react-native-intune 0.1.0-alpha.1 → 0.1.1-rc.1

package/README.md

@@ -1,16 +1,30 @@
-# react-native-intune
-
-Microsoft Intune app protection for React Native — **app-level data protection, not device
-management.** MSAL with broker support is included, so sign-in and enrollment work without
-a second SDK.
-
-**[Documentation](https://bayazetyan.github.io/react-native-intune/)** ·
-[Getting started](https://bayazetyan.github.io/react-native-intune/docs/getting-started) ·
-[Traps](https://bayazetyan.github.io/react-native-intune/docs/notes/traps) ·
-[API reference](https://bayazetyan.github.io/react-native-intune/docs/reference)
-
-> **Status: pre-alpha.** Implemented and verified on real devices against a real tenant,
-> but not released. Expect breaking changes until 1.0.
+<p align="center">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/bayazetyan/react-native-intune/main/.github/assets/banner-dark.png">
+    <img alt="react-native-intune — Microsoft Intune app protection for React Native" src="https://raw.githubusercontent.com/bayazetyan/react-native-intune/main/.github/assets/banner-light.png" width="820">
+  </picture>
+</p>
+
+<p align="center">
+  <a href="https://www.npmjs.com/package/react-native-intune"><img alt="npm" src="https://img.shields.io/npm/v/react-native-intune?color=4B5AE4&labelColor=1B2027"></a>
+  <a href="https://github.com/bayazetyan/react-native-intune/actions/workflows/ci.yml"><img alt="CI" src="https://github.com/bayazetyan/react-native-intune/actions/workflows/ci.yml/badge.svg?branch=main"></a>
+  <a href="./LICENSE"><img alt="MIT" src="https://img.shields.io/badge/licence-MIT-4B5AE4?labelColor=1B2027"></a>
+  <img alt="platforms" src="https://img.shields.io/badge/platforms-iOS%2017%2B%20%C2%B7%20Android%2024%2B-5A6478?labelColor=1B2027">
+  <img alt="React Native" src="https://img.shields.io/badge/React%20Native-0.74%2B%20new%20arch-5A6478?labelColor=1B2027">
+</p>
+
+<p align="center">
+  <a href="https://bayazetyan.github.io/react-native-intune/"><b>Documentation</b></a> ·
+  <a href="https://bayazetyan.github.io/react-native-intune/docs/getting-started">Getting started</a> ·
+  <a href="https://bayazetyan.github.io/react-native-intune/docs/notes/traps">Traps</a> ·
+  <a href="https://bayazetyan.github.io/react-native-intune/docs/reference">API reference</a>
+</p>
+
+---
+
+> **Status: pre-alpha.** Implemented and verified on real devices against a real tenant.
+> The public types changed twice in the fortnight before release, so expect breaking
+> changes until 1.0 and pin an exact version.
 
 *Not affiliated with, endorsed by, or sponsored by Microsoft. Microsoft, Intune and Entra
 are trademarks of the Microsoft group of companies.*
@@ -76,7 +90,7 @@ app project** — `Info.plist`, entitlements, `AndroidManifest.xml`, your app mo
 `build.gradle`, your `Application` class — and autolinking does not touch any of them.
 
 **Expo:** add the config plugin and run `expo prebuild`. Nearly everything is applied for
-you, including the `MAMApplication` change.
+you, including the auth callback in your `Application` class.
 
 ```json
 { "expo": { "plugins": [["react-native-intune", { "androidSignatureHash": "…" }]] } }

package/android/src/main/java/com/reactnativeintune/RNIntuneAuthCallback.kt

@@ -13,20 +13,25 @@ import java.util.concurrent.atomic.AtomicLong
 /**
  * Supplies the MAM service token (SPEC §13.4, §6.1.2).
