unplugin-https-reverse-proxy 4.0.2 → 4.0.3

package/dist/vite.cjs

@@ -13455,7 +13455,7 @@ function validateTemplateContext(ctx) {
 }
 var caddyTemplate = `{
   debug
-  auto_https disable_redirects
+  auto_https disable_redirects ignore_loaded_certs
 }
 
 :7601 {
@@ -13722,6 +13722,97 @@ function useCaddyConfig() {
   };
 }
 
+// src/caddy/log.ts
+function isCaddyReloadCancellation(line) {
+  try {
+    const entry = JSON.parse(line);
+    return entry.logger === "tls" && typeof entry.error === "string" && entry.error.endsWith("context canceled");
+  } catch {
+    return false;
+  }
+}
+
+// src/caddy/tls-health.ts
+var import_node_tls = require("tls");
+function assessTlsCertificate(certificate, hostname, now = Date.now(), verifyHostname = import_node_tls.checkServerIdentity) {
+  if (!certificate.valid_to)
+    return { healthy: false, reason: "certificate_missing" };
+  const expiresAt = new Date(certificate.valid_to);
+  if (Number.isNaN(expiresAt.getTime()))
+    return { healthy: false, reason: "certificate_invalid" };
+  if (expiresAt.getTime() <= now)
+    return { healthy: false, reason: "certificate_expired", expiresAt };
+  try {
+    if (verifyHostname(hostname, certificate))
+      return { healthy: false, reason: "hostname_mismatch" };
+  } catch {
+    return { healthy: false, reason: "certificate_invalid" };
+  }
+  return { healthy: true, expiresAt };
+}
+function probeLocalTls(hostname, options = {}) {
+  const {
+    connect: openTlsConnection = import_node_tls.connect,
+    port = 443,
+    timeoutMs = 1e3
+  } = options;
+  return new Promise((resolve2) => {
+    let settled = false;
+    let timeout;
+    const socket = openTlsConnection({
+      host: "127.0.0.1",
+      port,
+      servername: hostname,
+      rejectUnauthorized: false
+    });
+    const finish = (result) => {
+      if (settled)
+        return;
+      settled = true;
+      if (timeout)
+        clearTimeout(timeout);
+      socket.destroy();
+      resolve2(result);
+    };
+    timeout = setTimeout(() => {
+      finish({ healthy: false, reason: "connection_failed" });
+    }, timeoutMs);
+    socket.once("secureConnect", () => {
+      finish(assessTlsCertificate(socket.getPeerCertificate(), hostname));
+    });
+    socket.once("error", () => {
+      finish({ healthy: false, reason: "connection_failed" });
+    });
+  });
+}
+function sleep(ms) {
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
+}
+async function waitForLocalTls(hostname, options = {}) {
+  const {
+    probe: checkTls = probeLocalTls,
+    retryIntervalMs = 250,
+    retryWindowMs = 3e4,
+    sleep: wait = sleep,
+    ...probeOptions
+  } = options;
+  const deadline = Date.now() + retryWindowMs;
+  let result = { healthy: false, reason: "connection_failed" };
+  do {
+    result = await checkTls(hostname, probeOptions);
+    if (result.healthy)
+      return result;
+    const remaining = deadline - Date.now();
+    if (remaining > 0)
+      await wait(Math.min(retryIntervalMs, remaining));
+  } while (Date.now() < deadline);
+  return result;
+}
+function formatTlsHealthFailure(hostname, result) {
+  const reason = result.reason === "certificate_expired" && result.expiresAt ? `the certificate expired at ${result.expiresAt.toISOString()}` : result.reason.replaceAll("_", " ");
+  return `[unplugin-https-reverse-proxy] Caddy cannot serve valid HTTPS for ${hostname}: ${reason}. Restart Caddy to retry its automatic certificate renewal. Do not remove Caddy PKI data automatically because that replaces the trusted local root certificate.`;
+}
+
 // src/caddy/utils.ts
 var import_node_child_process3 = require("child_process");
 var import_node_net = require("net");
@@ -13911,6 +14002,39 @@ var CaddyInstant = class {
     await download();
     this.inited = true;
   }
+  async ensureTlsReady(targetHost) {
+    const health = await waitForLocalTls(targetHost);
+    if (!health.healthy)
+      throw new Error(formatTlsHealthFailure(targetHost, health));
+  }
+  async updateCaddyfile() {
+    const { configJsonRef } = getCaddyConfig();
+    const proxies = Object.values(configJsonRef() || {});
+    const ctx = validateTemplateContext({
+      caddy_root: this.caddyRoot,
+      proxies
+    });
+    this.caddyfile = await genCaddyfile(ctx);
