@umutcansu/react-native-pinvault 2.3.2 → 2.4.1

package/android/src/main/java/io/github/umutcansu/pinvault/reactnative/PinVaultNetworking.kt

@@ -10,6 +10,7 @@ import com.facebook.react.modules.network.CustomClientBuilder
 import com.facebook.react.modules.network.NetworkingModule
 import com.facebook.react.modules.network.OkHttpClientFactory
 import com.facebook.react.modules.network.OkHttpClientProvider
+import com.facebook.react.modules.websocket.WebSocketModule
 import io.github.umutcansu.pinvault.PinVault
 import okhttp3.Cache
 import okhttp3.CookieJar
@@ -35,7 +36,7 @@ import javax.net.ssl.X509TrustManager
  * Startup pattern, without the dependency). [install] stays as an explicit
  * alternative for apps that remove the provider.
  *
- * Two hooks, both verified against React Native 0.87's sources:
+ * Three hooks, verified against React Native 0.81 and 0.87's sources:
  *
  * - `NetworkingModule.setCustomClientBuilder`: RN calls it for **every**
  *   fetch / XHR request on `client.newBuilder()`. Each request gets the
@@ -50,6 +51,11 @@ import javax.net.ssl.X509TrustManager
  *   singleton, Fresco's image client) get a forwarding socket factory: every
  *   TLS handshake uses the pinned factory of the current start. No disk
  *   cache, no `https` → `http` redirects.
+ * - `WebSocketModule.setCustomClientBuilder`: RN calls it for every
+ *   `WebSocket`. Up to 0.81 the module builds each socket's client from a
+ *   bare `OkHttpClient.Builder()`, outside `OkHttpClientProvider`; from 0.87
+ *   it derives it from the provider's client. Either way the socket gets the
+ *   same forwarding factory, gate and network interceptors.
  *
  * Before `start()` — and after a start that failed — every `https` request
  * through RN's networking fails (`IOException: PinVault has not started`),
@@ -59,7 +65,7 @@ import javax.net.ssl.X509TrustManager
  * without a pin entry are refused by PinVault's trust manager like
  * everywhere else.
  *
- * Another library that calls `setOkHttpClientFactory` or
+ * Another library that calls `setOkHttpClientFactory` or either
  * `setCustomClientBuilder` after PinVault replaces these hooks: [status]
  * tells, `start()` and every plugin `fetch` check it and log a warning, and
  * `requirePinnedReactNativeNetworking: true` makes `start()` fail.
@@ -71,39 +77,50 @@ object PinVaultNetworking {
     @Volatile private var installed = false
     @Volatile private var app: Context? = null
 
-    /** The two hooks this object installed; compared by identity in [status]. */
+    /** The hooks this object installed; compared by identity in [status]. */
     private val factory = OkHttpClientFactory {
-        pinning.configureLongLived(OkHttpClientProvider.createClientBuilder()).build()
+        pinning.track(pinning.configureLongLived(OkHttpClientProvider.createClientBuilder()).build())
     }
     private val clientBuilder = CustomClientBuilder { builder -> pinning.configurePerRequest(builder) }
+    private val webSocketBuilder = CustomClientBuilder { builder -> pinning.configureLongLived(builder) }
 
     internal val pinning = NetworkPinning(
         applier = { builder -> PinVault.applyTo(builder) },
         httpCache = { app?.let { ReactHttpCache.get(it) } },
+        hooksPinned = { status().pinned },
     )
 
+    /** True when [install] ran only from `start()`: React Native may have built clients before it. */
+    @Volatile private var installedLate = false
+
     /**
-     * Installs both hooks (once per process). The plugin's content provider
+     * Installs the hooks (once per process). The plugin's content provider
      * calls it before `Application.onCreate`; call it yourself in
      * `MainApplication.onCreate`, before `loadReactNative`, only when the app
      * removed that provider.
      */
     @JvmStatic
     @Synchronized
-    fun install(context: Context) {
+    fun install(context: Context) = install(context, late = false)
+
+    /** [late]: called from `start()`, after React Native may already have built its clients. */
+    @Synchronized
+    internal fun install(context: Context, late: Boolean) {
         if (installed) return
         app = context.applicationContext
         OkHttpClientProvider.setOkHttpClientFactory(factory)
         NetworkingModule.setCustomClientBuilder(clientBuilder)
+        WebSocketModule.setCustomClientBuilder(webSocketBuilder)
         installed = true
+        installedLate = late
     }
 
