@scriptc/runtime 0.0.13 → 0.0.14

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scriptc/runtime",
-  "version": "0.0.13",
+  "version": "0.0.14",
   "description": "scriptc native runtime — C sources, compiled into every scriptc binary",
   "license": "Apache-2.0",
   "homepage": "https://scriptc.dev",

package/src/scr_http.c

@@ -2911,8 +2911,23 @@ static ScrHttpClientReq *scr_http_request_impl(ScrStr *host /*borrowed*/, double
   if (cb) scr_net_ls_add(&c->resp_ls, cb, (void *)fn, true);
 
   /* dial — or take the caller's pre-made socket (createConnection); dial
-   * failures are the async 'error' either way, the net story */
-  c->sock = presock != NULL ? presock : scr_net_connect(port, host, NULL);
+   * failures are the async 'error' either way, the net story.
+   *
+   * The hostname resolves HERE, at the client dial, the way the island's
+   * client and the native fetch resolve at theirs: node:net's own connect
+   * surface stays resolver-less on purpose (Node's async lookup semantics
+   * are not this), so a client that dials by name has to ask. Only the
+   * dial takes the address — c->host keeps the ORIGINAL name, which is
+   * what the Host header carries and what the caller built the TLS
+   * client's SNI from. An unresolvable name comes back unchanged and the
+   * dial delivers Node's deferred ENOTFOUND. */
+  if (presock != NULL) {
+    c->sock = presock;
+  } else {
+    ScrStr *dial = scr_net_blocking_lookup(host);
+    c->sock = scr_net_connect(port, dial, NULL);
+    scr_str_release(dial);
+  }
   ScrHttpConn *conn = calloc(1, sizeof *conn);
   if (!conn) scr_http_oom();
   conn->sock = c->sock; /* borrowed */
@@ -4481,41 +4496,54 @@ void scr_http_client_end_dynv(ScrHttpClientReq *c, const ScrDyn *d) {
  * result +1 or NULL with the exception pending. */
 #include "scr_url_internal.h"
 
-ScrHttpClientReq *scr_http_request_url(ScrStr *url /*borrowed*/, ScrStr *method /*borrowed*/,
-                                        bool auto_end, ScrClosure *cb /*moves, nullable*/,
-                                        ScrHttpRespFn fn) {
+bool scr_http_url_parts(ScrStr *url /*borrowed*/, bool secure, ScrStr **host_out /*+1*/,
+                         double *port_out, ScrStr **path_out /*+1*/) {
   ScrUrl *u = scr_url_new(url);
-  if (!u) {
-    if (cb) scr_closure_release(cb);
-    return NULL; /* Invalid URL pending */
-  }
-  if (!(u->scheme->len == 4 && memcmp(u->scheme->data, "http", 4) == 0)) {
+  if (!u) return false; /* Invalid URL pending */
+  /* The scheme is checked against the MODULE the call came from, not read
+   * off the URL: http.get('https://…') is Node's ERR_INVALID_PROTOCOL, not
+   * a silent upgrade. Hence `secure` as a parameter. */
