@umutcansu/react-native-pinvault 2.3.2 → 2.4.0

package/android/src/main/java/io/github/umutcansu/pinvault/reactnative/PinVaultModule.kt

@@ -103,6 +103,7 @@ class PinVaultModule(reactContext: ReactApplicationContext) : NativePinVaultSpec
                         listener = connectionListener,
                         native = NativeSecurity.load(app),
                         release = NativeSecurity.isReleaseBuild(app),
+                        noFileAllowed = NativeSecurity.noFileAllowed(app),
                     )
                 } catch (e: IllegalArgumentException) {
                     // The guard of the running config stays: a refused config changes nothing.
@@ -119,7 +120,9 @@ class PinVaultModule(reactContext: ReactApplicationContext) : NativePinVaultSpec
                         )
                         return@launch
                     }
-                    if (parsed.pinGlobalNetworking) PinVaultNetworking.install(app)
+                    // Installed here only when the plugin's provider was removed and the app did not
+                    // install it before React Native started: marked late (HookStatus.installedLate).
+                    if (parsed.pinGlobalNetworking && !PinVaultNetworking.isInstalled) PinVaultNetworking.install(app, late = true)
                     val hooks = PinVaultNetworking.warnIfNotPinned("PinVault.start")
                     if (parsed.networking.requirePinned && !hooks.pinned) {
                         promise.reject(E_NETWORKING_NOT_PINNED, "requirePinnedReactNativeNetworking: ${hooks.describe()}")
@@ -142,7 +145,8 @@ class PinVaultModule(reactContext: ReactApplicationContext) : NativePinVaultSpec
                             // Setup failed (InitResult.Failed): RN's https stays refused.
                         }
                     }
-                    promise.resolve(toBridge(mapper.init(result)))
+                    // Says whether the anchors came from the native security file (README "Native security file").
+                    promise.resolve(toBridge(mapper.init(result) + ("nativeSecurityApplied" to parsed.nativeSecurityApplied)))
                 } catch (e: Exception) {
                     promise.reject(E_NATIVE, tokens.redact("${e.javaClass.simpleName}: ${e.message}"), exceptionInfo(e))
                 }
@@ -337,8 +341,11 @@ class PinVaultModule(reactContext: ReactApplicationContext) : NativePinVaultSpec
         guard?.answer(requestId, allowed)
     }
 
+    /** A vault file key: the library's rule (it names the stored copy's file). */
     private fun checkKey(key: String) {
-        if (key.isEmpty() || key.length > 128) throw BridgeInputException("key: must be 1 to 128 characters")
+        if (!VAULT_KEY.matches(key) || key.all { it == '.' }) {
+            throw BridgeInputException("key: must match [A-Za-z0-9._-]{1,64} and not be only dots")
+        }
     }
 
     private fun rejectNow(promise: Promise, code: String, message: String): Nothing {
@@ -408,3 +415,5 @@ class PinVaultModule(reactContext: ReactApplicationContext) : NativePinVaultSpec
         }
     }
 }
+
+private val VAULT_KEY = Regex("^[A-Za-z0-9._-]{1,64}$")

package/android/src/main/java/io/github/umutcansu/pinvault/reactnative/PinVaultNetworking.kt

@@ -73,15 +73,19 @@ object PinVaultNetworking {
 
     /** The two hooks this object installed; compared by identity in [status]. */
     private val factory = OkHttpClientFactory {
-        pinning.configureLongLived(OkHttpClientProvider.createClientBuilder()).build()
+        pinning.track(pinning.configureLongLived(OkHttpClientProvider.createClientBuilder()).build())
     }
     private val clientBuilder = CustomClientBuilder { builder -> pinning.configurePerRequest(builder) }
 
     internal val pinning = NetworkPinning(
         applier = { builder -> PinVault.applyTo(builder) },
         httpCache = { app?.let { ReactHttpCache.get(it) } },
+        hooksPinned = { status().pinned },
     )
 
