Insulate bitcoin-ohttp and bitcoin-hpke from the public API - #1702
Merged
Merged
Conversation
HpkeSecretKey and HpkePublicKey each wrapped a bitcoin-hpke KEM key type behind a public tuple field plus a Deref impl, leaking those foreign types into payjoin's public API. A breaking release of bitcoin-hpke would then force a breaking release of payjoin. Make the inner fields private and drop the Deref impls so the foreign key types are no longer reachable through the public API. Callers use the existing accessor methods and to_/from_compressed_bytes, so no downstream code changes are required.
Collaborator
Coverage Report for CI Build 28969235109Coverage increased (+0.04%) to 85.934%Details
Uncovered Changes
Coverage RegressionsNo coverage regressions found. Coverage Stats
💛 - Coveralls |
Member
|
concept ACK this is important before 1.0-rc.4 |
Collaborator
|
We either need to remove |
Several bitcoin-ohttp types leaked into payjoin's public API: OhttpKeys exposed its inner ohttp::KeyConfig through a public field and Deref, decode/to_bytes returned ohttp::Error, and ohttp::ClientResponse appeared directly in the v2 create_*/process_* signatures. A breaking release of bitcoin-ohttp would then force a breaking release of payjoin. Make the OhttpKeys field private and drop its Deref/DerefMut, wrap the key config error in a new OhttpKeysError that erases ohttp::Error, and return the OHTTP response context as a new opaque OhttpResponse newtype. ohttp_encapsulate now takes &OhttpKeys directly. Tests build OhttpKeys through the public decode API via a new payjoin_test_utils::ohttp_key_config_bytes helper (plus ohttp_server for the emulated gateway), since production code only ever constructs OhttpKeys from directory bytes. payjoin-ffi no longer needs its direct bitcoin-ohttp dependency, so drop it.
spacebear21
force-pushed
the
api/insulate-ohttp-hpke
branch
from
July 8, 2026 19:17
0928067 to
25ff70d
Compare
spacebear21
marked this pull request as ready for review
July 8, 2026 19:50
spacebear21
added a commit
to spacebear21/rust-payjoin
that referenced
this pull request
Jul 22, 2026
Part of the 1.0 API hardening: remove the foreign bitcoin_uri types from payjoin's public API so that a breaking release of bitcoin_uri no longer forces a breaking release of payjoin. This follows the same approach as the bitcoin-ohttp and bitcoin-hpke insulation in payjoin#1702. Previously `Uri` and `PjUri` were type aliases to `bitcoin_uri::Uri`, so the wrapped type, its public fields (including `bitcoin_uri::Param` labels and messages), the `bitcoin_uri::de::Error` parse error, and the `bitcoin_uri::Uri` returned by `check_pj_supported` were all reachable through the public API. The parser traits were also implemented directly on the public `MaybePayjoinExtras` and `PayjoinExtras` types. The crate now only names `bitcoin_uri` in private newtype fields and on the private adapters. No `bitcoin_uri` type or trait impl is reachable through the public API.
spacebear21
added a commit
to spacebear21/rust-payjoin
that referenced
this pull request
Jul 23, 2026
Part of the 1.0 API hardening: remove the foreign bitcoin_uri types from payjoin's public API so that a breaking release of bitcoin_uri no longer forces a breaking release of payjoin. This follows the same approach as the bitcoin-ohttp and bitcoin-hpke insulation in payjoin#1702. Previously `Uri` and `PjUri` were type aliases to `bitcoin_uri::Uri`, so the wrapped type, its public fields (including `bitcoin_uri::Param` labels and messages), the `bitcoin_uri::de::Error` parse error, and the `bitcoin_uri::Uri` returned by `check_pj_supported` were all reachable through the public API. The parser traits were also implemented directly on the public `MaybePayjoinExtras` and `PayjoinExtras` types. The crate now only names `bitcoin_uri` in private newtype fields and on the private adapters. No `bitcoin_uri` type or trait impl is reachable through the public API.
spacebear21
added a commit
to spacebear21/rust-payjoin
that referenced
this pull request
Jul 23, 2026
Part of the 1.0 API hardening: remove the foreign bitcoin_uri types from payjoin's public API so that a breaking release of bitcoin_uri no longer forces a breaking release of payjoin. This follows the same approach as the bitcoin-ohttp and bitcoin-hpke insulation in payjoin#1702. Previously `Uri` and `PjUri` were type aliases to `bitcoin_uri::Uri`, so the wrapped type, its public fields (including `bitcoin_uri::Param` labels and messages), the `bitcoin_uri::de::Error` parse error, and the `bitcoin_uri::Uri` returned by `check_pj_supported` were all reachable through the public API. The parser traits were also implemented directly on the public `MaybePayjoinExtras` and `PayjoinExtras` types. The crate now only names `bitcoin_uri` in private newtype fields and on the private adapters. No `bitcoin_uri` type or trait impl is reachable through the public API.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Part of the 1.0 API hardening: remove pre-1.0 foreign crate types
(
bitcoin-ohttp0.6,bitcoin-hpke0.13) from payjoin's public API so that abreaking release of either dependency no longer forces a breaking release of
payjoin. The rust-bitcoin 0.32 and bitcoin_uri 0.1 pins are intentionally kept
for 1.0.
bitcoin-hpke
Make the inner tuple fields of
HpkeSecretKeyandHpkePublicKeyprivate anddrop their
Derefimpls, so the wrapped secp256k1/hpke KEM key types are nolonger reachable through the public API. Callers use the existing accessors and
to_/from_compressed_bytes.bitcoin-ohttp
OhttpKeys' innerohttp::KeyConfigfield is now private and theDeref/DerefMutimpls are removed.OhttpKeys::decode/encode/to_bytes/TryFromreturn a new opaqueOhttpKeysErrorinstead ofohttp::Error(the foreign error is erasedbehind
Box<dyn Error + Send + Sync>, keeping thesource()chain).create_*/process_*methods now return/accept a new opaqueOhttpResponsenewtype instead ofohttp::ClientResponse.ohttp_encapsulatetakes&OhttpKeysdirectly.payjoin-cliandpayjoin-ffiare updated to the new API. The FFI's exporteduniffi surface is unchanged (only its internal plumbing types), so the language
bindings do not require regeneration.
The two changes are split into separate commits (hpke, then ohttp) for review.
Disclosure: co-authored by Claude Code (Opus 4.8)
🤖 Generated with Claude Code