@onekeyfe/react-native-sni-connect 1.1.0 → 3.0.69

package/README.md

@@ -1,37 +1,62 @@
-# react-native-sni-connect
+# @onekeyfe/react-native-sni-connect
 
-onekey sni http client
+OneKey SNI HTTP client for React Native. Performs HTTPS requests to a caller-supplied
+IP address while preserving the original TLS SNI / `Host` of a hostname, so certificate
+chain and hostname verification are still enforced against the real hostname (not the IP).
+
+Backed by EMASCurl (libcurl) on iOS and OkHttp on Android.
 
 ## Installation
 
+This package is published as part of the OneKey `app-modules` workspace:
 
 ```sh
-npm install react-native-sni-connect
+yarn add @onekeyfe/react-native-sni-connect
 ```
 
+iOS: run `pod install`. Android autolinks.
 
 ## Usage
 
-
-```js
-import { multiply } from 'react-native-sni-connect';
-
-// ...
-
-const result = multiply(3, 7);
+```ts
+import {
+  request,
+  cancelRequest,
+  cancelAllRequests,
+  clearDNSCache,
+} from '@onekeyfe/react-native-sni-connect';
+
+const res = await request({
+  // requestId is optional; required only if you want to cancel the request.
+  requestId: 'health-check-1',
+  ip: '93.184.216.34', // must be a public IP literal (private/loopback/metadata are rejected)
+  hostname: 'example.com', // used for SNI, Host header and certificate validation
+  method: 'GET',
+  path: '/api/v1/ping', // relative path only — absolute URLs are rejected
+  headers: { 'Content-Type': 'application/json' },
+  timeout: 30_000,
+});
+
+console.log(res.status, res.headers, res.data);
+
+// Cancellation (requires requestId on the request)
+await cancelRequest('health-check-1');
+await cancelAllRequests();
+
+// Drop pinned-IP connections / cached clients
+await clearDNSCache();
 ```
 
+### Security notes
 
-## Contributing
-
-- [Development workflow](CONTRIBUTING.md#development-workflow)
-- [Sending a pull request](CONTRIBUTING.md#sending-a-pull-request)
-- [Code of conduct](CODE_OF_CONDUCT.md)
+- The request scheme is always `https` on port `443`; `path` cannot override scheme, host or port.
+- `ip` must be an IPv4/IPv6 literal that routes to a public destination; loopback, private,
+  link-local (incl. cloud metadata), CGNAT, multicast and reserved ranges are rejected.
+- Header names/values containing CR/LF/control characters are rejected; the `Host` header is
+  managed by the module.
+- Native logs go through OneKey's native logger (with sensitive-data redaction); there is no
+  JS log event channel.
 
 ## License
 
 MIT
-
----
-
-Made with [create-react-native-library](https://github.com/callstack/react-native-builder-bob)

package/SniConnect.podspec

@@ -11,7 +11,7 @@ Pod::Spec.new do |s|
   s.authors      = package["author"]
 
   s.platforms    = { :ios => min_ios_version_supported }
-  s.source       = { :git => "https://github.com/OneKeyHQ/react-native-sni-connect.git", :tag => "#{s.version}" }
+  s.source       = { :git => "https://github.com/OneKeyHQ/app-modules/react-native-sni-connect.git", :tag => "#{s.version}" }
 
   s.static_framework = true
 
@@ -24,7 +24,7 @@ Pod::Spec.new do |s|
   s.dependency 'React-jsi'
   s.dependency 'React-callinvoker'
   s.dependency 'React-Codegen'
-  s.dependency 'EMASCurl', '1.4.1'
+  s.dependency 'EMASCurl', '1.5.5'
 
   s.pod_target_xcconfig = {
     "HEADER_SEARCH_PATHS" => "\"$(PODS_ROOT)/Headers/Private/React-Core\"",

package/android/build.gradle

@@ -34,27 +34,6 @@ android {
     targetSdkVersion getExtOrIntegerDefault("targetSdkVersion")
   }
 
-  packagingOptions {
-    excludes = [
-      "META-INF",
-      "META-INF/**",
-      "**/libc++_shared.so",
-      "**/libfbjni.so",
-      "**/libjsi.so",
-      "**/libfolly_json.so",
-      "**/libfolly_runtime.so",
-      "**/libglog.so",
-      "**/libhermes.so",
-      "**/libhermes-executor-debug.so",
-      "**/libhermes_executor.so",
-      "**/libreactnative.so",
-      "**/libreactnativejni.so",
-      "**/libturbomodulejsijni.so",
-      "**/libreact_nativemodule_core.so",
-      "**/libjscexecutor.so"
-    ]
-  }
-
   buildFeatures {
     buildConfig true
   }

package/android/src/main/java/com/sniconnect/SniConnectLogger.kt

@@ -0,0 +1,55 @@
+package com.sniconnect
+
+/**
+ * Lightweight logging wrapper that dynamically dispatches to OneKeyLog.
