Merge pull request #19 from jsonjoy-com/https

TLS/HTTPS support

package.json

@@ -40,7 +40,7 @@
   "license": "Apache-2.0",
   "scripts": {
     "format": "biome format ./src",
-    "format:write": "biome format --write ./src",
+    "format:fix": "biome format --write ./src",
     "lint": "biome lint ./src",
     "lint:fix": "biome lint --apply ./src",
     "clean": "rimraf lib typedocs coverage gh-pages yarn-error.log db dist",

src/__demos__/json-crdt-server/main-http1-tls.ts

@@ -0,0 +1,36 @@
+// Run: npx ts-node src/__demos__/json-crdt-server/main-http1-tls.ts
+// curl https://localhost/rx --insecure -d '[1,1,"util.ping"]'
+
+import type * as tls from 'tls';
+import * as fs from 'fs';
+import {createCaller, createServices} from './routes';
+import {RpcServer} from '../../server/http1/RpcServer';
+
+export type JsonJoyDemoRpcCaller = ReturnType<typeof createCaller>['caller'];
+
+const main = async () => {
+  const secureContext = async (): Promise<tls.SecureContextOptions> => {
+    return {
+      key: await fs.promises.readFile(__dirname + '/../../__tests__/certs/server.key'),
+      cert: await fs.promises.readFile(__dirname + '/../../__tests__/certs/server.crt'),
+    };
+  };
+
+  const services = await createServices();
+  const server = await RpcServer.startWithDefaults({
+    create: {
+      tls: true,
+      secureContext,
+      secureContextRefreshInterval: 1000 * 60 * 60 * 24,
+    },
+    port: +(process.env.PORT || 443),
+    caller: createCaller(services).caller,
+    logger: console,
+  });
+
+  // tslint:disable-next-line:no-console
+  console.log(server + '');
+};
+
+// tslint:disable-next-line no-console
+main().catch(console.error);

src/__demos__/json-crdt-server/main-http1.ts

@@ -9,7 +9,7 @@ export type JsonJoyDemoRpcCaller = ReturnType<typeof createCaller>['caller'];
 
 const main = async () => {
   const services = await createServices();
-  const server = RpcServer.startWithDefaults({
+  const server = await RpcServer.startWithDefaults({
     port: +(process.env.PORT || 9999),
     caller: createCaller(services).caller,
     logger: console,

src/__tests__/certs/root.crt

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDazCCAlOgAwIBAgIUTCuaouku5UxROTTWDaMZ02A+rMwwDQYJKoZIhvcNAQEL
+BQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM
+GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0yNDEwMDcwNzM1MDhaFw0yNTEw
+MDcwNzM1MDhaMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw
+HwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3DQEB
+AQUAA4IBDwAwggEKAoIBAQCibOXoqQTSAvjVFNOZOt6MT9PK1HqTJjknITMPYsrh
+8BZemAAV9pEImeNNBGqScO4oUHX3ZmqcGn6PyTtIWGClXkuVAlghEMNuHqunqRFl
+isYaNMsvlmRxFaWVzRq7iN8S+zX0ongtLCUDRexkZmBzM6+aBszifTwMd7oryQhj
+9adBROw8yl1yZF33T+a6khQwJ96S5NL/cBbD6aHYH/2DbODN1ru6CGHi0f6b+kUW
+1t5xsuc2K+DAWNfmEDQ47EMxS8OYhh2Y/0V/YCIuOIU1tlVL78XjOBmjssPpNFfg
+86Uqcfyx0+naQWLF/2r4uUTT3nNhWofM0pXA7DxuMawXAgMBAAGjUzBRMB0GA1Ud
+DgQWBBRBA4dUj3VDyFhGSvtIMFkfxMxkOjAfBgNVHSMEGDAWgBRBA4dUj3VDyFhG
+SvtIMFkfxMxkOjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQBi
+UTc+mRjoSKjpxYgoEFF6MDm24IrZ9b0NSFNHrM9hbbbErJgQ3UJkUAjXweRxvWPw
+gL8HLGLDjsUg/h4D33xndmoXPvmQAuiBFaujWqOeZ7mcwbLNVkDNZzgdo8ggfXkn
+e64u37aSoUV+XdyeyJyRBHpVfdTPeptN/KhdijjL0uWiw48A7sDZsgz0SZKSxdF3
+TVQA2W1dGJ0yAEqnbIc3f2HbRg6PXs2jyQ0pdWjQlaARJ3KV433V2T0ecKXQaXoL
+B8cvXrfn4dEkHd4tBZqB5Z/bVxj14g5jtq5f/FWupZwWCvP28vDe0ZJw/5/7R10R
+1S3XB1fJh48m0c7k9gn3
+-----END CERTIFICATE-----

