@vzn/vx-reapi 0.0.630 → 0.0.632

package/README.md

@@ -45,9 +45,10 @@ adds gRPC metadata to every call: a hosted server's API key goes there
 `RequestMetadata.tool_details`, and `correlatedInvocationsId` groups several
 runs as one build in a server's UI.
 
-TLS is on for a `grpcs://` or `https://` endpoint, or with any PEM below;
-a bare `host:port` is plaintext, unless `tls: true` turns it on (`tls: false`
-turns it off). It uses the system roots unless told otherwise. A server behind a private
+TLS is on unless asked off, as in Bazel: a bare `host:port`, a `grpcs://`
+or `https://` endpoint, and a `dns:`/`ipv4:`/`ipv6:` target all use it.
+Plaintext takes a `grpc://` or `http://` endpoint or `tls: false`; a `unix:`
+or `unix-abstract:` socket is plaintext (`tls: true` turns it on). It uses the system roots unless told otherwise. A server behind a private
 CA takes `tlsCertificate` (or `VX_REAPI_TLS_CERTIFICATE`), a PEM file of
 that CA; one that asks for mutual TLS takes `tlsClientCertificate` and
 `tlsClientKey` (`VX_REAPI_TLS_CLIENT_CERTIFICATE` / `VX_REAPI_TLS_CLIENT_KEY`)
@@ -335,7 +336,7 @@ server:
 docker run -d -p 19092:9092 buchgr/bazel-remote-cache:latest \
   --dir /data --max_size 1 --grpc_address 0.0.0.0:9092 --http_address 0.0.0.0:8080
 
-VX_REAPI_TEST_ENDPOINT=127.0.0.1:19092 bun test
+VX_REAPI_TEST_ENDPOINT=grpc://127.0.0.1:19092 bun test
 ```
 
 Without an endpoint those tests skip; CI sets `VX_REQUIRE_REAPI=1`, which turns

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx-reapi",
-  "version": "0.0.630",
+  "version": "0.0.632",
   "license": "MIT",
   "description": "Bazel Remote Execution API plugin for vx — remote cache (ActionCache + CAS) against NativeLink, BuildBuddy, Buildbarn or bazel-remote.",
   "keywords": [
@@ -39,7 +39,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@vzn/vx": "^0.0.630"
+    "@vzn/vx": "^0.0.632"
   },
   "repository": {
     "type": "git",

package/src/index.ts

@@ -51,7 +51,9 @@ export interface ReapiPluginOptions extends Partial<
   /**
    * Endpoint, or omit to read `VX_REAPI_ENDPOINT`. With neither the plugin
    * DECLINES — a declared-but-unconfigured plugin costs nothing and must
-   * never fail a run.
+   * never fail a run. TLS unless it starts `grpc://`, `http://`, `unix:` or
+   * `unix-abstract:`, or `tls: false` is set, as Bazel reads a schemeless
+   * `--remote_cache`.
    */
   endpoint?: string
   /**
@@ -173,7 +175,7 @@ function assertEndpoint(endpoint: string, from: string): void {
   const port = m?.[2] === undefined ? undefined : Number(m[2])
   if (m === null || (port !== undefined && (port < 1 || port > 65_535))) {
     throw new UserError(
-      `vx/reapi: ${from} is ${JSON.stringify(endpoint)}, which is not host[:port] (e.g. cache.example.com:443 or grpcs://cache.example.com)`,
+      `vx/reapi: ${from} is ${JSON.stringify(endpoint)}, which is not host[:port] (e.g. grpcs://cache.example.com:443)`,
     )
   }
 }

package/src/wire.ts

@@ -329,13 +329,13 @@ function abortableSleep(ms: number, signal: AbortSignal | undefined): Promise<vo
 const NOT_FOUND = grpc.status.NOT_FOUND
 
 export interface ReapiOptions {
-  /** `host:port` of the REAPI server. */
+  /** `host:port` of the REAPI server; TLS unless `grpc://`, `http://` or a socket. */
   endpoint: string
   /** Multi-tenant servers scope by instance; most single-tenant ones use ''. */
   instanceName?: string
   /** Sent on every call (auth, routing). */
   headers?: Record<string, string>
-  /** TLS. Default: on with any PEM below or an `https://`/`grpcs://` endpoint, else insecure. */
+  /** TLS. Default: on, unless the endpoint is `grpc://`, `http://`, `unix:` or `unix-abstract:` and no PEM below is set. */
   tls?: boolean
   /** PEM of the CA that signed the server's certificate, in place of the system roots. */
   tlsCaPem?: string
@@ -453,11 +453,13 @@ export class ReapiClient {
     assertBunSupportsChunking()
     const pem = (text: string | undefined): Buffer | null =>
       text === undefined ? null : Buffer.from(text)
+    // TLS unless the endpoint says plaintext, as Bazel reads a schemeless
+    // `--remote_cache`; a unix socket stays plaintext.
     const tls =
       opts.tls ??
       (opts.tlsCaPem !== undefined ||
         opts.tlsClientCertPem !== undefined ||
-        /^(https|grpcs):\/\//.test(opts.endpoint))
+        !/^((http|grpc):\/\/|unix:|unix-abstract:)/.test(opts.endpoint))
     const target = opts.endpoint.replace(/^(https?|grpcs?):\/\//, '')
     this.svc = loadServices(
       target,