     @JvmStatic
     val isInstalled: Boolean get() = installed
 
-    /** Whether React Native's two networking hooks are still the ones [install] set. */
+    /** Whether React Native's networking hooks are still the ones [install] set. */
     @JvmStatic
-    fun status(): HookStatus = HookStatus.read(installed, factory, clientBuilder)
+    fun status(): HookStatus = HookStatus.read(installed, factory, clientBuilder, webSocketBuilder, installedLate)
 
     private val warned = java.util.concurrent.atomic.AtomicReference<HookStatus?>(null)
 
@@ -126,30 +143,41 @@ data class HookStatus(
     val factoryIsPinVault: Boolean?,
     /** `NetworkingModule`'s custom client builder is PinVault's. */
     val clientBuilderIsPinVault: Boolean?,
+    /** `WebSocketModule`'s custom client builder is PinVault's. */
+    val webSocketBuilderIsPinVault: Boolean?,
+    /** Installed only by `start()`: clients React Native built before (Fresco's, among them) keep the system's trust. */
+    val installedLate: Boolean = false,
 ) {
-    val pinned: Boolean get() = installed && factoryIsPinVault == true && clientBuilderIsPinVault == true
+    val pinned: Boolean get() = installed && !installedLate && factoryIsPinVault == true &&
+        clientBuilderIsPinVault == true && webSocketBuilderIsPinVault == true
 
     fun describe(): String = when {
         pinned -> "React Native's networking is pinned by PinVault"
+        installed && installedLate -> "React Native's networking hooks were installed only by start() (the plugin's content provider " +
+            "was removed and PinVaultNetworking.install was not called before React Native started): clients it built " +
+            "before, such as the image client, are NOT pinned"
         !installed -> "React Native's networking hooks are not installed (the plugin's content provider was removed " +
             "and PinVaultNetworking.install was not called, or android.pinGlobalNetworking is false): " +
             "RN fetch / XHR / WebSocket / images are NOT pinned"
         else -> buildList {
             if (factoryIsPinVault != true) add("OkHttpClientProvider's client factory " + if (factoryIsPinVault == null) "could not be read" else "was replaced by another library")
             if (clientBuilderIsPinVault != true) add("NetworkingModule's custom client builder " + if (clientBuilderIsPinVault == null) "could not be read" else "was replaced by another library")
+            if (webSocketBuilderIsPinVault != true) add("WebSocketModule's custom client builder " + if (webSocketBuilderIsPinVault == null) "could not be read" else "was replaced by another library")
         }.joinToString("; ") + ": React Native's own networking may NOT be pinned"
     }
 
     internal companion object {
-        fun read(installed: Boolean, ourFactory: Any, ourBuilder: Any): HookStatus = HookStatus(
+        fun read(installed: Boolean, ourFactory: Any, ourBuilder: Any, ourWebSocketBuilder: Any, installedLate: Boolean = false): HookStatus = HookStatus(
             installed,
             isOurs(OkHttpClientProvider::class.java, "factory", ourFactory),
             isOurs(NetworkingModule::class.java, "customClientBuilder", ourBuilder),
+            isOurs(WebSocketModule::class.java, "customClientBuilder", ourWebSocketBuilder),
+            installedLate,
         )
 
         /**
          * Whether RN's private static field [name] holds [ours]; null when it
-         * cannot be read. The plugin's consumer R8 rules keep both fields' names.
+         * cannot be read. The plugin's consumer R8 rules keep the fields' names.
          */
         private fun isOurs(owner: Class<*>, name: String, ours: Any): Boolean? = try {
             owner.getDeclaredField(name).apply { isAccessible = true }.get(null) === ours
@@ -199,8 +227,30 @@ internal object ReactHttpCache {
 internal class NetworkPinning(
     private val applier: (OkHttpClient.Builder) -> Unit,
     private val httpCache: () -> Cache? = { null },
+    /** Whether React Native's hooks are still PinVault's (``PinVaultNetworking.status``). */
+    private val hooksPinned: () -> Boolean = { true },
 ) {
 
+    /** The long-lived clients React Native built through the factory: their pools are emptied on every change. */
+    private val longLived = java.util.Collections.synchronizedList(mutableListOf<java.lang.ref.WeakReference<OkHttpClient>>())
+
+    /** Last answer of [hooksPinned] and when it was read (reflection: not on every request). */
+    @Volatile private var hooksCheckedAt = 0L
+    @Volatile private var hooksWerePinned = true
+
+    fun track(client: OkHttpClient): OkHttpClient {
+        longLived.add(java.lang.ref.WeakReference(client))
+        return client
+    }
+
+    /** Closes the idle pooled connections of every long-lived client: the next request makes a fresh, pinned handshake. */
+    private fun evictLongLived() {
+        synchronized(longLived) {
+            longLived.removeAll { it.get() == null }
+            longLived.forEach { it.get()?.connectionPool?.evictAll() }
+        }
+    }
+
     /** A client `PinVault.applyTo` configured after the last `start()`; null = not started. */
     @Volatile private var template: OkHttpClient? = null
     @Volatile var options: NetworkingOptions = NetworkingOptions()
@@ -212,11 +262,13 @@ internal class NetworkPinning(
     fun activate(options: NetworkingOptions = this.options) {
         this.options = options
         template = OkHttpClient.Builder().also(applier).build()
+        evictLongLived()
     }
 
