react-native-intune 0.1.1 → 1.0.0-rc.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "react-native-intune",
-  "version": "0.1.1",
+  "version": "1.0.0-rc.1",
   "description": "Microsoft Intune app protection policies (MAM) for React Native",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",
@@ -22,7 +22,7 @@
     "app.plugin.js",
     "plugin",
     "scripts",
-    "!scripts/verify-expo.mjs",
+    "!scripts/verify",
     "sdk-versions.json",
     "sdk-lock.json",
     "!vendor",
@@ -44,7 +44,8 @@
   ],
   "scripts": {
     "fetch-sdks": "node scripts/fetch-sdks.mjs",
-    "verify:expo": "node scripts/verify-expo.mjs",
+    "verify:expo": "node scripts/verify/expo.mjs",
+    "verify:bare": "node scripts/verify/bare.mjs",
     "postinstall": "node scripts/fetch-sdks.mjs --soft --quiet",
     "example": "yarn workspace react-native-intune-example",
     "clean": "del-cli android/build example/android/build example/android/app/build example/ios/build lib",
@@ -100,9 +101,9 @@
     "typescript": "^6.0.3"
   },
   "peerDependencies": {
-    "@expo/config-plugins": ">=7",
+    "@expo/config-plugins": ">=54.0.0",
     "react": "*",
-    "react-native": "*"
+    "react-native": ">=0.74.0"
   },
   "workspaces": [
     "example",
@@ -197,9 +198,7 @@
     ],
     "version": "0.63.0"
   },
-  "bin": {
-    "react-native-intune": "scripts/cli.mjs"
-  },
+  "bin": "scripts/cli.mjs",
   "engines": {
     "node": ">=18"
   },

package/plugin/transforms.js

@@ -27,9 +27,20 @@ intunemam {
 }
 `;
 
-/** Applies the MAM plugin to android/app/build.gradle. */
+/**
+ * Applies the MAM plugin to android/app/build.gradle.
+ *
+ * The guard looks for an actual application at the start of a line, not the plugin id
+ * anywhere: commenting the apply out is the first thing anyone does when the bytecode
+ * rewrite breaks a library, and a guard that read the comment as applied would leave
+ * the app unprotected while `setup` reported success.
+ */
 function withMamPluginApplied(contents) {
-  if (contents.includes('com.microsoft.intune.mam')) {
+  if (
+    /^[ \t]*(?:apply\s+plugin\s*:\s*|id\s*\(?\s*)["']com\.microsoft\.intune\.mam["']/m.test(
+      contents
+    )
+  ) {
     return contents;
   }
   return `${contents.trimEnd()}\n${MAM_PLUGIN_BLOCK}`;
@@ -187,9 +198,151 @@ function addImports(contents, imports) {
   return `${contents.slice(0, at)}\n${missing.join('\n')}${contents.slice(at)}`;
 }
 