+    /** True when [install] ran only from `start()`: React Native may have built clients before it. */
+    @Volatile private var installedLate = false
+
     /**
      * Installs both hooks (once per process). The plugin's content provider
      * calls it before `Application.onCreate`; call it yourself in
@@ -90,12 +94,17 @@ object PinVaultNetworking {
      */
     @JvmStatic
     @Synchronized
-    fun install(context: Context) {
+    fun install(context: Context) = install(context, late = false)
+
+    /** [late]: called from `start()`, after React Native may already have built its clients. */
+    @Synchronized
+    internal fun install(context: Context, late: Boolean) {
         if (installed) return
         app = context.applicationContext
         OkHttpClientProvider.setOkHttpClientFactory(factory)
         NetworkingModule.setCustomClientBuilder(clientBuilder)
         installed = true
+        installedLate = late
     }
 
     @JvmStatic
@@ -103,7 +112,7 @@ object PinVaultNetworking {
 
     /** Whether React Native's two networking hooks are still the ones [install] set. */
     @JvmStatic
-    fun status(): HookStatus = HookStatus.read(installed, factory, clientBuilder)
+    fun status(): HookStatus = HookStatus.read(installed, factory, clientBuilder, installedLate)
 
     private val warned = java.util.concurrent.atomic.AtomicReference<HookStatus?>(null)
 
@@ -126,11 +135,16 @@ data class HookStatus(
     val factoryIsPinVault: Boolean?,
     /** `NetworkingModule`'s custom client builder is PinVault's. */
     val clientBuilderIsPinVault: Boolean?,
+    /** Installed only by `start()`: clients React Native built before (Fresco's, among them) keep the system's trust. */
+    val installedLate: Boolean = false,
 ) {
-    val pinned: Boolean get() = installed && factoryIsPinVault == true && clientBuilderIsPinVault == true
+    val pinned: Boolean get() = installed && !installedLate && factoryIsPinVault == true && clientBuilderIsPinVault == true
 
     fun describe(): String = when {
         pinned -> "React Native's networking is pinned by PinVault"
+        installed && installedLate -> "React Native's networking hooks were installed only by start() (the plugin's content provider " +
+            "was removed and PinVaultNetworking.install was not called before React Native started): clients it built " +
+            "before, such as the image client, are NOT pinned"
         !installed -> "React Native's networking hooks are not installed (the plugin's content provider was removed " +
             "and PinVaultNetworking.install was not called, or android.pinGlobalNetworking is false): " +
             "RN fetch / XHR / WebSocket / images are NOT pinned"
@@ -141,10 +155,11 @@ data class HookStatus(
     }
 
     internal companion object {
-        fun read(installed: Boolean, ourFactory: Any, ourBuilder: Any): HookStatus = HookStatus(
+        fun read(installed: Boolean, ourFactory: Any, ourBuilder: Any, installedLate: Boolean = false): HookStatus = HookStatus(
             installed,
             isOurs(OkHttpClientProvider::class.java, "factory", ourFactory),
             isOurs(NetworkingModule::class.java, "customClientBuilder", ourBuilder),
+            installedLate,
         )
 
         /**
@@ -199,8 +214,30 @@ internal object ReactHttpCache {
 internal class NetworkPinning(
     private val applier: (OkHttpClient.Builder) -> Unit,
     private val httpCache: () -> Cache? = { null },
+    /** Whether React Native's hooks are still PinVault's (``PinVaultNetworking.status``). */
+    private val hooksPinned: () -> Boolean = { true },
 ) {
 
