@jcoder-stack/abp-react 0.1.0 → 0.1.1

package/dist/proxy.js

@@ -141,6 +141,43 @@ function resolveAbpAuthEnv(env, opts = {}) {
   });
 }
 
+// src/proxy/tls-trust.ts
+var TRUST_FAILURE_CODES = /* @__PURE__ */ new Set([
+  "CERT_HAS_EXPIRED",
+  "CERT_NOT_YET_VALID",
+  "CERT_UNTRUSTED",
+  "DEPTH_ZERO_SELF_SIGNED_CERT",
+  "ERR_TLS_CERT_ALTNAME_INVALID",
+  "SELF_SIGNED_CERT_IN_CHAIN",
+  "UNABLE_TO_GET_ISSUER_CERT",
+  "UNABLE_TO_GET_ISSUER_CERT_LOCALLY",
+  "UNABLE_TO_VERIFY_LEAF_SIGNATURE"
+]);
+var MAX_DEPTH = 5;
+function property(value, key) {
+  if (typeof value !== "object" || value === null) return void 0;
+  return value[key];
+}
+function search(value, depth) {
+  if (depth > MAX_DEPTH || typeof value !== "object" || value === null) return null;
+  const code = property(value, "code");
+  if (typeof code === "string" && TRUST_FAILURE_CODES.has(code)) return code;
+  const aggregated = property(value, "errors");
+  if (Array.isArray(aggregated)) {
+    for (const inner of aggregated) {
+      const found = search(inner, depth + 1);
+      if (found !== null) return found;
+    }
+  }
+  return search(property(value, "cause"), depth + 1);
+}
+function tlsTrustFailureCode(error) {
+  return search(error, 0);
+}
+function tlsTrustFailureMessage(code, url) {
+  return `abp proxy: upstream TLS certificate is not trusted (${code}) at ${new URL(url).origin}. Node verifies against its own CA list and ignores the OS keychain, so a self-signed dev certificate the browser accepts still fails here. Start the server with NODE_EXTRA_CA_CERTS=<pem path>; it is read at startup, so putting it in .env has no effect.`;
+}
+
 // src/proxy/proxy.ts
 var AbpProxyError = class extends Error {
   constructor(message, setCookies, opts) {
@@ -235,16 +272,18 @@ function createAbpProxy(opts) {
             signal: AbortSignal.any([...stops, AbortSignal.timeout(timeoutMs)])
           });
         } catch (error) {
-          if (attempt < maxRetries && !stopped()) {
+          const tlsCode = tlsTrustFailureCode(error);
+          if (tlsCode === null && attempt < maxRetries && !stopped()) {
             opts.logger?.debug("proxy retry after network error", { attempt, path: req.path });
             if (await backoff()) continue;
           }
+          const failure = tlsCode === null ? error : new Error(tlsTrustFailureMessage(tlsCode, url), { cause: error });
           if (setCookies.length > 0) {
             throw new AbpProxyError("abp proxy request failed after refresh", setCookies, {
-              cause: error
+              cause: failure
             });
           }
-          throw error;
+          throw failure;
         }
         if (res.status === 401 && !refreshedOnce && session?.tokens.refreshToken !== void 0) {
           refreshedOnce = true;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@jcoder-stack/abp-react",
   "description": "纯 React ABP 前端框架运行时：日志、ABP 类型与 zod 解析、fetch client、认证会话、ABP 代理网关、权限、i18n、React Provider/hooks、TanStack Router 守卫；按子路径分域导出",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "type": "module",
   "license": "MIT",
   "repository": {