Use PKCS8 PEM, not raw SEC1 bytes, to store VAPID keys.

The `web-push` crate's VAPID signing support requires a private key. The `p256` crate is more than capable of generating one, but the easiest way to get a key from a `p256::ecdsa::SigningKey` to a `web_push::PartialVapidSignature` is via PKCS #8 PEM, not via the bytes. Since we'll need it in that form anyways, store it that way, so that we don't have to decode it using `p256`, re-encode to PEM, then decode to `PartialVapidSignature`.

The migration in this commit invalidates existing VAPID keys. We could include support for re-encoding them on read, but there's little point: this code is still in flux anyways, and only development deployments exist. By the time this is final, the schema will have settled.

1 files changed, 2 insertions, 0 deletions

diff --git a/src/event/app.rs b/src/event/app.rs
index 6c657c7..1e471f1 100644
--- a/src/event/app.rs
+++ b/src/event/app.rs
@@ -98,6 +98,7 @@ pub enum Error {
     Database(#[from] sqlx::Error),
     Name(#[from] name::Error),
     Ecdsa(#[from] p256::ecdsa::Error),
+    Pkcs8(#[from] p256::pkcs8::Error),
 }
 
 impl From<user::repo::LoadError> for Error {
@@ -126,6 +127,7 @@ impl From<vapid::repo::Error> for Error {
         match error {
             Error::Database(error) => error.into(),
             Error::Ecdsa(error) => error.into(),
+            Error::Pkcs8(error) => error.into(),
         }
     }
 }