@umutcansu/react-native-pinvault 2.3.2 → 2.4.1

package/android/src/main/java/io/github/umutcansu/pinvault/reactnative/ConfigParser.kt

@@ -55,11 +55,16 @@ internal object ConfigParser {
     const val MAX_PINS = 256
     const val MAX_PINS_PER_HOST = 16
     const val KEY_LENGTH = 4096
+    private val VAULT_KEY = Regex("^[A-Za-z0-9._-]{1,64}$")
 
     /**
      * @param native the app's native security file ([NativeSecurity]); null = none.
-     * @param release a release build of the app: without a native file, the
-     *   relaxations (`allowUnsigned`, …) are refused from JS.
+     * @param release a release build of the app: without a native file, a
+     *   config with Config APIs or static pins is refused (unless
+     *   [noFileAllowed]) and the relaxations (`allowUnsigned`, …) are refused
+     *   from JS; `expiredConfigGrace` is capped.
+     * @param noFileAllowed the app's manifest accepts a release start without
+     *   a native security file ([NativeSecurity.NO_FILE_META_DATA]).
      */
     fun parse(
         json: String,
@@ -68,27 +73,64 @@ internal object ConfigParser {
         listener: PinVaultConnectionListener?,
         native: NativeSecurity? = null,
         release: Boolean = false,
+        noFileAllowed: Boolean = false,
     ): ParsedConfig {
         val root = StrictJson.parseObject(json, "config")
         val builder = PinVaultConfig.Builder()
+        val nativeRequire = native?.require ?: NativeSecurity.Require()
 
-        root.objList("configApis", MAX_CONFIG_APIS)?.forEach { addConfigApi(builder, it, native, release) }
-        root.objList("vaultFiles", MAX_VAULT_FILES)?.forEach { addVaultFile(builder, it, tokens) }
+        val configApis = root.objList("configApis", MAX_CONFIG_APIS)
+        val vaultFiles = root.objList("vaultFiles", MAX_VAULT_FILES)
         val staticPins = root.obj("staticPins")?.let(::staticPins)
+        if (release && native == null && !noFileAllowed && (!configApis.isNullOrEmpty() || staticPins != null)) {
+            throw BridgeInputException(
+                "config: a release build takes its trust anchors only from the app's native security file " +
+                    "(assets/${NativeSecurity.ASSET_NAME}, README \"Native security file\"); none is shipped. " +
+                    "An app that accepts JS-only anchors says so in its manifest: meta-data ${NativeSecurity.NO_FILE_META_DATA}=true"
+            )
+        }
+        configApis?.forEach { addConfigApi(builder, it, native, release) }
+        vaultFiles?.forEach { addVaultFile(builder, it, tokens, native) }
         SecurityPolicy.staticPins("config.staticPins", staticPins, native)?.let { builder.staticPins(it) }
 
         root.int("maxRetryCount", 0, 10)?.let { builder.maxRetryCount(it) }
         root.long("updateIntervalHours", 1, 24L * 30)?.let { builder.updateIntervalHours(it) }
         root.long("updateIntervalMinutes", 15, 60L * 24 * 30)?.let { builder.updateIntervalMinutes(it) }
         root.string("deviceAlias", 128)?.let { builder.deviceAlias(it) }
-        root.obj("expiredConfigGrace")?.let { d -> duration(d).let { builder.expiredConfigGrace(it.first, it.second) } }
-        root.stringList("requireCaTrust", 64, 255)?.let { builder.requireCaTrust(*it.toTypedArray()) }
-        if (root.bool("wipeVaultFilesOnRevocation") == true) builder.wipeVaultFilesOnRevocation()
-        root.obj("vaultFileMaxOfflineAge")?.let { d -> duration(d).let { builder.vaultFileMaxOfflineAge(it.first, it.second) } }
-        val requireUnlocked = root.bool("requireUnlockedDevice") == true
-        if (root.bool("requireHardwareBackedKeys") == true) builder.requireHardwareBackedKeys()
-        if (root.bool("managedTrustRoots") == true) builder.managedTrustRoots()
-        root.stringList("expectedSignerSha256", 16, 128)?.let { builder.expectedSignerSha256(it) }
+        root.obj("expiredConfigGrace")?.let { d ->
+            val (amount, unit) = duration(d)
+            val ms = unit.toMillis(amount)
+            if (release && ms > NativeSecurity.MAX_RELEASE_GRACE_MS) {
+                throw BridgeInputException("${d.path}: a release build takes at most 7 days")
+            }
+            nativeRequire.expiredConfigGraceMs?.let { max ->
+                if (ms > max) throw BridgeInputException("${d.path}: longer than the app's native security file allows (${max / 1000} s)")
+            }
+            builder.expiredConfigGrace(amount, unit)
+        } ?: nativeRequire.expiredConfigGraceMs?.let { builder.expiredConfigGrace(it, TimeUnit.MILLISECONDS) }
+        // `require` hosts are added to JS's: JS can name more, never fewer.
