react-native-intune 0.1.0-alpha.1

package/ios/RNIntune.mm

@@ -0,0 +1,467 @@
+//
+//  Copyright (c) 2026 react-native-intune contributors. MIT.
+//
+
+#import "RNIntune.h"
+#import "RNIntuneCore.h"
+
+#import <UIKit/UIKit.h>
+
+// The only file that may import React (CLAUDE.md rule 7). RCTPresentedViewController()
+// finds the controller MSAL must present its sign-in from, including when the app already
+// has a modal up — which is why the auth layer takes it as a parameter rather than
+// guessing at the key window's root.
+#import <React/RCTUtils.h>
+
+/// Rejects with a stable code (SPEC §13.6). RCTPromiseRejectBlock reads `code` off the
+/// NSError's userInfo, so every rejection built by RNIntuneCore arrives in JS with the
+/// documented string rather than a platform error number.
+static void RNIntuneReject(RCTPromiseRejectBlock reject, NSError *error)
+{
+  NSString *code = error.userInfo[@"code"] ?: RNIntuneErrorNative;
+  reject(code, error.localizedDescription, error);
+}
+
+static void RNIntuneRejectNotConfigured(RCTPromiseRejectBlock reject, NSString *method)
+{
+  NSError *error = [RNIntuneCore
+      errorWithCode:RNIntuneErrorNotConfigured
+            message:[NSString stringWithFormat:
+                                  @"%@ was called before configure() resolved.", method]];
+  RNIntuneReject(reject, error);
+}
+
+/// `authMode: 'external'` means the host app owns MSAL; signing in here would put a
+/// second instance and a second cache in one binary (SPEC §3.2).
+static void RNIntuneRejectExternalAuth(RCTPromiseRejectBlock reject, NSString *method)
+{
+  NSError *error = [RNIntuneCore
+      errorWithCode:RNIntuneErrorExternalAuthMode
+            message:[NSString stringWithFormat:
+                                  @"%@ is unavailable in authMode 'external'. The host "
+                                  @"app owns MSAL there; supply the account id to "
+                                  @"enroll() and answer tokenRequest via "
+                                  @"setTokenProvider.",
+                                  method]];
+  RNIntuneReject(reject, error);
+}
+
+/// Every auth method needs the same three checks in the same order. Returns nil when the
+/// caller may proceed, or the rejection has already been sent.
+static BOOL RNIntuneAuthReady(RCTPromiseRejectBlock reject, NSString *method)
+{
+  if (!RNIntuneCore.shared.isConfigured) {
+    RNIntuneRejectNotConfigured(reject, method);
+    return NO;
+  }
+  if (!RNIntuneCore.shared.builtinAuth) {
+    RNIntuneRejectExternalAuth(reject, method);
+    return NO;
+  }
+  return YES;
+}
+
+/// Answers one auth call: a result resolves, an error rejects with its stable code.
+static RNIntuneAuthCompletion RNIntuneAuthHandler(RCTPromiseResolveBlock resolve,
+                                                  RCTPromiseRejectBlock reject)
+{
+  return ^(NSDictionary<NSString *, id> *result, NSError *error) {
+    if (result != nil) {
+      resolve(result);
+      return;
+    }
+    RNIntuneReject(reject, error);
+  };
+}
+
+@implementation RNIntune {
+  /// Events emitted before JS subscribed. Flushed in startObserving.
+  NSMutableArray<NSDictionary *> *_pendingEvents;
+  BOOL _observing;
+}
+
+// Generates +moduleName. The argument must match TurboModuleRegistry.getEnforcing in
+// src/NativeIntune.ts (SPEC §2.2) — do not also declare +moduleName by hand, the macro
+// already does and the duplicate does not compile.
+RCT_EXPORT_MODULE(RNIntune)
+
+- (instancetype)init
+{
+  if ((self = [super init])) {
+    _pendingEvents = [NSMutableArray new];
+    _observing = NO;
+
+    // Wired here, not in configure(): the SDK can call a delegate before the app has
+    // called anything, and an event lost during startup means the reset machine never
+    // runs (SPEC §4.4). sendEventWithName: queues while nothing is listening.
