From 9634c3422eea95a2dd1713e6a826f0adb5af644b Mon Sep 17 00:00:00 2001 From: Jose Olarte III Date: Fri, 10 Jul 2026 21:09:22 +0800 Subject: [PATCH] docs: document Endorser auth flow and ENDORSER_URL Describe when register/refresh verify with Endorser, keep the testMode bypass notes, and list ENDORSER_URL in the env table. --- README.md | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 03cde7e..5c956a9 100644 --- a/README.md +++ b/README.md @@ -6,9 +6,11 @@ A lightweight Express service that schedules and sends Firebase Cloud Messaging cp .env.example .env ``` -Edit .env — set FIREBASE_SERVICE_ACCOUNT_JSON +Edit .env — set `FIREBASE_SERVICE_ACCOUNT_JSON`. Here is one way to generate the contents: `cat your-downloaded-key.json | jq -c .` +Optionally set `ENDORSER_URL` if you are not using the default production Endorser API (`https://api.endorser.ch`). + ```bash pnpm install pnpm run dev @@ -16,7 +18,13 @@ pnpm run dev The server starts on `http://localhost:3003` (or the port in `PORT`). Hot-reloads on file changes. -Set `NODE_ENV=test-local` in `.env` to bypass JWT expiry verification during local development. +### Authentication + +`POST /notifications/register` and `POST /notifications/refresh` require a Bearer JWT. After local JWT verification, the service checks the token with Endorser (`GET /api/report/rateLimits` on `ENDORSER_URL`). Registration and refresh continue only if Endorser accepts the JWT. + +**Local notification test bypass:** send `testMode: true` in the JSON body and omit the `Authorization` header. The request skips JWT and Endorser checks and uses a synthetic local test user, same as before. + +Set `NODE_ENV=test-local` in `.env` to bypass ethr JWT *expiry* verification during local development (this is separate from the `testMode` bypass above). ## Production @@ -40,4 +48,5 @@ Required environment variables: |---|---| | `FIREBASE_SERVICE_ACCOUNT_JSON` | Inline service account JSON (one line). If unset, falls back to Application Default Credentials. | | `PORT` | HTTP port (default: `3003`). | +| `ENDORSER_URL` | Endorser API base URL used for auth checks on register/refresh (default: `https://api.endorser.ch`). | | `FCM_TOKEN_DATA_DIR` | Directory for persisting registered FCM tokens (default: `./data`). |