+        val caTrust = (root.stringList("requireCaTrust", 64, 255) ?: emptyList()) + (nativeRequire.requireCaTrust ?: emptyList())
+        if (caTrust.isNotEmpty()) builder.requireCaTrust(*caTrust.distinct().toTypedArray())
+        if (root.bool("wipeVaultFilesOnRevocation") == true || nativeRequire.wipeVaultFilesOnRevocation) builder.wipeVaultFilesOnRevocation()
+        root.obj("vaultFileMaxOfflineAge")?.let { d ->
+            val (amount, unit) = duration(d)
+            nativeRequire.vaultFileMaxOfflineAgeMs?.let { max ->
+                val ms = unit.toMillis(amount)
+                // 0 = no limit: longer than any.
+                if (ms == 0L || ms > max) throw BridgeInputException("${d.path}: longer than the app's native security file allows (${max / 1000} s)")
+            }
+            builder.vaultFileMaxOfflineAge(amount, unit)
+        } ?: nativeRequire.vaultFileMaxOfflineAgeMs?.let { builder.vaultFileMaxOfflineAge(it, TimeUnit.MILLISECONDS) }
+        val requireUnlocked = root.bool("requireUnlockedDevice") == true || nativeRequire.requireUnlockedDevice
+        if (root.bool("requireHardwareBackedKeys") == true || nativeRequire.requireHardwareBackedKeys) builder.requireHardwareBackedKeys()
+        if (root.bool("managedTrustRoots") == true || nativeRequire.managedTrustRoots) builder.managedTrustRoots()
+        val signers = root.stringList("expectedSignerSha256", 16, 128)
+        nativeRequire.expectedSignerSha256?.let { fixed ->
+            if (signers != null && !NativeSecurity.sameKeys(signers.map(String::lowercase), fixed.map(String::lowercase))) {
+                throw BridgeInputException("config.expectedSignerSha256: differs from the app's native security file (${native?.source}); the native value is fixed")
+            }
+        }
+        (nativeRequire.expectedSignerSha256 ?: signers)?.let { builder.expectedSignerSha256(it) }
 
         var guardTimeout: Long? = null
         root.obj("environmentGuard")?.let { g ->
@@ -109,7 +151,10 @@ internal object ConfigParser {
             keepCookies = a.bool("keepReactNativeCookies") == true
             a.finish()
         }
-        val requirePinned = root.bool("requirePinnedReactNativeNetworking") == true
+        // On by default in a release build: RN's https must go through PinVault there.
+        // The native security file can pin this on (RN-3): JS may turn it on, never off.
+        val requirePinned = (root.bool("requirePinnedReactNativeNetworking") ?: (release && pinGlobal)) ||
+            nativeRequire.requirePinnedReactNativeNetworking
         if (requirePinned && !pinGlobal) {
             throw BridgeInputException("config.requirePinnedReactNativeNetworking: contradicts android.pinGlobalNetworking: false")
         }
@@ -149,6 +194,20 @@ internal object ConfigParser {
         return url
     }
 
+    /**
+     * An endpoint path, resolved relative to the block's base URL. An absolute
+     * value — a scheme (`://`) or a root (`/`, `\`) — would silently retarget the
+     * request past the pinned host (`@Url`/`URL(string:relativeTo:)` honour it),
+     * so it is refused (RN-2). Returns null when the optional field is absent.