+    __weak __typeof(self) weakSelf = self;
+    [RNIntuneCore.shared setEventSink:^(NSString *event, NSDictionary *body) {
+      // The SDK picks its own thread; RCTEventEmitter must be driven from the JS queue.
+      dispatch_async(dispatch_get_main_queue(), ^{
+        [weakSelf sendEventWithName:event body:body];
+      });
+    }];
+  }
+  return self;
+}
+
++ (BOOL)requiresMainQueueSetup
+{
+  // Construction only allocates the queue. The SDK's own initialisation is triggered by
+  // configure(), not by module creation, so there is no reason to block app startup.
+  return NO;
+}
+
+#pragma mark - Events
+
+- (NSArray<NSString *> *)supportedEvents
+{
+  return @[
+    RNIntuneEventEnrollmentResult,
+    RNIntuneEventPolicyChanged,
+    RNIntuneEventUnenrollmentResult,
+    RNIntuneEventWipeRequested,
+    RNIntuneEventRestartRequired,
+    RNIntuneEventTokenRequest,
+    RNIntuneEventBrokerStatusChanged,
+  ];
+}
+
+- (void)startObserving
+{
+  _observing = YES;
+
+  // A wipe notification lost during startup means the reset machine never runs, so
+  // anything emitted before this point is replayed rather than discarded (SPEC §4.4).
+  NSArray<NSDictionary *> *queued = [_pendingEvents copy];
+  [_pendingEvents removeAllObjects];
+  for (NSDictionary *event in queued) {
+    [super sendEventWithName:event[@"name"] body:event[@"body"]];
+  }
+}
+
+- (void)stopObserving
+{
+  _observing = NO;
+}
+
+- (void)sendEventWithName:(NSString *)name body:(id)body
+{
+  if (_observing) {
+    [super sendEventWithName:name body:body];
+    return;
+  }
+  [_pendingEvents addObject:@{@"name" : name, @"body" : body ?: NSNull.null}];
+}
+
+#pragma mark - Lifecycle
+
+- (void)configure:(JS::NativeIntune::SpecConfigureConfig &)config
+          resolve:(RCTPromiseResolveBlock)resolve
+           reject:(RCTPromiseRejectBlock)reject
+{
+  // The generated struct is a typed view over the NSDictionary, so a renamed spec field
+  // fails to compile here instead of silently reading nil. Everything crossing into the
+  // .m core below is a plain ObjC type.
+  RNIntuneConfig *resolved = [RNIntuneConfig new];
+  resolved.clientId = config.clientId();
+  resolved.tenantId = config.tenantId();
+  resolved.authority = config.authority();
+  resolved.redirectUri = config.redirectUri();
+  resolved.authMode = config.authMode();
+  resolved.maxFileProtectionLevel = config.maxFileProtectionLevel();
+  resolved.keychainGroupOverride = config.keychainGroupOverride();
+  resolved.verboseLogging = config.verboseLogging();
+  resolved.restartHandledByApp = config.restartHandledByApp();
+  resolved.telemetryEnabled = config.telemetryEnabled();
+  resolved.brandingBackground = config.brandingBackground();
+  resolved.brandingForeground = config.brandingForeground();
+  resolved.brandingAccent = config.brandingAccent();
+  resolved.brandingSecondaryBackground = config.brandingSecondaryBackground();
+  resolved.brandingSecondaryForeground = config.brandingSecondaryForeground();
+
+  NSError *error = nil;
+  if (![RNIntuneCore.shared applyConfig:resolved error:&error]) {
+    RNIntuneReject(reject, error);
+    return;
+  }
+  resolve(nil);
+}
+
+- (void)isSupported:(RCTPromiseResolveBlock)resolve reject:(RCTPromiseRejectBlock)reject
+{
+  resolve(@(RNIntuneCore.shared.sdkAvailable));
+}
+
+- (void)getBrokerStatus:(RCTPromiseResolveBlock)resolve
+                 reject:(RCTPromiseRejectBlock)reject
+{
+  resolve([RNIntuneCore.shared brokerStatus]);
+}
+
+- (void)openBrokerInstall:(RCTPromiseResolveBlock)resolve
+                   reject:(RCTPromiseRejectBlock)reject
+{
+  NSDictionary *status = [RNIntuneCore.shared brokerStatus];
+  if ([status[@"brokerAvailable"] boolValue]) {
+    RNIntuneReject(reject,
+                   [RNIntuneCore errorWithCode:RNIntuneErrorNotNeeded
+                                       message:@"A broker is already installed."]);
+    return;
+  }
+
+  // A search URL rather than a hardcoded App Store id. The numeric id for Authenticator
+  // is well known but is not something this repository has verified, and a wrong one
+  // sends users to the wrong app — CLAUDE.md rule 1 applies to store identifiers too.
