From 12938cbc731f23a8413b1ebce9252b3db079e21f Mon Sep 17 00:00:00 2001
From: Hans <me@hans00.me>
Date: Mon, 8 Sep 2025 14:48:59 +0800
Subject: [PATCH] feat: Support `passphrase` for TLS Server

---
 .../com/asterinet/react/tcpsocket/SSLCertificateHelper.java   | 4 ++--
 .../java/com/asterinet/react/tcpsocket/TcpSocketServer.java   | 3 ++-
 ios/TcpSocketClient.m                                         | 4 ++--
 lib/types/TLSServer.d.ts                                      | 1 +
 src/TLSServer.js                                              | 1 +
 5 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/android/src/main/java/com/asterinet/react/tcpsocket/SSLCertificateHelper.java b/android/src/main/java/com/asterinet/react/tcpsocket/SSLCertificateHelper.java
index 1e0622f..8cd3d0b 100644
--- a/android/src/main/java/com/asterinet/react/tcpsocket/SSLCertificateHelper.java
+++ b/android/src/main/java/com/asterinet/react/tcpsocket/SSLCertificateHelper.java
@@ -63,8 +63,8 @@ static SSLSocketFactory createBlindSocketFactory() throws GeneralSecurityExcepti
         return ctx.getSocketFactory();
     }
 
-    static SSLServerSocketFactory createServerSocketFactory(Context context, @NonNull final String keyStoreResourceUri) throws GeneralSecurityException, IOException {
-        char[] password = "".toCharArray();
+    static SSLServerSocketFactory createServerSocketFactory(Context context, @NonNull final String keyStoreResourceUri, final String passphrase) throws GeneralSecurityException, IOException {
+        char[] password = (passphrase != null) ? passphrase.toCharArray() : "".toCharArray();
 
         InputStream keyStoreInput = getRawResourceStream(context, keyStoreResourceUri);
         KeyStore keyStore = KeyStore.getInstance("PKCS12");
diff --git a/android/src/main/java/com/asterinet/react/tcpsocket/TcpSocketServer.java b/android/src/main/java/com/asterinet/react/tcpsocket/TcpSocketServer.java
index 2f13fdf..16ddfd3 100644
--- a/android/src/main/java/com/asterinet/react/tcpsocket/TcpSocketServer.java
+++ b/android/src/main/java/com/asterinet/react/tcpsocket/TcpSocketServer.java
@@ -40,8 +40,9 @@ public TcpSocketServer(final Context context, final ConcurrentHashMap<Integer, T
         if (tlsOptions != null) {
             String keystoreResourceUri = tlsOptions.getString("keystore");
             assert keystoreResourceUri != null;
+            String passphrase = tlsOptions.hasKey("passphrase") ? tlsOptions.getString("passphrase") : null;
 
-            SSLServerSocketFactory ssf = SSLCertificateHelper.createServerSocketFactory(context, keystoreResourceUri);
+            SSLServerSocketFactory ssf = SSLCertificateHelper.createServerSocketFactory(context, keystoreResourceUri, passphrase);
             serverSocket = ssf.createServerSocket(port, 50, localInetAddress);
             isTLS = true;
             // ((SSLServerSocket) serverSocket).setNeedClientAuth(true);
diff --git a/ios/TcpSocketClient.m b/ios/TcpSocketClient.m
index ad52d6c..81b5ec2 100644
--- a/ios/TcpSocketClient.m
+++ b/ios/TcpSocketClient.m
@@ -348,7 +348,8 @@ - (BOOL)setSecureContext:(NSDictionary *)tlsOptions {
     NSURL *keystoreUrl = [[NSURL alloc] initWithString:keystoreResourcePath];
     NSData *pkcs12data = [[NSData alloc] initWithContentsOfURL:keystoreUrl];
     CFDataRef inPCKS12Data = (CFDataRef)CFBridgingRetain(pkcs12data);
-    CFStringRef password = CFSTR("");
+    NSString *passphrase = tlsOptions[@"passphrase"] ?: @"";
+    CFStringRef password = (__bridge CFStringRef)passphrase;
     const void *keys[] = {kSecImportExportPassphrase};
     const void *values[] = {password};
     CFDictionaryRef options = CFDictionaryCreate(NULL, keys, values, 1, NULL, NULL);
@@ -357,7 +358,6 @@ - (BOOL)setSecureContext:(NSDictionary *)tlsOptions {
 
     OSStatus securityError = SecPKCS12Import(inPCKS12Data, options, &items);
     CFRelease(options);
-    CFRelease(password);
 
     if (securityError != errSecSuccess) {
         return false;
diff --git a/lib/types/TLSServer.d.ts b/lib/types/TLSServer.d.ts
index 2691811..a346893 100644
--- a/lib/types/TLSServer.d.ts
+++ b/lib/types/TLSServer.d.ts
@@ -23,6 +23,7 @@ export default class TLSServer extends Server {
 }
 export type TLSServerOptions = {
     keystore: any;
+    passphrase?: string;
 };
 import Server from "./Server";
 import TLSSocket from "./TLSSocket";
diff --git a/src/TLSServer.js b/src/TLSServer.js
index 64808a4..72a8fe0 100644
--- a/src/TLSServer.js
+++ b/src/TLSServer.js
@@ -7,6 +7,7 @@ import TLSSocket from './TLSSocket';
 /**
  * @typedef {object} TLSServerOptions
  * @property {any} keystore
+ * @property {string} [passphrase] - Optional passphrase for keystore
  *
  * @extends {Server}
  */