     @Synchronized
     fun deactivate() {
         template = null
+        evictLongLived()
     }
 
     /** NetworkingModule's per-request builder (fetch / XHR). */
@@ -242,23 +294,71 @@ internal class NetworkPinning(
         pinned.networkInterceptors.forEach { if (it !in builder.networkInterceptors()) builder.addNetworkInterceptor(it) }
     }
 
-    /** Clients RN builds once and keeps: TLS goes through the pinned factory of the current start. */
+    /**
+     * Clients RN builds once and keeps, and each WebSocket's client: TLS goes
+     * through the pinned factory of the current start. Idempotent: from RN
+     * 0.87 a WebSocket's builder derives from a client already configured here.
+     */
     fun configureLongLived(builder: OkHttpClient.Builder): OkHttpClient.Builder {
         val forwarding = ForwardingSocketFactory { template?.sslSocketFactory }
         builder.sslSocketFactory(forwarding, ForwardingTrustManager { template?.x509TrustManager })
-        builder.addInterceptor(httpsGate)
+        if (httpsGate !in builder.interceptors()) builder.addInterceptor(httpsGate)
+        // The current start's network interceptors (the per-request pin check of a pooled
+        // or coalesced connection, among them) run for these clients too.
+        if (forwardingNetwork !in builder.networkInterceptors()) builder.addNetworkInterceptor(forwardingNetwork)
         builder.cache(null)
         builder.followSslRedirects(false)
         return builder
     }
 
-    /** Refuses `https` while PinVault has not started. */
+    /**
+     * Refuses `https` while PinVault has not started, and — with
+     * `requirePinnedReactNativeNetworking` — once another library has replaced
+     * React Native's hooks after start (checked at most every few seconds).
+     */
     private val httpsGate = Interceptor { chain ->
-        if (chain.request().isHttps && template == null) {
-            throw IOException("PinVault has not started: https requests are refused until start() returns")
+        if (chain.request().isHttps) {
+            if (template == null) throw IOException("PinVault has not started: https requests are refused until start() returns")
+            if (options.requirePinned && !hooksStillPinned()) {
+                throw IOException("requirePinnedReactNativeNetworking: React Native's networking hooks are no longer PinVault's")
+            }
         }
         chain.proceed(chain.request())
     }
+
+    private fun hooksStillPinned(): Boolean {
+        val now = android.os.SystemClock.elapsedRealtime()
+        if (now - hooksCheckedAt > HOOK_CHECK_MS) {
+            hooksWerePinned = hooksPinned()
+            hooksCheckedAt = now
+        }
+        return hooksWerePinned
+    }
+
+    /** Runs the current start's network interceptors in order, then the request. */
+    private val forwardingNetwork = Interceptor { chain ->
+        val interceptors = template?.networkInterceptors ?: emptyList()
+        ForwardingChain(chain, interceptors, 0).proceed(chain.request())
+    }
+
+    companion object {
+        const val HOOK_CHECK_MS = 5_000L
+    }
+}
+
+/** A chain that hands the request to `interceptors[index]`, …, and finally to the real chain. */
+internal class ForwardingChain(
+    private val base: Interceptor.Chain,
+    private val interceptors: List<Interceptor>,
+    private val index: Int,
+) : Interceptor.Chain by base {
+    override fun proceed(request: okhttp3.Request): okhttp3.Response =
+        if (index >= interceptors.size) base.proceed(request)
+        else interceptors[index].intercept(ForwardingChain(base, interceptors, index + 1).withRequest(request))
+
+    private var current: okhttp3.Request = base.request()
+    private fun withRequest(request: okhttp3.Request) = also { current = request }
+    override fun request(): okhttp3.Request = current
 }
 
