validate web push params

scripts/webpush_notify.js

@@ -5,6 +5,7 @@ import Tarantool from '../db/tarantool';
 webPush.setGCMAPIKey(config.gcm_key);
 
 function notify(account, nparams, title, body, url, pic) {
+    if (!nparams.keys || !nparams.keys.auth) return Promise.resolve(false);
      var payload = JSON.stringify({
         title,
         body,
@@ -32,11 +33,13 @@ async function process_queue() {
                 try {
                     await notify(account, nparams, title, body, url, pic);
                 } catch (err) {
-                    console.error('-- error in notify -->', account, err);
+                    console.error('-- error in notify -->', account, nparams, err);
+                    if (err.statusCode && err.statusCode == 410) {
+                        await Tarantool.instance().call('webpush_unsubscribe', account, nparams.keys.auth);
+                    }
                 }
             }
         }
-        // console.log('-- run.run -->', queue);
     } catch (error) {
         console.error('-- process_queue error -->', error);
     }

server/api/notifications.js

@@ -58,19 +58,19 @@ export default function useNotificationsApi(app) {
     });
 
     router.post('/notifications/register', koaBody, function *() {
+        this.body = '';
         try {
             const params = this.request.body;
             const {csrf, account, webpush_params} = typeof(params) === 'string' ? JSON.parse(params) : params;
             if (!checkCSRF(this, csrf)) return;
             console.log('-- POST /notifications/register -->', this.session.uid, account, webpush_params);
-            if (!account || account !== this.session.a) {
-                this.body = ''; return;
-            }
+            if (!account || account !== this.session.a) return;
+            if (!webpush_params || !webpush_params.endpoint || !webpush_params.endpoint.match(/^https:\/\/android\.googleapis\.com/)) return;
+            if (!webpush_params.keys || !webpush_params.keys.auth) return;
             yield Tarantool.instance().call('webpush_subscribe', account, webpush_params);
         } catch (error) {
             console.error('-- POST /notifications/register error -->', this.session.uid, error.message);
         }
-        this.body = '';
     });
 }