react-native-intune 0.1.0-alpha.1

package/android/src/main/java/com/reactnativeintune/RNIntuneAuth.kt

@@ -0,0 +1,330 @@
+package com.reactnativeintune
+
+import android.app.Activity
+import com.facebook.react.bridge.Arguments
+import com.facebook.react.bridge.ReactApplicationContext
+import com.facebook.react.bridge.WritableMap
+import com.microsoft.identity.client.AcquireTokenSilentParameters
+import com.microsoft.identity.client.AuthenticationCallback
+import com.microsoft.identity.client.IAccount
+import com.microsoft.identity.client.IAuthenticationResult
+import com.microsoft.identity.client.ISingleAccountPublicClientApplication
+import com.microsoft.identity.client.Prompt
+import com.microsoft.identity.client.PublicClientApplication
+import com.microsoft.identity.client.SignInParameters
+import com.microsoft.identity.client.exception.MsalException
+import com.microsoft.identity.client.exception.MsalUiRequiredException
+import com.microsoft.identity.client.exception.MsalUserCancelException
+
+/**
+ * MSAL: the client, sign-in, and tokens for the app's own scopes (SPEC §3, spike S-3).
+ *
+ * The iOS counterpart is `ios/RNIntuneAuth.m`, and the two answer the same questions with
+ * the same error codes. The mechanics differ in one way worth knowing: on iOS the module
+ * builds an `MSALPublicClientApplication` from objects, while here MSAL insists on reading
+ * a JSON config, so `RNIntuneMsalConfig` writes one at `configure()` time (SPEC §3.3).
+ *
+ * Two tokens exist and only one of them leaves this file. The MAM service token is
+ * acquired by `RNIntuneAuthCallback`, handed to the SDK, and never returned to JS
+ * (CLAUDE.md rule 9). Everything here is for the *app's* scopes (SPEC §3.5).
+ */
+internal class RNIntuneAuth(private val reactContext: ReactApplicationContext) {
+
+  private var client: ISingleAccountPublicClientApplication? = null
+
+  val isConfigured: Boolean
+    get() = client != null
+
+  companion object {
+    /**
+     * What a sign-in asks for when the caller names no scopes.
+     *
+     * MSAL leaves no cheaper option: it adds `openid`, `profile` and `offline_access`
+     * itself and rejects a call that names them, so a sign-in must request some real
+     * resource. `User.Read` is the permission Entra grants every new app registration,
+     * and it is what Microsoft's own samples use to mean "just sign in".
+     *
+     * Which scope fetched the token does not matter for enrollment: the refresh token is
+     * per account, not per resource, and the MAM token is acquired separately.
+     */
+    val DEFAULT_SCOPES: List<String> = listOf("https://graph.microsoft.com/User.Read")
+  }
+
+  /**
+   * Builds the MSAL client for one tenant. Blocking, and it does disk and network setup —
+   * the caller runs it off the main thread.
+   *
+   * Throws rather than returning a flag so `configure()` fails loudly here instead of at
+   * the first sign-in, where the cause is much harder to see.
+   */
+  @Throws(MsalException::class, InterruptedException::class)
+  fun configure(clientId: String, authority: String, redirectUri: String) {
+    val file = RNIntuneMsalConfig.write(reactContext, clientId, authority, redirectUri)
+    client = PublicClientApplication.createSingleAccountPublicClientApplication(
+      reactContext.applicationContext,
+      file,
+    )
+  }
+
+  /** Drops the client. Called from reset, which must leave nothing pinned to the tenant. */
+  fun invalidate() {
+    client = null
+  }
+
+  // ------------------------------------------------------------------------ sign-in
+
+  /**
+   * Interactive sign-in. Uses Company Portal as the broker when present, which is what
+   * makes the resulting token acceptable to the MAM service.
+   *
+   * Needs a foreground Activity, and there may not be one — React Native survives its
+   * Activity being destroyed, so this is a real failure mode rather than a formality.