+  NSURL *url = [NSURL
+      URLWithString:@"itms-apps://apps.apple.com/search?term=Microsoft%20Authenticator"];
+
+  dispatch_async(dispatch_get_main_queue(), ^{
+    [UIApplication.sharedApplication openURL:url
+                                     options:@{}
+                           completionHandler:^(BOOL success) {
+                             if (success) {
+                               resolve(nil);
+                             } else {
+                               RNIntuneReject(
+                                   reject,
+                                   [RNIntuneCore
+                                       errorWithCode:RNIntuneErrorNative
+                                             message:@"Could not open the App Store."]);
+                             }
+                           }];
+  });
+}
+
+#pragma mark - Auth
+
+/// These five take `Object` in the Codegen spec, so the values arrive untyped and are
+/// read defensively here. `index.ts` has already narrowed and defaulted them
+/// (CLAUDE.md rule 11) — this is the second line of defence, not the first.
+static NSArray<NSString *> *RNIntuneScopes(NSDictionary *params)
+{
+  id scopes = params[@"scopes"];
+  return [scopes isKindOfClass:NSArray.class] ? scopes : @[];
+}
+
+static NSString *RNIntuneOptionalString(NSDictionary *params, NSString *key)
+{
+  id value = params[key];
+  return [value isKindOfClass:NSString.class] && [value length] > 0 ? value : nil;
+}
+
+- (void)signIn:(NSDictionary *)params
+       resolve:(RCTPromiseResolveBlock)resolve
+        reject:(RCTPromiseRejectBlock)reject
+{
+  if (!RNIntuneAuthReady(reject, @"signIn")) {
+    return;
+  }
+  [RNIntuneCore.shared.auth
+      signInWithScopes:RNIntuneScopes(params)
+             loginHint:RNIntuneOptionalString(params, @"loginHint")
+                prompt:RNIntuneOptionalString(params, @"prompt")
+      presentingController:RCTPresentedViewController()
+            completion:RNIntuneAuthHandler(resolve, reject)];
+}
+
+- (void)signInSilent:(NSDictionary *)params
+             resolve:(RCTPromiseResolveBlock)resolve
+              reject:(RCTPromiseRejectBlock)reject
+{
+  if (!RNIntuneAuthReady(reject, @"signInSilent")) {
+    return;
+  }
+  [RNIntuneCore.shared.auth
+      signInSilentWithScopes:RNIntuneScopes(params)
+                   accountId:RNIntuneOptionalString(params, @"accountId")
+                  completion:RNIntuneAuthHandler(resolve, reject)];
+}
+
+- (void)acquireToken:(NSDictionary *)params
+             resolve:(RCTPromiseResolveBlock)resolve
+              reject:(RCTPromiseRejectBlock)reject
+{
+  if (!RNIntuneAuthReady(reject, @"acquireToken")) {
+    return;
+  }
+  id forceRefresh = params[@"forceRefresh"];
+  [RNIntuneCore.shared.auth
+      acquireTokenWithScopes:RNIntuneScopes(params)
+                   accountId:RNIntuneOptionalString(params, @"accountId")
+                forceRefresh:[forceRefresh isKindOfClass:NSNumber.class]
+                                 ? [forceRefresh boolValue]
+                                 : NO
+                  completion:RNIntuneAuthHandler(resolve, reject)];
+}
+
+- (void)getAccounts:(RCTPromiseResolveBlock)resolve reject:(RCTPromiseRejectBlock)reject
+{
+  if (!RNIntuneAuthReady(reject, @"getAccounts")) {
+    return;
+  }
+  NSError *error = nil;
+  NSArray *accounts = [RNIntuneCore.shared.auth accountsWithError:&error];
+  if (accounts == nil) {
+    RNIntuneReject(reject, error);
+    return;
+  }
+  resolve(accounts);
+}
+
+- (void)signOut:(JS::NativeIntune::SpecSignOutParams &)params
+        resolve:(RCTPromiseResolveBlock)resolve
+         reject:(RCTPromiseRejectBlock)reject
+{
+  if (!RNIntuneAuthReady(reject, @"signOut")) {
+    return;
+  }
+
+  NSString *accountId = params.accountId();
+  BOOL wipeIntune = params.wipeIntune();
+
+  // Off the main thread whenever a wipe is involved: the unregister inside the reset
+  // sequence blocks while it acquires the Intune AAD token (SPEC §5.3, §12.5).
