@microsoft/power-apps-native-host 0.2.22 → 0.3.0

package/scripts/wrap.js

@@ -0,0 +1,536 @@
+#!/usr/bin/env node
+/**
+ * scripts/build.js — Production build for the Power Apps standalone template.
+ *
+ * Relies entirely on the Expo build pipeline — no bundletool, no signing code,
+ * no post-build binary patching.  All customer values (bundle ID, display name,
+ * ADAL credentials, URL schemes) are injected via environment variables before
+ * `expo prebuild` runs, so the native project is fully configured before the
+ * native toolchain compiles it.
+ *
+ *   Android flow:
+ *     1. Write auth.config.json  (MSAL clientId / tenantId)
+ *     2. expo prebuild --platform android  (env vars bake in bundle ID + ADAL)
+ *     3. ./gradlew assembleRelease         (produces an unsigned release APK)
+ *     4. Copy APK → dist/<bundleId>.apk
+ *
+ *   iOS flow (unsigned — default, for the wrap pipeline):
+ *     1. Write auth.config.json
+ *     2. expo prebuild --platform ios      (env vars bake in bundle ID + ADAL + URL schemes)
+ *     3. pod install
+ *     4. build-ios-base                    (xcodebuild archive → unsigned IPA)
+ *     5. Copy IPA → dist/<bundleId>.ipa
+ *
+ *   iOS flow (signed — when ios.signing is set in wrap.config.json):
+ *     1-4. Same as above
+ *     5. xcodebuild archive                (with DEVELOPMENT_TEAM for automatic signing)
+ *     6. xcodebuild -exportArchive         (produces signed IPA via ExportOptions.plist)
+ *
+ * Usage:
+ *   node scripts/build.js android   — produces dist/<bundleId>.apk (signed)
+ *   node scripts/build.js ios       — produces dist/<bundleId>.ipa  (signed or unsigned)
+ *
+ * Prerequisites — Android:
+ *   - JDK 17+: https://adoptium.net/ | brew install openjdk@17
+ *   - ANDROID_HOME pointing to the Android SDK
+ *   - Android SDK Platform-Tools + Build-Tools on PATH
+ *
+ * Prerequisites — iOS (macOS only):
+ *   - Xcode + Command Line Tools (xcode-select --install)
+ *   - CocoaPods (brew install cocoapods)
+ *
+ * The output IPA (iOS) is unsigned when ios.signing is absent (suitable for the
+ * wrap pipeline), or signed via xcodebuild automatic signing when ios.signing is
+ * configured.  The Android APK is signed by apksigner using the
+ * keystore configured in wrap.config.json (debug keystore for local testing).
+ *
+ * Configuration: fill in wrap.config.json (copy from wrap.config.json.example).
+ */
+'use strict';
+
+const { execFileSync } = require('child_process');
+const path = require('path');
+const fs   = require('fs');
+const os   = require('os');
+
+// ─── Parse args ───────────────────────────────────────────────────────────────
+const projectRoot = process.cwd();
+const platform    = (process.argv[2] || '').toLowerCase();
+
+if (platform !== 'android' && platform !== 'ios') {
+  console.error('Usage: wrap android|ios');
+  process.exit(1);
+}
+
+// ─── Load wrap.config.json ────────────────────────────────────────────────────
+const configPath = path.join(projectRoot, 'wrap.config.json');
+if (!fs.existsSync(configPath)) {
+  console.error(
+    '✗ wrap.config.json not found.\n' +
+    '  Copy wrap.config.json.example, fill in your values, then re-run.'
