@umutcansu/react-native-pinvault 2.7.0 → 2.8.0

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 2.8.0 — 2026-10-15
+
+### Changed
+
+- **Release builds take a block's addresses only from the native security
+  file**: a declared block names its `url` there, and `enrollmentUrl` /
+  `renewalUrl` from JS are refused where the file names none (the device's
+  identity goes to all three, its token to `url`). iOS `ios.resolve` follows the
+  same rule (top-level `"ios": {"resolve": {…}}` in the file; fixed wherever the
+  file gives it). Add them to `pinvault_security.json` if a release build now
+  refuses to start.
+- `PinVault.fetch` refuses `Host`, `Connection`, `Keep-Alive`,
+  `Proxy-Connection`, `TE`, `Trailer`, `Transfer-Encoding`, `Upgrade` and
+  `Content-Length` from JS: the HTTP client sets them.
+
 ## 2.7.0 — 2026-10-15
 
 ### Changed
@@ -11,7 +26,7 @@
   library's default sends `PinVault-Token` to the block's own Config API only,
   so a `tokenHosts` from JS would add hosts that receive the device's token.
   Debug builds and files that name the hosts are unchanged. Move your
-  `tokenHosts` into `pinvault-security.json` (Android: `res/raw`, iOS: the
+  `tokenHosts` into `pinvault_security.json` (Android: `assets`, iOS: the
   bundle) if a release build now refuses to start.
 
 ## 2.6.1 — 2026-10-15

package/README.md

@@ -29,9 +29,9 @@ npm install @umutcansu/react-native-pinvault
 cd ios && pod install
 ```
 
-The native libraries come with it, at the package's own version: npm 2.7.0
-uses `io.github.umutcansu:pinvault:2.7.0` from Maven Central and the Swift
-package at tag `v2.7.0`. The New Architecture must stay on (React Native's
+The native libraries come with it, at the package's own version: npm 2.8.0
+uses `io.github.umutcansu:pinvault:2.8.0` from Maven Central and the Swift
+package at tag `v2.8.0`. The New Architecture must stay on (React Native's
 default since 0.76).
 
 **iOS.** The pod depends on the PinVault Swift package through React Native's
@@ -165,7 +165,8 @@ names), enum values are the Kotlin constant names (`'TOKEN_MTLS'`,
   requirePinnedReactNativeNetworking,                    // see Networking
   android: { requireUnlockedDeviceAllowFallback, pinGlobalNetworking,
              keepReactNativeHttpCache, keepReactNativeCookies },
-  ios: { resolve: { 'mock-tls.sample': '10.0.0.12' }, expectedBundleIds, expectedTeamIds, userAuthStrength,
+  ios: { resolve: { 'mock-tls.sample': '10.0.0.12' },   // release: only from the native security file
+         expectedBundleIds, expectedTeamIds, userAuthStrength,
          reactNativeMaxResponseBytes },
 }
 ```
@@ -236,6 +237,7 @@ signature. Ship them natively as well, in `pinvault_security.json`:
     "allowUnsigned": false, "allowUnpinnedConfigApi": false, "allowServerGeneratedKey": false
   }],
   "staticPins": { "pins": [ … ], "version": 1 },
+  "ios": { "resolve": { "api.example.com": "10.0.0.12" } },
   "require": {
     "requireUnlockedDevice": true, "requireHardwareBackedKeys": true,
     "managedTrustRoots": true, "wipeVaultFilesOnRevocation": true,
@@ -262,9 +264,9 @@ parsed as strictly; a broken file rejects `start` with `E_INVALID_CONFIG`
   applies) or repeat it (lists in any order); a different value rejects `start`
   with `E_INVALID_CONFIG` naming the field;
 - in a release build a declared block must carry its anchors: `bootstrapPins`
-  (or `allowUnpinnedConfigApi`) and `signaturePublicKeys` (or `allowUnsigned`);
-  a block that only names itself rejects `start` — otherwise the bundle would
-  supply the pins and keys;
+  (or `allowUnpinnedConfigApi`), `signaturePublicKeys` (or `allowUnsigned`) and
+  its `url` (2.7.1+: the device's token and identity go there); a block that
+  only names itself rejects `start` — otherwise the bundle would supply them;
 - `allowUnsigned`, `allowUnpinnedConfigApi` and `allowServerGeneratedKey` from
   JS are refused unless the file allows them for that block; a release build
   of the native libraries (2.4.2+) refuses the first two unless the block also
@@ -273,10 +275,13 @@ parsed as strictly; a broken file rejects `start` with `E_INVALID_CONFIG`
 - a block's `url`, `enrollmentUrl`, `renewalUrl`, `tokenHosts` and
   `clientCertHosts` are fixed where the file gives them (where the block talks to, and who gets its token and identity),
   and `attestation: true` / `proofOfPossession: true` there cannot be turned off from JS;
-  in a release build JS may give `clientCertHosts` and `tokenHosts` only where
-  the file names them (the bundle cannot hand the device's identity or its
-  `PinVault-Token` to another host; the library's default sends the token to the
-  block's own Config API only);
+  in a release build JS may give `enrollmentUrl`, `renewalUrl` (2.7.1+),
+  `clientCertHosts` and `tokenHosts` only where the file names them (the bundle
+  cannot hand the device's identity or its `PinVault-Token` to another host; the
+  library presents the identity to the block's url, enrollment and renewal
+  addresses, and its default sends the token to the block's own Config API only);
+- iOS `ios.resolve` (where a pinned host's connection goes) is fixed where the
+  file gives it, and a release build takes it only from the file (2.7.1+);
 - `require` only tightens: a protection it turns on stays on whatever JS says,
   its `requireCaTrust` hosts are added to JS's, the expected signer / bundle /
   team ids and iOS `userAuthStrength` are fixed, and `expiredConfigGraceSeconds`

