rpc-express-toolkit 2.1.0 → 2.3.0

package/README.md

@@ -91,6 +91,7 @@ app.listen(3000, () => {
 });
 ```
 
+
 ### Client Usage
 
 ```javascript
@@ -108,6 +109,21 @@ const client = new RpcClient('/api');
 const user = await client.call('getUser', { userId: 123 });
 ```
 
+#### SSL e certificati self-signed in sviluppo (Node.js)
+
+Per bypassare la validazione dei certificati SSL (ad esempio con certificati self-signed in sviluppo), imposta **prima** di avviare il client:
+
+```js
+process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
+```
+
+**Attenzione:**
+- Questa impostazione disabilita la validazione SSL per tutte le richieste nel processo Node.js.
+- Usala solo in ambienti di sviluppo!
+- Non committare mai questa impostazione in produzione.
+
+Le opzioni avanzate `agent` e `ca` sono state rimosse per semplicità e compatibilità con Node.js moderno.
+
 ## Advanced Usage
 
 ### Configuration Options
@@ -516,30 +532,40 @@ logger.error('Database error', {
 
 ### Client Configuration
 
-The `RpcClient` supports various configuration options for different environments:
+The `RpcClient` supports various configuration options for different environments, **inclusa la gestione di certificati self-signed**:
 
 ```javascript
+const fs = require('fs');
 const { RpcClient } = require('rpc-express-toolkit');
 
 // Basic client
 const client = new RpcClient('https://api.example.com/rpc');
 
-// Client with custom headers
+// Client con header personalizzati
 const clientWithHeaders = new RpcClient('https://api.example.com/rpc', {
     'Authorization': 'Bearer your-token',
     'X-API-Key': 'your-api-key',
     'User-Agent': 'MyApp/1.0'
 });
 
-// Client for development with self-signed certificates
+// Client per sviluppo con certificato self-signed (accetta qualsiasi certificato, NON usare in produzione)
 const devClient = new RpcClient('https://localhost:3000/api', {
     'Authorization': 'Bearer dev-token'
 }, {
-    rejectUnauthorized: false // Only for development!
+    rejectUnauthorized: false // Solo per sviluppo!
+});
+
+// Client per sviluppo con CA self-signed (modo sicuro: accetta solo la tua CA)
+const ca = fs.readFileSync('path/to/your/selfsigned-ca.pem');
+const devClientWithCA = new RpcClient('https://localhost:3000/api', {
+    'Authorization': 'Bearer dev-token'
+}, {
+    ca // Passa il certificato della tua CA self-signed
+    // oppure: agent: new require('https').Agent({ ca, rejectUnauthorized: true })
 });
 ```
 
-**⚠️ Security Warning**: Only use `rejectUnauthorized: false` in development environments with self-signed certificates. Never use this in production as it disables SSL certificate validation and makes your application vulnerable to man-in-the-middle attacks.
+**⚠️ Security Warning**: Usa `rejectUnauthorized: false` solo in sviluppo. Per maggiore sicurezza, preferisci sempre la soluzione con `ca` per accettare solo la tua CA self-signed. In produzione usa sempre certificati validi e firmati da una CA attendibile.
 
 ### Built-in Middlewares
 

package/examples/ssl-development-example.js

@@ -18,33 +18,32 @@ async function demonstrateSSLOptions() {
   });
   console.log('   ✓ Created client with strict SSL validation (default)\n');
 
-  // Example 2: Development client for self-signed certificates
+
+
+  // Example 2: Development client per self-signed certificates (bypassa TUTTA la validazione SSL)
   console.log('2. Development Client (bypasses SSL validation):');
-  const developmentClient = new RpcClient('https://localhost:3000/api', {
-    'Authorization': 'Bearer dev-token',
-    'X-Environment': 'development'
-  }, {
-    rejectUnauthorized: false // Only for development!
