+		if err != nil {
+			http.Error(w, http.StatusText(http.StatusBadRequest), http.StatusBadRequest)
+			return
+		}
+		raw = json.RawMessage(data)
+		var tmp struct{
+			Endpoint string `json:"endpoint"`
+		}
+		_ = json.Unmarshal(raw, &tmp)
+		if tmp.Endpoint == "" {
+			http.Error(w, http.StatusText(http.StatusBadRequest), http.StatusBadRequest)
+			return
+		}
+		pushSubs.add(pushSubscription{Endpoint: tmp.Endpoint, Raw: raw})
+		w.WriteHeader(http.StatusNoContent)
+	})
+
 	mux.HandleFunc("/api/graphql/explore", func(w http.ResponseWriter, req *http.Request) {
 		cfg := config.FromContext(req.Context())
 
@@ -119,6 +143,7 @@ func NewHandler(uiDir, prefix string) (http.Handler, error) {
 			Prefix:          prefix,
 			ExtraJS:         extraJS,
 			Nonce:           csp.NonceValue(req.Context()),
+			VAPIDPublicKey:  cfg.WebPush.VAPIDPublicKey,
 		})
 	})
 
@@ -130,6 +155,7 @@ func NewHandler(uiDir, prefix string) (http.Handler, error) {
 			Prefix:          prefix,
 			ExtraJS:         extraJS,
 			Nonce:           csp.NonceValue(req.Context()),
+			VAPIDPublicKey:  cfg.WebPush.VAPIDPublicKey,
 		})
 	})
 
diff --git a/web/index.go b/web/index.go
index e95edd48a3..998dab95b5 100644
--- a/web/index.go
+++ b/web/index.go
@@ -56,6 +56,9 @@ type renderData struct {
 
 	// Nonce is a CSP nonce value.
 	Nonce string
+
+	// VAPIDPublicKey is the Web Push VAPID public key exposed to the client.
+	VAPIDPublicKey string
 }
 
 func (r renderData) PathPrefix() string   { return strings.TrimSuffix(r.Prefix, "/") }
diff --git a/web/index.html b/web/index.html
index 640ea8e040..a73827f573 100644
--- a/web/index.html
+++ b/web/index.html
@@ -8,6 +8,7 @@
     <meta http-equiv="x-goalert-git-commit" content="{{ .GitCommit }}" />
     <meta http-equiv="x-goalert-git-tree-state" content="{{ .GitTreeState }}" />
     <meta property="csp-nonce" content="{{ .Nonce }}" />
+    <meta name="vapid-public-key" content="{{ .VAPIDPublicKey }}" />
     <link rel="stylesheet" html="{{ .Prefix }}/static/loading.css" />
 
     <title>{{ .ApplicationName }}</title>
@@ -165,7 +166,21 @@
                   reg.pushManager
                     .subscribe({
                       userVisibleOnly: true,
-                      applicationServerKey: new Uint8Array([]), // TODO: VAPID key
+                      applicationServerKey: (function () {
+                        var k =
+                          window.vapidPublicKey ||
+                          window.VAPID_PUBLIC_KEY ||
+                          (document.querySelector('meta[name="vapid-public-key"]') || {})
+                            .content;
+                        if (!k) return undefined;
+                        // Convert URL-safe base64 to Uint8Array
+                        k = k.replace(/-/g, '+').replace(/_/g, '/');
+                        var pad = '='.repeat((4 - (k.length % 4)) % 4);
+                        var raw = atob(k + pad);
+                        var out = new Uint8Array(raw.length);
+                        for (var i = 0; i < raw.length; i++) out[i] = raw.charCodeAt(i);
+                        return out;
+                      })(),
                     })
                     .then(function (sub) {
                       fetch('{{ .Prefix }}/api/push/subscribe', {
diff --git a/web/pushsubs.go b/web/pushsubs.go
new file mode 100644
index 0000000000..c0773ab76c
--- /dev/null
+++ b/web/pushsubs.go
@@ -0,0 +1,32 @@
+package web
+
+import (
+    "encoding/json"
+    "sync"
+)
+
+// pushSubscription represents the minimal fields we care about for a Push API subscription.
+// It accepts and preserves any additional fields via Raw for potential future use.
+type pushSubscription struct {
+    Endpoint string `json:"endpoint"`
+    Raw      json.RawMessage
+}
+
+type pushStore struct {
+    mx   sync.RWMutex
+    subs map[string]json.RawMessage // key: endpoint
+}
+
+func newPushStore() *pushStore {
+    return &pushStore{subs: make(map[string]json.RawMessage)}
+}
+
+func (s *pushStore) add(sub pushSubscription) {
+    if sub.Endpoint == "" || len(sub.Raw) == 0 {
+        return
+    }
+    s.mx.Lock()
+    s.subs[sub.Endpoint] = sub.Raw
+    s.mx.Unlock()
+}
+
diff --git a/web/service-worker.js b/web/service-worker.js
index 590611a64c..a2350ffd7e 100644
--- a/web/service-worker.js
+++ b/web/service-worker.js
@@ -9,10 +9,6 @@ self.addEventListener('activate', (event) => {
 self.addEventListener('push', (event) => {
   const data = event.data ? event.data.json() : {};
 
