@whitewall/blip-sdk 0.0.176 → 0.0.177

package/src/sender/tcp/tcpsender.ts

@@ -1,4 +1,5 @@
 import type { Socket } from 'node:net'
+import type { ConnectionOptions } from 'node:tls'
 import type {
     Command,
     CommandMethods,
@@ -9,11 +10,13 @@ import type {
     Notification,
     UnknownCommandResponse,
 } from '../../types/index.ts'
+import { logger } from '../../utils/logger.ts'
 import { BlipError } from '../bliperror.ts'
 import { RetryableError } from '../retryableerror.ts'
 import { ConnectionSender, type ConnectionSenderConstructor, OpenConnectionSender } from '../sender.ts'
 import { SessionNegotiator } from '../sessionnegotiator.ts'
 import { EnvelopeThrottler } from '../throttler.ts'
+import { buildTlsConnectOptions } from '../transporttls.ts'
 import { tryParseJSON } from './json-parser.ts'
 
 /**
@@ -30,16 +33,26 @@ export class TCPSender extends OpenConnectionSender {
         super(options)
 
         const prefix = options.tenantId ? `${options.tenantId}.` : ''
+        const host = `${prefix}tcp.${this.domain}`
+        const auth = options.authentication
+        const tlsOptions: ConnectionOptions | null =
+            auth.scheme === 'transport' ? { ...buildTlsConnectOptions(auth), servername: host } : null
+
         this.connectionHandle = new TCPHandle<Envelope>(
-            `${prefix}tcp.${this.domain}`,
+            host,
             443,
-            (socket) => {
+            () => {
                 this.sessionNegotiator = new SessionNegotiator(this, (session) => {
-                    socket.write(JSON.stringify(session))
+                    this.connectionHandle
+                        .get()
+                        .then((s) => s.write(JSON.stringify(session)))
+                        .catch((err) => logger.warn('TCPSender', 'Failed to write session frame', err))
                 })
+                const upgradeToTls = tlsOptions ? () => this.connectionHandle.upgradeToTls(tlsOptions) : undefined
                 return this.sessionNegotiator.negotiate({
                     node: options.node,
-                    authentication: options.authentication,
+                    authentication: auth,
+                    upgradeToTls,
                 })
             },
             () => this.envelopeResolver.rejectPendingEnvelopes('Connection was closed'),
@@ -124,15 +137,18 @@ class TCPHandle<T> {
     private currentSocketPromise: Promise<Socket> | null = null
     private closing = false
     private connectionAttempts = 0
+    private buffer = Buffer.alloc(0)
+    private readonly onMessage: (message: T) => void
 
     constructor(
         host: string,
         port: number,
-        onConnected: (socket: Socket) => Promise<void>,
+        onConnected: () => Promise<void>,
         onClose: () => void,
         onMessage: (message: T) => void,
     ) {
-        this.currentSocketPromise = this.connect(host, port, onConnected, onClose, onMessage)
+        this.onMessage = onMessage
+        this.currentSocketPromise = this.connect(host, port, onConnected, onClose)
     }
 
     public get() {
@@ -151,17 +167,55 @@ class TCPHandle<T> {
         }
     }
 
+    public async upgradeToTls(options: ConnectionOptions): Promise<void> {
+        if (!this.currentSocketPromise) {
+            throw new Error('Cannot upgrade: no active socket.')
+        }
+        const plain = await this.currentSocketPromise
+        plain.removeAllListeners('data')
+        this.buffer = Buffer.alloc(0)
+
+        const { connect: tlsConnect } = await import('node:tls')
+        const secured = tlsConnect({ ...options, socket: plain })
+
+        await new Promise<void>((resolve, reject) => {
+            const onError = (err: Error) => {
+                secured.off('secureConnect', onConnect)
+                reject(err)
+            }
+            const onConnect = () => {
+                secured.off('error', onError)
+                resolve()
+            }
+            secured.once('secureConnect', onConnect)
+            secured.once('error', onError)
+        })
+
+        this.attachDataListener(secured)
+        this.currentSocketPromise = Promise.resolve(secured)
+    }
+
+    private attachDataListener(socket: NodeJS.ReadableStream) {
+        socket.on('data', (chunk: Buffer<ArrayBuffer>) => {
+            const result = tryParseJSON<T>(this.buffer.length === 0 ? chunk : Buffer.concat([this.buffer, chunk]))
+            this.buffer = result.remainingBuffer
+
+            for (const parsed of result.parsedObjects) {
+                this.onMessage(parsed)
+            }
+        })
+    }
+
     private async connect(
         host: string,
         port: number,
-        onConnected: (socket: Socket) => Promise<void>,
+        onConnected: () => Promise<void>,
         onClose: () => void,
-        onMessage: (message: T) => void,
     ): Promise<Socket> {
         const { connect } = await import('node:net')
 