src/__tests__/certs/root.key

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCibOXoqQTSAvjV
+FNOZOt6MT9PK1HqTJjknITMPYsrh8BZemAAV9pEImeNNBGqScO4oUHX3ZmqcGn6P
+yTtIWGClXkuVAlghEMNuHqunqRFlisYaNMsvlmRxFaWVzRq7iN8S+zX0ongtLCUD
+RexkZmBzM6+aBszifTwMd7oryQhj9adBROw8yl1yZF33T+a6khQwJ96S5NL/cBbD
+6aHYH/2DbODN1ru6CGHi0f6b+kUW1t5xsuc2K+DAWNfmEDQ47EMxS8OYhh2Y/0V/
+YCIuOIU1tlVL78XjOBmjssPpNFfg86Uqcfyx0+naQWLF/2r4uUTT3nNhWofM0pXA
+7DxuMawXAgMBAAECggEAJwQOk/0prcLN/+1BSND1zXGNd+7jRL6NQwN8DumVv4Ea
+9nz/pEb2nsDMc18otGWRJ7jwJU4CNN4+YY6egWnNSVvlvvTxs3uh3i1a4WrAxYn4
+vSnKVvOCzBE9lcbPcZXWs+oJE2sFgCBXAbrFpnZbG8EiINcaVxtrFbmazFK9g7kI
+Cvn8fzfsl2hSodusj9HuNNjfZL1CewHrF/xtuLp50wTvTpS2IZVqfhIpuuf1lmHf
+tArJIbW3Rp3VUUtlEc6OEFa8xMVoJF1zNSBgIeUq00UjEtS3nTTZprt29ggigI2d
+GfJ/89vXRIaorGuGOI6of8CgpDKlA0oYXy94sh/v9QKBgQDO6LRWGR3jTePSEXZR
+E+ph74zLHOpfrDed7LYeOlV7zBciN8D1q9KpOQVMY/7Lenok5f2svJeO8hxGeM9J
+F13xzmITQppxoq3qoMOQm4FtGe+MsTe1nXtUGldUbMQwwFL5GqxYjCUI9sDXGEox
+zBawUa/KDuD+p1nQn9sG+h/5OwKBgQDI9lXfvqIEC22PboyN3Jp5n+PVy2xJera8
+BPHvdiRLfdZitRRfJ5wg0/B1euVsnLRPGRI321r7IidELGX/VT3jvEIHYFVXfH3e
+xnQWyvOTdnXmgIZYIlgnk7ryDSpwNnDaHzX8ozoVtXl8G08CD+T74KcSr0R+pof0
+ssAUv+EK1QKBgAQgWfBZoeH1nLSEyqJFTmhTmbA3TGlKCvXoUZ16tle4s0FocT21
+Bod/bp6eY+d08tiniY6XWEJui6fQIvonMCVxYz1VF7VqdCN4v02z/DnLyZ45ro29
+rUb5G4LAhI0gWMdFA+jkKpzqJuBjSJ+DnXQ4vNO/xjbt6XmipoCWHmsfAoGAUa+H
+omXrlzdJ9mZaLYPBKrTqOEnynz+JLY3ZBZwBDsp8rSyrti30kYd0k1w8C1T7Gbe4
+Jwo7xh7Q1S4y24G7oWkxcawfpGsPAtGp+GXQcl1ReTs+4G49ZQDwmVjuqiQG5TKQ
+kDuM7awRUHgNOmpZimR7pOWnMs/gLX/HAegowm0CgYBZKUy7hNNY9bjbi8AmADWP
+g0roJZYU+12EvrR1AShVx6oE5Oq/w3WnG1qyFaoaIo36kkGB5yZDQkySN6UV3GF/
+sHaWtGVVcYnTFiDkeH4BAxKhLg/0q+ipfVT18dlPec5WhVhgHtldFeCP0j7UFQEx
+Dn97qAEU6vqvMz8vUBXTxA==
+-----END PRIVATE KEY-----

