An example Ruby implementation using ZeroPush to send Safari Push Notifications

routes.rb

Application.routes.draw do
  scope format: false, constraints: {website_push_id: /[a-zA-Z0-9\._-]+/} do
    # When a user allows permission to receive push notifications, a POST request is sent to the following URL:
    # webServiceURL/version/pushPackages/websitePushID
    post '/safari/:version/pushPackages/:website_push_id' => 'safari_apn#package'

    # When users first grant permission, or later change their permission levels for your website, a POST request is sent to the following URL:
    # webServiceURL/version/devices/deviceToken/registrations/websitePushID
    post '/safari/:version/devices/:device_token/registrations/:website_push_id' => 'safari_apn#register'

    # If a user removes permission of a website in Safari preferences, a DELETE request is sent to the following URL:
    # webServiceURL/version/devices/deviceToken/registrations/websitePushID
    delete '/safari/:version/devices/:device_token/registrations/:website_push_id' => 'safari_apn#unregister'

    # If an error occurs, a POST request is sent to the following URL:
    # webServiceURL/version/log
    post '/safari/:version/log' => 'safari_apn#log'
  end
end

safari_push.js

document.body.onload = function() {
    // Ensure that the user can receive Safari Push Notifications.
    if ('safari' in window && 'pushNotification' in window.safari) {
        var permissionData = window.safari.pushNotification.permission('web.com.my-awesome-site');
        checkRemotePermission(permissionData);
    }
    else {
      // A good time to let a user know they are missing out on a feature or just bail out completely?
    }
};

var checkRemotePermission = function (permissionData) {
    if (permissionData.permission === 'default') {
        // This is a new web service URL and its validity is unknown.
        window.safari.pushNotification.requestPermission(
            'https://your-webservice-url/safari', // The web service URL.
            'web.com.my-awesome-site',     // The Website Push ID.
            {user_id: 4741619481},         // Data used to help you identify the user.
            checkRemotePermission          // The callback function.
        );
    }
    else if (permissionData.permission === 'denied') {
      // The user said no. Talk to your UX expert to see what you can do to entice your
      // users to subscribe to push notifications.
    }
    else if (permissionData.permission === 'granted') {
        // The web service URL is a valid push provider, and the user said yes.
        // permissionData.deviceToken is now available to use.
    }
};

SafariApnController.rb

class SafariApnController < ApplicationController
  
  # When a user allows permission to receive push notifications, a POST request is sent to the following URL:
  # webServiceURL/version/pushPackages/websitePushID
  # post '/:version/pushPackages/:website_push_id' => 'safari_apn#package'
  def package
    #return the push package
    send_file(File.join(Rails.root, 'public', 'pushPackage.zip'), type: 'application/zip', disposition: 'inline')
  end

  # When users first grant permission, or later change their permission levels for your website, a POST request is sent to the following URL:
  # webServiceURL/version/devices/deviceToken/registrations/websitePushID
  # post '/:version/devices/:device_token/registrations/:website_push_id' => 'safari_apn#register'
  def register
    # In the HTTP request is an Authorization header. Its value is the word ApplePushNotifications and the authentication token, separated by a single space. The authentication token is the same token that’s specified in your package’s website.json file. Your web service can use this authentication token to determine which user is removing their permission policy.
    # Use this authentication token to remove the device token from your database, as if the device had never registered to your service.
    
    #TODO: Create a record to store this device token. It will be used to send push notifications later.
    render json: {message: 'ok'}, status: 200
  end

  # If a user removes permission of a website in Safari preferences, a DELETE request is sent to the following URL:
  # webServiceURL/version/devices/deviceToken/registrations/websitePushID
  # delete '/:version/devices/:device_token/registrations/:website_push_id' => 'safari_apn#unregister'
  def unregister
    # In the HTTP request is an Authorization header. Its value is the word ApplePushNotifications and the authentication token, separated by a single space. The authentication token is the same token that’s specified in your package’s website.json file. Your web service can use this authentication token to determine which user is removing their permission policy.
    # Use this authentication token to remove the device token from your database, as if the device had never registered to your service.
    
    #TODO: Delete the record with this device token. The device will no longer accept notifications.
    render json: {message: 'ok'}, status: 200
  end

  # If an error occurs, a POST request is sent to the following URL:
  # webServiceURL/version/log
  # post '/:version/log' => 'safari_apn#log'
  def log
    # In the HTTP body is a JSON dictionary containing a single key, named logs, which holds an array of strings describing the errors that occurred.
    # Use this endpoint to help you debug your web service implementation. The logs contain a description of the error in a human-readable format. See “Troubleshooting” for a list of possible errors.
    
    #TODO: Log the incoming messages intelligently within the application.
    render json: {message: 'ok'}, status: 200
  end
end