@nativelement/capacitor-msal-entra 0.0.0-stage → 1.0.1

package/ios/Plugin/MsalAuthPlugin.swift

@@ -0,0 +1,204 @@
+import Foundation
+import Capacitor
+import MSAL
+
+/// Wraps the MSAL iOS SDK so the Ionic/Angular layer only ever deals with
+/// plain JS objects and promises.
+///
+/// Requires the MSAL pod (pod 'MSAL', '~> 1.2') and an entry in Info.plist
+/// registering the CFBundleURLSchemes redirect URI, plus LSApplicationQueriesSchemes
+/// entries for "msauthv2" / "msauthv3" if you want broker support.
+@objc(MsalAuthPlugin)
+public class MsalAuthPlugin: CAPPlugin, CAPBridgedPlugin {
+    public let identifier = "MsalAuthPlugin"
+    public let jsName = "MsalAuth"
+    public let pluginMethods: [CAPPluginMethod] = [
+        CAPPluginMethod(name: "signIn", returnType: CAPPluginReturnPromise),
+        CAPPluginMethod(name: "acquireTokenSilent", returnType: CAPPluginReturnPromise),
+        CAPPluginMethod(name: "getAccount", returnType: CAPPluginReturnPromise),
+        CAPPluginMethod(name: "signOut", returnType: CAPPluginReturnPromise)
+    ]
+
+    private var application: MSALPublicClientApplication?
+
+    override public func load() {
+        NSLog("MsalAuthPlugin: load() called")
+        guard
+            let path = Bundle.main.path(forResource: "msal_config", ofType: "json"),
+            let data = try? Data(contentsOf: URL(fileURLWithPath: path)),
+            let json = try? JSONSerialization.jsonObject(with: data) as? [String: Any],
+            let clientId = json["client_id"] as? String,
+            let authorityUrlString = json["authority_url"] as? String,
+            let redirectUri = json["redirect_uri"] as? String,
+            let authorityUrl = URL(string: authorityUrlString)
+        else {
+            NSLog("MsalAuthPlugin: failed to load msal_config.json")
+            return
+        }
+        NSLog("MsalAuthPlugin: parsed config, clientId=%@ authority=%@ redirectUri=%@", clientId, authorityUrlString, redirectUri)
+
+        do {
+            let authority = try MSALCIAMAuthority(url: authorityUrl)
+            let config = MSALPublicClientApplicationConfig(
+                clientId: clientId,
+                redirectUri: redirectUri,
+                authority: authority
+            )
+            application = try MSALPublicClientApplication(configuration: config)
+            NSLog("MsalAuthPlugin: MSALPublicClientApplication initialized successfully")
+        } catch {
+            NSLog("MsalAuthPlugin: failed to init MSAL - %@", String(describing: error))
+        }
+    }
+
+    @objc func signIn(_ call: CAPPluginCall) {
+        NSLog("MsalAuthPlugin: signIn() called")
+        // 'openid', 'profile' and 'offline_access' are reserved scopes MSAL
+        // adds automatically - callers should only pass scopes for a specific
+        // protected resource here, or none at all for a basic sign-in.
+        let scopes = call.getArray("scopes", String.self) ?? []
+        let domainHint = call.getString("domainHint")
+        guard let application = application else {
+            NSLog("MsalAuthPlugin: signIn() rejected - MSAL not initialized")
+            call.reject("MSAL not initialized", "NOT_INITIALIZED")
+            return
+        }
+        guard let viewController = bridge?.viewController else {
+            NSLog("MsalAuthPlugin: signIn() rejected - no view controller")
+            call.reject("No view controller to present sign-in from")
+            return
+        }
+        NSLog("MsalAuthPlugin: signIn() guards passed, scopes=%@, domainHint=%@, dispatching acquireToken", scopes, domainHint ?? "nil")
+
+        DispatchQueue.main.async {
+            NSLog("MsalAuthPlugin: on main queue, building webParameters")
+            let webParameters = MSALWebviewParameters(authPresentationViewController: viewController)
+            let interactiveParameters = MSALInteractiveTokenParameters(scopes: scopes, webviewParameters: webParameters)
+            if let domainHint = domainHint, !domainHint.isEmpty {
+                interactiveParameters.extraQueryParameters = ["domain_hint": domainHint]
+            }
+
+            NSLog("MsalAuthPlugin: calling application.acquireToken(with:)")
+            application.acquireToken(with: interactiveParameters) { result, error in
+                NSLog("MsalAuthPlugin: acquireToken completion invoked, error=%@, result=%@", String(describing: error), String(describing: result))
+                if let error = error {
+                    call.reject(error.localizedDescription, self.errorCode(for: error), error)
+                    return
+                }
+                guard let result = result else {
+                    call.reject("No result returned from MSAL")
+                    return
+                }
+                call.resolve(self.toResultJson(result))
+            }
