@capgo/capacitor-ssl-pinning 8.1.6 → 8.1.8

package/README.md

@@ -54,7 +54,7 @@ const config: CapacitorConfig = {
       enabled: true,
     },
     SSLPinning: {
-      certs: ['sslCerts/production/primary.cer', 'sslCerts/production/backup.cer'],
+      certs: ['sslCerts/production/primary.cer', 'sslCerts/production/backup.der'],
       excludedDomains: ['https://analytics.google.com'],
     },
   },
@@ -63,7 +63,7 @@ const config: CapacitorConfig = {
 export default config;
 ```
 
-During `bunx cap sync`, the plugin copies the configured certificates into `webDir/certs`, which lets both native implementations load them from the bundled app assets.
+During `bunx cap sync`, the plugin copies the configured certificates into `webDir/certs`, which lets both native implementations load them from the bundled app assets. Both `.cer` and `.der` are supported; PEM `.cer` files are converted to DER automatically for iOS.
 
 ## Usage
 

package/android/src/main/java/io/ionic/sslpinning/CertificateLoader.java

@@ -3,6 +3,7 @@ package io.ionic.sslpinning;
 import android.content.Context;
 import com.getcapacitor.Bridge;
 import com.getcapacitor.PluginConfig;
+import java.io.FileNotFoundException;
 import java.io.InputStream;
 import java.net.URL;
 import java.security.KeyStore;
@@ -91,9 +92,43 @@ final class CertificateLoader {
 
     private static X509Certificate loadCertificate(final Context context, final String configuredCertPath) throws Exception {
         final String fileName = configuredCertPath.substring(configuredCertPath.lastIndexOf('/') + 1);
+        final String[] candidateFileNames = candidateFileNames(fileName);
+        final CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");
+
+        for (String candidateFileName : candidateFileNames) {
+            try (InputStream inputStream = context.getAssets().open(CERTS_DIR + "/" + candidateFileName)) {
+                return (X509Certificate) certificateFactory.generateCertificate(inputStream);
+            } catch (FileNotFoundException ignored) {
+                // Try alternate extension if available.
+            }
+        }
+
+        // Trigger the original exception message for easier debugging.
         try (InputStream inputStream = context.getAssets().open(CERTS_DIR + "/" + fileName)) {
-            final CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");
             return (X509Certificate) certificateFactory.generateCertificate(inputStream);
         }
     }
+
+    private static String[] candidateFileNames(final String fileName) {
+        if (fileName == null) {
+            return new String[0];
+        }
+
+        final int dotIndex = fileName.lastIndexOf('.');
+        if (dotIndex == -1) {
+            return new String[] { fileName };
+        }
+
+        final String base = fileName.substring(0, dotIndex);
+        final String ext = fileName.substring(dotIndex + 1).toLowerCase();
+
+        if ("cer".equals(ext)) {
+            return new String[] { fileName, base + ".der" };
+        }
+        if ("der".equals(ext)) {
+            return new String[] { fileName, base + ".cer" };
+        }
+
+        return new String[] { fileName };
+    }
 }

package/dist/esm/definitions.d.ts

@@ -33,6 +33,10 @@ export interface SSLPinningPluginConfig {
      *
      * During `bunx cap sync`, this plugin copies them into `webDir/certs` so native runtimes can load them from
      * the bundled web assets.
+     *
+     * Both `.cer` and `.der` filenames are supported. iOS requires DER-encoded X.509 certificates; when a
+     * certificate file is provided in PEM form (for example a `.cer` containing `-----BEGIN CERTIFICATE-----`),
+     * the sync hook converts it to DER while keeping the same filename.