  *
- * **The consumer registers this from `Application.onMAMCreate()`,** not from JS. The SDK
+ * **The consumer registers this from `Application.onCreate()`,** not from JS. The SDK
  * can ask for a token before any React context exists — it has its own enrollment retry
  * schedule that survives restarts — so registration has to happen earlier than JS is
  * able to run. The module supplies the class; the wiring is one line in the host app:
  *
  * ```kotlin
- * class MainApplication : MAMApplication() {
- *   override fun onMAMCreate() {
- *     super.onMAMCreate()
+ * class MainApplication : Application(), ReactApplication {
+ *   override fun onCreate() {
+ *     super.onCreate()
  *     RNIntuneAuthCallback.register(this)
  *   }
  * }
  * ```
  *
+ * `Application`, not `MAMApplication`, and `onCreate`, not `onMAMCreate`: the MAM Gradle
+ * plugin rewrites both at build time. Written in source, `MAMApplication` does not
+ * compile — this module declares the SDK as `implementation`, which is not transitive,
+ * so it is not on the app module's classpath (issue #5).
+ *
  * `acquireToken` is called **on a background thread and must return synchronously**, so
  * this blocks that thread while JS answers. That is why the timeout is not optional: the
  * SDK's thread is held for its duration.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "react-native-intune",
-  "version": "0.1.0-alpha.1",
+  "version": "0.1.1-rc.1",
   "description": "Microsoft Intune app protection policies (MAM) for React Native",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",
@@ -22,6 +22,7 @@
     "app.plugin.js",
     "plugin",
     "scripts",
+    "!scripts/verify-expo.mjs",
     "sdk-versions.json",
     "sdk-lock.json",
     "!vendor",
@@ -43,12 +44,13 @@
   ],
   "scripts": {
     "fetch-sdks": "node scripts/fetch-sdks.mjs",
+    "verify:expo": "node scripts/verify-expo.mjs",
     "postinstall": "node scripts/fetch-sdks.mjs --soft --quiet",
     "example": "yarn workspace react-native-intune-example",
     "clean": "del-cli android/build example/android/build example/android/app/build example/ios/build lib",
     "prepare": "bob build",
     "typecheck": "yarn workspace react-native-intune-example ensure-tenant && tsc",
-    "test": "jest",
+    "test": "NODE_OPTIONS=--experimental-vm-modules jest",
     "release": "release-it --only-version",
     "lint": "eslint \"**/*.{js,ts,tsx}\""
   },
@@ -145,6 +147,11 @@
     "modulePathIgnorePatterns": [
       "<rootDir>/example/node_modules",
       "<rootDir>/lib/"
+    ],
+    "testMatch": [
+      "**/__tests__/**/*.[jt]s?(x)",
+      "**/?(*.)+(spec|test).[jt]s?(x)",
+      "**/__tests__/**/*.test.mjs"
     ]
   },
   "commitlint": {
@@ -190,9 +197,7 @@
     ],
     "version": "0.63.0"
   },
-  "bin": {
-    "react-native-intune": "scripts/cli.mjs"
-  },
+  "bin": "scripts/cli.mjs",
   "engines": {
     "node": ">=18"
   },

package/plugin/transforms.js

@@ -63,14 +63,18 @@ function withMamClasspath(contents, { javassist = '3.29.2-GA' } = {}) {
 }
 
 /**
- * Makes the generated Application class derive from MAMApplication and register the auth
- * callback.
+ * Registers the auth callback in the generated Application class.
  *
- * This is the difference Expo makes. On bare React Native this file is the developer's
- * own source, so `doctor` can only report it; under prebuild the file is generated, so
- * there is nothing of theirs to overwrite. It is also one of the three omissions that
- * build and run while protecting nothing, which is why automating it is worth the
- * string surgery.
+ * **It deliberately does not touch the superclass.** An earlier version rewrote
+ * `: Application()` to `: MAMApplication()` in source, which does not compile in a
+ * consumer app: this package declares the MAM AAR as `implementation files(...)`, and
+ * `implementation` is not transitive, so the SDK's classes are not on the app module's
+ * compile classpath. The superclass resolves to an error type and every member
+ * inheriting from it fails with it — see issue #5.