+    /** The long-lived clients React Native built through the factory: their pools are emptied on every change. */
+    private val longLived = java.util.Collections.synchronizedList(mutableListOf<java.lang.ref.WeakReference<OkHttpClient>>())
+
+    /** Last answer of [hooksPinned] and when it was read (reflection: not on every request). */
+    @Volatile private var hooksCheckedAt = 0L
+    @Volatile private var hooksWerePinned = true
+
+    fun track(client: OkHttpClient): OkHttpClient {
+        longLived.add(java.lang.ref.WeakReference(client))
+        return client
+    }
+
+    /** Closes the idle pooled connections of every long-lived client: the next request makes a fresh, pinned handshake. */
+    private fun evictLongLived() {
+        synchronized(longLived) {
+            longLived.removeAll { it.get() == null }
+            longLived.forEach { it.get()?.connectionPool?.evictAll() }
+        }
+    }
+
     /** A client `PinVault.applyTo` configured after the last `start()`; null = not started. */
     @Volatile private var template: OkHttpClient? = null
     @Volatile var options: NetworkingOptions = NetworkingOptions()
@@ -212,11 +249,13 @@ internal class NetworkPinning(
     fun activate(options: NetworkingOptions = this.options) {
         this.options = options
         template = OkHttpClient.Builder().also(applier).build()
+        evictLongLived()
     }
 
     @Synchronized
     fun deactivate() {
         template = null
+        evictLongLived()
     }
 
     /** NetworkingModule's per-request builder (fetch / XHR). */
@@ -247,18 +286,62 @@ internal class NetworkPinning(
         val forwarding = ForwardingSocketFactory { template?.sslSocketFactory }
         builder.sslSocketFactory(forwarding, ForwardingTrustManager { template?.x509TrustManager })
         builder.addInterceptor(httpsGate)
+        // The current start's network interceptors (the per-request pin check of a pooled
+        // or coalesced connection, among them) run for these clients too.
+        builder.addNetworkInterceptor(forwardingNetwork)
         builder.cache(null)
         builder.followSslRedirects(false)
         return builder
     }
 
-    /** Refuses `https` while PinVault has not started. */
+    /**
+     * Refuses `https` while PinVault has not started, and — with
+     * `requirePinnedReactNativeNetworking` — once another library has replaced
+     * React Native's hooks after start (checked at most every few seconds).
+     */
     private val httpsGate = Interceptor { chain ->
-        if (chain.request().isHttps && template == null) {
-            throw IOException("PinVault has not started: https requests are refused until start() returns")
+        if (chain.request().isHttps) {
+            if (template == null) throw IOException("PinVault has not started: https requests are refused until start() returns")
+            if (options.requirePinned && !hooksStillPinned()) {
+                throw IOException("requirePinnedReactNativeNetworking: React Native's networking hooks are no longer PinVault's")
+            }
         }
         chain.proceed(chain.request())
     }
+
+    private fun hooksStillPinned(): Boolean {
+        val now = android.os.SystemClock.elapsedRealtime()
+        if (now - hooksCheckedAt > HOOK_CHECK_MS) {
+            hooksWerePinned = hooksPinned()
+            hooksCheckedAt = now
+        }
+        return hooksWerePinned
+    }
+
+    /** Runs the current start's network interceptors in order, then the request. */
+    private val forwardingNetwork = Interceptor { chain ->
+        val interceptors = template?.networkInterceptors ?: emptyList()
+        ForwardingChain(chain, interceptors, 0).proceed(chain.request())
+    }
+
+    companion object {
+        const val HOOK_CHECK_MS = 5_000L
+    }
+}
+
+/** A chain that hands the request to `interceptors[index]`, …, and finally to the real chain. */
+internal class ForwardingChain(
+    private val base: Interceptor.Chain,
+    private val interceptors: List<Interceptor>,
+    private val index: Int,
+) : Interceptor.Chain by base {
+    override fun proceed(request: okhttp3.Request): okhttp3.Response =
+        if (index >= interceptors.size) base.proceed(request)
+        else interceptors[index].intercept(ForwardingChain(base, interceptors, index + 1).withRequest(request))
+
+    private var current: okhttp3.Request = base.request()
+    private fun withRequest(request: okhttp3.Request) = also { current = request }
+    override fun request(): okhttp3.Request = current
 }
 
