@microsoft/power-apps-native-host 0.2.22 → 0.3.0

package/lib/commonjs/auth/AuthContext.js

@@ -36,10 +36,49 @@ const SIGN_IN_SCOPES = ['https://api.powerplatform.com/.default'];
 function getSafeErrorName(error) {
   return error instanceof Error ? error.constructor.name : typeof error;
 }
+function accountsMatch(left, right) {
+  return left.identifier === right.identifier && left.tenantId === right.tenantId;
+}
+async function validateRequiredScopes(pca, account, scopes) {
+  for (const scope of scopes) {
+    await pca.acquireTokenSilent({
+      scopes: [scope],
+      account
+    });
+  }
+}
+async function acquireRequiredScopesInteractively(pca, scopes) {
+  const [primaryScope, ...additionalScopes] = scopes;
+  const primaryResult = await pca.acquireToken({
+    scopes: [primaryScope],
+    prompt: 'select_account'
+  });
+  const signedInAccount = primaryResult.account;
+  for (const scope of additionalScopes) {
+    try {
+      await pca.acquireTokenSilent({
+        scopes: [scope],
+        account: signedInAccount
+      });
+    } catch {
+      const result = await pca.acquireToken({
+        scopes: [scope],
+        loginHint: signedInAccount.username,
+        prompt: 'login'
+      });
+      if (!accountsMatch(signedInAccount, result.account)) {
+        throw new Error('Sign in with the same account for all required Power Platform permissions.');
+      }
+    }
+  }
+  await validateRequiredScopes(pca, signedInAccount, scopes);
+  return signedInAccount;
+}
 const AuthContext = /*#__PURE__*/(0, _react.createContext)(null);
 function AuthProvider({
   msalConfig,
   intuneConfig,
+  requiredScopes = [],
   children
 }) {
   const [isAuthReady, setIsAuthReady] = (0, _react.useState)(false);
@@ -104,6 +143,8 @@ function AuthProvider({
   // Skip MSAL entirely; treat the session as already signed in so the app
   // renders without requiring credentials.
   const noAuthMode = !effectiveClientId;
+  const requiredScopeKey = [...new Set(requiredScopes)].join('|');
+  const effectiveRequiredScopes = requiredScopeKey ? requiredScopeKey.split('|') : SIGN_IN_SCOPES;
   const pcaRef = (0, _react.useRef)(null);
   (0, _react.useEffect)(() => {
     if (noAuthMode) {
@@ -129,8 +170,20 @@ function AuthProvider({
       useBroker,
       platform: _reactNative.Platform.OS
     });
-    pca.init().then(() => pca.getAccounts()).then(accounts => {
-      const restoredAccount = accounts[0] ?? null;
+    pca.init().then(() => pca.getAccounts()).then(async accounts => {
+      let restoredAccount = accounts[0] ?? null;
+      if (restoredAccount) {
+        try {
+          await validateRequiredScopes(pca, restoredAccount, effectiveRequiredScopes);
+        } catch (tokenError) {
+          await pca.signOut({
+            account: restoredAccount
+          }).catch(() => undefined);
+          restoredAccount = null;
+          setError(new Error('Your session has expired. Sign in again to continue.'));
+          (0, _logger.debugWarn)('[AuthProvider] restored account is missing a required token:', tokenError);
+        }
+      }
       setAccount(restoredAccount);
       if (restoredAccount) {
         (0, _index.getAppLogger)().identifyUser({
@@ -154,7 +207,7 @@ function AuthProvider({
     });
     // Re-initialize only when the effective broker/identity settings change.
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [effectiveClientId, effectiveTenantId, effectiveRedirectUri, useBroker]);
+  }, [effectiveClientId, effectiveTenantId, effectiveRedirectUri, requiredScopeKey, useBroker]);
   const signIn = (0, _react.useCallback)(async () => {
     const pca = pcaRef.current;
     if (!pca) return;
@@ -168,13 +221,11 @@ function AuthProvider({
       if (!pca.isInitialized) {
         await pca.init();
       }
-      const result = await pca.acquireToken({
-        scopes: SIGN_IN_SCOPES
-      });
-      setAccount(result.account);
+      const signedInAccount = await acquireRequiredScopesInteractively(pca, effectiveRequiredScopes);
+      setAccount(signedInAccount);
       (0, _index.getAppLogger)().identifyUser({
-        objectId: result.account.identifier,
-        tenantId: result.account.tenantId
+        objectId: signedInAccount.identifier,
+        tenantId: signedInAccount.tenantId
       });
       // Register the signed-in account with Intune MAM so the SDK can apply
       // app protection policies (PIN, wipe, copy-paste restriction, etc.).
@@ -183,9 +234,9 @@ function AuthProvider({
       if (intuneEnabled) {
         try {
           await (0, _powerAppsNativeAuth.registerAndEnrollAccount)({
-            upn: result.account.username,
-            aadId: result.account.identifier,
-            tenantId: result.account.tenantId
+            upn: signedInAccount.username,
+            aadId: signedInAccount.identifier,
+            tenantId: signedInAccount.tenantId
           });
           (0, _index.getAppLogger)().trackActivityEvent(_index.HostOperationNames.AuthIntuneEnroll);
         } catch (intuneErr) {
@@ -206,7 +257,7 @@ function AuthProvider({
     } finally {
       setIsLoading(false);
     }
-  }, [intuneEnabled, useBroker]);
+  }, [intuneEnabled, requiredScopeKey, useBroker]);
   const acquireToken = (0, _react.useCallback)(async scopes => {
     const pca = pcaRef.current;
     if (!pca || !account) return null;
@@ -217,18 +268,23 @@ function AuthProvider({
       });
       return result.accessToken;
     } catch (e) {
-      // Silent acquisition failed — do NOT fall back to interactive here.
-      // Interactive sign-in is handled exclusively by signIn(). Falling back
-      // to interactive from acquireToken triggers an unexpected login webview
-      // whenever a connector needs a token the cache doesn't hold yet.
       (0, _logger.debugWarn)('[AuthContext] acquireTokenSilent failed for scopes:', scopes, e);
       (0, _index.getAppLogger)().trackErrorEvent(_index.HostOperationNames.AuthAcquireTokenSilentFailed, {
         scopeCount: scopes.length,
         errorName: getSafeErrorName(e)
       });
+      if (scopes.some(scope => effectiveRequiredScopes.includes(scope))) {
+        await pca.signOut({
+          account
+        }).catch(signOutError => {
+          (0, _logger.debugWarn)('[AuthContext] failed to clear an invalid session:', signOutError);
+        });
+        setError(new Error('Your session has expired. Sign in again to continue.'));
+        setAccount(null);
+      }
       return null;
     }
-  }, [account]);
+  }, [account, requiredScopeKey]);
   const signOut = (0, _react.useCallback)(async () => {
     const pca = pcaRef.current;
     if (!pca || !account) return;

