@seriousme/opifex 1.3.0 → 1.5.0

package/.github/workflows/update-license-year.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+
+license='LICENSE.txt'
+prefix='2016-'
+current_year=$(date +%Y)
+sed -i -e "s/$prefix\([0-9\]\+\)/$prefix$current_year/" $license
+
+if [ "$(git diff $license)" ]; then
+  git add $license
+  git commit -m "Update license year to $current_year"
+  git push
+else
+  echo "No changes detected in $license"
+fi

package/.github/workflows/update-license-year.yml

@@ -0,0 +1,13 @@
+name: Update License Year
+
+on:
+  schedule:
+    - cron: "5 12 1 1 *"
+
+jobs:
+  update_license:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Update license year
+        run: ./update_license.sh

package/CHANGELOG.md

@@ -4,6 +4,18 @@
 
 ### Changed
 
+## [v1.5.0] 02-01-2025
+
+### Changed
+
+- added client certificate support to mqtts.ts
+
+## [v1.4.0] 02-01-2025
+
+### Changed
+
+- added client certificate support (w0otness)
+
 ## [v1.3.0] 19-11-2024
 
 ### Changed

package/LICENSE.txt

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2024 Hans Klunder
+Copyright (c) 2023-2025 Hans Klunder
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/bin/mqtt.ts

@@ -2,7 +2,8 @@
 import { DEFAULT_URL } from "../client/mod.ts";
 import { logger, LogLevel } from "../utils/mod.ts";
 import { getArgs, parseArgs } from "../utils/mod.ts";
-import { getCaCerts, TcpClient } from "../node/client.ts";
+import { getFileData, TcpClient } from "../node/client.ts";
+import type { Args } from "../utils/args.ts";
 
 const client = new TcpClient();
 const encoder = new TextEncoder();
@@ -21,18 +22,30 @@ const ConnectHelp = `
   -i/--clientId   the clientId to connect to the server
   -U/--username   the username to connect to the server
   -P/--password   the password to connect to the server
-  -c/--certFile   the path to a certFile
+  -C/--caFile     the path to a CA certificate file
+  -c/--certFile   the path to a certificate file
+  -k/--keyFile    the path to a key file
   -n/--noClean    try to resume a previous session
   -h/--help       this text
   `;
 
 const connectOpts = {
-  string: ["url", "username", "password", "certFile", "clientId"],
+  string: [
+    "url",
+    "username",
+    "password",
+    "caFile",
+    "certFile",
+    "keyFile",
+    "clientId",
+  ],
   alias: {
     u: "url",
     U: "username",
     P: "password",
+    C: "caFile",
     c: "certFile",
+    k: "keyFile",
     i: "clientId",
     n: "noClean",
     h: "help",
@@ -80,9 +93,25 @@ function parseQos(qosArg: string | number) {
   return 0;
 }
 
+async function getTLSdata(connectArgs: Args) {
+  const caFileData = await getFileData(connectArgs.caFile);
+  const caCerts = caFileData ? [caFileData] : undefined;
+  const cert = await getFileData(connectArgs.certFile);
+  const key = await getFileData(connectArgs.keyFile);
+  return {
+    caCerts,
+    cert,
+    key,
+  };
+}
+
 async function subscribe() {
   const connectArgs = parseArgs(getArgs(), connectOpts);
-  const caCerts = await getCaCerts(connectArgs.certFile);
+  const {
+    caCerts,
+    cert,
+    key,
+  } = await getTLSdata(connectArgs);
   const subscribeArgs = parseArgs(getArgs(), subscribeOpts);
   if (connectArgs.help) {
     console.log(SubscribeHelp);
@@ -96,6 +125,8 @@ async function subscribe() {
     await client.connect({
       url: connectArgs.url,
       caCerts,
+      cert,
+      key,
       options: {
         username: connectArgs.username,
         password: encoder.encode(connectArgs.password),
@@ -157,7 +188,11 @@ const publishOpts = {
 