+            NSLog("MsalAuthPlugin: acquireToken(with:) call returned (async, awaiting completion)")
+        }
+    }
+
+    @objc func acquireTokenSilent(_ call: CAPPluginCall) {
+        let scopes = call.getArray("scopes", String.self) ?? []
+        guard let application = application else {
+            call.reject("MSAL not initialized", "NOT_INITIALIZED")
+            return
+        }
+
+        do {
+            guard let account = try application.allAccounts().first else {
+                call.reject("No cached account, call signIn() first", "UI_REQUIRED")
+                return
+            }
+            let silentParameters = MSALSilentTokenParameters(scopes: scopes, account: account)
+            application.acquireTokenSilent(with: silentParameters) { result, error in
+                if let error = error as NSError? {
+                    if error.domain == MSALErrorDomain,
+                       error.code == MSALError.interactionRequired.rawValue {
+                        call.reject("Interactive sign-in required", "UI_REQUIRED", error)
+                    } else {
+                        call.reject(error.localizedDescription, "SILENT_FAILED", error)
+                    }
+                    return
+                }
+                guard let result = result else {
+                    call.reject("No result returned from MSAL")
+                    return
+                }
+                call.resolve(self.toResultJson(result))
+            }
+        } catch {
+            call.reject(error.localizedDescription, "SILENT_FAILED", error)
+        }
+    }
+
+    @objc func getAccount(_ call: CAPPluginCall) {
+        guard let application = application else {
+            NSLog("MsalAuthPlugin: getAccount() - application is nil")
+            call.resolve(["value": NSNull()])
+            return
+        }
+        do {
+            let accounts = try application.allAccounts()
+            NSLog("MsalAuthPlugin: getAccount() - allAccounts() returned %d account(s): %@",
+                  accounts.count, accounts.map { "\($0.identifier ?? "?") / \($0.username ?? "?")" })
+            guard let account = accounts.first else {
+                call.resolve(["value": NSNull()])
+                return
+            }
+            call.resolve([
+                "value": [
+                    "accountId": account.identifier ?? "",
+                    "username": account.username ?? NSNull(),
+                    "idTokenClaims": account.accountClaims ?? [:]
+                ]
+            ])
+        } catch {
+            NSLog("MsalAuthPlugin: getAccount() - allAccounts() threw %@", String(describing: error))
+            call.reject(error.localizedDescription, "GET_ACCOUNT_FAILED", error)
+        }
+    }
+
+    @objc func signOut(_ call: CAPPluginCall) {
+        guard let application = application else {
+            NSLog("MsalAuthPlugin: signOut() - application is nil")
+            call.resolve()
+            return
+        }
+        do {
+            // Remove every cached account, not just the first - MSAL's
+            // Keychain-backed cache can accumulate more than one account
+            // over time (e.g. testing with different sign-ins), and
+            // signOut() must guarantee no account remains afterward, not
+            // just remove whichever one happens to be first in the list.
+            let accounts = try application.allAccounts()
+            NSLog("MsalAuthPlugin: signOut() - allAccounts() found %d account(s) to remove: %@",
+                  accounts.count, accounts.map { "\($0.identifier ?? "?") / \($0.username ?? "?")" })
+            for account in accounts {
+                try application.remove(account)
+                NSLog("MsalAuthPlugin: signOut() - removed account %@", account.identifier ?? "?")
+            }
+            let remaining = try application.allAccounts()
+            NSLog("MsalAuthPlugin: signOut() - after removal, allAccounts() returns %d account(s)", remaining.count)
+            call.resolve()
+        } catch {
+            NSLog("MsalAuthPlugin: signOut() - threw %@", String(describing: error))
+            call.reject(error.localizedDescription, "SIGN_OUT_FAILED", error)
+        }
+    }
+
+    private func toResultJson(_ result: MSALResult) -> [String: Any] {
+        return [
+            "accessToken": result.accessToken,
+            "idToken": result.idToken ?? "",
+            "expiresOn": (result.expiresOn?.timeIntervalSince1970 ?? 0) * 1000,
+            "accountId": result.account.identifier ?? "",
+            "scopes": result.scopes
+        ]
+    }
+
+    private func errorCode(for error: Error) -> String {
+        let nsError = error as NSError
+        if nsError.domain == MSALErrorDomain, nsError.code == MSALError.userCanceled.rawValue {
+            return "USER_CANCELLED"
+        }
+        return "SIGN_IN_FAILED"
+    }
+}

