@microsoft/power-apps-native-host 0.2.25 → 0.3.0

package/README.md

@@ -104,8 +104,8 @@ npx --package @microsoft/power-apps-native-host@latest upgrade-template
 
 Each run upgrades one template version, installs compatible dependencies, and
 runs Expo validation. If another version is available, run the command again.
-The current version is stored in `.powerapps-native/version.json`; do not edit
-this file.
+The current version is stored in `app.json` under
+`expo.extra.powerappsNative`; do not edit this object.
 
 Apps created before this version file existed must specify their source template
 version:
@@ -161,6 +161,25 @@ export default function App() {
 
 See `src/index.ts` for the full exported API.
 
+## Metro Logger
+
+Metro configuration can import the Node-only logger from
+`@microsoft/power-apps-native-host/metro-logger`. Pass `projectRoot` when
+wrapping middleware. An optional `onError(error, context)` callback receives the
+first instrumentation failure for that project; `context` contains `phase` and
+`logPath`. The callback is invoked at most once so diagnostics cannot recurse.
+When it is omitted, the first failure is written once through the original
+stderr stream. Logging and callback failures never propagate into Metro.
+
+```js
+withPowerNativeMetroLogging(middleware, {
+    projectRoot: __dirname,
+    onError(error, { phase, logPath }) {
+        reportMetroLoggingFailure({ error, phase, logPath });
+    },
+});
+```
+
 ## Bundled CLI Scripts
 
 This package exposes these CLI scripts through the `bin` field:

package/compatibility/current.json

@@ -61,7 +61,6 @@
     "react-dom": "19.2.0",
     "react-hook-form": "7.54.0",
     "react-native": "0.83.6",
-    "react-native-calendars": "1.1314.0",
     "react-native-gesture-handler": "2.30.1",
     "react-native-get-random-values": "^2.0.0",
     "react-native-reanimated": "4.2.1",

package/lib/NOTICE.txt

@@ -396,7 +396,7 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ========================================================================
 
-framer-motion 12.42.2
+framer-motion 12.43.0
 --
 The MIT License (MIT)
 
@@ -422,13 +422,7 @@ SOFTWARE.
 
 ========================================================================
 
-imurmurhash 0.1.4
---
-Copyright Jens Taylor; licensed under MIT (https://spdx.org/licenses/MIT.html)
-
-========================================================================
-
-motion 12.42.2
+motion 12.43.0
 --
 The MIT License (MIT)
 
@@ -454,7 +448,7 @@ SOFTWARE.
 
 ========================================================================
 
-motion-dom 12.42.2
+motion-dom 12.43.0
 --
 The MIT License (MIT)
 
@@ -532,11 +526,11 @@ Copyright (c) 2024-present Cedric van Putten <me@cedric.dev>
 
 ========================================================================
 
-signal-exit 3.0.7
+signal-exit 4.1.0
 --
 The ISC License
 
-Copyright (c) 2015, Contributors
+Copyright (c) 2015-2023 Benjamin Coe, Isaac Z. Schlueter, and Contributors
 
 Permission to use, copy, modify, and/or distribute this software
 for any purpose with or without fee is hereby granted, provided
@@ -570,7 +564,7 @@ PERFORMANCE OF THIS SOFTWARE.
 
 ========================================================================
 
-write-file-atomic 4.0.2
+write-file-atomic 7.0.1
 --
 Copyright (c) 2015, Rebecca Turner
 