package/RNPinVault.podspec

@@ -4,7 +4,7 @@ package = JSON.parse(File.read(File.join(__dir__, "package.json")))
 
 # PinVault for iOS is a Swift package (Package.swift at the repository root,
 # product "PinVault"). React Native's spm_dependency adds it to the Pods project:
-#   - consumers: the git URL at the tag of this package's version (v2.7.0);
+#   - consumers: the git URL at the tag of this package's version (v2.8.0);
 #   - development: PINVAULT_IOS_PACKAGE_PATH = a PinVault checkout (the sample's
 #     Podfile sets it to this repository), the counterpart of pinvault.localPath.
 pinvault_url = "https://github.com/umutcansu/PinVault.git"

package/android/build.gradle

@@ -9,7 +9,7 @@ buildscript {
     kotlinVersion: "2.2.0",
     minSdkVersion: 24,
     compileSdkVersion: 36,
-    pinvaultVersion: "2.7.0",
+    pinvaultVersion: "2.8.0",
   ]
   ext.pinvaultRnExt = { prop ->
     rootProject.ext.has(prop) ? rootProject.ext.get(prop) : PinVaultRN[prop]

package/android/src/main/java/io/github/umutcansu/pinvault/reactnative/ConfigParser.kt

@@ -278,6 +278,20 @@ internal object ConfigParser {
         val blockUrl = nativeBlock?.url?.also { if (it != url) fixed("url") } ?: url
         val fixedEnrollmentUrl = nativeBlock?.enrollmentUrl?.also { if (enrollmentUrl != null && it != enrollmentUrl) fixed("enrollmentUrl") } ?: enrollmentUrl
         val fixedRenewalUrl = nativeBlock?.renewalUrl?.also { if (renewalUrl != null && it != renewalUrl) fixed("renewalUrl") } ?: renewalUrl
+        // The device's identity goes to the enrollment and renewal addresses as well as to url:
+        // in a release build JS may give them only where the file names them (url itself must be
+        // in the file, SecurityPolicy.apply), like tokenHosts and clientCertHosts below.
+        if (release && nativeBlock != null) {
+            for ((key, given, declared) in listOf(
+                Triple("enrollmentUrl", enrollmentUrl, nativeBlock.enrollmentUrl),
+                Triple("renewalUrl", renewalUrl, nativeBlock.renewalUrl),
+            )) {
+                if (declared == null && given != null) {
+                    throw BridgeInputException("${b.path}.$key: a release build takes it only from the app's native security file " +
+                        "(${native?.source}); declare $key for Config API '$id' there")
+                }
+            }
+        }
         if (nativeBlock?.attestation == true && jsAttestation == false) {
             throw BridgeInputException("${b.path}.attestation: the app's native security file turns it on; JS cannot turn it off")
         }

package/android/src/main/java/io/github/umutcansu/pinvault/reactnative/NativeSecurity.kt

