react-native-intune 0.1.0-alpha.1

package/plugin/transforms.js

@@ -0,0 +1,153 @@
+/**
+ * The text surgery the Expo config plugin performs, as pure functions.
+ *
+ * Separated from the plugin wiring for one reason: `@expo/config-plugins` is not
+ * installed unless the consumer uses Expo, so anything importing it cannot be tested
+ * here. These take a string and return a string, so they are tested directly — which
+ * matters, because two of them edit generated Kotlin and a bad regex silently produces
+ * a file that does not compile.
+ *
+ * Every function is idempotent. `expo prebuild` runs plugins against freshly generated
+ * files most of the time, but `prebuild` without `--clean` runs them against files a
+ * previous run already touched, so applying twice has to be a no-op.
+ */
+
+const MARKER = 'react-native-intune';
+
+const MAM_PLUGIN_BLOCK = `
+// ${MARKER}: the MAM Gradle plugin rewrites bytecode across the app and every
+// dependency. It belongs in the app module — applied to a library it rewrites only that
+// library, builds cleanly, and protects nothing.
+apply plugin: "com.microsoft.intune.mam"
+
+intunemam {
+    report = true
+    verify = true
+    incremental = true
+}
+`;
+
+/** Applies the MAM plugin to android/app/build.gradle. */
+function withMamPluginApplied(contents) {
+  if (contents.includes('com.microsoft.intune.mam')) {
+    return contents;
+  }
+  return `${contents.trimEnd()}\n${MAM_PLUGIN_BLOCK}`;
+}
+
+/**
+ * Adds the plugin jar and javassist to the root buildscript classpath.
+ *
+ * javassist's version must match the SDK exactly — the plugin uses it to rewrite
+ * bytecode, and a mismatch fails in ways that point at the rewritten class rather than
+ * at the version.
+ */
+function withMamClasspath(contents, { javassist = '3.29.2-GA' } = {}) {
+  if (contents.includes('com.microsoft.intune.mam.build')) {
+    return contents;
+  }
+  const lines = [
+    `        // ${MARKER}: managed block`,
+    '        classpath files("$rootDir/../node_modules/react-native-intune/vendor/android/GradlePlugin/com.microsoft.intune.mam.build.jar")',
+    `        classpath "org.javassist:javassist:${javassist}"`,
+  ].join('\n');
+
+  // Anchor on the buildscript's own dependencies block. Matching `dependencies {`
+  // anywhere would hit the app-level one in a single-file project and put a buildscript
+  // classpath where it does nothing.
+  const anchor = /(buildscript\s*\{[\s\S]*?dependencies\s*\{\s*\n)/;
+  if (!anchor.test(contents)) {
+    return null;
+  }
+  return contents.replace(anchor, `$1${lines}\n`);
+}
+
+/**
+ * Makes the generated Application class derive from MAMApplication and register the auth
+ * callback.
+ *
+ * This is the difference Expo makes. On bare React Native this file is the developer's
+ * own source, so `doctor` can only report it; under prebuild the file is generated, so
+ * there is nothing of theirs to overwrite. It is also one of the three omissions that
+ * build and run while protecting nothing, which is why automating it is worth the
+ * string surgery.
+ *
+ * The callback goes in `onCreate` deliberately: the MAM plugin rewrites `onCreate` into
+ * `onMAMCreate` at build time, so writing `onMAMCreate` here would leave a method the
+ * plugin never calls.
+ *
+ * Returns null when the file does not look the way we expect. A warning the consumer can
+ * act on beats a generated file that does not compile.
+ */
+function withMamApplication(contents, language) {
+  if (contents.includes('MAMApplication')) {
+    return contents;
+  }
+
+  const isKotlin = language === 'kt';
+  const superclass = isKotlin
+    ? /(class\s+\w+\s*:\s*)Application(\s*\(\s*\))?/
+    : /(class\s+\w+\s+extends\s+)Application/;
+  if (!superclass.test(contents)) {
+    return null;
+  }
+
+  let next = contents.replace(superclass, '$1MAMApplication()');
+  if (!isKotlin) {
+    next = next.replace(
+      /(class\s+\w+\s+extends\s+)MAMApplication\(\)/,
+      '$1MAMApplication'
+    );
+  }
+
+  // Imports. `android.app.Application` may still be referenced elsewhere in the file, so
+  // it is added alongside rather than replacing anything.
