react-native-intune 0.1.0-alpha.1

package/ios/RNIntuneAuth.m

@@ -0,0 +1,390 @@
+//
+//  Copyright (c) 2026 react-native-intune contributors. MIT.
+//
+
+#import "RNIntuneAuth.h"
+#import "RNIntuneCore.h"
+
+#import <MSAL/MSAL.h>
+
+/// The scope a sign-in falls back to. See the note on `defaultScopes` in the header for
+/// why this cannot be `openid profile offline_access`.
+static NSString *const RNIntuneDefaultScope = @"https://graph.microsoft.com/User.Read";
+
+@implementation RNIntuneAuth {
+  MSALPublicClientApplication *_client;
+}
+
++ (NSArray<NSString *> *)defaultScopes
+{
+  return @[ RNIntuneDefaultScope ];
+}
+
+#pragma mark - Configuration
+
+- (BOOL)configureWithClientId:(NSString *)clientId
+                    authority:(NSString *)authority
+                  redirectUri:(NSString *)redirectUri
+                keychainGroup:(NSString *)keychainGroup
+                        error:(NSError **)error
+{
+  NSURL *authorityUrl = [NSURL URLWithString:authority];
+  if (authorityUrl == nil) {
+    if (error != NULL) {
+      *error = [RNIntuneCore
+          errorWithCode:RNIntuneErrorNative
+                message:@"The authority is not a valid URL. Expected something like "
+                        @"https://login.microsoftonline.com/<tenantId>."];
+    }
+    return NO;
+  }
+
+  NSError *authorityError = nil;
+  MSALAADAuthority *aadAuthority = [[MSALAADAuthority alloc] initWithURL:authorityUrl
+                                                                  error:&authorityError];
+  if (aadAuthority == nil) {
+    if (error != NULL) {
+      *error = [RNIntuneCore
+          errorWithCode:RNIntuneErrorNative
+                message:[NSString stringWithFormat:@"MSAL rejected the authority: %@",
+                                                   authorityError
+                                                       .localizedDescription
+                                                   ?: @"unknown reason"]];
+    }
+    return NO;
+  }
+
+  MSALPublicClientApplicationConfig *config =
+      [[MSALPublicClientApplicationConfig alloc] initWithClientId:clientId
+                                                     redirectUri:redirectUri
+                                                       authority:aadAuthority];
+
+  // Only when the host plist asked for one. MSAL's own default is already
+  // `com.microsoft.adalcache`, which is what the Intune SDK looks in — writing that
+  // constant here by hand would just be a second place for it to drift (§5.1.4).
+  if (keychainGroup.length > 0) {
+    config.cacheConfig.keychainSharingGroup = keychainGroup;
+  }
+
+  NSError *clientError = nil;
+  MSALPublicClientApplication *client =
+      [[MSALPublicClientApplication alloc] initWithConfiguration:config error:&clientError];
+  if (client == nil) {
+    if (error != NULL) {
+      // The usual cause is a redirect URI that does not match the required
+      // `msauth.<bundle id>` format, or a missing keychain-sharing entitlement — both
+      // were real failures on device before the example app was fixed (§5.1.2).
+      *error = [RNIntuneCore
+          errorWithCode:RNIntuneErrorNative
+                message:[NSString
+                            stringWithFormat:@"MSAL could not be initialised: %@",
+                                             clientError.localizedDescription
+                                                 ?: @"unknown reason"]];
+    }
+    return NO;
+  }
+
+  _client = client;
+  return YES;
+}
+
+- (void)invalidate
+{
+  _client = nil;
+}
+
+- (BOOL)isConfigured
+{
+  return _client != nil;
+}
+
+#pragma mark - Sign-in
+
+- (void)signInWithScopes:(NSArray<NSString *> *)scopes
+               loginHint:(NSString *)loginHint
+                  prompt:(NSString *)prompt
+    presentingController:(UIViewController *)controller
+              completion:(RNIntuneAuthCompletion)completion
+{
+  MSALPublicClientApplication *client = _client;
+  if (client == nil) {
+    completion(nil, [self notConfiguredError]);
+    return;
+  }
+
+  MSALWebviewParameters *webParams =
+      [[MSALWebviewParameters alloc] initWithAuthPresentationViewController:controller];
+
+  MSALInteractiveTokenParameters *params =
+      [[MSALInteractiveTokenParameters alloc] initWithScopes:[self resolveScopes:scopes]
+                                          webviewParameters:webParams];
+  params.promptType = [self promptTypeFromString:prompt];
+  if (loginHint.length > 0) {
+    params.loginHint = loginHint;
+  }
+
+  // MSAL requires the interactive call on the main thread, and it presents UI.