+     */
+    private fun relEndpoint(f: Fields, key: String, max: Int): String? {
+        val v = f.string(key, max) ?: return null
+        if (v.contains("://") || v.startsWith("/") || v.startsWith("\\")) {
+            throw BridgeInputException("${f.path}.$key: must be a relative path, not an absolute URL")
+        }
+        return v
+    }
+
     fun hostPin(p: Fields): HostPin {
         val hostname = p.requireString("hostname", 255)
         val pins = p.stringList("sha256", MAX_PINS_PER_HOST, 128) ?: throw BridgeInputException("${p.path}.sha256: required")
@@ -180,8 +239,8 @@ internal object ConfigParser {
         val url = httpsUrl(b, "url") ?: throw BridgeInputException("${b.path}.url: required")
         // Read everything before the builder runs, so a refusal names the JSON path.
         val bootstrapPins = b.objList("bootstrapPins", MAX_PINS)?.map(::hostPin)
-        val configEndpoint = b.string("configEndpoint", 512)
-        val healthEndpoint = b.string("healthEndpoint", 512)
+        val configEndpoint = relEndpoint(b, "configEndpoint", 512)
+        val healthEndpoint = relEndpoint(b, "healthEndpoint", 512)
         val oneKey = b.string("signaturePublicKey", KEY_LENGTH, multiline = true)
         val keys = b.stringList("signaturePublicKeys", 16, KEY_LENGTH, multiline = true)
         if (oneKey != null && keys != null) {
@@ -197,20 +256,49 @@ internal object ConfigParser {
         val clientCaPins = b.stringList("clientCaPins", 16, 128)
         val maxLifetime = b.int("maxClientCertLifetimeDays", 1, 3650)
         val clientCertHosts = b.stringList("clientCertHosts", 64, 2048)
-        val enrollmentEndpoint = b.string("enrollmentEndpoint", 512)
-        val clientCertEndpoint = b.string("clientCertEndpoint", 512)
-        val vaultReportEndpoint = b.string("vaultReportEndpoint", 512)
+        val enrollmentEndpoint = relEndpoint(b, "enrollmentEndpoint", 512)
+        val clientCertEndpoint = relEndpoint(b, "clientCertEndpoint", 512)
+        val vaultReportEndpoint = relEndpoint(b, "vaultReportEndpoint", 512)
         val clientCertLabel = b.string("clientCertLabel", 128)
         val wantPinsFor = b.stringList("wantPinsFor", 256, 255)
         val renewalUrl = httpsUrl(b, "renewalUrl")
         val enrollmentUrl = httpsUrl(b, "enrollmentUrl")
         val threshold = b.double("clientCertRenewalThreshold", 0.0, 1.0)
         val disableRenewal = b.bool("disableClientCertRenewal") == true
-        val attestation = b.bool("attestation") == true
+        val jsAttestation = b.bool("attestation")
         val attestationInterval = b.obj("attestationInterval")?.let(::duration)
-        val tokenHosts = b.stringList("tokenHosts", 64, 255)
+        val jsTokenHosts = b.stringList("tokenHosts", 64, 255)
+        val jsProof = b.bool("proofOfPossession")
         b.finish()
 
+        // Where the block talks to and who gets its token and identity: fixed where the file says.
+        val nativeBlock = native?.blocks?.get(id)
+        fun fixed(key: String): Nothing =
+            throw BridgeInputException("${b.path}.$key: differs from the app's native security file (${native?.source}); the native value is fixed")
+        val blockUrl = nativeBlock?.url?.also { if (it != url) fixed("url") } ?: url
+        val fixedEnrollmentUrl = nativeBlock?.enrollmentUrl?.also { if (enrollmentUrl != null && it != enrollmentUrl) fixed("enrollmentUrl") } ?: enrollmentUrl
+        val fixedRenewalUrl = nativeBlock?.renewalUrl?.also { if (renewalUrl != null && it != renewalUrl) fixed("renewalUrl") } ?: renewalUrl
+        if (nativeBlock?.attestation == true && jsAttestation == false) {
+            throw BridgeInputException("${b.path}.attestation: the app's native security file turns it on; JS cannot turn it off")
+        }
+        val attestation = jsAttestation == true || nativeBlock?.attestation == true
+        if (nativeBlock?.proofOfPossession == true && jsProof == false) {
+            throw BridgeInputException("${b.path}.proofOfPossession: the app's native security file turns it on; JS cannot turn it off")
+        }
+        val proof = jsProof == true || nativeBlock?.proofOfPossession == true
+        val tokenHosts = nativeBlock?.tokenHosts?.also { n ->
+            if (jsTokenHosts != null && !NativeSecurity.sameKeys(jsTokenHosts.map(String::lowercase), n.map(String::lowercase))) fixed("tokenHosts")
+        } ?: jsTokenHosts
+        // Who gets the device's identity is the file's call in a release build: JS cannot
+        // add a host the file does not name (tokenHosts only narrows the library's default).
