@microsoft/power-apps-native-host 0.4.0 → 0.5.1

package/lib/module/auth/AuthContext.js

@@ -21,6 +21,7 @@ import { Platform } from 'react-native';
 import { PublicClientApplication, registerAndEnrollAccount, deRegisterAndUnenrollAccount, computeMsalRedirectUri, getWrapConfig } from '@microsoft/power-apps-native-auth';
 import { getAppLogger, HostOperationNames } from "../telemetry/index.js";
 import { debugLog, debugWarn } from "../logger.js";
+import { authorizeRequiredScopes } from "./targetAuthorization.js";
 
 // The Power Platform API (api.powerplatform.com) exposes its own scopes, not raw
 // OIDC scopes. Requesting 'openid'/'profile' alone causes AAD to decline.
@@ -28,25 +29,19 @@ import { debugLog, debugWarn } from "../logger.js";
 // implicitly includes openid + profile + offline_access for the sign-in flow.
 import { jsx as _jsx } from "react/jsx-runtime";
 const SIGN_IN_SCOPES = ['https://api.powerplatform.com/.default'];
+const AUTHENTICATION_ERROR_MESSAGE = 'We could not sign you in. Try again.';
 function getSafeErrorName(error) {
   return error instanceof Error ? error.constructor.name : typeof error;
 }
 function getErrorProperty(error, propertyName) {
   return error && typeof error === 'object' ? error[propertyName] : undefined;
 }
-function getSafeErrorMessage(error) {
-  if (error instanceof Error) return error.message;
-  return typeof error === 'string' ? error : String(error);
-}
 function getAuthErrorTelemetry(error) {
-  const errorMessage = getSafeErrorMessage(error);
-  const parsedNSError = /domain=([^\s]+) code=(-?\d+)/.exec(errorMessage);
   return {
     errorName: getSafeErrorName(error),
     errorCode: getErrorProperty(error, 'code'),
-    nativeErrorDomain: getErrorProperty(error, 'nativeErrorDomain') ?? parsedNSError?.[1],
-    nativeErrorCode: getErrorProperty(error, 'nativeErrorCode') ?? parsedNSError?.[2],
-    nativeErrorMessage: errorMessage.slice(0, 512)
+    nativeErrorDomain: getErrorProperty(error, 'nativeErrorDomain'),
+    nativeErrorCode: getErrorProperty(error, 'nativeErrorCode')
   };
 }
 function getAuthTelemetryProperties(useBroker, useEmbeddedWebView) {
@@ -60,6 +55,14 @@ function getAuthTelemetryProperties(useBroker, useEmbeddedWebView) {
 function accountsMatch(left, right) {
   return left.identifier === right.identifier && left.tenantId === right.tenantId;
 }
+function normalizeTenantId(tenantId) {
+  return tenantId.trim().toLowerCase();
+}
+function assertExpectedTenant(account, expectedTenantId) {
+  if (expectedTenantId && normalizeTenantId(account.tenantId) !== normalizeTenantId(expectedTenantId)) {
+    throw new Error('The signed-in account is not available in the selected environment tenant.');
+  }
+}
 async function validateRequiredScopes(pca, account, scopes) {
   for (const scope of scopes) {
     await pca.acquireTokenSilent({
@@ -68,13 +71,14 @@ async function validateRequiredScopes(pca, account, scopes) {
     });
   }
 }
-async function acquireRequiredScopesInteractively(pca, scopes) {
+async function acquireRequiredScopesInteractively(pca, scopes, expectedTenantId) {
   const [primaryScope, ...additionalScopes] = scopes;
   const primaryResult = await pca.acquireToken({
     scopes: [primaryScope],
     prompt: 'select_account'
   });
   const signedInAccount = primaryResult.account;
+  assertExpectedTenant(signedInAccount, expectedTenantId);
   for (const scope of additionalScopes) {
     try {
       await pca.acquireTokenSilent({
@@ -90,6 +94,7 @@ async function acquireRequiredScopesInteractively(pca, scopes) {
       if (!accountsMatch(signedInAccount, result.account)) {
         throw new Error('Sign in with the same account for all required Power Platform permissions.');
       }
+      assertExpectedTenant(result.account, expectedTenantId);
     }
   }
   await validateRequiredScopes(pca, signedInAccount, scopes);
@@ -100,6 +105,10 @@ export function AuthProvider({
   msalConfig,
   intuneConfig,
   requiredScopes = [],
+  expectedTenantId,
+  authorityTenant,
+  preferredAccountIdentifier,
+  autoAuthorizeMissingScopes = false,
   children
 }) {
   const [isAuthReady, setIsAuthReady] = useState(false);
@@ -142,6 +151,7 @@ export function AuthProvider({
       return msalConfig.tenantId;
     }
   })();
+  const effectiveAuthorityTenant = authorityTenant ?? effectiveTenantId;
 