+   */
+  fun signIn(
+    scopes: List<String>,
+    loginHint: String?,
+    prompt: String?,
+    onResult: (WritableMap) -> Unit,
+    onError: (String, String) -> Unit,
+  ) {
+    val app = client ?: return onError(
+      RNIntuneModule.ERR_NOT_CONFIGURED,
+      "MSAL is not configured. Call configure first.",
+    )
+    val activity: Activity = reactContext.currentActivity ?: return onError(
+      RNIntuneModule.ERR_NO_ACTIVITY,
+      "signIn needs a foreground Activity and there is none. Call it from a mounted " +
+        "screen rather than during startup or from the background.",
+    )
+
+    val params = SignInParameters.builder()
+      .withActivity(activity)
+      .withScopes(if (scopes.isEmpty()) DEFAULT_SCOPES else scopes)
+      .withPrompt(promptFrom(prompt))
+      .withCallback(callback(onResult, onError))
+      .apply { if (!loginHint.isNullOrEmpty()) withLoginHint(loginHint) }
+      .build()
+
+    // A signed-in account changes which call is legal, and the wrong one fails outright:
+    // `signIn` throws "An account is already signed in." in SINGLE account mode. iOS has
+    // no such rule — `acquireTokenWithParameters:` works either way — so smoothing this
+    // over belongs here rather than in every consumer.
+    val existing = currentAccount()
+    if (existing == null) {
+      app.signIn(params)
+      return
+    }
+
+    // Already signed in: answer from the cache, which is also the better experience —
+    // no UI at all for the common case of an app restart.
+    val silent = AcquireTokenSilentParameters.Builder()
+      .withScopes(if (scopes.isEmpty()) DEFAULT_SCOPES else scopes)
+      .forAccount(existing)
+      .fromAuthority(existing.authority)
+      .build()
+
+    val cached = runCatching { app.acquireTokenSilent(silent) }.getOrNull()
+    if (cached != null) {
+      onResult(toAuthResult(cached))
+      return
+    }
+
+    // The cache could not answer, so re-authenticate the account that is already there.
+    // `signInAgain` rather than `signIn`, which is the same distinction as above.
+    app.signInAgain(params)
+  }
+
+  /**
+   * Cache-first. Fails with `E_INTERACTION_REQUIRED` when a prompt is needed — the
+   * caller's pattern is silent first, interactive on that failure.
+   *
+   * Blocking, so the caller runs it off the main thread. The async variants exist, but
+   * every caller here is already on a background thread and the blocking form keeps the
+   * error handling in one place.
+   */
+  fun acquireTokenSilent(
+    scopes: List<String>,
+    forceRefresh: Boolean,
+    onResult: (WritableMap) -> Unit,
+    onError: (String, String) -> Unit,
+  ) {
+    val app = client ?: return onError(
+      RNIntuneModule.ERR_NOT_CONFIGURED,
+      "MSAL is not configured. Call configure first.",
+    )
+
+    val account = currentAccount()
+    if (account == null) {
+      // Not a fault: with no cached account there is nothing to refresh, and the caller's
+      // next move is the same as for an expired token.
+      onError(
+        RNIntuneModule.ERR_INTERACTION_REQUIRED,
+        "No signed-in account is cached. Call signIn to acquire one.",
+      )
+      return
+    }
+
+    val params = AcquireTokenSilentParameters.Builder()
+      .withScopes(if (scopes.isEmpty()) DEFAULT_SCOPES else scopes)
+      .forAccount(account)
+      .fromAuthority(account.authority)
+      .forceRefresh(forceRefresh)
+      .build()
+
+    try {
+      onResult(toAuthResult(app.acquireTokenSilent(params)))
+    } catch (e: Throwable) {
+      val (code, message) = map(e)
+      onError(code, message)
+    }
+  }
+
+  /**
+   * A MAM service token, acquired silently for the SDK.
+   *
+   * This is the Android half of "the module owns MAM token acquisition" (CLAUDE.md rule
+   * 8), and it exists because Android gives no equivalent of the iOS escape hatch. There,
+   * the module simply does not implement the token delegate and the SDK helps itself from
+   * the shared MSAL cache. Here `MAMServiceAuthenticationCallback` is mandatory and the
+   * SDK always asks the app, so in `builtin` mode the app has to answer — from the same
+   * MSAL instance, without involving JS.
+   *
+   * Blocking, and called on the SDK's own background thread, which is what it wants: the
+   * callback must return the token synchronously.
+   *
+   * The return value is a token. It is handed to the SDK and nothing else — never logged,
+   * never stored, never returned across the bridge (CLAUDE.md rule 9). The `null` path
+   * deliberately carries no detail for the same reason.
+   */
+  fun mamServiceToken(resourceId: String): String? {
+    val app = client ?: return null
+    val account = currentAccount() ?: return null
+
+    // `<resource>/.default` is how MSAL asks for every statically-granted permission on a
+    // resource, which is what the MAM service expects. The SDK passes the resource as an
+    // app id GUID; the constant form in RNIntuneAuthCallback is the same resource written
+    // as a URI, and either is accepted here.