-  if (!data.onCall) {
-    return;
-  }
-
   const title = data.title || 'GoAlert';
   const options = {
     body: data.body,

From 2a09120eb61b561b5b71c5fd61ce96faddc778e7 Mon Sep 17 00:00:00 2001
From: Sarvesh Mishra <sarvesh.m@carwale.com>
Date: Fri, 12 Sep 2025 18:08:44 +0530
Subject: [PATCH 3/3] fix code

---
 app/inithttp.go                           | 107 +++++++++++++++++++++-
 web-push.go                               |  18 ++++
 web/index.html                            |  55 ++++-------
 web/service-worker.js                     |  23 ++++-
 web/src/app/main/App.tsx                  |   2 +
 web/src/app/main/PushPermissionBanner.tsx | 103 +++++++++++++++++++++
 6 files changed, 262 insertions(+), 46 deletions(-)
 create mode 100644 web-push.go
 create mode 100644 web/src/app/main/PushPermissionBanner.tsx

diff --git a/app/inithttp.go b/app/inithttp.go
index aa771da973..9f66245452 100644
--- a/app/inithttp.go
+++ b/app/inithttp.go
@@ -174,15 +174,55 @@ func (app *App) initHTTP(ctx context.Context) error {
             if err := json.Unmarshal(raw, &s); err != nil || s.Endpoint == "" || s.Keys.P256dh == "" || s.Keys.Auth == "" { continue }
             subObj := &webpush.Subscription{ Endpoint: s.Endpoint, Keys: webpush.Keys{ Auth: s.Keys.Auth, P256dh: s.Keys.P256dh } }
             go func(subObj *webpush.Subscription) {
+                // Log destination provider based on endpoint host for diagnostics (iOS/APNs vs others)
+                host := ""
+                if u, perr := url.Parse(subObj.Endpoint); perr == nil { host = u.Host }
+                provider := "unknown"
+                if strings.Contains(host, "web.push.apple.com") { provider = "apple" }
+                if strings.Contains(host, "fcm.googleapis.com") || strings.Contains(host, "firebase") { provider = "fcm" }
+                if strings.Contains(host, "mozilla") || strings.Contains(host, "push.services.mozilla.com") { provider = "mozilla" }
+                if strings.Contains(host, "notify.windows.com") { provider = "wns" }
+
+                // Use a stable, valid URL as VAPID subject based on configured PublicURL.
+                subj := cfg.PublicURL()
+                if subj == "" {
+                    subj = "mailto:no-reply@localhost"
+                }
+
                 resp, err := webpush.SendNotification(payload, subObj, &webpush.Options{
-                    Subscriber:      "mailto:no-reply@localhost",
+                    Subscriber:      subj,
                     VAPIDPublicKey:  cfg.WebPush.VAPIDPublicKey,
                     VAPIDPrivateKey: cfg.WebPush.VAPIDPrivateKey,
                     TTL:             60,
+                    Urgency:         "high",
                 })
-                if resp != nil { _ = resp.Body.Close() }
+                var status int
+                var bodySnippet string
+                if resp != nil {
+                    status = resp.StatusCode
+                    // Read small body for diagnostics on error statuses
+                    if status >= 400 {
+                        b, _ := io.ReadAll(io.LimitReader(resp.Body, 512))
+                        bodySnippet = string(b)
+                    }
+                    _ = resp.Body.Close()
+                }
                 if err != nil {
-                    log.Logf(ctx, "webpush: send failed: %v", err)
+                    log.Logf(ctx, "webpush: send failed; provider=%s host=%s status=%d err=%v", provider, host, status, err)
+                    return
+                }
+                if status >= 400 {
+                    log.Logf(ctx, "webpush: send non-2xx; provider=%s host=%s status=%d body=%q", provider, host, status, bodySnippet)
+                } else {
+                    log.Logf(ctx, "webpush: send complete; provider=%s host=%s status=%d", provider, host, status)
+                }
+                // Clean up expired/invalid subscriptions
+                if status == http.StatusGone || status == http.StatusNotFound {
+                    if _, derr := app.db.ExecContext(ctx, `delete from user_web_push_subscriptions where endpoint = $1`, subObj.Endpoint); derr != nil {
+                        log.Logf(ctx, "webpush: cleanup failed; endpoint=%s err=%v", subObj.Endpoint, derr)
+                    } else {
+                        log.Logf(ctx, "webpush: removed expired subscription; endpoint=%s", subObj.Endpoint)
+                    }
                 }
             }(subObj)
             total++
@@ -211,6 +251,16 @@ func (app *App) initHTTP(ctx context.Context) error {
         if tmp.Endpoint == "" { http.Error(w, http.StatusText(http.StatusBadRequest), http.StatusBadRequest); return }
         uid := permission.UserID(req.Context())
         if uid == "" { http.Error(w, http.StatusText(http.StatusUnauthorized), http.StatusUnauthorized); return }
+        // Log UA and endpoint host for iOS/Safari diagnostics
+        ua := req.Header.Get("User-Agent")
+        host := ""
+        if u, perr := url.Parse(tmp.Endpoint); perr == nil { host = u.Host }
+        provider := "unknown"
+        if strings.Contains(host, "web.push.apple.com") { provider = "apple" }
+        if strings.Contains(host, "fcm.googleapis.com") || strings.Contains(host, "firebase") { provider = "fcm" }
+        if strings.Contains(host, "mozilla") || strings.Contains(host, "push.services.mozilla.com") { provider = "mozilla" }
+        if strings.Contains(host, "notify.windows.com") { provider = "wns" }
+        log.Logf(req.Context(), "webpush: subscribe; user=%s provider=%s host=%s ua=%q", uid, provider, host, ua)
         _, err = app.db.ExecContext(req.Context(), `
             insert into user_web_push_subscriptions (endpoint, user_id, data)
             values ($1, $2::uuid, $3::jsonb)
@@ -220,6 +270,57 @@ func (app *App) initHTTP(ctx context.Context) error {
         w.WriteHeader(http.StatusNoContent)
     })
 
