Remove push subscriptions when rotating the VAPID key by hand.

1 files changed, 5 insertions, 0 deletions

diff --git a/src/vapid/app.rs b/src/vapid/app.rs
index 7d872ed..ebd2446 100644
--- a/src/vapid/app.rs
+++ b/src/vapid/app.rs
@@ -29,6 +29,11 @@ impl Vapid {
         // of the change. All we have to do is remove the existing key, so that the server can know
         // to do so.
         tx.vapid().clear().await?;
+        // Delete outstanding subscriptions for the existing VAPID key, as well. They're
+        // unserviceable once we lose the key. Clients can resubscribe when they process the next
+        // key rotation event, which will be quite quickly once the running server notices that the
+        // VAPID key has been removed.
+        tx.push().clear().await?;
         tx.commit().await?;
 
         Ok(())