+  );
+  process.exit(1);
+}
+
+let config;
+try {
+  config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+} catch (e) {
+  console.error(`✗ wrap.config.json is not valid JSON: ${e.message}`);
+  process.exit(1);
+}
+
+for (const field of ['bundleIdentifier', 'displayName']) {
+  if (!config[field]) {
+    console.error(`✗ wrap.config.json: missing required field "${field}"`);
+    process.exit(1);
+  }
+}
+if (!config.msal?.clientId || !config.msal?.tenantId) {
+  console.error('✗ wrap.config.json: missing required fields msal.clientId / msal.tenantId');
+  process.exit(1);
+}
+
+const {
+  bundleIdentifier,
+  displayName,
+  version     = '1.0.0',
+  versionCode = 1,
+  msal:       { clientId, tenantId },
+  outputPath: outputPathRel = './dist',
+} = config;
+
+const outputDir = path.resolve(projectRoot, outputPathRel);
+
+// ─── Helpers ──────────────────────────────────────────────────────────────────
+function step(n, total, msg) {
+  console.log(`\n${'─'.repeat(60)}`);
+  console.log(`  Step ${n}/${total} — ${msg}`);
+  console.log('─'.repeat(60));
+}
+
+function ok(msg)   { console.log(`  ✓ ${msg}`); }
+function warn(msg) { console.log(`  ⚠ ${msg}`); }
+
+function run(cmd, args, opts = {}) {
+  const label = [cmd, ...args].join(' ');
+  console.log(`\n▶ ${label.length > 120 ? label.slice(0, 117) + '...' : label}`);
+  execFileSync(cmd, args, { stdio: 'inherit', ...opts });
+}
+
+function requireCommand(cmd, hint) {
+  try {
+    // Use `where` on Windows, `which` on Unix/macOS.
+    const checker = process.platform === 'win32' ? 'where' : 'which';
+    execFileSync(checker, [cmd], { stdio: 'ignore' });
+  } catch {
+    console.error(`✗ "${cmd}" not found. ${hint}`);
+    process.exit(1);
+  }
+}
+
+// ─── Step: write auth.config.json ─────────────────────────────────────────────
+function updateAuthConfig() {
+  const authPath = path.join(projectRoot, 'auth.config.json');
+  fs.writeFileSync(authPath, JSON.stringify({ msal: { clientId, tenantId } }, null, 2) + '\n');
+  ok(`auth.config.json updated (clientId: ${clientId})`);
+}
+
+// ─── Step: expo prebuild ──────────────────────────────────────────────────────
+// All customer values are passed as env vars.  app.config.js reads them and
+// injects them into the native project so no post-build binary patching is needed.
+function runPrebuild(plat) {
+  const appSlug = bundleIdentifier.replace(/\./g, '-').toLowerCase();
+
+  const env = {
+    ...process.env,
+    // Identity
+    ANDROID_PACKAGE:       bundleIdentifier,
+    IOS_BUNDLE_IDENTIFIER: bundleIdentifier,
+    APP_DISPLAY_NAME:      displayName,
+    APP_SLUG:              appSlug,
+    APP_SCHEME:            appSlug,
+    // Version — applied to the Expo config's version and Android versionCode / iOS buildNumber.
+    APP_VERSION:           version,
+    APP_VERSION_CODE:      String(versionCode),
+    // ADAL / MAM — picked up by app.config.js → baked into Info.plist (iOS)
+    // and Android string resources (via the power-apps-native-host config plugin).
+    ADAL_CLIENT_ID:        clientId,
+    ADAL_TENANT_ID:        tenantId,
+    // iOS auth-broker redirect URI — msauth.<bundleId>://auth
+    IOS_ADAL_REDIRECT_URI: `msauth.${bundleIdentifier}://auth`,
+    // App icon — 1024×1024 PNG; Expo generates all platform sizes at prebuild time.
+    ...(config.iconPath ? { APP_ICON_PATH: path.resolve(projectRoot, config.iconPath) } : {}),
+  };
+
+  run('npx', ['expo', 'prebuild', '--platform', plat, '--clean'], { env });
+  ok(`expo prebuild (${plat}) complete`);
+}
+
+// ─── Compute base64-encoded SHA-1 keystore signature hash ────────────────────
+// The MSAL Android redirect URI is msauth://<bundleId>/<base64-SHA1>.  The hash
+// comes from the signing certificate, so this must be called with the same
+// keystore that signed the APK.
+function computeSignatureHash(ksPath, ksPassword, alias) {
+  const out = execFileSync('keytool', [
+    '-list', '-keystore', ksPath,
+    '-storepass', ksPassword,
+    '-alias', alias,
+    '-v',
+  ]).toString();
+  const match = out.match(/SHA1:\s+([0-9A-Fa-f:]{59})/i);
+  if (!match) throw new Error('Could not extract SHA1 from keytool output');
+  return Buffer.from(match[1].replace(/:/g, ''), 'hex').toString('base64');
+}
+
+// ─── Pre-flight: ensure Intune MAM assets are present ─────────────────────────────
+// Downloads on-demand assets required before the native build.  The auth
+// package ships without the large binary artifacts; this ensures they exist.