 async function publish() {
   const connectArgs = parseArgs(getArgs(), connectOpts);
-  const caCerts = await getCaCerts(connectArgs.certFile);
+  const {
+    caCerts,
+    cert,
+    key,
+  } = await getTLSdata(connectArgs);
   const publishArgs = parseArgs(getArgs(), publishOpts);
   if (connectArgs.help) {
     console.log(PublishHelp);
@@ -171,6 +206,8 @@ async function publish() {
     await client.connect({
       url: connectArgs.url,
       caCerts,
+      cert,
+      key,
       options: {
         username: connectArgs.username,
         password: encoder.encode(connectArgs.password),

package/client/client.ts

@@ -25,6 +25,8 @@ type ConnectOptions = Omit<
 export type ConnectParameters = {
   url?: URL;
   caCerts?: string[];
+  cert?: string;
+  key?: string;
   numberOfRetries?: number;
   options?: ConnectOptions;
 };
@@ -70,6 +72,8 @@ export class Client {
   protected keepAlive = DEFAULT_KEEPALIVE;
   protected autoReconnect = true;
   private caCerts?: string[];
+  private cert?: string;
+  private key?: string;
   private clientId: string;
   private ctx = new Context(new MemoryStore());
   private connectPacket?: ConnectPacket;
@@ -84,6 +88,8 @@ export class Client {
     _hostname: string,
     _port?: number,
     _caCerts?: string[],
+    _cert?: string,
+    _key?: string,
   ): Promise<SockConn> {
     // if you need to support alternative connection types just
     // overload this method in your subclass
@@ -106,6 +112,8 @@ export class Client {
           this.url.hostname,
           Number(this.url.port) ?? undefined,
           this.caCerts,
+          this.cert,
+          this.key,
         );
         // if we get this far we have a connection
         tryConnect =
@@ -137,6 +145,8 @@ export class Client {
     this.url = params?.url || this.url;
     this.numberOfRetries = params.numberOfRetries || this.numberOfRetries;
     this.caCerts = params?.caCerts;
+    this.cert = params?.cert;
+    this.key = params?.key;
     const options = Object.assign(
       {
         keepAlive: this.keepAlive,

package/deno/client.ts

@@ -4,15 +4,15 @@ import { Client } from "../client/client.ts";
 import { logger } from "../client/deps.ts";
 import type { SockConn } from "../client/deps.ts";
 
-export async function getCaCerts(filename: string | undefined) {
+export async function getFileData(filename: string | undefined) {
   if (!filename) {
     return;
   }
-  const caCerts = await Deno.readTextFile(filename);
-  if (caCerts === "") {
+  const data = await Deno.readTextFile(filename);
+  if (data === "") {
     return;
   }
-  return [caCerts];
+  return data;
 }
 
 export class TcpClient extends Client {
@@ -25,9 +25,11 @@ export class TcpClient extends Client {
     hostname: string,
     port = 8883,
     caCerts?: string[],
+    cert?: string,
+    key?: string,
   ) {
-    logger.debug({ hostname, port, caCerts });
-    return await Deno.connectTls({ hostname, port, caCerts });
+    logger.debug({ hostname, port, caCerts, cert });
+    return await Deno.connectTls({ hostname, port, caCerts, cert, key });
   }
 
   protected override createConn(
@@ -35,11 +37,13 @@ export class TcpClient extends Client {
     hostname: string,
     port?: number,
     caCerts?: string[],
+    cert?: string,
+    key?: string,
   ): Promise<SockConn> {
     // if you need to support alternative connection types just
     // overload this method in your subclass
     if (protocol === "mqtts:") {
-      return this.connectMQTTS(hostname, port, caCerts);
+      return this.connectMQTTS(hostname, port, caCerts, cert, key);
     }
     if (protocol === "mqtt:") {
       return this.connectMQTT(hostname, port);

package/deno.json

@@ -1,6 +1,6 @@
 {
   "name": "@seriousme/opifex",
-  "version": "1.3.0",
+  "version": "1.5.0",
   "exports": {
     "./server": "./server/mod.ts",
     "./client": "./client/mod.ts"