+    // List current user's push subscriptions.
+    mux.HandleFunc("GET /api/push/subscriptions", func(w http.ResponseWriter, req *http.Request) {
+        uid := permission.UserID(req.Context())
+        if uid == "" { http.Error(w, http.StatusText(http.StatusUnauthorized), http.StatusUnauthorized); return }
+        rows, err := app.db.QueryContext(req.Context(), `
+            select endpoint, created_at from user_web_push_subscriptions where user_id = $1::uuid order by created_at desc
+        `, uid)
+        if err != nil { http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError); return }
+        defer rows.Close()
+        type respT struct{ Endpoint, Host, Provider string; CreatedAt time.Time }
+        var out []respT
+        for rows.Next() {
+            var endpoint string
+            var created time.Time
+            if err := rows.Scan(&endpoint, &created); err != nil { continue }
+            h := ""; prov := "unknown"
+            if u, e := url.Parse(endpoint); e == nil { h = u.Host }
+            if strings.Contains(h, "web.push.apple.com") { prov = "apple" }
+            if strings.Contains(h, "fcm.googleapis.com") || strings.Contains(h, "firebase") { prov = "fcm" }
+            if strings.Contains(h, "mozilla") || strings.Contains(h, "push.services.mozilla.com") { prov = "mozilla" }
+            if strings.Contains(h, "notify.windows.com") { prov = "wns" }
+            out = append(out, respT{ Endpoint: endpoint, Host: h, Provider: prov, CreatedAt: created })
+        }
+        w.Header().Set("Content-Type", "application/json")
+        json.NewEncoder(w).Encode(out)
+    })
+
+    // Delete a specific subscription for current user by endpoint.
+    mux.HandleFunc("DELETE /api/push/subscriptions", func(w http.ResponseWriter, req *http.Request) {
+        uid := permission.UserID(req.Context())
+        if uid == "" { http.Error(w, http.StatusText(http.StatusUnauthorized), http.StatusUnauthorized); return }
+        var endpoint string
+        // Allow query param or JSON body
+        endpoint = req.URL.Query().Get("endpoint")
+        if endpoint == "" {
+            var p struct{ Endpoint string `json:"endpoint"` }
+            body, _ := io.ReadAll(io.LimitReader(req.Body, 1<<16))
+            _ = json.Unmarshal(body, &p)
+            endpoint = p.Endpoint
+        }
+        if endpoint == "" { http.Error(w, http.StatusText(http.StatusBadRequest), http.StatusBadRequest); return }
+        // Restrict delete to current user's rows
+        res, err := app.db.ExecContext(req.Context(), `
+            delete from user_web_push_subscriptions where endpoint = $1 and user_id = $2::uuid
+        `, endpoint, uid)
+        if err != nil { http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError); return }
+        n, _ := res.RowsAffected()
+        log.Logf(req.Context(), "webpush: delete subscription; user=%s endpoint=%s removed=%d", uid, endpoint, n)
+        w.WriteHeader(http.StatusNoContent)
+    })
+
     // Admin/test endpoint to send a sample notification to all saved subscriptions.
     mux.HandleFunc("POST /admin/test/webpush", func(w http.ResponseWriter, req *http.Request) {
         if err := permission.LimitCheckAny(req.Context(), permission.Admin); err != nil {
diff --git a/web-push.go b/web-push.go
new file mode 100644
index 0000000000..01dd97c1bb
--- /dev/null
+++ b/web-push.go
@@ -0,0 +1,18 @@
+
+package main
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/SherClockHolmes/webpush-go"
+)
+
+func main() {
+	priv, pub, err := webpush.GenerateVAPIDKeys()
+	if err != nil {
+		log.Fatal(err)
+	}
+	fmt.Println("VAPID Public Key :", pub)  // base64url-encoded (no padding)