+  dispatch_async(dispatch_get_global_queue(QOS_CLASS_USER_INITIATED, 0), ^{
+    if (wipeIntune) {
+      // The order is the whole point of doing this in one place: unregister first, then
+      // clear MSAL. Reversed, the unregister loses the token it needs and leaves the
+      // account registered — which is what the host app could not reliably sequence back
+      // when MSAL lived on its side (SPEC §13.1.1).
+      [RNIntuneCore.shared resetWithWipe:YES reason:@"logout"];
+      resolve(nil);
+      return;
+    }
+
+    NSError *error = nil;
+    if (![RNIntuneCore.shared.auth removeAccountId:accountId error:&error]) {
+      RNIntuneReject(reject, error);
+      return;
+    }
+    resolve(nil);
+  });
+}
+
+#pragma mark - Enrollment
+
+- (void)enroll:(JS::NativeIntune::SpecEnrollParams &)params
+       resolve:(RCTPromiseResolveBlock)resolve
+        reject:(RCTPromiseRejectBlock)reject
+{
+  if (!RNIntuneCore.shared.isConfigured) {
+    RNIntuneRejectNotConfigured(reject, @"enroll");
+    return;
+  }
+
+  NSString *accountId = params.accountId();
+  if (accountId.length == 0) {
+    RNIntuneReject(reject,
+                   [RNIntuneCore errorWithCode:RNIntuneErrorInvalidAccountId
+                                       message:@"enroll() requires an Entra object ID."]);
+    return;
+  }
+
+  // Resolves for every outcome including failures — a non-success status is data, not an
+  // exception (SPEC §13.2). It only rejects for the programming errors above.
+  [RNIntuneCore.shared enrollAccountId:accountId
+                            completion:^(NSDictionary<NSString *, id> *result) {
+                              resolve(result);
+                            }];
+}
+
+- (void)enrollInteractive:(JS::NativeIntune::SpecEnrollInteractiveParams &)params
+                  resolve:(RCTPromiseResolveBlock)resolve
+                   reject:(RCTPromiseRejectBlock)reject
+{
+  if (!RNIntuneCore.shared.isConfigured) {
+    RNIntuneRejectNotConfigured(reject, @"enrollInteractive");
+    return;
+  }
+  [RNIntuneCore.shared
+      enrollInteractiveWithUpn:params.upn()
+                    completion:^(NSDictionary<NSString *, id> *result) {
+                      resolve(result);
+                    }];
+}
+
+- (void)getState:(RCTPromiseResolveBlock)resolve reject:(RCTPromiseRejectBlock)reject
+{
+  // Deliberately never rejects: reporting `configured: false` is what makes this the
+  // reconciliation primitive (SPEC §13.2).
+  resolve([RNIntuneCore.shared state]);
+}
+
+- (void)reset:(JS::NativeIntune::SpecResetParams &)params
+      resolve:(RCTPromiseResolveBlock)resolve
+       reject:(RCTPromiseRejectBlock)reject
+{
+  BOOL wipe = params.wipe();
+  NSString *reason = params.reason();
+
+  // deRegisterAndUnenrollAccountId: blocks while it acquires the Intune AAD token, so it
+  // can never run on the main thread (SPEC §5.3, §12.5).