+        if (release && nativeBlock != null && nativeBlock.clientCertHosts == null && clientCertHosts != null) {
+            throw BridgeInputException("${b.path}.clientCertHosts: a release build takes it only from the app's native security file " +
+                "(${native?.source}); declare clientCertHosts for Config API '$id' there")
+        }
+        val certHosts = nativeBlock?.clientCertHosts?.also { n ->
+            if (clientCertHosts != null && !NativeSecurity.sameKeys(clientCertHosts.map(String::lowercase), n.map(String::lowercase))) fixed("clientCertHosts")
+        } ?: clientCertHosts
+
         // The trust anchors and relaxations: the native security file decides, JS only repeats.
         val sec = SecurityPolicy.apply(
             b.path, id,
@@ -221,7 +309,7 @@ internal object ConfigParser {
             native, release,
         )
 
-        builder.configApi(id, url) {
+        builder.configApi(id, blockUrl) {
             sec.bootstrapPins?.let { this.bootstrapPins(it) }
             configEndpoint?.let { this.configEndpoint(it) }
             healthEndpoint?.let { this.healthEndpoint(it) }
@@ -236,36 +324,69 @@ internal object ConfigParser {
             if (sec.allowServerKey) this.allowServerGeneratedKey()
             sec.clientCaPins?.let { this.clientCaPins(it) }
             maxLifetime?.let { this.maxClientCertLifetimeDays(it) }
-            clientCertHosts?.let { this.clientCertHosts(it) }
+            certHosts?.let { this.clientCertHosts(it) }
             enrollmentEndpoint?.let { this.enrollmentEndpoint(it) }
             clientCertEndpoint?.let { this.clientCertEndpoint(it) }
             vaultReportEndpoint?.let { this.vaultReportEndpoint(it) }
             clientCertLabel?.let { this.clientCertLabel(it) }
             wantPinsFor?.let { this.wantPinsFor(*it.toTypedArray()) }
-            renewalUrl?.let { this.renewalUrl(it) }
-            enrollmentUrl?.let { this.enrollmentUrl(it) }
+            fixedRenewalUrl?.let { this.renewalUrl(it) }
+            fixedEnrollmentUrl?.let { this.enrollmentUrl(it) }
             threshold?.let { this.clientCertRenewalThreshold(it) }
             if (disableRenewal) this.disableClientCertRenewal()
             if (attestation) this.attestation()
             attestationInterval?.let { this.attestationInterval(it.first, it.second) }
             tokenHosts?.let { this.tokenHosts(it) }
+            if (proof) this.proofOfPossession()
         }
     }
 
-    private fun addVaultFile(builder: PinVaultConfig.Builder, f: Fields, tokens: VaultTokenStore) {
+    private fun addVaultFile(builder: PinVaultConfig.Builder, f: Fields, tokens: VaultTokenStore, native: NativeSecurity?) {
         val key = f.requireString("key", 128)
+        // The same rule as the library's (the key names the stored copy's file).
+        if (!VAULT_KEY.matches(key) || key.all { it == '.' }) {
+            throw BridgeInputException("${f.path}.key: must match [A-Za-z0-9._-]{1,64} and not be only dots")
+        }
         val endpoint = f.requireString("endpoint", 512)
-        val signatureKey = f.string("signaturePublicKey", KEY_LENGTH, multiline = true)
+        if (endpoint.contains("://") || endpoint.startsWith("/") || endpoint.startsWith("\\")) {
+            throw BridgeInputException("${f.path}.endpoint: must be a relative path, not an absolute URL")
+        }
+        val jsSignatureKey = f.string("signaturePublicKey", KEY_LENGTH, multiline = true)
         val updateWithPins = f.bool("updateWithPins")
         val storage = f.enum("storage", StorageStrategy.values())
         val configApi = f.string("configApi", 128)
         val policy = f.enum("accessPolicy", VaultFileAccessPolicy.values())
-        val encryption = f.enum("encryption", VaultFileEncryption.values())
-        val userAuth = f.enum("userAuth", UserAuth.values())
+        val jsEncryption = f.enum("encryption", VaultFileEncryption.values())
+        val jsUserAuth = f.enum("userAuth", UserAuth.values())
         val maxOfflineAge = f.obj("maxOfflineAge")?.let(::duration)
         val wipeWhenStale = f.bool("wipeWhenStale") == true
         f.finish()
 
+        // A file the native security file names keeps its signature key, encryption and lock.