package/lib/commonjs/auth/AuthContext.web.js

@@ -0,0 +1,32 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.AuthProvider = AuthProvider;
+exports.useAuth = useAuth;
+var _react = _interopRequireWildcard(require("react"));
+var _jsxRuntime = require("react/jsx-runtime");
+function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
+const hostedWebAuthState = {
+  isLoading: false,
+  isAuthReady: true,
+  isSignedIn: true,
+  hasRealAccount: false,
+  error: null,
+  acquireToken: async () => null,
+  signIn: async () => undefined,
+  signOut: async () => undefined
+};
+const AuthContext = /*#__PURE__*/(0, _react.createContext)(hostedWebAuthState);
+function AuthProvider({
+  children
+}) {
+  return /*#__PURE__*/(0, _jsxRuntime.jsx)(AuthContext.Provider, {
+    value: hostedWebAuthState,
+    children: children
+  });
+}
+function useAuth() {
+  return (0, _react.useContext)(AuthContext);
+}

package/lib/commonjs/auth/completePowerAppsAuthSession.js

@@ -0,0 +1,16 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.completePowerAppsAuthSession = completePowerAppsAuthSession;
+var WebBrowser = _interopRequireWildcard(require("expo-web-browser"));
+function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
+/**
+ * Completes an Expo web authentication popup when the current route is its
+ * redirect target. Call this at module initialization in the OAuth callback
+ * route; navigation after completion remains application-owned.
+ */
+function completePowerAppsAuthSession(options) {
+  return WebBrowser.maybeCompleteAuthSession(options);
+}