 /** Hands every socket to the pinned factory of the current start; none before `start()`. */

package/ios/Core/ConfigParser.swift

@@ -30,23 +30,38 @@ public enum ConfigParser {
 
     /// - Parameters:
     ///   - native: the app's native security file (``NativeSecurity``); nil = none.
-    ///   - release: a release build: without a native file, the relaxations (`allowUnsigned`, …) are refused from JS.
+    ///   - release: a release build: without a native file, a config with Config APIs or static
+    ///     pins is refused (unless `noFileAllowed`) and the relaxations (`allowUnsigned`, …) are
+    ///     refused from JS; `expiredConfigGrace` is capped.
+    ///   - noFileAllowed: the app's Info.plist accepts a release start without the file (``NativeSecurity/noFileInfoKey``).
     public static func parse(
         _ json: String,
         tokens: VaultTokenStore,
         guardFactory: (Int64) -> any EnvironmentGuard,
         listener: PinVaultConnectionListener?,
         native: NativeSecurity? = nil,
-        release: Bool = false
+        release: Bool = false,
+        noFileAllowed: Bool = false,
+        reactNetworkingEnabled: Bool = true
     ) throws -> ParsedConfig {
         let root = try StrictJSON.parseObject(json, path: "config")
         let builder = PinVaultConfig.Builder()
+        let require = native?.require ?? NativeSecurity.Require()
 
-        for api in try root.objectList("configApis", maxItems: maxConfigApis) ?? [] {
+        let configApis = try root.objectList("configApis", maxItems: maxConfigApis)
+        let vaultFiles = try root.objectList("vaultFiles", maxItems: maxVaultFiles)
+        let jsStaticPins = try root.object("staticPins").map(staticPins)
+        if release && native == nil && !noFileAllowed && (!(configApis ?? []).isEmpty || jsStaticPins != nil) {
+            throw BridgeInputError(
+                "config: a release build takes its trust anchors only from the app's native security file " +
+                    "(\(NativeSecurity.resourceName).json, README \"Native security file\"); none is shipped. " +
+                    "An app that accepts JS-only anchors says so in its Info.plist: \(NativeSecurity.noFileInfoKey) = YES"
+            )
+        }
+        for api in configApis ?? [] {
             try addConfigApi(builder, api, native: native, release: release)
         }
-        for file in try root.objectList("vaultFiles", maxItems: maxVaultFiles) ?? [] { try addVaultFile(builder, file, tokens) }
-        let jsStaticPins = try root.object("staticPins").map(staticPins)
+        for file in vaultFiles ?? [] { try addVaultFile(builder, file, tokens, native: native) }
         if let pins = try SecurityPolicy.staticPins(path: "config.staticPins", js: jsStaticPins, native: native) {
             builder.staticPins(pins)
         }
@@ -55,13 +70,38 @@ public enum ConfigParser {
         if let v = try root.int64("updateIntervalHours", min: 1, max: 24 * 30) { builder.updateIntervalHours(v) }
         if let v = try root.int64("updateIntervalMinutes", min: 15, max: 60 * 24 * 30) { builder.updateIntervalMinutes(v) }
         if let v = try root.string("deviceAlias", maxLength: 128) { builder.deviceAlias(v) }
-        if let d = try root.object("expiredConfigGrace") { let (a, u) = try duration(d); builder.expiredConfigGrace(a, u) }
-        if let v = try root.stringList("requireCaTrust", maxItems: 64, maxLength: 255) { builder.requireCaTrust(v) }
-        if try root.bool("wipeVaultFilesOnRevocation") == true { builder.wipeVaultFilesOnRevocation() }
-        if let d = try root.object("vaultFileMaxOfflineAge") { let (a, u) = try duration(d); builder.vaultFileMaxOfflineAge(a, u) }
-        if try root.bool("requireUnlockedDevice") == true { builder.requireUnlockedDevice() }
-        if try root.bool("requireHardwareBackedKeys") == true { builder.requireHardwareBackedKeys() }
-        if try root.bool("managedTrustRoots") == true { builder.managedTrustRoots() }
+        if let d = try root.object("expiredConfigGrace") {
+            let (a, u) = try duration(d)
+            let ms = millis(a, u)
+            if release && ms > NativeSecurity.maxReleaseGraceMs { throw BridgeInputError("\(d.path): a release build takes at most 7 days") }
+            if let max = require.expiredConfigGraceMs, ms > max {
+                throw BridgeInputError("\(d.path): longer than the app's native security file allows (\(max / 1000) s)")
+            }
+            builder.expiredConfigGrace(a, u)
+        } else if let max = require.expiredConfigGraceMs {
+            builder.expiredConfigGrace(max, .milliseconds)
+        }
+        // `require` hosts are added to JS's: JS can name more, never fewer.
+        let caTrust = (try root.stringList("requireCaTrust", maxItems: 64, maxLength: 255) ?? []) + (require.requireCaTrust ?? [])
+        if !caTrust.isEmpty {
+            var seen = Set<String>()
+            builder.requireCaTrust(caTrust.filter { seen.insert($0).inserted })
+        }
+        if try root.bool("wipeVaultFilesOnRevocation") == true || require.wipeVaultFilesOnRevocation { builder.wipeVaultFilesOnRevocation() }
+        if let d = try root.object("vaultFileMaxOfflineAge") {
+            let (a, u) = try duration(d)
+            if let max = require.vaultFileMaxOfflineAgeMs {
+                let ms = millis(a, u)
+                // 0 = no limit: longer than any.
+                if ms == 0 || ms > max { throw BridgeInputError("\(d.path): longer than the app's native security file allows (\(max / 1000) s)") }
+            }
+            builder.vaultFileMaxOfflineAge(a, u)
+        } else if let max = require.vaultFileMaxOfflineAgeMs {
+            builder.vaultFileMaxOfflineAge(max, .milliseconds)
+        }
+        if try root.bool("requireUnlockedDevice") == true || require.requireUnlockedDevice { builder.requireUnlockedDevice() }
+        if try root.bool("requireHardwareBackedKeys") == true || require.requireHardwareBackedKeys { builder.requireHardwareBackedKeys() }
+        if try root.bool("managedTrustRoots") == true || require.managedTrustRoots { builder.managedTrustRoots() }
         if let v = try root.stringList("expectedSignerSha256", maxItems: 16, maxLength: 128) { builder.expectedSignerSha256(v) }
 