package/lib/commonjs/auth/AuthContext.js

@@ -36,10 +36,49 @@ const SIGN_IN_SCOPES = ['https://api.powerplatform.com/.default'];
 function getSafeErrorName(error) {
   return error instanceof Error ? error.constructor.name : typeof error;
 }
+function accountsMatch(left, right) {
+  return left.identifier === right.identifier && left.tenantId === right.tenantId;
+}
+async function validateRequiredScopes(pca, account, scopes) {
+  for (const scope of scopes) {
+    await pca.acquireTokenSilent({
+      scopes: [scope],
+      account
+    });
+  }
+}
+async function acquireRequiredScopesInteractively(pca, scopes) {
+  const [primaryScope, ...additionalScopes] = scopes;
+  const primaryResult = await pca.acquireToken({
+    scopes: [primaryScope],
+    prompt: 'select_account'
+  });
+  const signedInAccount = primaryResult.account;
+  for (const scope of additionalScopes) {
+    try {
+      await pca.acquireTokenSilent({
+        scopes: [scope],
+        account: signedInAccount
+      });
+    } catch {
+      const result = await pca.acquireToken({
+        scopes: [scope],
+        loginHint: signedInAccount.username,
+        prompt: 'login'
+      });
+      if (!accountsMatch(signedInAccount, result.account)) {
+        throw new Error('Sign in with the same account for all required Power Platform permissions.');
+      }
+    }
+  }
+  await validateRequiredScopes(pca, signedInAccount, scopes);
+  return signedInAccount;
+}
 const AuthContext = /*#__PURE__*/(0, _react.createContext)(null);
 function AuthProvider({
   msalConfig,
   intuneConfig,
+  requiredScopes = [],
   children
 }) {
   const [isAuthReady, setIsAuthReady] = (0, _react.useState)(false);
@@ -104,6 +143,8 @@ function AuthProvider({
   // Skip MSAL entirely; treat the session as already signed in so the app
   // renders without requiring credentials.
   const noAuthMode = !effectiveClientId;
+  const requiredScopeKey = [...new Set(requiredScopes)].join('|');
+  const effectiveRequiredScopes = requiredScopeKey ? requiredScopeKey.split('|') : SIGN_IN_SCOPES;
   const pcaRef = (0, _react.useRef)(null);
   (0, _react.useEffect)(() => {
     if (noAuthMode) {
@@ -129,8 +170,20 @@ function AuthProvider({
       useBroker,
       platform: _reactNative.Platform.OS
     });
-    pca.init().then(() => pca.getAccounts()).then(accounts => {
-      const restoredAccount = accounts[0] ?? null;
+    pca.init().then(() => pca.getAccounts()).then(async accounts => {
+      let restoredAccount = accounts[0] ?? null;
+      if (restoredAccount) {
+        try {
+          await validateRequiredScopes(pca, restoredAccount, effectiveRequiredScopes);
+        } catch (tokenError) {
+          await pca.signOut({
+            account: restoredAccount
+          }).catch(() => undefined);
+          restoredAccount = null;
+          setError(new Error('Your session has expired. Sign in again to continue.'));
+          (0, _logger.debugWarn)('[AuthProvider] restored account is missing a required token:', tokenError);
+        }
+      }
       setAccount(restoredAccount);
       if (restoredAccount) {
         (0, _index.getAppLogger)().identifyUser({
@@ -154,7 +207,7 @@ function AuthProvider({
     });
     // Re-initialize only when the effective broker/identity settings change.
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [effectiveClientId, effectiveTenantId, effectiveRedirectUri, useBroker]);
+  }, [effectiveClientId, effectiveTenantId, effectiveRedirectUri, requiredScopeKey, useBroker]);
   const signIn = (0, _react.useCallback)(async () => {
     const pca = pcaRef.current;
     if (!pca) return;
@@ -168,13 +221,11 @@ function AuthProvider({
       if (!pca.isInitialized) {
         await pca.init();
       }
-      const result = await pca.acquireToken({
-        scopes: SIGN_IN_SCOPES
-      });
-      setAccount(result.account);
+      const signedInAccount = await acquireRequiredScopesInteractively(pca, effectiveRequiredScopes);
+      setAccount(signedInAccount);
       (0, _index.getAppLogger)().identifyUser({
-        objectId: result.account.identifier,
-        tenantId: result.account.tenantId
+        objectId: signedInAccount.identifier,
+        tenantId: signedInAccount.tenantId
       });
       // Register the signed-in account with Intune MAM so the SDK can apply
       // app protection policies (PIN, wipe, copy-paste restriction, etc.).
@@ -183,9 +234,9 @@ function AuthProvider({
       if (intuneEnabled) {
         try {
           await (0, _powerAppsNativeAuth.registerAndEnrollAccount)({
-            upn: result.account.username,
-            aadId: result.account.identifier,
-            tenantId: result.account.tenantId
+            upn: signedInAccount.username,
+            aadId: signedInAccount.identifier,
+            tenantId: signedInAccount.tenantId
           });
           (0, _index.getAppLogger)().trackActivityEvent(_index.HostOperationNames.AuthIntuneEnroll);
         } catch (intuneErr) {
@@ -206,7 +257,7 @@ function AuthProvider({
     } finally {
       setIsLoading(false);
     }
-  }, [intuneEnabled, useBroker]);
+  }, [intuneEnabled, requiredScopeKey, useBroker]);
   const acquireToken = (0, _react.useCallback)(async scopes => {
     const pca = pcaRef.current;
     if (!pca || !account) return null;
@@ -217,18 +268,23 @@ function AuthProvider({
       });
       return result.accessToken;
     } catch (e) {
-      // Silent acquisition failed — do NOT fall back to interactive here.
-      // Interactive sign-in is handled exclusively by signIn(). Falling back
-      // to interactive from acquireToken triggers an unexpected login webview
-      // whenever a connector needs a token the cache doesn't hold yet.
       (0, _logger.debugWarn)('[AuthContext] acquireTokenSilent failed for scopes:', scopes, e);
       (0, _index.getAppLogger)().trackErrorEvent(_index.HostOperationNames.AuthAcquireTokenSilentFailed, {
         scopeCount: scopes.length,
         errorName: getSafeErrorName(e)
       });
+      if (scopes.some(scope => effectiveRequiredScopes.includes(scope))) {
+        await pca.signOut({
+          account
+        }).catch(signOutError => {
+          (0, _logger.debugWarn)('[AuthContext] failed to clear an invalid session:', signOutError);
+        });
+        setError(new Error('Your session has expired. Sign in again to continue.'));
+        setAccount(null);
+      }
       return null;
     }
-  }, [account]);
+  }, [account, requiredScopeKey]);
   const signOut = (0, _react.useCallback)(async () => {
     const pca = pcaRef.current;
     if (!pca || !account) return;

