supabase / supabase-swift / 29766581958

84%

Build Type

push

github

Committed by web-flow

Commit Message

feat(realtime): support certificate pinning on the WebSocket connection (#1123)

* docs: add design spec for Realtime WebSocket cert pinning

* docs: add e2e cert pinning test task to implementation plan

* feat(realtime): add session option to RealtimeClientOptions

* feat(realtime): forward WebSocket auth challenges to a wrapped delegate

Adds an optional wrappedDelegate to _Delegate so a caller's own
URLSessionDelegate is consulted for TLS/auth-challenge callbacks on the
Realtime WebSocket connection (task-level method first, then
session-level, then default handling). Prepares for certificate
pinning support; WebSocket lifecycle callbacks are untouched.

* feat(realtime): accept an external URLSession in URLSessionWebSocket.connect

Replaces the configuration: parameter with session: URLSession = .shared
so callers can supply their own session (and its delegate) for the
Realtime WebSocket connection, enabling certificate pinning end-to-end.
On Apple platforms the task uses a per-task delegate wrapping the
caller's session delegate; Linux keeps building its own internal
session via the existing sessionWithConfiguration helper, since
swift-corelibs-foundation doesn't support per-task delegates.

* docs: correct WebSocket session default to avoid process-wide URLSession interference

* fix(realtime): don't share .shared URLSession for the default WebSocket connection

connect(session:) previously used the caller-supplied session directly for
every call, including the .shared default. This regressed the pre-existing
behavior of always building a dedicated internal session, making the common
no-session-specified case vulnerable to process-wide URLSession state (e.g.
a globally-registered URLProtocol from Mocker, used by
AuthTests/StorageTests/PostgRESTTests/FunctionsTests, or any host app's own
interceptor). Only route through the caller's session (enabling pinning)
when it's not === URLSession.shared; otherwise build a dedicated session as
before.

* ... (continued)

Coverage Stats

94 of 120 new or added lines in 4 files covered. (78.33%)

19 existing lines in 1 file now uncovered.

8152 of 9729 relevant lines covered (83.79%)

38.67 hits per line