+  dispatch_async(dispatch_get_main_queue(), ^{
+    [client acquireTokenWithParameters:params
+                      completionBlock:^(MSALResult *result, NSError *error) {
+                        [self complete:completion result:result error:error];
+                      }];
+  });
+}
+
+- (void)signInSilentWithScopes:(NSArray<NSString *> *)scopes
+                     accountId:(NSString *)accountId
+                    completion:(RNIntuneAuthCompletion)completion
+{
+  [self acquireTokenWithScopes:scopes
+                    accountId:accountId
+                 forceRefresh:NO
+                   completion:completion];
+}
+
+- (void)acquireTokenWithScopes:(NSArray<NSString *> *)scopes
+                     accountId:(NSString *)accountId
+                  forceRefresh:(BOOL)forceRefresh
+                    completion:(RNIntuneAuthCompletion)completion
+{
+  MSALPublicClientApplication *client = _client;
+  if (client == nil) {
+    completion(nil, [self notConfiguredError]);
+    return;
+  }
+
+  NSError *lookupError = nil;
+  MSALAccount *account = [self accountForId:accountId error:&lookupError];
+  if (account == nil) {
+    // Not a fault. With no cached account there is nothing to refresh silently, and the
+    // caller's next move is the same as for an expired token: sign in interactively.
+    completion(nil,
+               lookupError ?: [RNIntuneCore
+                                  errorWithCode:RNIntuneErrorInteractionRequired
+                                        message:@"No signed-in account is cached. Call "
+                                                @"signIn to acquire one."]);
+    return;
+  }
+
+  MSALSilentTokenParameters *params =
+      [[MSALSilentTokenParameters alloc] initWithScopes:[self resolveScopes:scopes]
+                                               account:account];
+  params.forceRefresh = forceRefresh;
+
+  [client acquireTokenSilentWithParameters:params
+                          completionBlock:^(MSALResult *result, NSError *error) {
+                            [self complete:completion result:result error:error];
+                          }];
+}
+
+#pragma mark - Accounts
+
+- (NSArray<NSDictionary<NSString *, id> *> *)accountsWithError:(NSError **)error
+{
+  MSALPublicClientApplication *client = _client;
+  if (client == nil) {
+    if (error != NULL) {
+      *error = [self notConfiguredError];
+    }
+    return nil;
+  }
+
+  NSError *msalError = nil;
+  NSArray<MSALAccount *> *accounts = [client allAccounts:&msalError];
+  if (accounts == nil) {
+    if (error != NULL) {
+      *error = [RNIntuneCore errorWithCode:RNIntuneErrorNative
+                                   message:msalError.localizedDescription
+                                           ?: @"MSAL could not list accounts."];
+    }
+    return nil;
+  }
+
+  NSMutableArray<NSDictionary<NSString *, id> *> *out =
+      [NSMutableArray arrayWithCapacity:accounts.count];
+  for (MSALAccount *account in accounts) {
+    [out addObject:@{
+      @"accountId" : [self accountIdFor:account] ?: @"",
+      @"tenantId" : account.homeAccountId.tenantId ?: @"",
+      @"username" : account.username ?: @"",
+    }];
+  }
+  return out;
+}
+
+- (BOOL)removeAccountId:(NSString *)accountId error:(NSError **)error
+{
+  MSALPublicClientApplication *client = _client;
+  if (client == nil) {
+    if (error != NULL) {
+      *error = [self notConfiguredError];
+    }
+    return NO;
+  }
+
+  NSError *lookupError = nil;
+  MSALAccount *account = [self accountForId:accountId error:&lookupError];
+  if (account == nil) {
+    // Already gone is success. `reset` runs this after the SDK has unregistered, and it
+    // must be safe to retry from the journal on the next launch (SPEC §7).
+    if (lookupError != nil && error != NULL) {
+      *error = lookupError;
+      return NO;
+    }
+    return YES;
+  }
+
+  NSError *removeError = nil;
+  if (![client removeAccount:account error:&removeError]) {
+    if (error != NULL) {
+      *error = [RNIntuneCore errorWithCode:RNIntuneErrorNative
+                                   message:removeError.localizedDescription
+                                           ?: @"MSAL could not remove the account."];
+    }
+    return NO;
+  }
+  return YES;
+}
+
+- (void)removeAllAccounts
+{
+  MSALPublicClientApplication *client = _client;
+  if (client == nil) {
+    return;
+  }
+
+  NSArray<MSALAccount *> *accounts = [client allAccounts:NULL];
+  for (MSALAccount *account in accounts) {
+    // Errors are deliberately not propagated: this runs inside the reset sequence, where
+    // the journal's verification decides whether the reset took, not this loop.
