Fix JWT encoding, null safety, and other code quality issues

- Fix Base64URL encoding in ApnSender and FirebaseSender (RFC 7617)
- Fix potential NullReferenceException in ApnSender error handling
- Fix static token cache key collision by including key ID
- Add device token validation in ApnSender.SendAsync
- Propagate CancellationToken in FirebaseSender.GetJwtTokenAsync
- Remove infinite loop in CorePush.Tester
- Remove unused System.IdentityModel.Tokens.Jwt dependency

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: andrei-m-code

CorePush.Tester/CorePush.Tester.csproj

@@ -11,7 +11,6 @@
 
   <ItemGroup>
     <PackageReference Include="FirebaseAdmin" Version="3.4.0" />
-    <PackageReference Include="System.IdentityModel.Tokens.Jwt" Version="8.15.0" />
   </ItemGroup>
 
 </Project>

CorePush.Tester/Program.cs

@@ -50,15 +50,13 @@ private static async Task SendApnNotificationAsync()
             ServerType = apnServerType,
         };
 
-        while (true)
-        {
-            var apn = new ApnSender(settings, http);
-            var payload = new AppleNotification(
-                Guid.NewGuid(), 
-                "Hello World (Message)",
-                "Hello World (Title)");
-            var response = await apn.SendAsync(payload, apnDeviceToken);
-        }
+        var apn = new ApnSender(settings, http);
+        var payload = new AppleNotification(
+            Guid.NewGuid(),
+            "Hello World (Message)",
+            "Hello World (Title)");
+        var response = await apn.SendAsync(payload, apnDeviceToken);
+        Console.WriteLine($"APN Response: {response.StatusCode} - {response.Message}");
     }
 
     private static async Task SendFirebaseNotificationAsync()

CorePush/Apple/ApnSender.cs

@@ -78,6 +78,8 @@ public async Task<PushResult> SendAsync(
         ApnPushType apnPushType = ApnPushType.Alert,
         CancellationToken cancellationToken = default)
     {
+        ArgumentException.ThrowIfNullOrWhiteSpace(deviceToken);
+
         var path = $"/3/device/{deviceToken}";
         var json = serializer.Serialize(notification);
 
@@ -102,19 +104,20 @@ public async Task<PushResult> SendAsync(
         using var response = await http.SendAsync(message, cancellationToken);
 
         var content = await response.Content.ReadAsStringAsync(cancellationToken);
-        var error = response.IsSuccessStatusCode 
-            ? null 
-            : serializer.Deserialize<ApnsError>(content).Reason;
+        var error = response.IsSuccessStatusCode
+            ? null
+            : serializer.Deserialize<ApnsError>(content)?.Reason;
 
         return new PushResult((int)response.StatusCode, response.IsSuccessStatusCode, content, error);
     }
 
     private string GetJwtToken()
     {
-        var (token, date) = tokens.GetOrAdd(settings.AppBundleIdentifier, _ => new Tuple<string, DateTime>(CreateJwtToken(), DateTime.UtcNow));
+        var cacheKey = $"{settings.AppBundleIdentifier}:{settings.P8PrivateKeyId}";
+        var (token, date) = tokens.GetOrAdd(cacheKey, _ => new Tuple<string, DateTime>(CreateJwtToken(), DateTime.UtcNow));
         if (date < DateTime.UtcNow.AddMinutes(-tokenExpiresMinutes))
         {
-            tokens.TryRemove(settings.AppBundleIdentifier, out _);
+            tokens.TryRemove(cacheKey, out _);
             return GetJwtToken();
         }
 
@@ -156,5 +159,9 @@ private static string Base64UrlEncode(string str)
         return Base64UrlEncode(bytes);
     }
 
-    private static string Base64UrlEncode(byte[] bytes) => Convert.ToBase64String(bytes);
+    private static string Base64UrlEncode(byte[] bytes) =>
+        Convert.ToBase64String(bytes)
+            .Replace('+', '-')
+            .Replace('/', '_')
+            .TrimEnd('=');
 }

CorePush/Firebase/FirebaseSender.cs

@@ -102,7 +102,7 @@ public async Task<PushResult> SendAsync(object payload, CancellationToken cancel
             HttpMethod.Post, 
             $"https://fcm.googleapis.com/v1/projects/{settings.ProjectId}/messages:send");
 
-        var token = await GetJwtTokenAsync();
+        var token = await GetJwtTokenAsync(cancellationToken);
 
         message.Headers.Add("Authorization", $"Bearer {token}");
         message.Content = new StringContent(json, Encoding.UTF8, "application/json");
@@ -118,22 +118,22 @@ public async Task<PushResult> SendAsync(object payload, CancellationToken cancel
             firebaseResponse.Error?.Status);
     }
 
-    private async Task<string> GetJwtTokenAsync()
+    private async Task<string> GetJwtTokenAsync(CancellationToken cancellationToken)
     {
         if (firebaseToken != null && firebaseTokenExpiration > DateTime.UtcNow)
         {
             return firebaseToken.AccessToken;
         }
-            
+
         using var message = new HttpRequestMessage(HttpMethod.Post, "https://oauth2.googleapis.com/token");
         using var form = new MultipartFormDataContent();
         var authToken = GetMasterToken();
         form.Add(new StringContent(authToken), "assertion");
         form.Add(new StringContent("urn:ietf:params:oauth:grant-type:jwt-bearer"), "grant_type");
         message.Content = form;
 
-        using var response = await http.SendAsync(message);
-        var content = await response.Content.ReadAsStringAsync();
+        using var response = await http.SendAsync(message, cancellationToken);
+        var content = await response.Content.ReadAsStringAsync(cancellationToken);
 
         if (!response.IsSuccessStatusCode)
         {
@@ -163,8 +163,8 @@ private string GetMasterToken()
             exp = CryptoHelper.GetEpochTimestamp() + 3600 /* has to be short lived */
         });
 
-        var headerBase64 = Convert.ToBase64String(Encoding.UTF8.GetBytes(header));
-        var payloadBase64 = Convert.ToBase64String(Encoding.UTF8.GetBytes(payload));
+        var headerBase64 = Base64UrlEncode(Encoding.UTF8.GetBytes(header));
+        var payloadBase64 = Base64UrlEncode(Encoding.UTF8.GetBytes(payload));
         var unsignedJwtData = $"{headerBase64}.{payloadBase64}";
         var unsignedJwtBytes = Encoding.UTF8.GetBytes(unsignedJwtData);
 
@@ -174,11 +174,17 @@ private string GetMasterToken()
         signer.BlockUpdate(unsignedJwtBytes, 0, unsignedJwtBytes.Length);
 
         var signature = signer.GenerateSignature();
-        var signatureBase64 = Convert.ToBase64String(signature);
+        var signatureBase64 = Base64UrlEncode(signature);
 
         return $"{unsignedJwtData}.{signatureBase64}";
     }
 
+    private static string Base64UrlEncode(byte[] bytes) =>
+        Convert.ToBase64String(bytes)
+            .Replace('+', '-')
+            .Replace('/', '_')
+            .TrimEnd('=');
+
     private static AsymmetricKeyParameter ParsePkcs8PrivateKeyPem(string key)
     {
         using var keyReader = new StringReader(key);