Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Push delivery: make the worker's VAPID authorizer required

Open Beginner friendly
#423 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
82/100
Issue type
Refactor
Clarity
Clearly specified
Activity status
Active
Tech stack
typescript
Domain
backend

Research direction

Start in app/apps/worker/src/push/deliver.ts around line 86, where the optional vapid field and its comment sit, then check line 98 where it reaches webPushSender. Make the field required and update the comment. Next, update the test callers listed in the issue (app/tests/app/push.test.ts and three others) to pass createVapidAuthorizer() from apps/worker/src/push/index.ts. Done means the type check, lint and ./scripts/check_application.sh pass.

Written by the indexing model from the issue text.

Description

good first issue

DeliveryDependencies.vapid is optional in the worker's push delivery. Every production caller passes the worker's one authorizer, which reuses a VAPID JWT per push service; when the field is left out, each delivery silently signs its own JWT instead. Making it required lets the type checker catch a future caller that forgets it.

Where to look

  • app/apps/worker/src/push/deliver.ts (around line 86): vapid?: VapidAuthorizer and its comment; line 98 passes it to webPushSender.
  • app/apps/worker/src/index.ts (line 26) and app/apps/worker/src/push/index.ts (line 22): the production path, which already passes it.
  • Tests that call deliverPush({ db, config }) without it: app/tests/app/push.test.ts, notifications.test.ts, notification-summary-native.test.ts, notification-inbox.test.ts (git grep -n "deliverPush({" app/tests).

Acceptance criteria

  • vapid is required in DeliveryDependencies, and its comment no longer describes the "without one" case.
  • Every caller passes an authorizer; tests use createVapidAuthorizer() (exported from apps/worker/src/push/index.ts), ideally one per test file.
  • Type check, lint and the full Docker suite pass.

How to check
./scripts/check_application.sh (builds, type checks, lints and runs the API tests, including the push tests against the push-service mock).

New to Flux? Start with CONTRIBUTING. Comment here to say you are taking it.

Carried over from the #185 handoff, as suggested on #306.

Dominant language
TypeScript
Stars
3
Forks
0
Avg merge
14h 40m
Merged PRs (30d)
242

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from ColdPhase/flux

All issues in ColdPhase/flux

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.