-  });
-  console.log('   ✓ Created client that bypasses SSL certificate validation');
-  console.log('   ⚠️  WARNING: Only use this for development with self-signed certificates!\n');
+  console.log('   ⚠️  Per bypassare la validazione SSL in Node.js, imposta PRIMA di avviare il client:');
+  console.log('   process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";');
+  console.log('   ✓ Tutte le richieste accetteranno certificati self-signed (solo per sviluppo!)\n');
 
-  // Example 3: Demonstrate how to choose configuration based on environment
-  console.log('3. Environment-based Configuration:');
-  
+  // Example 3: Best practice
+  console.log('3. Best Practices:');
+  console.log('   ✓ Usa sempre la validazione SSL in produzione');
+  console.log('   ✓ Disabilita la validazione solo per sviluppo con self-signed');
+  console.log('   ✓ Usa variabili d’ambiente per controllare il comportamento SSL');
+  console.log('   ✓ Non committare mai process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0" in produzione');
+  console.log('   ✓ Considera l’uso di certificati di sviluppo validi invece di disabilitare la validazione\n');
+
+  // Example 4: Demonstrate how to choose configuration based on environment
+  console.log('4. Environment-based Configuration:');
   const isDevelopment = process.env.NODE_ENV === 'development';
   const baseUrl = isDevelopment ? 'https://localhost:3000/api' : 'https://api.production.com/rpc';
-  
   const environmentClient = new RpcClient(baseUrl, {
     'Authorization': `Bearer ${process.env.API_TOKEN || 'default-token'}`,
     'X-Environment': process.env.NODE_ENV || 'development'
-  }, {
-    // Only bypass SSL validation in development
-    ...(isDevelopment && { rejectUnauthorized: false })
-  });
-
+  }, isDevelopment ? { ca } : {});
   console.log(`   ✓ Created client for ${isDevelopment ? 'development' : 'production'} environment`);
-  console.log(`   ✓ SSL validation: ${isDevelopment ? 'disabled (dev only)' : 'enabled (secure)'}\n`);
+  console.log(`   ✓ SSL validation: ${isDevelopment ? 'custom CA (dev only)' : 'enabled (secure)'}\n`);
 
   // Example usage (commented out since we don't have a real server)
   /*

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "rpc-express-toolkit",
-  "version": "2.1.0",
-  "description": "Enterprise-ready JSON-RPC 2.0 toolkit for Express.js with simplified APIs, structured logging, middleware system, schema validation, and comprehensive BigInt/Date support.",
+  "version": "2.3.0",
+  "description": "Enterprise-ready JSON-RPC 2.0 toolkit for Express.js with simplified APIs, structured logging, middleware system, schema validation, comprehensive BigInt/Date support. Semplificato: gestione SSL avanzata rimossa, vedi README.",
   "main": "src/index.js",
   "types": "src/index.d.ts",
   "files": [
@@ -39,7 +39,11 @@
     "validation",
     "bigint",
     "enterprise",
-    "nodejs"
+    "nodejs",
+    "ssl",
+    "self-signed",
+    "secure",
+    "fetch"
   ],
   "author": "Nicola Carpanese <nicola.carpanese@gmail.com>",
   "license": "MIT",

package/src/clients/rpc-client.js

@@ -52,21 +52,10 @@ class RpcClient {
     
     // Store fetch options for Node.js environments
     this.#fetchOptions = {};
-    
-    // Handle SSL certificate validation option for Node.js
-    if (typeof process !== 'undefined' && process.env && options.rejectUnauthorized === false) {
-      // Set up agent for Node.js fetch implementations
-      if (typeof require !== 'undefined') {
-        try {
-          const https = require('https');
-          this.#fetchOptions.agent = new https.Agent({
-            rejectUnauthorized: false
-          });
-        } catch (e) {
-          // Ignore if https module is not available
-        }
-      }
-    }
+    // SSL validation: la gestione avanzata (agent/ca) è rimossa per semplicità e compatibilità.