package/lib/commonjs/bridge/NativePowerAppsBridge.js

@@ -7,7 +7,9 @@ exports.NativePowerAppsBridge = void 0;
 exports.buildConnectionReferences = buildConnectionReferences;
 var _logger = require("../logger.js");
 var _index = require("../telemetry/index.js");
+var _http = require("@microsoft/power-apps-native-common/http");
 var _powerAppsNativeCommon = require("@microsoft/power-apps-native-common");
+var _bridgeState = require("./bridgeState.js");
 /*!
  * power-apps-native-host — NativePowerAppsBridge
  *
@@ -120,7 +122,7 @@ class NativePowerAppsBridge {
    * via globalThis would have no effect — mutating options is the correct path.
    */
   updateOptions(options) {
-    this._options = options;
+    this._options = (0, _bridgeState.updateBridgeOptionsInPlace)(this._options, options);
   }
   async initialize() {
     // No handshake required for the native path.
@@ -203,10 +205,6 @@ class NativePowerAppsBridge {
       method
     } = requestConfig;
     const urlLabel = (0, _powerAppsNativeCommon.sanitizeUrl)(url.replace(/^https?:\/\/[^/]+/, '').slice(0, 100));
-    const scenario = (0, _index.getAppLogger)().trackScenario(_index.HostOperationNames.BridgeHttpRequest, {
-      httpMethod: method,
-      url: urlLabel
-    });
     const isBlob = bodyParam instanceof Blob;
 
     // The SDK builds Authorization headers with the "paauth" scheme (its web-player
@@ -231,11 +229,12 @@ class NativePowerAppsBridge {
       // SDK passed a plain object — JSON-stringify it as a fallback
       bodyInit = JSON.stringify(bodyParam);
     }
+    bodyInit = (0, _bridgeState.getRequestBodyForMethod)(method, bodyInit);
     headers = normalizeJsonBodyHeaders(headers, bodyInit);
     (0, _logger.debugLog)(`[bridge] → ${method} ${urlLabel}`);
     let response;
     try {
-      response = await fetch(url, {
+      response = await _index.bridgeHttpClient.request(url, {
         method,
         headers: headers,
         body: bodyInit
@@ -243,9 +242,6 @@ class NativePowerAppsBridge {
     } catch (fetchErr) {
       (0, _logger.debugWarn)(`[bridge] fetch THREW for ${method} ${urlLabel}:`, fetchErr);
       (0, _logger.debugLog)(`[bridge] fetch THREW for ${method} ${urlLabel} | req body: ${typeof bodyInit === 'string' ? bodyInit.slice(0, 500) : bodyInit != null ? '<non-string body>' : '<no body>'}`);
-      scenario.fail(undefined, {
-        errorName: getSafeErrorName(fetchErr)
-      });
       throw fetchErr;
     }
     const responseHeaders = {};
@@ -256,20 +252,27 @@ class NativePowerAppsBridge {
       const sdkKey = key === 'content-type' ? 'Content-Type' : key;
       responseHeaders[sdkKey] = value;
     });
-    const buffer = await response.arrayBuffer();
     (0, _logger.debugLog)(`[bridge] ${method} ${urlLabel} → ${response.status}`);
+    const correlationProperties = (0, _http.getHttpCorrelationProperties)(response.headers);
+    let buffer;
+    try {
+      buffer = await response.arrayBuffer();
+    } catch (readErr) {
+      (0, _logger.debugWarn)(`[bridge] HTTP ${response.status} for ${method} ${urlLabel} | failed to read response body:`, readErr);
+      (0, _index.getAppLogger)().trackErrorEvent(_index.HostOperationNames.BridgeHttpRequest, {
+        phase: 'readResponseBody',
+        errorName: getSafeErrorName(readErr),
+        httpStatus: response.status,
+        ...correlationProperties
+      });
+      throw readErr;
+    }
     if (!response.ok) {
       const bodyText = new TextDecoder().decode(buffer).slice(0, 1000);
       (0, _logger.debugWarn)(`[bridge] HTTP ${response.status} for ${method} ${urlLabel} | res: ${bodyText}`);
       (0, _logger.debugLog)(`[bridge] HTTP ${response.status} for ${method} ${urlLabel} | req: ${typeof bodyInit === 'string' ? bodyInit.slice(0, 500) : bodyInit != null ? '<non-string body>' : '<no body>'} | res: ${bodyText}`);
-      scenario.completeWithError({
-        httpStatus: response.status
-      });
-    } else {
-      scenario.complete({
-        httpStatus: response.status
-      });
     }
+    (0, _bridgeState.assertSuccessfulHttpStatus)(response.status, method);
     return [{
       status: response.status,
       headers: responseHeaders