+    await this.writeCaddyfile();
+  }
+  async stopCaddy() {
+    var _a4;
+    try {
+      await import_got_cjs.got.post("http://127.0.0.1:2019/stop", {
+        headers: {
+          Origin: "http://localhost:2019"
+        },
+        retry: {
+          limit: 0
+        },
+        timeout: {
+          request: 2e3
+        }
+      });
+    } catch {
+    }
+    (_a4 = this._caddyChild) == null ? void 0 : _a4.kill();
+  }
   /**
    * @param source like `127.0.0.1:8080`
    * @param target like `test.abc.com`. And if you provide a port ,it will be ignore.
@@ -13955,16 +14079,16 @@ var CaddyInstant = class {
     ];
     const { writeCaddyConfig } = getCaddyConfig();
     writeCaddyConfig(proxies);
+    await this.updateCaddyfile();
+    let skipInitialCaddyfileEffect = true;
     this._stopEffects.push(
-      effect(async () => {
-        const { configJsonRef } = getCaddyConfig();
-        const proxies2 = Object.values(configJsonRef() || {});
-        const ctx = validateTemplateContext({
-          caddy_root: this.caddyRoot,
-          proxies: proxies2
-        });
-        this.caddyfile = await genCaddyfile(ctx);
-        await this.writeCaddyfile();
+      effect(() => {
+        getCaddyConfig().configJsonRef();
+        if (skipInitialCaddyfileEffect) {
+          skipInitialCaddyfileEffect = false;
+          return;
+        }
+        void this.updateCaddyfile();
       })
     );
     if (!(0, import_node_fs3.existsSync)(caddyLockFilePath))
@@ -13977,6 +14101,21 @@ var CaddyInstant = class {
     }
     return new Promise((resolve2, reject2) => {
       var _a4, _b3;
+      let startupCheckStarted = false;
+      const resolveWhenReady = async () => {
+        if (startupCheckStarted)
+          return;
+        startupCheckStarted = true;
+        try {
+          if (https)
+            await this.ensureTlsReady(targetHost);
+          resolve2();
+        } catch (error) {
+          if (!this.locked)
+            await this.baseCleanup(restore);
+          reject2(error);
+        }
+      };
       const setupCleanup = () => {
         import_node_process4.default.on("SIGINT", async () => {
           if (this.stoped)
@@ -14036,6 +14175,10 @@ var CaddyInstant = class {
           const lines = data.toString().split("\n").map((line) => line.trim());
           for (const line of lines) {
             showCaddyLog && line && console.info(line);
+            if (isCaddyReloadCancellation(line)) {
+              consola.info("Caddy restarted before TLS issuance completed; retrying.\n");
+              continue;
+            }
             try {
               if (line.includes("Error:") || line && JSON.parse(line).level === "error") {
                 if (line.includes("parsing caddyfile tokens")) {
@@ -14056,23 +14199,30 @@ ${line}
             if (line.includes("config file changed"))
               consola.success("Detect added a new reverse proxy config, restarted.\n");
             if (line.includes("caddy proxying") || line.includes("serving initial"))
-              return resolve2();
+              void resolveWhenReady();
           }
         });
         (_b3 = this._caddyChild.stdout) == null ? void 0 : _b3.on("data", (_data) => {
           consola.info(_data.toString());
-          resolve2();
+          void resolveWhenReady();
         });
         setupCleanup();
       } else {
         consola.info("Caddy is running in another process.");
-        setupCleanup();
-        return resolve2();
+        void (async () => {
+          try {
+            if (https)
+              await this.ensureTlsReady(targetHost);
+            setupCleanup();
+            resolve2();
+          } catch (error) {
+            reject2(error);
+          }
+        })();
       }
     });
   }
   async baseCleanup(restore = true) {
-    var _a4;
     this._stopEffects.forEach((fn) => fn());
     try {
       if (restore && this._source && this._target) {
@@ -14086,7 +14236,7 @@ ${line}
       consola.fail("Restore host failed.\n");
     }
     if (!this.locked && !this.stoped) {
-      (_a4 = this._caddyChild) == null ? void 0 : _a4.kill();
+      await this.stopCaddy();
       try {
         await lockfile.unlock(caddyLockFilePath).catch(() => {
         });

