Kikobeats / https-tls / 40733799220

100%

push

github

fix(tls): let caller options win over the browser profile (#29)

* fix(tls): let caller options win over the browser profile

tls(userAgent, httpsOpts) copied the caller options and then assigned
ciphers, signatureAlgorithms, ecdhCurve, minVersion and maxVersion from the
browser profile unconditionally. A caller asking for minVersion TLSv1.2 with
a Chrome user agent got TLSv1 back, and through the got hook a caller
ecdhCurve was replaced, since the hook only bails out for the other four.

The profile is a set of defaults, so each field is now assigned only when
the caller left it unset (undefined or null). got 12+ normalizes https
options with every key present and undefined, so treating undefined as
unset keeps the profile working there. A caller secureProtocol already pins
the TLS version, and Node throws ERR_TLS_PROTOCOL_VERSION_CONFLICT when it
is combined with minVersion or maxVersion, so the profile versions are
skipped in that case. The caller object is still copied, never mutated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* test(tls): lock every nullish profile default

signatureAlgorithms, ecdhCurve, minVersion, and maxVersion could be
overwritten, or skip a null, without a failing test. Empty strings are
caller values, and a null secureProtocol is unset. The hook also skips
decoration when a profile field is already set.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(tls): keep the profile minimum within the caller maximum

A caller maximum below the profile minimum left no protocol Node 18 can negotiate.

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

39 of 40 branches covered (97.5%)

Branch coverage included in aggregate %.

17 of 17 new or added lines in 1 file covered. (100.0%)

248 of 248 relevant lines covered (100.0%)

11.25 hits per line