      */
     certs?: string[];
     /**

package/dist/esm/definitions.js.map

@@ -1 +1 @@
-{"version":3,"file":"definitions.js","sourceRoot":"","sources":["../../src/definitions.ts"],"names":[],"mappings":"","sourcesContent":["/**\n * Plugin version payload.\n */\nexport interface PluginVersionResult {\n  /**\n   * Version identifier returned by the platform implementation.\n   */\n  version: string;\n}\n\n/**\n * Static SSL pinning configuration currently visible to the plugin.\n */\nexport interface SSLPinningConfigurationState {\n  /**\n   * Whether at least one certificate is configured for native pinning.\n   */\n  configured: boolean;\n\n  /**\n   * Certificate paths from `capacitor.config.*` relative to the app root.\n   */\n  certs: string[];\n\n  /**\n   * Fully-qualified URLs that should bypass SSL pinning.\n   */\n  excludedDomains: string[];\n}\n\n/**\n * Plugin configuration added under `plugins.SSLPinning` in `capacitor.config.*`.\n */\nexport interface SSLPinningPluginConfig {\n  /**\n   * Certificate files relative to the application root.\n   *\n   * During `bunx cap sync`, this plugin copies them into `webDir/certs` so native runtimes can load them from\n   * the bundled web assets.\n   */\n  certs?: string[];\n\n  /**\n   * Fully-qualified URLs that should bypass pinning.\n   *\n   * Match is done by origin, and by path-prefix when the configured URL contains a path.\n   */\n  excludedDomains?: string[];\n}\n\n/**\n * Capacitor API for inspecting SSL pinning configuration.\n *\n * Native enforcement is applied automatically to `CapacitorHttp` requests when:\n * 1. `plugins.CapacitorHttp.enabled` is `true`\n * 2. `plugins.SSLPinning.certs` contains at least one certificate\n */\nexport interface SSLPinningPlugin {\n  /**\n   * Returns the active native configuration visible to the plugin.\n   */\n  getConfiguration(): Promise<SSLPinningConfigurationState>;\n\n  /**\n   * Returns the native implementation version marker.\n   */\n  getPluginVersion(): Promise<PluginVersionResult>;\n}\n"]}
+{"version":3,"file":"definitions.js","sourceRoot":"","sources":["../../src/definitions.ts"],"names":[],"mappings":"","sourcesContent":["/**\n * Plugin version payload.\n */\nexport interface PluginVersionResult {\n  /**\n   * Version identifier returned by the platform implementation.\n   */\n  version: string;\n}\n\n/**\n * Static SSL pinning configuration currently visible to the plugin.\n */\nexport interface SSLPinningConfigurationState {\n  /**\n   * Whether at least one certificate is configured for native pinning.\n   */\n  configured: boolean;\n\n  /**\n   * Certificate paths from `capacitor.config.*` relative to the app root.\n   */\n  certs: string[];\n\n  /**\n   * Fully-qualified URLs that should bypass SSL pinning.\n   */\n  excludedDomains: string[];\n}\n\n/**\n * Plugin configuration added under `plugins.SSLPinning` in `capacitor.config.*`.\n */\nexport interface SSLPinningPluginConfig {\n  /**\n   * Certificate files relative to the application root.\n   *\n   * During `bunx cap sync`, this plugin copies them into `webDir/certs` so native runtimes can load them from\n   * the bundled web assets.\n   *\n   * Both `.cer` and `.der` filenames are supported. iOS requires DER-encoded X.509 certificates; when a\n   * certificate file is provided in PEM form (for example a `.cer` containing `-----BEGIN CERTIFICATE-----`),\n   * the sync hook converts it to DER while keeping the same filename.\n   */\n  certs?: string[];\n\n  /**\n   * Fully-qualified URLs that should bypass pinning.\n   *\n   * Match is done by origin, and by path-prefix when the configured URL contains a path.\n   */\n  excludedDomains?: string[];\n}\n\n/**\n * Capacitor API for inspecting SSL pinning configuration.\n *\n * Native enforcement is applied automatically to `CapacitorHttp` requests when:\n * 1. `plugins.CapacitorHttp.enabled` is `true`\n * 2. `plugins.SSLPinning.certs` contains at least one certificate\n */\nexport interface SSLPinningPlugin {\n  /**\n   * Returns the active native configuration visible to the plugin.\n   */\n  getConfiguration(): Promise<SSLPinningConfigurationState>;\n\n  /**\n   * Returns the native implementation version marker.\n   */\n  getPluginVersion(): Promise<PluginVersionResult>;\n}\n"]}