 /** Hands every socket to the pinned factory of the current start; none before `start()`. */

package/ios/Core/ConfigParser.swift

@@ -30,23 +30,38 @@ public enum ConfigParser {
 
     /// - Parameters:
     ///   - native: the app's native security file (``NativeSecurity``); nil = none.
-    ///   - release: a release build: without a native file, the relaxations (`allowUnsigned`, …) are refused from JS.
+    ///   - release: a release build: without a native file, a config with Config APIs or static
+    ///     pins is refused (unless `noFileAllowed`) and the relaxations (`allowUnsigned`, …) are
+    ///     refused from JS; `expiredConfigGrace` is capped.
+    ///   - noFileAllowed: the app's Info.plist accepts a release start without the file (``NativeSecurity/noFileInfoKey``).
     public static func parse(
         _ json: String,
         tokens: VaultTokenStore,
         guardFactory: (Int64) -> any EnvironmentGuard,
         listener: PinVaultConnectionListener?,
         native: NativeSecurity? = nil,
-        release: Bool = false
+        release: Bool = false,
+        noFileAllowed: Bool = false,
+        reactNetworkingEnabled: Bool = true
     ) throws -> ParsedConfig {
         let root = try StrictJSON.parseObject(json, path: "config")
         let builder = PinVaultConfig.Builder()
+        let require = native?.require ?? NativeSecurity.Require()
 
-        for api in try root.objectList("configApis", maxItems: maxConfigApis) ?? [] {
+        let configApis = try root.objectList("configApis", maxItems: maxConfigApis)
+        let vaultFiles = try root.objectList("vaultFiles", maxItems: maxVaultFiles)
+        let jsStaticPins = try root.object("staticPins").map(staticPins)
+        if release && native == nil && !noFileAllowed && (!(configApis ?? []).isEmpty || jsStaticPins != nil) {
+            throw BridgeInputError(
+                "config: a release build takes its trust anchors only from the app's native security file " +
+                    "(\(NativeSecurity.resourceName).json, README \"Native security file\"); none is shipped. " +
+                    "An app that accepts JS-only anchors says so in its Info.plist: \(NativeSecurity.noFileInfoKey) = YES"
+            )
+        }
+        for api in configApis ?? [] {
             try addConfigApi(builder, api, native: native, release: release)
         }
-        for file in try root.objectList("vaultFiles", maxItems: maxVaultFiles) ?? [] { try addVaultFile(builder, file, tokens) }
-        let jsStaticPins = try root.object("staticPins").map(staticPins)
+        for file in vaultFiles ?? [] { try addVaultFile(builder, file, tokens, native: native) }
         if let pins = try SecurityPolicy.staticPins(path: "config.staticPins", js: jsStaticPins, native: native) {
             builder.staticPins(pins)
         }
@@ -55,13 +70,38 @@ public enum ConfigParser {
         if let v = try root.int64("updateIntervalHours", min: 1, max: 24 * 30) { builder.updateIntervalHours(v) }
         if let v = try root.int64("updateIntervalMinutes", min: 15, max: 60 * 24 * 30) { builder.updateIntervalMinutes(v) }
         if let v = try root.string("deviceAlias", maxLength: 128) { builder.deviceAlias(v) }
-        if let d = try root.object("expiredConfigGrace") { let (a, u) = try duration(d); builder.expiredConfigGrace(a, u) }
-        if let v = try root.stringList("requireCaTrust", maxItems: 64, maxLength: 255) { builder.requireCaTrust(v) }
-        if try root.bool("wipeVaultFilesOnRevocation") == true { builder.wipeVaultFilesOnRevocation() }
-        if let d = try root.object("vaultFileMaxOfflineAge") { let (a, u) = try duration(d); builder.vaultFileMaxOfflineAge(a, u) }
-        if try root.bool("requireUnlockedDevice") == true { builder.requireUnlockedDevice() }
-        if try root.bool("requireHardwareBackedKeys") == true { builder.requireHardwareBackedKeys() }
-        if try root.bool("managedTrustRoots") == true { builder.managedTrustRoots() }
+        if let d = try root.object("expiredConfigGrace") {
+            let (a, u) = try duration(d)
+            let ms = millis(a, u)
+            if release && ms > NativeSecurity.maxReleaseGraceMs { throw BridgeInputError("\(d.path): a release build takes at most 7 days") }
+            if let max = require.expiredConfigGraceMs, ms > max {
+                throw BridgeInputError("\(d.path): longer than the app's native security file allows (\(max / 1000) s)")
+            }
+            builder.expiredConfigGrace(a, u)
+        } else if let max = require.expiredConfigGraceMs {
+            builder.expiredConfigGrace(max, .milliseconds)
+        }
+        // `require` hosts are added to JS's: JS can name more, never fewer.
+        let caTrust = (try root.stringList("requireCaTrust", maxItems: 64, maxLength: 255) ?? []) + (require.requireCaTrust ?? [])
+        if !caTrust.isEmpty {
+            var seen = Set<String>()
+            builder.requireCaTrust(caTrust.filter { seen.insert($0).inserted })
+        }
+        if try root.bool("wipeVaultFilesOnRevocation") == true || require.wipeVaultFilesOnRevocation { builder.wipeVaultFilesOnRevocation() }
+        if let d = try root.object("vaultFileMaxOfflineAge") {
+            let (a, u) = try duration(d)
+            if let max = require.vaultFileMaxOfflineAgeMs {
+                let ms = millis(a, u)
+                // 0 = no limit: longer than any.
+                if ms == 0 || ms > max { throw BridgeInputError("\(d.path): longer than the app's native security file allows (\(max / 1000) s)") }
+            }
+            builder.vaultFileMaxOfflineAge(a, u)
+        } else if let max = require.vaultFileMaxOfflineAgeMs {
+            builder.vaultFileMaxOfflineAge(max, .milliseconds)
+        }
+        if try root.bool("requireUnlockedDevice") == true || require.requireUnlockedDevice { builder.requireUnlockedDevice() }
+        if try root.bool("requireHardwareBackedKeys") == true || require.requireHardwareBackedKeys { builder.requireHardwareBackedKeys() }
+        if try root.bool("managedTrustRoots") == true || require.managedTrustRoots { builder.managedTrustRoots() }
         if let v = try root.stringList("expectedSignerSha256", maxItems: 16, maxLength: 128) { builder.expectedSignerSha256(v) }
 