+ * Uses reflection to avoid a hard dependency on the (nitro-based) native-logger
+ * module. Falls back to android.util.Log when OneKeyLog is not available.
+ *
+ * Mirrors iOS SniConnectLog and the existing BTLogger / SBLLogger.
+ */
+internal object SniConnectLogger {
+  private const val TAG = "SniConnect"
+
+  private val logClass: Class<*>? by lazy {
+    try {
+      Class.forName("com.margelo.nitro.nativelogger.OneKeyLog")
+    } catch (_: ClassNotFoundException) {
+      null
+    }
+  }
+
+  private val methods by lazy {
+    val cls = logClass ?: return@lazy null
+    mapOf(
+      "debug" to cls.getMethod("debug", String::class.java, String::class.java),
+      "info" to cls.getMethod("info", String::class.java, String::class.java),
+      "warn" to cls.getMethod("warn", String::class.java, String::class.java),
+      "error" to cls.getMethod("error", String::class.java, String::class.java),
+    )
+  }
+
+  @JvmStatic
+  fun debug(message: String) = log("debug", message, android.util.Log.DEBUG)
+
+  @JvmStatic
+  fun info(message: String) = log("info", message, android.util.Log.INFO)
+
+  @JvmStatic
+  fun warn(message: String) = log("warn", message, android.util.Log.WARN)
+
+  @JvmStatic
+  fun error(message: String) = log("error", message, android.util.Log.ERROR)
+
+  private fun log(level: String, message: String, androidLogLevel: Int) {
+    val method = methods?.get(level)
+    if (method != null) {
+      try {
+        method.invoke(null, TAG, message)
+        return
+      } catch (_: Exception) {
+        // Fall through to android.util.Log
+      }
+    }
+    android.util.Log.println(androidLogLevel, TAG, message)
+  }
+}

package/android/src/main/java/com/sniconnect/SniConnectModule.kt

@@ -1,16 +1,16 @@
 package com.sniconnect
 
-import android.util.Log
 import com.facebook.react.bridge.Arguments
 import com.facebook.react.bridge.Promise
 import com.facebook.react.bridge.ReactApplicationContext
 import com.facebook.react.bridge.ReactMethod
 import com.facebook.react.bridge.ReadableMap
 import com.facebook.react.bridge.WritableMap
-import com.facebook.react.modules.core.DeviceEventManagerModule
 import com.facebook.react.module.annotations.ReactModule
 import okhttp3.Call
 import okhttp3.Callback
+import okhttp3.ConnectionPool
+import okhttp3.Dispatcher
 import okhttp3.Dns
 import okhttp3.Headers
 import okhttp3.MediaType.Companion.toMediaTypeOrNull
@@ -21,10 +21,10 @@ import okhttp3.Response
 import okhttp3.ResponseBody
 import java.io.IOException
 import java.net.InetAddress
-import java.net.UnknownHostException
 import java.util.Locale
 import java.util.concurrent.ConcurrentHashMap
 import java.util.concurrent.TimeUnit
+import java.util.concurrent.atomic.AtomicBoolean
 import javax.net.ssl.HttpsURLConnection
 
 private const val TAG = "SniConnect"
@@ -35,65 +35,49 @@ class SniConnectModule(reactContext: ReactApplicationContext) :
 
   companion object {
     const val NAME = "SniConnect"
-    private const val EVENT_NAME = "SniConnectLog"
+
+    // Upper bound on cached OkHttpClient instances to prevent unbounded growth
+    // from JS-controlled host/IP pairs (e.g. speed-testing many endpoints).