package/ios/Sources/SSLPinningPlugin/SSLPinningSupport.swift

@@ -85,8 +85,9 @@ final class SSLPinningCertificateStore {
 
     private func loadCertificate(from configuredPath: String) throws -> SecCertificate {
         let fileName = URL(fileURLWithPath: configuredPath).lastPathComponent
-        guard let resourceURL = Bundle.main.resourceURL?.appendingPathComponent("public/certs/\(fileName)"),
-              let certificateData = try? Data(contentsOf: resourceURL),
+        let candidateFileNames = SSLPinningCertificateStore.candidateFileNames(for: fileName)
+
+        guard let certificateData = SSLPinningCertificateStore.loadBundledCertificateData(candidateFileNames: candidateFileNames),
               let certificate = SecCertificateCreateWithData(nil, certificateData as CFData)
         else {
             throw NSError(
@@ -98,6 +99,73 @@ final class SSLPinningCertificateStore {
 
         return certificate
     }
+
+    private static func candidateFileNames(for fileName: String) -> [String] {
+        var candidates = [fileName]
+        let url = URL(fileURLWithPath: fileName)
+        let ext = url.pathExtension.lowercased()
+        let base = url.deletingPathExtension().lastPathComponent
+
+        if ext == "cer" {
+            candidates.append("\(base).der")
+        } else if ext == "der" {
+            candidates.append("\(base).cer")
+        }
+
+        return candidates
+    }
+
+    private static func loadBundledCertificateData(candidateFileNames: [String]) -> Data? {
+        guard let resourceURL = Bundle.main.resourceURL else {
+            return nil
+        }
+
+        for fileName in candidateFileNames {
+            let candidateURL = resourceURL.appendingPathComponent("public/certs/\(fileName)")
+            guard let data = try? Data(contentsOf: candidateURL) else {
+                continue
+            }
+
+            if let decoded = decodePEMCertificateIfNeeded(data) {
+                return decoded
+            }
+
+            return data
+        }
+
+        return nil
+    }
+
+    private static func decodePEMCertificateIfNeeded(_ data: Data) -> Data? {
+        guard let text = String(data: data, encoding: .utf8),
+              text.contains("-----BEGIN CERTIFICATE-----")
+        else {
+            return nil
+        }
+
+        let beginMarker = "-----BEGIN CERTIFICATE-----"
+        let endMarker = "-----END CERTIFICATE-----"
+
+        guard let beginRange = text.range(of: beginMarker),
+              let endRange = text.range(of: endMarker, range: beginRange.upperBound..<text.endIndex)
+        else {
+            return nil
+        }
+
+        let base64Body = text[beginRange.upperBound..<endRange.lowerBound]
+            .replacingOccurrences(of: "\r", with: "")
+            .replacingOccurrences(of: "\n", with: "")
+            .replacingOccurrences(of: " ", with: "")
+            .replacingOccurrences(of: "\t", with: "")
+
+        guard let decoded = Data(base64Encoded: String(base64Body), options: [.ignoreUnknownCharacters]),
+              !decoded.isEmpty
+        else {
+            return nil
+        }
+
+        return decoded
+    }
 }
 
 enum SSLPinningTrustEvaluator {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capgo/capacitor-ssl-pinning",
-  "version": "8.1.6",
+  "version": "8.1.8",
   "description": "Capacitor SSL pinning plugin for Android and iOS that integrates with CapacitorHttp.",
   "main": "dist/plugin.cjs.js",
   "module": "dist/esm/index.js",
@@ -55,7 +55,8 @@
     "capacitor:sync:before": "bun run prepare:certs",
     "capacitor:update:before": "bun run prepare:certs",
     "example:install": "cd example-app && bun install --frozen-lockfile",
-    "example:build": "bun run build && cd example-app && bun install --frozen-lockfile && bun run build"
+    "example:build": "bun run build && cd example-app && bun install --frozen-lockfile && bun run build",
+    "changelog:ai": "node scripts/generate-ai-changelog.mjs"
   },
   "devDependencies": {
     "@capacitor/android": "^8.0.0",

package/scripts/generate-ai-changelog.mjs

@@ -0,0 +1,135 @@
+#!/usr/bin/env node
+/**
+ * Generate a release changelog with Cloudflare Workers AI in CI.