@@ -48,11 +48,13 @@ import java.io.IOException
  *   a different value is refused (`E_INVALID_CONFIG`);
  * - `allowUnsigned`, `allowUnpinnedConfigApi`, `allowServerGeneratedKey` from
  *   JS are refused unless the file allows them for that block;
- * - `url`, `tokenHosts` and `clientCertHosts` of a block are fixed where the
- *   file gives them, and `attestation: true` / `proofOfPossession: true` there
- *   cannot be switched off; in a release build JS may give `tokenHosts` and
- *   `clientCertHosts` only where the file names them (who gets the device's
- *   token and identity is the file's call);
+ * - `url`, `enrollmentUrl`, `renewalUrl`, `tokenHosts` and `clientCertHosts`
+ *   of a block are fixed where the file gives them, and `attestation: true` /
+ *   `proofOfPossession: true` there cannot be switched off; in a release build
+ *   a declared block must name its `url`, and JS may give `enrollmentUrl`,
+ *   `renewalUrl`, `tokenHosts` and `clientCertHosts` only where the file names
+ *   them (where the device's token and identity go is the file's call);
+ * - `ios.resolve` (top level) is the iOS side's; here it is read for the shape;
  * - `require` only tightens: a protection it turns on stays on whatever JS
  *   says, `requireCaTrust` hosts are added to JS's, `expectedSignerSha256` is
  *   fixed, and `expiredConfigGraceSeconds` is the most JS may ask for;
@@ -192,6 +194,11 @@ internal class NativeSecurity(
                     )
                     b.finish()
                 }
+                // iOS-only (connection addresses, `ios.resolve`): read for the shape, used by the iOS side.
+                root.obj("ios")?.let { ios ->
+                    ios.stringMap("resolve", 64, 255, 255)
+                    ios.finish()
+                }
                 val staticPins = root.obj("staticPins")?.let(ConfigParser::staticPins)
                 val require = root.obj("require")?.let { r ->
                     Require(
@@ -309,6 +316,10 @@ internal object SecurityPolicy {
                     "declare $key for Config API '$id' there (or $relaxation)")
             if (block.bootstrapPins == null && !block.allowUnpinnedConfigApi) anchor("bootstrapPins", "allowUnpinnedConfigApi")
             if (block.signaturePublicKeys == null && !block.allowUnsigned) anchor("signaturePublicKeys", "allowUnsigned")
+            // Where the block talks to: the library hands it the device's token and identity.
+            if (block.url == null) throw BridgeInputException(
+                "$path.url: a release build takes it only from the app's native security file (${native.source}); " +
+                    "declare url for Config API '$id' there")
         }
 
         val pins = block.bootstrapPins?.also { n ->

package/android/src/main/java/io/github/umutcansu/pinvault/reactnative/PinnedFetch.kt

@@ -45,6 +45,11 @@ internal object PinnedFetch {
     /** The attestation headers: only the library sets them, for its token hosts (and a proof only it can sign). */
     val LIBRARY_HEADERS = listOf("PinVault-Token", "PinVault-Proof")
 
+    /** The HTTP client's own headers: the host the URL names, the connection and the body's framing. */
+    val CLIENT_HEADERS = listOf(
+        "Host", "Connection", "Keep-Alive", "Proxy-Connection", "TE", "Trailer", "Transfer-Encoding", "Upgrade", "Content-Length",
+    )
+
     fun parse(json: String): FetchRequest {
         // Base64 inflates by 4/3; leave room for the other fields.
         val f = StrictJson.parseObject(json, "request", maxChars = (MAX_REQUEST_BYTES * 4 / 3 + 64 * 1024).toInt())
@@ -59,6 +64,9 @@ internal object PinnedFetch {
             if (LIBRARY_HEADERS.any { it.equals(name, ignoreCase = true) }) {
                 throw BridgeInputException("request.headers.$name: set by PinVault itself (a token host's requests carry it)")
             }
+            if (CLIENT_HEADERS.any { it.equals(name, ignoreCase = true) }) {
+                throw BridgeInputException("request.headers.$name: set by the HTTP client (host, connection and framing headers)")
+            }
             if (value.any { it == '\r' || it == '\n' || it.code == 0 }) {
                 throw BridgeInputException("request.headers.$name: line breaks are not allowed")
             }

package/ios/Core/ConfigParser.swift

@@ -123,9 +123,8 @@ public enum ConfigParser {
         var maxRN = ReactNetworking.defaultMaxResponseBytes
         if let ios = try root.object("ios") {
             if let v = try ios.int64("reactNativeMaxResponseBytes", min: 1, max: ReactNetworking.maxResponseBytesLimit) { maxRN = v }
-            if let resolve = try ios.stringMap("resolve", maxItems: 64, maxKeyLength: 255, maxValueLength: 255) {
-                for (host, address) in resolve.sorted(by: { $0.key < $1.key }) { builder.resolve(host: host, to: address) }
-            }
+            try applyResolve(try ios.stringMap("resolve", maxItems: 64, maxKeyLength: 255, maxValueLength: 255),
+                             native: native, release: release, to: builder)
             if let v = try fixedList("config.ios.expectedBundleIds", require.expectedBundleIds,
                                      try ios.stringList("expectedBundleIds", maxItems: 16, maxLength: 255), native) {
                 builder.expectedBundleId(v)
@@ -143,6 +142,7 @@ public enum ConfigParser {
         }
 
