Repository navigation
Security
Authentication and authorization belong to the host application. Pass its authenticated recipient model to services; do not resolve arbitrary recipient UUIDs from a request without authorization. An installation ID or provider token is not authentication. The package refuses cross-owner registration changes, removal and ordinary token replacement. Reassignment is an explicit service operation requiring an application-authorized context.
Use validated requests and safe response resources. Exclude registration token inputs from request logging, tracing, exception snapshots and observability tools. HTTPS and the application's normal session/token protections belong at its API boundary.
Provider tokens use Laravel encryption at rest. Fingerprints use a dedicated HMAC-SHA256 key and include provider/application/project/environment scope. Database constraints enforce active uniqueness. Tokens/fingerprints are hidden from model serialization, but privileged code can still explicitly access them: do not dump models or their raw attributes.
Internal notification payloads are encrypted in the message table. Queued jobs contain a delivery UUID and ordinary Laravel queue metadata, not a device token, credential or payload. Visible native history stores application-chosen notification data as normal database notification JSON. Encrypt database volumes/backups as appropriate and keep sensitive content out of notification bodies/custom data.
Providers see the title/body/custom data needed to transport/display a push. Prefer a neutral alert plus opaque notification/resource UUID, then fetch sensitive details through the authenticated API. Device reassignment or logout cannot recall a notification already in flight or accepted remotely.
The package records sanitized diagnostics and contains dependency events that may include raw tokens. Disable request-body/provider HTTP logging. Credentials must never be committed; examples contain placeholders only. The code and documentation are public-facing and must not contain internal product names, domains, workstation paths or proprietary integration details.
Use Laravel's supported previous-key configuration to read older encrypted tokens/payloads while rotating APP_KEY. Pause/drain workers or coordinate an application maintenance operation; deploy keys consistently to every web/worker/scheduler process, reencrypt rows in bounded batches, verify decryption, then retire the old key only when all retained ciphertext/backups have an appropriate policy. Losing encryption keys makes stored provider tokens unusable.
The package deliberately uses the application's existing encrypter. No second encryption algorithm or standalone credential store is introduced.
Fingerprint lookup uniqueness requires every active registration in a scope to use the same current key. Changing only the environment secret leaves old fingerprints inconsistent and can allow duplicate tokens.
Perform a coordinated maintenance rotation: pause registration and sending/recovery, retain decryption access, decrypt each active token in memory, recompute its scoped fingerprint with the new dedicated key, resolve collisions safely, update all active rows and deploy the new key to every process before resuming. Do not log tokens or batch values. Revoke/re-register devices if that process cannot be safely coordinated. Increment generations when registration scope changes so queued work becomes stale.
The current version has no automatic online multi-key fingerprint rotation protocol. Document the maintenance evidence in the consuming application's own operational records without publishing secrets.
Use service operations for device mutation, preferences and history deletion. Raw model writes, changing connection assignments, bulk deletes or bypass dispatch paths can defeat coordination. The models are Laravel records, not an authorization facade for arbitrary application code. Keep administrative operations behind explicit policies and avoid automatic mass assignment from request payloads.