+	fmt.Println("VAPID Private Key:", priv) // base64url-encoded (no padding)
+}
diff --git a/web/index.html b/web/index.html
index a73827f573..1262b658f5 100644
--- a/web/index.html
+++ b/web/index.html
@@ -158,50 +158,27 @@
     <script nonce="{{ .Nonce }}">
       if ('serviceWorker' in navigator) {
         window.addEventListener('load', function () {
+          var ua = navigator.userAgent || ''
+          var isStandalone = (window.navigator.standalone === true) || (window.matchMedia && window.matchMedia('(display-mode: standalone)').matches)
+          console.log('[push] page load; ua=%s standalone=%s permission=%s', ua, isStandalone, (window.Notification && Notification.permission))
           navigator.serviceWorker
             .register('{{ .Prefix }}/service-worker.js')
             .then(function (reg) {
+              console.log('[push] service worker registered', reg && reg.scope)
               if ('PushManager' in window) {
-                function subscribe() {
-                  reg.pushManager
-                    .subscribe({
-                      userVisibleOnly: true,
-                      applicationServerKey: (function () {
-                        var k =
-                          window.vapidPublicKey ||
-                          window.VAPID_PUBLIC_KEY ||
-                          (document.querySelector('meta[name="vapid-public-key"]') || {})
-                            .content;
-                        if (!k) return undefined;
-                        // Convert URL-safe base64 to Uint8Array
-                        k = k.replace(/-/g, '+').replace(/_/g, '/');
-                        var pad = '='.repeat((4 - (k.length % 4)) % 4);
-                        var raw = atob(k + pad);
-                        var out = new Uint8Array(raw.length);
-                        for (var i = 0; i < raw.length; i++) out[i] = raw.charCodeAt(i);
-                        return out;
-                      })(),
-                    })
-                    .then(function (sub) {
-                      fetch('{{ .Prefix }}/api/push/subscribe', {
-                        method: 'POST',
-                        headers: { 'Content-Type': 'application/json' },
-                        body: JSON.stringify(sub),
-                      });
-                    });
-                }
-                if (Notification.permission === 'granted') {
-                  subscribe();
-                } else if (Notification.permission === 'default') {
-                  Notification.requestPermission().then(function (permission) {
-                    if (permission === 'granted') {
-                      subscribe();
-                    }
-                  });
-                }
+                // React app handles permission and subscription UX.
+                // We just log availability here.
+                console.log('[push] PushManager available; React component will manage subscription')
+              } else {
+                console.warn('[push] PushManager not available in this environment')
               }
-            });
-        });
+            })
+            .catch(function (err) {
+              console.error('[push] service worker registration failed', err)
+            })
+        })
+      } else {
+        console.warn('[push] serviceWorker not supported in this browser')
       }
     </script>
   </body>
diff --git a/web/service-worker.js b/web/service-worker.js
index a2350ffd7e..5de50dee19 100644
--- a/web/service-worker.js
+++ b/web/service-worker.js
@@ -1,23 +1,38 @@
 self.addEventListener('install', () => {
+  try {
+    console.log('[sw] install')
+  } catch (e) {}
   self.skipWaiting();
 });
 