+        val declared = native?.vaultFiles?.let { files ->
+            files[key] ?: throw BridgeInputException("${f.path}: vault file '$key' is not declared in the app's native security file (${native.source})")
+        }
+        fun fixed(field: String): Nothing =
+            throw BridgeInputException("${f.path}.$field: differs from the app's native security file (${native?.source}); the native value is fixed")
+        val signatureKey = declared?.signaturePublicKey?.also { n ->
+            if (jsSignatureKey != null && jsSignatureKey.trim() != n.trim()) fixed("signaturePublicKey")
+        } ?: jsSignatureKey
+        val encryption = declared?.encryption?.also { if (jsEncryption != null && jsEncryption != it) fixed("encryption") } ?: jsEncryption
+        val userAuth = declared?.userAuth?.also { if (jsUserAuth != null && jsUserAuth != it) fixed("userAuth") } ?: jsUserAuth
+        // The tighter of the file's own cap and the config-wide one: a per-file value
+        // overrides the config's, so it must not escape the config-wide cap either.
+        val cap = listOfNotNull(declared?.maxOfflineAgeMs, native?.require?.vaultFileMaxOfflineAgeMs).minOrNull()
+        cap?.let { max ->
+            maxOfflineAge?.let { (amount, unit) ->
+                val ms = unit.toMillis(amount)
+                // 0 = no limit: longer than any.
+                if (ms == 0L || ms > max) {
+                    throw BridgeInputException("${f.path}.maxOfflineAge: longer than the app's native security file allows (${max / 1000} s)")
+                }
+            }
+        }
+        val offlineAge = maxOfflineAge ?: declared?.maxOfflineAgeMs?.let { it to TimeUnit.MILLISECONDS }
+
         builder.vaultFile(key) {
             this.endpoint(endpoint)
             signatureKey?.let { this.signaturePublicKey(it) }
@@ -279,7 +400,7 @@ internal object ConfigParser {
             }
             encryption?.let { this.encryption(it) }
             userAuth?.let { this.userAuth(it) }
-            maxOfflineAge?.let { this.maxOfflineAge(it.first, it.second) }
+            offlineAge?.let { this.maxOfflineAge(it.first, it.second) }
             if (wipeWhenStale) this.wipeWhenStale()
         }
     }

package/android/src/main/java/io/github/umutcansu/pinvault/reactnative/NativeSecurity.kt

@@ -4,6 +4,8 @@ import android.content.Context
 import android.content.pm.ApplicationInfo
 import io.github.umutcansu.pinvault.model.CertificateConfig
 import io.github.umutcansu.pinvault.model.HostPin
+import io.github.umutcansu.pinvault.model.UserAuth
+import io.github.umutcansu.pinvault.model.VaultFileEncryption
 import java.io.FileNotFoundException
 import java.io.IOException
 
@@ -22,9 +24,19 @@ import java.io.IOException
  *     "signaturePublicKeys": ["…", "…"], "requiredSignatures": 2,
  *     "recoveryPublicKeys": ["…"], "requiredRecoverySignatures": 1,
  *     "serverScope": "default-tls", "clientCaPins": ["…"],
+ *     "url": "https://config.example.com/", "attestation": true,
+ *     "tokenHosts": ["api.example.com"], "proofOfPossession": true, "clientCertHosts": ["api.example.com:443"],
+ *     "enrollmentUrl": "https://enroll.example.com/", "renewalUrl": "https://renew.example.com/",
  *     "allowUnsigned": false, "allowUnpinnedConfigApi": false, "allowServerGeneratedKey": false
  *   }],
- *   "staticPins": { "pins": [ … ], "version": 1 }
+ *   "staticPins": { "pins": [ … ], "version": 1 },
+ *   "require": {
+ *     "requireUnlockedDevice": true, "requireHardwareBackedKeys": true,
+ *     "requirePinnedReactNativeNetworking": true, "managedTrustRoots": true,
+ *     "wipeVaultFilesOnRevocation": true, "requireCaTrust": ["api.example.com"],
+ *     "expectedSignerSha256": ["…"], "expiredConfigGraceSeconds": 0, "vaultFileMaxOfflineAgeSeconds": 604800
+ *   },
+ *   "vaultFiles": [{ "key": "statement", "signaturePublicKey": "…", "encryption": "USER_AUTH", "userAuth": "REQUIRED", "maxOfflineAgeSeconds": 86400 }]
  * }
  * ```
  *
@@ -35,18 +47,59 @@ import java.io.IOException
  * - a field the file declares is the value: JS may leave it out or repeat it,
  *   a different value is refused (`E_INVALID_CONFIG`);
  * - `allowUnsigned`, `allowUnpinnedConfigApi`, `allowServerGeneratedKey` from
- *   JS are refused unless the file allows them for that block.