+ *
+ * The superclass is the MAM Gradle plugin's job, in bytecode, which is what Microsoft's
+ * own guidance describes and what this repository's example app has always relied on.
+ * Rewriting it here was both broken and redundant.
  *
  * The callback goes in `onCreate` deliberately: the MAM plugin rewrites `onCreate` into
  * `onMAMCreate` at build time, so writing `onMAMCreate` here would leave a method the
@@ -80,69 +84,107 @@ function withMamClasspath(contents, { javassist = '3.29.2-GA' } = {}) {
  * act on beats a generated file that does not compile.
  */
 function withMamApplication(contents, language) {
-  if (contents.includes('MAMApplication')) {
-    return contents;
+  const isKotlin = language === 'kt';
+
+  const migrated = revertLegacySuperclass(contents, isKotlin);
+  if (migrated === null) {
+    return null;
+  }
+  if (/RNIntuneAuthCallback\s*\.\s*register/.test(migrated)) {
+    return migrated;
   }
 
-  const isKotlin = language === 'kt';
-  const superclass = isKotlin
-    ? /(class\s+\w+\s*:\s*)Application(\s*\(\s*\))?/
-    : /(class\s+\w+\s+extends\s+)Application/;
-  if (!superclass.test(contents)) {
+  // `MAMApplication` is accepted as well as `Application`: an app that has wired the SDK
+  // into its own module may extend it directly, and the plugin's rewrite is then a no-op
+  // rather than an error. What matters is that there is an Application subclass at all —
+  // with none, the Gradle plugin has nothing to transform.
+  const appClass = isKotlin
+    ? /class\s+\w+\s*:\s*(?:MAM)?Application\s*\(\s*\)/
+    : /class\s+\w+\s+extends\s+(?:MAM)?Application\b/;
+  if (!appClass.test(migrated)) {
     return null;
   }
 
-  let next = contents.replace(superclass, '$1MAMApplication()');
-  if (!isKotlin) {
-    next = next.replace(
-      /(class\s+\w+\s+extends\s+)MAMApplication\(\)/,
-      '$1MAMApplication'
-    );
+  const next = addImports(migrated, [
+    `import com.reactnativeintune.RNIntuneAuthCallback${isKotlin ? '' : ';'}`,
+  ]);
+  if (next === null) {
+    return null;
   }
 
-  // Imports. `android.app.Application` may still be referenced elsewhere in the file, so
-  // it is added alongside rather than replacing anything.
-  const imports = isKotlin
-    ? [
-        'import com.microsoft.intune.mam.client.app.MAMApplication',
-        'import com.reactnativeintune.RNIntuneAuthCallback',
-      ]
-    : [
-        'import com.microsoft.intune.mam.client.app.MAMApplication;',
-        'import com.reactnativeintune.RNIntuneAuthCallback;',
-      ];
-  const missing = imports.filter((i) => !next.includes(i));
-  if (missing.length > 0) {
-    const lastImport = [...next.matchAll(/^import .*$/gm)].pop();
-    if (!lastImport) {
-      return null;
-    }
-    const at = lastImport.index + lastImport[0].length;
-    next = `${next.slice(0, at)}\n${missing.join('\n')}${next.slice(at)}`;
+  // After `super.onCreate()`, not at the top of the method. The superclass is what
+  // initialises the MAM machinery the callback registers with, so registering first is
+  // registering against nothing — and it fails the way everything here fails, by
+  // reporting a licensing-shaped enrollment status that retries quietly.
+  const onCreate = isKotlin
+    ? /(override\s+fun\s+onCreate\s*\(\s*\)\s*\{[^\n]*\n\s*super\.onCreate\s*\(\s*\)\s*\n)/
+    : /(public\s+void\s+onCreate\s*\(\s*\)\s*\{[^\n]*\n\s*super\.onCreate\s*\(\s*\)\s*;\s*\n)/;
+  if (!onCreate.test(next)) {
+    return null;
   }
+  const end = isKotlin ? '' : ';';
+  const call =
+    `    ${CALLBACK_COMMENT}\n` +
+    `    // time, so this belongs here rather than in an onMAMCreate we write.\n` +
+    `    RNIntuneAuthCallback.register(this)${end}\n`;
+
+  return next.replace(onCreate, `$1${call}`);
+}
+
+/**
+ * The first line of the comment this transform writes above the callback. It is also
+ * how a file this transform has already touched is recognised — see below.