 self.addEventListener('activate', (event) => {
+  try {
+    console.log('[sw] activate')
+  } catch (e) {}
   event.waitUntil(self.clients.claim());
 });
 
 self.addEventListener('push', (event) => {
-  const data = event.data ? event.data.json() : {};
+  let data = {}
+  try {
+    data = event.data ? event.data.json() : {}
+    console.log('[sw] push received', { hasData: !!event.data, title: data && data.title, url: data && data.url })
+  } catch (e) {
+    try { console.error('[sw] push data parse error', e) } catch (_) {}
+  }
 
-  const title = data.title || 'GoAlert';
+  const title = (data && data.title) || 'GoAlert';
   const options = {
-    body: data.body,
-    data: data.url,
+    body: data && data.body,
+    data: data && data.url,
+    icon: '/static/favicon-192.png',
+    badge: '/static/favicon-128.png',
   };
   event.waitUntil(self.registration.showNotification(title, options));
 });
 
 self.addEventListener('notificationclick', (event) => {
+  try { console.log('[sw] notificationclick') } catch (e) {}
   event.notification.close();
   const url = event.notification.data || '/';
   event.waitUntil(clients.openWindow(url));
diff --git a/web/src/app/main/App.tsx b/web/src/app/main/App.tsx
index 9a28a6e486..3b0dc5764c 100644
--- a/web/src/app/main/App.tsx
+++ b/web/src/app/main/App.tsx
@@ -23,6 +23,7 @@ import NavBar from './NavBar'
 import AuthLink from './components/AuthLink'
 import { useExpFlag } from '../util/useExpFlag'
 import { NotificationProvider } from './SnackbarNotification'
+import PushPermissionBanner from './PushPermissionBanner'
 import ReactGA from 'react-ga4'
 import { useConfigValue } from '../util/RequireConfig'
 import Spinner from '../loading/components/Spinner'
@@ -78,6 +79,7 @@ export default function App(): React.JSX.Element {
       <PageActionProvider>
         <SearchProvider>
           <NotificationProvider>
+            <PushPermissionBanner />
             <AppBar
               position='fixed'
               className={classes.appBar}
diff --git a/web/src/app/main/PushPermissionBanner.tsx b/web/src/app/main/PushPermissionBanner.tsx
new file mode 100644
index 0000000000..0a78ed4448
--- /dev/null
+++ b/web/src/app/main/PushPermissionBanner.tsx
@@ -0,0 +1,103 @@
+import React, { useCallback, useEffect, useMemo, useState } from 'react'
+import { Alert, Button, Snackbar } from '@mui/material'
+
+function getVapidKey(): Uint8Array | undefined {
+  try {
+    const meta = document.querySelector('meta[name="vapid-public-key"]') as HTMLMetaElement | null
+    let k = (window as any).vapidPublicKey || (window as any).VAPID_PUBLIC_KEY || (meta && meta.content) || ''
+    if (!k) return undefined
+    k = k.replace(/-/g, '+').replace(/_/g, '/')
+    const pad = '='.repeat((4 - (k.length % 4)) % 4)
+    const raw = atob(k + pad)
+    const out = new Uint8Array(raw.length)
+    for (let i = 0; i < raw.length; i++) out[i] = raw.charCodeAt(i)
+    return out
+  } catch {
+    return undefined
+  }
+}
+
+async function ensureSubscribed(): Promise<void> {
+  if (!('serviceWorker' in navigator) || !(window as any).Notification) return
+  const perm = (window as any).Notification.permission
+  if (perm !== 'granted') return
+  const reg = await navigator.serviceWorker.ready
+  let sub = await reg.pushManager.getSubscription()
+  if (!sub) {
+    sub = await reg.pushManager.subscribe({ userVisibleOnly: true, applicationServerKey: getVapidKey() })
+  }
+  await fetch((window as any).pathPrefix + '/api/push/subscribe', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify(sub),
+    credentials: 'same-origin',
+  })
+}
+
+const DISMISS_KEY = 'push-banner-dismissed'
+
+export default function PushPermissionBanner(): JSX.Element | null {
+  const supported = typeof window !== 'undefined' && 'serviceWorker' in navigator && (window as any).Notification
+  const [open, setOpen] = useState(false)
+
+  const shouldShow = useMemo(() => {
+    if (!supported) return false
+    const perm = (window as any).Notification.permission
+    if (perm === 'granted') return false
+    if (localStorage.getItem(DISMISS_KEY) === '1') return false
+    return perm === 'default'
+  }, [supported])
+
+  useEffect(() => {
+    setOpen(shouldShow)
+  }, [shouldShow])
+
+  useEffect(() => {
+    // if already granted, make sure subscription is stored
+    ensureSubscribed().catch((e) => console.error('[push] ensureSubscribed failed', e))
+  }, [])
+
+  const onDismiss = useCallback(() => {
+    try { localStorage.setItem(DISMISS_KEY, '1') } catch {}
+    setOpen(false)
+  }, [])
+
+  const onEnable = useCallback(() => {
+    try {
+      ;(window as any).Notification.requestPermission().then((permission: string) => {
+        console.log('[push] permission response (banner):', permission)
+        if (permission === 'granted') {
+          ensureSubscribed().catch((e) => console.error('[push] subscribe/store failed', e))
+          setOpen(false)
+        }
+        if (permission === 'denied') {
+          setOpen(false)
+        }
+      })
+    } catch (e) {
+      console.error('[push] permission request threw', e)
+    }
+  }, [])
+
+  if (!open) return null
+
+  return (
+    <Snackbar open anchorOrigin={{ vertical: 'bottom', horizontal: 'center' }}>
+      <Alert elevation={6} variant='filled' severity='info'
+        action={
+          <>
+            <Button color='inherit' size='small' onClick={onEnable}>
+              Allow
+            </Button>
+            <Button color='inherit' size='small' onClick={onDismiss}>
+              Dismiss
+            </Button>
+          </>
+        }
+      >
+        Enable push notifications?
+      </Alert>
+    </Snackbar>
+  )
+}
+