         var guardTimeout: Int64?
@@ -73,7 +113,11 @@ public enum ConfigParser {
             builder.environmentGuard(guardFactory(timeout))
         }
 
-        let requirePinned = try root.bool("requirePinnedReactNativeNetworking") == true
+        // On by default in a release build — unless the app opted out of pinning RN's
+        // networking natively (Info.plist PinVaultPinReactNativeNetworking = NO).
+        // The native security file can pin this on (RN-3): JS may turn it on, never off.
+        let requirePinned = (try root.bool("requirePinnedReactNativeNetworking") ?? (release && reactNetworkingEnabled))
+            || require.requirePinnedReactNativeNetworking
         // Android-only settings: the Android side reads them; here only their shape is checked.
         _ = try root.object("android")
         var maxRN = ReactNetworking.defaultMaxResponseBytes
@@ -82,12 +126,28 @@ public enum ConfigParser {
             if let resolve = try ios.stringMap("resolve", maxItems: 64, maxKeyLength: 255, maxValueLength: 255) {
                 for (host, address) in resolve.sorted(by: { $0.key < $1.key }) { builder.resolve(host: host, to: address) }
             }
-            if let v = try ios.stringList("expectedBundleIds", maxItems: 16, maxLength: 255) { builder.expectedBundleId(v) }
-            if let v = try ios.stringList("expectedTeamIds", maxItems: 16, maxLength: 32) { builder.expectedTeamId(v) }
-            if let v = try ios.enumValue("userAuthStrength", UserAuthStrength.self) { builder.userAuthStrength(v) }
+            if let v = try fixedList("config.ios.expectedBundleIds", require.expectedBundleIds,
+                                     try ios.stringList("expectedBundleIds", maxItems: 16, maxLength: 255), native) {
+                builder.expectedBundleId(v)
+            }
+            if let v = try fixedList("config.ios.expectedTeamIds", require.expectedTeamIds,
+                                     try ios.stringList("expectedTeamIds", maxItems: 16, maxLength: 32), native) {
+                builder.expectedTeamId(v)
+            }
+            let jsStrength = try ios.enumValue("userAuthStrength", UserAuthStrength.self)
+            if let fixed = require.userAuthStrength, let jsStrength, jsStrength != fixed {
+                throw BridgeInputError("config.ios.userAuthStrength: differs from the app's native security file (\(native?.source ?? "")); the native value is fixed")
+            }
+            if let v = require.userAuthStrength ?? jsStrength { builder.userAuthStrength(v) }
             try ios.finish()
         }
 
+        else {
+            if let v = require.expectedBundleIds { builder.expectedBundleId(v) }
+            if let v = require.expectedTeamIds { builder.expectedTeamId(v) }
+            if let v = require.userAuthStrength { builder.userAuthStrength(v) }
+        }
+
         try root.finish()
         if let listener { builder.onConnectionEvent(listener) }
         var parsed = ParsedConfig(config: try builder.build(), guardTimeoutMs: guardTimeout)
@@ -97,6 +157,26 @@ public enum ConfigParser {
         return parsed
     }
 
+    /// A JS list against the native file's: fixed where the file gives it.
+    static func fixedList(_ path: String, _ native: [String]?, _ js: [String]?, _ file: NativeSecurity?) throws -> [String]? {
+        guard let native else { return js }
+        if let js, !NativeSecurity.sameKeys(js, native) {
+            throw BridgeInputError("\(path): differs from the app's native security file (\(file?.source ?? "")); the native value is fixed")
+        }
+        return native
+    }
+
+    static func millis(_ amount: Int64, _ unit: TimeUnit) -> Int64 {
+        switch unit {
+        case .milliseconds: return amount
+        case .seconds: return amount.multipliedReportingOverflow(by: 1000).overflow ? .max : amount * 1000
+        case .minutes: return amount.multipliedReportingOverflow(by: 60_000).overflow ? .max : amount * 60_000
+        case .hours: return amount.multipliedReportingOverflow(by: 3_600_000).overflow ? .max : amount * 3_600_000
+        case .days: return amount.multipliedReportingOverflow(by: 86_400_000).overflow ? .max : amount * 86_400_000
+        default: return .max
+        }
+    }
+
     static func duration(_ d: Fields) throws -> (Int64, TimeUnit) {
         guard let amount = try d.int64("amount", min: 0, max: 10 * 365 * 24 * 3600 * 1000) else {
             throw BridgeInputError("\(d.path).amount: required")
@@ -116,6 +196,18 @@ public enum ConfigParser {
         return url
     }
 
+    /// An endpoint path resolved relative to the block's base URL. An absolute
+    /// value — a scheme (`://`) or a root (`/`, `\`) — would silently retarget the
+    /// request past the pinned host (`URL(string:relativeTo:)` honours it), so it
+    /// is refused (RN-2). Returns nil when the optional field is absent.
+    static func relEndpoint(_ f: Fields, _ key: String, maxLength: Int) throws -> String? {
+        guard let v = try f.string(key, maxLength: maxLength) else { return nil }
+        if v.contains("://") || v.hasPrefix("/") || v.hasPrefix("\\") {
+            throw BridgeInputError("\(f.path).\(key): must be a relative path, not an absolute URL")
+        }
+        return v
+    }
+
     public static func hostPin(_ p: Fields) throws -> HostPin {
         let hostname = try p.requireString("hostname", maxLength: 255)
         guard let pins = try p.stringList("sha256", maxItems: maxPinsPerHost, maxLength: 128) else {
@@ -152,8 +244,8 @@ public enum ConfigParser {
         let id = try b.requireString("id", maxLength: 128)
         guard let url = try httpsUrl(b, "url") else { throw BridgeInputError("\(b.path).url: required") }
         let bootstrapPins = try b.objectList("bootstrapPins", maxItems: maxPins)?.map(hostPin)
-        let configEndpoint = try b.string("configEndpoint", maxLength: 512)
-        let healthEndpoint = try b.string("healthEndpoint", maxLength: 512)
+        let configEndpoint = try relEndpoint(b, "configEndpoint", maxLength: 512)
+        let healthEndpoint = try relEndpoint(b, "healthEndpoint", maxLength: 512)
         let oneKey = try b.string("signaturePublicKey", maxLength: keyLength, multiline: true)
         let keys = try b.stringList("signaturePublicKeys", maxItems: 16, maxLength: keyLength, multiline: true)
         if oneKey != nil && keys != nil {
@@ -169,20 +261,67 @@ public enum ConfigParser {
         let clientCaPins = try b.stringList("clientCaPins", maxItems: 16, maxLength: 128)
         let maxLifetime = try b.int("maxClientCertLifetimeDays", min: 1, max: 3650)
         let clientCertHosts = try b.stringList("clientCertHosts", maxItems: 64, maxLength: 2048)
-        let enrollmentEndpoint = try b.string("enrollmentEndpoint", maxLength: 512)
-        let clientCertEndpoint = try b.string("clientCertEndpoint", maxLength: 512)
-        let vaultReportEndpoint = try b.string("vaultReportEndpoint", maxLength: 512)
+        let enrollmentEndpoint = try relEndpoint(b, "enrollmentEndpoint", maxLength: 512)
+        let clientCertEndpoint = try relEndpoint(b, "clientCertEndpoint", maxLength: 512)
+        let vaultReportEndpoint = try relEndpoint(b, "vaultReportEndpoint", maxLength: 512)
         let clientCertLabel = try b.string("clientCertLabel", maxLength: 128)
         let wantPinsFor = try b.stringList("wantPinsFor", maxItems: 256, maxLength: 255)
         let renewalUrl = try httpsUrl(b, "renewalUrl")
         let enrollmentUrl = try httpsUrl(b, "enrollmentUrl")
         let threshold = try b.double("clientCertRenewalThreshold", min: 0, max: 1)
         let disableRenewal = try b.bool("disableClientCertRenewal") == true
-        let attestation = try b.bool("attestation") == true
+        let jsAttestation = try b.bool("attestation")
         let attestationInterval = try b.object("attestationInterval").map(duration)
-        let tokenHosts = try b.stringList("tokenHosts", maxItems: 64, maxLength: 255)
+        let jsTokenHosts = try b.stringList("tokenHosts", maxItems: 64, maxLength: 255)
+        let jsProof = try b.bool("proofOfPossession")
         try b.finish()
 