   // When broker is off (Android dev/embedded-WebView mode) the msauth:// redirect
   // URI is not registered in AAD and will cause "multiple apps listening" errors
@@ -167,7 +177,12 @@ export function AuthProvider({
   const requiredScopeKey = [...new Set(requiredScopes)].join('|');
   const effectiveRequiredScopes = requiredScopeKey ? requiredScopeKey.split('|') : SIGN_IN_SCOPES;
   const pcaRef = useRef(null);
+  const accountRef = useRef(null);
+  accountRef.current = account;
+  const authGenerationRef = useRef(0);
   useEffect(() => {
+    const generation = ++authGenerationRef.current;
+    const isCurrent = () => authGenerationRef.current === generation;
     if (noAuthMode) {
       setIsAuthReady(true);
       setIsLoading(false);
@@ -176,7 +191,7 @@ export function AuthProvider({
     const pca = new PublicClientApplication({
       auth: {
         clientId: effectiveClientId,
-        authority: `https://login.microsoftonline.com/${effectiveTenantId}`,
+        authority: `https://login.microsoftonline.com/${effectiveAuthorityTenant}`,
         redirectUri: effectiveRedirectUri
       },
       useBroker,
@@ -190,19 +205,20 @@ export function AuthProvider({
     const authTelemetryProperties = getAuthTelemetryProperties(useBroker, useEmbeddedWebView);
     const authInitScenario = getAppLogger().trackScenario(HostOperationNames.AuthInit, authTelemetryProperties);
     pca.init().then(() => pca.getAccounts()).then(async accounts => {
-      let restoredAccount = accounts[0] ?? null;
+      if (!isCurrent()) return;
+      const matchesExpectedTenant = candidate => !expectedTenantId || normalizeTenantId(candidate.tenantId) === normalizeTenantId(expectedTenantId);
+      let restoredAccount = preferredAccountIdentifier ? accounts.find(candidate => candidate.identifier === preferredAccountIdentifier && matchesExpectedTenant(candidate)) ?? null : accounts.find(matchesExpectedTenant) ?? null;
       if (restoredAccount) {
         try {
-          await validateRequiredScopes(pca, restoredAccount, effectiveRequiredScopes);
+          restoredAccount = autoAuthorizeMissingScopes ? await authorizeRequiredScopes(pca, restoredAccount, effectiveRequiredScopes, expectedTenantId) : (await validateRequiredScopes(pca, restoredAccount, effectiveRequiredScopes), restoredAccount);
         } catch (tokenError) {
-          await pca.signOut({
-            account: restoredAccount
-          }).catch(() => undefined);
           restoredAccount = null;
+          if (!isCurrent()) return;
           setError(new Error('Your session has expired. Sign in again to continue.'));
           debugWarn('[AuthProvider] restored account is missing a required token:', tokenError);
         }
       }
+      if (!isCurrent()) return;
       setAccount(restoredAccount);
       if (restoredAccount) {
         getAppLogger().identifyUser({
@@ -216,15 +232,19 @@ export function AuthProvider({
         accountFound: accounts.length > 0
       });
     }).catch(e => {
+      if (!isCurrent()) return;
       debugLog('[AuthProvider] MSAL init failed:', e);
-      setError(e instanceof Error ? e : new Error(String(e)));
+      setError(new Error(AUTHENTICATION_ERROR_MESSAGE));
       setIsAuthReady(true);
       setIsLoading(false);
       authInitScenario.fail(undefined, getAuthErrorTelemetry(e));
     });
+    return () => {
+      if (isCurrent()) authGenerationRef.current += 1;
+    };
     // Re-initialize only when the effective broker/identity settings change.
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [effectiveClientId, effectiveTenantId, effectiveRedirectUri, requiredScopeKey, useBroker]);
+  }, [autoAuthorizeMissingScopes, effectiveClientId, effectiveAuthorityTenant, effectiveRedirectUri, expectedTenantId, preferredAccountIdentifier, requiredScopeKey, useBroker, useEmbeddedWebView]);
   const signIn = useCallback(async () => {
     const pca = pcaRef.current;
     if (!pca) return;
@@ -237,7 +257,8 @@ export function AuthProvider({
       if (!pca.isInitialized) {
         await pca.init();
       }
-      const signedInAccount = await acquireRequiredScopesInteractively(pca, effectiveRequiredScopes);
+      const signedInAccount = await acquireRequiredScopesInteractively(pca, effectiveRequiredScopes, expectedTenantId);
+      if (pcaRef.current !== pca) return;
       setAccount(signedInAccount);
       getAppLogger().identifyUser({
         objectId: signedInAccount.identifier,
@@ -267,12 +288,13 @@ export function AuthProvider({
       }
       signInScenario.complete();
     } catch (e) {
-      setError(e instanceof Error ? e : new Error(String(e)));
+      debugWarn('[AuthProvider] sign-in failed:', e);
+      setError(new Error(AUTHENTICATION_ERROR_MESSAGE));
       signInScenario.fail(undefined, getAuthErrorTelemetry(e));
     } finally {
       setIsLoading(false);
     }
-  }, [intuneEnabled, requiredScopeKey, useBroker]);
+  }, [expectedTenantId, intuneEnabled, requiredScopeKey, useBroker, useEmbeddedWebView]);
   const acquireToken = useCallback(async scopes => {
     const pca = pcaRef.current;
     if (!pca || !account) return null;
@@ -281,6 +303,10 @@ export function AuthProvider({
         scopes,
         account
       });
+      assertExpectedTenant(result.account, expectedTenantId);
+      if (pcaRef.current !== pca || !accountRef.current || !accountsMatch(accountRef.current, account)) {
+        return null;
+      }
       return result.accessToken;
     } catch (e) {
       debugWarn('[AuthContext] acquireTokenSilent failed for scopes:', scopes, e);
@@ -300,7 +326,7 @@ export function AuthProvider({
       }
       return null;
     }
-  }, [account, requiredScopeKey]);
+  }, [account, expectedTenantId, requiredScopeKey]);
   const signOut = useCallback(async () => {
     const pca = pcaRef.current;
     if (!pca || !account) return;
@@ -333,6 +359,7 @@ export function AuthProvider({
       isAuthReady,
       isSignedIn: noAuthMode || account !== null,
       hasRealAccount: account !== null,
+      account,
       error,
       acquireToken,
       signIn,

package/lib/module/auth/targetAuthorization.js

@@ -0,0 +1,48 @@
+"use strict";
+
+function getErrorProperty(error, propertyName) {
+  return error && typeof error === 'object' ? error[propertyName] : undefined;
+}
+function getErrorMessage(error) {
+  if (error instanceof Error) return error.message;
+  return typeof error === 'string' ? error : String(error);
+}
+function normalizeTenantId(tenantId) {
+  return tenantId.trim().toLowerCase();
+}
+function assertExpectedTenant(account, expectedTenantId) {
+  if (expectedTenantId && normalizeTenantId(account.tenantId) !== normalizeTenantId(expectedTenantId)) {
+    throw new Error('The signed-in account is not available in the selected environment tenant.');
+  }
+}
+function accountsMatch(left, right) {
+  return left.identifier === right.identifier && normalizeTenantId(left.tenantId) === normalizeTenantId(right.tenantId);
+}
+export function isInteractionRequired(error) {
+  const code = getErrorProperty(error, 'code');
+  return code === 1004 || code === '1004' || code === 'E_INTERACTION_REQUIRED' || /interaction[ _-]?required/i.test(getErrorMessage(error));
+}
+export async function authorizeRequiredScopes(client, account, scopes, expectedTenantId) {
+  let authorizedAccount = account;
+  for (const scope of scopes) {
+    try {
+      const result = await client.acquireTokenSilent({
+        scopes: [scope],
+        account: authorizedAccount
+      });
+      authorizedAccount = result.account;
+    } catch (error) {
+      if (!isInteractionRequired(error)) throw error;
+      const result = await client.acquireToken({
+        scopes: [scope],
+        loginHint: authorizedAccount.username
+      });
+      if (!accountsMatch(authorizedAccount, result.account)) {
+        throw new Error('Sign in with the same account for all required Power Platform permissions.');
+      }
+      authorizedAccount = result.account;
+    }
+    assertExpectedTenant(authorizedAccount, expectedTenantId);
+  }
+  return authorizedAccount;
+}

package/lib/module/bridge/NativePowerAppsBridge.js

@@ -104,6 +104,7 @@ function arrayBufferViewToArrayBuffer(view) {
   return copy.buffer;
 }
 export class NativePowerAppsBridge {
+  _runtimeEpoch = 0;
   constructor(_options) {
     this._options = _options;
   }
@@ -117,8 +118,14 @@ export class NativePowerAppsBridge {
    * via globalThis would have no effect — mutating options is the correct path.
    */
   updateOptions(options) {
+    if (this._options.runtimeIdentity !== options.runtimeIdentity) {
+      this._runtimeEpoch += 1;
+    }
     this._options = updateBridgeOptionsInPlace(this._options, options);
   }
+  invalidateRuntime() {
+    this._runtimeEpoch += 1;
+  }
   async initialize() {
     // No handshake required for the native path.
   }
@@ -147,9 +154,27 @@ export class NativePowerAppsBridge {
     });
     switch (key) {
       case 'AppIdentityServicePlugin.getAppAccessTokenAsync':
-        return this._options.getConnectorToken(params[0]);
+        {
+          const runtimeEpoch = this._runtimeEpoch;
+          const generation = this._options.targetGeneration;
+          const runtimeIdentity = this._options.runtimeIdentity;
+          const token = await this._options.getConnectorToken(params[0]);
+          if (this._runtimeEpoch !== runtimeEpoch || this._options.targetGeneration !== generation || this._options.runtimeIdentity !== runtimeIdentity) {
+            throw new Error('NativePowerAppsBridge: target changed while acquiring a connector token');
+          }
+          return token;
+        }
       case 'AppIdentityServicePlugin.getAppDynamicResourceAccessTokenAsync':
-        return this._options.getDataverseToken(params[0]);
+        {
+          const runtimeEpoch = this._runtimeEpoch;
+          const generation = this._options.targetGeneration;
+          const runtimeIdentity = this._options.runtimeIdentity;
+          const token = await this._options.getDataverseToken(params[0]);
+          if (this._runtimeEpoch !== runtimeEpoch || this._options.targetGeneration !== generation || this._options.runtimeIdentity !== runtimeIdentity) {
+            throw new Error('NativePowerAppsBridge: target changed while acquiring a Dataverse token');
+          }
+          return token;
+        }
       case 'AppHttpClientPlugin.sendHttpAsync':
         return this._sendHttpAsync(params);
       case 'AppPowerAppsClientPlugin.getAppCdsDataSourceConfigsAsync':
@@ -193,6 +218,9 @@ export class NativePowerAppsBridge {
    *   [{ status: number; headers: Record<string, string> }, ArrayBuffer]
    */
   async _sendHttpAsync(params) {
+    const requestRuntimeEpoch = this._runtimeEpoch;
+    const requestGeneration = this._options.targetGeneration;
+    const requestRuntimeIdentity = this._options.runtimeIdentity;
     const requestConfig = params[0];
     const bodyParam = params[1];
     const {
@@ -234,6 +262,9 @@ export class NativePowerAppsBridge {
         headers: headers,
         body: bodyInit
       });
+      if (this._runtimeEpoch !== requestRuntimeEpoch || this._options.targetGeneration !== requestGeneration || this._options.runtimeIdentity !== requestRuntimeIdentity) {
+        throw new Error('NativePowerAppsBridge: target changed while the request was in flight');
+      }
     } catch (fetchErr) {
       debugWarn(`[bridge] fetch THREW for ${method} ${urlLabel}:`, fetchErr);
       debugLog(`[bridge] fetch THREW for ${method} ${urlLabel} | req body: ${typeof bodyInit === 'string' ? bodyInit.slice(0, 500) : bodyInit != null ? '<non-string body>' : '<no body>'}`);

package/lib/module/bridge/PowerPagesBridge.js

@@ -125,11 +125,9 @@ export class PowerPagesBridge {
       throw error;
     }
     if (!response.ok) {
-      const responseText = new TextDecoder().decode(responseBody).slice(0, 1000);
-      const detail = responseText ? `: ${responseText}` : '';
       // RuntimeDataClient treats JSON tuples as successful before inspecting status.
       // Reject with its HTTP-plugin error shape so 4xx/5xx responses remain failures.
-      throw [[`Power Pages Web API request failed (${response.status})${detail}`, undefined, {
+      throw [[`Power Pages Web API request failed (${response.status})`, undefined, {
         status: response.status,
         headers: responseHeaders
       }], responseBody];

package/lib/module/bridge/setupNativeHost.js

@@ -59,4 +59,9 @@ export function setupNativeHost(options) {
     globalThis.powerAppsBridge = _bridge;
     debugLog('[bridge] setupNativeHost: bridge ready');
   }
+}
+
+/** Invalidates in-flight work without replacing the SDK-cached bridge singleton. */
+export function invalidateNativeHostRuntime() {
+  _bridge?.invalidateRuntime();
 }

package/lib/module/config/expoConfig.js

@@ -1,5 +1,6 @@
 "use strict";
 
+import { resolveMultiTenantConfig, resolveTenantMode } from "./tenantMode.js";
 /**
  * Branding placeholder used when the app supplies no icon/splash of its own.
  *
@@ -13,6 +14,12 @@
  */
 const PLACEHOLDER_BRANDING_IMAGE = './assets/adaptive-icon.png';
 export function createPowerAppsExpoConfig(baseConfig, settings, customize = config => config) {
+  const tenantMode = resolveTenantMode({
+    expo: baseConfig
+  });
+  if (tenantMode === 'multi') resolveMultiTenantConfig({
+    expo: baseConfig
+  });
   const resolvedIconPath = settings.iconPath || PLACEHOLDER_BRANDING_IMAGE;
   const resolvedSplashPath = settings.splashPath || process.env.APP_SPLASH_PATH || PLACEHOLDER_BRANDING_IMAGE;
   const icon = {
@@ -40,6 +47,13 @@ export function createPowerAppsExpoConfig(baseConfig, settings, customize = conf
     experiments: {
       typedRoutes: true
     },
+    extra: {
+      ...baseConfig.extra,
+      powerappsNative: {
+        ...baseConfig.extra?.powerappsNative,
+        tenantMode
+      }
+    },
     plugins: [...(settings.isDevClient ? ['expo-dev-client'] : []), 'expo-asset', 'expo-audio', 'expo-font', 'expo-image', 'expo-mail-composer', 'expo-router', 'expo-secure-store', 'expo-sharing', 'expo-video', 'expo-web-browser', '@microsoft/power-apps-native-host', '@microsoft/power-apps-native-offline', '@react-native-community/datetimepicker',
     // Configured explicitly rather than left to Expo's default so prebuild
     // emits named, resource-table-registered splash assets the wrap pipeline

package/lib/module/config/runtimeTenantMode.js

@@ -0,0 +1,12 @@
+"use strict";
+
+import { getWrapConfig } from '@microsoft/power-apps-native-auth';
+import { TargetRuntimeError } from "../target/errors.js";
+import { isDevPlayer } from "../utils/isDevPlayer.js";
+export function assertNativeTenantMode(tenantMode) {
+  if (__DEV__ || isDevPlayer) return;
+  const native = getWrapConfig();
+  if (native.authContractVersion !== '2' || native.tenantMode !== 'single' && native.tenantMode !== 'multi' || native.tenantMode !== tenantMode) {
+    throw new TargetRuntimeError('invalid-build-config', 'configuration', false, 'The app authentication configuration does not match this build. Rebuild the app or contact your administrator.');
+  }
+}

package/lib/module/config/runtimeTenantMode.web.js

@@ -0,0 +1,5 @@
+"use strict";
+
+export function assertNativeTenantMode(_tenantMode) {
+  // Native wrap metadata is not available on web.
+}

package/lib/module/config/tenantMode.js

@@ -0,0 +1,61 @@
+"use strict";
+
+export const MULTI_TENANT_AUTHORITY = 'common';
+const GUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const CANVAS_APP_NAME_PATTERN = /^[A-Za-z][A-Za-z0-9_]{0,99}$/;
+function getPowerAppsNativeConfig(appConfig) {
+  if (!appConfig || typeof appConfig !== 'object') return {};
+  const config = appConfig;
+  return config.expo?.extra?.powerappsNative ?? {};
+}
+export function resolveTenantMode(appConfig) {
+  const value = getPowerAppsNativeConfig(appConfig).tenantMode;
+  if (value === undefined) return 'single';
+  if (value === 'single' || value === 'multi') return value;
+  throw new Error('app.json expo.extra.powerappsNative.tenantMode must be "single" or "multi"');
+}
+export function resolveMultiTenantConfig(appConfig) {
+  const config = getPowerAppsNativeConfig(appConfig);
+  if (typeof config.appDisplayName !== 'string' || config.appDisplayName.trim().length === 0) {
+    throw new Error('app.json expo.extra.powerappsNative.appDisplayName is required in multi-tenant mode');
+  }
+  if (typeof config.appName !== 'string' || !CANVAS_APP_NAME_PATTERN.test(config.appName.trim())) {
+    throw new Error('app.json expo.extra.powerappsNative.appName must start with a letter and contain only letters, numbers, or underscores (maximum 100 characters)');
+  }
+  const appIdentity = {
+    appDisplayName: config.appDisplayName.trim(),
+    appName: config.appName.trim()
+  };
+  if (config.tenantPolicy === 'organizations') {
+    return {
+      ...appIdentity,
+      tenantPolicy: 'organizations'
+    };
+  }
+  if (!config.tenantPolicy || typeof config.tenantPolicy !== 'object' || Array.isArray(config.tenantPolicy)) {
+    throw new Error('app.json expo.extra.powerappsNative.tenantPolicy must be "organizations" or an allowedTenantIds policy');
+  }
+  const values = config.tenantPolicy.allowedTenantIds;
+  if (!Array.isArray(values) || values.length === 0) {
+    throw new Error('app.json tenantPolicy.allowedTenantIds must be a non-empty tenant GUID array');
+  }
+  const allowedTenantIds = values.map(value => {
+    if (typeof value !== 'string' || !GUID_PATTERN.test(value.trim())) {
+      throw new Error('app.json tenantPolicy.allowedTenantIds must contain only tenant GUIDs');
+    }
+    return value.trim().toLowerCase();
+  });
+  if (new Set(allowedTenantIds).size !== allowedTenantIds.length) {
+    throw new Error('app.json tenantPolicy.allowedTenantIds must not contain duplicates');
+  }
+  return {
+    ...appIdentity,
+    tenantPolicy: {
+      allowedTenantIds
+    }
+  };
+}
+export function isTenantAllowed(tenantId, policy) {
+  if (!GUID_PATTERN.test(tenantId.trim())) return false;
+  return policy === 'organizations' || policy.allowedTenantIds.includes(tenantId.trim().toLowerCase());
+}