package/lib/commonjs/bridge/NativePowerAppsBridge.js

@@ -7,7 +7,9 @@ exports.NativePowerAppsBridge = void 0;
 exports.buildConnectionReferences = buildConnectionReferences;
 var _logger = require("../logger.js");
 var _index = require("../telemetry/index.js");
+var _http = require("@microsoft/power-apps-native-common/http");
 var _powerAppsNativeCommon = require("@microsoft/power-apps-native-common");
+var _bridgeState = require("./bridgeState.js");
 /*!
  * power-apps-native-host — NativePowerAppsBridge
  *
@@ -120,7 +122,7 @@ class NativePowerAppsBridge {
    * via globalThis would have no effect — mutating options is the correct path.
    */
   updateOptions(options) {
-    this._options = options;
+    this._options = (0, _bridgeState.updateBridgeOptionsInPlace)(this._options, options);
   }
   async initialize() {
     // No handshake required for the native path.
@@ -203,10 +205,6 @@ class NativePowerAppsBridge {
       method
     } = requestConfig;
     const urlLabel = (0, _powerAppsNativeCommon.sanitizeUrl)(url.replace(/^https?:\/\/[^/]+/, '').slice(0, 100));
-    const scenario = (0, _index.getAppLogger)().trackScenario(_index.HostOperationNames.BridgeHttpRequest, {
-      httpMethod: method,
-      url: urlLabel
-    });
     const isBlob = bodyParam instanceof Blob;
 
     // The SDK builds Authorization headers with the "paauth" scheme (its web-player
@@ -231,11 +229,12 @@ class NativePowerAppsBridge {
       // SDK passed a plain object — JSON-stringify it as a fallback
       bodyInit = JSON.stringify(bodyParam);
     }
+    bodyInit = (0, _bridgeState.getRequestBodyForMethod)(method, bodyInit);
     headers = normalizeJsonBodyHeaders(headers, bodyInit);
     (0, _logger.debugLog)(`[bridge] → ${method} ${urlLabel}`);
     let response;
     try {
-      response = await fetch(url, {
+      response = await _index.bridgeHttpClient.request(url, {
         method,
         headers: headers,
         body: bodyInit
@@ -243,9 +242,6 @@ class NativePowerAppsBridge {
     } catch (fetchErr) {
       (0, _logger.debugWarn)(`[bridge] fetch THREW for ${method} ${urlLabel}:`, fetchErr);
       (0, _logger.debugLog)(`[bridge] fetch THREW for ${method} ${urlLabel} | req body: ${typeof bodyInit === 'string' ? bodyInit.slice(0, 500) : bodyInit != null ? '<non-string body>' : '<no body>'}`);
-      scenario.fail(undefined, {
-        errorName: getSafeErrorName(fetchErr)
-      });
       throw fetchErr;
     }
     const responseHeaders = {};
@@ -257,14 +253,17 @@ class NativePowerAppsBridge {
       responseHeaders[sdkKey] = value;
     });
     (0, _logger.debugLog)(`[bridge] ${method} ${urlLabel} → ${response.status}`);
+    const correlationProperties = (0, _http.getHttpCorrelationProperties)(response.headers);
     let buffer;
     try {
       buffer = await response.arrayBuffer();
     } catch (readErr) {
       (0, _logger.debugWarn)(`[bridge] HTTP ${response.status} for ${method} ${urlLabel} | failed to read response body:`, readErr);
-      scenario.fail(undefined, {
+      (0, _index.getAppLogger)().trackErrorEvent(_index.HostOperationNames.BridgeHttpRequest, {
+        phase: 'readResponseBody',
         errorName: getSafeErrorName(readErr),
-        httpStatus: response.status
+        httpStatus: response.status,
+        ...correlationProperties
       });
       throw readErr;
     }
@@ -272,14 +271,8 @@ class NativePowerAppsBridge {
       const bodyText = new TextDecoder().decode(buffer).slice(0, 1000);
       (0, _logger.debugWarn)(`[bridge] HTTP ${response.status} for ${method} ${urlLabel} | res: ${bodyText}`);
       (0, _logger.debugLog)(`[bridge] HTTP ${response.status} for ${method} ${urlLabel} | req: ${typeof bodyInit === 'string' ? bodyInit.slice(0, 500) : bodyInit != null ? '<non-string body>' : '<no body>'} | res: ${bodyText}`);
-      scenario.completeWithError({
-        httpStatus: response.status
-      });
-    } else {
-      scenario.complete({
-        httpStatus: response.status
-      });
     }
+    (0, _bridgeState.assertSuccessfulHttpStatus)(response.status, method);
     return [{
       status: response.status,
       headers: responseHeaders