+  const imports = isKotlin
+    ? [
+        'import com.microsoft.intune.mam.client.app.MAMApplication',
+        'import com.reactnativeintune.RNIntuneAuthCallback',
+      ]
+    : [
+        'import com.microsoft.intune.mam.client.app.MAMApplication;',
+        'import com.reactnativeintune.RNIntuneAuthCallback;',
+      ];
+  const missing = imports.filter((i) => !next.includes(i));
+  if (missing.length > 0) {
+    const lastImport = [...next.matchAll(/^import .*$/gm)].pop();
+    if (!lastImport) {
+      return null;
+    }
+    const at = lastImport.index + lastImport[0].length;
+    next = `${next.slice(0, at)}\n${missing.join('\n')}${next.slice(at)}`;
+  }
+
+  if (!/RNIntuneAuthCallback\s*\.\s*register/.test(next)) {
+    // After `super.onCreate()`, not at the top of the method. The superclass is what
+    // initialises the MAM machinery the callback registers with, so registering first
+    // is registering against nothing — and it fails the way everything here fails, by
+    // reporting a licensing-shaped enrollment status that retries quietly.
+    const onCreate = isKotlin
+      ? /(override\s+fun\s+onCreate\s*\(\s*\)\s*\{[^\n]*\n\s*super\.onCreate\s*\(\s*\)\s*\n)/
+      : /(public\s+void\s+onCreate\s*\(\s*\)\s*\{[^\n]*\n\s*super\.onCreate\s*\(\s*\)\s*;\s*\n)/;
+    if (!onCreate.test(next)) {
+      return null;
+    }
+    const call = isKotlin
+      ? `    // ${MARKER}: the MAM plugin rewrites onCreate into onMAMCreate at build\n` +
+        `    // time, so this belongs here rather than in an onMAMCreate we write.\n` +
+        '    RNIntuneAuthCallback.register(this)\n'
+      : `    // ${MARKER}: the MAM plugin rewrites onCreate into onMAMCreate at build\n` +
+        `    // time, so this belongs here rather than in an onMAMCreate we write.\n` +
+        '    RNIntuneAuthCallback.register(this);\n';
+    next = next.replace(onCreate, `$1${call}`);
+  }
+
+  return next;
+}
+
+module.exports = {
+  MARKER,
+  withMamPluginApplied,
+  withMamClasspath,
+  withMamApplication,
+};

package/plugin/withIntune.js

@@ -0,0 +1,320 @@
+/**
+ * Expo config plugin.
+ *
+ * Why automation is right here and wrong everywhere else in this package: config
+ * plugins run during `expo prebuild`, against files prebuild has just **generated**.
+ * There is no developer edit to fight, no git history to churn, and nothing to
+ * re-apply on the next version bump — the whole reason `setup` refuses to run from
+ * postinstall (SPEC §12.7) simply does not apply.
+ *
+ * So Expo users get nearly the entire integration checklist automatically, including
+ * the Application subclass, which on bare React Native `doctor` can only report because
+ * the file belongs to the developer.
+ *
+ * Usage, in app.json / app.config.js:
+ *
+ *   {
+ *     "plugins": [
+ *       ["react-native-intune", { "androidSignatureHash": "Xo8W...yr9iU=" }]
+ *     ]
+ *   }
+ *
+ * Two props. `maxFileProtectionLevel` writes the plist-only `MaxFileProtectionLevel`
+ * key, which matters for any app that reads its own files while the screen is locked —
+ * the SDK's default makes them unreadable about ten seconds after the device locks.
+ *
+ * The one that cannot be omitted is `androidSignatureHash`. It cannot be derived: an EAS
+ * build is signed with a keystore Expo manages, so the value comes from
+ * `eas credentials` and only the project owner can read it. Without it the Android
+ * redirect activity is skipped and a warning says so, rather than a plausible-looking
+ * activity being written with the wrong hash — which fails at the first sign-in with an
+ * error naming neither key.
+ */
+
+const {
+  AndroidConfig,
+  WarningAggregator,
+  createRunOncePlugin,
+  withAndroidManifest,
+  withAppBuildGradle,
+  withEntitlementsPlist,
+  withInfoPlist,
+  withMainApplication,
+  withProjectBuildGradle,
+} = require('@expo/config-plugins');
+
+const {
+  MARKER,
+  withMamApplication,
+  withMamClasspath,
+  withMamPluginApplied,
+} = require('./transforms');
+
+const pkg = require('../package.json');
+
+const BROKER_PACKAGES = [
+  'com.microsoft.windowsintune.companyportal',
+  'com.azure.authenticator',
+  'com.microsoft.workaccount',
+];
+
+const QUERY_SCHEMES = ['msauthv2', 'msauthv3', 'companyportal'];
+
+/**
+ * `MaxFileProtectionLevel` is plist-only — the SDK reads it at launch and there is no
+ * runtime setter, which is why `configure()` rejects the option when the plist disagrees
+ * instead of ignoring it. Prebuild generates the plist, so this is exactly the kind of
+ * key a config plugin should be writing.