+function ensureMamAssets(plat) {
+  const authPkg = path.dirname(require.resolve('@microsoft/power-apps-native-auth/package.json'));
+  const { sentinel, setupScript, label } = plat === 'android'
+    ? {
+        sentinel:    path.join(authPkg, 'android', 'libs', 'com.microsoft.intune.mam.build.jar'),
+        setupScript: path.join(authPkg, 'scripts', 'setup-android-sdk.js'),
+        label:       'MAM SDK jars',
+      }
+    : {
+        sentinel:    path.join(authPkg, 'ios', 'Frameworks', 'IntuneMAMSwift.xcframework'),
+        setupScript: path.join(authPkg, 'scripts', 'setup-ios-frameworks.js'),
+        label:       'MAM iOS xcframeworks',
+      };
+
+  if (fs.existsSync(sentinel)) return;
+  console.log(`\n  Intune ${label} not found — downloading now...`);
+  if (!fs.existsSync(setupScript)) {
+    console.error(`✗ Setup script not found: ${setupScript}`);
+    console.error('  Reinstall @microsoft/power-apps-native-auth and retry.');
+    process.exit(1);
+  }
+  run(process.execPath, [setupScript]);
+  if (!fs.existsSync(sentinel)) {
+    console.error(`✗ Setup completed but ${label} still missing — check network and retry.`);
+    process.exit(1);
+  }
+  ok(`Intune ${label} ready`);
+}
+
+// ─── Decode a .mobileprovision file to a plain JS object ──────────────────────────
+// Strips the DER-wrapped CMS envelope with security(1) then converts the
+// resulting plist to JSON with plutil(1).
+function decodeProvisioningProfile(profPath) {
+  requireCommand('security', 'xcode-select --install');
+  requireCommand('plutil',   'xcode-select --install');
+  const tmpPlist = path.join(os.tmpdir(), `pawrap-prof-${process.pid}.plist`);
+  fs.writeFileSync(
+    tmpPlist,
+    execFileSync('security', ['cms', '-D', '-i', profPath], { stdio: ['ignore', 'pipe', 'ignore'] }),
+  );
+  try {
+    return JSON.parse(
+      execFileSync('plutil', ['-convert', 'json', '-o', '-', tmpPlist],
+        { stdio: ['ignore', 'pipe', 'ignore'] }).toString(),
+    );
+  } finally {
+    fs.rmSync(tmpPlist, { force: true });
+  }
+}
+
+// ─── Write ExportOptions.plist for xcodebuild -exportArchive ──────────────────
+// Returns the path to the written file.
+function writeExportOptionsPlist({ exportMethod, signingStyle, teamId, profileName }) {
+  const entries = [
+    `\t<key>method</key>\n\t<string>${exportMethod}</string>`,
+    `\t<key>signingStyle</key>\n\t<string>${signingStyle}</string>`,
+    teamId      ? `\t<key>teamID</key>\n\t<string>${teamId}</string>` : '',
+    profileName ? `\t<key>provisioningProfiles</key>\n\t<dict>\n\t\t<key>${bundleIdentifier}</key>\n\t\t<string>${profileName}</string>\n\t</dict>` : '',
+  ].filter(Boolean).join('\n');
+  const plistPath = path.join(os.tmpdir(), 'pawrap-ExportOptions.plist');
+  fs.writeFileSync(plistPath, [
+    '<?xml version="1.0" encoding="UTF-8"?>',
+    '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
+    '<plist version="1.0">',
+    '<dict>',
+    entries,
+    '</dict>',
+    '</plist>',
+  ].join('\n'));
+  return plistPath;
+}
+
+function buildAndroid() {
+  requireCommand('keytool',   'Included with the JDK (https://adoptium.net/)');
+  requireCommand('apksigner', 'Add $ANDROID_HOME/build-tools/<version> to PATH');
+  requireCommand('unzip',     'xcode-select --install  (macOS) | apt install unzip  (Linux)');
+
+  ensureMamAssets('android');
+
+  const { android: androidCfg = {} } = config;
+  const {
+    keystorePath     = '',
+    keystorePassword = 'android',
+    keyAlias         = 'androiddebugkey',
+    keyPassword      = 'android',
+  } = androidCfg;
+
+  // Resolve keystore — fall back to the auto-generated Expo debug keystore.