+    // Per bypassare i certificati self-signed in sviluppo, imposta:
+    //   process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
+    // Vedi README per dettagli e best practice.
   }
 
   /**

package/src/clients/rpc-client.min.js

@@ -1 +1 @@
-let fetchFn;if("undefined"==typeof BigInt||BigInt.prototype.toJSON||(BigInt.prototype.toJSON=function(){return this.toString()}),"undefined"!=typeof fetch)fetchFn=fetch;else try{fetchFn=require("node-fetch")}catch(t){if("undefined"==typeof globalThis||!globalThis.fetch)throw new Error("fetch is not available. Please install node-fetch or use Node.js 18+");fetchFn=globalThis.fetch}class RpcClient{#t;#e;#r;#i;constructor(t,e={},r={}){if(this.#t=t,this.#e={"Content-Type":"application/json",...e},this.#r=1e3*Date.now()+Math.floor(1e3*Math.random()),this.#i={},"undefined"!=typeof process&&process.env&&!1===r.rejectUnauthorized&&"undefined"!=typeof require)try{const t=require("https");this.#i.agent=new t.Agent({rejectUnauthorized:!1})}catch(t){}}#n(){return++this.#r}async call(t,e={},r=void 0,i={}){const n={jsonrpc:"2.0",method:t,params:e,id:void 0===r?this.#n():r};try{const t=await fetchFn(this.#t,{method:"POST",headers:{...this.#e,...i},body:JSON.stringify(n),...this.#i});if(!t.ok)throw new Error(`HTTP Error: ${t.status} ${t.statusText}`);const e=await t.json();if(e.error)throw e.error;return this.deserializeBigIntsAndDates(e.result)}catch(t){throw console.error("RPC call failed:",t),t}}async notify(t,e={},r={}){await this.call(t,e,null,r)}async batch(t,e={}){const r=t.map(t=>({jsonrpc:"2.0",method:t.method,params:t.params||{},id:void 0!==t.id?t.id:this.#n()}));try{const t=await fetchFn(this.#t,{method:"POST",headers:{...this.#e,...e},body:JSON.stringify(r),...this.#i});if(!t.ok)throw new Error(`HTTP Error: ${t.status} ${t.statusText}`);const i=await t.json();if(Array.isArray(i))return i.map(t=>{if(t.error)throw t.error;return this.deserializeBigIntsAndDates(t.result)});if(i.error)throw i.error;return[this.deserializeBigIntsAndDates(i.result)]}catch(t){throw console.error("Batch RPC call failed:",t),t}}serializeBigIntsAndDates(t){if("bigint"==typeof t)return t.toString();if(Array.isArray(t))return t.map(t=>this.serializeBigIntsAndDates(t));if(t instanceof Date)return t.toISOString();if(t&&"object"==typeof t){const e={};for(const[r,i]of Object.entries(t))e[r]=this.serializeBigIntsAndDates(i);return e}return t}deserializeBigIntsAndDates(t){const e=/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})?$/;if("string"==typeof t){if(/^-?\d+n?$/.test(t))return BigInt(t.replace(/n$/,""));if(e.test(t)){const e=new Date(t);if(!isNaN(e.getTime()))return e}}return Array.isArray(t)?t.map(t=>this.deserializeBigIntsAndDates(t)):t&&"object"==typeof t?Object.fromEntries(Object.entries(t).map(([t,e])=>[t,this.deserializeBigIntsAndDates(e)])):t}}module.exports=RpcClient,module.exports.RpcClient=RpcClient;