package/lib/commonjs/bridge/PowerPagesBridge.js

@@ -5,6 +5,8 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.PowerPagesBridge = void 0;
 exports.setupPowerPagesHost = setupPowerPagesHost;
+var _index = require("../telemetry/index.js");
+var _http = require("@microsoft/power-apps-native-common/http");
 function toPowerPagesUrl(url) {
   const parsedUrl = new URL(url, window.location.origin);
   if (parsedUrl.origin === window.location.origin && parsedUrl.pathname.startsWith('/_api/')) {
@@ -29,7 +31,7 @@ function toPowerPagesUrl(url) {
 let requestVerificationTokenPromise;
 function getRequestVerificationToken() {
   requestVerificationTokenPromise ??= (async () => {
-    const response = await fetch('/_layout/tokenhtml', {
+    const response = await _index.bridgeHttpClient.request('/_layout/tokenhtml', {
       credentials: 'same-origin'
     });
     if (!response.ok) {
@@ -99,17 +101,34 @@ class PowerPagesBridge {
     const body = params[1];
     const powerPagesUrl = toPowerPagesUrl(request.url);
     const token = await getRequestVerificationToken();
-    const response = await fetch(powerPagesUrl, {
-      method: request.method,
-      headers: createHeaders(request.headers, token),
-      body: body || undefined,
-      credentials: 'same-origin'
-    });
+    let response;
+    try {
+      response = await _index.bridgeHttpClient.request(powerPagesUrl, {
+        method: request.method,
+        headers: createHeaders(request.headers, token),
+        body: body || undefined,
+        credentials: 'same-origin'
+      });
+    } catch (error) {
+      throw error;
+    }
+    const correlationProperties = (0, _http.getHttpCorrelationProperties)(response.headers);
     const responseHeaders = {};
     response.headers.forEach((value, name) => {
       responseHeaders[name === 'content-type' ? 'Content-Type' : name] = value;
     });
-    const responseBody = await response.arrayBuffer();
+    let responseBody;
+    try {
+      responseBody = await response.arrayBuffer();
+    } catch (error) {
+      (0, _index.getAppLogger)().trackErrorEvent(_index.HostOperationNames.BridgeHttpRequest, {
+        phase: 'readResponseBody',
+        errorName: error instanceof Error ? error.constructor.name : typeof error,
+        httpStatus: response.status,
+        ...correlationProperties
+      });
+      throw error;
+    }
     if (!response.ok) {
       const responseText = new TextDecoder().decode(responseBody).slice(0, 1000);
       const detail = responseText ? `: ${responseText}` : '';

package/lib/commonjs/bridge/bridgeState.js

@@ -0,0 +1,40 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.assertSuccessfulHttpStatus = assertSuccessfulHttpStatus;
+exports.getRequestBodyForMethod = getRequestBodyForMethod;
+exports.updateBridgeOptionsInPlace = updateBridgeOptionsInPlace;
+function getRequestBodyForMethod(method, body) {
+  const normalizedMethod = method.toUpperCase();
+  return normalizedMethod === 'GET' || normalizedMethod === 'HEAD' ? null : body;
+}
+function assertSuccessfulHttpStatus(status, method) {
+  if (status >= 200 && status < 300) return;
+  throw new Error(`HTTP ${status} for ${method.toUpperCase()} request`);
+}
+function updateBridgeOptionsInPlace(current, next) {
+  const connections = current.connections;
+  for (const key of Object.keys(connections)) {
+    if (!(key in next.connections)) delete connections[key];
+  }
+  for (const [key, nextConnection] of Object.entries(next.connections)) {
+    const currentConnection = connections[key];
+    if (currentConnection) {
+      for (const property of Object.keys(currentConnection)) {
+        delete currentConnection[property];
+      }
+      Object.assign(currentConnection, nextConnection);
+    } else {
+      connections[key] = nextConnection;
+    }
+  }
+  const dataSources = current.dataSources;
+  dataSources.splice(0, dataSources.length, ...next.dataSources);
+  return {
+    ...next,
+    connections,
+    dataSources
+  };
+}