react-native-audio-browser 0.2.0-next.10 → 0.2.0-next.11

package/android/src/test/java/com/audiobrowser/tls/AiaChasingTrustManagerTest.kt

@@ -34,8 +34,8 @@ class AiaChasingTrustManagerTest {
     val r13 = CertFixtures.cert("letsencrypt-r13.pem")
     val delegate = FakeDelegate(trustsChainOfSize = 2)
     val tm =
-      AiaChasingTrustManager(delegate) {
-        if (it == "http://r13.i.lencr.org/") listOf(r13) else emptyList()
+      AiaChasingTrustManager(delegate) { url, _ ->
+        if (url == "http://r13.i.lencr.org/") listOf(r13) else emptyList()
       }
 
     // Must not throw: the leaf-only chain is rejected, AIA fills in R13, the [leaf, R13] chain
@@ -49,7 +49,7 @@ class AiaChasingTrustManagerTest {
   fun `rethrows the original failure when no intermediate can be fetched`() {
     val leaf = CertFixtures.cert("stationplaylist-leaf.pem")
     val delegate = FakeDelegate(trustsChainOfSize = 2)
-    val tm = AiaChasingTrustManager(delegate) { emptyList() }
+    val tm = AiaChasingTrustManager(delegate) { _, _ -> emptyList() }
 
     assertThrows(CertificateException::class.java) { tm.checkServerTrusted(arrayOf(leaf), "RSA") }
 
@@ -63,7 +63,7 @@ class AiaChasingTrustManagerTest {
     val delegate = FakeDelegate(trustsChainOfSize = 1)
     var fetches = 0
     val tm =
-      AiaChasingTrustManager(delegate) {
+      AiaChasingTrustManager(delegate) { _, _ ->
         fetches++
         emptyList()
       }
@@ -124,14 +124,222 @@ class AiaChasingTrustManagerTest {
     override fun getAcceptedIssuers(): Array<X509Certificate> = emptyArray()
   }
 