+ *
+ * Keys are the `FileProtectionLevel` values from the public API; values are what the SDK
+ * expects to read.
+ */
+const FILE_PROTECTION = {
+  complete: 'NSFileProtectionComplete',
+  completeUnlessOpen: 'NSFileProtectionCompleteUnlessOpen',
+  completeUntilFirstUserAuthentication:
+    'NSFileProtectionCompleteUntilFirstUserAuthentication',
+  none: 'NSFileProtectionNone',
+};
+
+const DEFAULT_MSAL_GROUP = 'com.microsoft.adalcache';
+
+/**
+ * In this order, and the order is a requirement rather than a preference: without an
+ * explicit access group iOS writes to the *first* group in the entitlements, so a
+ * Microsoft group in that position would receive keychain items the app writes.
+ *
+ * `$(PRODUCT_BUNDLE_IDENTIFIER)` rather than a literal, because prebuild is where the
+ * bundle id is decided and it can differ per build profile.
+ */
+const keychainGroups = (msalGroup) => [
+  '$(AppIdentifierPrefix)$(PRODUCT_BUNDLE_IDENTIFIER)',
+  '$(AppIdentifierPrefix)com.microsoft.intune.mam',
+  `$(AppIdentifierPrefix)${msalGroup}`,
+];
+
+// ---------------------------------------------------------------- ios
+
+const withKeychainGroups = (config, { keychainGroup }) =>
+  withEntitlementsPlist(config, (c) => {
+    const wanted = keychainGroups(keychainGroup);
+    const existing = c.modResults['keychain-access-groups'] ?? [];
+    const others = existing.filter((g) => !wanted.includes(g));
+    c.modResults['keychain-access-groups'] = [...wanted, ...others];
+    return c;
+  });
+
+const withMsalUrlScheme = (config, { maxFileProtectionLevel, keychainGroup }) =>
+  withInfoPlist(config, (c) => {
+    const scheme = 'msauth.$(PRODUCT_BUNDLE_IDENTIFIER)';
+    const types = c.modResults.CFBundleURLTypes ?? [];
+    const already = types.some((t) =>
+      (t.CFBundleURLSchemes ?? []).includes(scheme)
+    );
+    if (!already) {
+      types.push({ CFBundleURLSchemes: [scheme] });
+    }
+    c.modResults.CFBundleURLTypes = types;
+
+    const queries = c.modResults.LSApplicationQueriesSchemes ?? [];
+    for (const s of QUERY_SCHEMES) {
+      if (!queries.includes(s)) {
+        queries.push(s);
+      }
+    }
+    c.modResults.LSApplicationQueriesSchemes = queries;
+
+    // Identity is configured at runtime, and a plist key alongside a runtime override is
+    // a known cause of enrollment failures whose error names the authority rather than
+    // the conflict. `configure()` refuses to start when it finds one, so leaving these
+    // in place would produce a prebuild that cannot run.
+    //
+    // ADALCacheKeychainGroupOverride is deliberately NOT removed: it has no runtime
+    // equivalent and is the only way to set the keychain group (SPEC §5.1.4).
+    const settings = c.modResults.IntuneMAMSettings;
+    if (settings && typeof settings === 'object') {
+      for (const key of ['ADALClientId', 'ADALAuthority', 'ADALRedirectUri']) {
+        delete settings[key];
+      }
+    }
+
+    // `configure({ keychainGroupOverride })` has no runtime equivalent for the SDK's own
+    // side of it: `ADALCacheKeychainGroupOverride` is read from the plist at launch, and
+    // `configure()` refuses the option when the two disagree. Prebuild regenerates the
+    // plist, so without this an Expo app could not use a custom group at all — it would
+    // fail with E_PLIST_CONFLICT and there would be nowhere to fix it.