+  // The debug keystore works for local testing but must NOT be used for
+  // Play Store submissions (use a dedicated release keystore instead).
+  let ksPath = keystorePath
+    ? path.resolve(projectRoot, keystorePath)
+    : path.join(projectRoot, 'android', 'app', 'debug.keystore');
+  const usingDebugKs = !keystorePath;
+
+  const TOTAL = 5;
+
+  step(1, TOTAL, 'Update auth.config.json');
+  updateAuthConfig();
+
+  step(2, TOTAL, 'expo prebuild (android)');
+  runPrebuild('android');
+
+  // After prebuild the debug keystore exists at android/app/debug.keystore.
+  // Resolve the path again so the fallback is valid post-prebuild.
+  if (usingDebugKs) ksPath = path.join(projectRoot, 'android', 'app', 'debug.keystore');
+
+  if (!fs.existsSync(ksPath)) {
+    console.error(`✗ Keystore not found: ${ksPath}`);
+    console.error('  Set android.keystorePath in wrap.config.json.');
+    console.error('  Generate: keytool -genkey -v -keystore release.jks -alias release -keyalg RSA -keysize 2048 -validity 10000');
+    process.exit(1);
+  }
+  if (usingDebugKs) warn('No android.keystorePath set — signing with the Expo debug keystore (testing only).');
+
+  step(3, TOTAL, 'Build release APK (gradlew assembleRelease)');
+  run('./gradlew', ['assembleRelease'], { cwd: path.join(projectRoot, 'android') });
+
+  // The ShrinkWrap product flavor (injected by the auth config plugin) changes
+  // the Gradle output path from outputs/apk/release/ to outputs/apk/ShrinkWrap/release/.
+  // Search one level of flavor subdirectory to handle both flavored and plain builds.
+  const apkBaseDir = path.join(projectRoot, 'android', 'app', 'build', 'outputs', 'apk');
+  let apks = [];
+  if (fs.existsSync(apkBaseDir)) {
+    // Try the flavored path first (ShrinkWrap/release/), then fall back to release/
+    for (const entry of fs.readdirSync(apkBaseDir)) {
+      const releaseDir = path.join(apkBaseDir, entry, 'release');
+      if (fs.existsSync(releaseDir)) {
+        const found = fs.readdirSync(releaseDir).filter(f => f.endsWith('.apk'));
+        apks.push(...found.map(f => path.join(releaseDir, f)));
+      }
+    }
+  }
+  if (!apks.length) {
+    console.error(`✗ No APK found under ${apkBaseDir}`);
+    process.exit(1);
+  }
+  // assembleRelease produces an unsigned APK when no signingConfig is set.
+  // Prefer the *-unsigned.apk variant for determinism; fall back to the
+  // first match sorted alphabetically.
+  apks.sort();
+  const unsignedApk = apks.find(f => path.basename(f).includes('-unsigned')) ?? apks[0];
+
+  step(4, TOTAL, 'Sign APK (apksigner)');
+  // The MSAL redirect URI is derived from the signing certificate, so we must
+  // sign before computing the redirect URI — unsigned APKs cannot authenticate.
+  fs.mkdirSync(outputDir, { recursive: true });
+  const signedApk = path.join(outputDir, `${bundleIdentifier}.apk`);
+  run('apksigner', [
+    'sign',
+    '--ks',          ksPath,
+    '--ks-pass',     `pass:${keystorePassword}`,
+    '--ks-key-alias', keyAlias,
+    '--key-pass',    `pass:${keyPassword}`,
+    '--out',         signedApk,
+    unsignedApk,
+  ]);
+  ok(`Signed APK: ${signedApk}`);
+
+  step(5, TOTAL, 'Compute MSAL redirect URI');
+  try {
+    const sigHash    = computeSignatureHash(ksPath, keystorePassword, keyAlias);
+    const redirectUri = `msauth://${bundleIdentifier}/${sigHash}`;
+    console.log('\n  ── Add to your Entra app registration ──────────────');
+    console.log(`  Redirect URI (Android / Public client):`)
+    console.log(`    ${redirectUri}`);
+    if (usingDebugKs) {
+      warn('This URI uses the debug keystore — register a release keystore URI for Play Store.');
+    }
+    console.log('  ─────────────────────────────────────────────────────');
+  } catch (e) {
+    warn(`Could not compute redirect URI: ${e.message}`);
+  }
+}
+
+
+// ═════════════════════════════════════════════════════════════════════════════
+//   iOS
+//
+//   Two build paths depending on whether ios.signing is configured:
+//
+//   Unsigned (no ios.signing):  build-ios-base → unsigned IPA for the wrap
+//     pipeline.  Suitable when you want to produce a base binary that will be
+//     re-signed downstream (e.g. by the PowerApps shrinkwrap service).