+        // Where the block talks to and who gets its token and identity: fixed where the file says.
+        let nativeBlock = native?.blocks[id]
+        func fixed(_ key: String) -> BridgeInputError {
+            BridgeInputError("\(b.path).\(key): differs from the app's native security file (\(native?.source ?? "")); the native value is fixed")
+        }
+        var blockUrl = url
+        if let n = nativeBlock?.url {
+            if n != url { throw fixed("url") }
+            blockUrl = n
+        }
+        if nativeBlock?.attestation == true && jsAttestation == false {
+            throw BridgeInputError("\(b.path).attestation: the app's native security file turns it on; JS cannot turn it off")
+        }
+        let attestation = jsAttestation == true || nativeBlock?.attestation == true
+        if nativeBlock?.proofOfPossession == true && jsProof == false {
+            throw BridgeInputError("\(b.path).proofOfPossession: the app's native security file turns it on; JS cannot turn it off")
+        }
+        let proof = jsProof == true || nativeBlock?.proofOfPossession == true
+        let lower: ([String]) -> [String] = { $0.map { $0.lowercased() } }
+        var tokenHosts = jsTokenHosts
+        if let n = nativeBlock?.tokenHosts {
+            if let j = jsTokenHosts, !NativeSecurity.sameKeys(lower(j), lower(n)) { throw fixed("tokenHosts") }
+            tokenHosts = n
+        }
+        var fixedEnrollmentUrl = enrollmentUrl
+        if let n = nativeBlock?.enrollmentUrl {
+            if let j = enrollmentUrl, j != n { throw fixed("enrollmentUrl") }
+            fixedEnrollmentUrl = n
+        }
+        var fixedRenewalUrl = renewalUrl
+        if let n = nativeBlock?.renewalUrl {
+            if let j = renewalUrl, j != n { throw fixed("renewalUrl") }
+            fixedRenewalUrl = n
+        }
+        // Who gets the device's identity is the file's call in a release build: JS cannot
+        // add a host the file does not name (tokenHosts only narrows the library's default).
+        if release, let nativeBlock, nativeBlock.clientCertHosts == nil, clientCertHosts != nil {
+            throw BridgeInputError("\(b.path).clientCertHosts: a release build takes it only from the app's native security file "
+                + "(\(native?.source ?? "")); declare clientCertHosts for Config API '\(id)' there")
+        }
+        var certHosts = clientCertHosts
+        if let n = nativeBlock?.clientCertHosts {
+            if let j = clientCertHosts, !NativeSecurity.sameKeys(lower(j), lower(n)) { throw fixed("clientCertHosts") }
+            certHosts = n
+        }
+
         // The trust anchors and relaxations: the native security file decides, JS only repeats.
         let sec = try SecurityPolicy.apply(
             path: b.path, id: id,
@@ -195,7 +334,7 @@ public enum ConfigParser {
             native: native, release: release
         )
 
-        builder.configApi(id, url: url) { api in
+        builder.configApi(id, url: blockUrl) { api in
             if let v = sec.bootstrapPins { api.bootstrapPins(v) }
             if let configEndpoint { api.configEndpoint(configEndpoint) }
             if let healthEndpoint { api.healthEndpoint(healthEndpoint) }
@@ -210,35 +349,80 @@ public enum ConfigParser {
             if sec.allowServerKey { api.allowServerGeneratedKey() }
             if let v = sec.clientCaPins { api.clientCaPins(v) }
             if let maxLifetime { api.maxClientCertLifetimeDays(maxLifetime) }
-            if let clientCertHosts { api.clientCertHosts(clientCertHosts) }
+            if let certHosts { api.clientCertHosts(certHosts) }
             if let enrollmentEndpoint { api.enrollmentEndpoint(enrollmentEndpoint) }
             if let clientCertEndpoint { api.clientCertEndpoint(clientCertEndpoint) }
             if let vaultReportEndpoint { api.vaultReportEndpoint(vaultReportEndpoint) }
             if let clientCertLabel { api.clientCertLabel(clientCertLabel) }
             if let wantPinsFor { api.wantPinsFor(wantPinsFor) }
-            if let renewalUrl { api.renewalUrl(renewalUrl) }
-            if let enrollmentUrl { api.enrollmentUrl(enrollmentUrl) }
+            if let fixedRenewalUrl { api.renewalUrl(fixedRenewalUrl) }
+            if let fixedEnrollmentUrl { api.enrollmentUrl(fixedEnrollmentUrl) }
             if let threshold { api.clientCertRenewalThreshold(threshold) }
             if disableRenewal { api.disableClientCertRenewal() }
             if attestation { api.attestation() }
             if let (amount, unit) = attestationInterval { api.attestationInterval(amount, unit) }
             if let tokenHosts { api.tokenHosts(tokenHosts) }
+            if proof { api.proofOfPossession() }
         }
     }
 
