package com.jiooption.trading.security

import com.jiooption.trading.utils.Constants
import okhttp3.CertificatePinner

/**
 * SSL Certificate Pinning configuration
 * Pins the server's SSL certificate to prevent MITM attacks
 */
object SSLPinning {

    /**
     * Create CertificatePinner for OkHttp
     * 
     * In production, replace the placeholder pin with your actual server's
     * certificate SHA-256 hash. You can get it by running:
     * 
     * openssl s_client -servername yourdomain.com -connect yourdomain.com:443 | \
     *   openssl x509 -pubkey -noout | \
     *   openssl pkey -pubin -outform der | \
     *   openssl dgst -sha256 -binary | openssl enc -base64
     */
    fun createCertificatePinner(): CertificatePinner {
        return CertificatePinner.Builder()
            // Add your production domain's certificate pins here
            // Example:
            // .add("yourdomain.com", "sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=")
            // .add("yourdomain.com", "sha256/BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=")
            .build()
    }

    /**
     * Check if SSL pinning should be enabled
     * Disable for debug builds to allow local development
     */
    fun isEnabled(): Boolean {
        return !com.jiooption.trading.BuildConfig.DEBUG
    }
}