+//
+//   Signed (ios.signing present): xcodebuild archive + xcodebuild -exportArchive
+//     xcodebuild’s native automatic signing handles certificate and provisioning-
+//     profile selection (including downloading from the Developer Portal) — no
+//     custom profile-search logic needed.
+//
+//   ios.signing fields:
+//     exportMethod  — "development" | "ad-hoc" | "app-store" | "enterprise"
+//     teamId        — Apple Developer team ID (e.g. "ABCD1234EF").
+//                     Recommended; required if multiple teams are in Xcode.
+//     provisioningProfile — optional path to a .mobileprovision file.
+//                     When omitted, xcodebuild uses automatic signing and
+//                     downloads / selects the profile from the Developer Portal.
+//                     When provided, the profile is installed locally and
+//                     signingStyle=manual is used.
+// ═════════════════════════════════════════════════════════════════════════════
+function buildIos() {
+  if (process.platform !== 'darwin') {
+    console.error('✗ iOS builds require macOS.');
+    process.exit(1);
+  }
+  requireCommand('pod', 'brew install cocoapods');
+
+  const { ios: iosCfg = {} } = config;
+  const signing = iosCfg.signing;
+  const TOTAL = 6;
+
+  step(1, TOTAL, 'Update auth.config.json');
+  updateAuthConfig();
+
+  step(2, TOTAL, 'Download Intune MAM iOS xcframeworks');
+  ensureMamAssets('ios');
+
+  step(3, TOTAL, 'expo prebuild (ios)');
+  runPrebuild('ios');
+
+  step(4, TOTAL, 'pod install');
+  run('pod', ['install'], { cwd: path.join(projectRoot, 'ios') });
+
+  if (signing) {
+    // ── Signed path: xcodebuild archive + exportArchive ─────────────────────────────
+    // xcodebuild’s native signing handles certificate + profile selection automatically.
+    requireCommand('xcodebuild', 'xcode-select --install');
+
+    const {
+      exportMethod                    = 'development',
+      teamId                          = '',
+      provisioningProfile: profileRel = '',
+    } = signing;
+
+    const iosDir      = path.join(projectRoot, 'ios');
+    const xcworkspace = fs.readdirSync(iosDir).find(f => f.endsWith('.xcworkspace'));
+    if (!xcworkspace) throw new Error('No .xcworkspace found in ios/ — run pod install first.');
+    const scheme      = xcworkspace.replace('.xcworkspace', '');
+    const archivePath = path.join(os.tmpdir(), 'pawrap-signed.xcarchive');
+
+    step(5, TOTAL, 'Archive (xcodebuild archive)');
+    const archiveArgs = [
+      '-workspace',     path.join(iosDir, xcworkspace),
+      '-scheme',        scheme,
+      '-configuration', 'Release',
+      'archive',
+      '-archivePath',   archivePath,
+      '-destination',   'generic/platform=iOS',
+    ];
+    if (teamId) archiveArgs.push(`DEVELOPMENT_TEAM=${teamId}`);
+    run('xcodebuild', archiveArgs);
+
+    step(6, TOTAL, 'Export signed IPA (xcodebuild -exportArchive)');
+
+    // If an explicit profile file is provided, install it to the local profiles
+    // directory by UUID so xcodebuild can reference it by name.