src/__tests__/certs/root.srl

@@ -0,0 +1 @@
+2AAEBC5B9C0D89E6BF42BF00A11B7178A5BDD49A

src/__tests__/certs/server.crt

@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDWjCCAkKgAwIBAgIUKq68W5wNiea/Qr8AoRtxeKW91JowDQYJKoZIhvcNAQEL
+BQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM
+GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0yNDEwMDcwOTA2MjNaFw0yNTEw
+MDcwOTA2MjNaMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw
+HwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3DQEB
+AQUAA4IBDwAwggEKAoIBAQDHeHPg8Z+3WPdsoV3Io7ZxEAbAiYPm30vq9I6u6uHY
+c2BK/sYAEolQ6a1KMGXeElEtav/msJ1sAr5AX62QiMIie1CV0HN8bUrYeYxM3gdn
+f18qW4q1Cxy3o+lZ42QvwJksC0JbsvD7Eg5SW/pD89hxD1ovREnxbNNZkPkaxCcg
+YzruILGkCSWpBjYiXeebjxZTam84fauUXLlzjp7ox2xhBLg5fxxd9aPahc2szLeY
+7v4pk3wZJ8EU3BJpgkOQrlyLQmZ31/dWDAHxqRteFqt6wGLvBYBwxKvHcWyxoxhI
+5AU6c5IWiUn0Sd66dy31X+konEZSPaUchyGsqTTTpkfjAgMBAAGjQjBAMB0GA1Ud
+DgQWBBT4zgQm2Katn77dYvHsiT4b/9v8bTAfBgNVHSMEGDAWgBRBA4dUj3VDyFhG
+SvtIMFkfxMxkOjANBgkqhkiG9w0BAQsFAAOCAQEAia33i3C2yRjh228e3SOOiECn
+kAC7aiZ9Qry/lO241XCz9T/SayRuisq5L1B0vBIKMnuqJw6DX+hrnHPJkx7H5N5a
+ISwlCCOjcurIDdI2tZZrYu0CLpAhSpY0/hFWswnNKefOWgmDRpxw4iBLpAAeAv5z
+aohmi98JdthOQHWvPvu0APz/r7Nb0GpDXjyU2daBnxkiEvBOxXJ7KiFt336haOrn
+EJ3Fbba335rfI9CFqCERHjE/SaJGxrL4z8FRx86HdKbl39ILGr73TyySOh0Tp/iG
+FXzN2POaKzFdB0ezHZsWyh5KeW7AlJaw5SvHLFljV+r1vRR9sX4O+tj04u6V4Q==
+-----END CERTIFICATE-----

src/__tests__/certs/server.csr

@@ -0,0 +1,16 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIICijCCAXICAQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUx
+ITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAMd4c+Dxn7dY92yhXcijtnEQBsCJg+bfS+r0jq7q
+4dhzYEr+xgASiVDprUowZd4SUS1q/+awnWwCvkBfrZCIwiJ7UJXQc3xtSth5jEze
+B2d/XypbirULHLej6VnjZC/AmSwLQluy8PsSDlJb+kPz2HEPWi9ESfFs01mQ+RrE
+JyBjOu4gsaQJJakGNiJd55uPFlNqbzh9q5RcuXOOnujHbGEEuDl/HF31o9qFzazM
+t5ju/imTfBknwRTcEmmCQ5CuXItCZnfX91YMAfGpG14Wq3rAYu8FgHDEq8dxbLGj
+GEjkBTpzkhaJSfRJ3rp3LfVf6SicRlI9pRyHIaypNNOmR+MCAwEAAaAAMA0GCSqG
+SIb3DQEBCwUAA4IBAQBzZYKoSCgIvpJTF9/vgkdJDpWnVROf5xbUCXym8j80ouOm
+Wi8sIgdEqofwlUguPvTD2WLKY40tBHTOEtTtnFYXhHOKAQLduHTrVHzZ3MddcLbI
++9FbDmQKnJtGGUQrzUKfRKPcEwZiXxn3IclPbR/bvZP5F+7brMNOTN/AAfBBAByw
+RYhwOiKiMlodDWFHLBdllY5z5o/nlIXMuPrWclUMSZjoERbM3niSF3fhw1j9m4Tl
+XJnQq0i7n/7KQSRGweckaP3rJu5yn8SmkxmNAo9Fj0H51tpYEdc2K256QVKTGSr2
+bNCcr60ToRiLUL4vokrCbUyIqAPahVwnWg0Kkux1
+-----END CERTIFICATE REQUEST-----

src/__tests__/certs/server.key

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDHeHPg8Z+3WPds
+oV3Io7ZxEAbAiYPm30vq9I6u6uHYc2BK/sYAEolQ6a1KMGXeElEtav/msJ1sAr5A
+X62QiMIie1CV0HN8bUrYeYxM3gdnf18qW4q1Cxy3o+lZ42QvwJksC0JbsvD7Eg5S
+W/pD89hxD1ovREnxbNNZkPkaxCcgYzruILGkCSWpBjYiXeebjxZTam84fauUXLlz
+jp7ox2xhBLg5fxxd9aPahc2szLeY7v4pk3wZJ8EU3BJpgkOQrlyLQmZ31/dWDAHx
+qRteFqt6wGLvBYBwxKvHcWyxoxhI5AU6c5IWiUn0Sd66dy31X+konEZSPaUchyGs
+qTTTpkfjAgMBAAECggEAHB1STo8ai7f1Q8aTa+SwoctNpanxlphm4Gpw3p705H0P
+7PIaS/H7kGp8m3DVOCbiceGGHmif/5R8EUxgWndUJD0M9Ni+dk1cl8S7WC2ROJlq
+JekPf14Iwaok3p+0xCBEK+zjAP692tLG2afkzzAZk9yYlwHr3s86aNeMrM+fPiqj
+0ySjKj+VIgDO+6pItaUdHhgfX+57mzW6FIyiuF5j4fC2w/BFWj8QRXoVul0NNLID
+kfbz0bE3VyFIQcqx68SwD9CoHwIgLYp5uWr57elf9Fd0eFBDSkJglOFCGuhTL/G+
+7nIjLpupuZQy+t9UEH81zM3MPR9OKjLXw9oXtw0Y0QKBgQDxBKATjnJhgAC+iEQ0
+SIySrYa86vo+HxJPbxmv7zKgMTWkfkoUELA3ZrAsR3pyf8a3GNfjwk7iuUEexO4M
+hMqR+7rMY4ORHcHL5OQNYVQF35AOxNS5VKwFt/+Q307pHPQ34Wh9VZ/41Zt/+RFd
+JYFPpupb+RLcx8c9ddwXl0wYEQKBgQDT3qv+1Th7QX/J2oTjajPDo4bu/ZgrqNRo
+mKlL5ngji99fNNt4hT4AGS5S5s2h/5gdfqkF+0dYbdCPAGk6qNdUSAQ+SSCjVFwr
++WDOwYzHaoLtPIDMqBW+O9jkFvSgwVAnW6WBWDUEnOg/3IkAISSQoOOemTyAnIUL
+z+lvqa40swKBgQDiFzqq3ceCmvcXxPBmM2BbABkTA0J4H+GnTktEdRiCmWb+xdFr
+/TOw5M2C3BKLcj3Q6Kcs6svhd3MVEBtW9wKn6wKSVQ/Ig6eWQ0ODIbgWQl/62r3K
+lRlBzBcbqb92gki+Wt8QI9CLNqZGaDjXriUduTDD0mTVYzsN9o/eOXmSYQKBgQCo
+qpMIOxxM21btDf5OwQRWkf9gkRgsYao/XpEgMGih+78mnwC9UG2MTH+ZVc6MUdr6
+WBQdA+7HUhz/Std68GED4pUmNLc773O1OkE8N89oDb4POORciM9Oc3x2EGRM+bhi
+rM30S5Fhi7xE4r9aEAh47uxmHR2SUYiFX845q75YiwKBgQDOhMRsDY0IplKj1DzI
+DK2AcQzhEpXl3wTbcxs48FJs1pBwYPxfgcNEqaHS3nFqwGufeOY7txzfYD758rSO
+f+497Z0gLZ6gqdleUNVGqaRYS5oqEhLIV6/k9zkJiBrlh1wztiVSpjZ8on6YeKp7
+Uy/eYp2ikaeFHMW1VOBx0G6qeg==
+-----END PRIVATE KEY-----