package/ios/Plugin/msal_config.json

@@ -0,0 +1,5 @@
+{
+  "client_id": "<IOS_APP_CLIENT_ID>",
+  "redirect_uri": "msauth.com.example.myapp://auth",
+  "authority_url": "https://<your-tenant-subdomain>.ciamlogin.com/<your-tenant-subdomain>.onmicrosoft.com/"
+}

package/package.json

@@ -1,6 +1,70 @@
 {
   "name": "@nativelement/capacitor-msal-entra",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.1",
+  "description": "Capacitor plugin wrapping native MSAL SDKs (Android/iOS) and msal-browser (web) for Microsoft Entra External ID authentication",
+  "main": "dist/plugin.cjs.js",
+  "module": "dist/esm/index.js",
+  "types": "dist/esm/index.d.ts",
+  "files": [
+    "android/src/main/",
+    "android/build.gradle",
+    "dist/",
+    "ios/Plugin/",
+    "web/",
+    "NativelementCapacitorMsalEntra.podspec",
+    "LICENSE",
+    "CHANGELOG.md"
+  ],
+  "author": "Nativelement",
+  "license": "MIT",
+  "scripts": {
+    "clean": "rm -rf ./dist",
+    "build": "npm run clean && tsc && rollup -c rollup.config.js",
+    "watch": "tsc --watch",
+    "prepublishOnly": "npm run build"
+  },
+  "dependencies": {
+    "@azure/msal-browser": "^5.22.0"
+  },
+  "devDependencies": {
+    "@capacitor/android": "^7.0.0",
+    "@capacitor/core": "^7.0.0",
+    "@capacitor/ios": "^7.0.0",
+    "rollup": "^4.9.0",
+    "typescript": "^5.4.0"
+  },
+  "peerDependencies": {
+    "@capacitor/core": ">=6.0.0"
+  },
+  "capacitor": {
+    "ios": {
+      "src": "ios"
+    },
+    "android": {
+      "src": "android"
+    }
+  },
+  "keywords": [
+    "capacitor",
+    "plugin",
+    "msal",
+    "entra",
+    "entra-external-id",
+    "azure-ad",
+    "ciam",
+    "authentication",
+    "ios",
+    "android"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/NativElement/capacitor-msal-entra.git"
+  },
+  "bugs": {
+    "url": "https://github.com/NativElement/capacitor-msal-entra/issues"
+  },
+  "homepage": "https://github.com/NativElement/capacitor-msal-entra#readme",
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/web/msal_config.json

@@ -0,0 +1,6 @@
+{
+  "client_id": "<WEB_APP_CLIENT_ID>",
+  "authority_url": "https://<your-tenant-subdomain>.ciamlogin.com/<your-tenant-subdomain>.onmicrosoft.com/",
+  "redirect_uri": "https://<your-app-host>/",
+  "known_authorities": []
+}