[thomasluizon]

Closes thomasluizon/orbit-tickets#1503.

This replaces #748 as one commit on the current main. That pull request carried Microsoft's public sample WNS channel URI as a test fixture, which GitGuardian flags as a high-entropy secret in every commit it scans; the fixtures now use https://cloud.notify.windows.com/?token=test-channel, and the code is unchanged. The same three test groups pass (Domain 39, Application 26, Infrastructure 45).

Web Push subscriptions now accept only supported push service hosts. The same policy rejects unsupported registrations and skips unsupported rows already stored in the database. The delivery HTTP client disables redirects.

Approach

• Orbit.Domain/Common/WebPushEndpointPolicy.cs owns the HTTPS provider boundary; PushSubscription.Create enforces it for Web Push entities.
• SubscribePushCommand applies the policy before looking up or claiming an existing endpoint. Its validator uses the existing validation pipeline and PUSH_ENDPOINT_INVALID error.
• PushNotificationService checks the stored endpoint immediately before preparing delivery. Unsupported rows remain stored and do not count as delivered; other valid subscriptions still receive their push.
• ServiceCollectionExtensions.Infrastructure.cs configures the typed push client with AllowAutoRedirect = false.
• Domain, validator, handler, delivery and registration tests cover supported providers, misleading hostnames, legacy rows, redirects and native FCM tokens. Existing subscription fixtures use an allowed authority so their original account ownership and eviction coverage remains active.

Provider and external interface evidence

The provider hosts were checked against these sources before implementing the policy:

• Google: Web.dev push server example supplies the copied fcm.googleapis.com/fcm/send/cpqAgzGzkzQ:APA9... fixture.
• Mozilla: Autopush send documentation supplies updates.push.services.mozilla.com/wpush/v1/... and treats the subscription URL as opaque.
• Apple: Web Push server requirements permit subdomains of push.apple.com. The copied Safari subscription fixture comes from the subscription producer example: https://web.push.apple.com/QGuQyavXutnMH....
• Microsoft: WNS overview supplies the copied cloud.notify.windows.com query-token fixture and says subdomains may change. The Edge fixture https://wns2-sg2p.notify.windows.com/w/?token=... comes from a reported browser subscription on Microsoft Q&A, with the token redacted. The cloud service DNS allow list confirms the provider suffix.

These are documentation/example placeholders, not live subscription credentials. Each provider fixture passes entity creation, command validation and encrypted delivery through the real Web Push library with an HTTP test handler.

Installed Lib.Net.Http.WebPush 3.3.1 identifies commit 5f601ff75f9de62ab2fa83206ff0ac9b9ab10d4c in its NuGet manifest. Its PushServiceClient source confirms that it retains the supplied HTTP client, calls its SendAsync, and treats redirect responses as failures. No new provider response fields are read.

Installed .NET HTTP package source at commit 4099f83977f4d29604a9aeb971fb0a7bc1d5f699 confirms the typed client name and AllowAutoRedirect forwarding. The policy tests exercise real System.Uri parsing and its Scheme, Port, UserInfo, Fragment and Host properties through the production policy, rather than mocking URI parsing. The registration test resolves the real handler chain from the configured service collection and verifies the redirect setting.

Assumptions

• Put the reusable policy in Domain.Common rather than Application so the entity guard and delivery service share one implementation without reversing dependencies.
• Use the documented exact Google and Mozilla hosts and the documented Apple and WNS subdomain boundaries rather than trusting broader provider parent domains.
• Require HTTPS on port 443 without user information or fragments rather than accepting alternate ports or credential-bearing authorities; subscription paths and query strings stay opaque.
• Make the existing push registration method internal for a focused composition test rather than initializing unrelated external integrations.

Test evidence

Before changing implementation:

• dotnet test tests/Orbit.Application.Tests --filter FullyQualifiedName~SubscribePushCommandValidatorTests --verbosity quiet: exit 0, 19 tests passed unchanged with the defect present. The substring filter also includes unsubscribe validator tests.
• Added Validate_UnsupportedHttpsEndpoint_HasError, then ran dotnet test tests/Orbit.Application.Tests --filter FullyQualifiedName~SubscribePushCommandValidatorTests.Validate_UnsupportedHttpsEndpoint_HasError --verbosity quiet: exit 1, one failure because no validation error existed for Endpoint. A --no-build --logger 'console;verbosity=normal' rerun confirmed that exact assertion failure.
• dotnet test tests/Orbit.Infrastructure.Tests --filter FullyQualifiedName~PushNotificationServiceTests --verbosity quiet: exit 0, all 29 existing delivery tests passed unchanged with the defect present.
• Added SendToUserAsync_UnsupportedStoredEndpoint_SkipsDeliveryAndKeepsSubscription, then ran dotnet test tests/Orbit.Infrastructure.Tests --filter FullyQualifiedName~PushNotificationServiceTests.SendToUserAsync_UnsupportedStoredEndpoint --logger 'console;verbosity=normal': exit 1, expected delivered false but found true. This seeds and reloads a legacy row and drives TrySendToUserAsync through the real persistence and encryption path. The case was then expanded to a theory.

