Allows self-signed certs on OPDS feed requests in dev

[iisisrael]

Not sure how kosher / best practice this is, but resolves issue #860 .

[iisisrael]

Squashed, which removes the original changes.

[danielweck]

It has just occurred to me that we should probably use this instead:

const request = require( 'request' ).defaults({rejectUnauthorized: _NODE_ENV === "development"});

https://github.com/request/request#requestdefaultsoptions

However, unfortunately this is not a global default that would apply to all instances of request in a given Javascript bundle / process (e.g. the Electron main process), which would be ideal because there are other uses of request in Readium2 dependencies/components (e.g. LCP LSD register / renew / return interactions, etc.).

So instead this just creates a wrapper to a specific request instance that will use the given defaults. For this to work more globally in Thorium's own codebase, we must expose the instance as a const, somewhere. For this to work with underlying Readium2 components, the APIs would need to accept a custom request instance to be used instead of a regular import * as request from "request" (IIRC).

[danielweck]

New file: src/utils/request.ts

import * as rawRequest from "request";
export const request = rawRequest.defaults({ rejectUnauthorized: _NODE_ENV === "development" });

...then in src/main/services/downloader.ts and src/common/utils/http.ts replace import * as request from "request"; with import { request } from "readium-desktop/utils/request";

What do you think?

[danielweck]

I'm not sure how this would work with request-promise-native which is used in some cases instead of request inside the Readium2 LCP/LSD code.
https://github.com/request/request-promise-native

[danielweck]

Closing this PR, as rejectUnauthorized is now enabled in DEV mode for httpGet() (wrapper for request() which calls Node fetch()), as well as the special case request.post() (OPDS OAuth). Note that the LCP/LSD internal request() calls (request lib, not a Thorium-specific function wrapper) do not enable rejectUnauthorized (see comment above #874 (comment) ).