rpc-express-toolkit 2.1.0 → 2.2.0

package/README.md

@@ -516,30 +516,40 @@ logger.error('Database error', {
 
 ### Client Configuration
 
-The `RpcClient` supports various configuration options for different environments:
+The `RpcClient` supports various configuration options for different environments, **inclusa la gestione di certificati self-signed**:
 
 ```javascript
+const fs = require('fs');
 const { RpcClient } = require('rpc-express-toolkit');
 
 // Basic client
 const client = new RpcClient('https://api.example.com/rpc');
 
-// Client with custom headers
+// Client con header personalizzati
 const clientWithHeaders = new RpcClient('https://api.example.com/rpc', {
     'Authorization': 'Bearer your-token',
     'X-API-Key': 'your-api-key',
     'User-Agent': 'MyApp/1.0'
 });
 
-// Client for development with self-signed certificates
+// Client per sviluppo con certificato self-signed (accetta qualsiasi certificato, NON usare in produzione)
 const devClient = new RpcClient('https://localhost:3000/api', {
     'Authorization': 'Bearer dev-token'
 }, {
-    rejectUnauthorized: false // Only for development!
+    rejectUnauthorized: false // Solo per sviluppo!
+});
+
+// Client per sviluppo con CA self-signed (modo sicuro: accetta solo la tua CA)
+const ca = fs.readFileSync('path/to/your/selfsigned-ca.pem');
+const devClientWithCA = new RpcClient('https://localhost:3000/api', {
+    'Authorization': 'Bearer dev-token'
+}, {
+    ca // Passa il certificato della tua CA self-signed
+    // oppure: agent: new require('https').Agent({ ca, rejectUnauthorized: true })
 });
 ```
 
-**⚠️ Security Warning**: Only use `rejectUnauthorized: false` in development environments with self-signed certificates. Never use this in production as it disables SSL certificate validation and makes your application vulnerable to man-in-the-middle attacks.
+**⚠️ Security Warning**: Usa `rejectUnauthorized: false` solo in sviluppo. Per maggiore sicurezza, preferisci sempre la soluzione con `ca` per accettare solo la tua CA self-signed. In produzione usa sempre certificati validi e firmati da una CA attendibile.
 
 ### Built-in Middlewares
 

package/examples/ssl-development-example.js

@@ -18,33 +18,41 @@ async function demonstrateSSLOptions() {
   });
   console.log('   ✓ Created client with strict SSL validation (default)\n');
 
-  // Example 2: Development client for self-signed certificates
+
+  // Example 2: Development client for self-signed certificates (bypasses ALL SSL validation)
   console.log('2. Development Client (bypasses SSL validation):');
   const developmentClient = new RpcClient('https://localhost:3000/api', {
     'Authorization': 'Bearer dev-token',
     'X-Environment': 'development'
   }, {
-    rejectUnauthorized: false // Only for development!
+    rejectUnauthorized: false // Solo per sviluppo!
   });
   console.log('   ✓ Created client that bypasses SSL certificate validation');
   console.log('   ⚠️  WARNING: Only use this for development with self-signed certificates!\n');
 
-  // Example 3: Demonstrate how to choose configuration based on environment
-  console.log('3. Environment-based Configuration:');
-  
+  // Example 3: Development client with custom CA (accepts only your self-signed CA)
+  console.log('3. Development Client with custom CA:');
+  const fs = require('fs');
+  const ca = fs.readFileSync('path/to/your/selfsigned-ca.pem');
+  const devClientWithCA = new RpcClient('https://localhost:3000/api', {
+    'Authorization': 'Bearer dev-token',
+    'X-Environment': 'development'
+  }, {
+    ca // Passa il certificato della tua CA self-signed
+  });
+  console.log('   ✓ Created client that accepts only your self-signed CA');
+  console.log('   ⚠️  WARNING: This is safer than disabling validation, but use valid certificates in production!\n');
+
+  // Example 4: Demonstrate how to choose configuration based on environment
+  console.log('4. Environment-based Configuration:');
   const isDevelopment = process.env.NODE_ENV === 'development';
   const baseUrl = isDevelopment ? 'https://localhost:3000/api' : 'https://api.production.com/rpc';
-  
   const environmentClient = new RpcClient(baseUrl, {
     'Authorization': `Bearer ${process.env.API_TOKEN || 'default-token'}`,
     'X-Environment': process.env.NODE_ENV || 'development'
-  }, {
-    // Only bypass SSL validation in development
-    ...(isDevelopment && { rejectUnauthorized: false })
-  });
-
+  }, isDevelopment ? { ca } : {});
   console.log(`   ✓ Created client for ${isDevelopment ? 'development' : 'production'} environment`);
-  console.log(`   ✓ SSL validation: ${isDevelopment ? 'disabled (dev only)' : 'enabled (secure)'}\n`);
+  console.log(`   ✓ SSL validation: ${isDevelopment ? 'custom CA (dev only)' : 'enabled (secure)'}\n`);
 