+    let signingStyle = 'automatic';
+    let profileName  = '';
+    if (profileRel) {
+      const profPath = path.resolve(projectRoot, profileRel);
+      if (!fs.existsSync(profPath)) {
+        console.error(`✗ Provisioning profile not found: ${profPath}`);
+        process.exit(1);
+      }
+      const profMeta = decodeProvisioningProfile(profPath);
+      const destDir  = path.join(os.homedir(), 'Library', 'MobileDevice', 'Provisioning Profiles');
+      fs.mkdirSync(destDir, { recursive: true });
+      fs.copyFileSync(profPath, path.join(destDir, `${profMeta.UUID}.mobileprovision`));
+      profileName  = profMeta.Name;
+      signingStyle = 'manual';
+      ok(`Installed provisioning profile: ${profileName}`);
+    }
+
+    const exportOptsPlist = writeExportOptionsPlist({ exportMethod, signingStyle, teamId, profileName });
+
+    const exportDir = path.join(os.tmpdir(), 'pawrap-export');
+    fs.rmSync(exportDir, { recursive: true, force: true });
+    run('xcodebuild', [
+      '-exportArchive',
+      '-archivePath',        archivePath,
+      '-exportOptionsPlist', exportOptsPlist,
+      '-exportPath',         exportDir,
+    ]);
+
+    const ipas = fs.readdirSync(exportDir).filter(f => f.endsWith('.ipa'));
+    if (!ipas.length) throw new Error(`No IPA found in export directory: ${exportDir}`);
+    fs.mkdirSync(outputDir, { recursive: true });
+    const dest = path.join(outputDir, `${bundleIdentifier}.ipa`);
+    fs.copyFileSync(path.join(exportDir, ipas[0]), dest);
+    ok(`Signed IPA: ${dest}`);
+
+  } else {
+    // ── Unsigned path: build-ios-base ───────────────────────────────────────────────
+    // build-ios-base runs xcodebuild with CODE_SIGNING_REQUIRED=NO and packages
+    // the result into /tmp/pawrap-base.ipa — ready for the wrap pipeline to re-sign.
+    requireCommand('zip',   'xcode-select --install');
+    requireCommand('unzip', 'xcode-select --install');
+
+    step(5, TOTAL, 'Build base IPA (build-ios-base)');
+    const buildIosArgs    = iosCfg.simulator ? ['--simulator'] : [];
+    const buildIosBaseBin = path.join(projectRoot, 'node_modules', '.bin', 'build-ios-base');
+    if (!fs.existsSync(buildIosBaseBin)) {
+      console.error('✗ build-ios-base binary not found — run npm install first');
+      process.exit(1);
+    }
+    run(buildIosBaseBin, buildIosArgs, { cwd: projectRoot });
+
+    const baseIpa = path.join(os.tmpdir(), 'pawrap-base.ipa');
+    if (!fs.existsSync(baseIpa)) {
+      console.error(`✗ IPA not found at ${baseIpa}`);
+      process.exit(1);
+    }
+
+    step(6, TOTAL, 'Copy IPA → dist/');
+    fs.mkdirSync(outputDir, { recursive: true });
+    const dest = path.join(outputDir, `${bundleIdentifier}.ipa`);
+    fs.copyFileSync(baseIpa, dest);
+    ok(`IPA: ${dest}`);
+    warn('IPA is unsigned — add ios.signing to wrap.config.json to produce a signed IPA.');
+  }
+
+  console.log(`\n  Entra redirect URI (add to your app registration):`);
+  console.log(`    msauth.${bundleIdentifier}://auth`);
+}
+
+// ─── Main ─────────────────────────────────────────────────────────────────────
+console.log(`\n${'═'.repeat(60)}`);
+console.log(`  Power Apps Standalone Build — ${platform.toUpperCase()}`);
+console.log(`  Bundle ID : ${bundleIdentifier}`);
+console.log(`  Display   : ${displayName}`);
+console.log(`  Version   : ${version} (${versionCode})`);
+console.log(`  Output    : ${outputDir}`);
+console.log('═'.repeat(60));
+
+try {
+  if (platform === 'android') {
+    buildAndroid();
+  } else {
+    buildIos();
+  }
+  console.log(`\n${'═'.repeat(60)}`);
+  console.log('  Build complete!');
+  console.log('═'.repeat(60) + '\n');
+} catch (err) {
+  console.error(`\n✗ Build failed: ${err.message}`);
+  process.exit(1);
+}
+