+ *   JS are refused unless the file allows them for that block;
+ * - `url`, `tokenHosts` and `clientCertHosts` of a block are fixed where the
+ *   file gives them, and `attestation: true` / `proofOfPossession: true` there
+ *   cannot be switched off;
+ * - `require` only tightens: a protection it turns on stays on whatever JS
+ *   says, `requireCaTrust` hosts are added to JS's, `expectedSignerSha256` is
+ *   fixed, and `expiredConfigGraceSeconds` is the most JS may ask for;
+ * - `vaultFiles` fixes those files' signature key, encryption and screen lock;
+ *   with the section present, a JS vault file it does not name is refused.
  *
- * Without the file, release builds (the app is not debuggable) refuse those
- * three relaxations from JS; debug builds take them as before.
+ * Without the file, release builds (the app is not debuggable) refuse to start
+ * a config with Config APIs or static pins: the trust anchors would come from
+ * JS alone. An app that accepts that says so natively, in its manifest
+ * (`<meta-data android:name="io.github.umutcansu.pinvault.ALLOW_NO_NATIVE_SECURITY_FILE" android:value="true"/>`);
+ * the three relaxations stay refused from JS then. Debug builds take
+ * everything as before. Whatever the file says, a release build caps
+ * `expiredConfigGrace` at [MAX_RELEASE_GRACE_MS].
  */
 internal class NativeSecurity(
     /** Where the file came from, for messages. */
     val source: String,
     val blocks: Map<String, Block>,
     val staticPins: CertificateConfig?,
+    val require: Require = Require(),
+    /** Null when the file has no `vaultFiles` section. */
+    val vaultFiles: Map<String, VaultFilePolicy>? = null,
 ) {
 
+    /** The `require` section: protections JS cannot switch off. */
+    class Require(
+        val requireUnlockedDevice: Boolean = false,
+        val requireHardwareBackedKeys: Boolean = false,
+        /** Pins `requirePinnedReactNativeNetworking`: JS cannot set it false (RN-3). */
+        val requirePinnedReactNativeNetworking: Boolean = false,
+        val managedTrustRoots: Boolean = false,
+        val wipeVaultFilesOnRevocation: Boolean = false,
+        val requireCaTrust: List<String>? = null,
+        val expectedSignerSha256: List<String>? = null,
+        /** The most `expiredConfigGrace` JS may set; null = only the release cap. */
+        val expiredConfigGraceMs: Long? = null,
+        /** The most `vaultFileMaxOfflineAge` JS may set (and the value when JS sets none); null = no rule. */
+        val vaultFileMaxOfflineAgeMs: Long? = null,
+    )
+
+    /** One `vaultFiles` entry: what JS cannot change about that file. */
+    class VaultFilePolicy(
+        val signaturePublicKey: String?,
+        val encryption: VaultFileEncryption?,
+        val userAuth: UserAuth?,
+        /** The most `maxOfflineAge` JS may give this file (and the value when JS gives none). */
+        val maxOfflineAgeMs: Long? = null,
+    )
+
     class Block(
         val bootstrapPins: List<HostPin>?,
         val signaturePublicKeys: List<String>?,
@@ -58,10 +111,25 @@ internal class NativeSecurity(
         val allowUnsigned: Boolean,
         val allowUnpinnedConfigApi: Boolean,
         val allowServerGeneratedKey: Boolean,
+        val url: String? = null,
+        val attestation: Boolean = false,
+        val tokenHosts: List<String>? = null,
+        val proofOfPossession: Boolean = false,
+        val clientCertHosts: List<String>? = null,
+        val enrollmentUrl: String? = null,
+        val renewalUrl: String? = null,
     )
 
     companion object {
         const val ASSET_NAME = "pinvault_security.json"
+        const val NO_FILE_META_DATA = "io.github.umutcansu.pinvault.ALLOW_NO_NATIVE_SECURITY_FILE"
+        /** The longest `expiredConfigGrace` a release build takes: an expired pin set must not live on for months. */
+        const val MAX_RELEASE_GRACE_MS = 7L * 24 * 3600 * 1000
+        private const val MAX_OFFLINE_AGE_S = 10L * 365 * 24 * 3600
+
+        private fun httpsOnly(b: Fields, key: String): String? = b.string(key, 2048)?.also {
+            if (!it.startsWith("https://")) throw BridgeInputException("${b.path}.$key: must be an https:// URL")
+        }
         private const val MAX_FILE_CHARS = 256 * 1024
 
         /** The file from the app's assets; null when the app ships none. A broken file throws [BridgeInputException]. */
@@ -77,6 +145,15 @@ internal class NativeSecurity(
             return parse(text, "assets/$ASSET_NAME")
         }
 
+        /** True when the app's manifest says it starts without a native security file in release. */
+        fun noFileAllowed(context: Context): Boolean = try {
+            @Suppress("DEPRECATION")
+            context.packageManager.getApplicationInfo(context.packageName, android.content.pm.PackageManager.GET_META_DATA)
