Merge branch 'main' into fixCWE117

Author: thibmeu

package-lock.json

@@ -38,7 +38,8 @@
 		"@cloudflare/blindrsa-ts": "0.4.3",
 		"@cloudflare/vitest-pool-workers": "0.12.5",
 		"@cloudflare/workers-types": "4.20260122.0",
-		"@types/node": "25.0.10",
+		"@types/node": "^25.2.3",
+		"@types/node-fetch": "^2.6.13",
 		"@typescript-eslint/eslint-plugin": "6.21.0",
 		"@typescript-eslint/parser": "6.21.0",
 		"commander": "12.1.0",
@@ -55,7 +56,7 @@
 		"wrangler": "4.59.3"
 	},
 	"dependencies": {
-		"@cloudflare/privacypass-ts": "0.7.1",
+		"@cloudflare/privacypass-ts": "0.8.1",
 		"@sentry/cli": "2.26.0",
 		"@sentry/types": "7.95.0",
 		"@tsndr/cloudflare-worker-jwt": "3.2.1",

package.json

@@ -122,13 +122,15 @@ export class InMemoryCryptoKeyCache {
 		key: string,
 		setValFn: (key: string) => Promise<CacheElement<CryptoKey>>
 	): Promise<CryptoKey> {
+		const prefixedKey = `${this.ctx.prefix ?? ''}/${key}`;
+
 		const refreshCache = async () => {
 			const val = await setValFn(key);
-			InMemoryCryptoKeyCache.store.set(key, val);
+			InMemoryCryptoKeyCache.store.set(prefixedKey, val);
 			return val.value;
 		};
 
-		const cachedValue = InMemoryCryptoKeyCache.store.get(key);
+		const cachedValue = InMemoryCryptoKeyCache.store.get(prefixedKey);
 		if (cachedValue) {
 			this.ctx.waitUntil(
 				(() => {

src/cache.ts

@@ -30,7 +30,7 @@ import {
 	PRIVATE_TOKEN_ISSUER_DIRECTORY,
 	TOKEN_TYPES,
 	publicVerif,
-	arbitraryBatched,
+	genericBatched,
 	util,
 } from '@cloudflare/privacypass-ts';
 import { KeyError } from './context/metrics';
@@ -42,7 +42,11 @@ import {
 	getDirectoryCache,
 } from './cache';
 const { BlindRSAMode, Issuer, TokenRequest } = publicVerif;
-const { BatchedTokenRequest, BatchedTokenResponse, Issuer: BatchedTokensIssuer } = arbitraryBatched;
+const {
+	BatchedTokenRequest,
+	GenericBatchTokenResponse,
+	Issuer: BatchedTokensIssuer,
+} = genericBatched;
 
 import { shouldClearKey } from './utils/keyRotation';
 import { WorkerEntrypoint } from 'cloudflare:workers';
@@ -170,7 +174,7 @@ export const handleBatchedTokenRequest = async (
 	// Deserialize the batched token request.
 	const batchedTokenRequest = BatchedTokenRequest.deserialize(new Uint8Array(buffer));
 	if (batchedTokenRequest.tokenRequests.length === 0) {
-		const responseBytes = new BatchedTokenResponse([]).serialize();
+		const responseBytes = new GenericBatchTokenResponse([]).serialize();
 		return {
 			serialized: responseBytes,
 			status: 200,

src/index.ts

@@ -3,7 +3,6 @@
 
 import { PRIVATE_TOKEN_ISSUER_DIRECTORY } from '@cloudflare/privacypass-ts';
 import { getDirectoryCache, shouldRevalidate, STALE_WHILE_REVALIDATE_IN_MS } from '../src/cache';
-import { default as workerObject } from '../src/index';
 import { MockCache } from './mocks';
 
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';

test/cache.test.ts

@@ -5,17 +5,17 @@ import {
 	TOKEN_TYPES,
 	TokenChallenge,
 	publicVerif,
-	arbitraryBatched,
+	genericBatched,
 	util,
 } from '@cloudflare/privacypass-ts';
 
-const { TokenRequest, Client: BatchedTokensClient, BatchedTokenResponse } = arbitraryBatched;
+const { TokenRequest, Client: BatchedTokensClient, GenericBatchTokenResponse } = genericBatched;
 import { type Token } from '@cloudflare/privacypass-ts';
 const { BlindRSAMode, Client, Origin } = publicVerif;
 
 import { RequestInit } from 'node-fetch';
 
-import { RequestInit as NodeFetchRequestInit, Response as NodeFetchResponse } from 'node-fetch';
+import { RequestInit as NodeFetchRequestInit } from 'node-fetch';
 // Union type for RequestInit from DOM and node‑fetch
 export type UniversalRequestInit = RequestInit | NodeFetchRequestInit;
 
