feat: implement custom fetch function for handling insecure TLS in Grafana requests

Author: essinghigh

radius-proxy/lib/grafana.ts

@@ -2,6 +2,28 @@ import { config } from './config'
 import { warn, error, info } from './log'
 import https from 'https'
 
+// Create a custom fetch function that handles TLS configuration
+async function customFetch(url: string, options: RequestInit = {}): Promise<Response> {
+  if (config.GRAFANA_INSECURE_TLS && url.startsWith('https://')) {
+    // For HTTPS URLs when TLS verification is disabled, use a custom agent
+    const agent = new https.Agent({
+      rejectUnauthorized: false
+    })
+    
+    // Create options with the custom agent
+    const fetchOptions = {
+      ...options,
+      agent: agent
+    }
+    
+    info('[grafana] Using insecure TLS agent for HTTPS request', { url: url.substring(0, 50) + '...' })
+    return fetch(url, fetchOptions)
+  }
+  
+  // For HTTP URLs or when TLS verification is enabled, use regular fetch
+  return fetch(url, options)
+}
+
 // Types describing Grafana REST API shapes we touch in this helper.
 interface GrafanaOrgUserLookupItem {
   id?: number
@@ -27,20 +49,11 @@ interface GrafanaGlobalCache {
 
 declare const global: typeof globalThis & GrafanaGlobalCache
 
-// Get fetch options with optional TLS configuration
+// Get fetch options - TLS configuration is handled in customFetch function
 function getFetchOptions(headers: Record<string, string>, method: string, body?: string): RequestInit {
   const options: RequestInit = { method, headers }
   if (body) options.body = body
 
-  // If TLS verification is disabled, create an HTTPS agent that ignores certificate errors
-  if (config.GRAFANA_INSECURE_TLS) {
-    const agent = new https.Agent({
-      rejectUnauthorized: false
-    })
-    // @ts-expect-error - Node.js specific fetch option
-    options.agent = agent
-  }
-  
   return options
 }
 
@@ -82,7 +95,7 @@ export async function addUserToTeamByEmail(teamId: number, email: string, userna
       const headers: Record<string, string> = { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' }
 
       info('[grafana] org user lookup', { email, url: lookupUrl })
-      const lookupRes = await fetch(lookupUrl, getFetchOptions(headers, 'GET'))
+      const lookupRes = await customFetch(lookupUrl, getFetchOptions(headers, 'GET'))
       const lookupText = await lookupRes.text().catch(() => '<no body>')
       info('[grafana] org lookup response', { email, url: lookupUrl, status: lookupRes.status, body: lookupText })
 
@@ -130,7 +143,7 @@ export async function addUserToTeamByEmail(teamId: number, email: string, userna
           info('[grafana] user not found in org lookup; retrying lookup', { email, attempt, backoff })
           await new Promise((res) => setTimeout(res, backoff))
           backoff *= 2
-          const retryRes = await fetch(lookupUrl, getFetchOptions(headers, 'GET'))
+          const retryRes = await customFetch(lookupUrl, getFetchOptions(headers, 'GET'))
           const retryText = await retryRes.text().catch(() => '<no body>')
           info('[grafana] org lookup retry response', { email, url: lookupUrl, attempt, status: retryRes.status, body: retryText })
           if (!retryRes.ok) {
@@ -156,7 +169,7 @@ export async function addUserToTeamByEmail(teamId: number, email: string, userna
       const teamUrl = grafanaBase ? `${grafanaBase}/api/teams/${teamId}/members` : `/api/teams/${teamId}/members`
       // Check current team members to avoid duplicate adds (idempotent)
       try {
-        const membersRes = await fetch(teamUrl, getFetchOptions(headers, 'GET'))
+        const membersRes = await customFetch(teamUrl, getFetchOptions(headers, 'GET'))
         const membersText = await membersRes.text().catch(() => '<no body>')
         if (membersRes.ok) {
           try {
@@ -176,7 +189,7 @@ export async function addUserToTeamByEmail(teamId: number, email: string, userna
       }
 
       info('[grafana] add user to team via POST', { teamId, userId, email, url: teamUrl })
-      const addRes = await fetch(teamUrl, getFetchOptions(headers, 'POST', JSON.stringify({ userId, role })))
+      const addRes = await customFetch(teamUrl, getFetchOptions(headers, 'POST', JSON.stringify({ userId, role })))
       const addText = await addRes.text().catch(() => '<no body>')
       info('[grafana] add response', { teamId, userId, status: addRes.status, body: addText })
       if (!addRes.ok) {