From 3981ed9608a3b66d47e155b203c0f5b0876f68a8 Mon Sep 17 00:00:00 2001
From: Agent <agent@lorentz.is>
Date: Wed, 16 Sep 2026 13:50:47 -0400
Subject: [PATCH] fix email notifications: match mailship PUT API with full-URL
 NIP-98 and payload tag

- register(): sign makeHttpAuth with full URL (/subscription/email),
  method PUT, and serialized body so both u-tag and payload tag match
  mailship's verifyNip98Auth. Drop pubkey from request body (server
  reads it from the auth event).
- unregister(): sign makeHttpAuth with full URL (/subscription/:key)
  and method DELETE, matching mailship's u-tag expectation.

Closes PR #4
---
 src/app/mail/index.ts | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/src/app/mail/index.ts b/src/app/mail/index.ts
index 1e504659..8649efa9 100644
--- a/src/app/mail/index.ts
+++ b/src/app/mail/index.ts
@@ -99,9 +99,18 @@ export class MailNotifications {
           throw new Error("Email notification server not configured")
         }
 
+        const body = {email, frequency}
+        const bodyJson = JSON.stringify(body)
+
         let authEvent
         try {
-          authEvent = await $signer.sign(await makeHttpAuth(EMAIL_NOTIFICATION_SERVER, "PUT"))
+          authEvent = await $signer.sign(
+            await makeHttpAuth(
+              buildUrl(EMAIL_NOTIFICATION_SERVER, "subscription", "email"),
+              "PUT",
+              bodyJson,
+            ),
+          )
         } catch (e) {
           emailNotificationState.set({
             error: "Failed to create authentication. Check your signer.",
@@ -115,7 +124,7 @@ export class MailNotifications {
         try {
           res = await fetch(buildUrl(EMAIL_NOTIFICATION_SERVER, "subscription", "email"), {
             method: "PUT",
-            body: JSON.stringify({email, frequency, pubkey: $user.pubkey}),
+            body: bodyJson,
             headers: {Authorization: authHeader, "Content-Type": "application/json"},
           })
         } catch (e) {
@@ -149,7 +158,9 @@ export class MailNotifications {
     if (!$signer) return
 
     try {
-      const authEvent = await $signer.sign(await makeHttpAuth(EMAIL_NOTIFICATION_SERVER, "DELETE"))
+      const authEvent = await $signer.sign(
+        await makeHttpAuth(buildUrl(EMAIL_NOTIFICATION_SERVER, "subscription", key), "DELETE"),
+      )
       const authHeader = makeHttpAuthHeader(authEvent)
 
       await fetch(buildUrl(EMAIL_NOTIFICATION_SERVER, "subscription", key), {