+                .metaData?.getBoolean(NO_FILE_META_DATA, false) == true
+        } catch (_: Exception) {
+            false
+        }
+
         /** True for a release build of the app (not `android:debuggable`). */
         fun isReleaseBuild(context: Context): Boolean =
             (context.applicationInfo.flags and ApplicationInfo.FLAG_DEBUGGABLE) == 0
@@ -103,15 +180,57 @@ internal class NativeSecurity(
                         allowUnsigned = b.bool("allowUnsigned") == true,
                         allowUnpinnedConfigApi = b.bool("allowUnpinnedConfigApi") == true,
                         allowServerGeneratedKey = b.bool("allowServerGeneratedKey") == true,
+                        url = httpsOnly(b, "url"),
+                        attestation = b.bool("attestation") == true,
+                        tokenHosts = b.stringList("tokenHosts", 64, 255),
+                        proofOfPossession = b.bool("proofOfPossession") == true,
+                        clientCertHosts = b.stringList("clientCertHosts", 64, 2048),
+                        enrollmentUrl = httpsOnly(b, "enrollmentUrl"),
+                        renewalUrl = httpsOnly(b, "renewalUrl"),
                     )
                     b.finish()
                 }
                 val staticPins = root.obj("staticPins")?.let(ConfigParser::staticPins)
+                val require = root.obj("require")?.let { r ->
+                    Require(
+                        requireUnlockedDevice = r.bool("requireUnlockedDevice") == true,
+                        requireHardwareBackedKeys = r.bool("requireHardwareBackedKeys") == true,
+                        requirePinnedReactNativeNetworking = r.bool("requirePinnedReactNativeNetworking") == true,
+                        managedTrustRoots = r.bool("managedTrustRoots") == true,
+                        wipeVaultFilesOnRevocation = r.bool("wipeVaultFilesOnRevocation") == true,
+                        requireCaTrust = r.stringList("requireCaTrust", 64, 255),
+                        expectedSignerSha256 = r.stringList("expectedSignerSha256", 16, 128),
+                        expiredConfigGraceMs = r.long("expiredConfigGraceSeconds", 0, MAX_RELEASE_GRACE_MS / 1000)?.let { it * 1000 },
+                        vaultFileMaxOfflineAgeMs = r.long("vaultFileMaxOfflineAgeSeconds", 1, MAX_OFFLINE_AGE_S)?.let { it * 1000 },
+                    ).also {
+                        // iOS-only (screen-lock strength): read for the shape, used by the iOS side.
+                        r.string("userAuthStrength", 32)
+                        // iOS-only (bundle and team ids): read for the shape, used by the iOS side.
+                        r.stringList("expectedBundleIds", 16, 255)
+                        r.stringList("expectedTeamIds", 16, 32)
+                        r.finish()
+                    }
+                } ?: Require()
+                val vaultFiles = root.objList("vaultFiles", ConfigParser.MAX_VAULT_FILES)?.let { list ->
+                    val map = LinkedHashMap<String, VaultFilePolicy>()
+                    list.forEach { f ->
+                        val key = f.requireString("key", 128)
+                        if (key in map) throw BridgeInputException("${f.path}.key: '$key' is declared twice")
+                        map[key] = VaultFilePolicy(
+                            signaturePublicKey = f.string("signaturePublicKey", ConfigParser.KEY_LENGTH, multiline = true),
+                            encryption = f.enum("encryption", VaultFileEncryption.values()),
+                            userAuth = f.enum("userAuth", UserAuth.values()),
+                            maxOfflineAgeMs = f.long("maxOfflineAgeSeconds", 1, MAX_OFFLINE_AGE_S)?.let { it * 1000 },
+                        )
+                        f.finish()
+                    }
+                    map
+                }
                 root.finish()
                 if (blocks.isEmpty() && staticPins == null) {
                     throw BridgeInputException("$source: declares neither configApis nor staticPins")
                 }
-                return NativeSecurity(source, blocks, staticPins)
+                return NativeSecurity(source, blocks, staticPins, require, vaultFiles)
             } catch (e: BridgeInputException) {
                 val message = e.message ?: ""
                 throw BridgeInputException(if (message.startsWith("native security file")) message else "native security file $message")
@@ -180,6 +299,16 @@ internal object SecurityPolicy {
         relaxation("allowUnpinnedConfigApi", js.allowUnpinned, block.allowUnpinnedConfigApi)
         relaxation("allowServerGeneratedKey", js.allowServerKey, block.allowServerGeneratedKey)
 
+        // A release build's trust anchors come from the file, so a declared block
+        // must carry them: a bare `{"id": …}` would hand pins and keys to the bundle.
