@thelacanians/vue-native-cli 0.4.2 → 0.4.4

package/native/ios/VueNativeCore/Sources/VueNativeCore/Bridge/CertificatePinning.swift

@@ -0,0 +1,132 @@
+#if canImport(UIKit)
+import Foundation
+import CommonCrypto
+
+/// Manages certificate pinning for network requests.
+/// Stores SHA-256 pin hashes per domain and provides a URLSession with
+/// a delegate that validates server certificates against the pinned hashes.
+///
+/// Usage from JS (via the bridge):
+///   __VN_configurePins({ "api.example.com": ["sha256/BBBBBBB..."] })
+///
+/// The fetch polyfill uses `CertificatePinning.shared.session` instead of
+/// `URLSession.shared` when pins are configured for the request's host.
+public final class CertificatePinning: NSObject, URLSessionDelegate {
+
+    public static let shared = CertificatePinning()
+
+    /// Maps lowercase domain to an array of base64-encoded SHA-256 hashes of the
+    /// Subject Public Key Info (SPKI).
+    private var pins: [String: [String]] = [:]
+
+    /// A URLSession configured with this object as its delegate for TLS validation.
+    /// Lazily created so we don't pay the cost if pinning is never configured.
+    public private(set) lazy var session: URLSession = {
+        let config = URLSessionConfiguration.default
+        config.timeoutIntervalForRequest = 30
+        config.timeoutIntervalForResource = 60
+        return URLSession(configuration: config, delegate: self, delegateQueue: nil)
+    }()
+
+    private override init() {
+        super.init()
+    }
+
+    // MARK: - Configuration
+
+    /// Configure certificate pins for one or more domains.
+    /// Each pin string must be in the format "sha256/<base64-encoded-hash>".
+    ///
+    /// - Parameter domainPins: Dictionary mapping domain names to arrays of pin strings.
+    public func configurePins(_ domainPins: [String: [String]]) {
+        for (domain, pinList) in domainPins {
+            let hashes = pinList.compactMap { pin -> String? in
+                // Accept "sha256/XXXXX" format — strip the prefix
+                if pin.hasPrefix("sha256/") {
+                    return String(pin.dropFirst(7))
+                }
+                return nil
+            }
+            if !hashes.isEmpty {
+                pins[domain.lowercased()] = hashes
+            }
+        }
+    }
+
+    /// Returns true if there are pins configured for the given host.
+    public func hasPins(for host: String) -> Bool {
+        return pins[host.lowercased()] != nil
+    }
+
+    /// Remove all configured pins.
+    public func clearPins() {
+        pins.removeAll()
+    }
+
+    // MARK: - URLSessionDelegate
+
+    public func urlSession(
+        _ session: URLSession,
+        didReceive challenge: URLAuthenticationChallenge,
+        completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void
+    ) {
+        guard challenge.protectionSpace.authenticationMethod == NSURLAuthenticationMethodServerTrust,
+              let serverTrust = challenge.protectionSpace.serverTrust else {
+            completionHandler(.performDefaultHandling, nil)
+            return
+        }
+
+        let host = challenge.protectionSpace.host.lowercased()
+
+        // If no pins configured for this host, use default handling
+        guard let expectedPins = pins[host] else {
+            completionHandler(.performDefaultHandling, nil)
+            return
+        }
+
+        // Evaluate the server trust
+        var error: CFError?
+        guard SecTrustEvaluateWithError(serverTrust, &error) else {
+            NSLog("[VueNative CertPin] Trust evaluation failed for %@: %@", host, error?.localizedDescription ?? "unknown")
+            completionHandler(.cancelAuthenticationChallenge, nil)
+            return
+        }
+
+        // Check each certificate in the chain against our pins
+        let certCount = SecTrustGetCertificateCount(serverTrust)
+        for i in 0..<certCount {
+            guard let cert = SecTrustCopyCertificateChain(serverTrust)?[i] else { continue }
+            guard let certificate = cert as? SecCertificate else { continue }
+            let spkiHash = sha256OfSPKI(for: certificate)
+            if expectedPins.contains(spkiHash) {
+                completionHandler(.useCredential, URLCredential(trust: serverTrust))
+                return
+            }
+        }
+
+        // No pin matched — reject the connection
+        NSLog("[VueNative CertPin] Pin validation failed for %@. No matching pin found.", host)
+        completionHandler(.cancelAuthenticationChallenge, nil)
+    }
+
+    // MARK: - SPKI Hashing
+
+    /// Compute the base64-encoded SHA-256 hash of a certificate's Subject Public Key Info.
+    private func sha256OfSPKI(for certificate: SecCertificate) -> String {
+        guard let publicKey = SecCertificateCopyKey(certificate) else { return "" }
+
+        var error: Unmanaged<CFError>?
+        guard let publicKeyData = SecKeyCopyExternalRepresentation(publicKey, &error) as Data? else {
+            return ""
+        }
+
+        // Hash the raw public key data with SHA-256
+        var hash = [UInt8](repeating: 0, count: Int(CC_SHA256_DIGEST_LENGTH))
+        publicKeyData.withUnsafeBytes { bytes in
+            _ = CC_SHA256(bytes.baseAddress, CC_LONG(publicKeyData.count), &hash)
+        }
+
+        return Data(hash).base64EncodedString()
+    }
+}
+#endif