package/lib/commonjs/bridge/PowerPagesBridge.js

@@ -0,0 +1,157 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.PowerPagesBridge = void 0;
+exports.setupPowerPagesHost = setupPowerPagesHost;
+var _index = require("../telemetry/index.js");
+var _http = require("@microsoft/power-apps-native-common/http");
+function toPowerPagesUrl(url) {
+  const parsedUrl = new URL(url, window.location.origin);
+  if (parsedUrl.origin === window.location.origin && parsedUrl.pathname.startsWith('/_api/')) {
+    return `${parsedUrl.pathname}${parsedUrl.search}`;
+  }
+  const lowerPath = parsedUrl.pathname.toLowerCase();
+  if (lowerPath.includes('/$metadata') || lowerPath.includes('/entitydefinitions') || lowerPath.includes('/$batch') || lowerPath.includes('/microsoft.dynamics.crm.')) {
+    throw new Error(`PowerPagesBridge does not support this Dataverse operation: ${parsedUrl.pathname}`);
+  }
+  const dataverseApiPattern = /\/api\/data\/v\d+(?:\.\d+)+\//gi;
+  let finalMatch = null;
+  let match;
+  while ((match = dataverseApiPattern.exec(parsedUrl.pathname)) !== null) {
+    finalMatch = match;
+  }
+  if (finalMatch?.index === undefined) {
+    throw new Error(`PowerPagesBridge only supports Dataverse Web API requests: ${parsedUrl.pathname}`);
+  }
+  const resourcePath = parsedUrl.pathname.slice(finalMatch.index + finalMatch[0].length);
+  return `/_api/${resourcePath}${parsedUrl.search}`;
+}
+let requestVerificationTokenPromise;
+function getRequestVerificationToken() {
+  requestVerificationTokenPromise ??= (async () => {
+    const response = await _index.bridgeHttpClient.request('/_layout/tokenhtml', {
+      credentials: 'same-origin'
+    });
+    if (!response.ok) {
+      throw new Error(`PowerPagesBridge could not get a CSRF token (${response.status})`);
+    }
+    const tokenDocument = new DOMParser().parseFromString(await response.text(), 'text/html');
+    const token = tokenDocument.querySelector('input[name="__RequestVerificationToken"]')?.getAttribute('value');
+    if (!token) {
+      throw new Error('PowerPagesBridge could not find a CSRF token in /_layout/tokenhtml');
+    }
+    return token;
+  })().catch(error => {
+    requestVerificationTokenPromise = undefined;
+    throw error;
+  });
+  return requestVerificationTokenPromise;
+}
+function createHeaders(headers, token) {
+  const result = new Headers();
+  for (const [name, value] of Object.entries(headers ?? {})) {
+    if (name.toLowerCase() !== 'authorization') {
+      result.set(name, value);
+    }
+  }
+  result.set('__RequestVerificationToken', token);
+  return result;
+}
+class PowerPagesBridge {
+  constructor(options) {
+    this.options = options;
+  }
+  updateOptions(options) {
+    this.options = options;
+  }
+  async initialize() {}
+  createRequestBody(config) {
+    return config.body ?? '';
+  }
+  async executePluginAsync(pluginName, pluginAction, params) {
+    const pluginKey = `${pluginName}.${pluginAction}`;
+    switch (pluginKey) {
+      case 'AppIdentityServicePlugin.getAppAccessTokenAsync':
+      case 'AppIdentityServicePlugin.getAppDynamicResourceAccessTokenAsync':
+        return '';
+      case 'AppPowerAppsClientPlugin.getAppCdsDataSourceConfigsAsync':
+        return this.options.dataSources;
+      case 'AppPowerAppsClientPlugin.loadAppConnectionsAsync_v2':
+      case 'AppPowerAppsClientPlugin.loadNonCompositeConnectionsAsync':
+        return this.options.connections;
+      case 'AppPowerAppsClientPlugin.resolveCompositeConnectionsAsync':
+        return null;
+      case 'AppHttpClientPlugin.sendHttpAsync':
+        return this.sendHttpAsync(params);
+      case 'PublishedAppTelemetry.trackEvent':
+      case 'PublishedAppTelemetry.trackException':
+      case 'PublishedAppTelemetry.trackMetric':
+      case 'PublishedAppTelemetry.startScenario':
+      case 'PublishedAppTelemetry.endScenario':
+      case 'PublishedAppTelemetry.setDefaultProperties':
+        return undefined;
+      default:
+        throw new Error(`PowerPagesBridge does not support ${pluginKey}`);
+    }
+  }
+  async sendHttpAsync(params) {
+    const request = params[0];
+    const body = params[1];
+    const powerPagesUrl = toPowerPagesUrl(request.url);
+    const token = await getRequestVerificationToken();
+    let response;
+    try {
+      response = await _index.bridgeHttpClient.request(powerPagesUrl, {
+        method: request.method,
+        headers: createHeaders(request.headers, token),
+        body: body || undefined,
+        credentials: 'same-origin'
+      });
+    } catch (error) {
+      throw error;
+    }
+    const correlationProperties = (0, _http.getHttpCorrelationProperties)(response.headers);
+    const responseHeaders = {};
+    response.headers.forEach((value, name) => {
+      responseHeaders[name === 'content-type' ? 'Content-Type' : name] = value;
+    });
+    let responseBody;
+    try {
+      responseBody = await response.arrayBuffer();
+    } catch (error) {
+      (0, _index.getAppLogger)().trackErrorEvent(_index.HostOperationNames.BridgeHttpRequest, {
+        phase: 'readResponseBody',
+        errorName: error instanceof Error ? error.constructor.name : typeof error,
+        httpStatus: response.status,
+        ...correlationProperties
+      });
+      throw error;
+    }
+    if (!response.ok) {
+      const responseText = new TextDecoder().decode(responseBody).slice(0, 1000);
+      const detail = responseText ? `: ${responseText}` : '';
+      // RuntimeDataClient treats JSON tuples as successful before inspecting status.
+      // Reject with its HTTP-plugin error shape so 4xx/5xx responses remain failures.
+      throw [[`Power Pages Web API request failed (${response.status})${detail}`, undefined, {
+        status: response.status,
+        headers: responseHeaders
+      }], responseBody];
+    }
+    return [{
+      status: response.status,
+      headers: responseHeaders
+    }, responseBody];
+  }
+}
+exports.PowerPagesBridge = PowerPagesBridge;
+let bridge;
+function setupPowerPagesHost(options) {
+  if (bridge) {
+    bridge.updateOptions(options);
+    return;
+  }
+  bridge = new PowerPagesBridge(options);
+  globalThis.powerAppsBridge = bridge;
+}