+    [client removeAccount:account error:NULL];
+  }
+}
+
+#pragma mark - Helpers
+
+/**
+ * Finds the account by the id this module hands out.
+ *
+ * That id is the Entra object ID, not MSAL's own `identifier` (which is
+ * `<objectId>.<tenantId>`), because the Intune SDK's `registerAndEnrollAccountId:` wants
+ * the object ID — one value has to serve both, so the narrower one wins. Matching is done
+ * over `allAccounts` rather than `accountForIdentifier:` for the same reason: that lookup
+ * takes MSAL's composite identifier, which is not what we store.
+ */
+- (MSALAccount *)accountForId:(NSString *)accountId error:(NSError **)error
+{
+  MSALPublicClientApplication *client = _client;
+  NSError *msalError = nil;
+  NSArray<MSALAccount *> *accounts = [client allAccounts:&msalError];
+  if (accounts == nil) {
+    if (error != NULL) {
+      *error = [RNIntuneCore errorWithCode:RNIntuneErrorNative
+                                   message:msalError.localizedDescription
+                                           ?: @"MSAL could not list accounts."];
+    }
+    return nil;
+  }
+
+  if (accountId.length == 0) {
+    // Single identity is decided (SPEC §9), so "the account" is unambiguous when there is
+    // one. Callers that pass nothing get it rather than an argument error.
+    return accounts.firstObject;
+  }
+
+  for (MSALAccount *account in accounts) {
+    if ([[self accountIdFor:account] isEqualToString:accountId]) {
+      return account;
+    }
+  }
+  return nil;
+}
+
+- (NSString *)accountIdFor:(MSALAccount *)account
+{
+  return account.homeAccountId.objectId;
+}
+
+- (NSArray<NSString *> *)resolveScopes:(NSArray<NSString *> *)scopes
+{
+  return scopes.count > 0 ? scopes : RNIntuneAuth.defaultScopes;
+}
+
+- (MSALPromptType)promptTypeFromString:(NSString *)prompt
+{
+  if ([prompt isEqualToString:@"selectAccount"]) {
+    return MSALPromptTypeSelectAccount;
+  }
+  if ([prompt isEqualToString:@"login"]) {
+    return MSALPromptTypeLogin;
+  }
+  if ([prompt isEqualToString:@"consent"]) {
+    return MSALPromptTypeConsent;
+  }
+  if ([prompt isEqualToString:@"whenRequired"]) {
+    return MSALPromptTypePromptIfNecessary;
+  }
+  // Including nil. An unknown value must not fail a sign-in: a string added to the JS
+  // enum later would otherwise break every already-shipped native binary.
+  return MSALPromptTypeDefault;
+}
+
+- (NSError *)notConfiguredError
+{
+  return [RNIntuneCore errorWithCode:RNIntuneErrorNotConfigured
+                             message:@"MSAL is not configured. Call configure first."];
+}
+
+/// Shapes an `AuthResult`, or maps MSAL's error onto a stable code. The access token here
+/// is for the app's own scopes; the MAM token never passes through (CLAUDE.md rule 9).
+- (void)complete:(RNIntuneAuthCompletion)completion
+          result:(MSALResult *)result
+           error:(NSError *)error
+{
+  if (result != nil) {
+    completion(@{
+      @"accountId" : [self accountIdFor:result.account] ?: @"",
+      @"tenantId" : result.account.homeAccountId.tenantId ?: @"",
+      @"username" : result.account.username ?: @"",
+      @"accessToken" : result.accessToken,
+      @"idToken" : result.idToken ?: NSNull.null,
+      // Unix seconds, matching AuthResult in SPEC §13.1.1.