-    static func addVaultFile(_ builder: PinVaultConfig.Builder, _ f: Fields, _ tokens: VaultTokenStore) throws {
+    static func addVaultFile(_ builder: PinVaultConfig.Builder, _ f: Fields, _ tokens: VaultTokenStore, native: NativeSecurity?) throws {
         let key = try f.requireString("key", maxLength: 128)
         let endpoint = try f.requireString("endpoint", maxLength: 512)
-        let signatureKey = try f.string("signaturePublicKey", maxLength: keyLength, multiline: true)
+        if endpoint.contains("://") || endpoint.hasPrefix("/") || endpoint.hasPrefix("\\") {
+            throw BridgeInputError("\(f.path).endpoint: must be a relative path, not an absolute URL")
+        }
+        let jsSignatureKey = try f.string("signaturePublicKey", maxLength: keyLength, multiline: true)
         let updateWithPins = try f.bool("updateWithPins")
         let storage = try f.enumValue("storage", StorageStrategy.self)
         let configApi = try f.string("configApi", maxLength: 128)
         let policy = try f.enumValue("accessPolicy", VaultFileAccessPolicy.self)
-        let encryption = try f.enumValue("encryption", VaultFileEncryption.self)
-        let userAuth = try f.enumValue("userAuth", UserAuth.self)
+        let jsEncryption = try f.enumValue("encryption", VaultFileEncryption.self)
+        let jsUserAuth = try f.enumValue("userAuth", UserAuth.self)
         let maxOfflineAge = try f.object("maxOfflineAge").map(duration)
         let wipeWhenStale = try f.bool("wipeWhenStale") == true
         try f.finish()
+        var offlineAge = maxOfflineAge
+
+        // A file the native security file names keeps its signature key, encryption and lock.
+        var signatureKey = jsSignatureKey
+        var encryption = jsEncryption
+        var userAuth = jsUserAuth
+        if let files = native?.vaultFiles {
+            guard let declared = files[key] else {
+                throw BridgeInputError("\(f.path): vault file '\(key)' is not declared in the app's native security file (\(native?.source ?? ""))")
+            }
+            func fixed(_ field: String) -> BridgeInputError {
+                BridgeInputError("\(f.path).\(field): differs from the app's native security file (\(native?.source ?? "")); the native value is fixed")
+            }
+            if let n = declared.signaturePublicKey {
+                if let j = jsSignatureKey, j.trimmingCharacters(in: .whitespacesAndNewlines) != n.trimmingCharacters(in: .whitespacesAndNewlines) {
+                    throw fixed("signaturePublicKey")
+                }
+                signatureKey = n
+            }
+            if let n = declared.encryption {
+                if let j = jsEncryption, j != n { throw fixed("encryption") }
+                encryption = n
+            }
+            if let n = declared.userAuth {
+                if let j = jsUserAuth, j != n { throw fixed("userAuth") }
+                userAuth = n
+            }
+            if let max = declared.maxOfflineAgeMs, maxOfflineAge == nil {
+                offlineAge = (max, .milliseconds)
+            }
+        }
+        // The tighter of the file's own cap and the config-wide one: a per-file value
+        // overrides the config's, so it must not escape the config-wide cap either.
+        let cap = [native?.vaultFiles?[key]?.maxOfflineAgeMs, native?.require.vaultFileMaxOfflineAgeMs].compactMap { $0 }.min()
+        if let cap, let (a, u) = maxOfflineAge {
+            let ms = millis(a, u)
+            // 0 = no limit: longer than any.
+            if ms == 0 || ms > cap {
+                throw BridgeInputError("\(f.path).maxOfflineAge: longer than the app's native security file allows (\(cap / 1000) s)")
+            }
+        }
 
         builder.vaultFile(key) { file in
             file.endpoint(endpoint)
@@ -255,7 +439,7 @@ public enum ConfigParser {
             }
             if let encryption { file.encryption(encryption) }
             if let userAuth { file.userAuth(userAuth) }
-            if let (amount, unit) = maxOfflineAge { file.maxOfflineAge(amount, unit) }
+            if let (amount, unit) = offlineAge { file.maxOfflineAge(amount, unit) }
             if wipeWhenStale { file.wipeWhenStale() }
         }
     }