+  @Test
+  fun `a complete chain rejected for some other reason is not chased`() {
+    val leaf = CertFixtures.cert("stationplaylist-leaf.pem")
+    val r13 = CertFixtures.cert("letsencrypt-r13.pem")
+    val root = CertFixtures.cert("isrg-root-x1.pem")
+    // Trusts nothing — an expired chain, a hostname mismatch, a CT refusal all look like this:
+    // the delegate rejects a chain that is not missing anything.
+    val delegate =
+      object : X509TrustManager {
+        override fun checkServerTrusted(chain: Array<X509Certificate>, authType: String) =
+          throw CertificateException("certificate expired")
+
+        override fun checkClientTrusted(chain: Array<X509Certificate>, authType: String) = Unit
+
+        override fun getAcceptedIssuers(): Array<X509Certificate> = arrayOf(root)
+      }
+    var fetches = 0
+    val tm =
+      AiaChasingTrustManager(delegate) { _, _ ->
+        fetches++
+        emptyList()
+      }
+
+    assertThrows(CertificateException::class.java) {
+      tm.checkServerTrusted(arrayOf(leaf, r13), "RSA")
+    }
+
+    // Chasing could not have helped, so it must not have reached out to a host named by a
+    // certificate that just failed validation.
+    assertEquals(0, fetches)
+  }
+
+  @Test
+  fun `the original failure is kept when the completed chain fails too`() {
+    val leaf = CertFixtures.cert("stationplaylist-leaf.pem")
+    val r13 = CertFixtures.cert("letsencrypt-r13.pem")
+    // Trusts no chain of any size, so the retry fails as well.
+    val delegate = FakeDelegate(trustsChainOfSize = -1)
+    val tm = AiaChasingTrustManager(delegate) { _, _ -> listOf(r13) }
+
+    val thrown =
+      assertThrows(CertificateException::class.java) { tm.checkServerTrusted(arrayOf(leaf), "RSA") }
+
+    assertEquals(1, thrown.suppressed.size)
+  }
+
+  @Test
+  fun `client checks are forwarded, not routed through the server path`() {
+    val leaf = CertFixtures.cert("stationplaylist-leaf.pem")
+    var clientChecks = 0
+    val delegate =
+      object : X509ExtendedTrustManager() {
+        override fun checkServerTrusted(chain: Array<X509Certificate>, authType: String) =
+          throw CertificateException("server path must not be used for a client check")
+
+        override fun checkServerTrusted(
+          chain: Array<X509Certificate>,
+          authType: String,
+          socket: Socket?,
+        ) = throw CertificateException("server path must not be used for a client check")
+
+        override fun checkServerTrusted(
+          chain: Array<X509Certificate>,
+          authType: String,
+          engine: SSLEngine?,
+        ) = throw CertificateException("server path must not be used for a client check")
+
+        override fun checkClientTrusted(chain: Array<X509Certificate>, authType: String) {
+          clientChecks++
+        }
+
+        override fun checkClientTrusted(
+          chain: Array<X509Certificate>,
+          authType: String,
+          socket: Socket?,
+        ) {
+          clientChecks++
+        }
+
+        override fun checkClientTrusted(
+          chain: Array<X509Certificate>,
+          authType: String,
+          engine: SSLEngine?,
+        ) {
+          clientChecks++
+        }
+
+        override fun getAcceptedIssuers(): Array<X509Certificate> = emptyArray()
+      }
+    val tm = AiaChasingExtendedTrustManager(delegate) { _, _ -> emptyList() }
+
+    tm.checkClientTrusted(arrayOf(leaf), "RSA")
+    tm.checkClientTrusted(arrayOf(leaf), "RSA", null as Socket?)
+    tm.checkClientTrusted(arrayOf(leaf), "RSA", null as SSLEngine?)
+
+    assertEquals(3, clientChecks)
+  }
+
+  /** A delegate carrying the Android-specific hostname-aware method, as `RootTrustManager` does. */
+  @Suppress("unused")
+  private class HostAwareDelegate(private val trustsChainOfSize: Int) : X509TrustManager {
+    val hosts = mutableListOf<String>()
+
+    fun checkServerTrusted(
+      chain: Array<X509Certificate>,
+      authType: String,
+      host: String,
+    ): List<X509Certificate> {
+      hosts.add(host)
+      if (chain.size != trustsChainOfSize) {
+        throw CertificateException("Trust anchor for certification path not found.")
+      }
+      return chain.toList()
+    }
+
+    override fun checkServerTrusted(chain: Array<X509Certificate>, authType: String) =
+      throw CertificateException("the host-aware overload should have been used")