+let fetchFn;if("undefined"==typeof BigInt||BigInt.prototype.toJSON||(BigInt.prototype.toJSON=function(){return this.toString()}),"undefined"!=typeof fetch)fetchFn=fetch;else try{fetchFn=require("node-fetch")}catch(t){if("undefined"==typeof globalThis||!globalThis.fetch)throw new Error("fetch is not available. Please install node-fetch or use Node.js 18+");fetchFn=globalThis.fetch}class RpcClient{#t;#e;#r;#i;constructor(t,e={},r={}){this.#t=t,this.#e={"Content-Type":"application/json",...e},this.#r=1e3*Date.now()+Math.floor(1e3*Math.random()),this.#i={}}#s(){return++this.#r}async call(t,e={},r=void 0,i={}){const s={jsonrpc:"2.0",method:t,params:e,id:void 0===r?this.#s():r};try{const t=await fetchFn(this.#t,{method:"POST",headers:{...this.#e,...i},body:JSON.stringify(s),...this.#i});if(!t.ok)throw new Error(`HTTP Error: ${t.status} ${t.statusText}`);const e=await t.json();if(e.error)throw e.error;return this.deserializeBigIntsAndDates(e.result)}catch(t){throw console.error("RPC call failed:",t),t}}async notify(t,e={},r={}){await this.call(t,e,null,r)}async batch(t,e={}){const r=t.map(t=>({jsonrpc:"2.0",method:t.method,params:t.params||{},id:void 0!==t.id?t.id:this.#s()}));try{const t=await fetchFn(this.#t,{method:"POST",headers:{...this.#e,...e},body:JSON.stringify(r),...this.#i});if(!t.ok)throw new Error(`HTTP Error: ${t.status} ${t.statusText}`);const i=await t.json();if(Array.isArray(i))return i.map(t=>{if(t.error)throw t.error;return this.deserializeBigIntsAndDates(t.result)});if(i.error)throw i.error;return[this.deserializeBigIntsAndDates(i.result)]}catch(t){throw console.error("Batch RPC call failed:",t),t}}serializeBigIntsAndDates(t){if("bigint"==typeof t)return t.toString();if(Array.isArray(t))return t.map(t=>this.serializeBigIntsAndDates(t));if(t instanceof Date)return t.toISOString();if(t&&"object"==typeof t){const e={};for(const[r,i]of Object.entries(t))e[r]=this.serializeBigIntsAndDates(i);return e}return t}deserializeBigIntsAndDates(t){const e=/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})?$/;if("string"==typeof t){if(/^-?\d+n?$/.test(t))return BigInt(t.replace(/n$/,""));if(e.test(t)){const e=new Date(t);if(!isNaN(e.getTime()))return e}}return Array.isArray(t)?t.map(t=>this.deserializeBigIntsAndDates(t)):t&&"object"==typeof t?Object.fromEntries(Object.entries(t).map(([t,e])=>[t,this.deserializeBigIntsAndDates(e)])):t}}module.exports=RpcClient,module.exports.RpcClient=RpcClient;

package/src/clients/rpc-client.min.mjs

@@ -1 +1 @@
-let t;if("undefined"==typeof BigInt||BigInt.prototype.toJSON||(BigInt.prototype.toJSON=function(){return this.toString()}),"undefined"!=typeof fetch)t=fetch;else try{const{default:e}=await import("node-fetch");t=e}catch(e){if("undefined"==typeof globalThis||!globalThis.fetch)throw new Error("fetch is not available. Please install node-fetch or use Node.js 18+");t=globalThis.fetch}export class RpcClient{#t;#e;#r;#i;constructor(t,e={},r={}){if(this.#t=t,this.#e={"Content-Type":"application/json",...e},this.#r=1e3*Date.now()+Math.floor(1e3*Math.random()),this.#i={},"undefined"!=typeof process&&process.env&&!1===r.rejectUnauthorized&&"undefined"!=typeof require)try{const t=require("https");this.#i.agent=new t.Agent({rejectUnauthorized:!1})}catch(t){import("https").then(t=>{this.#i.agent=new t.Agent({rejectUnauthorized:!1})}).catch(()=>{})}}async call(e,r={},i=null,s={}){null===i&&(i=++this.#r);const n={jsonrpc:"2.0",method:e,params:r,id:i};try{const e=await t(this.#t,{method:"POST",headers:{...this.#e,...s},body:JSON.stringify(n),...this.