         else {
+            try applyResolve(nil, native: native, release: release, to: builder)
             if let v = require.expectedBundleIds { builder.expectedBundleId(v) }
             if let v = require.expectedTeamIds { builder.expectedTeamId(v) }
             if let v = require.userAuthStrength { builder.userAuthStrength(v) }
@@ -157,6 +157,29 @@ public enum ConfigParser {
         return parsed
     }
 
+    /// `config.ios.resolve` decides where a pinned host's TCP connection goes. The native
+    /// security file's map is the value (JS may leave it out or repeat it); a release build
+    /// takes it only from the file, so an OTA bundle cannot send the app's connections elsewhere.
+    static func applyResolve(_ given: [String: String]?, native: NativeSecurity?, release: Bool,
+                             to builder: PinVaultConfig.Builder) throws {
+        let lowered: ([String: String]) -> [String: String] = { map in
+            Dictionary(map.map { ($0.key.lowercased(), $0.value) }, uniquingKeysWith: { first, _ in first })
+        }
+        var map = given
+        if let native {
+            if let fixed = native.resolve {
+                if let given, lowered(given) != lowered(fixed) {
+                    throw BridgeInputError("config.ios.resolve: differs from the app's native security file (\(native.source)); the native value is fixed")
+                }
+                map = fixed
+            } else if release, given != nil {
+                throw BridgeInputError("config.ios.resolve: a release build takes it only from the app's native security file "
+                    + "(\(native.source)); declare ios.resolve there")
+            }
+        }
+        for (host, address) in (map ?? [:]).sorted(by: { $0.key < $1.key }) { builder.resolve(host: host, to: address) }
+    }
+
     /// A JS list against the native file's: fixed where the file gives it.
     static func fixedList(_ path: String, _ native: [String]?, _ js: [String]?, _ file: NativeSecurity?) throws -> [String]? {
         guard let native else { return js }
@@ -317,6 +340,17 @@ public enum ConfigParser {
             if let j = renewalUrl, j != n { throw fixed("renewalUrl") }
             fixedRenewalUrl = n
         }
+        // The device's identity goes to the enrollment and renewal addresses as well as to url:
+        // in a release build JS may give them only where the file names them (url itself must be
+        // in the file, SecurityPolicy.apply), like tokenHosts and clientCertHosts.
+        if release, let nativeBlock {
+            for (key, given, declared) in [("enrollmentUrl", enrollmentUrl, nativeBlock.enrollmentUrl),
+                                           ("renewalUrl", renewalUrl, nativeBlock.renewalUrl)]
+                where declared == nil && given != nil {
+                throw BridgeInputError("\(b.path).\(key): a release build takes it only from the app's native security file "
+                    + "(\(native?.source ?? "")); declare \(key) for Config API '\(id)' there")
+            }
+        }
         // Who gets the device's identity is the file's call in a release build: JS cannot
         // add a host the file does not name.
         if release, let nativeBlock, nativeBlock.clientCertHosts == nil, clientCertHosts != nil {

package/ios/Core/NativeSecurity.swift

@@ -11,6 +11,7 @@
 //                      "clientCertHosts",
 //                      "enrollmentUrl", "renewalUrl" }],
 //     "staticPins": { "pins": [...], "version": 1 },
+//     "ios": { "resolve": { "<host>": "<address>" } },
 //     "require": { "requireUnlockedDevice", "requireHardwareBackedKeys",
 //                  "requirePinnedReactNativeNetworking", "managedTrustRoots",
 //                  "wipeVaultFilesOnRevocation", "requireCaTrust", "expectedBundleIds",
@@ -21,7 +22,11 @@
 // When the file is there: every JS Config API (and JS `staticPins`) must be
 // declared in it; a declared field is the value (JS may omit or repeat it, a
 // different value is refused); the three relaxations need the file's consent;
-// `attestation: true` and `proofOfPossession: true` cannot be switched off; `require` only tightens (its
+// `attestation: true` and `proofOfPossession: true` cannot be switched off; in a
+// release build a declared block names its `url`, and JS may give `enrollmentUrl`,
+// `renewalUrl`, `tokenHosts`, `clientCertHosts` and `ios.resolve` only where the
+// file names them (where the device's token, identity and connections go is the
+// file's call); `require` only tightens (its
 // protections stay on, its `requireCaTrust` hosts are added to JS's, its
 // expected ids are fixed, its grace is the most JS may ask for); `vaultFiles`
 // fixes those files' signature key, encryption and lock, and a JS vault file
@@ -100,6 +105,8 @@ public struct NativeSecurity {
     var require = Require()
     /// Nil when the file has no `vaultFiles` section.
     var vaultFiles: [String: VaultFilePolicy]? = nil
+    /// `ios.resolve` (logical host → connection address); nil when the file has none.
+    var resolve: [String: String]? = nil
 