         var guardTimeout: Int64?
@@ -73,7 +113,9 @@ public enum ConfigParser {
             builder.environmentGuard(guardFactory(timeout))
         }
 
-        let requirePinned = try root.bool("requirePinnedReactNativeNetworking") == true
+        // On by default in a release build — unless the app opted out of pinning RN's
+        // networking natively (Info.plist PinVaultPinReactNativeNetworking = NO).
+        let requirePinned = try root.bool("requirePinnedReactNativeNetworking") ?? (release && reactNetworkingEnabled)
         // Android-only settings: the Android side reads them; here only their shape is checked.
         _ = try root.object("android")
         var maxRN = ReactNetworking.defaultMaxResponseBytes
@@ -82,12 +124,28 @@ public enum ConfigParser {
             if let resolve = try ios.stringMap("resolve", maxItems: 64, maxKeyLength: 255, maxValueLength: 255) {
                 for (host, address) in resolve.sorted(by: { $0.key < $1.key }) { builder.resolve(host: host, to: address) }
             }
-            if let v = try ios.stringList("expectedBundleIds", maxItems: 16, maxLength: 255) { builder.expectedBundleId(v) }
-            if let v = try ios.stringList("expectedTeamIds", maxItems: 16, maxLength: 32) { builder.expectedTeamId(v) }
-            if let v = try ios.enumValue("userAuthStrength", UserAuthStrength.self) { builder.userAuthStrength(v) }
+            if let v = try fixedList("config.ios.expectedBundleIds", require.expectedBundleIds,
+                                     try ios.stringList("expectedBundleIds", maxItems: 16, maxLength: 255), native) {
+                builder.expectedBundleId(v)
+            }
+            if let v = try fixedList("config.ios.expectedTeamIds", require.expectedTeamIds,
+                                     try ios.stringList("expectedTeamIds", maxItems: 16, maxLength: 32), native) {
+                builder.expectedTeamId(v)
+            }
+            let jsStrength = try ios.enumValue("userAuthStrength", UserAuthStrength.self)
+            if let fixed = require.userAuthStrength, let jsStrength, jsStrength != fixed {
+                throw BridgeInputError("config.ios.userAuthStrength: differs from the app's native security file (\(native?.source ?? "")); the native value is fixed")
+            }
+            if let v = require.userAuthStrength ?? jsStrength { builder.userAuthStrength(v) }
             try ios.finish()
         }
 