+  dispatch_async(dispatch_get_global_queue(QOS_CLASS_USER_INITIATED, 0), ^{
+    [RNIntuneCore.shared resetWithWipe:wipe reason:reason];
+    resolve(nil);
+  });
+}
+
+- (void)completeReset:(RCTPromiseResolveBlock)resolve
+               reject:(RCTPromiseRejectBlock)reject
+{
+  if ([RNIntuneCore.shared completeReset]) {
+    resolve(nil);
+    return;
+  }
+  // Left open on purpose: the next launch sees pendingReset and retries. Reporting
+  // success here would strand an account the SDK will keep trying to re-enroll.
+  RNIntuneReject(reject,
+                 [RNIntuneCore errorWithCode:RNIntuneErrorResetInProgress
+                                     message:@"The account is still registered after "
+                                             @"reset, so the journal was left open. It "
+                                             @"will be retried on the next launch."]);
+}
+
+#pragma mark - Policy
+
+- (void)getPolicy:(RCTPromiseResolveBlock)resolve reject:(RCTPromiseRejectBlock)reject
+{
+  NSDictionary *snapshot = [RNIntuneCore.shared policySnapshot];
+  if (snapshot == nil) {
+    RNIntuneReject(reject,
+                   [RNIntuneCore errorWithCode:RNIntuneErrorSDKUnavailable
+                                       message:@"The Intune MAM SDK is not linked."]);
+    return;
+  }
+  resolve(snapshot);
+}
+
+- (void)getDiagnostics:(RCTPromiseResolveBlock)resolve
+                reject:(RCTPromiseRejectBlock)reject
+{
+  resolve([RNIntuneCore.shared diagnostics]);
+}
+
+#pragma mark - Token provider
+
+// Not public API — setTokenProvider in index.ts wraps these. The token goes straight to
+// the SDK and is never logged or returned to JS (CLAUDE.md rule 9).
+- (void)resolveToken:(JS::NativeIntune::SpecResolveTokenParams &)params
+{
+  [RNIntuneCore.shared resolveTokenRequest:params.requestId() token:params.token()];
+}
+
+- (void)rejectToken:(JS::NativeIntune::SpecRejectTokenParams &)params
+{
+  [RNIntuneCore.shared rejectTokenRequest:params.requestId() reason:params.reason()];
+}
+
+#pragma mark - TurboModule
+
+- (std::shared_ptr<facebook::react::TurboModule>)getTurboModule:
+    (const facebook::react::ObjCTurboModule::InitParams &)params
+{
+  return std::make_shared<facebook::react::NativeIntuneSpecJSI>(params);
+}
+
+@end

package/ios/RNIntuneAuth.h

@@ -0,0 +1,121 @@
+//
+//  MSAL: the client, sign-in, and tokens for the app's own scopes (SPEC §3, spike S-3).
+//
+//  Pure Objective-C and free of React imports, like every other file on this side of the
+//  boundary — `RNIntune.mm` is the only place that knows about React (CLAUDE.md rule 7).
+//  That is why the presenting view controller arrives as a parameter instead of being
+//  looked up here: finding it is the bridge's job.
+//
+//  Two tokens exist and only one of them leaves this file. The MAM service token is never
+//  returned, never logged, and is not even acquired here — the SDK acquires it itself,
+//  from the cache this object populates (§5.1.3). Everything returned by these methods is
+//  for the *app's* scopes (§3.5, CLAUDE.md rule 9).
+//
+
+#import <Foundation/Foundation.h>
+#import <UIKit/UIKit.h>
+
+NS_ASSUME_NONNULL_BEGIN
+
+/// Completes with an `AuthResult`-shaped dictionary, or an error carrying one of the
+/// stable codes in SPEC §13.6. Never both.
+typedef void (^RNIntuneAuthCompletion)(NSDictionary<NSString *, id> *_Nullable result,
+                                       NSError *_Nullable error);
+
+@interface RNIntuneAuth : NSObject
+
+/**
+ * Builds the MSAL client for one tenant.
+ *
+ * `keychainGroup` is the value resolved from the host app's plist, not from `configure`
+ * (§5.1.4): the Intune SDK's half of this setting has no runtime setter, so the group is
+ * a build-time value and `configure` only asserts agreement. Pass nil to let MSAL keep
+ * its own default, which is already what the Intune SDK expects.