+  const char *want = secure ? "https" : "http";
+  const size_t wantlen = secure ? 5 : 4;
+  if (!(u->scheme->len == wantlen && memcmp(u->scheme->data, want, wantlen) == 0)) {
     char msg[128];
-    int n = snprintf(msg, sizeof msg, "Protocol \"%.*s:\" not supported. Expected \"http:\"",
-                     (int)(u->scheme->len < 32 ? u->scheme->len : 32), u->scheme->data);
+    int n = snprintf(msg, sizeof msg, "Protocol \"%.*s:\" not supported. Expected \"%s:\"",
+                     (int)(u->scheme->len < 32 ? u->scheme->len : 32), u->scheme->data, want);
     scr_throw_error_msg_code(SCR_ERR_TYPE, msg, (size_t)n, "ERR_INVALID_PROTOCOL");
     scr_url_release(u);
-    if (cb) scr_closure_release(cb);
-    return NULL;
+    return false;
   }
-  double port = 80;
+  double port = secure ? 443 : 80;
   if (u->port->len > 0) {
     port = 0;
     for (size_t i = 0; i < u->port->len; i++) port = port * 10 + (u->port->data[i] - '0');
   }
   /* IPv6 authority arrives bracketed ("[::1]") — the dial wants the bare
    * address, like Node's client strips them. */
-  ScrStr *host;
   if (u->host->len >= 2 && u->host->data[0] == '[' && u->host->data[u->host->len - 1] == ']') {
-    host = scr_str_new(u->host->data + 1, u->host->len - 2);
+    *host_out = scr_str_new(u->host->data + 1, u->host->len - 2);
   } else {
-    host = scr_str_retain(u->host);
+    *host_out = scr_str_retain(u->host);
   }
-  ScrStr *path;
   if (u->query->len > 0) {
-    path = scr_str_concat(u->path, u->query);
+    *path_out = scr_str_concat(u->path, u->query);
   } else {
-    path = u->path->len > 0 ? scr_str_retain(u->path) : scr_str_new("/", 1);
+    *path_out = u->path->len > 0 ? scr_str_retain(u->path) : scr_str_new("/", 1);
+  }
+  *port_out = port;
+  scr_url_release(u);
+  return true;
+}
+
+ScrHttpClientReq *scr_http_request_url(ScrStr *url /*borrowed*/, ScrStr *method /*borrowed*/,
+                                        bool auto_end, ScrClosure *cb /*moves, nullable*/,
+                                        ScrHttpRespFn fn) {
+  ScrStr *host;
+  ScrStr *path;
+  double port;
+  if (!scr_http_url_parts(url, false, &host, &port, &path)) {
+    if (cb) scr_closure_release(cb);
+    return NULL; /* Invalid URL / ERR_INVALID_PROTOCOL pending */
   }
   ScrArr *pairs = scr_arr_new(SCR_ELEM_STR, 0); /* request_impl reads the pairs array */
   ScrHttpClientReq *c = scr_http_request_ex(host, port, path, method, 0, pairs, auto_end,
@@ -4523,6 +4551,5 @@ ScrHttpClientReq *scr_http_request_url(ScrStr *url /*borrowed*/, ScrStr *method
   scr_arr_release(pairs);
   scr_str_release(host);
   scr_str_release(path);
-  scr_url_release(u);
   return c;
 }