+    val params = AcquireTokenSilentParameters.Builder()
+      .withScopes(listOf("$resourceId/.default"))
+      .forAccount(account)
+      .fromAuthority(account.authority)
+      .build()
+
+    return runCatching { app.acquireTokenSilent(params).accessToken }.getOrNull()
+  }
+
+  // ------------------------------------------------------------------------ accounts
+
+  /**
+   * The signed-in account as an `AuthAccount` list, or an empty one.
+   *
+   * A list of at most one, because the client is SINGLE-account mode — the shape matches
+   * iOS and the public API, where more than one entry would mean state a reset should
+   * have cleared (SPEC §9).
+   */
+  fun accounts(): List<WritableMap> {
+    val account = currentAccount() ?: return emptyList()
+    return listOf(
+      Arguments.createMap().apply {
+        putString("accountId", objectIdOf(account))
+        putString("tenantId", account.tenantId.orEmpty())
+        putString("username", account.username.orEmpty())
+      },
+    )
+  }
+
+  /**
+   * The signed-in account's UPN, which Android enrollment needs alongside the object ID.
+   *
+   * This is the seam `RNIntuneModule.knownUpnFor` was left for:
+   * `registerAccountForMAM` takes both and will not accept a null UPN, and the public API
+   * deliberately carries only the object ID (SPEC §6.3).
+   */
+  fun upnFor(accountId: String): String? {
+    val account = currentAccount() ?: return null
+    return if (objectIdOf(account) == accountId) account.username else null
+  }
+
+  /**
+   * Removes the account and its tokens from the MSAL cache — the half of reset the module
+   * could not do while MSAL lived in the host app (SPEC §7 step 4).
+   *
+   * Blocking. Errors are swallowed on purpose: this runs inside the reset sequence, where
+   * the journal's verification decides whether the reset took, not this call.
+   */
+  fun signOutQuietly() {
+    runCatching { client?.signOut() }
+  }
+
+  // ------------------------------------------------------------------------ internals
+
+  private fun currentAccount(): IAccount? =
+    runCatching { client?.currentAccount?.currentAccount }.getOrNull()
+
+  /**
+   * The Entra object ID, which is what `enroll()` and the Intune SDK want.
+   *
+   * `oid` from the claims is the authoritative source; `getId()` is the fallback because
+   * for an AAD account MSAL populates it from the same value. Guessing wrong here does not
+   * fail loudly — it registers the wrong identity — so both are consulted.
+   */
+  private fun objectIdOf(account: IAccount): String {
+    val fromClaims = account.claims?.get("oid")?.toString()
+    return if (!fromClaims.isNullOrEmpty()) fromClaims else account.id.orEmpty()
+  }
+
+  private fun toAuthResult(result: IAuthenticationResult): WritableMap =
+    Arguments.createMap().apply {
+      putString("accountId", objectIdOf(result.account))
+      putString("tenantId", result.tenantId.orEmpty())
+      putString("username", result.account.username.orEmpty())
+      putString("accessToken", result.accessToken)
+      putString("idToken", result.account.idToken)
+      // Unix seconds, matching AuthResult in SPEC §13.1.1 and the iOS implementation.
+      putDouble("expiresOn", (result.expiresOn?.time ?: 0L) / 1000.0)
+      putArray(
+        "scopes",
+        Arguments.createArray().apply { result.scope?.forEach { pushString(it) } },
+      )
+    }
+
+  private fun callback(
+    onResult: (WritableMap) -> Unit,
+    onError: (String, String) -> Unit,
+  ) = object : AuthenticationCallback {
+    override fun onSuccess(result: IAuthenticationResult) = onResult(toAuthResult(result))
+
+    override fun onError(exception: MsalException) {
+      val (code, message) = map(exception)
+      onError(code, message)
+    }
+
+    override fun onCancel() {
+      onError(
+        RNIntuneModule.ERR_USER_CANCELLED,
+        "The user dismissed the sign-in UI.",
+      )
+    }
+  }
+
+  private fun promptFrom(prompt: String?): Prompt = when (prompt) {
+    "selectAccount" -> Prompt.SELECT_ACCOUNT
+    "login" -> Prompt.LOGIN
+    "consent" -> Prompt.CONSENT
+    "whenRequired" -> Prompt.WHEN_REQUIRED
+    // Including null. An unrecognised value must not fail a sign-in: a string added to
+    // the JS enum later would otherwise break every already-shipped native binary.