package/dist/vite.js

@@ -1,6 +1,6 @@
 import {
   unpluginFactory
-} from "./chunk-JA3D5AWS.js";
+} from "./chunk-MD5CVZP7.js";
 import "./chunk-RSBXFJ3Z.js";
 import "./chunk-2P7SUCQ3.js";
 

package/dist/webpack.cjs

@@ -13455,7 +13455,7 @@ function validateTemplateContext(ctx) {
 }
 var caddyTemplate = `{
   debug
-  auto_https disable_redirects
+  auto_https disable_redirects ignore_loaded_certs
 }
 
 :7601 {
@@ -13722,6 +13722,97 @@ function useCaddyConfig() {
   };
 }
 
+// src/caddy/log.ts
+function isCaddyReloadCancellation(line) {
+  try {
+    const entry = JSON.parse(line);
+    return entry.logger === "tls" && typeof entry.error === "string" && entry.error.endsWith("context canceled");
+  } catch {
+    return false;
+  }
+}
+
+// src/caddy/tls-health.ts
+var import_node_tls = require("tls");
+function assessTlsCertificate(certificate, hostname, now = Date.now(), verifyHostname = import_node_tls.checkServerIdentity) {
+  if (!certificate.valid_to)
+    return { healthy: false, reason: "certificate_missing" };
+  const expiresAt = new Date(certificate.valid_to);
+  if (Number.isNaN(expiresAt.getTime()))
+    return { healthy: false, reason: "certificate_invalid" };
+  if (expiresAt.getTime() <= now)
+    return { healthy: false, reason: "certificate_expired", expiresAt };
+  try {
+    if (verifyHostname(hostname, certificate))
+      return { healthy: false, reason: "hostname_mismatch" };
+  } catch {
+    return { healthy: false, reason: "certificate_invalid" };
+  }
+  return { healthy: true, expiresAt };
+}
+function probeLocalTls(hostname, options = {}) {
+  const {
+    connect: openTlsConnection = import_node_tls.connect,
+    port = 443,
+    timeoutMs = 1e3
+  } = options;
+  return new Promise((resolve2) => {
+    let settled = false;
+    let timeout;
+    const socket = openTlsConnection({
+      host: "127.0.0.1",
+      port,
+      servername: hostname,
+      rejectUnauthorized: false
+    });
+    const finish = (result) => {
+      if (settled)
+        return;
+      settled = true;
+      if (timeout)
+        clearTimeout(timeout);
+      socket.destroy();
+      resolve2(result);
+    };
+    timeout = setTimeout(() => {
+      finish({ healthy: false, reason: "connection_failed" });
+    }, timeoutMs);
+    socket.once("secureConnect", () => {
+      finish(assessTlsCertificate(socket.getPeerCertificate(), hostname));
+    });
+    socket.once("error", () => {
+      finish({ healthy: false, reason: "connection_failed" });
+    });
+  });
+}
+function sleep(ms) {
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
+}
+async function waitForLocalTls(hostname, options = {}) {
+  const {
+    probe: checkTls = probeLocalTls,
+    retryIntervalMs = 250,
+    retryWindowMs = 3e4,
+    sleep: wait = sleep,
+    ...probeOptions
+  } = options;
+  const deadline = Date.now() + retryWindowMs;
+  let result = { healthy: false, reason: "connection_failed" };
+  do {
+    result = await checkTls(hostname, probeOptions);
+    if (result.healthy)
+      return result;
+    const remaining = deadline - Date.now();
+    if (remaining > 0)
+      await wait(Math.min(retryIntervalMs, remaining));
+  } while (Date.now() < deadline);
+  return result;
+}
+function formatTlsHealthFailure(hostname, result) {
+  const reason = result.reason === "certificate_expired" && result.expiresAt ? `the certificate expired at ${result.expiresAt.toISOString()}` : result.reason.replaceAll("_", " ");
+  return `[unplugin-https-reverse-proxy] Caddy cannot serve valid HTTPS for ${hostname}: ${reason}. Restart Caddy to retry its automatic certificate renewal. Do not remove Caddy PKI data automatically because that replaces the trusted local root certificate.`;
+}
+
 // src/caddy/utils.ts
 var import_node_child_process3 = require("child_process");
 var import_node_net = require("net");
@@ -13911,6 +14002,39 @@ var CaddyInstant = class {
     await download();
     this.inited = true;
   }
+  async ensureTlsReady(targetHost) {
+    const health = await waitForLocalTls(targetHost);
+    if (!health.healthy)
+      throw new Error(formatTlsHealthFailure(targetHost, health));
+  }
+  async updateCaddyfile() {
+    const { configJsonRef } = getCaddyConfig();
+    const proxies = Object.values(configJsonRef() || {});
+    const ctx = validateTemplateContext({
+      caddy_root: this.caddyRoot,
