native-update/dist/esm/live-update/certificate-pinning.js

Foundation package for building a comprehensive update system for Capacitor apps. Provides architecture and interfaces but requires backend implementation.

/**
 * Certificate pinning utilities
 */
export class CertificatePinning {
    /**
     * Generate SHA-256 fingerprint from certificate
     * Note: This is a utility for generating pins, not for runtime validation
     */
    static async generateFingerprint(certificatePem) {
        // Remove PEM headers and convert to binary
        const base64 = certificatePem
            .replace(/-----BEGIN CERTIFICATE-----/g, '')
            .replace(/-----END CERTIFICATE-----/g, '')
            .replace(/\s/g, '');
        const binaryString = atob(base64);
        const bytes = new Uint8Array(binaryString.length);
        for (let i = 0; i < binaryString.length; i++) {
            bytes[i] = binaryString.charCodeAt(i);
        }
        // Calculate SHA-256
        const hashBuffer = await crypto.subtle.digest('SHA-256', bytes);
        const hashArray = Array.from(new Uint8Array(hashBuffer));
        const hashBase64 = btoa(String.fromCharCode(...hashArray));
        return `sha256/${hashBase64}`;
    }
    /**
     * Validate certificate pinning configuration
     */
    static validateConfig(config) {
        if (!config || typeof config !== 'object') {
            throw new Error('Certificate pinning config must be an object');
        }
        if (typeof config.enabled !== 'boolean') {
            throw new Error('Certificate pinning enabled must be a boolean');
        }
        if (!config.enabled) {
            return; // No need to validate pins if disabled
        }
        if (!Array.isArray(config.pins)) {
            throw new Error('Certificate pins must be an array');
        }
        for (const pin of config.pins) {
            if (!pin.hostname || typeof pin.hostname !== 'string') {
                throw new Error('Certificate pin hostname must be a non-empty string');
            }
            if (!Array.isArray(pin.sha256) || pin.sha256.length === 0) {
                throw new Error('Certificate pin sha256 must be a non-empty array');
            }
            for (const hash of pin.sha256) {
                if (!hash || typeof hash !== 'string' || !hash.startsWith('sha256/')) {
                    throw new Error('Certificate pin hash must be in format "sha256/base64hash"');
                }
            }
        }
    }
    /**
     * Example configuration
     */
    static example() {
        return {
            enabled: true,
            pins: [
                {
                    hostname: 'api.example.com',
                    sha256: [
                        'sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=',
                        'sha256/BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=', // Backup pin
                    ],
                },
                {
                    hostname: 'cdn.example.com',
                    sha256: ['sha256/CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC='],
                },
            ],
        };
    }
}
//# sourceMappingURL=certificate-pinning.js.map