+ */
+const CALLBACK_COMMENT = `// ${MARKER}: the MAM plugin rewrites onCreate into onMAMCreate at build`;
 
-  if (!/RNIntuneAuthCallback\s*\.\s*register/.test(next)) {
-    // After `super.onCreate()`, not at the top of the method. The superclass is what
-    // initialises the MAM machinery the callback registers with, so registering first
-    // is registering against nothing — and it fails the way everything here fails, by
-    // reporting a licensing-shaped enrollment status that retries quietly.
-    const onCreate = isKotlin
-      ? /(override\s+fun\s+onCreate\s*\(\s*\)\s*\{[^\n]*\n\s*super\.onCreate\s*\(\s*\)\s*\n)/
-      : /(public\s+void\s+onCreate\s*\(\s*\)\s*\{[^\n]*\n\s*super\.onCreate\s*\(\s*\)\s*;\s*\n)/;
-    if (!onCreate.test(next)) {
-      return null;
-    }
-    const call = isKotlin
-      ? `    // ${MARKER}: the MAM plugin rewrites onCreate into onMAMCreate at build\n` +
-        `    // time, so this belongs here rather than in an onMAMCreate we write.\n` +
-        '    RNIntuneAuthCallback.register(this)\n'
-      : `    // ${MARKER}: the MAM plugin rewrites onCreate into onMAMCreate at build\n` +
-        `    // time, so this belongs here rather than in an onMAMCreate we write.\n` +
-        '    RNIntuneAuthCallback.register(this);\n';
-    next = next.replace(onCreate, `$1${call}`);
+/**
+ * Undoes what 0.1.0 wrote, so the fix reaches people the defect already reached.
+ *
+ * 0.1.0 rewrote the superclass to `MAMApplication` in source and added its import. The
+ * idempotency guard above would leave such a file untouched — it already registers the
+ * callback — so `expo prebuild` without `--clean` would keep a file that does not
+ * compile, on the version that is supposed to fix it.
+ *
+ * Only a file carrying this transform's own comment is changed. That comment is proof
+ * the superclass was ours to write; an app that extends `MAMApplication` deliberately,
+ * with the SDK on its own classpath, is left alone.
+ */
+function revertLegacySuperclass(contents, isKotlin) {
+  if (!contents.includes(CALLBACK_COMMENT)) {
+    return contents;
+  }
+  const superclass = isKotlin
+    ? /(class\s+\w+\s*:\s*)MAMApplication(\s*\(\s*\))/
+    : /(class\s+\w+\s+extends\s+)MAMApplication\b/;
+  if (!superclass.test(contents)) {
+    return contents;
   }
+  const reverted = contents
+    .replace(superclass, isKotlin ? '$1Application$2' : '$1Application')
+    .replace(
+      /^import com\.microsoft\.intune\.mam\.client\.app\.MAMApplication;?\n/m,
+      ''
+    );
+  return addImports(reverted, [
+    `import android.app.Application${isKotlin ? '' : ';'}`,
+  ]);
+}
 
-  return next;
+/**
+ * Adds each missing import after the last existing one. Null when the file has no
+ * import to anchor on, which a generated Application class always has.
+ */
+function addImports(contents, imports) {
+  const missing = imports.filter((i) => !contents.includes(i));
+  if (missing.length === 0) {
+    return contents;
+  }
+  const lastImport = [...contents.matchAll(/^import .*$/gm)].pop();
+  if (!lastImport) {
+    return null;
+  }
+  const at = lastImport.index + lastImport[0].length;
+  return `${contents.slice(0, at)}\n${missing.join('\n')}${contents.slice(at)}`;
 }
 
 module.exports = {

package/plugin/withIntune.js

@@ -285,9 +285,9 @@ const withMamApplicationClass = (config) =>
       // leaving the app unprotected. A quiet skip here is the worst outcome available.