+      proxies
+    });
+    this.caddyfile = await genCaddyfile(ctx);
+    await this.writeCaddyfile();
+  }
+  async stopCaddy() {
+    var _a4;
+    try {
+      await import_got_cjs.got.post("http://127.0.0.1:2019/stop", {
+        headers: {
+          Origin: "http://localhost:2019"
+        },
+        retry: {
+          limit: 0
+        },
+        timeout: {
+          request: 2e3
+        }
+      });
+    } catch {
+    }
+    (_a4 = this._caddyChild) == null ? void 0 : _a4.kill();
+  }
   /**
    * @param source like `127.0.0.1:8080`
    * @param target like `test.abc.com`. And if you provide a port ,it will be ignore.
@@ -13955,16 +14079,16 @@ var CaddyInstant = class {
     ];
     const { writeCaddyConfig } = getCaddyConfig();
     writeCaddyConfig(proxies);
+    await this.updateCaddyfile();
+    let skipInitialCaddyfileEffect = true;
     this._stopEffects.push(
-      effect(async () => {
-        const { configJsonRef } = getCaddyConfig();
-        const proxies2 = Object.values(configJsonRef() || {});
-        const ctx = validateTemplateContext({
-          caddy_root: this.caddyRoot,
-          proxies: proxies2
-        });
-        this.caddyfile = await genCaddyfile(ctx);
-        await this.writeCaddyfile();
+      effect(() => {
+        getCaddyConfig().configJsonRef();
+        if (skipInitialCaddyfileEffect) {
+          skipInitialCaddyfileEffect = false;
+          return;
+        }
+        void this.updateCaddyfile();
       })
     );
     if (!(0, import_node_fs3.existsSync)(caddyLockFilePath))
@@ -13977,6 +14101,21 @@ var CaddyInstant = class {
     }
     return new Promise((resolve2, reject2) => {
       var _a4, _b3;
+      let startupCheckStarted = false;
+      const resolveWhenReady = async () => {
+        if (startupCheckStarted)
+          return;
+        startupCheckStarted = true;
+        try {
+          if (https)
+            await this.ensureTlsReady(targetHost);
+          resolve2();
+        } catch (error) {
+          if (!this.locked)
+            await this.baseCleanup(restore);
+          reject2(error);
+        }
+      };
       const setupCleanup = () => {
         import_node_process4.default.on("SIGINT", async () => {
           if (this.stoped)
@@ -14036,6 +14175,10 @@ var CaddyInstant = class {
           const lines = data.toString().split("\n").map((line) => line.trim());
           for (const line of lines) {
             showCaddyLog && line && console.info(line);
+            if (isCaddyReloadCancellation(line)) {
+              consola.info("Caddy restarted before TLS issuance completed; retrying.\n");
+              continue;
+            }
             try {
               if (line.includes("Error:") || line && JSON.parse(line).level === "error") {
                 if (line.includes("parsing caddyfile tokens")) {
@@ -14056,23 +14199,30 @@ ${line}
             if (line.includes("config file changed"))
               consola.success("Detect added a new reverse proxy config, restarted.\n");
             if (line.includes("caddy proxying") || line.includes("serving initial"))
-              return resolve2();
+              void resolveWhenReady();
           }
         });
         (_b3 = this._caddyChild.stdout) == null ? void 0 : _b3.on("data", (_data) => {
           consola.info(_data.toString());
-          resolve2();
+          void resolveWhenReady();
         });
         setupCleanup();
       } else {
         consola.info("Caddy is running in another process.");
-        setupCleanup();
-        return resolve2();
+        void (async () => {
+          try {
+            if (https)
+              await this.ensureTlsReady(targetHost);
+            setupCleanup();
+            resolve2();
+          } catch (error) {
+            reject2(error);
+          }
+        })();
       }
     });
   }
   async baseCleanup(restore = true) {
-    var _a4;
     this._stopEffects.forEach((fn) => fn());
     try {
       if (restore && this._source && this._target) {
@@ -14086,7 +14236,7 @@ ${line}
       consola.fail("Restore host failed.\n");
     }
     if (!this.locked && !this.stoped) {
-      (_a4 = this._caddyChild) == null ? void 0 : _a4.kill();
+      await this.stopCaddy();
       try {
         await lockfile.unlock(caddyLockFilePath).catch(() => {
         });