After the fix:

• dotnet build Orbit.slnx --verbosity quiet: exit 0, zero errors. OpenAPI generation produced no contract diff.

• dotnet test tests/Orbit.Domain.Tests --no-build --filter 'FullyQualifiedName~PushSubscriptionTests|FullyQualifiedName~WebPushEndpointPolicyTests' --verbosity quiet: exit 0, 56 passed.

• dotnet test tests/Orbit.Application.Tests --no-build --filter 'FullyQualifiedName~SubscribePushCommandValidatorTests|FullyQualifiedName~SubscribePushCommandHandlerTests|FullyQualifiedName~UnsubscribePushCommandHandlerTests|FullyQualifiedName~GetPushSubscriptionsQueryHandlerTests' --verbosity quiet: exit 0, 56 passed, including the validator regression.

• dotnet test tests/Orbit.Infrastructure.Tests --no-build --filter 'FullyQualifiedName~PushNotificationServiceTests|FullyQualifiedName~PushHttpClientConfigurationTests|FullyQualifiedName~PushSubscriptionAccountSwitchTests' --verbosity quiet: exit 0, 57 passed, including all six legacy endpoint cases and the registered redirect setting.

• Added the sourced Edge browser fixture, rebuilt with dotnet build Orbit.slnx --verbosity quiet (exit 0, zero errors), and reran dotnet test tests/Orbit.Domain.Tests --no-build --filter FullyQualifiedName~SupportedEndpoint_PolicyAndEntityAccept --verbosity quiet (8 passed), dotnet test tests/Orbit.Application.Tests --no-build --filter FullyQualifiedName~Validate_DocumentedProviderEndpoint_NoErrors --verbosity quiet (5 passed), and dotnet test tests/Orbit.Infrastructure.Tests --no-build --filter FullyQualifiedName~SendToUserAsync_WebPushDelivered_KeepsSubscription --verbosity quiet (5 passed). Each command exited 0.

• The first full Application run passed 5,494 tests and failed one existing HeldWriteRevisionTests.ValidEdit_ExecutesStoredRevisedValue subscribe case whose valid endpoint used example.com. Updated only that subscribe fixture to an allowed FCM authority, preserving its assertions; the invalid-revision fixture also starts from an allowed subscription.

• dotnet test tests/Orbit.Application.Tests --filter FullyQualifiedName~HeldWriteRevisionTests --verbosity quiet: exit 0, all 144 revision tests passed after the fixture adjustment.

• The first full Infrastructure run passed 3,372 tests and failed two account-reset tests while creating subscriptions at the synthetic https://push/ host. A focused unchanged-test run confirmed both failures came from the new entity guard rejecting those fixture endpoints. Updated only the three Web Push fixture URLs to an allowed FCM authority. dotnet test tests/Orbit.Infrastructure.Tests --filter FullyQualifiedName~AccountResetRepositoryTests --verbosity quiet then exited 0 with all 5 account-reset tests passing; deletion assertions are unchanged.

Full test projects, each judged by exit code:

Command	Exit	Passed	Failed	Skipped
dotnet test tests/Orbit.Domain.Tests --verbosity quiet	0	710	0	0
dotnet test tests/Orbit.Application.Tests --verbosity quiet	0	5495	0	0
dotnet test tests/Orbit.Infrastructure.Tests --verbosity quiet	0	3374	0	0
dotnet test tests/Orbit.Analyzers.Tests --verbosity quiet	0	32	0	0

All 9,611 tests passed. Commit hooks passed formatting, dash, timeless, root allow list and suppression checks. A scan found no added bare comments.

No browser session or live device delivery was exercised; verification uses sourced endpoint fixtures and unit tests as required by the work order.

🤖 Generated with Claude Code

[pullfrog]

✅ No new issues found.

Reviewed changes across registration, domain validation, persisted-subscription delivery, HTTP configuration, and the web/Android consumers.

• Provider policy: A shared domain policy restricts Web Push to supported HTTPS authorities on port 443, rejecting misleading hostnames, user information, and fragments while preserving opaque paths and queries.
• Registration guards: The validator, command handler, and entity factory enforce the policy without changing native FCM token handling or subscription ownership rules.
• Delivery boundary: Unsupported persisted endpoints are skipped without being deleted or counted as delivered; the production HTTP client disables redirects.
• Regression coverage: Provider fixtures, legacy rows, redirects, account switching, eviction, unsubscribe, account reset, and held-write behavior are covered without changing the consumer payload contract.
• Verification: The solution build passed with zero errors, and all 321 focused tests passed. Live provider/device delivery was not exercised.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud