@microsoft/power-apps-native-host 0.2.25 → 0.3.3

package/lib/module/platform/GlobalDiscovery.js

@@ -0,0 +1,45 @@
+"use strict";
+
+const GLOBAL_DISCOVERY_HOST = {
+  prod: 'globaldisco.crm.dynamics.com',
+  gcc: 'globaldisco.crm9.dynamics.com',
+  usg: 'globaldisco.crm.microsoftdynamics.us',
+  dod: 'globaldisco.crm.appsplatform.us',
+  china: 'globaldisco.crm.dynamics.cn'
+};
+const REGION_DISCOVERY_CLOUD = {
+  dev: 'prod',
+  test: 'prod',
+  preprod: 'prod',
+  preview: 'prod',
+  firstrelease: 'prod',
+  prod: 'prod',
+  gccmoderate: 'gcc',
+  gov: 'gcc',
+  gcchigh: 'usg',
+  high: 'usg',
+  dod: 'dod',
+  mooncake: 'china'
+};
+const ENVIRONMENT_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+export function globalDiscoveryEndpoint(region) {
+  const cloud = REGION_DISCOVERY_CLOUD[region];
+  if (!cloud) {
+    throw new Error(`Dataverse Global Discovery is not available for Power Platform region "${region}"`);
+  }
+  return `https://${GLOBAL_DISCOVERY_HOST[cloud]}`;
+}
+export function globalDiscoveryScope(region) {
+  return `${globalDiscoveryEndpoint(region)}/user_impersonation`;
+}
+export function buildGlobalDiscoveryUrl(environmentId, region) {
+  if (!ENVIRONMENT_ID_PATTERN.test(environmentId)) {
+    throw new Error(`Invalid Power Platform environment ID: "${environmentId}"`);
+  }
+  const normalizedEnvironmentId = environmentId.toLowerCase();
+  const query = new URLSearchParams({
+    '$select': 'ApiUrl,EnvironmentId',
+    '$filter': `EnvironmentId eq '${normalizedEnvironmentId}'`
+  });
+  return `${globalDiscoveryEndpoint(region)}/api/discovery/v2.0/Instances?${query.toString()}`;
+}

package/lib/module/platform/PowerPlatformEnvironmentApi.js

@@ -3,14 +3,7 @@
 /*!
  * power-apps-native-host — PowerPlatformEnvironmentApi
  *
- * Mirrors the Host SDK's DefaultAppMetadataProvider.fetchAppMetadataFromPowerConfig
- * pattern: resolves the Power Platform environment-scoped API endpoint from the
- * environment GUID and region, then fetches linkedEnvironmentMetadata to obtain
- * the Dataverse instanceUrl.
- *
- * Reference (Host SDK):
- *   packages/power-apps-host/src/providers/defaults/DefaultAppMetadataProvider.ts
- *   packages/power-apps-common/src/services/PowerPlatformApiDiscovery.ts
+ * Resolves Power Platform RP endpoints and scopes.
  */
 
 // ---------------------------------------------------------------------------
@@ -69,10 +62,6 @@ export function buildEnvironmentEndpoint(environmentId, region) {
   return `https://${hexPrefix}.${hexSuffix}.environment.${hostNameSuffix}`;
 }
 
-// ---------------------------------------------------------------------------
-// Public API
-// ---------------------------------------------------------------------------
-
 /**
  * Token scope for the Power Platform management API (prod cluster).
  * Non-prod clusters (test, gov, high, dev, mooncake, etc.) host the management
@@ -90,97 +79,9 @@ export function powerPlatformScope(region) {
   const host = HOST_NAME_SUFFIX[region] ?? HOST_NAME_SUFFIX['prod'];
   return `https://${host}/.default`;
 }
-import { getAppLogger, HostOperationNames } from "../telemetry/index.js";
-function getSafeErrorName(error) {
-  return error instanceof Error ? error.constructor.name : typeof error;
-}
 
-/**
- * Fetch the Dataverse instanceUrl for a Power Platform environment by calling
- * the environment-scoped Power Platform management API — the same call that
- * the Host SDK's DefaultAppMetadataProvider makes to populate
- * `databaseReferences[*].databaseDetails.linkedEnvironmentMetadata`.
- *
- * @param environmentId - Environment GUID (from power.config.json `environmentId`).
- * @param region        - Cluster region string (from power.config.json `region`, default "prod").
- * @param acquireToken  - Callback to obtain a bearer token for the given scopes.
- *                        Scope will be {@link powerPlatformScope}`(region)`.
- * @param bearerToken   - Optional pre-fetched bearer token for {@link powerPlatformScope}`(region)`.
- *                        Pass this to avoid a redundant `acquireToken` round-trip when the
- *                        caller has already obtained a token for the same audience.
- * @returns The Dataverse org URL (e.g. "https://org12345.crm.dynamics.com"), or
- *          `undefined` if the environment has no linked CDS database.
- */
-export async function fetchInstanceUrl(environmentId, region, acquireToken, bearerToken) {
-  const scenario = getAppLogger().trackScenario(HostOperationNames.PlatformFetchInstanceUrl, {
-    environmentId,
-    region
-  });
-  try {
-    const baseUrl = buildEnvironmentEndpoint(environmentId, region);
-    const url = `${baseUrl}/powerapps/environment?api-version=1&%24filter=name+eq+%27${encodeURIComponent(environmentId)}%27`;
-    const token = bearerToken ?? (await acquireToken([powerPlatformScope(region)]));
-    if (!token) {
-      throw new Error('fetchInstanceUrl: failed to acquire Power Platform API token');
-    }
-    const response = await fetch(url, {
-      method: 'GET',
-      headers: {
-        Authorization: `Bearer ${token}`,
-        'Content-Type': 'application/json'
-      }
-    });
-    if (!response.ok) {
-      throw new Error(`fetchInstanceUrl: environment API returned ${response.status} ${response.statusText}`);
-    }
-    const env = await response.json();
-    const instanceUrl = env.properties?.linkedEnvironmentMetadata?.instanceUrl;
-    scenario.complete({
-      hasInstanceUrl: instanceUrl !== undefined
-    });
-    return instanceUrl;
-  } catch (e) {
-    scenario.fail(undefined, {
-      errorName: getSafeErrorName(e)
-    });
-    throw e;
-  }
-}
-
-// ---------------------------------------------------------------------------
-// buildCdsDataSources
-// ---------------------------------------------------------------------------
-
-/**
- * Shape of a single Dataverse table entry inside power.config.json
- * `databaseReferences[*].dataSources[*]`.
- */
-
-/**
- * Shape of a single database reference entry inside power.config.json
- * `databaseReferences`.
- */
-
-/**
- * Build the CDS data source config array that the SDK reads via
- * AppPowerAppsClientPlugin.getAppCdsDataSourceConfigsAsync.
- *
- * Pass the resolved Dataverse org URL (from useConnectionRefs) and the
- * databaseReferences map from power.config.json.  The resulting array is
- * passed directly to <PowerAppsHostProvider dataSources={...} />.
- *
- * @param databaseReferences - The `databaseReferences` map from power.config.json.
- * @param dataverseOrgUrl    - The resolved Dataverse org URL
- *                             (connectionRefs['commondataserviceforapps']?.datasetName).
- *                             Pass an empty string before the org URL is known;
- *                             the host provider will receive empty runtimeUrl entries
- *                             and the SDK will not attempt Dataverse calls.
- */
-export function buildCdsDataSources(databaseReferences, dataverseOrgUrl) {
-  return Object.values(databaseReferences).flatMap(dbRef => Object.values(dbRef.dataSources ?? {}).map(ds => ({
-    runtimeUrl: dataverseOrgUrl ? `${dataverseOrgUrl}/api/data/v9.0/` : '',
-    entitySetName: ds.entitySetName ?? '',
-    logicalName: ds.logicalName ?? '',
-    version: '9.2'
-  })));
+/** Delegated permission required by the connection user-consent endpoint. */
+export function connectionUserConsentScope(region) {
+  const host = HOST_NAME_SUFFIX[region] ?? HOST_NAME_SUFFIX['prod'];
+  return `https://${host}/Connectivity.Connections.UserConsent`;
 }

package/lib/module/provider/PowerAppsHostProvider.js

@@ -30,20 +30,26 @@
  */
 
 import React, { useEffect, useLayoutEffect, useRef, useState, useCallback, useMemo } from 'react';
-import { ActivityIndicator, View } from 'react-native';
+import { ActivityIndicator, Text, TouchableOpacity, View } from 'react-native';
 import { SafeAreaProvider } from 'react-native-safe-area-context';
 import { setupNativeHost } from "../bridge/setupNativeHost.js";
 import { buildConnectionReferences } from "../bridge/NativePowerAppsBridge.js";
-import { useConnectionRefs } from "../platform/useConnectionRefs.js";
-import { buildCdsDataSources } from "../platform/PowerPlatformEnvironmentApi.js";
+import { useConnectionRefs } from "../connections/useConnectionRefs.js";
+import { buildCdsDataSources, hasDataverseDatabaseReferences } from "../platform/DataverseDataSources.js";
+import { powerPlatformScope } from "../platform/PowerPlatformEnvironmentApi.js";
 import { ConnectionSetupScreen } from "../connections/ConnectionSetupScreen.js";
+import { buildConnectionResolutionKey } from "../connections/types.js";
+import { postConnectionUsage, reportScopeConsents } from "../connections/PowerPlatformConnectionApi.js";
+import { shouldPersistConnectionUsages, shouldShowConnectionReview } from "../connections/connectionState.js";
+import { isDevPlayer } from "../utils/isDevPlayer.js";
 import { debugLog } from "../logger.js";
 import { getAppLogger, HostOperationNames } from "../telemetry/index.js";
 
 // Entra ID token scope for the APIM connector proxy (API Hub).
-import { jsx as _jsx, Fragment as _Fragment } from "react/jsx-runtime";
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 const CONNECTOR_SCOPE = 'https://apihub.azure.com/.default';
 const EMPTY_DATABASE_REFERENCES = {};
+const EMPTY_CONNECTION_REFERENCES = {};
 /**
  * Initialises the NativePowerAppsBridge and manages the full pre-launch
  * pipeline — connection resolution, disambiguation, and creation — before
@@ -54,6 +60,7 @@ const EMPTY_DATABASE_REFERENCES = {};
 export function PowerAppsHostProvider({
   acquireToken,
   isSignedIn,
+  onSignOut,
   appId,
   environmentId,
   region = 'prod',
@@ -63,18 +70,75 @@ export function PowerAppsHostProvider({
   renderOAuthWebView,
   isvClientId,
   onDisambiguationNeeded,
+  onConnectionConsent,
+  onResourceConsent,
+  onConnectionConsentDeclined,
   children
 }) {
   // Extra refs produced by ConnectionSetupScreen for newly-created connections.
   const [extraConnectionRefs, setExtraConnectionRefs] = useState({});
-
-  // setupDone is derived — true as soon as extraConnectionRefs is populated.
-  const setupDone = Object.keys(extraConnectionRefs).length > 0;
+  const [consentApproved, setConsentApproved] = useState(false);
+  const setupDone = consentApproved;
+  const renderConnectionError = (title, messages, useNeutralText = false) => /*#__PURE__*/_jsxs(View, {
+    style: {
+      flex: 1,
+      padding: 24,
+      justifyContent: 'center',
+      backgroundColor: '#F8F8F8'
+    },
+    children: [/*#__PURE__*/_jsx(Text, {
+      style: {
+        fontSize: 20,
+        fontWeight: '700',
+        color: '#1A1A1A',
+        marginBottom: 12
+      },
+      children: title
+    }), messages.map(message => /*#__PURE__*/_jsx(Text, {
+      style: {
+        fontSize: 14,
+        color: useNeutralText ? '#323130' : '#C4262E',
+        lineHeight: 20,
+        marginBottom: 8
+      },
+      children: message
+    }, message)), isSignedIn && onSignOut ? /*#__PURE__*/_jsx(TouchableOpacity, {
+      accessibilityRole: "button",
+      onPress: () => {
+        void onSignOut();
+      },
+      style: {
+        alignSelf: 'flex-start',
+        backgroundColor: '#0F6CBD',
+        paddingHorizontal: 20,
+        paddingVertical: 12,
+        borderRadius: 4,
+        marginTop: 12
+      },
+      children: /*#__PURE__*/_jsx(Text, {
+        style: {
+          color: '#FFFFFF',
+          fontSize: 15,
+          fontWeight: '600'
+        },
+        children: "Sign out"
+      })
+    }) : null]
+  });
   const {
     connectionRefs,
     isReady,
+    error: connectionError,
+    errorKind: connectionErrorKind,
     missingConnectors,
-    dataverseOrgUrl
+    missingConnectionReferences,
+    connectionRequirements,
+    resourceConsents: launchResourceConsents,
+    configurationErrors,
+    requiresConnectionConsent,
+    resolvedConfigKey,
+    dataverseOrgUrl,
+    databaseReferences: resolvedDatabaseReferences
   } = useConnectionRefs({
     isSignedIn,
     acquireToken,
@@ -82,6 +146,7 @@ export function PowerAppsHostProvider({
     environmentId,
     region,
     connectionReferences,
+    hasDataverse: hasDataverseDatabaseReferences(databaseReferences),
     schemaMap,
     onDisambiguationNeeded,
     isvClientId
@@ -92,39 +157,43 @@ export function PowerAppsHostProvider({
     if (!isSignedIn) {
       debugLog('[PAHost] user signed out — resetting bridge state');
       setExtraConnectionRefs({});
+      setConsentApproved(false);
     }
   }, [isSignedIn]);
+  useEffect(() => {
+    setExtraConnectionRefs({});
+    setConsentApproved(false);
+  }, [appId, environmentId, connectionReferences]);
 
   // Merge hook refs with anything the setup screen created.
   const mergedRefs = useMemo(() => ({
     ...connectionRefs,
     ...extraConnectionRefs
   }), [connectionRefs, extraConnectionRefs]);
-  const staticConnectionRefs = useMemo(() => buildConnectionReferences(connectionReferences), [connectionReferences]);
+  const staticConnectionRefs = useMemo(() => isDevPlayer ? buildConnectionReferences(connectionReferences) : EMPTY_CONNECTION_REFERENCES, [connectionReferences, isDevPlayer]);
 
   // dataverseOrgUrl comes directly from useConnectionRefs (fetched from the
   // environment metadata regardless of whether a commondataserviceforapps
   // connection reference is configured).  This allows Dataverse calls to work
   // even when there is no explicit Dataverse connection in connectionReferences.
-  const cdsDataSources = useMemo(() => buildCdsDataSources(databaseReferences ?? EMPTY_DATABASE_REFERENCES, dataverseOrgUrl), [databaseReferences, dataverseOrgUrl]);
+  const cdsDataSources = useMemo(() => buildCdsDataSources(isDevPlayer ? databaseReferences ?? EMPTY_DATABASE_REFERENCES : resolvedDatabaseReferences, dataverseOrgUrl), [databaseReferences, resolvedDatabaseReferences, dataverseOrgUrl, isDevPlayer]);
 