+    if (keychainGroup !== DEFAULT_MSAL_GROUP) {
+      c.modResults.IntuneMAMSettings = {
+        ...(c.modResults.IntuneMAMSettings ?? {}),
+        ADALCacheKeychainGroupOverride: keychainGroup,
+      };
+    }
+
+    if (maxFileProtectionLevel) {
+      const value = FILE_PROTECTION[maxFileProtectionLevel];
+      if (!value) {
+        WarningAggregator.addWarningIOS(
+          MARKER,
+          `maxFileProtectionLevel "${maxFileProtectionLevel}" is not one of ` +
+            `${Object.keys(FILE_PROTECTION).join(', ')}, so MaxFileProtectionLevel was ` +
+            'not written. configure() will reject the option rather than ignore it.'
+        );
+      } else {
+        c.modResults.IntuneMAMSettings = {
+          ...(settings ?? {}),
+          MaxFileProtectionLevel: value,
+        };
+      }
+    }
+    return c;
+  });
+
+// ---------------------------------------------------------------- android
+
+const withBrokerQueries = (config) =>
+  withAndroidManifest(config, (c) => {
+    const manifest = c.modResults.manifest;
+    manifest.queries = manifest.queries ?? [{}];
+    const block = manifest.queries[0];
+    block.package = block.package ?? [];
+    for (const name of BROKER_PACKAGES) {
+      const present = block.package.some((p) => p.$?.['android:name'] === name);
+      if (!present) {
+        block.package.push({ $: { 'android:name': name } });
+      }
+    }
+    return c;
+  });
+
+const withRedirectActivity = (config, { androidSignatureHash }) =>
+  withAndroidManifest(config, (c) => {
+    if (!androidSignatureHash) {
+      WarningAggregator.addWarningAndroid(
+        MARKER,
+        'androidSignatureHash was not provided, so the MSAL redirect activity was not ' +
+          'added and sign-in will fail. Read it from `eas credentials` (or your own ' +
+          'keystore) and pass it as a plugin prop.'
+      );
+      return c;
+    }
+
+    const app = AndroidConfig.Manifest.getMainApplicationOrThrow(c.modResults);
+    app.activity = app.activity ?? [];
+    const name = 'com.microsoft.identity.client.BrowserTabActivity';
+    if (app.activity.some((a) => a.$?.['android:name'] === name)) {
+      return c;
+    }
+
+    const packageName =
+      AndroidConfig.Package.getPackage(c) ?? c.android?.package;
+
+    app.activity.push({
+      '$': { 'android:name': name, 'android:exported': 'true' },
+      'intent-filter': [
+        {
+          action: [{ $: { 'android:name': 'android.intent.action.VIEW' } }],
+          category: [
+            { $: { 'android:name': 'android.intent.category.DEFAULT' } },
+            { $: { 'android:name': 'android.intent.category.BROWSABLE' } },
+          ],
+          data: [
+            {
+              $: {
+                'android:scheme': 'msauth',
+                'android:host': packageName,
+                // The DECODED hash — "/" and "=" literal. The redirect URI registered in
+                // Entra percent-encodes them as %2F and %3D. Same value, two spellings,
+                // in two places that must agree.
+                'android:path': `/${decodeURIComponent(androidSignatureHash)}`,
+              },
+            },
+          ],
+        },
+      ],
+    });
+    return c;
+  });
+
+const withGradle = (config) => {
+  let next = withAppBuildGradle(config, (c) => {
+    if (c.modResults.language !== 'groovy') {
+      WarningAggregator.addWarningAndroid(
+        MARKER,
+        'android/app/build.gradle is Kotlin DSL, which this plugin does not edit. Apply ' +
+          'the MAM plugin by hand — see `npx react-native-intune doctor`.'
+      );
+      return c;
+    }
+    c.modResults.contents = withMamPluginApplied(c.modResults.contents);
+    return c;
+  });
+
+  next = withProjectBuildGradle(next, (c) => {
+    if (c.modResults.language !== 'groovy') {
+      WarningAggregator.addWarningAndroid(
+        MARKER,
+        'android/build.gradle is Kotlin DSL, which this plugin does not edit. Add the ' +
+          'MAM plugin classpath by hand — see `npx react-native-intune doctor`.'
+      );
+      return c;
+    }
+    const result = withMamClasspath(c.modResults.contents);
+    if (result === null) {
+      WarningAggregator.addWarningAndroid(
+        MARKER,
+        'Could not find a buildscript { dependencies { } } block in ' +
+          'android/build.gradle, so the MAM plugin classpath was not added.'
