On every HomeActivity open (non-Vrutti tenants), AppUtils.subscribeTopics subscribes the device to three FCM topics: urvi_endorsement_status, urvi_endorsement_comment and NOTIFICATION. unsubscribeTopic() removes them. FirebaseMessageReceiver handles data messages. Status and comment messages look up the farmer by key_entity_id and show a local notification unless the logged-in user is the sender. Any other topic shows title and body and saves them to the notifications table. The publishers are the app itself: EndorsementPostRH and EndorsementCommentPostRH call FcmUtil.sendMessage, which POSTs to the legacy https://fcm.googleapis.com/fcm/send with "Authorization: key=<FCM server key>". That server key comes from app constants (AppUtils.getAppConstant().getFCMServerkey()), so it is shipped to every device. Google retired the legacy FCM API in 2024, so these device-originated sends probably fail silently. onNewToken does nothing (the token is never registered with the backend).
Headers
Header
Value
Notes
Authorization (device-side legacy FCM send)
key=<redacted: FCM server key fetched from app constants, see ApplicationClass.kt:64 / HomeViewModel.kt:147>
Secret leak: the server key is held on the device and sent from it.
Content-Type
application/json
Legacy send only.
Parameters
Param
In
Required
Example
Notes
topic
path
Yes
urvi_endorsement_status
One of urvi_endorsement_status, urvi_endorsement_comment, NOTIFICATION. Global topics: every device of every user on the tenant gets every message.