       WarningAggregator.addWarningAndroid(
         MARKER,
-        'Could not make MainApplication extend MAMApplication — its shape was not ' +
-          'recognised. THE APP WILL BUILD AND RUN WITHOUT PROTECTION until this is ' +
-          'done by hand. Run `npx react-native-intune doctor` for the exact change.'
+        'Could not register the MAM auth callback in MainApplication — its shape was ' +
+          'not recognised. THE APP WILL BUILD AND RUN WITHOUT PROTECTION until this ' +
+          'is done by hand. Run `npx react-native-intune doctor` for the exact change.'
       );
       return c;
     }

package/scripts/doctor.mjs

@@ -128,7 +128,9 @@ function main() {
     }
     process.stdout.write(`\n${platform === 'ios' ? 'iOS' : 'Android'}\n`);
     for (const r of forPlatform) {
-      process.stdout.write(`  ${glyph(r.state)} ${r.check.title}${suffix(r)}\n`);
+      process.stdout.write(
+        `  ${glyph(r.state, r.check.severity)} ${r.check.title}${suffix(r)}\n`
+      );
     }
   }
 
@@ -183,7 +185,15 @@ function main() {
   process.exit(s.blocking.length > 0 ? 1 : 0);
 }
 
-function glyph(state) {
+/**
+ * An advisory never reads as MISS or WRONG. It does not fail the exit code by design,
+ * and a line that shouts while the detail underneath says "advisory" teaches people to
+ * discount the ones that do matter.
+ */
+function glyph(state, severity) {
+  if (severity === 'advisory' && state !== 'ok' && state !== 'skip') {
+    return 'note';
+  }
   return { ok: 'ok  ', missing: 'MISS', wrong: 'WRONG', unknown: '?   ', skip: '--  ' }[
     state
   ];

package/scripts/lib/checks.mjs

@@ -49,30 +49,58 @@ export const KEYCHAIN_GROUPS = [
 
 // ---------------------------------------------------------------- android
 
+/**
+ * Source text with `//` and block comments removed, for Gradle, Kotlin and Java alike.
+ *
+ * Every check that reads source for a declaration goes through this, because matching
+ * text that includes comments is how `android-mam-application` reported this
+ * repository's own example as passing for as long as it existed (issue #5). A `//` is
+ * only a comment after whitespace or at the start of a line, so `https://` in a
+ * repository URL survives.
+ */
+function stripComments(src) {
+  return src.replace(/\/\*[\s\S]*?\*\//g, '').replace(/(^|\s)\/\/.*$/gm, '$1');
+}
+
+/**
+ * An actual application of the plugin: `apply plugin: "…"`, `id "…"` or `id("…")`. The
+ * closing quote is required, so the `com.microsoft.intune.mam.build` classpath entry in
+ * the root build file does not count.
+ */
+const MAM_PLUGIN_APPLIED =
+  /(?:apply\s+plugin\s*:\s*|\bid\s*\(?\s*)['"]com\.microsoft\.intune\.mam['"]/;
+
+/**
+ * Whether the MAM Gradle plugin is applied to the app module. Shared by the plugin check
+ * and the Application check, which both depend on the answer and must never disagree
+ * about it.