#i});if(!e.ok)throw new Error(`HTTP Error: ${e.status} ${e.statusText}`);const r=await e.json();if(r.error)throw r.error;return this.deserializeBigIntsAndDates(r.result)}catch(t){throw console.error("RPC call failed:",t),t}}async notify(e,r={},i={}){const s={jsonrpc:"2.0",method:e,params:r};try{const e=await t(this.#t,{method:"POST",headers:{...this.#e,...i},body:JSON.stringify(s),...this.#i});if(!e.ok)throw new Error(`HTTP Error: ${e.status} ${e.statusText}`)}catch(t){throw console.error("RPC notification failed:",t),t}}async batch(e,r={}){const i=e.map(t=>{const e={jsonrpc:"2.0",method:t.method,params:t.params||{}};return t.notification||(e.id=void 0!==t.id?t.id:++this.#r),e});try{const e=await t(this.#t,{method:"POST",headers:{...this.#e,...r},body:JSON.stringify(i),...this.#i});if(!e.ok)throw new Error(`HTTP Error: ${e.status} ${e.statusText}`);const s=await e.json();if(Array.isArray(s))return s.map(t=>{if(t.error)throw t.error;return this.deserializeBigIntsAndDates(t.result)});if(s.error)throw s.error;return[this.deserializeBigIntsAndDates(s.result)]}catch(t){throw console.error("RPC batch call failed:",t),t}}serializeBigIntsAndDates(t){if("bigint"==typeof t)return t.toString();if(Array.isArray(t))return t.map(t=>this.serializeBigIntsAndDates(t));if(t instanceof Date)return t.toISOString();if(t&&"object"==typeof t){const e={};for(const[r,i]of Object.entries(t))e[r]=this.serializeBigIntsAndDates(i);return e}return t}deserializeBigIntsAndDates(t){const e=/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})?$/;if("string"==typeof t){if(/^-?\d+n?$/.test(t))return BigInt(t.replace(/n$/,""));if(e.test(t)){const e=new Date(t);if(!isNaN(e.getTime()))return e}}return Array.isArray(t)?t.map(t=>this.deserializeBigIntsAndDates(t)):t&&"object"==typeof t?Object.fromEntries(Object.entries(t).map(([t,e])=>[t,this.deserializeBigIntsAndDates(e)])):t}}
+let t;if("undefined"==typeof BigInt||BigInt.prototype.toJSON||(BigInt.prototype.toJSON=function(){return this.toString()}),"undefined"!=typeof fetch)t=fetch;else try{const{default:e}=await import("node-fetch");t=e}catch(e){if("undefined"==typeof globalThis||!globalThis.fetch)throw new Error("fetch is not available. Please install node-fetch or use Node.js 18+");t=globalThis.fetch}export class RpcClient{#t;#e;#r;#s;constructor(t,e={},r={}){this.#t=t,this.#e={"Content-Type":"application/json",...e},this.#r=1e3*Date.now()+Math.floor(1e3*Math.random()),this.#s={}}async call(e,r={},s=null,i={}){null===s&&(s=++this.#r);const n={jsonrpc:"2.0",method:e,params:r,id:s};try{const e=await t(this.#t,{method:"POST",headers:{...this.#e,...i},body:JSON.stringify(n),...this.#s});if(!e.ok)throw new Error(`HTTP Error: ${e.status} ${e.statusText}`);const r=await e.json();if(r.error)throw r.error;return this.deserializeBigIntsAndDates(r.result)}catch(t){throw console.error("RPC call failed:",t),t}}async notify(e,r={},s={}){const i={jsonrpc:"2.0",method:e,params:r};try{const e=await t(this.#t,{method:"POST",headers:{...this.#e,...s},body:JSON.stringify(i),...this.#s});if(!e.ok)throw new Error(`HTTP Error: ${e.status} ${e.statusText}`)}catch(t){throw console.error("RPC notification failed:",t),t}}async batch(e,r={}){const s=e.map(t=>{const e={jsonrpc:"2.0",method:t.method,params:t.params||{}};return t.notification||(e.id=void 0!==t.id?t.id:++this.#r),e});try{const e=await t(this.#t,{method:"POST",headers:{...this.#e,...r},body:JSON.stringify(s),...this.