package/deno.lock

@@ -2,29 +2,32 @@
   "version": "4",
   "specifiers": {
     "npm:@types/node@*": "22.5.4",
-    "npm:@types/node@^22.8.6": "22.8.6"
+    "npm:@types/node@^22.10.0": "22.10.0"
   },
   "npm": {
-    "@types/node@22.5.4": {
-      "integrity": "sha512-FDuKUJQm/ju9fT/SeX/6+gBzoPzlVCzfzmGkwKvRHQVxi4BntVbyIwf6a4Xn62mrvndLiml6z/UBXIdEVjQLXg==",
+    "@types/node@22.10.0": {
+      "integrity": "sha512-XC70cRZVElFHfIUB40FgZOBbgJYFKKMa5nb9lxcwYstFG/Mi+/Y0bGS+rs6Dmhmkpq4pnNiLiuZAbc02YCOnmA==",
       "dependencies": [
-        "undici-types"
+        "undici-types@6.20.0"
       ]
     },
-    "@types/node@22.8.6": {
-      "integrity": "sha512-tosuJYKrIqjQIlVCM4PEGxOmyg3FCPa/fViuJChnGeEIhjA46oy8FMVoF9su1/v8PNs2a8Q0iFNyOx0uOF91nw==",
+    "@types/node@22.5.4": {
+      "integrity": "sha512-FDuKUJQm/ju9fT/SeX/6+gBzoPzlVCzfzmGkwKvRHQVxi4BntVbyIwf6a4Xn62mrvndLiml6z/UBXIdEVjQLXg==",
       "dependencies": [
-        "undici-types"
+        "undici-types@6.19.8"
       ]
     },
     "undici-types@6.19.8": {
       "integrity": "sha512-ve2KP6f/JnbPBFyobGHuerC9g1FYGn/F8n1LWTwNxCEzd6IfqTwUQcNXgEtmmQ6DlRrC1hrSrBnCZPokRrDHjw=="
+    },
+    "undici-types@6.20.0": {
+      "integrity": "sha512-Ny6QZ2Nju20vw1SRHe3d9jVu6gJ+4e3+MMpqu7pqE5HT6WsTSlce++GQmK5UXS8mzV8DSYHrQH+Xrf2jVcuKNg=="
     }
   },
   "workspace": {
     "packageJson": {
       "dependencies": [
-        "npm:@types/node@^22.8.6"
+        "npm:@types/node@^22.10.0"
       ]
     }
   }