+      @"expiresOn" : @(result.expiresOn.timeIntervalSince1970),
+      @"scopes" : result.scopes,
+    },
+               nil);
+    return;
+  }
+
+  completion(nil, [self mapError:error]);
+}
+
+- (NSError *)mapError:(NSError *)error
+{
+  if (error == nil) {
+    return [RNIntuneCore errorWithCode:RNIntuneErrorNative
+                              message:@"MSAL returned neither a result nor an error."];
+  }
+
+  if ([error.domain isEqualToString:MSALErrorDomain]) {
+    switch ((MSALError)error.code) {
+      case MSALErrorInteractionRequired:
+        return [RNIntuneCore
+            errorWithCode:RNIntuneErrorInteractionRequired
+                  message:@"A prompt is required. Call signIn instead of signInSilent."];
+      case MSALErrorUserCanceled:
+        return [RNIntuneCore errorWithCode:RNIntuneErrorUserCancelled
+                                   message:@"The user dismissed the sign-in UI."];
+      default:
+        break;
+    }
+  }
+
+  // Everything else keeps MSAL's own description, which names the cause far better than
+  // a re-worded guess would. No token or claim is ever part of it.
+  return [RNIntuneCore errorWithCode:RNIntuneErrorNative
+                             message:error.localizedDescription
+                                     ?: @"MSAL failed with no description."];
+}
+
+@end

package/ios/RNIntuneCore.h

@@ -0,0 +1,150 @@
+//
+//  Pure Objective-C. Everything that talks to the Intune MAM SDK lives on this side of
+//  the boundary; RNIntune.mm is ObjC++ only because Codegen conformance and
+//  getTurboModule: are C++ (SPEC §5.1.1, CLAUDE.md rule 7).
+//
+//  Keep it that way. An enrollment failure should be debuggable across one language
+//  boundary, not two, in a domain with no official React Native support.
+//
+
+#import <Foundation/Foundation.h>
+
+#import "RNIntuneAuth.h"
+
+NS_ASSUME_NONNULL_BEGIN
+
+/// Stable rejection codes (SPEC §13.6). Never surface a raw platform error to JS.
+extern NSString *const RNIntuneErrorNotConfigured;
+extern NSString *const RNIntuneErrorResetRequired;
+extern NSString *const RNIntuneErrorSDKUnavailable;
+extern NSString *const RNIntuneErrorInvalidAccountId;
+extern NSString *const RNIntuneErrorNotNeeded;
+extern NSString *const RNIntuneErrorExternalAuthMode;
+extern NSString *const RNIntuneErrorNative;
+extern NSString *const RNIntuneErrorTokenProviderFailed;
+extern NSString *const RNIntuneErrorTokenProviderMissing;
+extern NSString *const RNIntuneErrorResetInProgress;
+/// MSAL outcomes that are ordinary control flow, not faults (SPEC §13.6).
+extern NSString *const RNIntuneErrorInteractionRequired;
+extern NSString *const RNIntuneErrorUserCancelled;
+/// Raised by the configure-time assertions below. Not in SPEC §13.6 yet — see §12.7 S1.
+extern NSString *const RNIntuneErrorPlistConflict;
+
+/// Event names. Must match the `IntuneEvents` keys in src/types.ts.
+extern NSString *const RNIntuneEventEnrollmentResult;
+extern NSString *const RNIntuneEventPolicyChanged;
+extern NSString *const RNIntuneEventUnenrollmentResult;
+extern NSString *const RNIntuneEventWipeRequested;
+extern NSString *const RNIntuneEventRestartRequired;
+extern NSString *const RNIntuneEventTokenRequest;
+extern NSString *const RNIntuneEventBrokerStatusChanged;
+
+/// Resolved configuration. `index.ts` applies every default, so nothing here is optional.
+@interface RNIntuneConfig : NSObject
+@property (nonatomic, copy) NSString *clientId;
+@property (nonatomic, copy) NSString *tenantId;
+@property (nonatomic, copy) NSString *authority;
+@property (nonatomic, copy) NSString *redirectUri;
+@property (nonatomic, copy) NSString *authMode;
+@property (nonatomic, copy) NSString *maxFileProtectionLevel;
+/// Empty string means "use the platform default" (`com.microsoft.adalcache`).
+@property (nonatomic, copy) NSString *keychainGroupOverride;
+@property (nonatomic) BOOL verboseLogging;
+@property (nonatomic) BOOL restartHandledByApp;
+@property (nonatomic) BOOL telemetryEnabled;
+/// Hex strings for the SDK's own screens; empty means "leave Microsoft's default".
+@property (nonatomic, copy) NSString *brandingBackground;
+@property (nonatomic, copy) NSString *brandingForeground;
+@property (nonatomic, copy) NSString *brandingAccent;
+@property (nonatomic, copy) NSString *brandingSecondaryBackground;
+@property (nonatomic, copy) NSString *brandingSecondaryForeground;
+@end
+
+@interface RNIntuneCore : NSObject
+
++ (instancetype)shared;
+
+/// Set once, before configure. Publishes SDK events to JS.
