Developer notes

Overview · Installation · Configuration · Usage · FAQ

Service worker

• CS-Cart 4.21+: the core registers service_worker.js in the store root and imports the scripts that add-ons add to $service_worker_scripts in the index:scripts hook (the PWA add-on does the same). The add-on adds js/addons/kv_web_push/sw.js. When the browser already has a registration without it (the add-on was installed later), the storefront script registers the core worker again with the current list.
• Before 4.21: the add-on serves the same file from index.php?dispatch=kv_web_push.sw, so the default scope is the store root without extra headers.
• sw.js handles push only for payloads with "kvwp": 1, notificationclick for its own tags, and pushsubscriptionchange (sends the renewed subscription to the store).

Encryption

Tygh\Addons\KvWebPush\Crypto implements VAPID (RFC 8292, ES256 JWT, sub = the https URL of the store) and the aes128gcm content coding (RFC 8291 / RFC 8188) with OpenSSL only: P-256 key pairs, ECDH, HKDF-SHA-256, AES-128-GCM, one record of 4096 bytes, a new ephemeral key and salt per message. PHP builds without an openssl.cnf (common on Windows) get a minimal configuration shipped in resources/. Sender posts with parallel cURL (10 at a time); on Windows without a CA bundle it uses the Windows certificate store.

Storefront endpoints (POST, same site only)

kv_web_push.subscribe (endpoint, p256dh, auth, browser, device), kv_web_push.unsubscribe (endpoint), kv_web_push.watch (endpoint, product_id, type S or P). New subscriptions are limited to 20 per address and hour. kv_web_push.click&q=&k= counts the click (HMAC token) and redirects to the campaign link.

Hooks

update_product_post (an admin save can fire alerts and sends up to 50 messages at once), update_product_amount_post (stock from zero to positive), delete_product_post (removes alerts). Templates: storefront index:scripts, index:styles, products:buttons_block (post).

Tables

Table	Contents
kv_wpu_subscribers	endpoint, keys, origin (storefront URL), company, user, language, browser, device, status A/U/E, counters
kv_wpu_campaigns	type M (campaign), S (back in stock), P (price drop); texts, link, image, audience, status D/Q/S/F/X, counters
kv_wpu_queue	one row per message: status P/S/F/E/X, attempts, next try, HTTP answer, click time
kv_wpu_watches	product alerts: subscriber, product, type, price at the time, fired time

Cron

php admin.php --dispatch=kv_web_push.cron fires due alerts for all watched products (so imports and API changes are caught), starts scheduled campaigns and sends one batch.