+        else {
+            if let v = require.expectedBundleIds { builder.expectedBundleId(v) }
+            if let v = require.expectedTeamIds { builder.expectedTeamId(v) }
+            if let v = require.userAuthStrength { builder.userAuthStrength(v) }
+        }
+
         try root.finish()
         if let listener { builder.onConnectionEvent(listener) }
         var parsed = ParsedConfig(config: try builder.build(), guardTimeoutMs: guardTimeout)
@@ -97,6 +155,26 @@ public enum ConfigParser {
         return parsed
     }
 
+    /// A JS list against the native file's: fixed where the file gives it.
+    static func fixedList(_ path: String, _ native: [String]?, _ js: [String]?, _ file: NativeSecurity?) throws -> [String]? {
+        guard let native else { return js }
+        if let js, !NativeSecurity.sameKeys(js, native) {
+            throw BridgeInputError("\(path): differs from the app's native security file (\(file?.source ?? "")); the native value is fixed")
+        }
+        return native
+    }
+
+    static func millis(_ amount: Int64, _ unit: TimeUnit) -> Int64 {
+        switch unit {
+        case .milliseconds: return amount
+        case .seconds: return amount.multipliedReportingOverflow(by: 1000).overflow ? .max : amount * 1000
+        case .minutes: return amount.multipliedReportingOverflow(by: 60_000).overflow ? .max : amount * 60_000
+        case .hours: return amount.multipliedReportingOverflow(by: 3_600_000).overflow ? .max : amount * 3_600_000
+        case .days: return amount.multipliedReportingOverflow(by: 86_400_000).overflow ? .max : amount * 86_400_000
+        default: return .max
+        }
+    }
+
     static func duration(_ d: Fields) throws -> (Int64, TimeUnit) {
         guard let amount = try d.int64("amount", min: 0, max: 10 * 365 * 24 * 3600 * 1000) else {
             throw BridgeInputError("\(d.path).amount: required")
@@ -178,11 +256,52 @@ public enum ConfigParser {
         let enrollmentUrl = try httpsUrl(b, "enrollmentUrl")
         let threshold = try b.double("clientCertRenewalThreshold", min: 0, max: 1)
         let disableRenewal = try b.bool("disableClientCertRenewal") == true
-        let attestation = try b.bool("attestation") == true
+        let jsAttestation = try b.bool("attestation")
         let attestationInterval = try b.object("attestationInterval").map(duration)
-        let tokenHosts = try b.stringList("tokenHosts", maxItems: 64, maxLength: 255)
+        let jsTokenHosts = try b.stringList("tokenHosts", maxItems: 64, maxLength: 255)
+        let jsProof = try b.bool("proofOfPossession")
         try b.finish()
 