package/native/ios/VueNativeCore/Sources/VueNativeCore/Bridge/ErrorOverlayView.swift

@@ -0,0 +1,92 @@
+#if canImport(UIKit)
+import UIKit
+
+/// Full-screen red error overlay shown in dev mode when a JS exception occurs.
+@MainActor
+final class ErrorOverlayView: UIView {
+
+    private let containerView = UIView()
+    private let titleLabel = UILabel()
+    private let messageLabel = UILabel()
+    private let dismissButton = UIButton(type: .system)
+    private let scrollView = UIScrollView()
+
+    override init(frame: CGRect) {
+        super.init(frame: frame)
+        setupUI()
+    }
+
+    required init?(coder: NSCoder) { fatalError() }
+
+    private func setupUI() {
+        backgroundColor = UIColor(red: 0.8, green: 0.1, blue: 0.1, alpha: 0.95)
+
+        titleLabel.text = "JavaScript Error"
+        titleLabel.textColor = .white
+        titleLabel.font = .systemFont(ofSize: 20, weight: .bold)
+        titleLabel.textAlignment = .center
+
+        messageLabel.textColor = .white
+        messageLabel.font = .monospacedSystemFont(ofSize: 13, weight: .regular)
+        messageLabel.numberOfLines = 0
+        messageLabel.textAlignment = .left
+
+        dismissButton.setTitle("Dismiss", for: .normal)
+        dismissButton.setTitleColor(.white, for: .normal)
+        dismissButton.backgroundColor = UIColor(white: 1, alpha: 0.2)
+        dismissButton.layer.cornerRadius = 8
+        dismissButton.addTarget(self, action: #selector(dismiss), for: .touchUpInside)
+
+        scrollView.addSubview(messageLabel)
+        addSubview(titleLabel)
+        addSubview(scrollView)
+        addSubview(dismissButton)
+    }
+
+    func show(error: String, in window: UIWindow) {
+        messageLabel.text = error
+        frame = window.bounds
+
+        let padding: CGFloat = 20
+        let topPadding = window.safeAreaInsets.top + 20
+
+        titleLabel.frame = CGRect(x: padding, y: topPadding, width: bounds.width - padding * 2, height: 30)
+        dismissButton.frame = CGRect(
+            x: padding,
+            y: bounds.height - 60 - window.safeAreaInsets.bottom,
+            width: bounds.width - padding * 2,
+            height: 44
+        )
+        scrollView.frame = CGRect(
+            x: padding,
+            y: topPadding + 40,
+            width: bounds.width - padding * 2,
+            height: dismissButton.frame.minY - topPadding - 50
+        )
+        messageLabel.frame = CGRect(x: 0, y: 0, width: scrollView.bounds.width, height: 0)
+        messageLabel.sizeToFit()
+        scrollView.contentSize = CGSize(width: scrollView.bounds.width, height: messageLabel.bounds.height)
+
+        window.addSubview(self)
+    }
+
+    @objc private func dismiss() {
+        removeFromSuperview()
+    }
+
+    static func show(error: String) {
+        DispatchQueue.main.async {
+            guard let window = UIApplication.shared.connectedScenes
+                .compactMap({ $0 as? UIWindowScene })
+                .flatMap({ $0.windows })
+                .first(where: { $0.isKeyWindow }) else { return }
+
+            // Remove any existing overlay
+            window.subviews.compactMap { $0 as? ErrorOverlayView }.forEach { $0.removeFromSuperview() }
+
+            let overlay = ErrorOverlayView(frame: window.bounds)
+            overlay.show(error: error, in: window)
+        }
+    }
+}
+#endif

package/native/ios/VueNativeCore/Sources/VueNativeCore/Bridge/HotReloadManager.swift