+- (void)setEventSink:(void (^)(NSString *event, NSDictionary *body))sink;
+
+/// YES when the MAM SDK is actually linked into the binary. Checked by class lookup so a
+/// misbuilt binary degrades instead of crashing.
+@property (nonatomic, readonly) BOOL sdkAvailable;
+
+@property (nonatomic, readonly, getter=isConfigured) BOOL configured;
+@property (nonatomic, readonly, nullable) NSString *configuredTenantId;
+
+/// NO in `authMode: 'external'`, where the host app owns MSAL and the module performs no
+/// sign-in at all (SPEC §3.2).
+@property (nonatomic, readonly) BOOL builtinAuth;
+
+/// MSAL. Configured only in `builtin` mode; `isConfigured` is NO otherwise.
+@property (nonatomic, readonly) RNIntuneAuth *auth;
+
+/// Applies the runtime overrides, installs the delegates, and runs the configure-time
+/// assertions. Returns NO and fills `error` on `E_RESET_REQUIRED` (different tenant),
+/// `E_SDK_UNAVAILABLE`, or `E_PLIST_CONFLICT`.
+- (BOOL)applyConfig:(RNIntuneConfig *)config error:(NSError *_Nullable *_Nullable)error;
+
+/// BrokerStatus (SPEC §13.1). Answerable before `configure`, on purpose: the app needs
+/// it to decide whether to prompt for a broker install.
+- (NSDictionary<NSString *, id> *)brokerStatus;
+
+/// IntuneState (SPEC §4.2). Never rejects — reporting `configured: false` is the whole
+/// point of the reconciliation primitive.
+- (NSDictionary<NSString *, id> *)state;
+
+/// Diagnostics (SPEC §13.3). No tokens, no UPNs — safe to attach to a support ticket.
+- (NSDictionary<NSString *, NSString *> *)diagnostics;
+
+#pragma mark - Enrollment
+
+/**
+ * Registers and enrolls the account, completing with an `EnrollmentResult`.
+ *
+ * `registerAndEnrollAccountId:` returns immediately and says nothing; the outcome arrives
+ * later on `enrollmentRequestWithStatus:`. So the completion is held against the account
+ * ID and fired from the delegate (SPEC §12.5) — never from the call returning.
+ *
+ * Completes for every outcome, including failures: a non-success status is data, not an
+ * error. If the SDK says nothing at all within the timeout it completes with `pending`,
+ * which is truthful — the SDK keeps retrying on its own schedule and the result will
+ * still arrive as an event.
+ */
+- (void)enrollAccountId:(NSString *)accountId
+             completion:(void (^)(NSDictionary<NSString *, id> *result))completion;
+
+/// PolicySnapshot (SPEC §4.3). Nil when the SDK is not linked.
+- (nullable NSDictionary<NSString *, id> *)policySnapshot;
+
+#pragma mark - Reset (SPEC §7)
+
+/**
+ * Writes the journal, then unregisters and unenrolls.
+ *
+ * **Blocks** while the SDK acquires the Intune AAD token, so it must not run on the main
+ * thread, and it must happen before the host app purges the account's Entra tokens
+ * (SPEC §5.3). The process may not survive it; everything after is driven by the journal.
+ */
+- (void)resetWithWipe:(BOOL)wipe reason:(NSString *)reason;
+
+/// Verifies the account is really gone and closes the journal. Returns NO and leaves the
+/// journal open when it is not, so the next launch retries rather than declaring success.
+- (BOOL)completeReset;
+
+/// iOS-only interactive enrollment: the SDK runs the sign-in and shows its own UI.
+- (void)enrollInteractiveWithUpn:(nullable NSString *)upn
+                      completion:(void (^)(NSDictionary<NSString *, id> *result))completion;
+
+#pragma mark - Token bridge (SPEC §13.4)
+
+/// Answers a pending `tokenRequest`. The token goes to the SDK and never back to JS.
+- (void)resolveTokenRequest:(NSString *)requestId token:(NSString *)token;
+- (void)rejectTokenRequest:(NSString *)requestId reason:(NSString *)reason;
+
+/// Builds an NSError carrying one of the stable codes above.
++ (NSError *)errorWithCode:(NSString *)code message:(NSString *)message;
+
+@end
+
+NS_ASSUME_NONNULL_END