#pragma once
#include <windows.h>
#include <winhttp.h>
#include <string>
#include <vector>

#pragma comment(lib, "crypt32.lib")

/**
 * SPKI SHA-256 Certificate Pinner — pure client-side.
 * Prevents MITM proxies (Fiddler/Charles/Burp) from intercepting HTTPS traffic
 * by verifying the server's public key matches a hardcoded hash.
 *
 * Pin format: SHA-256 of the SPKI (Subject Public Key Info) DER encoding.
 * This survives certificate renewal as long as the same key pair is used.
 */
class CertPinner
{
public:
    /// Verify the server certificate presented by an active WinHTTP request.
    /// @return true if SPKI hash matches the pinned value, false (connection should be closed)
    static bool VerifyServerCert(HINTERNET hRequest);

private:
    CertPinner() = default;

    /// Extract the SPKI (SubjectPublicKeyInfo) from a certificate context and hash it.
    static std::string GetSpkiHash(PCCERT_CONTEXT pCertContext);

    /// Returns the XOR-obfuscated pinned SPKI SHA-256 hash, deobfuscated at runtime.
    static std::string GetPinnedHash();
};