+    else -> Prompt.WHEN_REQUIRED
+  }
+
+  /** MSAL's outcome onto one of the stable codes in SPEC §13.6. */
+  private fun map(e: Throwable): Pair<String, String> = when (e) {
+    is MsalUiRequiredException -> RNIntuneModule.ERR_INTERACTION_REQUIRED to
+      "A prompt is required. Call signIn instead of signInSilent."
+    is MsalUserCancelException -> RNIntuneModule.ERR_USER_CANCELLED to
+      "The user dismissed the sign-in UI."
+    // Everything else keeps MSAL's own message, which names the cause better than a
+    // re-worded guess would. No token or claim is ever part of it.
+    else -> RNIntuneModule.ERR_NATIVE to (e.message ?: "MSAL failed with no description.")
+  }
+}

package/android/src/main/java/com/reactnativeintune/RNIntuneAuthCallback.kt

@@ -0,0 +1,195 @@
+package com.reactnativeintune
+
+import android.content.Context
+import android.util.Log
+import com.microsoft.intune.mam.client.app.MAMComponents
+import com.microsoft.intune.mam.policy.MAMEnrollmentManager
+import com.microsoft.intune.mam.policy.MAMServiceAuthenticationCallbackExtended
+import java.util.concurrent.ConcurrentHashMap
+import java.util.concurrent.CountDownLatch
+import java.util.concurrent.TimeUnit
+import java.util.concurrent.atomic.AtomicLong
+
+/**
+ * Supplies the MAM service token (SPEC §13.4, §6.1.2).
+ *
+ * **The consumer registers this from `Application.onMAMCreate()`,** not from JS. The SDK
+ * can ask for a token before any React context exists — it has its own enrollment retry
+ * schedule that survives restarts — so registration has to happen earlier than JS is
+ * able to run. The module supplies the class; the wiring is one line in the host app:
+ *
+ * ```kotlin
+ * class MainApplication : MAMApplication() {
+ *   override fun onMAMCreate() {
+ *     super.onMAMCreate()
+ *     RNIntuneAuthCallback.register(this)
+ *   }
+ * }
+ * ```
+ *
+ * `acquireToken` is called **on a background thread and must return synchronously**, so
+ * this blocks that thread while JS answers. That is why the timeout is not optional: the
+ * SDK's thread is held for its duration.
+ *
+ * The token goes straight back to the SDK. It is never returned to JS, never logged, and
+ * never stored (CLAUDE.md rule 9).
+ */
+object RNIntuneAuthCallback {
+
+  /**
+   * The MAM service resource. Read from the SDK's own call site in `AuthCallbackUtils`
+   * rather than from documentation — the SDK passes this literal when it asks the app
+   * for a token, so a provider building an MSAL scope needs exactly this value.
+   */
+  const val MAM_SERVICE_RESOURCE = "https://msmamservice.api.application"
+
+  /**
+   * How long the SDK's background thread is held while JS answers. Matches the iOS
+   * timeout so the two platforms fail at the same point, but here it costs a blocked
+   * thread rather than just a pending completion.
+   */
+  private const val TOKEN_TIMEOUT_SECONDS = 45L
+
+  private const val TAG = "RNIntuneAuth"
+
+  private val pending = ConcurrentHashMap<String, PendingToken>()
+  private val counter = AtomicLong(0)
+
+  @Volatile private var module: RNIntuneModule? = null
+
+  private class PendingToken {
+    val latch = CountDownLatch(1)
+
+    @Volatile var token: String? = null
+
+    @Volatile var failureReason: String? = null
+  }
+
+  /**
+   * Call from `Application.onMAMCreate()`. Safe to call more than once.
+   *
+   * Note what this signature does *not* mention: no MAM SDK type appears anywhere in
+   * this object's public API. The library depends on the vendored AAR with
+   * `implementation` scope, so the SDK is on the consumer's runtime classpath but not
+   * their compile classpath — exposing `MAMServiceAuthenticationCallbackExtended` here
+   * would force every consumer to declare the SDK themselves just to write one line in
+   * `onMAMCreate`. The conformance lives in a private class instead.
+   */
+  @JvmStatic
+  fun register(context: Context) {
+    val manager = MAMComponents.get(MAMEnrollmentManager::class.java)
+    if (manager == null) {
+      // Almost always means the MAM Gradle plugin was not applied to the app module.
