30854254088

Committed 03 Aug 2026 09:21PM UTC coverage: 40.895% (-15.0%) from 55.93%

Build # 30854254088

Build Type

Pull #1260

github

Committed by

web-flow

Commit Message

Merge d93794de5 into e3affdd4f

Pull Request Pull Request #1260: WIP: health sync

Coverage Stats

9980 of 24404 relevant lines covered (40.89%)

1.72 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

72.22

/lib/core/http_overrides.dart

/*
 * This file is part of wger Workout Manager <https://github.com/wger-project>.
 * Copyright (c) 2026 - 2026 wger Team
 *
 * wger Workout Manager is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Affero General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU Affero General Public License for more details.
 *
 * You should have received a copy of the GNU Affero General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */

import 'dart:io';

import 'package:flutter/foundation.dart';
import 'package:wger/core/consts.dart';

/// [HttpOverrides] that accepts a self-signed / otherwise invalid TLS
/// certificate, but only from [trustedHost] and only while
/// [allowSelfSignedCerts] is set.
///
/// Installed as [HttpOverrides.global], so every `dart:io` `HttpClient` routes
/// through it: both the `http` package client used for API calls and the
/// `HttpClient` behind `NetworkImage` / `extended_image`. Native media players
/// (e.g. the `video_player` plugin on Android/iOS) use their own networking
/// stack and are not affected.
class WgerHttpOverrides extends HttpOverrides {
  /// Whether the user opted into trusting an invalid certificate.
  ///
  /// Both this and [trustedHost] are read when the handshake happens rather
  /// than when the client is built, so changing either also applies to clients
  /// that already exist. dart:io reads [HttpOverrides.current] once in the
  /// `HttpClient` constructor, and the auth client is built during startup, so
  /// swapping the override itself would only take effect after a restart.
  static bool allowSelfSignedCerts = ALLOW_SELF_SIGNED_CERTS_DEFAULT;

  /// Host the opt-in applies to. While null, every invalid certificate is
  /// rejected no matter what [allowSelfSignedCerts] says.
  static String? trustedHost;

  /// Narrows [trustedHost] to the host of [serverUrl]. A null, empty or
  /// hostless URL clears it.
  static void trustServer(String? serverUrl) => trustedHost = _hostOf(serverUrl);

  /// Hosts the opt-in can never apply to. The servers we run ourselves have a
  /// valid certificate, so an invalid one there is a genuine problem and not
  /// something a self-hosting setting may wave through.
  static final Set<String> _officialHosts = {
    Uri.parse(DEFAULT_SERVER_PROD).host,
    Uri.parse(DEFAULT_SERVER_TEST).host,
  };

  static String? _hostOf(String? serverUrl) {
    final host = serverUrl == null ? null : Uri.tryParse(serverUrl)?.host;
    return (host == null || host.isEmpty) ? null : host;
  }

  static bool _accepts(String host) =>
      allowSelfSignedCerts && host == trustedHost && !_officialHosts.contains(host);

  /// Whether an invalid certificate presented by [host] is accepted.
  ///
  /// Installed as the `badCertificateCallback` of every client, so it runs per
  /// handshake and sees the current [allowSelfSignedCerts] / [trustedHost]
  /// rather than the values from when the client was built.
  static bool acceptsBadCertificate(X509Certificate cert, String host, int port) => _accepts(host);

  /// The host of [serverUrl] while it is exempt from certificate validation,
  /// null otherwise.
  ///
  /// Answers the same question as [acceptsBadCertificate], so a UI built on this
  /// cannot warn about an exemption that does not exist, or stay silent about
  /// one that does.
  static String? exemptHost(String? serverUrl) {
    final host = _hostOf(serverUrl);
    return (host != null && _accepts(host)) ? host : null;
  }

  @override
  HttpClient createHttpClient(SecurityContext? context) {
    return super.createHttpClient(context)..badCertificateCallback = acceptsBadCertificate;
  }
}

/// Routes all `dart:io` HTTP traffic through [WgerHttpOverrides].
///
/// Must run before the first `HttpClient` is created, since dart:io only
/// consults [HttpOverrides.current] in the client constructor. No-op on the
/// web, where `dart:io` networking (and thus [HttpOverrides]) does not apply.
void installHttpOverrides() {
  if (kIsWeb) {
    return;
  }
  HttpOverrides.global = WgerHttpOverrides();
}