+    private const val MAX_CLIENTS = 32
+
+    // A single dispatcher + connection pool shared across all cached clients so we
+    // don't spawn a thread pool / connection pool per (hostname, ip) pair.
+    private val sharedDispatcher = Dispatcher()
+    private val sharedConnectionPool = ConnectionPool()
   }
 
   /**
-   * Cache key for OkHttpClient instances
-   * Uses hostname:IP combination to ensure:
-   * - Different IPs for the same hostname are isolated (accurate speed testing)
-   * - Same hostname+IP combination can reuse connections (performance optimization)
-   * Note: timeout is NOT part of the key to allow connection reuse across different timeout values
+   * Cache key for OkHttpClient instances.
+   * Uses hostname:IP so different IPs for the same hostname stay isolated (accurate
+   * speed testing) while the same hostname+IP reuses connections. Timeout is NOT part
+   * of the key — it is applied per-call via `call.timeout()`.
    */
   private data class ClientKey(
     val hostname: String,
     val ip: String,
   )
 
-  private val clientCache = ConcurrentHashMap<ClientKey, OkHttpClient>()
-  private val activeCalls = ConcurrentHashMap<String, Call>()
-  private var listenerCount = 0
-
-  override fun getName(): String = NAME
-
-  // Event emitter methods required for NativeEventEmitter
-  @ReactMethod
-  override fun addListener(eventType: String) {
-    listenerCount += 1
-  }
-
-  @ReactMethod
-  override fun removeListeners(count: Double) {
-    listenerCount -= count.toInt()
-    if (listenerCount < 0) {
-      listenerCount = 0
+  // Bounded LRU: access-ordered, evicts the eldest client when capacity is exceeded.
+  // Idle connections are reclaimed by the shared ConnectionPool's own keep-alive, so
+  // we do NOT evictAll here (that pool is shared by every client). Synchronized because
+  // LinkedHashMap is not thread-safe.
+  private val clientCache = object : LinkedHashMap<ClientKey, OkHttpClient>(16, 0.75f, true) {
+    override fun removeEldestEntry(eldest: MutableMap.MutableEntry<ClientKey, OkHttpClient>): Boolean {
+      return size > MAX_CLIENTS
     }
   }
 
-  private fun sendLogEvent(level: String, message: String) {
-    if (listenerCount > 0) {
-      val logData = Arguments.createMap().apply {
-        putString("level", level)
-        putString("message", message)
-        putDouble("timestamp", System.currentTimeMillis().toDouble())
-      }
+  private val activeCalls = ConcurrentHashMap<String, Call>()
 
-      reactApplicationContext
-        .getJSModule(DeviceEventManagerModule.RCTDeviceEventEmitter::class.java)
-        ?.emit(EVENT_NAME, logData)
-    }
-  }
+  override fun getName(): String = NAME
 
   override fun request(config: ReadableMap, promise: Promise) {
     try {
       val requestConfig = config.toRequestConfig()
-      // Log module initialization
-      sendLogEvent("info", "SniConnect module initialized successfully")
       performRequest(requestConfig, promise)
     } catch (error: Exception) {
-      Log.e(TAG, "[SniConnect] Request failed", error)
-      sendLogEvent("error", "Config parsing failed: ${error.message}")
-      promise.reject("SNI_REQUEST_FAILED", error.message, error)
+      SniConnectLogger.error("Config parsing failed: ${error.message}")
+      promise.reject("SNI_INVALID_CONFIG", error.message, error)
     }
   }
 
@@ -102,38 +86,31 @@ class SniConnectModule(reactContext: ReactApplicationContext) :
     val call = activeCalls.remove(requestId)
     if (call != null) {
       call.cancel()
-      sendLogEvent("info", "Cancelled request: $requestId")