src/server/http1/Http1Server.ts

@@ -1,4 +1,6 @@
 import * as http from 'http';
+import * as https from 'https';
+import type * as tls from 'tls';
 import type * as net from 'net';
 import {Writer} from '@jsonjoy.com/util/lib/buffers/Writer';
 import {Codecs} from '@jsonjoy.com/json-pack/lib/codecs/Codecs';
@@ -64,13 +66,55 @@ export interface Http1ServerOpts {
   writer?: Writer;
 }
 
+export type Http1CreateServerOpts = Http1CreateHttpServerOpts | Http1CreateHttpsServerOpts;
+
+export interface Http1CreateHttpServerOpts {
+  tls?: false;
+  conf?: http.ServerOptions;
+}
+
+export interface Http1CreateHttpsServerOpts {
+  tls: true;
+  conf?: https.ServerOptions;
+  secureContext?: () => Promise<tls.SecureContextOptions>;
+
+  /**
+   * If specified, and the `secureContext` is also specified, will be used to
+   * refresh the secure context every `secureContextRefreshInterval` milliseconds.
+   */
+  secureContextRefreshInterval?: number;
+}
+
 export class Http1Server implements Printable {
-  public static start(opts: http.ServerOptions = {}, port = 8000): Http1Server {
-    const rawServer = http.createServer(opts);
-    rawServer.listen(port);
-    const server = new Http1Server({server: rawServer});
-    return server;
-  }
+  public static create = async (opts: Http1CreateServerOpts = {}): Promise<http.Server | https.Server> => {
+    if (opts.tls) {
+      const {secureContext, secureContextRefreshInterval} = opts;
+      const server = https.createServer({
+        ...(secureContext ? await secureContext() : {}),
+        ...opts.conf,
+      });
+      if (secureContext && secureContextRefreshInterval) {
+        const timer = setInterval(() => {
+          try {
+            secureContext()
+              .then((context) => {
+                server.setSecureContext(context);
+              })
+              .catch((error) => {
+                console.error('Failed to update secure context:', error);
+              });
+          } catch (error) {
+            console.error('Failed to update secure context:', error);
+          }
+        }, secureContextRefreshInterval);
+        server.once('close', () => {
+          clearInterval(timer);
+        });
+      }
+      return server;
+    }
+    return http.createServer(opts.conf || {});
+  };
 
   public readonly codecs: RpcCodecs;
   public readonly server: http.Server;
@@ -82,7 +126,7 @@ export class Http1Server implements Printable {
     this.wsEncoder = new WsFrameEncoder(writer);
   }
 