+
+    override fun checkClientTrusted(chain: Array<X509Certificate>, authType: String) = Unit
+
+    override fun getAcceptedIssuers(): Array<X509Certificate> = emptyArray()
+  }
+
+  @Test
+  fun `the X509TrustManagerExtensions signature is present and forwards the host`() {
+    val leaf = CertFixtures.cert("stationplaylist-leaf.pem")
+    val r13 = CertFixtures.cert("letsencrypt-r13.pem")
+    val delegate = HostAwareDelegate(trustsChainOfSize = 2)
+    val tm =
+      AiaChasingExtendedTrustManager(delegate) { url, _ ->
+        if (url == "http://r13.i.lencr.org/") listOf(r13) else emptyList()
+      }
+
+    // The method X509TrustManagerExtensions looks up reflectively must exist on the wrapper...
+    val method =
+      tm.javaClass.getMethod(
+        "checkServerTrusted",
+        Array<X509Certificate>::class.java,
+        String::class.java,
+        String::class.java,
+      )
+
+    // ...and must reach the delegate's own host-aware method, so pinning still sees the host.
+    val accepted = tm.checkServerTrusted(arrayOf(leaf), "RSA", "ca.example")
+
+    assertEquals(listOf(leaf, r13), accepted)
+    assertEquals(listOf("ca.example", "ca.example"), delegate.hosts)
+    assertEquals(List::class.java, method.returnType)
+  }
+
+  @Test
+  fun `the host-aware signature falls back to the extended overloads when the delegate lacks it`() {
+    val leaf = CertFixtures.cert("stationplaylist-leaf.pem")
+    val r13 = CertFixtures.cert("letsencrypt-r13.pem")
+    // An extended delegate without the Android-specific String-host method, whose two-argument
+    // form refuses outright — the domain-config case. The fallback must route through its
+    // extended overloads, and must report the AIA-completed chain that actually validated.
+    val delegate = FakeDomainConfigDelegate(trustsChainOfSize = 2)
+    val tm =
+      AiaChasingExtendedTrustManager(delegate) { url, _ ->
+        if (url == "http://r13.i.lencr.org/") listOf(r13) else emptyList()
+      }
+
+    val accepted = tm.checkServerTrusted(arrayOf(leaf), "RSA", "ca.example")
+
+    assertEquals(listOf(leaf, r13), accepted)
+    assertEquals(listOf(1, 2), delegate.hostnameAwareChecks)
+  }
+
+  /** A host-aware delegate that validates fine but reports an empty accepted chain. */
+  @Suppress("unused")
+  private class SilentHostAwareDelegate(private val trustsChainOfSize: Int) : X509TrustManager {
+    fun checkServerTrusted(
+      chain: Array<X509Certificate>,
+      authType: String,
+      host: String,
+    ): List<X509Certificate> {
+      if (chain.size != trustsChainOfSize) {
+        throw CertificateException("Trust anchor for certification path not found.")
+      }
+      return emptyList()
+    }
+
+    override fun checkServerTrusted(chain: Array<X509Certificate>, authType: String) =
+      throw CertificateException("the host-aware overload should have been used")
+
+    override fun checkClientTrusted(chain: Array<X509Certificate>, authType: String) = Unit
+
+    override fun getAcceptedIssuers(): Array<X509Certificate> = emptyArray()
+  }
+
+  @Test
+  fun `a delegate reporting an empty accepted chain still yields the chain that validated`() {
+    val leaf = CertFixtures.cert("stationplaylist-leaf.pem")
+    val r13 = CertFixtures.cert("letsencrypt-r13.pem")
+    val delegate = SilentHostAwareDelegate(trustsChainOfSize = 2)
+    val tm =
+      AiaChasingExtendedTrustManager(delegate) { url, _ ->
+        if (url == "http://r13.i.lencr.org/") listOf(r13) else emptyList()
+      }
+
+    // An empty list from the delegate on success must not be passed through: the checked chain
+    // is what it accepted, and a pinning consumer given [] would fail a valid connection.
+    val accepted = tm.checkServerTrusted(arrayOf(leaf), "RSA", "ca.example")
+
+    assertEquals(listOf(leaf, r13), accepted)
+  }
+
   @Test
   fun `forwards to the hostname-aware overload the platform requires`() {
     val leaf = CertFixtures.cert("stationplaylist-leaf.pem")
     val r13 = CertFixtures.cert("letsencrypt-r13.pem")
     val delegate = FakeDomainConfigDelegate(trustsChainOfSize = 2)
     val tm =
-      AiaChasingExtendedTrustManager(delegate) {
-        if (it == "http://r13.i.lencr.org/") listOf(r13) else emptyList()
+      AiaChasingExtendedTrustManager(delegate) { url, _ ->
+        if (url == "http://r13.i.lencr.org/") listOf(r13) else emptyList()
       }
 