@@ -0,0 +1,147 @@
+#if canImport(UIKit)
+import Foundation
+import UIKit
+
+/// Manages a WebSocket connection to the Vue Native dev server for hot reload.
+/// When a new bundle is broadcast, triggers a full app reload via NativeBridge.
+///
+/// Usage in your app's root ViewController (debug builds only):
+/// ```swift
+/// #if DEBUG
+/// HotReloadManager.shared.connect(to: URL(string: "ws://localhost:8174")!)
+/// #endif
+/// ```
+public final class HotReloadManager: NSObject, URLSessionWebSocketDelegate {
+
+    public static let shared = HotReloadManager()
+
+    private var webSocketTask: URLSessionWebSocketTask?
+    private var session: URLSession?
+    private var serverURL: URL?
+    private var isConnecting = false
+
+    private override init() {
+        super.init()
+    }
+
+    // MARK: - Public API
+
+    /// Connect to the dev server. Safe to call multiple times.
+    public func connect(to url: URL) {
+        serverURL = url
+        scheduleConnect(delay: 0)
+    }
+
+    /// Disconnect and stop reconnecting.
+    public func disconnect() {
+        serverURL = nil
+        webSocketTask?.cancel(with: .goingAway, reason: nil)
+        webSocketTask = nil
+        session?.invalidateAndCancel()
+        session = nil
+        NSLog("[VueNative HotReload] Disconnected")
+    }
+
+    // MARK: - Connection
+
+    private func scheduleConnect(delay: TimeInterval) {
+        guard serverURL != nil, !isConnecting else { return }
+        isConnecting = true
+        DispatchQueue.main.asyncAfter(deadline: .now() + delay) { [weak self] in
+            self?.openConnection()
+        }
+    }
+
+    private func openConnection() {
+        guard let url = serverURL else {
+            isConnecting = false
+            return
+        }
+
+        // Create a fresh session each time to avoid stale state
+        session?.invalidateAndCancel()
+        let config = URLSessionConfiguration.default
+        config.timeoutIntervalForRequest = 5
+        session = URLSession(configuration: config, delegate: self, delegateQueue: .main)
+
+        webSocketTask = session?.webSocketTask(with: url)
+        webSocketTask?.resume()
+        NSLog("[VueNative HotReload] Connecting to \(url)...")
+        receiveNextMessage()
+    }
+
+    // MARK: - Message Handling
+
+    private func receiveNextMessage() {
+        webSocketTask?.receive { [weak self] result in
+            guard let self = self else { return }
+            switch result {
+            case .success(let message):
+                self.handleMessage(message)
+                self.receiveNextMessage()
+            case .failure(let error):
+                NSLog("[VueNative HotReload] Receive error: \(error.localizedDescription)")
+                self.scheduleReconnect()
+            }
+        }
+    }
+
+    private func handleMessage(_ message: URLSessionWebSocketTask.Message) {
+        let text: String
+        switch message {
+        case .string(let s): text = s
+        case .data(let d): text = String(data: d, encoding: .utf8) ?? ""
+        @unknown default: return
+        }
+
+        guard let data = text.data(using: .utf8),
+              let json = try? JSONSerialization.jsonObject(with: data) as? [String: Any],
+              let type = json["type"] as? String else {
+            return
+        }
+
+        switch type {
+        case "connected":
+            isConnecting = false
+            NSLog("[VueNative HotReload] Connected — hot reload active")
+
+        case "bundle":
+            guard let bundle = json["bundle"] as? String else { return }
+            NSLog("[VueNative HotReload] Received bundle (\(bundle.count) bytes) — reloading...")
+            DispatchQueue.main.async {
+                NativeBridge.shared.reloadWithBundle(bundle)
+            }
+
+        case "ping":
+            // Respond to keep-alive pings
+            let pong = "{\"type\":\"pong\"}"
+            webSocketTask?.send(.string(pong)) { _ in }
+
+        default:
+            break
+        }
+    }
+
+    // MARK: - Reconnection
+
+    private func scheduleReconnect() {
+        guard serverURL != nil else { return }
+        isConnecting = false
+        NSLog("[VueNative HotReload] Reconnecting in 2s...")
+        scheduleConnect(delay: 2.0)
+    }
+
+    // MARK: - URLSessionWebSocketDelegate
+
+    public func urlSession(_ session: URLSession, webSocketTask: URLSessionWebSocketTask,
+                           didOpenWithProtocol protocol: String?) {
+        NSLog("[VueNative HotReload] WebSocket opened")
+    }
+
+    public func urlSession(_ session: URLSession, webSocketTask: URLSessionWebSocketTask,
+                           didCloseWith closeCode: URLSessionWebSocketTask.CloseCode, reason: Data?) {
+        NSLog("[VueNative HotReload] WebSocket closed (code: \(closeCode.rawValue))")
+        scheduleReconnect()
+    }
+}
+#endif