     /// True when the app's Info.plist accepts a release start without the file.
     public static func noFileAllowed(_ bundle: Bundle = .main) -> Bool {
@@ -147,6 +154,12 @@ public struct NativeSecurity {
                 )
                 try b.finish()
             }
+            // Where a pinned host's connection goes (`ios.resolve`): fixed where the file gives it.
+            var resolve: [String: String]? = nil
+            if let ios = try root.object("ios") {
+                resolve = try ios.stringMap("resolve", maxItems: 64, maxKeyLength: 255, maxValueLength: 255)
+                try ios.finish()
+            }
             let staticPins = try root.object("staticPins").map(ConfigParser.staticPins)
             var require = Require()
             if let r = try root.object("require") {
@@ -188,6 +201,7 @@ public struct NativeSecurity {
             var native = NativeSecurity(source: source, blocks: blocks, staticPins: staticPins)
             native.require = require
             native.vaultFiles = vaultFiles
+            native.resolve = resolve
             return native
         } catch let e as BridgeInputError {
             throw e.message.hasPrefix("native security file") ? e : BridgeInputError("native security file \(e.message)")
@@ -268,6 +282,11 @@ enum SecurityPolicy {
             }
             if block.bootstrapPins == nil && !block.allowUnpinnedConfigApi { throw anchor("bootstrapPins", "allowUnpinnedConfigApi") }
             if block.signaturePublicKeys == nil && !block.allowUnsigned { throw anchor("signaturePublicKeys", "allowUnsigned") }
+            // Where the block talks to: the library hands it the device's token and identity.
+            if block.url == nil {
+                throw BridgeInputError("\(path).url: a release build takes it only from the app's native security file (\(native.source)); "
+                    + "declare url for Config API '\(id)' there")
+            }
         }
 
         var out = js

package/ios/Core/PinnedFetch.swift

@@ -29,6 +29,9 @@ public enum PinnedFetch {
     static let tokenChars = CharacterSet(charactersIn: "!#$%&'*+.^_`|~0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz-")
     /// The attestation headers: only the library sets them, for its token hosts (and a proof only it can sign).
     static let libraryHeaders = ["PinVault-Token", "PinVault-Proof"]
+    /// The HTTP client's own headers: the host the URL names, the connection and the body's framing.
+    static let clientHeaders = ["Host", "Connection", "Keep-Alive", "Proxy-Connection", "TE", "Trailer",
+                                "Transfer-Encoding", "Upgrade", "Content-Length"]
 
     public static func parse(_ json: String) throws -> FetchRequest {
         let f = try StrictJSON.parseObject(json, path: "request", maxChars: Int(maxRequestBytes * 4 / 3) + 64 * 1024)
@@ -47,6 +50,9 @@ public enum PinnedFetch {
             if libraryHeaders.contains(where: { $0.caseInsensitiveCompare(name) == .orderedSame }) {
                 throw BridgeInputError("request.headers.\(name): set by PinVault itself (a token host's requests carry it)")
             }
+            if clientHeaders.contains(where: { $0.caseInsensitiveCompare(name) == .orderedSame }) {
+                throw BridgeInputError("request.headers.\(name): set by the HTTP client (host, connection and framing headers)")
+            }
             if value.unicodeScalars.contains(where: { $0 == "\r" || $0 == "\n" || $0.value == 0 }) {
                 throw BridgeInputError("request.headers.\(name): line breaks are not allowed")
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@umutcansu/react-native-pinvault",
-  "version": "2.7.0",
+  "version": "2.8.0",
   "description": "PinVault for React Native: dynamic certificate pinning with signed remote configs, mTLS enrollment and signed vault files, as a thin bridge over the native PinVault libraries",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",