+ */
+function mamPluginApplied(project) {
+  const a = project.android;
+  if (a.appBuildGradleKts && !a.appBuildGradle) {
+    return {
+      state: 'unknown',
+      detail:
+        'app/build.gradle.kts — the Kotlin DSL is not inspected. Check by hand that ' +
+        'the plugin is applied.',
+    };
+  }
+  const src = read(a.appBuildGradle);
+  if (!src) {
+    return { state: 'unknown', detail: 'android/app/build.gradle not found' };
+  }
+  return MAM_PLUGIN_APPLIED.test(stripComments(src))
+    ? { state: 'ok' }
+    : { state: 'missing' };
+}
+
 const androidChecks = [
   {
     id: 'android-mam-plugin',
     platform: 'android',
     title: 'MAM Gradle plugin applied to the app module',
     severity: 'silent',
-    inspect(project) {
-      const a = project.android;
-      if (a.appBuildGradleKts && !a.appBuildGradle) {
-        return {
-          state: 'unknown',
-          detail:
-            'app/build.gradle.kts — the Kotlin DSL is not inspected. Check by hand ' +
-            'that the plugin is applied.',
-        };
-      }
-      const src = read(a.appBuildGradle);
-      if (!src) {
-        return { state: 'unknown', detail: 'android/app/build.gradle not found' };
-      }
-      return /com\.microsoft\.intune\.mam/.test(src)
-        ? { state: 'ok' }
-        : { state: 'missing' };
-    },
+    inspect: mamPluginApplied,
     why:
       'The plugin rewrites bytecode across the app and every dependency. Applied to ' +
       'the library instead of the app module it rewrites only the library, builds ' +
@@ -174,8 +202,18 @@ ${BROKER_PACKAGES.map((p) => `        <package android:name="${p}" />`).join('\n
   {
     id: 'android-mam-application',
     platform: 'android',
-    title: 'Application class derives from MAMApplication',
+    title: 'Application class is transformed into a MAMApplication',
     severity: 'silent',
+    /**
+     * What makes the app a MAMApplication is the Gradle plugin's bytecode rewrite, not
+     * the text of the source file — so this reads both, and a plain `Application`
+     * subclass with the plugin applied is the correct, expected shape.
+     *
+     * The previous version matched the substring `MAMApplication` anywhere in the
+     * source. It reported this repository's own example as passing because the word
+     * appears in a *comment* there, which is why nobody noticed it was asserting the
+     * wrong thing entirely. Issue #5.
+     */
     inspect(project) {
       const sources = project.android.applicationSources;
       if (sources.length === 0) {
@@ -184,26 +222,78 @@ ${BROKER_PACKAGES.map((p) => `        <package android:name="${p}" />`).join('\n
           detail: 'no Application subclass found in android/app/src/main',
         };
       }
-      const hit = sources.find((f) => /MAMApplication/.test(read(f)));
-      if (hit) {
-        return { state: 'ok', detail: rel(project, hit) };
+
+      // A class declaration, never a mention: comments are stripped first, so neither
+      // an explanatory comment nor a commented-out example counts.
+      const declared = /class\s+\w+\s*(?::\s*|\s+extends\s+)MAMApplication\b/;
+      const explicit = sources.find((f) => declared.test(stripComments(read(f))));
+      const a = project.android;
+
+      if (explicit) {
+        // Legitimate only when the app module has the SDK on its own compile classpath.
+        // This package declares the AAR as `implementation`, which is not transitive,
+        // so without that the supertype does not resolve — exactly the shape a 0.1.0
+        // Expo prebuild wrote, which must not read as protected (issue #5).