-  public start(): void {
+  public async start(): Promise<void> {
     const server = this.server;
     this.httpMatcher = this.httpRouter.compile();
     this.wsMatcher = this.wsRouter.compile();
@@ -93,6 +137,11 @@ export class Http1Server implements Printable {
     });
   }
 
+  public async stop(): Promise<void> {
+    const server = this.server;
+    server.removeAllListeners();
+  }
+
   // ------------------------------------------------------------- HTTP routing
 
   public onnotfound: Http1NotFoundHandler = (res) => {

src/server/http1/RpcServer.ts

@@ -1,7 +1,6 @@
-import * as http from 'http';
 import type {Printable} from 'sonic-forest/lib/print/types';
 import {printTree} from 'sonic-forest/lib/print/printTree';
-import {Http1Server} from './Http1Server';
+import {type Http1CreateServerOpts, Http1Server, type Http1ServerOpts} from './Http1Server';
 import {RpcError} from '../../common/rpc/caller';
 import {
   type IncomingBatchMessage,
@@ -10,14 +9,14 @@ import {
   RpcMessageBatchProcessor,
   RpcMessageStreamProcessor,
 } from '../../common';
+import {ObjectValueCaller} from '../../common/rpc/caller/ObjectValueCaller';
+import {gzip} from '@jsonjoy.com/util/lib/compression/gzip';
 import type {Http1ConnectionContext, WsConnectionContext} from './context';
 import type {RpcCaller} from '../../common/rpc/caller/RpcCaller';
 import type {ServerLogger} from './types';
 import type {ConnectionContext} from '../types';
-import {ObjectValueCaller} from '../../common/rpc/caller/ObjectValueCaller';
 import type {ObjectValue} from '@jsonjoy.com/json-type/lib/value/ObjectValue';
 import type {ObjectType} from '@jsonjoy.com/json-type/lib/type/classes';
-import {gzip} from '@jsonjoy.com/util/lib/compression/gzip';
 
 const DEFAULT_MAX_PAYLOAD = 4 * 1024 * 1024;
 
@@ -29,36 +28,29 @@ export interface RpcServerOpts {
 
 export interface RpcServerStartOpts extends Omit<RpcServerOpts, 'http1'> {
   port?: number;
-  server?: http.Server;
+  server?: Omit<Http1ServerOpts, 'server'>;
+  create?: Http1CreateServerOpts;
 }
 
 export class RpcServer implements Printable {
-  public static readonly create = (opts: RpcServerOpts) => {
-    const server = new RpcServer(opts);
-    opts.http1.enableHttpPing();
-    return server;
-  };
-
-  public static readonly startWithDefaults = (opts: RpcServerStartOpts): RpcServer => {
-    const port = opts.port ?? 8080;
+  public static readonly startWithDefaults = async (opts: RpcServerStartOpts): Promise<RpcServer> => {
+    const port = opts.port || 8080;
     const logger = opts.logger ?? console;
-    const server = http.createServer();
-    const http1Server = new Http1Server({
-      server,
-    });
-    const rpcServer = new RpcServer({
+    const server = await Http1Server.create(opts.create);
+    const http1 = new Http1Server({...opts.server, server});
+    const rpc = new RpcServer({
       caller: opts.caller,
-      http1: http1Server,
+      http1,
       logger,
     });
-    rpcServer.enableDefaults();
-    http1Server.start();
+    rpc.enableDefaults();
+    await http1.start();
     server.listen(port, () => {
       let host = server.address() || 'localhost';
       if (typeof host === 'object') host = (host as any).address;
       logger.log({msg: 'SERVER_STARTED', host, port});
     });
-    return rpcServer;
+    return rpc;
   };
 
   public readonly http1: Http1Server;