     // The socket overload must reach the delegate's socket overload. Routing it through the
@@ -147,7 +355,7 @@ class AiaChasingTrustManagerTest {
     val leaf = CertFixtures.cert("stationplaylist-leaf.pem")
     val delegate = FakeDomainConfigDelegate(trustsChainOfSize = 1)
 
-    AiaChasingExtendedTrustManager(delegate) { emptyList() }
+    AiaChasingExtendedTrustManager(delegate) { _, _ -> emptyList() }
       .checkServerTrusted(arrayOf(leaf), "RSA", null as SSLEngine?)
 
     assertEquals(listOf(1), delegate.hostnameAwareChecks)
@@ -159,8 +367,8 @@ class AiaChasingTrustManagerTest {
     val r13 = CertFixtures.cert("letsencrypt-r13.pem")
     val delegate = FakeDelegate(trustsChainOfSize = 2)
     val tm =
-      AiaChasingExtendedTrustManager(delegate) {
-        if (it == "http://r13.i.lencr.org/") listOf(r13) else emptyList()
+      AiaChasingExtendedTrustManager(delegate) { url, _ ->
+        if (url == "http://r13.i.lencr.org/") listOf(r13) else emptyList()
       }
 
     tm.checkServerTrusted(arrayOf(leaf), "RSA", null as Socket?)
@@ -174,7 +382,7 @@ class AiaChasingTrustManagerTest {
     val r13 = CertFixtures.cert("letsencrypt-r13.pem")
     // Trusts nothing, whatever the chain.
     val delegate = FakeDomainConfigDelegate(trustsChainOfSize = -1)
-    val tm = AiaChasingExtendedTrustManager(delegate) { listOf(r13) }
+    val tm = AiaChasingExtendedTrustManager(delegate) { _, _ -> listOf(r13) }
 
     assertThrows(CertificateException::class.java) {
       tm.checkServerTrusted(arrayOf(leaf), "RSA", null as Socket?)

