Add endpoint to remove web push subscription (#32626)

app/controllers/api/web/push_subscriptions_controller.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 class Api::Web::PushSubscriptionsController < Api::Web::BaseController
-  before_action :require_user!
+  before_action :require_user!, except: :destroy
   before_action :set_push_subscription, only: :update
   before_action :destroy_previous_subscriptions, only: :create, if: :prior_subscriptions?
   after_action :update_session_with_subscription, only: :create
@@ -17,6 +17,13 @@ class Api::Web::PushSubscriptionsController < Api::Web::BaseController
     render json: @push_subscription, serializer: REST::WebPushSubscriptionSerializer
   end
 
+  def destroy
+    push_subscription = ::Web::PushSubscription.find_by_token_for(:unsubscribe, params[:id])
+    push_subscription&.destroy
+
+    head 200
+  end
+
   private
 
   def active_session

app/models/web/push_subscription.rb

@@ -29,6 +29,8 @@ class Web::PushSubscription < ApplicationRecord
 
   delegate :locale, to: :associated_user
 
+  generates_token_for :unsubscribe, expires_in: Web::PushNotificationWorker::TTL
+
   def pushable?(notification)
     policy_allows_notification?(notification) && alert_enabled_for_notification_type?(notification)
   end

app/workers/web/push_notification_worker.rb

@@ -2,10 +2,11 @@
 
 class Web::PushNotificationWorker
   include Sidekiq::Worker
+  include RoutingHelper
 
   sidekiq_options queue: 'push', retry: 5
 
-  TTL     = 48.hours.to_s
+  TTL     = 48.hours
   URGENCY = 'normal'
 
   def perform(subscription_id, notification_id)
@@ -23,12 +24,13 @@ class Web::PushNotificationWorker
 
       request.add_headers(
         'Content-Type' => 'application/octet-stream',
-        'Ttl' => TTL,
+        'Ttl' => TTL.to_s,
         'Urgency' => URGENCY,
         'Content-Encoding' => 'aesgcm',
         'Encryption' => "salt=#{Webpush.encode64(payload.fetch(:salt)).delete('=')}",
         'Crypto-Key' => "dh=#{Webpush.encode64(payload.fetch(:server_public_key)).delete('=')};#{web_push_request.crypto_key_header}",
-        'Authorization' => web_push_request.authorization_header
+        'Authorization' => web_push_request.authorization_header,
+        'Unsubscribe-URL' => subscription_url
       )
 
       request.perform do |response|
@@ -72,4 +74,8 @@ class Web::PushNotificationWorker
   def request_pool
     RequestPool.current
   end
+
+  def subscription_url
+    api_web_push_subscription_url(id: @subscription.generate_token_for(:unsubscribe))
+  end
 end