+        if (a.appBuildGradleKts && !a.appBuildGradle) {
+          return {
+            state: 'unknown',
+            detail:
+              `${rel(project, explicit)} extends MAMApplication directly, and the ` +
+              'Kotlin DSL build file is not inspected — check by hand that the MAM SDK ' +
+              'is on the app module\u2019s classpath, or this does not compile.',
+          };
+        }
+        const gradle = stripComments(read(a.appBuildGradle));
+        if (/Microsoft\.Intune\.MAM\.SDK/.test(gradle)) {
+          return {
+            state: 'ok',
+            detail: `${rel(project, explicit)} extends MAMApplication directly`,
+          };
+        }
+        return {
+          state: 'wrong',
+          detail:
+            `${rel(project, explicit)} extends MAMApplication in source, but the MAM ` +
+            'SDK is not on the app module\u2019s classpath, so it does not compile. If ' +
+            'expo prebuild wrote it, re-run prebuild with this version.',
+        };
+      }
+
+      const plugin = mamPluginApplied(project);
+      if (plugin.state === 'unknown') {
+        return {
+          state: 'unknown',
+          detail: `whether the plugin transforms the class cannot be read: ${plugin.detail}`,
+        };
+      }
+      if (plugin.state === 'ok') {
+        return {
+          state: 'ok',
+          detail: `${rel(project, sources[0])} — superclass rewritten by the Gradle plugin`,
+        };
       }
       return {
         state: 'wrong',
-        detail: `found ${sources.map((f) => rel(project, f)).join(', ')} — none extends MAMApplication`,
+        detail:
+          `found ${sources.map((f) => rel(project, f)).join(', ')}, and the MAM ` +
+          'Gradle plugin is not applied to the app module — so nothing rewrites it',
       };
     },
     why:
       'One of the three omissions that build and run while protecting nothing. The ' +
-      'plugin transforms an Application subclass; with none to transform, or one that ' +
-      'does not derive from MAMApplication, the SDK is present and inert.',
+      'Gradle plugin transforms an Application subclass into a MAMApplication; with ' +
+      'none to transform, or with the plugin not applied, the SDK is present and inert.',
     instruction: () =>
-      `Your Application class must extend MAMApplication, and the auth callback is
-  registered from onMAMCreate — the plugin rewrites onCreate into it:
+      `Keep your Application class extending android.app.Application — the MAM Gradle
+  plugin rewrites the superclass at build time, and writing MAMApplication in source
+  does not compile unless you put the SDK on your app module's classpath yourself.
+
+  Apply the plugin (see the "MAM Gradle plugin applied to the app module" check), and
+  register the auth callback from onCreate, which the plugin rewrites into onMAMCreate:
 
-    class MainApplication : MAMApplication(), ReactApplication {
-      override fun onMAMCreate() {
-        super.onMAMCreate()
+    class MainApplication : Application(), ReactApplication {
+      override fun onCreate() {
+        super.onCreate()
         RNIntuneAuthCallback.register(this)
         // ... the rest of your existing onCreate body
       }
@@ -222,7 +312,9 @@ ${BROKER_PACKAGES.map((p) => `        <package android:name="${p}" />`).join('\n
       if (sources.length === 0) {
         return { state: 'missing', detail: 'no Application subclass found' };
       }
-      return sources.some((f) => /RNIntuneAuthCallback\s*\.\s*register/.test(read(f)))
+      return sources.some((f) =>
+        /RNIntuneAuthCallback\s*\.\s*register/.test(stripComments(read(f)))
+      )
         ? { state: 'ok' }
         : { state: 'missing' };
     },

package/sdk-lock.json

@@ -2,7 +2,7 @@
   "ios": {
     "repo": "microsoftconnect/ms-intune-app-sdk-ios",
     "tag": "21.8.0",
-    "fetchedAt": "2026-09-03T10:39:33.572Z",
+    "fetchedAt": "2026-09-28T11:15:17.927Z",
     "files": {
       "ios/IntuneMAMSwift.xcframework": "f38f0f130bd2adf0dd936acb26958f6c6ebc0b2d5a4bf886d4c8c7d4ae0870ab",
       "ios/IntuneMAMSwiftStub.xcframework": "a03e563feec36f719bfca34b061e590e1c54a03650a3855a8298988e49b9ea9c",
@@ -17,7 +17,7 @@
   "android": {
     "repo": "microsoftconnect/ms-intune-app-sdk-android",
     "tag": "12.4.0",
-    "fetchedAt": "2026-09-03T10:39:50.835Z",
+    "fetchedAt": "2026-09-28T11:15:18.852Z",
     "files": {
       "android/Microsoft.Intune.MAM.SDK.aar": "b7e5d0bb86d18f054d8901f168f82e64c79a57334fbb6227136b108b0514e998",
       "android/GradlePlugin/com.microsoft.intune.mam.build.jar": "04ae1e0fbb6b5dfcbf8bd42e8d4f41ad758332ee6c238780a764a9ab1b67446d",