package/dist/webpack.js

@@ -1,6 +1,6 @@
 import {
   unpluginFactory
-} from "./chunk-JA3D5AWS.js";
+} from "./chunk-MD5CVZP7.js";
 import "./chunk-RSBXFJ3Z.js";
 import "./chunk-2P7SUCQ3.js";
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "unplugin-https-reverse-proxy",
   "type": "module",
-  "version": "4.0.2",
+  "version": "4.0.3",
   "description": "",
   "license": "MIT",
   "homepage": "https://github.com/zcf0508/unplugin-https-reverse-proxy#readme",

package/src/caddy/caddyfile.ts

@@ -25,7 +25,7 @@ export function validateTemplateContext(ctx: unknown): typeof CaddyContext.infer
 
 export const caddyTemplate = `{
   debug
-  auto_https disable_redirects
+  auto_https disable_redirects ignore_loaded_certs
 }
 
 :7601 {

package/src/caddy/index.ts

@@ -14,6 +14,8 @@ import { chmodRecursive, consola, once } from '../utils'
 import { genCaddyfile, validateTemplateContext } from './caddyfile'
 import { useCaddyConfig } from './config'
 import { caddyFilePath, caddyLockFilePath, caddyPath, supportList, TEMP_DIR } from './constants'
+import { isCaddyReloadCancellation } from './log'
+import { formatTlsHealthFailure, waitForLocalTls } from './tls-health'
 import { kill, logProgress, logProgressOver, tryPort } from './utils'
 
 export async function download(): Promise<string> {
@@ -187,6 +189,43 @@ export class CaddyInstant {
     this.inited = true
   }
 