+ *
+ * Returns NO and fills `error` when MSAL rejects the configuration — a malformed
+ * authority URL is the common case, and it is worth failing loudly at `configure` rather
+ * than at the first sign-in.
+ */
+- (BOOL)configureWithClientId:(NSString *)clientId
+                    authority:(NSString *)authority
+                  redirectUri:(NSString *)redirectUri
+                keychainGroup:(nullable NSString *)keychainGroup
+                        error:(NSError *_Nullable *_Nullable)error;
+
+/// Drops the client and forgets the tenant. Called from `reset`, which must leave nothing
+/// pinned to the old tenant (SPEC §7).
+- (void)invalidate;
+
+@property (nonatomic, readonly, getter=isConfigured) BOOL configured;
+
+#pragma mark - Sign-in
+
+/**
+ * Interactive sign-in. Uses the broker when one is present, which also gives device-wide
+ * SSO: a user already signed into another Microsoft app usually gets a token with no
+ * prompt at all.
+ *
+ * `scopes` may be empty — see `defaultScopes`. `prompt` takes the public API's strings
+ * (`selectAccount`, `login`, `consent`, `whenRequired`); anything else falls back to
+ * MSAL's default rather than rejecting, so a future value added to the JS enum cannot
+ * break a shipped native binary.
+ */
+- (void)signInWithScopes:(NSArray<NSString *> *)scopes
+               loginHint:(nullable NSString *)loginHint
+                  prompt:(nullable NSString *)prompt
+    presentingController:(UIViewController *)controller
+              completion:(RNIntuneAuthCompletion)completion;
+
+/// Cache-first. Fails with `E_INTERACTION_REQUIRED` when a prompt is needed — the callers'
+/// pattern is silent first, interactive on that failure.
+- (void)signInSilentWithScopes:(NSArray<NSString *> *)scopes
+                     accountId:(nullable NSString *)accountId
+                    completion:(RNIntuneAuthCompletion)completion;
+
+/// A token for the app's own scopes, for an account that is already signed in.
+- (void)acquireTokenWithScopes:(NSArray<NSString *> *)scopes
+                     accountId:(nullable NSString *)accountId
+                  forceRefresh:(BOOL)forceRefresh
+                    completion:(RNIntuneAuthCompletion)completion;
+
+#pragma mark - Accounts
+
+/**
+ * Accounts with cached refresh tokens, as `AuthAccount` dictionaries.
+ *
+ * Under single identity (SPEC §9) this holds at most one; more than one means state a
+ * reset should have cleared, which is worth surfacing rather than hiding.
+ */
+- (nullable NSArray<NSDictionary<NSString *, id> *> *)accountsWithError:
+    (NSError *_Nullable *_Nullable)error;
+
+/// Removes the account and its tokens from the MSAL cache. This is the half of `reset`
+/// the module could not do while MSAL lived in the host app (SPEC §7 step 4).
+- (BOOL)removeAccountId:(NSString *)accountId error:(NSError *_Nullable *_Nullable)error;
+
+/// Empties the cache of every account. Used by `reset`, which runs without a specific
+/// account in hand once the SDK has already unregistered it.
+- (void)removeAllAccounts;
+
+#pragma mark - Defaults
+
+/**
+ * What `signIn` asks for when the caller names no scopes.
+ *
+ * `https://graph.microsoft.com/User.Read`, because MSAL leaves no cheaper option: it
+ * adds `openid`, `profile` and `offline_access` itself and *rejects* a call that names
+ * them ("reserved scopes and may not be specified"), so a sign-in must ask for some real
+ * resource. `User.Read` is the one Entra grants every new app registration by default,
+ * and the one Microsoft's own samples use for exactly this.
+ *
+ * It is a default, not a requirement — an app with its own API passes its own scopes.
+ * What matters for this module is the side effect either way: the refresh token lands in
+ * the shared cache, and the SDK then acquires the MAM token from it silently (§5.1.3).
+ * The refresh token is per account, not per resource, so which scope got it there does
+ * not affect enrollment.
+ */
+@property (class, nonatomic, readonly) NSArray<NSString *> *defaultScopes;
+
+@end
+
+NS_ASSUME_NONNULL_END