@chitchat/sdk-web 0.1.0-dev.0 → 0.1.0-dev.1

package/README.md

@@ -1,5 +1,5 @@
 # ChitChat Web SDK
 
-`createChitChatWebClient` always uses WSS. It authenticates through the first binary Protobuf frame, never by placing a session token in a URL. Supply the generated Protobuf codec and a function that fetches a short-lived project-user session token.
+`createChitChatWebClient` always uses WSS. It authenticates through the first binary Protobuf frame, never by placing a session token in a URL. Supply the generated Protobuf codec and a function that fetches a short-lived project-user session token. Plain `ws://` is rejected except for an explicit `allowInsecureWs: true` localhost-only development configuration.
 
 Raw TCP is not available in browsers and is never attempted by this module.

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "@chitchat/sdk-web",
-  "version": "0.1.0-dev.0",
+  "version": "0.1.0-dev.1",
   "main": "src/index.js",
+  "exports": "./src/index.js",
   "files": ["src", "README.md", "LICENSE"],
   "engines": { "node": ">=18" },
-  "dependencies": { "@chitchat/sdk-core": "0.1.0-dev.0" },
+  "dependencies": { "@chitchat/sdk-core": "0.1.0-dev.1" },
   "license": "UNLICENSED",
   "publishConfig": { "access": "public", "tag": "development" }
 }

package/src/index.js

@@ -3,15 +3,18 @@
 let ReliableRealtimeClient;
 try { ({ ReliableRealtimeClient } = require('@chitchat/sdk-core')); } catch (_) { ({ ReliableRealtimeClient } = require('../../chitchat-core/src')); }
 
-const toWssEndpoint = (endpoint) => {
-  const url = new URL(endpoint);
+const isLocalHttpUrl = (url) => ['localhost', '127.0.0.1', '::1'].includes(url.hostname);
+const toWssEndpoint = (endpoint, { allowInsecureWs = false } = {}) => {
+  let url;
+  try { url = new URL(endpoint); } catch (_) { throw new Error('A valid HTTPS or WSS endpoint is required'); }
+  if (url.username || url.password) throw new Error('Realtime endpoint must not include credentials');
   if (url.protocol === 'https:') url.protocol = 'wss:';
-  if (url.protocol === 'http:') url.protocol = 'ws:';
-  if (!['wss:', 'ws:'].includes(url.protocol)) throw new Error('A HTTP(S) or WS(S) endpoint is required');
+  if (url.protocol === 'http:' && allowInsecureWs === true && isLocalHttpUrl(url)) url.protocol = 'ws:';
+  if (url.protocol !== 'wss:' && !(url.protocol === 'ws:' && allowInsecureWs === true && isLocalHttpUrl(url))) throw new Error('Web realtime requires WSS (WS is allowed only for explicit localhost development)');
   return url.toString();
 };
 
-const createWssTransportFactory = ({ WebSocketImpl = globalThis.WebSocket, encode, decode }) => {
+const createWssTransportFactory = ({ WebSocketImpl = globalThis.WebSocket, encode, decode, allowInsecureWs = false }) => {
   if (!WebSocketImpl || typeof encode !== 'function' || typeof decode !== 'function') throw new Error('WebSocket implementation and protobuf encode/decode functions are required');
   return async ({ endpoint, token, protocol }) => {
     let socket; let onMessage = () => {}; let onClose = () => {};
@@ -19,7 +22,7 @@ const createWssTransportFactory = ({ WebSocketImpl = globalThis.WebSocket, encod
       onMessage: (listener) => { onMessage = listener; },
       onClose: (listener) => { onClose = listener; },
       open: () => new Promise((resolve, reject) => {
-        socket = new WebSocketImpl(toWssEndpoint(endpoint), protocol);
+        socket = new WebSocketImpl(toWssEndpoint(endpoint, { allowInsecureWs }), protocol);
         socket.binaryType = 'arraybuffer';
         socket.onopen = () => { socket.send(encode({ type: 'auth', token })); resolve(); };
         socket.onerror = () => reject(new Error('WSS connection failed'));
@@ -32,6 +35,6 @@ const createWssTransportFactory = ({ WebSocketImpl = globalThis.WebSocket, encod
   };
 };
 
-const createChitChatWebClient = ({ endpoint, tokenProvider, protobuf, ...options }) => new ReliableRealtimeClient({ endpoint, tokenProvider, runtime: 'web', webTransportFactory: createWssTransportFactory(protobuf), ...options });
+const createChitChatWebClient = ({ endpoint, tokenProvider, protobuf, allowInsecureWs = false, ...options }) => new ReliableRealtimeClient({ endpoint, tokenProvider, runtime: 'web', webTransportFactory: createWssTransportFactory({ ...protobuf, allowInsecureWs }), ...options });
 
 module.exports = { createChitChatWebClient, createWssTransportFactory, toWssEndpoint };