create-safest-tools 0.5.2 → 0.5.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-safest-tools",
-  "version": "0.5.2",
+  "version": "0.5.3",
   "description": "Create customer-owned abuse-reporting infrastructure on Cloudflare",
   "type": "module",
   "license": "Apache-2.0",

package/template/package.json

@@ -1,7 +1,7 @@
 {
   "name": "safest-resolve-installation",
-  "version": "0.5.2",
-  "safestToolsVersion": "0.5.2-resolve",
+  "version": "0.5.3",
+  "safestToolsVersion": "0.5.3-resolve",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

package/template/src/report-email.ts

@@ -67,7 +67,8 @@ export function reporterEmailConfigured(env: unknown): boolean {
 export type CaseReplyAudience = "reporter" | "affected_user";
 
 const legacyReplyTokenPattern = /^r1\.([a-z0-9_-]{16})\.([0-9a-f]{8})\.([0-9a-f]{24})$/u;
-const replyTokenPattern = /^r2([ra])\.([a-z0-9_-]{16})\.([0-9a-f]{8})\.([0-9a-f]{24})$/u;
+const replyTokenPattern = /^r([ra])\.([a-z0-9_-]{16})\.([0-9a-f]{8})\.([0-9a-f]{24})$/u;
+const transitionalReplyTokenPattern = /^r2([ra])\.([a-z0-9_-]{16})\.([0-9a-f]{8})\.([0-9a-f]{24})$/u;
 const encoder = new TextEncoder();
 
 function hex(bytes: Uint8Array): string {
@@ -98,7 +99,7 @@ export async function reporterReplyToken(input: {
   const expiry = input.expiresAt.toString(16).padStart(8, "0");
   if (!/^[0-9a-f]{8}$/u.test(expiry)) throw new Error("The reporter reply expiry is outside the supported range.");
   const audience = input.audience === "affected_user" ? "a" : "r";
-  const payload = `r2${audience}.${reference}.${expiry}`;
+  const payload = `r${audience}.${reference}.${expiry}`;
   return `${payload}.${hex(await replySignature(input.signingSecret, payload))}`;
 }
 
@@ -108,21 +109,23 @@ export async function verifyReporterReplyToken(
   currentTime = Math.floor(Date.now() / 1_000),
 ): Promise<{ publicReference: string; expiresAt: number; audience: CaseReplyAudience } | null> {
   const current = replyTokenPattern.exec(token);
-  const legacy = current ? null : legacyReplyTokenPattern.exec(token);
-  if (!current && !legacy) return null;
-  const reference = current?.[2] ?? legacy?.[1] ?? "";
-  const expiryHex = current?.[3] ?? legacy?.[2] ?? "";
-  const signatureHex = current?.[4] ?? legacy?.[3] ?? "";
+  const transitional = current ? null : transitionalReplyTokenPattern.exec(token);
+  const legacy = current || transitional ? null : legacyReplyTokenPattern.exec(token);
+  if (!current && !transitional && !legacy) return null;
+  const reference = current?.[2] ?? transitional?.[2] ?? legacy?.[1] ?? "";
+  const expiryHex = current?.[3] ?? transitional?.[3] ?? legacy?.[2] ?? "";
+  const signatureHex = current?.[4] ?? transitional?.[4] ?? legacy?.[3] ?? "";
   const expiry = Number.parseInt(expiryHex, 16);
   const supplied = Uint8Array.from(signatureHex.match(/.{2}/gu) ?? [], (pair) => Number.parseInt(pair, 16));
   if (!expiry || expiry <= currentTime) return null;
-  const payload = current ? `r2${current[1]}.${reference}.${expiryHex}` : `r1.${reference}.${expiryHex}`;
+  const payload = current ? `r${current[1]}.${reference}.${expiryHex}`
+    : transitional ? `r2${transitional[1]}.${reference}.${expiryHex}` : `r1.${reference}.${expiryHex}`;
   const expected = await replySignature(signingSecret, payload);
   if (!constantTimeEqual(supplied, expected)) return null;
   return {
     publicReference: `RPT-${reference.toUpperCase()}`,
     expiresAt: expiry,
-    audience: current?.[1] === "a" ? "affected_user" : "reporter",
+    audience: (current?.[1] ?? transitional?.[1]) === "a" ? "affected_user" : "reporter",
   };
 }