package/android/src/test/java/com/audiobrowser/tls/CachingCertificateFetcherCallSiteTest.kt

@@ -0,0 +1,322 @@
+package com.audiobrowser.tls
+
+import java.net.InetAddress
+import java.net.ServerSocket
+import java.security.cert.X509Certificate
+import java.util.concurrent.CountDownLatch
+import java.util.concurrent.TimeUnit
+import java.util.concurrent.atomic.AtomicInteger
+import java.util.concurrent.atomic.AtomicReference
+import javax.security.auth.x500.X500Principal
+import kotlin.concurrent.thread
+import org.junit.After
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import org.mockito.Mockito.mock
+import org.mockito.Mockito.`when`
+
+/**
+ * Exercises [CachingCertificateFetcher.fetch] against a real loopback server.
+ *
+ * The safety helpers have their own unit tests, but a predicate that is never consulted protects
+ * nothing: these cover the *wiring*, so that removing the `isSafeUrl` guard or swapping
+ * `readCapped` back for a plain read-to-EOF fails a test rather than passing silently.
+ */
+class CachingCertificateFetcherCallSiteTest {
+
+  private var server: ServerSocket? = null
+
+  @After
+  fun tearDown() {
+    server?.close()
+  }
+
+  /**
+   * Serves [response] to every connection, recording the request line of the first. [handled]
+   * counts accepted connections.
+   */
+  private fun startServer(
+    response: ByteArray = "HTTP/1.0 404 Not Found\r\n\r\n".toByteArray(),
+    handled: AtomicInteger = AtomicInteger(),
+    firstRequest: AtomicReference<String> = AtomicReference(),
+  ): Int {
+    val socket = ServerSocket(0, 50, InetAddress.getByName("127.0.0.1"))
+    server = socket
+    thread(isDaemon = true) {
+      while (!socket.isClosed) {
+        try {
+          socket.accept().use { client ->
+            handled.incrementAndGet()
+            val request = ByteArray(1024)
+            val read = client.getInputStream().read(request)
+            firstRequest.compareAndSet(null, String(request, 0, maxOf(read, 0)))
+            client.getOutputStream().apply {
+              write(response)
+              flush()
+            }
+          }
+        } catch (e: Exception) {
+          return@thread // socket closed, or the client hung up
+        }
+      }
+    }
+    return socket.localPort
+  }
+
+  @Test
+  fun `a URL carrying CRLF never reaches the network`() {
+    val handled = AtomicInteger()
+    val port = startServer(handled = handled)
+
+    // Without the isSafeUrl guard this connects and emits "SET foo bar" as its own request line.
+    val certs = CachingCertificateFetcher().fetch("http://127.0.0.1:$port/\r\nSET foo bar\r\n")
+
+    assertTrue(certs.isEmpty())
+    assertEquals("the request must not be sent at all", 0, handled.get())
+  }
+
+  @Test
+  fun `a well-formed URL does reach the network, so the guard is not just refusing everything`() {
+    val handled = AtomicInteger()
+    val request = AtomicReference<String>()
+    val port = startServer(handled = handled, firstRequest = request)
+
+    CachingCertificateFetcher().fetch("http://127.0.0.1:$port/issuer.crt")
+
+    assertEquals(1, handled.get())
+    assertTrue("request line was: ${request.get()}", request.get().startsWith("GET /issuer.crt "))
+  }
+
+  @Test
+  fun `a non-default port is carried in the Host header`() {
+    val request = AtomicReference<String>()
+    val port = startServer(firstRequest = request)
+
+    CachingCertificateFetcher().fetch("http://127.0.0.1:$port/issuer.crt")
+
+    assertTrue(
+      "headers were: ${request.get()}",
+      request.get().contains("Host: 127.0.0.1:$port\r\n"),
+    )
+  }
+
+  @Test(timeout = 30_000)
+  fun `an oversized response is abandoned rather than read to EOF`() {
+    // Asserting only that the fetch fails would prove nothing — 4 MiB crosses loopback in
+    // milliseconds and would fail to parse either way. What has to be true is that the client
+    // stopped reading, which shows up as the server's write not draining.
+    val socket = ServerSocket(0, 50, InetAddress.getByName("127.0.0.1"))
+    server = socket
+    val written = AtomicInteger()
+    val finished = CountDownLatch(1)
+    thread(isDaemon = true) {
+      runCatching {
+        socket.accept().use { client ->
+          client.getInputStream().read(ByteArray(1024))
+          val out = client.getOutputStream()
+          out.write("HTTP/1.0 200 OK\r\n\r\n".toByteArray())
+          val chunk = ByteArray(64 * 1024)
+          // 64 MiB — far past the 1 MiB cap. Once the client stops reading and closes, this
+          // throws a broken pipe, which is the signal we want.
+          repeat(1024) {
+            out.write(chunk)
+            written.addAndGet(chunk.size)
+          }
+        }
+      }
+      finished.countDown()
+    }
+
+    val certs = CachingCertificateFetcher().fetch("http://127.0.0.1:${socket.localPort}/big.crt")
+
+    assertTrue(certs.isEmpty())
+    assertTrue(finished.await(20, TimeUnit.SECONDS))
+    // Socket buffers mean the server gets somewhat past the cap before the write fails, but it
+    // must be nowhere near the 64 MiB it wanted to send.
+    assertTrue(
+      "server wrote ${written.get()} bytes; the read was not cut off",
+      written.get() < 16 shl 20,
+    )
+  }
+
+  @Test(timeout = 30_000)
+  fun `a real certificate is fetched, parsed and then served from cache`() {
+    // The success path, end to end over a socket: every other wire test serves a failure, so a
+    // broken body offset or a broken cache write would not show up anywhere.
+    val der = CertFixtures.bytes("letsencrypt-r13.der")
+    val handled = AtomicInteger()
+    val port =
+      startServer(
+        response =
+          ("HTTP/1.0 200 OK\r\nContent-Type: application/pkix-cert\r\n\r\n").toByteArray() + der,
+        handled = handled,
+      )
+    val fetcher = CachingCertificateFetcher()
+    val url = "http://127.0.0.1:$port/r13.der"
+
+    val certs = fetcher.fetch(url)
+
+    assertEquals(1, certs.size)
+    assertEquals("CN=R13,O=Let's Encrypt,C=US", certs.first().subjectX500Principal.name)
+
+    // Second call must be served from the cache, not the network.
+    assertEquals(certs, fetcher.fetch(url))