+  private async ensureTlsReady(targetHost: string): Promise<void> {
+    const health = await waitForLocalTls(targetHost)
+    if (!health.healthy)
+      throw new Error(formatTlsHealthFailure(targetHost, health))
+  }
+
+  private async updateCaddyfile(): Promise<void> {
+    const { configJsonRef } = getCaddyConfig()
+    const proxies = Object.values(configJsonRef() || {})
+    const ctx = validateTemplateContext({
+      caddy_root: this.caddyRoot,
+      proxies,
+    })
+
+    this.caddyfile = await genCaddyfile(ctx)
+    await this.writeCaddyfile()
+  }
+
+  private async stopCaddy(): Promise<void> {
+    try {
+      await got.post('http://127.0.0.1:2019/stop', {
+        headers: {
+          Origin: 'http://localhost:2019',
+        },
+        retry: {
+          limit: 0,
+        },
+        timeout: {
+          request: 2000,
+        },
+      })
+    }
+    catch {}
+
+    this._caddyChild?.kill()
+  }
+
   /**
    * @param source like `127.0.0.1:8080`
    * @param target like `test.abc.com`. And if you provide a port ,it will be ignore.
@@ -239,17 +278,17 @@ export class CaddyInstant {
     const { writeCaddyConfig } = getCaddyConfig()
     writeCaddyConfig(proxies)
 
-    this._stopEffects.push(
-      effect(async () => {
-        const { configJsonRef } = getCaddyConfig()
-        const proxies = Object.values(configJsonRef() || {})
-        const ctx = validateTemplateContext({
-          caddy_root: this.caddyRoot,
-          proxies,
-        })
+    await this.updateCaddyfile()
 
-        this.caddyfile = await genCaddyfile(ctx)
-        await this.writeCaddyfile()
+    let skipInitialCaddyfileEffect = true
+    this._stopEffects.push(
+      effect(() => {
+        getCaddyConfig().configJsonRef()
+        if (skipInitialCaddyfileEffect) {
+          skipInitialCaddyfileEffect = false
+          return
+        }
+        void this.updateCaddyfile()
       }),
     )
 
@@ -264,6 +303,25 @@ export class CaddyInstant {
     }
 
     return new Promise<void>((resolve, reject) => {
+      let startupCheckStarted = false
+
+      const resolveWhenReady = async (): Promise<void> => {
+        if (startupCheckStarted)
+          return
+        startupCheckStarted = true
+
+        try {
+          if (https)
+            await this.ensureTlsReady(targetHost)
+          resolve()
+        }
+        catch (error) {
+          if (!this.locked)
+            await this.baseCleanup(restore)
+          reject(error)
+        }
+      }
+
       const setupCleanup = (): void => {
         process.on('SIGINT', async () => {
           if (this.stoped)
@@ -340,6 +398,10 @@ export class CaddyInstant {
             // caddy log
             // eslint-disable-next-line no-console
             showCaddyLog && line && console.info(line)
+            if (isCaddyReloadCancellation(line)) {
+              consola.info('Caddy restarted before TLS issuance completed; retrying.\n')
+              continue
+            }
             try {
               if (line.includes('Error:') || (line && JSON.parse(line).level === 'error')) {
                 if (line.includes('parsing caddyfile tokens')) {
@@ -360,13 +422,13 @@ export class CaddyInstant {
               consola.success('Detect added a new reverse proxy config, restarted.\n')
 
             if (line.includes('caddy proxying') || line.includes('serving initial'))
-              return resolve()
+              void resolveWhenReady()
           }
         })
 
         this._caddyChild!.stdout?.on('data', (_data) => {
           consola.info(_data.toString())
-          resolve()
+          void resolveWhenReady()
         })
 
         setupCleanup()
@@ -374,9 +436,17 @@ export class CaddyInstant {
       else {
         consola.info('Caddy is running in another process.')
 
-        setupCleanup()
-
-        return resolve()
+        void (async () => {
+          try {
+            if (https)
+              await this.ensureTlsReady(targetHost)
+            setupCleanup()
+            resolve()
+          }
+          catch (error) {
+            reject(error)
+          }
+        })()
       }
     })
   }
@@ -398,7 +468,7 @@ export class CaddyInstant {
       consola.fail('Restore host failed.\n')
     }
     if (!this.locked && !this.stoped) {
-      this._caddyChild?.kill()
+      await this.stopCaddy()
       try {
         await lockfile.unlock(caddyLockFilePath).catch(() => { })
         await unlink(caddyFilePath).catch(() => { })