+      Log.e(
+        TAG,
+        "MAMEnrollmentManager is unavailable, so the auth callback was not registered. " +
+          "This app was probably built without the MAM Gradle plugin — see the README " +
+          "integration checklist.",
+      )
+      return
+    }
+    manager.registerAuthenticationCallback(Conformance)
+    Log.i(TAG, "MAM service auth callback registered")
+  }
+
+  /** The SDK-facing half, kept off the public surface. */
+  private object Conformance : MAMServiceAuthenticationCallbackExtended {
+    override fun acquireToken(
+      upn: String,
+      aadId: String,
+      tenantId: String?,
+      authority: String?,
+      resourceId: String,
+    ): String? = RNIntuneAuthCallback.acquireToken(upn, aadId, tenantId, authority, resourceId)
+  }
+
+  internal fun attach(module: RNIntuneModule) {
+    this.module = module
+  }
+
+  internal fun detach(module: RNIntuneModule) {
+    if (this.module === module) this.module = null
+    // Nothing is going to answer any more; release every held SDK thread rather than
+    // leaving them blocked until the timeout.
+    pending.keys.toList().forEach { reject(it, "The React context went away.") }
+  }
+
+  /**
+   * Parameter order verified from the SDK's own call site
+   * (`AuthCallbackUtils.acquireMAMServiceToken`), which passes
+   * `rawUPN, aadId, tenantId, authority, "https://msmamservice.api.application"`.
+   *
+   * Worth stating because the obvious guess is wrong: `resourceId` is **last**, not
+   * third, and the three-argument default overload forwards `(a, b, null, null, c)`. A
+   * transposed version compiles cleanly and sends the resource ID as the tenant.
+   */
+  internal fun acquireToken(
+    @Suppress("UNUSED_PARAMETER") upn: String,
+    aadId: String,
+    tenantId: String?,
+    authority: String?,
+    resourceId: String,
+  ): String? {
+    val target = module
+    if (target == null) {
+      Log.w(TAG, "Token requested before the React context was ready; cannot answer.")
+      return null
+    }
+
+    // `builtin`: the module owns MSAL, so answer from it and never involve JS. This is
+    // the Android counterpart of not claiming the token delegate on iOS — same rule,
+    // opposite mechanics, because here the callback is mandatory and the SDK always asks.
+    // Doing it this way also keeps the MAM token off the bridge entirely (rule 9).
+    val own = target.mamServiceToken(resourceId)
+    if (own != null) {
+      return own
+    }
+
+    // `external`, or `builtin` with nothing cached yet: fall through to the host app's
+    // provider. Returning null from here is the SDK's documented "cannot get a token
+    // right now" and maps to AUTHORIZATION_NEEDED, not a hard failure — the SDK retries.
+    val requestId = "tok-${counter.incrementAndGet()}"
+    val slot = PendingToken()
+    pending[requestId] = slot
+
+    target.emitTokenRequest(
+      requestId = requestId,
+      resourceId = resourceId,
+      accountId = aadId,
+      tenantId = tenantId.orEmpty(),
+      authority = authority.orEmpty(),
+    )
+
+    return try {
+      if (!slot.latch.await(TOKEN_TIMEOUT_SECONDS, TimeUnit.SECONDS)) {
+        Log.w(TAG, "Token provider did not answer within ${TOKEN_TIMEOUT_SECONDS}s.")
+        null
+      } else {
+        // Returning null is the SDK's documented "cannot get a token right now"; it maps
+        // to AUTHORIZATION_NEEDED rather than a hard failure.
+        slot.failureReason?.let { Log.w(TAG, "Token provider declined: $it") }
+        slot.token
+      }
+    } catch (e: InterruptedException) {
+      Thread.currentThread().interrupt()
+      null
+    } finally {
+      pending.remove(requestId)
+    }
+  }
+
+  internal fun resolve(requestId: String, token: String) {
+    // Removed rather than read: a late answer after the timeout must not be applied.
+    pending.remove(requestId)?.let {
+      it.token = token
+      it.latch.countDown()
+    }
+  }
+
+  internal fun reject(requestId: String, reason: String) {
+    pending.remove(requestId)?.let {
+      it.failureReason = reason
+      it.latch.countDown()
+    }
+  }
+}

package/android/src/main/java/com/reactnativeintune/RNIntuneConfig.kt

@@ -0,0 +1,63 @@
+package com.reactnativeintune
+
+import com.facebook.react.bridge.ReadableMap
+
+/**
+ * The configuration `configure()` was called with.
