From 11f4f36a689b6447c9898a2840418e581cb3eb11 Mon Sep 17 00:00:00 2001
From: Owen Jacobson <owen@grimoire.ca>
Date: Tue, 28 Oct 2025 14:10:48 -0400
Subject: Use PKCS8 PEM, not raw SEC1 bytes, to store VAPID keys.

The `web-push` crate's VAPID signing support requires a private key. The `p256` crate is more than capable of generating one, but the easiest way to get a key from a `p256::ecdsa::SigningKey` to a `web_push::PartialVapidSignature` is via PKCS #8 PEM, not via the bytes. Since we'll need it in that form anyways, store it that way, so that we don't have to decode it using `p256`, re-encode to PEM, then decode to `PartialVapidSignature`.

The migration in this commit invalidates existing VAPID keys. We could include support for re-encoding them on read, but there's little point: this code is still in flux anyways, and only development deployments exist. By the time this is final, the schema will have settled.
---
 migrations/20251028173914_pem_vapid_keys.sql | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 create mode 100644 migrations/20251028173914_pem_vapid_keys.sql

(limited to 'migrations/20251028173914_pem_vapid_keys.sql')

diff --git a/migrations/20251028173914_pem_vapid_keys.sql b/migrations/20251028173914_pem_vapid_keys.sql
new file mode 100644
index 0000000..6302504
--- /dev/null
+++ b/migrations/20251028173914_pem_vapid_keys.sql
@@ -0,0 +1,15 @@
+drop table vapid_signing_key;
+
+create table vapid_signing_key (
+    key text
+        not null
+);
+
+create unique index vapid_signing_key_singleton
+    on vapid_signing_key (0);
+
+-- Whatever key we had, if any, was just destroyed by dropping the table. Delete the metadata
+-- as well so that the server will issue a new one.
+delete
+from
+    vapid_key;
-- 
cgit v1.2.3

