feat: add ignore-certificate-errors option for self-signed TLS

tests/http.test.ts

@@ -0,0 +1,55 @@
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { createServer, type Server } from "node:https";
+import { after, before, test } from "node:test";
+import { fetchWith } from "../src/lib/http";
+
+const TLS_OPTIONS = {
+  cert: readFileSync(new URL("./fixtures/selfsigned-cert.pem", import.meta.url)),
+  key: readFileSync(new URL("./fixtures/selfsigned-key.pem", import.meta.url)),
+};
+
+let server: Server;
+let base: string;
+
+before(async () => {
+  server = createServer(TLS_OPTIONS, (req, res) => {
+    res.writeHead(200, { "content-type": "text/plain" });
+    res.end("ok");
+  });
+  await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
+  base = `https://127.0.0.1:${(server.address() as { port: number }).port}`;
+});
+
+after(async () => new Promise((resolve) => server.close(() => resolve())));
+
+test("fetchWith verifies certificates by default", async () => {
+  await assert.rejects(fetchWith({ baseUrl: base }, `${base}/`));
+});
+
+test("fetchWith accepts self-signed certificates when insecure", async () => {
+  const res = await fetchWith({ baseUrl: base, insecure: true }, `${base}/`);
+  assert.equal(res.status, 200);
+  assert.equal(await res.text(), "ok");
+});
+
+test("fetchWith honors init headers and signal when insecure", async () => {
+  let seen: string | undefined;
+  const spy = createServer(TLS_OPTIONS, (req, res) => {
+    seen = req.headers.authorization;
+    res.writeHead(200);
+    res.end("ok");
+  });
+  await new Promise<void>((resolve) => spy.listen(0, "127.0.0.1", resolve));
+  const spyBase = `https://127.0.0.1:${(spy.address() as { port: number }).port}`;
+  try {
+    const res = await fetchWith({ baseUrl: spyBase, insecure: true }, `${spyBase}/`, {
+      headers: { Authorization: "Bearer tok" },
+      signal: AbortSignal.timeout(3000),
+    });
+    assert.equal(res.status, 200);
+    assert.equal(seen, "Bearer tok");
+  } finally {
+    await new Promise<void>((resolve) => spy.close(() => resolve()));
+  }
+});