+      );
+      return c;
+    }
+    c.modResults.contents = result;
+    return c;
+  });
+
+  return next;
+};
+
+const withMamApplicationClass = (config) =>
+  withMainApplication(config, (c) => {
+    const result = withMamApplication(
+      c.modResults.contents,
+      c.modResults.language
+    );
+    if (result === null) {
+      // Said loudly, because this is one of the omissions that builds and runs while
+      // leaving the app unprotected. A quiet skip here is the worst outcome available.
+      WarningAggregator.addWarningAndroid(
+        MARKER,
+        'Could not make MainApplication extend MAMApplication — its shape was not ' +
+          'recognised. THE APP WILL BUILD AND RUN WITHOUT PROTECTION until this is ' +
+          'done by hand. Run `npx react-native-intune doctor` for the exact change.'
+      );
+      return c;
+    }
+    c.modResults.contents = result;
+    return c;
+  });
+
+// ---------------------------------------------------------------- entry
+
+const withIntune = (config, props = {}) => {
+  const androidSignatureHash = props.androidSignatureHash ?? null;
+  const maxFileProtectionLevel = props.maxFileProtectionLevel ?? null;
+  const keychainGroup = props.keychainGroup ?? DEFAULT_MSAL_GROUP;
+
+  let next = config;
+  next = withKeychainGroups(next, { keychainGroup });
+  next = withMsalUrlScheme(next, { maxFileProtectionLevel, keychainGroup });
+  next = withBrokerQueries(next);
+  next = withRedirectActivity(next, { androidSignatureHash });
+  next = withGradle(next);
+  next = withMamApplicationClass(next);
+  return next;
+};
+
+/**
+ * Run-once, so listing the plugin twice — easy to do when a config is assembled from
+ * shared fragments — does not apply everything twice. The transforms are idempotent
+ * anyway; this makes the intent explicit rather than relying on that.
+ */
+module.exports = createRunOncePlugin(withIntune, pkg.name, pkg.version);

package/scripts/cli.mjs

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+/**
+ * `npx react-native-intune <command>`.
+ *
+ * Three commands, and the split between them is the point (SPEC §12.7): `doctor` reads
+ * and reports, `setup` writes only when asked, `fetch-sdks` touches nothing but this
+ * package's own vendor directory. Nothing here ever runs from `postinstall` except
+ * `fetch-sdks`, which is why that one is safe to.
+ */
+
+import { spawnSync } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+
+const COMMANDS = {
+  doctor: {
+    script: 'doctor.mjs',
+    summary: 'report what your project still needs; changes nothing',
+  },
+  setup: {
+    script: 'setup.mjs',
+    summary: 'apply what can be applied, and print the rest',
+  },
+  'fetch-sdks': {
+    script: 'fetch-sdks.mjs',
+    summary: "download the pinned Microsoft SDKs into this package's vendor/",
+  },
+};
+
+const [command, ...rest] = process.argv.slice(2);
+
+if (!command || command === '--help' || command === '-h' || command === 'help') {
+  usage();
+  process.exit(command ? 0 : 1);
+}
+
+if (command === '--version' || command === '-v') {
+  const pkg = await import('node:fs').then((fs) =>
+    JSON.parse(fs.readFileSync(path.join(HERE, '..', 'package.json'), 'utf8'))
+  );
+  process.stdout.write(`${pkg.version}\n`);
+  process.exit(0);
+}
+
+const entry = COMMANDS[command];
+if (!entry) {
+  process.stderr.write(`Unknown command: ${command}\n\n`);
+  usage();
+  process.exit(1);
+}
+
+// Spawned rather than imported so each command keeps its own exit code, and so a crash
+// in one cannot take the router's error reporting with it.
+const result = spawnSync(process.execPath, [path.join(HERE, entry.script), ...rest], {
+  stdio: 'inherit',
+});
+process.exit(result.status ?? 1);
+
+function usage() {
+  const width = Math.max(...Object.keys(COMMANDS).map((k) => k.length));
+  process.stdout.write(
+    `\nreact-native-intune\n\n` +
+      `Usage: npx react-native-intune <command>\n\n` +
+      Object.entries(COMMANDS)
+        .map(([name, c]) => `  ${name.padEnd(width)}  ${c.summary}\n`)
+        .join('') +
+      `\nStart with \`doctor\`. It is read-only, and most Intune setup mistakes fail\n` +
+      `later with an error naming the wrong cause.\n\n`
+  );
+}