vrpc 3.11.1 → 3.12.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vrpc",
-  "version": "3.11.1",
+  "version": "3.12.0",
   "description": "Variadic Remote Procedure Calls",
   "main": "index.js",
   "directories": {

package/vrpc/VrpcAgent.js

@@ -102,6 +102,7 @@ class VrpcAgent extends EventEmitter {
    * @param {String} [obj.bestEffort=true] If true, message will be sent with best effort, i.e. no caching if offline
    * @param {String} [obj.version=''] The (user-defined) version of this agent
    * @param {String} [obj.mqttClientId='<generated()>'] Explicitly set the mqtt client id.
+   * @param {Object} [obj.tls] TLS settings for a secure broker: `{ ca, rejectUnauthorized }`. Without it the broker's certificate is not verified (the historical behaviour); with `ca` the broker must present a chain the given certificates anchor.
    *
    * @example
    * const agent = new Agent({
@@ -119,7 +120,8 @@ class VrpcAgent extends EventEmitter {
     log = 'console',
     bestEffort = true,
     version = '',
-    mqttClientId = null
+    mqttClientId = null,
+    tls = null
   } = {}) {
     super()
     this._validateDomain(domain)
@@ -132,6 +134,7 @@ class VrpcAgent extends EventEmitter {
     this._broker = broker
     this._qos = bestEffort ? 0 : 1
     this._version = version
+    this._tls = tls
     this._mqttClientId =
       mqttClientId || `va3${VrpcAgent._createHash(this._domain + this._agent)}`
     if (log === 'console') {
@@ -192,7 +195,7 @@ class VrpcAgent extends EventEmitter {
       // agent must come back when it does (mqtt >= 5 stops otherwise)
       reconnectOnConnackError: true,
       clientId: this._mqttClientId,
-      rejectUnauthorized: false,
+      ...VrpcAgent._tlsOptions(this._tls),
       will: {
         topic: `${this._baseTopic}/__agentInfo__`,
         payload: this._createAgentInfoPayload({ status: 'offline' }),
@@ -297,6 +300,17 @@ class VrpcAgent extends EventEmitter {
     return token.slice(0, length)
   }
 
+  /**
+   * The TLS part of the MQTT options: verification off when nothing was
+   * given (as it always was), the given anchors otherwise.
+   */
+  static _tlsOptions (tls) {
+    if (!tls) return { rejectUnauthorized: false }
+    const options = { rejectUnauthorized: tls.rejectUnauthorized !== false }
+    if (tls.ca) options.ca = tls.ca
+    return options
+  }
+
   static _generateAgentName () {
     const { username } = os.userInfo()
     const pathId = VrpcAgent._createHash(path.resolve, 4)

package/vrpc/VrpcClient.js

@@ -75,6 +75,7 @@ class VrpcClient extends EventEmitter {
    *   domain: 'vrpc',
    *   broker: 'mqtts://broker.hivemq.com:8883'
    * })
+   * @param {Object} [obj.tls] TLS settings for a secure broker: `{ ca, rejectUnauthorized }`. Without it the broker's certificate is not verified (the historical behaviour); with `ca` the broker must present a chain the given certificates anchor.
    */
   constructor ({
     token,
@@ -89,7 +90,8 @@ class VrpcClient extends EventEmitter {
     mqttClientId = null,
     identity = null,
     keepalive = 30,
-    requiresSchema = false
+    requiresSchema = false,
+    tls = null
   } = {}) {
     super()
     // domain sanity check
@@ -137,6 +139,7 @@ class VrpcClient extends EventEmitter {
 
     this._instance = nanoid(8)
     this._mqttClientId = mqttClientId || this._createMqttClientId()
+    this._tls = tls
     this._vrpcClientId = this._createVrpcClientId()
     // the part of the connection id nobody else can learn: a broker that
     // confines a client to topics under its own mqtt client id keeps
@@ -203,6 +206,17 @@ class VrpcClient extends EventEmitter {
     return this._vrpcConnectionId
   }
 
+  /**
+   * The TLS part of the MQTT options: verification off when nothing was
+   * given (as it always was), the given anchors otherwise.
+   */
+  static _tlsOptions (tls) {
+    if (!tls) return { rejectUnauthorized: false }
+    const options = { rejectUnauthorized: tls.rejectUnauthorized !== false }
+    if (tls.ca) options.ca = tls.ca
+    return options
+  }
+
   /**
    * Actually connects to the MQTT broker.
    *
@@ -229,7 +243,7 @@ class VrpcClient extends EventEmitter {
       clean: true,
       keepalive: this._keepalive,
       clientId: this._mqttClientId,
-      rejectUnauthorized: false,
+      ...VrpcClient._tlsOptions(this._tls),
       connectTimeout: this._timeout,
       // a refused CONNACK is retried like any other failed attempt (see
       // VrpcAgent): whoever wants a refusal to be final ends the client