-      promise.resolve(Arguments.createMap().apply {
-        putBoolean("success", true)
-      })
+      SniConnectLogger.info("Cancelled request: $requestId")
+      promise.resolve(Arguments.createMap().apply { putBoolean("success", true) })
     } else {
-      sendLogEvent("info", "Request not found: $requestId")
-      promise.resolve(Arguments.createMap().apply {
-        putBoolean("success", false)
-      })
+      promise.resolve(Arguments.createMap().apply { putBoolean("success", false) })
     }
   }
 
   @ReactMethod
   override fun cancelAllRequests(promise: Promise) {
     val count = activeCalls.size
-    activeCalls.forEach { (_, call) ->
-      call.cancel()
-    }
+    activeCalls.forEach { (_, call) -> call.cancel() }
     activeCalls.clear()
-    sendLogEvent("info", "Cancelled $count active requests")
-    promise.resolve(Arguments.createMap().apply {
-      putBoolean("success", true)
-    })
+    SniConnectLogger.info("Cancelled $count active requests")
+    promise.resolve(Arguments.createMap().apply { putBoolean("success", true) })
   }
 
   @ReactMethod
   override fun clearDNSCache(promise: Promise) {
-    clientCache.clear()
-    sendLogEvent("info", "DNS cache cleared")
-    promise.resolve(Arguments.createMap().apply {
-      putBoolean("success", true)
-    })
+    synchronized(clientCache) {
+      clientCache.clear()
+    }
+    // Drop pinned-IP connections from the shared pool.
+    sharedConnectionPool.evictAll()
+    SniConnectLogger.info("DNS cache cleared")
+    promise.resolve(Arguments.createMap().apply { putBoolean("success", true) })
   }
 
   private fun performRequest(config: RequestConfig, promise: Promise) {
@@ -148,52 +125,55 @@ class SniConnectModule(reactContext: ReactApplicationContext) :
       // Register the call if requestId is provided
       config.requestId?.let { requestId ->
         activeCalls[requestId] = call
-        sendLogEvent("info", "Registered request: $requestId, total active: ${activeCalls.size}")
       }
 
+      // Guard against double-settling the promise (RN hard-crashes otherwise).
+      val settled = AtomicBoolean(false)
+
       call.enqueue(object : Callback {
         override fun onFailure(call: Call, e: IOException) {
-          // Unregister the call
           config.requestId?.let { activeCalls.remove(it) }
+          if (!settled.compareAndSet(false, true)) return
 
           if (call.isCanceled()) {
-            sendLogEvent("info", "Request cancelled")
             promise.reject("SNI_CANCELLED", "Request cancelled", null)
           } else {
-            Log.e(TAG, "[SniConnect] Request failed", e)
-            sendLogEvent("error", "Request failed: ${e.message}")
+            SniConnectLogger.error("Request failed: ${e.message}")
             promise.reject("SNI_REQUEST_FAILED", e.message, e)
           }
         }
 
         override fun onResponse(call: Call, response: Response) {
-          // Unregister the call
           config.requestId?.let { activeCalls.remove(it) }
 
-          try {
+          val result: WritableMap = try {
             response.use {
               val bodyString = response.body.safeString()
               val headerMap = headersToMap(response.headers)
-
-              val result: WritableMap = Arguments.createMap().apply {
+              Arguments.createMap().apply {
                 putString("data", bodyString)
                 putInt("status", response.code)
                 putString("statusText", response.message)
                 putMap("headers", headerMap.toWritableMap())