+        if (release) {
+            fun anchor(key: String, relaxation: String): Nothing = throw BridgeInputException(
+                "$path.$key: a release build takes it only from the app's native security file (${native.source}); " +
+                    "declare $key for Config API '$id' there (or $relaxation)")
+            if (block.bootstrapPins == null && !block.allowUnpinnedConfigApi) anchor("bootstrapPins", "allowUnpinnedConfigApi")
+            if (block.signaturePublicKeys == null && !block.allowUnsigned) anchor("signaturePublicKeys", "allowUnsigned")
+        }
+
         val pins = block.bootstrapPins?.also { n ->
             if (js.bootstrapPins != null && !NativeSecurity.samePins(js.bootstrapPins, n)) fixed("bootstrapPins")
         } ?: js.bootstrapPins

package/android/src/main/java/io/github/umutcansu/pinvault/reactnative/PinVaultModule.kt

@@ -103,6 +103,7 @@ class PinVaultModule(reactContext: ReactApplicationContext) : NativePinVaultSpec
                         listener = connectionListener,
                         native = NativeSecurity.load(app),
                         release = NativeSecurity.isReleaseBuild(app),
+                        noFileAllowed = NativeSecurity.noFileAllowed(app),
                     )
                 } catch (e: IllegalArgumentException) {
                     // The guard of the running config stays: a refused config changes nothing.
@@ -119,7 +120,9 @@ class PinVaultModule(reactContext: ReactApplicationContext) : NativePinVaultSpec
                         )
                         return@launch
                     }
-                    if (parsed.pinGlobalNetworking) PinVaultNetworking.install(app)
+                    // Installed here only when the plugin's provider was removed and the app did not
+                    // install it before React Native started: marked late (HookStatus.installedLate).
+                    if (parsed.pinGlobalNetworking && !PinVaultNetworking.isInstalled) PinVaultNetworking.install(app, late = true)
                     val hooks = PinVaultNetworking.warnIfNotPinned("PinVault.start")
                     if (parsed.networking.requirePinned && !hooks.pinned) {
                         promise.reject(E_NETWORKING_NOT_PINNED, "requirePinnedReactNativeNetworking: ${hooks.describe()}")
@@ -142,7 +145,8 @@ class PinVaultModule(reactContext: ReactApplicationContext) : NativePinVaultSpec
                             // Setup failed (InitResult.Failed): RN's https stays refused.
                         }
                     }
-                    promise.resolve(toBridge(mapper.init(result)))
+                    // Says whether the anchors came from the native security file (README "Native security file").
+                    promise.resolve(toBridge(mapper.init(result) + ("nativeSecurityApplied" to parsed.nativeSecurityApplied)))
                 } catch (e: Exception) {
                     promise.reject(E_NATIVE, tokens.redact("${e.javaClass.simpleName}: ${e.message}"), exceptionInfo(e))
                 }
@@ -337,8 +341,11 @@ class PinVaultModule(reactContext: ReactApplicationContext) : NativePinVaultSpec
         guard?.answer(requestId, allowed)
     }
 
+    /** A vault file key: the library's rule (it names the stored copy's file). */
     private fun checkKey(key: String) {
-        if (key.isEmpty() || key.length > 128) throw BridgeInputException("key: must be 1 to 128 characters")
+        if (!VAULT_KEY.matches(key) || key.all { it == '.' }) {
+            throw BridgeInputException("key: must match [A-Za-z0-9._-]{1,64} and not be only dots")
+        }
     }
 
     private fun rejectNow(promise: Promise, code: String, message: String): Nothing {
@@ -408,3 +415,5 @@ class PinVaultModule(reactContext: ReactApplicationContext) : NativePinVaultSpec
         }
     }
 }
+
+private val VAULT_KEY = Regex("^[A-Za-z0-9._-]{1,64}$")