package/dist/bin/mqtt.js

@@ -2,7 +2,7 @@
 import { DEFAULT_URL } from "../client/mod.js";
 import { logger, LogLevel } from "../utils/mod.js";
 import { getArgs, parseArgs } from "../utils/mod.js";
-import { getCaCerts, TcpClient } from "../node/client.js";
+import { getFileData, TcpClient } from "../node/client.js";
 const client = new TcpClient();
 const encoder = new TextEncoder();
 const decoder = new TextDecoder();
@@ -18,17 +18,29 @@ const ConnectHelp = `
   -i/--clientId   the clientId to connect to the server
   -U/--username   the username to connect to the server
   -P/--password   the password to connect to the server
-  -c/--certFile   the path to a certFile
+  -C/--caFile     the path to a CA certificate file
+  -c/--certFile   the path to a certificate file
+  -k/--keyFile    the path to a key file
   -n/--noClean    try to resume a previous session
   -h/--help       this text
   `;
 const connectOpts = {
-    string: ["url", "username", "password", "certFile", "clientId"],
+    string: [
+        "url",
+        "username",
+        "password",
+        "caFile",
+        "certFile",
+        "keyFile",
+        "clientId",
+    ],
     alias: {
         u: "url",
         U: "username",
         P: "password",
+        C: "caFile",
         c: "certFile",
+        k: "keyFile",
         i: "clientId",
         n: "noClean",
         h: "help",
@@ -72,9 +84,20 @@ function parseQos(qosArg) {
     console.log("QoS must be between 0 and 2");
     return 0;
 }
+async function getTLSdata(connectArgs) {
+    const caFileData = await getFileData(connectArgs.caFile);
+    const caCerts = caFileData ? [caFileData] : undefined;
+    const cert = await getFileData(connectArgs.certFile);
+    const key = await getFileData(connectArgs.keyFile);
+    return {
+        caCerts,
+        cert,
+        key,
+    };
+}
 async function subscribe() {
     const connectArgs = parseArgs(getArgs(), connectOpts);
-    const caCerts = await getCaCerts(connectArgs.certFile);
+    const { caCerts, cert, key, } = await getTLSdata(connectArgs);
     const subscribeArgs = parseArgs(getArgs(), subscribeOpts);
     if (connectArgs.help) {
         console.log(SubscribeHelp);
@@ -88,6 +111,8 @@ async function subscribe() {
         await client.connect({
             url: connectArgs.url,
             caCerts,
+            cert,
+            key,
             options: {
                 username: connectArgs.username,
                 password: encoder.encode(connectArgs.password),
@@ -145,7 +170,7 @@ const publishOpts = {
 };
 async function publish() {
     const connectArgs = parseArgs(getArgs(), connectOpts);
-    const caCerts = await getCaCerts(connectArgs.certFile);
+    const { caCerts, cert, key, } = await getTLSdata(connectArgs);
     const publishArgs = parseArgs(getArgs(), publishOpts);
     if (connectArgs.help) {
         console.log(PublishHelp);
@@ -159,6 +184,8 @@ async function publish() {
         await client.connect({
             url: connectArgs.url,
             caCerts,
+            cert,
+            key,
             options: {
                 username: connectArgs.username,
                 password: encoder.encode(connectArgs.password),

package/dist/client/client.js

@@ -34,6 +34,8 @@ export class Client {
     keepAlive = DEFAULT_KEEPALIVE;
     autoReconnect = true;
     caCerts;
+    cert;
+    key;
     clientId;
     ctx = new Context(new MemoryStore());
     connectPacket;
@@ -41,7 +43,7 @@ export class Client {
         this.clientId = generateClientId(this.clientIdPrefix);
         this.numberOfRetries = DEFAULT_RETRIES;
     }
-    createConn(protocol, _hostname, _port, _caCerts) {
+    createConn(protocol, _hostname, _port, _caCerts, _cert, _key) {
         // if you need to support alternative connection types just
         // overload this method in your subclass
         throw `Unsupported protocol: ${protocol}`;
@@ -57,7 +59,7 @@ export class Client {
         while (tryConnect) {
             logger.debug(`${isReconnect ? "re" : ""}connecting`);
             try {
-                const conn = await this.createConn(this.url.protocol, this.url.hostname, Number(this.url.port) ?? undefined, this.caCerts);
+                const conn = await this.createConn(this.url.protocol, this.url.hostname, Number(this.url.port) ?? undefined, this.caCerts, this.cert, this.key);
                 // if we get this far we have a connection
                 tryConnect =
                     (await this.ctx.handleConnection(conn, this.connectPacket)) &&
@@ -88,6 +90,8 @@ export class Client {
         this.url = params?.url || this.url;
         this.numberOfRetries = params.numberOfRetries || this.numberOfRetries;
         this.caCerts = params?.caCerts;
+        this.cert = params?.cert;
+        this.key = params?.key;
         const options = Object.assign({
             keepAlive: this.keepAlive,
             clientId: this.clientId,

