feat: support mTLS for remote database (#2638)

This PR adds mTLS (mutual TLS) configuration support for the LanceDB
remote HTTP client, allowing users to authenticate with client
certificates and configure custom CA certificates for server
verification.

---------

Co-authored-by: Claude <noreply@anthropic.com>

nodejs/__test__/remote.test.ts

@@ -3,7 +3,13 @@
 
 import * as http from "http";
 import { RequestListener } from "http";
-import { Connection, ConnectionOptions, connect } from "../lancedb";
+import {
+  ClientConfig,
+  Connection,
+  ConnectionOptions,
+  TlsConfig,
+  connect,
+} from "../lancedb";
 
 async function withMockDatabase(
   listener: RequestListener,
@@ -148,4 +154,88 @@ describe("remote connection", () => {
       },
     );
   });
+
+  describe("TlsConfig", () => {
+    it("should create TlsConfig with all fields", () => {
+      const tlsConfig: TlsConfig = {
+        certFile: "/path/to/cert.pem",
+        keyFile: "/path/to/key.pem",
+        sslCaCert: "/path/to/ca.pem",
+        assertHostname: false,
+      };
+
+      expect(tlsConfig.certFile).toBe("/path/to/cert.pem");
+      expect(tlsConfig.keyFile).toBe("/path/to/key.pem");
+      expect(tlsConfig.sslCaCert).toBe("/path/to/ca.pem");
+      expect(tlsConfig.assertHostname).toBe(false);
+    });
+
+    it("should create TlsConfig with partial fields", () => {
+      const tlsConfig: TlsConfig = {
+        certFile: "/path/to/cert.pem",
+        keyFile: "/path/to/key.pem",
+      };
+
+      expect(tlsConfig.certFile).toBe("/path/to/cert.pem");
+      expect(tlsConfig.keyFile).toBe("/path/to/key.pem");
+      expect(tlsConfig.sslCaCert).toBeUndefined();
+      expect(tlsConfig.assertHostname).toBeUndefined();
+    });
+
+    it("should create ClientConfig with TlsConfig", () => {
+      const tlsConfig: TlsConfig = {
+        certFile: "/path/to/cert.pem",
+        keyFile: "/path/to/key.pem",
+        sslCaCert: "/path/to/ca.pem",
+        assertHostname: true,
+      };
+
+      const clientConfig: ClientConfig = {
+        userAgent: "test-agent",
+        tlsConfig: tlsConfig,
+      };
+
+      expect(clientConfig.userAgent).toBe("test-agent");
+      expect(clientConfig.tlsConfig).toBeDefined();
+      expect(clientConfig.tlsConfig?.certFile).toBe("/path/to/cert.pem");
+      expect(clientConfig.tlsConfig?.keyFile).toBe("/path/to/key.pem");
+      expect(clientConfig.tlsConfig?.sslCaCert).toBe("/path/to/ca.pem");
+      expect(clientConfig.tlsConfig?.assertHostname).toBe(true);
+    });
+
+    it("should handle empty TlsConfig", () => {
+      const tlsConfig: TlsConfig = {};
+
+      expect(tlsConfig.certFile).toBeUndefined();
+      expect(tlsConfig.keyFile).toBeUndefined();
+      expect(tlsConfig.sslCaCert).toBeUndefined();
+      expect(tlsConfig.assertHostname).toBeUndefined();
+    });
+
+    it("should accept TlsConfig in connection options", () => {
+      const tlsConfig: TlsConfig = {
+        certFile: "/path/to/cert.pem",
+        keyFile: "/path/to/key.pem",
+        sslCaCert: "/path/to/ca.pem",
+        assertHostname: false,
+      };
+
+      // Just verify that the ClientConfig accepts the TlsConfig
+      const clientConfig: ClientConfig = {
+        tlsConfig: tlsConfig,
+      };
+
+      const connectionOptions: ConnectionOptions = {
+        apiKey: "fake",
+        clientConfig: clientConfig,
+      };
+
+      // Verify the configuration structure is correct
+      expect(connectionOptions.clientConfig).toBeDefined();
+      expect(connectionOptions.clientConfig?.tlsConfig).toBeDefined();
+      expect(connectionOptions.clientConfig?.tlsConfig?.certFile).toBe(
+        "/path/to/cert.pem",
+      );
+    });
+  });
 });

nodejs/lancedb/index.ts

@@ -21,6 +21,7 @@ export {
   ClientConfig,
   TimeoutConfig,
   RetryConfig,
+  TlsConfig,
   OptimizeStats,
   CompactionStats,
   RemovalStats,

nodejs/src/remote.rs

@@ -69,6 +69,20 @@ pub struct RetryConfig {
     pub statuses: Option<Vec<u16>>,
 }
 
+/// TLS/mTLS configuration for the remote HTTP client.
+#[napi(object)]
+#[derive(Debug, Default)]
+pub struct TlsConfig {
+    /// Path to the client certificate file (PEM format) for mTLS authentication.
+    pub cert_file: Option<String>,
+    /// Path to the client private key file (PEM format) for mTLS authentication.
+    pub key_file: Option<String>,
+    /// Path to the CA certificate file (PEM format) for server verification.
+    pub ssl_ca_cert: Option<String>,
+    /// Whether to verify the hostname in the server's certificate.
+    pub assert_hostname: Option<bool>,
+}
+
 #[napi(object)]
 #[derive(Debug, Default)]
 pub struct ClientConfig {
@@ -77,6 +91,7 @@ pub struct ClientConfig {
     pub timeout_config: Option<TimeoutConfig>,
     pub extra_headers: Option<HashMap<String, String>>,
     pub id_delimiter: Option<String>,
+    pub tls_config: Option<TlsConfig>,
 }
 
 impl From<TimeoutConfig> for lancedb::remote::TimeoutConfig {
@@ -107,6 +122,17 @@ impl From<RetryConfig> for lancedb::remote::RetryConfig {
     }
 }
 
+impl From<TlsConfig> for lancedb::remote::TlsConfig {
+    fn from(config: TlsConfig) -> Self {
+        Self {
+            cert_file: config.cert_file,
+            key_file: config.key_file,
+            ssl_ca_cert: config.ssl_ca_cert,
+            assert_hostname: config.assert_hostname.unwrap_or(true),
+        }
+    }
+}
+
 impl From<ClientConfig> for lancedb::remote::ClientConfig {
     fn from(config: ClientConfig) -> Self {
         Self {
@@ -117,6 +143,7 @@ impl From<ClientConfig> for lancedb::remote::ClientConfig {
             timeout_config: config.timeout_config.map(Into::into).unwrap_or_default(),
             extra_headers: config.extra_headers.unwrap_or_default(),
             id_delimiter: config.id_delimiter,
+            tls_config: config.tls_config.map(Into::into),
         }
     }
 }