package/src/scr_http2.c

@@ -2440,7 +2440,12 @@ ScrH2Session *scr_http2_connect(ScrStr *url /*borrowed*/, bool reject_unauthoriz
   /* stash the authority in the session's hblock buf slot? No — its own
    * field: reuse rbuf? Neither: a dedicated malloc. */
   ScrStr *host_str = scr_str_new(host, hlen);
-  ScrNetSocket *sock = scr_net_connect(port, host_str, NULL);
+  /* Resolve for the dial only (the http client's rule): the TLS wrap below
+   * takes host_str, the NAME, because that is what SNI and verification
+   * must see. */
+  ScrStr *dial_addr = scr_net_blocking_lookup(host_str);
+  ScrNetSocket *sock = scr_net_connect(port, dial_addr, NULL);
+  scr_str_release(dial_addr);
   if (secure) scr_tls_h2_client_wrap(sock, host_str, reject_unauthorized, ca, ca_len);
   scr_str_release(host_str);
   s->sock = sock; /* scr_net_connect returned +1 — the session takes it */

package/src/scr_runtime.h

@@ -5327,6 +5327,12 @@ ScrHttpClientReq *scr_http_request_ex(ScrStr *host /*borrowed*/, double port,
 ScrHttpClientReq *scr_http_request_url(ScrStr *url /*borrowed*/, ScrStr *method /*borrowed*/,
                                         bool auto_end, ScrClosure *cb /*moves, nullable*/,
                                         ScrHttpRespFn fn); /* +1 */
+/* Its parse half, shared with scr_tls.c's https spelling: the scheme is
+ * checked against `secure` (the calling module), so a mismatch is Node's
+ * ERR_INVALID_PROTOCOL rather than a silent upgrade. false = the
+ * exception is pending and no out-parameter was written. */
+bool scr_http_url_parts(ScrStr *url /*borrowed*/, bool secure, ScrStr **host_out /*+1*/,
+                         double *port_out, ScrStr **path_out /*+1*/);
 /* ── the http Agent (new http.Agent(opts) — option surface, getName, and
  * the maxSockets queue over one-dial-per-request connections; keep-alive
  * POOLING is not modeled: keepAlive: true fences at construction).
@@ -5514,6 +5520,13 @@ ScrHttpClientReq *scr_https_request(ScrStr *host /*borrowed*/, double port,
                                      bool auto_end, bool reject_unauthorized,
                                      const char *ca /*borrowed, len 0 = none*/, size_t ca_len,
                                      ScrClosure *cb /*moves, nullable*/, ScrHttpRespFn fn); /* +1 */
+/* The URL-string form (https.get('https://host/path')): scr_http.c's
+ * shared parse, then the options form's dial with Node's no-options
+ * defaults (verification on, the default trust anchors). Throws
+ * catchably on an unparsable input or a non-https scheme. */
+ScrHttpClientReq *scr_https_request_url(ScrStr *url /*borrowed*/, ScrStr *method /*borrowed*/,
+                                         bool auto_end, ScrClosure *cb /*moves, nullable*/,
+                                         ScrHttpRespFn fn); /* +1 */
 /* The agent-threaded twin (the scr_http_request_agent story over TLS). */
 ScrHttpClientReq *scr_https_request_agent(ScrStr *host /*borrowed*/, double port,
                                            ScrStr *path /*borrowed*/, ScrStr *method /*borrowed*/,

package/src/scr_tls.c

@@ -1006,6 +1006,30 @@ ScrHttpClientReq *scr_https_request(ScrStr *host /*borrowed*/, double port,
                               fn, 443, &scr_tls_cli_wrap, cli);
 }
 
+/* https.get('https://host/path') — the URL-string spelling, sharing
+ * scr_http.c's parse (which rejects a non-https scheme here with Node's
+ * ERR_INVALID_PROTOCOL) and dialing through the same per-request client
+ * config as the options form. No options means Node's defaults: the
+ * certificate is verified against the default trust anchors. */
+ScrHttpClientReq *scr_https_request_url(ScrStr *url /*borrowed*/, ScrStr *method /*borrowed*/,
+                                         bool auto_end, ScrClosure *cb /*moves, nullable*/,
+                                         ScrHttpRespFn fn) {
+  ScrStr *host;
+  ScrStr *path;
+  double port;
+  if (!scr_http_url_parts(url, true, &host, &port, &path)) {
+    if (cb) scr_closure_release(cb);
+    return NULL; /* Invalid URL / ERR_INVALID_PROTOCOL pending */
+  }
+  ScrArr *pairs = scr_arr_new(SCR_ELEM_STR, 0);
+  ScrHttpClientReq *c = scr_https_request(host, port, path, method, 0, pairs, auto_end,
+                                           true /* rejectUnauthorized */, NULL, 0, cb, fn);
+  scr_arr_release(pairs);
+  scr_str_release(host);
+  scr_str_release(path);
+  return c;
+}
+
 ScrHttpClientReq *scr_https_request_agent(ScrStr *host /*borrowed*/, double port,
                                            ScrStr *path /*borrowed*/, ScrStr *method /*borrowed*/,
                                            double timeout_ms, ScrArr *header_pairs /*borrowed*/,
@@ -1516,7 +1540,12 @@ ScrNetSocket *scr_tls_connect_dyn(double port, ScrStr *host /*borrowed, nullable
     localhost_fallback = scr_str_new("localhost", 9);
     verify_host = localhost_fallback;
   }
-  ScrNetSocket *s = scr_net_connect(port, dial_host, cb); /* cb fires post-handshake — secureConnect */
+  /* Resolve for the dial only (the http client's rule): verify_host above
+   * already holds the NAME, which is what SNI and certificate verification
+   * must see. A null dial_host stays null — scr_net_connect's own arm. */
+  ScrStr *dial_addr = dial_host != NULL ? scr_net_blocking_lookup(dial_host) : NULL;
+  ScrNetSocket *s = scr_net_connect(port, dial_addr, cb); /* cb fires post-handshake — secureConnect */
+  if (dial_addr) scr_str_release(dial_addr);
   ScrTlsCli *cli = scr_tls_cli_new2(verify_host, reject,
                                      ca != NULL ? (const char *)ca->data : NULL,
                                      ca != NULL ? ca->len : 0, !reject);