   // Example usage (commented out since we don't have a real server)
   /*

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rpc-express-toolkit",
-  "version": "2.1.0",
+  "version": "2.2.0",
   "description": "Enterprise-ready JSON-RPC 2.0 toolkit for Express.js with simplified APIs, structured logging, middleware system, schema validation, and comprehensive BigInt/Date support.",
   "main": "src/index.js",
   "types": "src/index.d.ts",

package/src/clients/rpc-client.js

@@ -52,19 +52,27 @@ class RpcClient {
     
     // Store fetch options for Node.js environments
     this.#fetchOptions = {};
-    
-    // Handle SSL certificate validation option for Node.js
-    if (typeof process !== 'undefined' && process.env && options.rejectUnauthorized === false) {
-      // Set up agent for Node.js fetch implementations
-      if (typeof require !== 'undefined') {
-        try {
-          const https = require('https');
+    // Support for custom https.Agent (e.g. for self-signed CA)
+    if (typeof process !== 'undefined' && process.env && typeof require !== 'undefined') {
+      try {
+        const https = require('https');
+        // If options.agent is provided, use it directly
+        if (options.agent) {
+          this.#fetchOptions.agent = options.agent;
+        } else if (options.ca) {
+          // If options.ca is provided, create an agent with the custom CA
+          this.#fetchOptions.agent = new https.Agent({
+            ca: options.ca,
+            rejectUnauthorized: options.rejectUnauthorized !== false // true by default
+          });
+        } else if (options.rejectUnauthorized === false) {
+          // Legacy: allow disabling SSL validation for dev
           this.#fetchOptions.agent = new https.Agent({
             rejectUnauthorized: false
           });
-        } catch (e) {
-          // Ignore if https module is not available
         }
+      } catch (e) {
+        // Ignore if https module is not available
       }
     }
   }