+    assertEquals("a successful fetch must be cached", 1, handled.get())
+  }
+
+  /**
+   * A mock certificate whose AIA extension lists [url] as its one CA-Issuers location, so
+   * [AiaCertChaser.completeChain] chases it with this fetcher — the real wiring, end to end.
+   */
+  private fun certPointingAt(url: String): X509Certificate {
+    // Short-form DER lengths only; a loopback URL is far under 128 bytes.
+    fun der(tag: Int, content: ByteArray) =
+      byteArrayOf(tag.toByte(), content.size.toByte()) + content
+    val caIssuersOid = byteArrayOf(0x2B, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x02)
+    val aia =
+      der(
+        0x04,
+        der(
+          0x30,
+          der(0x30, der(0x06, caIssuersOid) + der(0x86, url.toByteArray(Charsets.US_ASCII))),
+        ),
+      )
+    return mock(X509Certificate::class.java).also {
+      `when`(it.getExtensionValue("1.3.6.1.5.5.7.1.1")).thenReturn(aia)
+      // Distinct principals, or the chaser reads the mock as a self-signed root and never fetches.
+      `when`(it.subjectX500Principal).thenReturn(X500Principal("CN=leaf"))
+      `when`(it.issuerX500Principal).thenReturn(X500Principal("CN=issuer"))
+    }
+  }
+
+  @Test(timeout = 30_000)
+  fun `a drip-feeding server is cut off by the chase deadline, not only the per-fetch caps`() {
+    // One byte every 100 ms: each read lands well inside the socket timeout, so per-read limits
+    // never fire, and the per-fetch read budget alone would let this run for its full 10 s. The
+    // walk's 1 s budget must cut the fetch *itself* — not merely decline to start the next one.
+    val socket = ServerSocket(0, 50, InetAddress.getByName("127.0.0.1"))
+    server = socket
+    thread(isDaemon = true) {
+      runCatching {
+        socket.accept().use { client ->
+          client.getInputStream().read(ByteArray(1024))
+          val out = client.getOutputStream()
+          out.write("HTTP/1.0 200 OK\r\n\r\n".toByteArray())
+          out.flush()
+          repeat(300) { // 30 s of drip on offer; the client must not stay for it
+            out.write(0)
+            out.flush()
+            Thread.sleep(100)
+          }
+        }
+      }
+    }
+    val fetcher = CachingCertificateFetcher()
+    val cert = certPointingAt("http://127.0.0.1:${socket.localPort}/drip.crt")
+
+    val started = System.nanoTime()
+    val completed =
+      AiaCertChaser.completeChain(listOf(cert), budgetMs = 1_000) { url, deadline ->
+        fetcher.fetch(url, deadline)
+      }
+    val elapsedMs = (System.nanoTime() - started) / 1_000_000
+
+    assertEquals(listOf(cert), completed)
+    // Well past the 1 s budget to absorb scheduling noise, but far short of the 10 s the
+    // per-fetch read budget alone would have allowed.
+    assertTrue("chase ran for $elapsedMs ms", elapsedMs < 8_000)
+  }
+
+  @Test(timeout = 30_000)
+  fun `the chase deadline spans redirect hops, not just fetch starts`() {
+    // Every hop stalls 1 s and then redirects back to itself. Each hop sits comfortably inside
+    // the per-operation timeouts, so only a deadline threaded through the redirect recursion
+    // can end the fetch — without one it walks all 5 redirects, ~6 s here.
+    val socket = ServerSocket(0, 50, InetAddress.getByName("127.0.0.1"))
+    server = socket
+    thread(isDaemon = true) {
+      while (!socket.isClosed) {
+        try {
+          socket.accept().use { client ->
+            client.getInputStream().read(ByteArray(1024))
+            Thread.sleep(1_000)
+            client.getOutputStream().apply {
+              write("HTTP/1.0 302 Found\r\nLocation: /again.crt\r\n\r\n".toByteArray())
+              flush()
+            }
+          }
+        } catch (e: Exception) {
+          return@thread
+        }
+      }
+    }
+    val fetcher = CachingCertificateFetcher()
+
+    val started = System.nanoTime()
+    val certs =
+      fetcher.fetch(
+        "http://127.0.0.1:${socket.localPort}/loop.crt",
+        deadlineNanos = System.nanoTime() + 1_500 * 1_000_000L,
+      )
+    val elapsedMs = (System.nanoTime() - started) / 1_000_000
+
+    assertTrue(certs.isEmpty())
+    assertTrue("fetch ran for $elapsedMs ms across redirect hops", elapsedMs < 4_000)
+  }
+
+  @Test(timeout = 30_000)
+  fun `a server that accepts and never answers is bounded by the read timeout`() {
+    val socket = ServerSocket(0, 50, InetAddress.getByName("127.0.0.1"))
+    server = socket
+    val accepted = CountDownLatch(1)
+    // Accept, then hold the connection open saying nothing at all.
+    thread(isDaemon = true) {
+      runCatching {
+        val client = socket.accept()
+        accepted.countDown()
+        Thread.sleep(60_000)
+        client.close()
+      }
+    }
+
+    val certs =
+      CachingCertificateFetcher(connectTimeoutMs = 2_000, readTimeoutMs = 1_000)
+        .fetch("http://127.0.0.1:${socket.localPort}/hangs.crt")
+
+    assertTrue(accepted.await(10, TimeUnit.SECONDS))
+    assertTrue(certs.isEmpty())
+  }
+
+  @Test
+  fun `a non-http scheme is never fetched`() {
+    val handled = AtomicInteger()
+    val port = startServer(handled = handled)
+
+    assertTrue(CachingCertificateFetcher().fetch("ftp://127.0.0.1:$port/issuer.crt").isEmpty())
+    assertTrue(CachingCertificateFetcher().fetch("file:///etc/hosts").isEmpty())
+    assertEquals(0, handled.get())
+  }
+
+  @Test
+  fun `a failed fetch is not cached, so it stays retryable`() {
+    val handled = AtomicInteger()
+    val port = startServer(handled = handled)
+    val fetcher = CachingCertificateFetcher()
+    val url = "http://127.0.0.1:$port/issuer.crt"
+
+    fetcher.fetch(url)
+    fetcher.fetch(url)
+
+    assertEquals("both attempts must hit the network", 2, handled.get())
+  }
+
+  @Test
+  fun `the cache is bounded`() {
+    // Far more distinct URLs than MAX_CACHE_ENTRIES; nothing is cached here (every fetch fails),
+    // but the bound is what stops an attacker-chosen URL space from growing without limit.
+    assertFalse(CachingCertificateFetcher.MAX_CACHE_ENTRIES <= 0)
+    assertTrue(CachingCertificateFetcher.MAX_CACHE_ENTRIES <= 128)
+  }
+}

