[luis-alvarez]

Fixes #1332.

Context

I read on a jailbroken Kindle with KOReader and reach my CWA server privately over Tailscale; the server isn't exposed to the internet. The Kindle's kernel has no TUN device, so Tailscale can only run in userspace mode, and KOReader gets onto the tailnet through Tailscale's local HTTP proxy. With that setup, OPDS browsing and downloads from CWA work, but CWA Progress Sync can't log in. #1332 reports the same thing on a Kindle PW3.

Problem

On a Kindle without kernel TUN, Tailscale runs in userspace mode (e.g. via koreader-tailscale or tailscale_kual), and KOReader reaches the tailnet only through tailscaled's local HTTP proxy, set as KOReader's proxy (Settings → Network → Proxy). OPDS works through it, but CWA Progress Sync fails to log in with "Unknown server error", and nothing reaches the server.

The cause is in the HTTP stack, not the server:

• KOReader's proxy setting is luasocket's global http.PROXY (NetworkMgr:setHTTPProxy).
• CWASyncClient uses lua-Spore, which sends https:// URLs through luasec's ssl.https.request. That returns nil, "proxy not supported" whenever http.PROXY is set (luasec src/https.lua), before any socket is opened. With no response body, the plugin falls back to "Unknown server error".
• The OPDS browser instead calls socket.http.request with the https:// URL. Under a proxy, luasocket sends the absolute URL to the proxy, which makes the TLS connection. That's why OPDS works on the same device.

The reporter of #1332 got around it by replacing KOReader's common/ssl/https.lua with a patched luasec, which changes every HTTPS request in KOReader. This PR fixes it inside the plugin instead.

Change

CWASyncClient.lua gets a small Spore middleware, ProxiedHTTPS, enabled for authorize, update_progress and get_progress. It acts only when a proxy is set and the URL is https://: it finalizes the request and sends it with socket.http.request, then returns the response table, which short-circuits Spore's own request. Format.JSON still decodes the body. In every other case it returns nil and Spore's normal path runs unchanged, so setups without a proxy are unaffected.

Security is the same as OPDS's through a proxy: the request is plain HTTP only between KOReader and the local proxy, and the proxy makes the TLS connection to the server.

Testing

On a Kindle with KOReader, koreader-tailscale in userspace mode with its HTTP proxy set in KOReader, and CWA v4.0.8 reached at its https:// tailnet name:

• before: login → "Unknown server error"; no /kosync request reached the server (checked with a capture between Tailscale Serve and CWA)
• after: login succeeds, and progress pushes and pulls

Not tested: a setup without a proxy, where the middleware returns nil and the code path is unchanged.