+ * Invoked from build.yml on tag releases via `bun run changelog:ai`.
+ */
+
+import { execFileSync } from 'node:child_process';
+import { appendFileSync } from 'node:fs';
+
+const DEFAULT_MODEL = '@cf/moonshotai/kimi-k2.7-code';
+
+function parseArgs(argv) {
+  const args = { fromTag: process.env.FROM_TAG, toTag: process.env.TO_TAG };
+  for (let i = 0; i < argv.length; i++) {
+    if (argv[i] === '--from-tag') args.fromTag = argv[++i];
+    if (argv[i] === '--to-tag') args.toTag = argv[++i];
+    if (argv[i] === '--model') args.model = argv[++i];
+  }
+  return args;
+}
+
+function git(args) {
+  return execFileSync('/usr/bin/git', args, { encoding: 'utf8' }).trim();
+}
+
+function resolveTags({ fromTag, toTag }) {
+  const currentTag =
+    toTag ??
+    (process.env.GITHUB_REF?.startsWith('refs/tags/') ? process.env.GITHUB_REF.replace('refs/tags/', '') : null);
+
+  if (!currentTag) {
+    throw new Error('Missing target tag. Set GITHUB_REF to refs/tags/<tag> or pass --to-tag.');
+  }
+
+  const previousTag = fromTag ?? git(['describe', '--tags', '--abbrev=0', `${currentTag}^`]);
+  return { previousTag, currentTag };
+}
+
+function buildPrompt(previousTag, currentTag) {
+  const commits = git(['log', `${previousTag}..${currentTag}`, '--pretty=format:%s']);
+  const diffLines = git(['diff', '--stat', `${previousTag}..${currentTag}`]).split('\n');
+  const diffStat = diffLines.at(-1)?.trim() ?? '';
+
+  return `You are a technical writer creating a changelog for a software project.
+
+There are changes in the git repository between two points:
+- From tag: ${previousTag}
+- To tag: ${currentTag}
+- Commits:
+${commits || '(none)'}
+- Diff summary: ${diffStat || '(no file changes)'}
+
+## Instructions:
+1. **Categorize changes** using standard changelog categories:
+   - **Added**: New features
+   - **Changed**: Changes in existing functionality
+   - **Deprecated**: Soon-to-be removed features
+   - **Removed**: Removed features
+   - **Fixed**: Bug fixes
+   - **Security**: Security improvements
+
+2. **Write clear, user-focused descriptions** that explain:
+   - What changed from a user's perspective
+   - Why it matters
+   - Any breaking changes or migration notes
+
+3. **Use consistent formatting**:
+   - Each item should be a concise bullet point
+   - Start with an action verb when possible
+   - Group related changes together
+
+4. **Focus on semantic meaning** rather than technical implementation details
+
+Output ONLY the changelog content in markdown format. Do NOT include any explanatory text, metadata, introductory phrases like "Based on the git analysis" or "Here's the changelog", or concluding remarks. Start IMMEDIATELY with the changelog categories and items (e.g., "## Added"). Do not include version numbers or dates. Do not preface your response with any text whatsoever.`;
+}
+
+async function generateChangelog(prompt, model) {
+  const accountId = process.env.CLOUDFLARE_ACCOUNT_ID;
+  const apiToken = process.env.CLOUDFLARE_API_TOKEN;
+
+  if (!accountId || !apiToken) {
+    throw new Error('CLOUDFLARE_ACCOUNT_ID and CLOUDFLARE_API_TOKEN are required.');
+  }
+
+  const url = `https://api.cloudflare.com/client/v4/accounts/${accountId}/ai/run/${model}`;
+  const response = await fetch(url, {
+    method: 'POST',
+    headers: {
+      Authorization: `Bearer ${apiToken}`,