   // Build the missing-connector entries for ConnectionSetupScreen.
-  const missingEntries = useMemo(() => missingConnectors.map(apiId => {
-    const localRefId = Object.keys(connectionReferences).find(k => connectionReferences[k].id === apiId) ?? apiId;
-    return {
-      apiId,
-      localRefId
-    };
-  }), [missingConnectors, connectionReferences]);
+  const missingEntries = useMemo(() => missingConnectionReferences, [missingConnectionReferences]);
+  const resourceConsents = useMemo(() => [...new Map(launchResourceConsents.map(resource => [resource.resourceId.toLowerCase(), resource])).values()], [launchResourceConsents]);
+  const currentConfigKey = useMemo(() => buildConnectionResolutionKey(appId, environmentId, isDevPlayer ? connectionReferences : {}), [appId, environmentId, connectionReferences, isDevPlayer]);
+  const resolutionMatchesCurrentConfig = resolvedConfigKey === currentConfigKey;
+  const needsConsent = shouldShowConnectionReview(isDevPlayer, requiresConnectionConsent, resourceConsents.length > 0);
 
   // Called by ConnectionSetupScreen once every missing connector is resolved.
-  const handleSetupComplete = useCallback(resolvedIds => {
+  const handleSetupComplete = useCallback(async resolvedIds => {
     const refs = {};
-    for (const [apiId, connectionId] of Object.entries(resolvedIds)) {
-      const localRefId = Object.keys(connectionReferences).find(k => connectionReferences[k].id === apiId);
-      if (!localRefId) continue;
-      const dataSources = connectionReferences[localRefId].dataSources;
-      const runtimeUrl = dataSources.map(ds => schemaMap[ds]?.properties?.primaryRuntimeUrl).find(Boolean) ?? '';
+    for (const [localRefId, connectionId] of Object.entries(resolvedIds)) {
+      const requirement = connectionRequirements.find(item => item.localRefId === localRefId);
+      if (!requirement) continue;
+      const apiId = requirement.apiId;
+      const dataSources = requirement.dataSources;
+      const runtimeUrl = dataSources.map(ds => connectionRefsRef.current[ds]?.runtimeUrl ?? (isDevPlayer ? schemaMap[ds]?.properties?.primaryRuntimeUrl : undefined)).find(Boolean) ?? '';
       for (const ds of dataSources) {
         refs[ds] = {
           apiId,
@@ -138,7 +207,44 @@ export function PowerAppsHostProvider({
       }
     }
     setExtraConnectionRefs(refs);
-  }, [connectionReferences, schemaMap]);
+    const mergedForConsent = {
+      ...connectionRefsRef.current,
+      ...refs
+    };
+    const usages = connectionRequirements.map(requirement => ({
+      localRefId: requirement.localRefId,
+      apiId: requirement.apiId,
+      connectionId: requirement.dataSources.map(dataSource => mergedForConsent[dataSource]?.connectionName).find(Boolean) ?? '',
+      dataSources: requirement.dataSources,
+      appActions: requirement.appActions ?? [],
+      apiScopes: requirement.apiScopes
+    }));
+    if (usages.some(usage => !usage.connectionId)) {
+      throw new Error('Not all required connections have been resolved.');
+    }
+    if (!isDevPlayer && resourceConsents.length > 0 && !onResourceConsent) {
+      throw new Error('Protected resource consent requires an onResourceConsent persistence callback.');
+    }
+    const shouldPersistUsages = shouldPersistConnectionUsages(isDevPlayer, appId);
+    if (shouldPersistUsages && appId && usages.length > 0) {
+      const token = await acquireToken([powerPlatformScope(region)]);
+      if (!token) throw new Error('Unable to acquire a token to register connection usage.');
+      await Promise.all(usages.map(usage => postConnectionUsage(appId, usage, environmentId, region, token)));
+      await reportScopeConsents(appId, usages, environmentId, region, token);
+    }
+    if (!isDevPlayer) {
+      await onConnectionConsent?.(usages);
+      await onResourceConsent?.(resourceConsents);
+    }
+    setConsentApproved(true);
+  }, [acquireToken, appId, environmentId, region, schemaMap, connectionRequirements, onConnectionConsent, onResourceConsent, resourceConsents, isDevPlayer]);
+  const consentDetails = useMemo(() => connectionRequirements.map(requirement => ({
+    localRefId: requirement.localRefId,
+    connectorId: requirement.connectorId,
+    displayName: requirement.displayName ?? requirement.connectorId.replace(/^shared_/, ''),
+    description: `Uses ${requirement.dataSources.join(', ')}`,
+    appActions: requirement.appActions ?? []
+  })), [connectionRequirements]);
 