package/lib/commonjs/bridge/bridgeState.js

@@ -0,0 +1,40 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.assertSuccessfulHttpStatus = assertSuccessfulHttpStatus;
+exports.getRequestBodyForMethod = getRequestBodyForMethod;
+exports.updateBridgeOptionsInPlace = updateBridgeOptionsInPlace;
+function getRequestBodyForMethod(method, body) {
+  const normalizedMethod = method.toUpperCase();
+  return normalizedMethod === 'GET' || normalizedMethod === 'HEAD' ? null : body;
+}
+function assertSuccessfulHttpStatus(status, method) {
+  if (status >= 200 && status < 300) return;
+  throw new Error(`HTTP ${status} for ${method.toUpperCase()} request`);
+}
+function updateBridgeOptionsInPlace(current, next) {
+  const connections = current.connections;
+  for (const key of Object.keys(connections)) {
+    if (!(key in next.connections)) delete connections[key];
+  }
+  for (const [key, nextConnection] of Object.entries(next.connections)) {
+    const currentConnection = connections[key];
+    if (currentConnection) {
+      for (const property of Object.keys(currentConnection)) {
+        delete currentConnection[property];
+      }
+      Object.assign(currentConnection, nextConnection);
+    } else {
+      connections[key] = nextConnection;
+    }
+  }
+  const dataSources = current.dataSources;
+  dataSources.splice(0, dataSources.length, ...next.dataSources);
+  return {
+    ...next,
+    connections,
+    dataSources
+  };
+}