+      'Content-Type': 'application/json',
+    },
+    body: JSON.stringify({
+      messages: [{ role: 'user', content: prompt }],
+    }),
+  });
+
+  const payload = await response.json();
+  if (!response.ok || !payload.success) {
+    throw new Error(`Cloudflare AI request failed with status ${response.status}`);
+  }
+
+  const content = payload.result?.choices?.[0]?.message?.content ?? payload.result?.response;
+  if (!content || typeof content !== 'string') {
+    throw new Error('Cloudflare AI returned an empty changelog response');
+  }
+
+  return content.trim();
+}
+
+function writeGithubOutput({ result, fromTag, toTag }) {
+  const outputFile = process.env.GITHUB_OUTPUT;
+  if (!outputFile) return;
+
+  const delimiter = `changelog_${Date.now()}`;
+  appendFileSync(outputFile, `result<<${delimiter}\n${result}\n${delimiter}\n`);
+  appendFileSync(outputFile, `from_tag=${fromTag}\n`);
+  appendFileSync(outputFile, `to_tag=${toTag}\n`);
+}
+
+const args = parseArgs(process.argv.slice(2));
+const model = args.model ?? process.env.CLOUDFLARE_AI_MODEL ?? DEFAULT_MODEL;
+const { previousTag, currentTag } = resolveTags(args);
+const prompt = buildPrompt(previousTag, currentTag);
+
+console.error(`Generating changelog with ${model}`);
+console.error(`Range: ${previousTag}..${currentTag}`);
+
+try {
+  const result = await generateChangelog(prompt, model);
+  writeGithubOutput({ result, fromTag: previousTag, toTag: currentTag });
+} catch (error) {
+  const message = error instanceof Error ? error.message : 'Unknown error';
+  console.error(`Changelog generation failed: ${message}`);
+  process.exit(1);
+}

package/scripts/prepare-certs.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { cp, mkdir, readdir, rm } from 'node:fs/promises';
+import { cp, mkdir, readdir, rm, readFile, writeFile } from 'node:fs/promises';
 import { basename, join, resolve } from 'node:path';
 
 const rootDir = process.env.CAPACITOR_ROOT_DIR;
@@ -12,6 +12,20 @@ const fail = (message) => {
   throw new Error(`[ssl-pinning] ${message}`);
 };
 
+const pemToDer = (pem) => {
+  const match = pem.match(/-----BEGIN CERTIFICATE-----([\s\S]*?)-----END CERTIFICATE-----/);
+  if (!match) {
+    return null;
+  }
+
+  const base64 = match[1].replace(/[\r\n\s]/g, '');
+  if (!base64) {
+    return null;
+  }
+
+  return Buffer.from(base64, 'base64');
+};
+
 if (!rootDir || !webDir || !configJson) {
   log('Capacitor hook environment not detected, skipping certificate preparation.');
   process.exit(0);
@@ -46,6 +60,19 @@ for (const existingEntry of await readdir(targetDir, { withFileTypes: true })) {
 }
 
 for (const { source, fileName } of sourceFiles) {
-  await cp(source, join(targetDir, fileName), { force: true });
+  const targetPath = join(targetDir, fileName);
+  const buffer = await readFile(source);
+  const head = buffer.subarray(0, 2048).toString('utf8');
+  if (head.includes('-----BEGIN CERTIFICATE-----')) {
+    const der = pemToDer(buffer.toString('utf8'));
+    if (!der || der.length === 0) {
+      fail(`Failed to decode PEM certificate ${fileName}.`);
+    }
+    await writeFile(targetPath, der);
+    log(`Converted PEM ${fileName} into DER at ${targetDir}`);
+    continue;
+  }
+
+  await cp(source, targetPath, { force: true });
   log(`Copied ${fileName} into ${targetDir}`);
 }