   // ---- Bridge wiring ----
 
@@ -150,7 +256,7 @@ export function PowerAppsHostProvider({
   connectionRefsRef.current = connectionRefs;
   const configuredBridgeInputsRef = useRef(undefined);
   const [, setBridgeRegistrationVersion] = useState(0);
-  const hasResolvedConnections = isSignedIn && isReady && (missingConnectors.length === 0 || setupDone);
+  const hasResolvedConnections = isSignedIn && isReady && resolutionMatchesCurrentConfig && (missingConnectors.length === 0 || consentApproved) && (!needsConsent || consentApproved);
   const isBridgeConfiguredFor = (connections, dataSources) => {
     const currentInputs = configuredBridgeInputsRef.current;
     return currentInputs?.connections === connections && currentInputs.dataSources === dataSources;
@@ -250,13 +356,34 @@ export function PowerAppsHostProvider({
     }
   }, [isSignedIn, isReady]);
   useEffect(() => {
-    if (isSignedIn && isReady && missingConnectors.length > 0 && !setupDone) {
+    if (isSignedIn && isReady && (missingConnectors.length > 0 || needsConsent) && !setupDone) {
       debugLog(`[PAHost] render: showing ConnectionSetupScreen for ${missingConnectors.length} missing connector(s):`, missingConnectors.join(', '));
     }
-  }, [isSignedIn, isReady, missingConnectors, setupDone]);
+  }, [isSignedIn, isReady, missingConnectors, needsConsent, setupDone]);
 
   // ---- Render ----
 
+  if (connectionError) {
+    const accessDenied = connectionErrorKind === 'app-access-denied';
+    return renderConnectionError(accessDenied ? 'You don’t have access' : 'Unable to load app', [connectionError], accessDenied);
+  }
+  if (configurationErrors.length > 0) {
+    return renderConnectionError('Connection configuration error', configurationErrors);
+  }
+  if (isSignedIn && !resolutionMatchesCurrentConfig) {
+    return /*#__PURE__*/_jsx(View, {
+      style: {
+        flex: 1,
+        alignItems: 'center',
+        justifyContent: 'center',
+        backgroundColor: '#F8F8F8'
+      },
+      children: /*#__PURE__*/_jsx(ActivityIndicator, {
+        size: "large"
+      })
+    });
+  }
+
   // First mount: register the native bridge with static manifest refs before
   // any route children can mount and call into @microsoft/power-apps.
   if (!staticBridgeRegistered && !hasResolvedConnections) {
@@ -292,7 +419,7 @@ export function PowerAppsHostProvider({
   // Wrapped in SafeAreaProvider so useSafeAreaInsets() works even when the
   // consuming app hasn't mounted its own SafeAreaProvider yet.  Nesting is
   // safe — react-native-safe-area-context treats inner providers as no-ops.
-  if (isSignedIn && isReady && missingConnectors.length > 0 && !setupDone) {
+  if (isSignedIn && isReady && (missingConnectors.length > 0 || needsConsent) && !setupDone) {
     return /*#__PURE__*/_jsx(SafeAreaProvider, {
       children: /*#__PURE__*/_jsx(ConnectionSetupScreen, {
         missingConnectors: missingEntries,
@@ -300,8 +427,13 @@ export function PowerAppsHostProvider({
         environmentId: environmentId,
         region: region,
         acquireToken: acquireToken,
+        onSignOut: isSignedIn ? onSignOut : undefined,
         isvClientId: isvClientId,
         onAllConnected: handleSetupComplete,
+        consentDetails: consentDetails,
+        resourceConsents: resourceConsents,
+        onConsentDeclined: onConnectionConsentDeclined,
+        showReview: !isDevPlayer,
         renderOAuthWebView: renderOAuthWebView
         // No onSkip — connections are required.
       })