@@ -69,10 +69,10 @@ export async function getIssuerConfig(
 export async function requestAndFinalizeToken(
 	baseUrl: string,
 	challenge: TokenChallenge,
-	client: any,
+	client: publicVerif.Client,
 	customFetch: UniversalFetch
 	// customFetch: (url: string, init?: RequestInit) => Promise<Response>
-): Promise<{ finalizedToken: any; publicKey: CryptoKey; response: Response }> {
+): Promise<{ finalizedToken: Token; publicKey: CryptoKey; response: Response }> {
 	// Get issuer configuration
 	const { url, publicKey, publicKeyEnc } = await getIssuerConfig(baseUrl, customFetch);
 
@@ -165,7 +165,7 @@ export async function requestBatchedTokens(
 	if (!response.ok) {
 		throw new Error(`Issuer request failed: ${response.status} ${response.statusText}`);
 	}
-	const tokenResponse = BatchedTokenResponse.deserialize(
+	const tokenResponse = GenericBatchTokenResponse.deserialize(
 		new Uint8Array(await response.arrayBuffer())
 	);
 	const responses = tokenResponse.tokenResponses;
@@ -177,8 +177,7 @@ export async function requestBatchedTokens(
 			continue;
 		}
 		try {
-			const deserializedResponse = publicVerif.TokenResponse.deserialize(res.tokenResponse);
-			const token = await clients[index].finalize(deserializedResponse);
+			const token = await clients[index].finalize(res.tokenResponse as publicVerif.TokenResponse);
 			tokens.push(token);
 		} catch (err) {
 			console.error(`[Token ${index}] Finalization failed:`, err);

test/e2e/e2eUtils.ts

@@ -43,7 +43,7 @@ export async function fetchWithMTLS(mTLS: MTLSConfiguration): Promise<UniversalF
 	// Return a function that accepts a UniversalRequestInit.
 	// We force the result to match the global Response type.
 	return async (url: string, init?: UniversalRequestInit): Promise<Response> => {
-		return (await fetch(url, { ...(init as any), agent } as any)) as unknown as Response;
+		return (await fetch(url, { ...init, agent })) as unknown as Response;
 	};
 }
 

test/e2e/issuer.ts

@@ -19,7 +19,7 @@ import {
 	MediaType,
 	PRIVATE_TOKEN_ISSUER_DIRECTORY,
 	publicVerif,
-	arbitraryBatched,
+	genericBatched,
 	util,
 	TokenChallenge,
 	TOKEN_TYPES,
@@ -127,16 +127,16 @@ describe('challenge handlers', () => {
 		const invs: Uint8Array[] = [];
 
 		const tokReqs = new Array<publicVerif.TokenRequest>(nTokens);
-		const batchedTokenReqs = new Array<arbitraryBatched.TokenRequest>(nTokens);
+		const batchedTokenReqs = new Array<genericBatched.TokenRequest>(nTokens);
 
 		for (let i = 0; i < nTokens; i++) {
 			const { blindedMsg, inv } = await suite.blind(publicKey, preparedMsg);
 			tokReqs[i] = new publicVerif.TokenRequest(tokenKeyId, blindedMsg, BLIND_RSA);
-			batchedTokenReqs[i] = new arbitraryBatched.TokenRequest(tokReqs[i]);
+			batchedTokenReqs[i] = new genericBatched.TokenRequest(tokReqs[i]);
 			invs.push(inv);
 		}
 
-		const batchedTokenRequest = new arbitraryBatched.BatchedTokenRequest(batchedTokenReqs);
+		const batchedTokenRequest = new genericBatched.GenericBatchTokenResponse(batchedTokenReqs);
 		const request = new Request(tokenRequestURL, {
 			method: 'POST',
 			headers: { 'content-type': MediaType.ARBITRARY_BATCHED_TOKEN_REQUEST },
@@ -148,7 +148,8 @@ describe('challenge handlers', () => {
 		expect(response.headers.get('content-type')).toBe(MediaType.ARBITRARY_BATCHED_TOKEN_RESPONSE);
 
 		const responseBytes = new Uint8Array(await response.arrayBuffer());
-		const batchedTokenResponse = arbitraryBatched.BatchedTokenResponse.deserialize(responseBytes);
+		const batchedTokenResponse =
+			genericBatched.GenericBatchTokenResponse.deserialize(responseBytes);
 
 		expect(batchedTokenResponse.tokenResponses.length).toBe(nTokens);
 
@@ -158,7 +159,12 @@ describe('challenge handlers', () => {
 			expect(tokenResponse.tokenResponse).not.toBeNull();
 
 			const blindSignature = tokenResponse.tokenResponse!;
-			const signature = await suite.finalize(publicKey, preparedMsg, blindSignature, invs[i]);
+			const signature = await suite.finalize(
+				publicKey,
+				preparedMsg,
+				(blindSignature as publicVerif.TokenResponse).blindSig,
+				invs[i]
+			);
 
 			const isValid = await suite.verify(publicKey, signature, preparedMsg);
 			expect(isValid).toBe(true);