package/ios/Model/NitroTypeStubs.swift

@@ -5,6 +5,12 @@
   /// These stubs declare `Equatable` for test ergonomics — the generated
   /// Nitro types do NOT. Shared `ios/` sources must not rely on conformances
   /// that exist only here: `swift test` compiles, the app build breaks.
+  ///
+  /// Property names and types ARE checked against `nitrogen/generated/ios/swift`
+  /// by `src/nitro-stub-drift.test.ts`, which runs in the JS CI job — neither
+  /// native job can see both files at once. Declaring fewer properties than the
+  /// real type is fine and deliberate; spelling one differently is what that
+  /// test catches. Conformances and default values are still on you.
 
   struct ArtworkVariants: Equatable {
     var light: String
@@ -23,7 +29,7 @@
   }
 
   struct Track: Equatable {
-    var id: String
+    var id: String?
     var url: String?
     var src: String?
     var request: TrackRequest?
@@ -63,9 +69,19 @@
     }
   }
 
+  enum HttpMethod {
+    case get
+    case post
+    case put
+    case patch
+    case delete
+    case head
+    case options
+  }
+
   struct ImageSource: Equatable {
     var uri: String
-    var method: String?
+    var method: HttpMethod?
     var headers: [String: String]?
     var body: String?
   }

package/ios/Tests/QueueManagerTests.swift

@@ -813,13 +813,13 @@ struct ComputedPropertyTests {
     let q = QueueManager()
     q.setQueue(tracks("a", "b", "c", "d"))
     q.shuffleEnabled = true
-    let nextFromProp = q.nextTracks.map(\.id)
+    let nextFromProp = q.nextTracks.map { $0.id! }
     // Navigate forward only as many times as nextTracks reports
     // (nextTracks does not include wrapped tracks)
     var nextFromNav: [String] = []
     for _ in 0 ..< nextFromProp.count {
       _ = q.next()
-      nextFromNav.append(q.currentTrack!.id)
+      nextFromNav.append(q.currentTrack!.id!)
     }
     #expect(nextFromProp == nextFromNav)
   }
@@ -832,12 +832,12 @@ struct ComputedPropertyTests {
     for _ in 0 ..< 3 {
       _ = q.next()
     }
-    let prevFromProp = q.previousTracks.map(\.id)
+    let prevFromProp = q.previousTracks.map { $0.id! }
     // Navigate backward the same number of times
     var prevFromNav: [String] = []
     for _ in 0 ..< prevFromProp.count {
       _ = q.previous()
-      prevFromNav.insert(q.currentTrack!.id, at: 0)
+      prevFromNav.insert(q.currentTrack!.id!, at: 0)
     }
     #expect(prevFromProp == prevFromNav)
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "react-native-audio-browser",
-  "version": "0.2.0-next.10",
+  "version": "0.2.0-next.11",
   "description": "react-native-audio-browser is a react native package built with Nitro",
   "keywords": [
     "react-native",
@@ -52,7 +52,8 @@
     "build": "yarn prepare",
     "clean": "del-cli android/build example/android/build example/android/app/build example/ios/build lib",
     "codegen": "node codegen/index.js --logLevel=\"debug\" && node post-script.cjs && node codegen/strip-struct-equality.cjs && yarn build",
-    "prepare": "bob build",
+    "prepare": "bob build && yarn hooks:install",
+    "hooks:install": "git config core.hooksPath .githooks || exit 0",
     "example": "yarn workspace example-native",
     "ci:format": "oxfmt --check --ignore-path .gitignore --ignore-path .oxfmtignore .",
     "ci:format:ios": "swiftformat --lint ios",