Push test instructions

Return to test page

V2.6 — SUPPRESS THE LETTER-AVATAR FALLBACK
The phone showed an A placeholder when the optional icon was omitted.
This version supplies a valid fully transparent PNG to test suppressing that
fallback. The existing Kanzen app icons and notification title are unchanged.
This is not yet visually verified on Samsung; Android may retain blank space.

V2.6 — CHECK THE ACTUAL NOTIFICATION RECEIVER
Deploy this ZIP using existing secrets. Open the Cloudflare app on the phone.
Under Hosting checks, wait for Notification code: v2.6 — confirmed active.
If necessary tap Update notification code. No reauthorisation is needed.
Dismiss old notifications. Close the phone app and send from the laptop.
The NEW notification should have bold title Kanzen Martial Arts and body
Remote test v2.6: notification received from Cloudflare.
V2.6 supplies a fully transparent notification image instead of omitting it,
to test suppressing Chrome's letter-avatar fallback. Android may still reserve
the image area. Check a NEW notification after the receiver confirms v2.6.
The small system app-name label remains My Kanzen by design.

MY KANZEN — REMOTE PUSH TEST v2.6
Prepared 20 September 2026

UPDATING FROM v2
Upload this new ZIP as another Production deployment. Keep the existing
Cloudflare secrets and phone endpoint; do not generate new keys. Refresh the
laptop page and check the footer says Push test v2.6. Close the phone app and
send once again. If it fails, share the new error text: it identifies the
failing step and removes credentials and addresses. A success response still
requires confirmation in the phone notification tray.

PURPOSE
Send a real remote notification from Cloudflare to Eddie's Samsung (Chrome),
while My Kanzen is closed on the phone. This is a technical test, not the
member portal. It does not connect to Wix, GoCardless or member records.

UPLOAD
1. Cloudflare > Workers & Pages > my-kanzen > Create a new deployment.
2. Choose Production and upload My_Kanzen_Remote_Push_Test_v2_6.zip directly.
   The ZIP has site files at its root. Do not wrap it in another folder.
3. Deploy. This replaces the existing temporary setup check in that project.

CONFIGURE — LAPTOP
4. Open https://my-kanzen.pages.dev/setup.html (works before custom DNS is ready)
   or https://app.kanzenmartialarts.co.uk/setup.html once the domain works.
5. Click Generate test secrets once. Keep this tab open.
6. In a separate Cloudflare tab open my-kanzen > Settings > Variables and Secrets.
   Select Production, then add each of these using type Secret:
     VAPID_PRIVATE_JWK — the complete first value, including braces.
     TEST_ACCESS_KEY — the complete second value.
   Keep the second value privately for the laptop test form. Do not send
   either secret in chat, include them in screenshots, or put them in site files.
7. Save both and deploy the SAME ZIP again so the new deployment has the secrets.
   No database, third-party notification account, or paid plan upgrade is needed
   to configure this small test. Normal Cloudflare usage limits still apply.

PHONE — AFTER THE CUSTOM DOMAIN IS ACTIVE
8. Open https://app.kanzenmartialarts.co.uk in Chrome on the Samsung.
   Wait for Service worker: Active. Install/open My Kanzen from this address.
   The earlier Wix installation is a different app; use this new app address.
9. Under "1. Connect your Samsung", tap Connect this phone for push.
   Grant notification permission. This connects only this device.
10. Copy the displayed phone endpoint and transfer it privately to your laptop
    using your usual device sharing method. It is the receiver address, not
    a website you need to open. Do not send it in this chat.
11. Close the My Kanzen app on the phone (swipe it from recent apps).
    Keep the phone online. Do not use Android Settings > Force stop.

LAPTOP — SEND
12. Open https://app.kanzenmartialarts.co.uk on the laptop.
13. Under "2. Send from your laptop", paste the PHONE endpoint and the
    TEST_ACCESS_KEY. Do not paste VAPID_PRIVATE_JWK into the send form.
14. Click Send My Kanzen test notification once.
15. Check the PHONE notification tray for:
      Kanzen Martial Arts
      Remote test v2.6: notification received from Cloudflare.
    A server "accepted" message is not proof of arrival; seeing it on the
    phone after sending from the laptop is the result we need.
16. Tap the notification to check that it opens My Kanzen.
    If needed, repeat once with the phone screen locked.

REPORT BACK
Tell me whether it arrived with the phone app closed and whether tapping it
opened My Kanzen. Share any status number/error text, but not keys/endpoints.
The existing Copy setup report does not verify remote delivery automatically.

TROUBLESHOOTING
- Two secrets not configured: check exact names, Production, and redeploy.
- Invalid private-key setting: copy the whole JSON value including braces.
- Incorrect access key: use the second generated value, no extra spaces.
- Status 401/403 from push provider: report the number. A rejected VAPID request
  needs investigation; regenerating keys blindly will invalidate subscriptions.
- Status 404/410: reconnect the phone and recopy its endpoint. If it persists,
  Disconnect this device then Connect again to create a fresh subscription.
- Endpoint unsupported: this first test intentionally only accepts Samsung
  Chrome's fcm.googleapis.com receiver. iPhone/other providers come later.
- Accepted but no visible alert: look in notification history/tray and check
  browser/app notification permission, Android notifications and Do Not Disturb.
  Test messages expire after 60 seconds; reconnect the phone and resend.
- Old setup page: reload; wait a moment for its updated service worker, then
  close and reopen. This package does not cache website pages.

AFTER TESTING
Disconnect the test device using its button if no longer needed. Remove
TEST_ACCESS_KEY in Cloudflare and redeploy to disable sending. Keep the
private VAPID key only if we decide to retain these test subscriptions.
Before member launch, replace this owner test with authenticated device
registration, account/member targeting, encrypted payloads, admin controls,
revocation, delivery retry handling and the agreed PIN/session behaviour.

WHAT THIS TEST DOES
- Browser-generated P-256 VAPID private key stays in Cloudflare secrets after setup.
- Public configuration exposes only the corresponding public key.
- Send endpoint requires the private test access key and same-origin request.
- Destination restricted to Google's Chrome push endpoint; redirects blocked.
- Empty push payload wakes sw.js, which shows fixed branded notification text.
- No member data, database, saved device list or automatic broadcasts.
- API endpoints use Pages Functions; static requests bypass the worker via
  _routes.json. No claim of production capacity or cross-platform validation.

VALIDATION COMPLETED LOCALLY
Syntax checks, authentication/origin rejection, outbound destination restrictions,
request size limits, VAPID signature independently verified with Node crypto,
key generator output, expired-subscription/network errors, payload-free receiver
notification, client enrollment/send flow, manifest/icons and ZIP structure.
Cloudflare runtime delivery and the actual Samsung notification remain untested.

REFERENCES
https://developers.cloudflare.com/pages/get-started/direct-upload/
https://developers.cloudflare.com/pages/functions/bindings/#secrets
https://datatracker.ietf.org/doc/html/rfc8292

V2.1 CHECKS
Timeout compatibility, response cleanup cannot override provider acceptance,
signing/network stage reporting, and secret/address redaction tested locally.
The v2.1 live error identified Cloudflare rejecting redirect mode "error".
V2.2 changes it to "manual" and explicitly rejects HTTP 3xx responses.
The corresponding runtime restriction and redirect rejection passed local
regression checks. Actual receipt on the Samsung still needs confirmation.

V2.3 NOTIFICATION BRANDING
Remote and local test notifications now use the bold title Kanzen Martial Arts.
The installed application name remains My Kanzen. Android supplies the small
app-name label and app identity icon in the system notification template.
V2.4 removes the optional right-hand notification image from both remote
and local tests. The system app icon and installed app name are retained.
After deploying, open/refresh the phone app to let its service worker update,
then close it and send a NEW notification from the laptop. Old notifications
do not change when the code is updated. Reuse existing keys and endpoint.