+        // Where the block talks to and who gets its token and identity: fixed where the file says.
+        let nativeBlock = native?.blocks[id]
+        func fixed(_ key: String) -> BridgeInputError {
+            BridgeInputError("\(b.path).\(key): differs from the app's native security file (\(native?.source ?? "")); the native value is fixed")
+        }
+        var blockUrl = url
+        if let n = nativeBlock?.url {
+            if n != url { throw fixed("url") }
+            blockUrl = n
+        }
+        if nativeBlock?.attestation == true && jsAttestation == false {
+            throw BridgeInputError("\(b.path).attestation: the app's native security file turns it on; JS cannot turn it off")
+        }
+        let attestation = jsAttestation == true || nativeBlock?.attestation == true
+        if nativeBlock?.proofOfPossession == true && jsProof == false {
+            throw BridgeInputError("\(b.path).proofOfPossession: the app's native security file turns it on; JS cannot turn it off")
+        }
+        let proof = jsProof == true || nativeBlock?.proofOfPossession == true
+        let lower: ([String]) -> [String] = { $0.map { $0.lowercased() } }
+        var tokenHosts = jsTokenHosts
+        if let n = nativeBlock?.tokenHosts {
+            if let j = jsTokenHosts, !NativeSecurity.sameKeys(lower(j), lower(n)) { throw fixed("tokenHosts") }
+            tokenHosts = n
+        }
+        var fixedEnrollmentUrl = enrollmentUrl
+        if let n = nativeBlock?.enrollmentUrl {
+            if let j = enrollmentUrl, j != n { throw fixed("enrollmentUrl") }
+            fixedEnrollmentUrl = n
+        }
+        var fixedRenewalUrl = renewalUrl
+        if let n = nativeBlock?.renewalUrl {
+            if let j = renewalUrl, j != n { throw fixed("renewalUrl") }
+            fixedRenewalUrl = n
+        }
+        var certHosts = clientCertHosts
+        if let n = nativeBlock?.clientCertHosts {
+            if let j = clientCertHosts, !NativeSecurity.sameKeys(lower(j), lower(n)) { throw fixed("clientCertHosts") }
+            certHosts = n
+        }
+
         // The trust anchors and relaxations: the native security file decides, JS only repeats.
         let sec = try SecurityPolicy.apply(
             path: b.path, id: id,
@@ -195,7 +314,7 @@ public enum ConfigParser {
             native: native, release: release
         )
 
-        builder.configApi(id, url: url) { api in
+        builder.configApi(id, url: blockUrl) { api in
             if let v = sec.bootstrapPins { api.bootstrapPins(v) }
             if let configEndpoint { api.configEndpoint(configEndpoint) }
             if let healthEndpoint { api.healthEndpoint(healthEndpoint) }
@@ -210,35 +329,77 @@ public enum ConfigParser {
             if sec.allowServerKey { api.allowServerGeneratedKey() }
             if let v = sec.clientCaPins { api.clientCaPins(v) }
             if let maxLifetime { api.maxClientCertLifetimeDays(maxLifetime) }
-            if let clientCertHosts { api.clientCertHosts(clientCertHosts) }
+            if let certHosts { api.clientCertHosts(certHosts) }
             if let enrollmentEndpoint { api.enrollmentEndpoint(enrollmentEndpoint) }
             if let clientCertEndpoint { api.clientCertEndpoint(clientCertEndpoint) }
             if let vaultReportEndpoint { api.vaultReportEndpoint(vaultReportEndpoint) }
             if let clientCertLabel { api.clientCertLabel(clientCertLabel) }
             if let wantPinsFor { api.wantPinsFor(wantPinsFor) }
-            if let renewalUrl { api.renewalUrl(renewalUrl) }
-            if let enrollmentUrl { api.enrollmentUrl(enrollmentUrl) }
+            if let fixedRenewalUrl { api.renewalUrl(fixedRenewalUrl) }
+            if let fixedEnrollmentUrl { api.enrollmentUrl(fixedEnrollmentUrl) }
             if let threshold { api.clientCertRenewalThreshold(threshold) }
             if disableRenewal { api.disableClientCertRenewal() }
             if attestation { api.attestation() }
             if let (amount, unit) = attestationInterval { api.attestationInterval(amount, unit) }
             if let tokenHosts { api.tokenHosts(tokenHosts) }
+            if proof { api.proofOfPossession() }
         }
     }
 