               }
-
-              promise.resolve(result)
             }
           } catch (error: Exception) {
-            Log.e(TAG, "[SniConnect] Response processing failed", error)
-            sendLogEvent("error", "Response processing failed: ${error.message}")
+            if (!settled.compareAndSet(false, true)) return
+            SniConnectLogger.error("Response processing failed: ${error.message}")
             promise.reject("SNI_RESPONSE_FAILED", error.message, error)
+            return
+          }
+
+          if (response.code >= 400) {
+            SniConnectLogger.warn("HTTP ${response.code} for ${config.hostname}")
+          }
+          if (settled.compareAndSet(false, true)) {
+            promise.resolve(result)
           }
         }
       })
     } catch (error: Exception) {
-      Log.e(TAG, "[SniConnect] Request setup failed", error)
-      sendLogEvent("error", "Request setup failed: ${error.message}")
+      SniConnectLogger.error("Request setup failed: ${error.message}")
       promise.reject("SNI_REQUEST_FAILED", error.message, error)
     }
   }
@@ -202,47 +182,54 @@ class SniConnectModule(reactContext: ReactApplicationContext) :
     val normalizedHost = config.hostname.lowercase(Locale.US)
     val key = ClientKey(normalizedHost, config.ip)
 
-    return clientCache.getOrPut(key) {
-      // Note: timeout is not part of the cache key to allow connection reuse
-      // Use reasonable default timeouts for the client
-      // Per-request timeout is applied via call.timeout() in performRequest
-      val defaultTimeout = 60_000L // 60 seconds
+    synchronized(clientCache) {
+      clientCache[key]?.let { return it }
+
+      // 60s defaults at the client level; the real deadline is the per-call timeout.
+      val defaultTimeout = 60_000L
 
-      OkHttpClient.Builder()
+      val client = OkHttpClient.Builder()
+        .dispatcher(sharedDispatcher)
+        .connectionPool(sharedConnectionPool)
         .connectTimeout(defaultTimeout, TimeUnit.MILLISECONDS)
         .readTimeout(defaultTimeout, TimeUnit.MILLISECONDS)
         .writeTimeout(defaultTimeout, TimeUnit.MILLISECONDS)
-        .callTimeout(0, TimeUnit.MILLISECONDS) // Disable client-level call timeout
+        .callTimeout(0, TimeUnit.MILLISECONDS)
+        // TLS is validated normally: cert chain via the default trust manager and
+        // hostname verification against the REAL hostname (not the pinned IP).
         .hostnameVerifier { _, session ->
           HttpsURLConnection.getDefaultHostnameVerifier().verify(config.hostname, session)
         }
         .dns(createPinnedDns(config.ip, config.hostname))
         .build()
+
+      clientCache[key] = client
+      return client
     }
   }
 
   private fun createPinnedDns(ip: String, hostname: String): Dns =
     object : Dns {
       private val expectedHost = hostname.lowercase(Locale.US)
+      // Resolve the literal IP once up front (validated; never triggers DNS).
+      private val pinnedAddress: InetAddress = SniConnectValidation.literalToInetAddress(ip)
 
       override fun lookup(requestedHost: String): List<InetAddress> {
         return if (requestedHost.lowercase(Locale.US) == expectedHost) {
-          listOf(resolveIp(ip))
+          listOf(pinnedAddress)
         } else {
           Dns.SYSTEM.lookup(requestedHost)
         }
       }
     }
 
+  /**
+   * Build the request. Always `https://<hostname><path>` on the implicit port 443 —
+   * `path` has been validated as relative, so scheme/host/port cannot be overridden.
