isCertificateFingerprintAllowed function

bool isCertificateFingerprintAllowed(
  1. X509Certificate? certificate, {
  2. required List<String> allowedFingerprints,
})

Whether certificate matches one of allowedFingerprints.

Takes the fingerprint list as a parameter (rather than reading SecurityConstants directly) so it can be unit tested against arbitrary fingerprint lists without needing to override a compile-time constant.

The empty-list and null-certificate cases both fail open (allow) rather than fail closed — this is a deliberate, security-reviewed decision, not an oversight: there is no production release yet, fail-open avoids the app being entirely non-functional pre-launch, and both cases remain fully protected by the platform's normal TLS/system-CA trust regardless. Do not "fix" this to fail closed without first raising it as a discussion, since it has already been decided.

Implementation

bool isCertificateFingerprintAllowed(X509Certificate? certificate, {required List<String> allowedFingerprints}) {
  if (allowedFingerprints.isEmpty || certificate == null) {
    return true;
  }

  final String fingerprint = sha256.convert(certificate.der).toString().toUpperCase();
  final List<String> normalizedAllowed = allowedFingerprints
      .map((String f) => f.toUpperCase().replaceAll(RegExp(r'[:\s]'), ''))
      .toList(growable: false);

  return normalizedAllowed.contains(fingerprint);
}