工作原理
开放标准，无服务提供商
Web 推送通过每个浏览器的推送服务在浏览器自己的 Web 推送协议上运行。没有付费的第三方推送供应商，也没有每条消息的费用。
VAPID 密钥，自动生成
首次启用时，Flash 会为您生成工作区的 VAPID 应用程序服务器密钥 — 无需手动创建、粘贴或旋转。
会员发起订阅
会员通过门户网站的隐私页面自行订阅。浏览器的权限提示会进行限制——没有权限，就无法订阅。
按订阅加密
每个推送有效负载都使用各个订阅的密钥进行加密（RFC 8291 消息加密），因此只有该成员的浏览器才能读取。
启用它（管理员）
管理员为工作区启用 Web 推送功能。无需生成密钥——Flash 会在首次启用时创建 VAPID 应用服务器密钥对。
// Admin enables web push for the workspace in Settings → Web Push.
// On first enable, Flash GENERATES the VAPID application-server keypair automatically —
// you don't create or paste keys. You set a contact email and can fire a test send.
//
// Settings → Web Push:
// • Enable web push (OFF by default, per workspace)
// • Contact email (identifies the sender to the browser push services)
// • Send test notification (verify the end-to-end path)
//
// The public VAPID application server key is what the member's browser uses when it
// creates a push subscription (below).会员订阅流程
成员的浏览器使用工作区的公共 VAPID 密钥创建订阅；门户将其发布到Flash。请参阅会员门户嵌入指南，了解其所依赖的登录消费者会话。
// Members subscribe THEMSELVES from the member portal privacy page. The web-push card
// only renders when (a) the browser supports the Push API AND (b) the workspace enabled
// web push. Tapping it triggers the browser's native permission prompt.
//
// 1. Portal registers a service worker.
// 2. Browser creates a PushSubscription using the workspace's public VAPID key
// (Notification.requestPermission() → pushManager.subscribe(...)).
// 3. The portal posts that subscription (endpoint + p256dh + auth keys) to Flash:
POST https://flash.socialhub.ai/api/member/web-push
Content-Type: application/json
{
"endpoint": "<browser push service endpoint>",
"keys": { "p256dh": "<client public key>", "auth": "<client auth secret>" }
}
// → 200 { data: { ok: true } }
// GET https://flash.socialhub.ai/api/member/web-push → the workspace public key + whether web push is on
// DELETE https://flash.socialhub.ai/api/member/web-push { "endpoint": "..." } → unsubscribe
// The member identity comes from the signed-in member session — never the body.交付：一个通道，而不是一个 API 调用
// You do NOT call a "send web push" endpoint directly. Web push is a CHANNEL in the
// same send/automation stack as email and app push. When a campaign or journey targets
// a subscribed member:
//
// • Flash encrypts the payload to that member's subscription keys (RFC 8291) and
// hands it to the member's own browser push service for delivery.
// • Subscriptions that the push service reports as gone/expired are pruned
// automatically, so you don't keep sending into dead endpoints.