+   */
   private fun buildRequest(config: RequestConfig): Request {
-    val normalizedPath = if (config.path.startsWith("http")) {
-      config.path
-    } else {
-      val prefix = if (config.path.startsWith("/")) "" else "/"
-      "https://${config.hostname}$prefix${config.path}"
-    }
-
-    val builder = Request.Builder().url(normalizedPath)
+    val url = "https://${config.hostname}${config.path}"
+    val builder = Request.Builder().url(url)
 
     config.headers.forEach { (key, value) ->
       if (!key.equals("host", ignoreCase = true)) {
@@ -251,7 +238,7 @@ class SniConnectModule(reactContext: ReactApplicationContext) :
     }
     builder.header("Host", config.hostname)
 
-    val method = config.method.uppercase(Locale.US)
+    val method = config.method
     val bodyContent = config.body ?: ""
     val mediaType = config.headers.entries
       .firstOrNull { it.key.equals("Content-Type", ignoreCase = true) }
@@ -278,13 +265,10 @@ class SniConnectModule(reactContext: ReactApplicationContext) :
   }
 
   private fun ResponseBody?.safeString(): String {
-    if (this == null) {
-      return ""
-    }
+    if (this == null) return ""
     return try {
       this.string()
     } catch (error: IOException) {
-      Log.e(TAG, "[SniConnect] Failed to read response body", error)
       throw IOException("Failed to read response body", error)
     }
   }
@@ -297,50 +281,47 @@ class SniConnectModule(reactContext: ReactApplicationContext) :
     return map
   }
 
-  private fun resolveIp(ip: String): InetAddress {
-    return try {
-      InetAddress.getByName(ip)
-    } catch (error: UnknownHostException) {
-      throw IOException("Invalid IP address: $ip", error)
-    }
-  }
-
   private fun Map<String, String>.toWritableMap(): WritableMap {
     return Arguments.createMap().apply {
-      forEach { (key, value) ->
-        putString(key, value)
-      }
+      forEach { (key, value) -> putString(key, value) }
     }
   }
 
   private fun ReadableMap.toRequestConfig(): RequestConfig {
     val headersMap = if (hasKey("headers") && !isNull("headers")) {
-      val headersReadable = getMap("headers")
-      headersReadable?.toHashMap()
+      getMap("headers")?.toHashMap()
         ?.mapValues { (_, value) -> value?.toString() ?: "" }
         ?: emptyMap()
     } else {
       emptyMap()
     }
 
-    val timeoutMillis = if (hasKey("timeout")) {
-      (getDouble("timeout") * 1.0).toLong()
+    val timeoutMillis = if (hasKey("timeout") && !isNull("timeout")) {
+      getDouble("timeout").toLong().coerceAtLeast(1L)
     } else {
       30_000L
     }
 
-    val requestId = if (hasKey("requestId") && !isNull("requestId")) {
-      getString("requestId")
-    } else {
-      null
-    }
+    val requestId = if (hasKey("requestId") && !isNull("requestId")) getString("requestId") else null
+
+    val ip = getString("ip") ?: throw IllegalArgumentException("ip is required")
+    val hostname = getString("hostname") ?: throw IllegalArgumentException("hostname is required")
+    val method = getString("method") ?: "GET"
+    val path = getString("path") ?: "/"
+
+    // Validate every caller-controlled field at the boundary.
+    SniConnectValidation.validatePublicIp(ip)
+    SniConnectValidation.validateHostname(hostname)
+    SniConnectValidation.validateHeaders(headersMap)
+    val normalizedMethod = SniConnectValidation.normalizeMethod(method)
+    val normalizedPath = SniConnectValidation.normalizePath(path)
 
     return RequestConfig(
       requestId = requestId,
-      ip = getString("ip") ?: throw IllegalArgumentException("ip is required"),
-      hostname = getString("hostname") ?: throw IllegalArgumentException("hostname is required"),
-      method = getString("method") ?: "GET",
-      path = getString("path") ?: "/",
+      ip = ip,
+      hostname = hostname,
+      method = normalizedMethod,
+      path = normalizedPath,
       headers = headersMap,
       body = if (hasKey("body") && !isNull("body")) getString("body") else null,
       timeoutMillis = timeoutMillis,