-    static func addVaultFile(_ builder: PinVaultConfig.Builder, _ f: Fields, _ tokens: VaultTokenStore) throws {
+    static func addVaultFile(_ builder: PinVaultConfig.Builder, _ f: Fields, _ tokens: VaultTokenStore, native: NativeSecurity?) throws {
         let key = try f.requireString("key", maxLength: 128)
         let endpoint = try f.requireString("endpoint", maxLength: 512)
-        let signatureKey = try f.string("signaturePublicKey", maxLength: keyLength, multiline: true)
+        let jsSignatureKey = try f.string("signaturePublicKey", maxLength: keyLength, multiline: true)
         let updateWithPins = try f.bool("updateWithPins")
         let storage = try f.enumValue("storage", StorageStrategy.self)
         let configApi = try f.string("configApi", maxLength: 128)
         let policy = try f.enumValue("accessPolicy", VaultFileAccessPolicy.self)
-        let encryption = try f.enumValue("encryption", VaultFileEncryption.self)
-        let userAuth = try f.enumValue("userAuth", UserAuth.self)
+        let jsEncryption = try f.enumValue("encryption", VaultFileEncryption.self)
+        let jsUserAuth = try f.enumValue("userAuth", UserAuth.self)
         let maxOfflineAge = try f.object("maxOfflineAge").map(duration)
         let wipeWhenStale = try f.bool("wipeWhenStale") == true
         try f.finish()
+        var offlineAge = maxOfflineAge
+
+        // A file the native security file names keeps its signature key, encryption and lock.
+        var signatureKey = jsSignatureKey
+        var encryption = jsEncryption
+        var userAuth = jsUserAuth
+        if let files = native?.vaultFiles {
+            guard let declared = files[key] else {
+                throw BridgeInputError("\(f.path): vault file '\(key)' is not declared in the app's native security file (\(native?.source ?? ""))")
+            }
+            func fixed(_ field: String) -> BridgeInputError {
+                BridgeInputError("\(f.path).\(field): differs from the app's native security file (\(native?.source ?? "")); the native value is fixed")
+            }
+            if let n = declared.signaturePublicKey {
+                if let j = jsSignatureKey, j.trimmingCharacters(in: .whitespacesAndNewlines) != n.trimmingCharacters(in: .whitespacesAndNewlines) {
+                    throw fixed("signaturePublicKey")
+                }
+                signatureKey = n
+            }
+            if let n = declared.encryption {
+                if let j = jsEncryption, j != n { throw fixed("encryption") }
+                encryption = n
+            }
+            if let n = declared.userAuth {
+                if let j = jsUserAuth, j != n { throw fixed("userAuth") }
+                userAuth = n
+            }
+            if let max = declared.maxOfflineAgeMs, maxOfflineAge == nil {
+                offlineAge = (max, .milliseconds)
+            }
+        }
+        // The tighter of the file's own cap and the config-wide one: a per-file value
+        // overrides the config's, so it must not escape the config-wide cap either.
+        let cap = [native?.vaultFiles?[key]?.maxOfflineAgeMs, native?.require.vaultFileMaxOfflineAgeMs].compactMap { $0 }.min()
+        if let cap, let (a, u) = maxOfflineAge {
+            let ms = millis(a, u)
+            // 0 = no limit: longer than any.
+            if ms == 0 || ms > cap {
+                throw BridgeInputError("\(f.path).maxOfflineAge: longer than the app's native security file allows (\(cap / 1000) s)")
+            }
+        }
 
         builder.vaultFile(key) { file in
             file.endpoint(endpoint)
@@ -255,7 +416,7 @@ public enum ConfigParser {
             }
             if let encryption { file.encryption(encryption) }
             if let userAuth { file.userAuth(userAuth) }
-            if let (amount, unit) = maxOfflineAge { file.maxOfflineAge(amount, unit) }
+            if let (amount, unit) = offlineAge { file.maxOfflineAge(amount, unit) }
             if wipeWhenStale { file.wipeWhenStale() }
         }
     }