1	/*
2	* This file is part of wger Workout Manager <https://github.com/wger-project>.
3	* Copyright (c) 2026 - 2026 wger Team
4	*
5	* wger Workout Manager is free software: you can redistribute it and/or modify
6	* it under the terms of the GNU Affero General Public License as published by
7	* the Free Software Foundation, either version 3 of the License, or
8	* (at your option) any later version.
9	*
10	* This program is distributed in the hope that it will be useful,
11	* but WITHOUT ANY WARRANTY; without even the implied warranty of
12	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13	* GNU Affero General Public License for more details.
14	*
15	* You should have received a copy of the GNU Affero General Public License
16	* along with this program. If not, see <http://www.gnu.org/licenses/>.
17	*/
18
19	import 'dart:io';
20
21	import 'package:flutter/foundation.dart';
22	import 'package:wger/core/consts.dart';
23
24	/// [HttpOverrides] that accepts a self-signed / otherwise invalid TLS
25	/// certificate, but only from [trustedHost] and only while
26	/// [allowSelfSignedCerts] is set.
27	///
28	/// Installed as [HttpOverrides.global], so every `dart:io` `HttpClient` routes
29	/// through it: both the `http` package client used for API calls and the
30	/// `HttpClient` behind `NetworkImage` / `extended_image`. Native media players
31	/// (e.g. the `video_player` plugin on Android/iOS) use their own networking
32	/// stack and are not affected.
33	class WgerHttpOverrides extends HttpOverrides {
34	/// Whether the user opted into trusting an invalid certificate.
35	///
36	/// Both this and [trustedHost] are read when the handshake happens rather
37	/// than when the client is built, so changing either also applies to clients
38	/// that already exist. dart:io reads [HttpOverrides.current] once in the
39	/// `HttpClient` constructor, and the auth client is built during startup, so
40	/// swapping the override itself would only take effect after a restart.
41	static bool allowSelfSignedCerts = ALLOW_SELF_SIGNED_CERTS_DEFAULT;	2✔
42
43	/// Host the opt-in applies to. While null, every invalid certificate is
44	/// rejected no matter what [allowSelfSignedCerts] says.
45	static String? trustedHost;
46
47	/// Narrows [trustedHost] to the host of [serverUrl]. A null, empty or
48	/// hostless URL clears it.
49	static void trustServer(String? serverUrl) => trustedHost = _hostOf(serverUrl);	10✔
50
51	/// Hosts the opt-in can never apply to. The servers we run ourselves have a
52	/// valid certificate, so an invalid one there is a genuine problem and not
53	/// something a self-hosting setting may wave through.
54	static final Set<String> _officialHosts = {	4✔
55	Uri.parse(DEFAULT_SERVER_PROD).host,	4✔
56	Uri.parse(DEFAULT_SERVER_TEST).host,	4✔
57	};
58
59	static String? _hostOf(String? serverUrl) {	5✔
60	final host = serverUrl == null ? null : Uri.tryParse(serverUrl)?.host;	10✔
61	return (host == null \|\| host.isEmpty) ? null : host;	5✔
62	}
63
64	static bool _accepts(String host) =>	2✔
65	allowSelfSignedCerts && host == trustedHost && !_officialHosts.contains(host);	8✔
66
67	/// Whether an invalid certificate presented by [host] is accepted.
68	///
69	/// Installed as the `badCertificateCallback` of every client, so it runs per
70	/// handshake and sees the current [allowSelfSignedCerts] / [trustedHost]
71	/// rather than the values from when the client was built.
72	static bool acceptsBadCertificate(X509Certificate cert, String host, int port) => _accepts(host);	×
73
74	/// The host of [serverUrl] while it is exempt from certificate validation,
75	/// null otherwise.
76	///
77	/// Answers the same question as [acceptsBadCertificate], so a UI built on this
78	/// cannot warn about an exemption that does not exist, or stay silent about
79	/// one that does.
80	static String? exemptHost(String? serverUrl) {	2✔
81	final host = _hostOf(serverUrl);	2✔
82	return (host != null && _accepts(host)) ? host : null;	2✔
83	}
84
85	@override	×
86	HttpClient createHttpClient(SecurityContext? context) {
87	return super.createHttpClient(context)..badCertificateCallback = acceptsBadCertificate;	×
88	}
89	}
90
91	/// Routes all `dart:io` HTTP traffic through [WgerHttpOverrides].
92	///
93	/// Must run before the first `HttpClient` is created, since dart:io only
94	/// consults [HttpOverrides.current] in the client constructor. No-op on the
95	/// web, where `dart:io` networking (and thus [HttpOverrides]) does not apply.
96	void installHttpOverrides() {	×
97	if (kIsWeb) {
98	return;
99	}
100	HttpOverrides.global = WgerHttpOverrides();	×
101	}

wger-project / flutter / 30854254088

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous