fix(push): reinstalled app replaces its old subscription; devices listed and removable

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/push.go

@@ -148,6 +148,8 @@ func (s *Server) handlePushSubscribe(w http.ResponseWriter, r *http.Request) {
 			Auth   string `json:"auth"`
 		} `json:"keys"`
 		Device string `json:"device"`
+		// The subscription this browser had before (e.g. before a reinstall): it is dead now
+		Replaces string `json:"replaces"`
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 		writeError(w, http.StatusBadRequest, "Ungültige Anfrage")
@@ -165,10 +167,14 @@ func (s *Server) handlePushSubscribe(w http.ResponseWriter, r *http.Request) {
 	if len(device) > 120 {
 		device = device[:120]
 	}
-	if err := s.store.SavePushSubscription(auth.GetUserID(r.Context()), req.Endpoint, req.Keys.P256dh, req.Keys.Auth, device); err != nil {
+	userID := auth.GetUserID(r.Context())
+	if err := s.store.SavePushSubscription(userID, req.Endpoint, req.Keys.P256dh, req.Keys.Auth, device); err != nil {
 		writeError(w, http.StatusInternalServerError, "Gerät konnte nicht gespeichert werden")
 		return
 	}
+	if req.Replaces != "" && req.Replaces != req.Endpoint {
+		_ = s.store.DeletePushSubscription(userID, req.Replaces) // only ever one of the own devices
+	}
 	writeJSON(w, http.StatusOK, map[string]bool{"ok": true})
 }
 

internal/api/push_test.go

@@ -77,3 +77,24 @@ func TestPushDigestText(t *testing.T) {
 		t.Fatalf("many: %+v", many)
 	}
 }
+
+// A reinstalled app registers a new subscription and names the old one: it is dropped, not counted twice
+func TestPushResubscribeReplacesOldDevice(t *testing.T) {
+	srv, store, _ := setupTestServer(t)
+	router := srv.Router()
+	me, token := newTestUser(t, store, "reinstall@example.com")
+	sub := func(endpoint, replaces string) int {
+		body := `{"endpoint":"` + endpoint + `","keys":{"p256dh":"k","auth":"a"},"device":"Chrome auf Android","replaces":"` + replaces + `"}`
+		return sessionCall(router, http.MethodPost, "/api/v1/push/subscribe", token, body, "").Code
+	}
+	if code := sub("https://fcm.googleapis.com/fcm/send/alt", ""); code != http.StatusOK {
+		t.Fatalf("subscribe: %d", code)
+	}
+	if code := sub("https://fcm.googleapis.com/fcm/send/neu", "https://fcm.googleapis.com/fcm/send/alt"); code != http.StatusOK {
+		t.Fatalf("resubscribe: %d", code)
+	}
+	subs, _ := store.PushSubscriptions(me.ID)
+	if len(subs) != 1 || subs[0].Endpoint != "https://fcm.googleapis.com/fcm/send/neu" {
+		t.Fatalf("old installation must be replaced, got %+v", subs)
+	}
+}