#s});if(!e.ok)throw new Error(`HTTP Error: ${e.status} ${e.statusText}`);const i=await e.json();if(Array.isArray(i))return i.map(t=>{if(t.error)throw t.error;return this.deserializeBigIntsAndDates(t.result)});if(i.error)throw i.error;return[this.deserializeBigIntsAndDates(i.result)]}catch(t){throw console.error("RPC batch call failed:",t),t}}serializeBigIntsAndDates(t){if("bigint"==typeof t)return t.toString();if(Array.isArray(t))return t.map(t=>this.serializeBigIntsAndDates(t));if(t instanceof Date)return t.toISOString();if(t&&"object"==typeof t){const e={};for(const[r,s]of Object.entries(t))e[r]=this.serializeBigIntsAndDates(s);return e}return t}deserializeBigIntsAndDates(t){const e=/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})?$/;if("string"==typeof t){if(/^-?\d+n?$/.test(t))return BigInt(t.replace(/n$/,""));if(e.test(t)){const e=new Date(t);if(!isNaN(e.getTime()))return e}}return Array.isArray(t)?t.map(t=>this.deserializeBigIntsAndDates(t)):t&&"object"==typeof t?Object.fromEntries(Object.entries(t).map(([t,e])=>[t,this.deserializeBigIntsAndDates(e)])):t}}

package/src/clients/rpc-client.mjs

@@ -53,28 +53,10 @@ export class RpcClient {
     
     // Store fetch options for Node.js environments
     this.#fetchOptions = {};
-    
-    // Handle SSL certificate validation option for Node.js
-    if (typeof process !== 'undefined' && process.env && options.rejectUnauthorized === false) {
-      // Set up agent for Node.js fetch implementations
-      if (typeof require !== 'undefined') {
-        try {
-          const https = require('https');
-          this.#fetchOptions.agent = new https.Agent({
-            rejectUnauthorized: false
-          });
-        } catch (e) {
-          // For ES modules, we'll try dynamic import
-          import('https').then(httpsModule => {
-            this.#fetchOptions.agent = new httpsModule.Agent({
-              rejectUnauthorized: false
-            });
-          }).catch(() => {
-            // Ignore if https module is not available
-          });
-        }
-      }
-    }
+    // SSL validation: la gestione avanzata (agent/ca) è rimossa per semplicità e compatibilità.
+    // Per bypassare i certificati self-signed in sviluppo, imposta:
+    //   process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
+    // Vedi README per dettagli e best practice.
   }
 
   /**

package/src/index.d.ts

@@ -92,8 +92,16 @@ declare class RpcClient {
    * @param defaultHeaders - Default headers to include in requests
    * @param options - Configuration options
    * @param options.rejectUnauthorized - Whether to reject unauthorized SSL certificates (default: true). Set to false for development with self-signed certificates.
+   * @param options.ca - Buffer or string of a custom CA certificate to trust (for self-signed CA)
+   * @param options.agent - Custom https.Agent instance (advanced usage)
    */
-  constructor(endpoint: string, defaultHeaders?: Record<string, string>, options?: { rejectUnauthorized?: boolean });
+  constructor(
+    endpoint: string,
+    defaultHeaders?: Record<string, string>,
+    options?: {
+      // Opzioni SSL avanzate rimosse: usa process.env.NODE_TLS_REJECT_UNAUTHORIZED per sviluppo
+    }
+  );
 
   /**
    * Make a JSON-RPC call to the server.