fix: allow cross-origin WebSocket and fix Redis stream MINID format

[rcoderdev]

Summary

Two bugs preventing browser extension WebSocket connections to the notification server:

1. WebSocket Origin rejection — websocket.Accept(w, r, nil) uses the coder/websocket library's default origin check, which requires the Origin header to match the Host header. Browser extensions send Origin: chrome-extension://<id>, causing 403 rejection. Fix: set OriginPatterns: ["*"] — authentication is already handled via the token in query params. Also re-applies the Cloudflare HTTP/1.0 workaround that was lost in a recent merge.

2. Redis Streams MINID format — XAdd was called with MinID: "~" + minID, concatenating the approximate-trimming prefix into the ID string itself. go-redis v9 expects Approx: true as a separate field. The ~-prefixed string is an invalid stream ID, causing ERR Invalid stream ID specified as stream command argument.

Testing

• Ran the notification server locally with both fixes
• Browser extension successfully established WebSocket connection (status 101)
• Sent POST /notify → notification delivered via Redis Streams → WebSocket → extension showed the keysign notification banner
• Verified full E2E: registration → WebSocket → notify → banner display

Summary by CodeRabbit

• Bug Fixes
  • WebSocket connections now properly support HTTP/1.0 protocol requests by upgrading to HTTP/1.1
  • Updated cross-origin request handling to accept all origin patterns during WebSocket upgrade
• Performance
  • Optimized stream data trimming operations

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 448e23fd-69e0-4707-99fa-c97152e26f90

📥 Commits

Reviewing files that changed from the base of the PR and between 3fe92d5 and 0d0c7d2.

📒 Files selected for processing (2)

• stream/stream.go
• ws/handler.go

---

Walkthrough

The PR modifies Redis stream trimming logic in the stream publisher and updates WebSocket upgrade handling to detect HTTP/1.0 requests and force HTTP/1.1, while also changing origin validation options during the WebSocket accept step.

Changes

Cohort / File(s)	Summary
Stream Publishing stream/stream.go	Modified Redis stream entry trimming in (*Store).Publish: removed "~" prefix from MinID and set Approx: true on redis.XAddArgs.
WebSocket Handler ws/handler.go	Updated (*Handler).ServeHTTP to detect HTTP/1.0 requests and force protocol to HTTP/1.1 before WebSocket accept. Changed websocket.Accept options from nil to &websocket.AcceptOptions{ OriginPatterns: []string{"*"} }.

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title directly summarizes the two main changes: cross-origin WebSocket fix and Redis stream MINID format fix, matching the primary objectives of the PR.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/websocket-origin-and-stream

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[johnnyluo]

LGTM