+ *
+ * Every field is required: `index.ts` resolves every optional to a concrete value before
+ * it crosses the bridge, so nothing here has to guess a default and the two platforms
+ * cannot drift apart on what the default was.
+ *
+ * Unlike iOS there is no runtime override to set — these values are held and passed
+ * per-call to `registerAccountForMAM` (SPEC §13.1).
+ */
+internal data class RNIntuneConfig(
+  val clientId: String,
+  val tenantId: String,
+  val authority: String,
+  val redirectUri: String,
+  val authMode: String,
+  val verboseLogging: Boolean,
+  val strictMode: Boolean,
+  val telemetryEnabled: Boolean,
+) {
+  /**
+   * `builtin` means the module owns MSAL and `signIn()` works; `external` means the host
+   * app does and every auth method rejects with `E_EXTERNAL_AUTH_MODE` (SPEC §3.2).
+   *
+   * An unrecognised value is treated as `builtin`, matching the public default — a typo
+   * must not silently disable the sign-in the app is relying on.
+   */
+  val builtinAuth: Boolean
+    get() = authMode != "external"
+
+  companion object {
+    fun from(map: ReadableMap): RNIntuneConfig =
+      RNIntuneConfig(
+        clientId = map.getString(CLIENT_ID).orEmpty(),
+        tenantId = map.getString(TENANT_ID).orEmpty(),
+        authority = map.getString(AUTHORITY).orEmpty(),
+        redirectUri = map.getString(REDIRECT_URI).orEmpty(),
+        authMode = map.getString(AUTH_MODE).orEmpty(),
+        verboseLogging = map.getBoolean(VERBOSE_LOGGING),
+        strictMode = map.getBoolean(STRICT_MODE),
+        telemetryEnabled = map.getBoolean(TELEMETRY_ENABLED),
+      )
+
+    // Spec field names in one place, because a typo'd ReadableMap key reads as null and
+    // says nothing. These must match the config object in src/NativeIntune.ts.
+    private const val CLIENT_ID = "clientId"
+    private const val TENANT_ID = "tenantId"
+    private const val AUTHORITY = "authority"
+    private const val REDIRECT_URI = "redirectUri"
+    private const val AUTH_MODE = "authMode"
+    private const val VERBOSE_LOGGING = "verboseLogging"
+    private const val STRICT_MODE = "strictMode"
+    private const val TELEMETRY_ENABLED = "telemetryEnabled"
+
+    // Branding is iOS-only: the Android SDK styles its own screens from the app theme
+    // and has no runtime colour API, so those fields are read by nobody here rather
+    // than being faked.
+  }
+}

package/android/src/main/java/com/reactnativeintune/RNIntuneEventQueue.kt

@@ -0,0 +1,50 @@
+package com.reactnativeintune
+
+import com.facebook.react.bridge.ReactApplicationContext
+import com.facebook.react.bridge.WritableMap
+import com.facebook.react.modules.core.DeviceEventManagerModule
+
+/**
+ * Events on their way to JS, and the queue for the ones that arrive too early.
+ *
+ * The emitter is live from module construction rather than from the first `enroll()`,
+ * because a service-initiated wipe can arrive with no prior app call at all. Anything
+ * emitted before JS subscribes is held rather than dropped: a wipe notification lost
+ * during startup means the reset machine never runs (SPEC §4.4).
+ */
+internal class RNIntuneEventQueue(private val context: ReactApplicationContext) {
+
+  private val pending = mutableListOf<Pair<String, WritableMap>>()
+  private var listenerCount = 0
+
+  /** Emits now if JS is listening, queues otherwise. */
+  fun emit(event: String, payload: WritableMap) {
+    synchronized(this) {
+      if (listenerCount == 0) {
+        pending += event to payload
+        return
+      }
+    }
+    send(event, payload)
+  }
+
+  fun addListener() {
+    val queued =
+      synchronized(this) {
+        listenerCount += 1
+        if (listenerCount != 1) return
+        pending.toList().also { pending.clear() }
+      }
+    queued.forEach { (event, payload) -> send(event, payload) }
+  }
+
+  fun removeListeners(count: Int) {
+    synchronized(this) { listenerCount = (listenerCount - count).coerceAtLeast(0) }
+  }
+
+  private fun send(event: String, payload: WritableMap) {
+    context
+      .getJSModule(DeviceEventManagerModule.RCTDeviceEventEmitter::class.java)
+      .emit(event, payload)
+  }
+}