         const socket = connect({ host, port }).setKeepAlive(true)
-        let buffer = Buffer.alloc(0)
+        this.buffer = Buffer.alloc(0)
 
         await new Promise<void>((resolve) => {
             socket.once('connect', () => {
@@ -175,29 +229,28 @@ class TCPHandle<T> {
             })
 
             socket.once('close', () => {
+                socket.removeAllListeners('data')
                 if (!this.closing) {
                     onClose()
 
                     this.connectionAttempts++
                     if (this.connectionAttempts < 3) {
-                        this.currentSocketPromise = this.connect(host, port, onConnected, onClose, onMessage)
+                        this.currentSocketPromise = this.connect(host, port, onConnected, onClose)
                     } else {
                         throw new Error('Failed to connect/reconnect to TCP socket')
                     }
                 }
             })
 
-            socket.on('data', (chunk: Buffer<ArrayBuffer>) => {
-                const result = tryParseJSON<T>(buffer.length === 0 ? chunk : Buffer.concat([buffer, chunk]))
-                buffer = result.remainingBuffer
-
-                for (const parsed of result.parsedObjects) {
-                    onMessage(parsed)
-                }
-            })
+            this.attachDataListener(socket)
         })
 
-        await onConnected(socket)
+        // sendSession callbacks read currentSocketPromise via .get(); resolve it
+        // before onConnected runs so negotiate() can write the 'new' session frame
+        // (otherwise we deadlock waiting on the outer connect() promise).
+        this.currentSocketPromise = Promise.resolve(socket)
+
+        await onConnected()
         this.connectionAttempts = 0
 
         return socket

package/src/sender/transporttls.ts

@@ -0,0 +1,16 @@
+import type { TransportAuthentication } from './security.ts'
+
+export function buildTlsConnectOptions(auth: TransportAuthentication) {
+    const toBuf = (v: Uint8Array | string) => (typeof v === 'string' ? v : Buffer.from(v))
+    const toBufOrArray = (v: TransportAuthentication['ca']) =>
+        Array.isArray(v) ? v.map(toBuf) : v !== undefined ? toBuf(v) : undefined
+
+    return {
+        pfx: auth.pfx ? [{ buf: Buffer.from(auth.pfx), passphrase: auth.passphrase }] : undefined,
+        cert: auth.cert !== undefined ? toBuf(auth.cert) : undefined,
+        key: auth.key !== undefined ? toBuf(auth.key) : undefined,
+        ca: toBufOrArray(auth.ca),
+        passphrase: auth.passphrase,
+        rejectUnauthorized: auth.rejectUnauthorized ?? true,
+    }
+}

package/src/sender/websocket/websocketsender.ts

@@ -11,6 +11,7 @@ import type {
 import { logger } from '../../utils/logger.ts'
 import { BlipError } from '../bliperror.ts'
 import { RetryableError } from '../retryableerror.ts'
+import { assertNonTransportAuth, type NonTransportAuthentication } from '../security.ts'
 import { ConnectionSender, type ConnectionSenderConstructor, OpenConnectionSender } from '../sender.ts'
 import { SessionNegotiator } from '../sessionnegotiator.ts'
 import { EnvelopeThrottler } from '../throttler.ts'
@@ -19,10 +20,14 @@ export class WebSocketSender extends OpenConnectionSender {
     private readonly throttler = new EnvelopeThrottler()
     private readonly connectionHandle: WebSocketHandle<Envelope>
 
-    constructor(options: ConstructorParameters<ConnectionSenderConstructor>[0]) {
+    constructor(
+        options: ConstructorParameters<ConnectionSenderConstructor<WebSocketSender, NonTransportAuthentication>>[0],
+    ) {
         super(options)
+        assertNonTransportAuth(options.authentication, 'WebSocketSender')
 
         const prefix = options.tenantId ? `${options.tenantId}.` : ''
+
         this.connectionHandle = new WebSocketHandle<Envelope>(
             `wss://${prefix}ws.${this.domain}`,
             (webSocket) => {