package/src/clients/rpc-client.min.js

@@ -1 +1 @@
-let fetchFn;if("undefined"==typeof BigInt||BigInt.prototype.toJSON||(BigInt.prototype.toJSON=function(){return this.toString()}),"undefined"!=typeof fetch)fetchFn=fetch;else try{fetchFn=require("node-fetch")}catch(t){if("undefined"==typeof globalThis||!globalThis.fetch)throw new Error("fetch is not available. Please install node-fetch or use Node.js 18+");fetchFn=globalThis.fetch}class RpcClient{#t;#e;#r;#i;constructor(t,e={},r={}){if(this.#t=t,this.#e={"Content-Type":"application/json",...e},this.#r=1e3*Date.now()+Math.floor(1e3*Math.random()),this.#i={},"undefined"!=typeof process&&process.env&&!1===r.rejectUnauthorized&&"undefined"!=typeof require)try{const t=require("https");this.#i.agent=new t.Agent({rejectUnauthorized:!1})}catch(t){}}#n(){return++this.#r}async call(t,e={},r=void 0,i={}){const n={jsonrpc:"2.0",method:t,params:e,id:void 0===r?this.#n():r};try{const t=await fetchFn(this.#t,{method:"POST",headers:{...this.#e,...i},body:JSON.stringify(n),...this.#i});if(!t.ok)throw new Error(`HTTP Error: ${t.status} ${t.statusText}`);const e=await t.json();if(e.error)throw e.error;return this.deserializeBigIntsAndDates(e.result)}catch(t){throw console.error("RPC call failed:",t),t}}async notify(t,e={},r={}){await this.call(t,e,null,r)}async batch(t,e={}){const r=t.map(t=>({jsonrpc:"2.0",method:t.method,params:t.params||{},id:void 0!==t.id?t.id:this.#n()}));try{const t=await fetchFn(this.#t,{method:"POST",headers:{...this.#e,...e},body:JSON.stringify(r),...this.#i});if(!t.ok)throw new Error(`HTTP Error: ${t.status} ${t.statusText}`);const i=await t.json();if(Array.isArray(i))return i.map(t=>{if(t.error)throw t.error;return this.deserializeBigIntsAndDates(t.result)});if(i.error)throw i.error;return[this.deserializeBigIntsAndDates(i.result)]}catch(t){throw console.error("Batch RPC call failed:",t),t}}serializeBigIntsAndDates(t){if("bigint"==typeof t)return t.toString();if(Array.isArray(t))return t.map(t=>this.serializeBigIntsAndDates(t));if(t instanceof Date)return t.toISOString();if(t&&"object"==typeof t){const e={};for(const[r,i]of Object.entries(t))e[r]=this.serializeBigIntsAndDates(i);return e}return t}deserializeBigIntsAndDates(t){const e=/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})?$/;if("string"==typeof t){if(/^-?\d+n?$/.test(t))return BigInt(t.replace(/n$/,""));if(e.test(t)){const e=new Date(t);if(!isNaN(e.getTime()))return e}}return Array.isArray(t)?t.map(t=>this.deserializeBigIntsAndDates(t)):t&&"object"==typeof t?Object.fromEntries(Object.entries(t).map(([t,e])=>[t,this.deserializeBigIntsAndDates(e)])):t}}module.exports=RpcClient,module.exports.RpcClient=RpcClient;
+let fetchFn;if("undefined"==typeof BigInt||BigInt.prototype.toJSON||(BigInt.prototype.toJSON=function(){return this.toString()}),"undefined"!=typeof fetch)fetchFn=fetch;else try{fetchFn=require("node-fetch")}catch(t){if("undefined"==typeof globalThis||!globalThis.fetch)throw new Error("fetch is not available. Please install node-fetch or use Node.js 18+");fetchFn=globalThis.fetch}class RpcClient{#t;#e;#r;#i;constructor(t,e={},r={}){if(this.#t=t,this.#e={"Content-Type":"application/json",...e},this.#r=1e3*Date.now()+Math.floor(1e3*Math.random()),this.#i={},"undefined"!=typeof process&&process.env&&"undefined"!=typeof require)try{const t=require("https");r.agent?this.#i.agent=r.agent:r.ca?this.#i.agent=new t.Agent({ca:r.ca,rejectUnauthorized:!1!==r.rejectUnauthorized}):!1===r.rejectUnauthorized&&(this.#i.agent=new t.Agent({rejectUnauthorized:!1}))}catch(t){}}#n(){return++this.#r}async call(t,e={},r=void 0,i={}){const n={jsonrpc:"2.0",method:t,params:e,id:void 0===r?this.#n():r};try{const t=await fetchFn(this.#t,{method:"POST",headers:{...this.#e,...i},body:JSON.stringify(n),...this.#i});if(!t.ok)throw new Error(`HTTP Error: ${t.status} ${t.statusText}`);const e=await t.json();if(e.error)throw e.error;return this.deserializeBigIntsAndDates(e.result)}catch(t){throw console.error("RPC call failed:",t),t}}async notify(t,e={},r={}){await this.call(t,e,null,r)}async batch(t,e={}){const r=t.map(t=>({jsonrpc:"2.0",method:t.method,params:t.params||{},id:void 0!==t.id?t.id:this.#n()}));try{const t=await fetchFn(this.#t,{method:"POST",headers:{...this.#e,...e},body:JSON.stringify(r),...this.#i});if(!t.ok)throw new Error(`HTTP Error: ${t.status} ${t.statusText}`);const i=await t.json();if(Array.isArray(i))return i.map(t=>{if(t.error)throw t.error;return this.deserializeBigIntsAndDates(t.result)});if(i.error)throw i.error;return[this.deserializeBigIntsAndDates(i.result)]}catch(t){throw console.error("Batch RPC call failed:",t),t}}serializeBigIntsAndDates(t){if("bigint"==typeof t)return t.toString();if(Array.isArray(t))return t.map(t=>this.serializeBigIntsAndDates(t));if(t instanceof Date)return t.toISOString();if(t&&"object"==typeof t){const e={};for(const[r,i]of Object.entries(t))e[r]=this.serializeBigIntsAndDates(i);return e}return t}deserializeBigIntsAndDates(t){const e=/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})?$/;if("string"==typeof t){if(/^-?\d+n?$/.test(t))return BigInt(t.replace(/n$/,""));if(e.test(t)){const e=new Date(t);if(!isNaN(e.getTime()))return e}}return Array.isArray(t)?t.map(t=>this.deserializeBigIntsAndDates(t)):t&&"object"==typeof t?Object.fromEntries(Object.entries(t).map(([t,e])=>[t,this.deserializeBigIntsAndDates(e)])):t}}module.exports=RpcClient,module.exports.RpcClient=RpcClient;

package/src/index.d.ts

@@ -92,8 +92,18 @@ declare class RpcClient {
    * @param defaultHeaders - Default headers to include in requests
    * @param options - Configuration options
    * @param options.rejectUnauthorized - Whether to reject unauthorized SSL certificates (default: true). Set to false for development with self-signed certificates.
+   * @param options.ca - Buffer or string of a custom CA certificate to trust (for self-signed CA)
+   * @param options.agent - Custom https.Agent instance (advanced usage)
    */
-  constructor(endpoint: string, defaultHeaders?: Record<string, string>, options?: { rejectUnauthorized?: boolean });
+  constructor(
+    endpoint: string,
+    defaultHeaders?: Record<string, string>,
+    options?: {
+      rejectUnauthorized?: boolean;
+      ca?: string | Buffer;
+      agent?: any;
+    }
+  );
 
   /**
    * Make a JSON-RPC call to the server.