package/dist/node/client.js

@@ -6,15 +6,15 @@ import { readFile } from "node:fs/promises";
 import { createConnection } from "node:net";
 import * as tls from "node:tls";
 import { wrapNodeSocket } from "./wrapNodeSocket.js";
-export async function getCaCerts(filename) {
+export async function getFileData(filename) {
     if (!filename) {
         return;
     }
-    const caCerts = await readFile(filename, { encoding: "utf-8" });
-    if (caCerts === "") {
+    const data = await readFile(filename, { encoding: "utf-8" });
+    if (data === "") {
         return;
     }
-    return [caCerts];
+    return data;
 }
 export class TcpClient extends Client {
     connectMQTT(hostname, port = 1883) {
@@ -25,21 +25,20 @@ export class TcpClient extends Client {
                 resolve(wrapNodeSocket(socket));
             });
             socket.once("error", (err) => {
-                // @ts-ignore the type spec of err is missing err.code
                 logger.debug("Connection failed: ", err);
                 reject(err);
             });
         });
     }
-    connectMQTTS(hostname, port = 8883, caCerts) {
+    connectMQTTS(hostname, port = 8883, ca, cert, key) {
         const opts = {
             host: hostname,
             port,
-            secureContext: caCerts
-                ? tls.createSecureContext({ cert: caCerts })
+            secureContext: (ca || key || cert)
+                ? tls.createSecureContext({ ca, cert, key })
                 : undefined,
         };
-        logger.debug({ hostname, port, caCerts });
+        logger.debug({ hostname, port, ca, cert });
         return new Promise((resolve, reject) => {
             const socket = tls.connect(opts, () => {
                 logger.debug("Connected to server");

package/dist/tsconfig.tsbuildinfo

@@ -1 +1 @@
-{"root":["../bin/conformanceServer.ts","../bin/demoServer.ts","../bin/mqtt.ts"],"version":"5.7.0-beta"}
+{"root":["../bin/conformanceServer.ts","../bin/demoServer.ts","../bin/mqtt.ts"],"version":"5.7.2"}

package/node/client.ts

@@ -8,15 +8,15 @@ import * as tls from "node:tls";
 import type { SockConn } from "../socket/socket.ts";
 import { wrapNodeSocket } from "./wrapNodeSocket.ts";
 
-export async function getCaCerts(filename: string | undefined) {
+export async function getFileData(filename: string | undefined) {
   if (!filename) {
     return;
   }
-  const caCerts = await readFile(filename, { encoding: "utf-8" });
-  if (caCerts === "") {
+  const data = await readFile(filename, { encoding: "utf-8" });
+  if (data === "") {
     return;
   }
-  return [caCerts];
+  return data;
 }
 
 export class TcpClient extends Client {
@@ -31,7 +31,6 @@ export class TcpClient extends Client {
         },
       );
       socket.once("error", (err) => {
-        // @ts-ignore the type spec of err is missing err.code
         logger.debug("Connection failed: ", err);
         reject(err);
       });
@@ -41,16 +40,18 @@ export class TcpClient extends Client {
   protected connectMQTTS(
     hostname: string,
     port = 8883,
-    caCerts?: string[],
+    ca?: string[],
+    cert?: string,
+    key?: string,
   ): Promise<SockConn> {
     const opts = {
       host: hostname,
       port,
-      secureContext: caCerts
-        ? tls.createSecureContext({ cert: caCerts })
+      secureContext: (ca || key || cert)
+        ? tls.createSecureContext({ ca, cert, key })
         : undefined,
     };
-    logger.debug({ hostname, port, caCerts });
+    logger.debug({ hostname, port, ca, cert });
     return new Promise((resolve, reject) => {
       const socket = tls.connect(opts, () => {
         logger.debug("Connected to server");

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@seriousme/opifex",
-  "version": "1.3.0",
+  "version": "1.5.0",
   "description": "MQTT client & server for Deno & NodeJS",
   "type": "module",
   "scripts": {
     "test": "node --experimental-strip-types --test --test-skip-pattern='/^Deno/'",
     "prebuild": "rm -rf dist",
-    "build": "npx -p typescript@beta tsc --build",
+    "build": "npx -p typescript tsc --build",
     "postbuild": "deno fmt",
     "preversion": "npm run test",
     "version": "npm run build",
@@ -45,6 +45,6 @@
   },
   "homepage": "https://github.com/seriousme/opifex#readme",
   "devDependencies": {
-    "@types/node": "^22.8.6"
+    "@types/node": "^22.10.0"
   }
 }