apache-iggy 0.8.1-edge.3 → 0.8.1-edge.4

package/README.md

@@ -57,11 +57,7 @@ from the SDK command table use `Operation::NonReplicated` and carry the command
 code in the request header's reserved field. The server remains authoritative
 for classifying or rejecting extension commands.
 
-The same npm package supports both framing modes. VSR currently supports TCP
-only and restricts `Client` to one pooled connection because authentication,
-request sequencing, and consumer-group assignments belong to one consensus
-session. Configurations requesting VSR over TLS or more than one pooled
-connection fail before a socket is opened.
+The same npm package supports both framing modes over TCP and TLS. VSR restricts `Client` to one pooled connection because authentication, request sequencing, and consumer-group assignments belong to one consensus session. Configurations requesting more than one pooled connection fail before a socket is opened.
 
 VSR authentication translates the existing password and personal-access-token
 login APIs into the register handshake required by the consensus protocol. A

package/dist/client/client.config.js

@@ -24,8 +24,6 @@ export const normalizeClientConfig = (config) => {
     if (!Number.isSafeInteger(maxResponseFrameSize) ||
         maxResponseFrameSize < 256)
         throw new TypeError('maxResponseFrameSize must be a safe integer of at least 256 bytes');
-    if (protocol === 'vsr' && config.transport === 'TLS')
-        throw new TypeError('VSR framing currently supports the TCP transport only');
     if (protocol === 'vsr' &&
         ((config.poolSize?.min ?? 1) > 1 || (config.poolSize?.max ?? 1) > 1))
         throw new TypeError('VSR clients currently support exactly one pooled connection');

package/dist/client/client.config.test.js

@@ -50,12 +50,15 @@ describe('normalizeClientConfig', () => {
             protocol: 'auto'
         }), /unsupported wire protocol/);
     });
-    it('rejects VSR over an untested TLS transport', () => {
-        assert.throws(() => normalizeClientConfig({
+    it('supports VSR over TLS', () => {
+        const normalized = normalizeClientConfig({
             ...config(),
             protocol: 'vsr',
             transport: 'TLS'
-        }), /TCP transport only/);
+        });
+        assert.equal(normalized.protocol, 'vsr');
+        assert.equal(normalized.transport, 'TLS');
+        assert.deepEqual(normalized.poolSize, { min: 1, max: 1 });
     });
     it('rejects unsafe response frame limits', () => {
         for (const maxResponseFrameSize of [0, 255, 1.5, Number.MAX_VALUE])

package/dist/client/client.socket.test.js

@@ -17,8 +17,10 @@
 //
 import assert from 'node:assert/strict';
 import { once } from 'node:events';
+import { readFileSync } from 'node:fs';
 import { createServer } from 'node:net';
 import { describe, it } from 'node:test';
+import { createServer as createTlsServer } from 'node:tls';
 import { COMMAND_CODE } from '../wire/command.code.js';
 import { ResponseError } from '../wire/error.utils.js';
 import { Command2, EVICTION_OFFSET, EvictionReason, HEADER_SIZE, REPLY_OFFSET, REQUEST_OFFSET } from '../wire/vsr/header.js';
@@ -26,10 +28,13 @@ import { Operation } from '../wire/vsr/operation.js';
 import { VsrEvictionError } from '../wire/vsr/reply.js';
 import { CommandResponseStream } from './client.socket.js';
 const TEST_SESSION = 42n;
+const TLS_CERTIFICATE = readFileSync(new URL('../../../../core/certs/iggy_cert.pem', import.meta.url));
+const TLS_KEY = readFileSync(new URL('../../../../core/certs/iggy_key.pem', import.meta.url));
+const TLS_CA_CERTIFICATE = readFileSync(new URL('../../../../core/certs/iggy_ca_cert.pem', import.meta.url));
 /** Loopback server speaking just enough VSR framing for the client tests. */
-const startVsrServer = async (handler) => {
+const startVsrServer = async (handler, transport = 'TCP') => {
     const frames = [];
-    const server = createServer((socket) => {
+    const handleConnection = (socket) => {
         let pending = Buffer.alloc(0);
         socket.on('data', (data) => {
             pending = Buffer.concat([pending, data]);
@@ -44,7 +49,10 @@ const startVsrServer = async (handler) => {
             }
         });
         socket.on('error', () => { });
-    });
+    };
+    const server = transport === 'TLS'
+        ? createTlsServer({ cert: TLS_CERTIFICATE, key: TLS_KEY }, handleConnection)
+        : createServer(handleConnection);
     server.listen(0, '127.0.0.1');
     await once(server, 'listening');
     return {
@@ -160,6 +168,28 @@ const vsrConfig = (port) => ({
     reconnect: { enabled: false, interval: 100, maxRetries: 1 }
 });
 describe('VSR client socket', () => {
+    it('exchanges VSR frames over TLS', async () => {
+        const server = await startVsrServer((frame, socket) => singleNodeHandler(server.port)(frame, socket), 'TLS');
+        const client = new CommandResponseStream({
+            ...vsrConfig(server.port),
+            transport: 'TLS',
+            options: {
+                host: '127.0.0.1',
+                port: server.port,
+                servername: 'localhost',
+                ca: TLS_CA_CERTIFICATE
+            }
+        });
+        try {
+            const response = await client.sendCommand(60_015, Buffer.from('tls'));
+            assert.equal(response.status, 0);
+            assert.equal(server.frames.length, 3);
+        }
+        finally {
+            client.destroy();
+            await server.close();
+        }
+    });
     it('registers one session before the first authenticated command', async () => {
         const server = await startVsrServer((frame, socket) => singleNodeHandler(server.port)(frame, socket));
         const client = new CommandResponseStream(vsrConfig(server.port));

package/dist/e2e/tls.system.e2e.js

@@ -46,9 +46,13 @@ const caCertPath = process.env.E2E_ROOT_CA_CERT
 const getTlsClient = () => {
     const [, port] = getIggyAddress();
     const caCert = readFileSync(caCertPath);
+    const protocol = process.env.IGGY_TEST_PROTOCOL === 'vsr'
+        ? 'vsr'
+        : 'classic';
     // The server certificate SAN is DNS:localhost, so we connect via 'localhost'
     // for proper hostname verification (consistent with Python and C# TLS tests).
     return new Client({
+        protocol,
         transport: 'TLS',
         options: {
             port,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "apache-iggy",
   "type": "module",
-  "version": "0.8.1-edge.3",
+  "version": "0.8.1-edge.4",
   "description": "Official Apache Iggy NodeJS SDK",
   "keywords": [
     "iggy",
@@ -58,8 +58,8 @@
   "devDependencies": {
     "@commitlint/cli": "21.2.1",
     "@commitlint/config-conventional": "21.2.0",
-    "@cucumber/cucumber": "13.1.1",
-    "@swc-node/register": "1.12.0",
+    "@cucumber/cucumber": "13.2.0",
+    "@swc-node/register": "1.12.1",
     "@types/debug": "4.1.13",
     "@types/node": "26.1.1",
     "c8": "^12.0.0",