+/**
+ * Forwards the sign-in redirect to MSAL from the generated AppDelegate.
+ *
+ * The URL type alone is not enough. When the broker — Authenticator or Company Portal —
+ * finishes, it opens the app with the result, and unless the AppDelegate hands that URL
+ * to MSAL it arrives and is dropped: the sign-in never completes and nothing reports
+ * why. Both halves were needed on a device, and the bare example has always had this
+ * one; the Expo plugin wrote the URL type and not the forward.
+ *
+ * MSAL goes first in the `||` chain, so a redirect meant for it is consumed before
+ * Linking sees it; any other URL falls through unchanged.
+ *
+ * Returns null when there is no `open url` handler to extend — a warning beats an
+ * AppDelegate edited in the wrong place.
+ */
+function withMsalResponseHandler(contents, language) {
+  if (/handleMSALResponse/.test(contents)) {
+    return contents;
+  }
+  const isSwift = language === 'swift';
+
+  const handler = isSwift
+    ? /(func\s+application\s*\(\s*_\s+\w+\s*:\s*UIApplication\s*,\s*open\s+url\s*:\s*URL\s*,\s*options\s*:[^)]*\)\s*->\s*Bool\s*\{\s*\n(\s*)return\s+)/
+    : /(-\s*\(BOOL\)\s*application\s*:\s*\(UIApplication\s*\*\)\s*\w+\s+openURL\s*:\s*\(NSURL\s*\*\)\s*url\s+options\s*:[^{]*\{\s*\n(\s*)return\s+)/;
+  if (!handler.test(contents)) {
+    return withNewMsalResponseHandler(contents, isSwift);
+  }
+  const forward = isSwift
+    ? 'MSALPublicClientApplication.handleMSALResponse(url, sourceApplication: options[.sourceApplication] as? String) || '
+    : '[MSALPublicClientApplication handleMSALResponse:url sourceApplication:options[UIApplicationOpenURLOptionsSourceApplicationKey]] || ';
+  let next = contents.replace(handler, `$1${forward}`);
+
+  const importLine = isSwift ? 'import MSAL' : '#import <MSAL/MSAL.h>';
+  const imports = isSwift
+    ? /^(?:\w+\s+)?import\s+\w+.*$/gm
+    : /^#import\s+.*$/gm;
+  const lastImport = [...next.matchAll(imports)].pop();
+  if (!lastImport) {
+    return null;
+  }
+  const at = lastImport.index + lastImport[0].length;
+  next = `${next.slice(0, at)}\n${importLine}${next.slice(at)}`;
+  return next;
+}
+
+/**
+ * React Native's own templates have no open-URL handler at all — only Expo's does — so
+ * for them the forward is a whole method. It goes at the end of the AppDelegate class,
+ * found by matching braces from the class declaration; string literals and comments are
+ * skipped so a brace in either cannot end the class early.
+ *
+ * No `override`: in these templates the class is a UIResponder conforming to
+ * UIApplicationDelegate, and the method is the protocol's, not a superclass's.
+ */
+function withNewMsalResponseHandler(contents, isSwift) {
+  const importLine = isSwift ? 'import MSAL' : '#import <MSAL/MSAL.h>';
+  let next = contents;
+
+  if (isSwift) {
+    const declaration = /class\s+AppDelegate\b[^{]*\{/.exec(next);
+    if (!declaration) {
+      return null;
+    }
+    const end = matchingBrace(
+      next,
+      declaration.index + declaration[0].length - 1
+    );
+    if (end === null) {
+      return null;
+    }
+    const method = `
+  /// Hands the sign-in result back to MSAL. Without it the broker's reply reaches the app
+  /// and is dropped, and sign-in never completes. Added by react-native-intune setup.
+  func application(
+    _ app: UIApplication,
+    open url: URL,
+    options: [UIApplication.OpenURLOptionsKey: Any] = [:]
+  ) -> Bool {
+    MSALPublicClientApplication.handleMSALResponse(
+      url,
+      sourceApplication: options[.sourceApplication] as? String
+    )
+  }
+`;
+    next = `${next.slice(0, end).replace(/\s*$/, '\n')}${method}${next.slice(end)}`;
+  } else {
+    const implementation = /@implementation\s+AppDelegate\b[^\n]*\n/.exec(next);
+    if (!implementation) {
+      return null;
+    }
+    const at = implementation.index + implementation[0].length;
+    const method = `
+// Hands the sign-in result back to MSAL. Without it the broker's reply reaches the app and
+// is dropped, and sign-in never completes. Added by react-native-intune setup.
+- (BOOL)application:(UIApplication *)application
+            openURL:(NSURL *)url
+            options:(NSDictionary<UIApplicationOpenURLOptionsKey, id> *)options
+{
+  return [MSALPublicClientApplication handleMSALResponse:url
+                                       sourceApplication:options[UIApplicationOpenURLOptionsSourceApplicationKey]];
+}
+`;
+    next = `${next.slice(0, at)}${method}${next.slice(at)}`;
+  }
+
+  const imports = isSwift
+    ? /^(?:\w+\s+)?import\s+\w+.*$/gm
+    : /^#import\s+.*$/gm;
+  const lastImport = [...next.matchAll(imports)].pop();
+  if (!lastImport) {
+    return null;
+  }
+  const at = lastImport.index + lastImport[0].length;
+  return `${next.slice(0, at)}\n${importLine}${next.slice(at)}`;
+}
+
+/** The index of the brace closing the one at `open`, skipping strings and comments. */
+function matchingBrace(src, open) {
+  let depth = 0;
+  for (let i = open; i < src.length; i += 1) {
+    const c = src[i];
+    if (c === '/' && src[i + 1] === '/') {
+      i = src.indexOf('\n', i);
+      if (i === -1) return null;
+    } else if (c === '/' && src[i + 1] === '*') {
+      i = src.indexOf('*/', i + 2) + 1;
+      if (i === 0) return null;
+    } else if (c === '"') {
+      for (i += 1; i < src.length && src[i] !== '"'; i += 1) {
+        if (src[i] === '\\') i += 1;
+      }
+    } else if (c === '{') {
+      depth += 1;
+    } else if (c === '}') {
+      depth -= 1;
+      if (depth === 0) return i;
+    }
+  }
+  return null;
+}
+
 module.exports = {
   MARKER,
   withMamPluginApplied,
   withMamClasspath,
   withMamApplication,
+  withMsalResponseHandler,
 };

package/plugin/withIntune.js

@@ -37,6 +37,7 @@ const {
   createRunOncePlugin,
   withAndroidManifest,
   withAppBuildGradle,
+  withAppDelegate,
   withEntitlementsPlist,
   withInfoPlist,
   withMainApplication,
@@ -48,6 +49,7 @@ const {
   withMamApplication,
   withMamClasspath,
   withMamPluginApplied,
+  withMsalResponseHandler,
 } = require('./transforms');
 
 const pkg = require('../package.json');
@@ -169,6 +171,30 @@ const withMsalUrlScheme = (config, { maxFileProtectionLevel, keychainGroup }) =>
     return c;
   });
 
+/**
+ * The other half of the URL type. Without it the broker's redirect reaches the app and
+ * is dropped, and sign-in never completes — see withMsalResponseHandler.
+ */
+const withMsalRedirectForward = (config) =>
+  withAppDelegate(config, (c) => {
+    const result = withMsalResponseHandler(
+      c.modResults.contents,
+      c.modResults.language
+    );
+    if (result === null) {
+      WarningAggregator.addWarningIOS(
+        MARKER,
+        'Could not forward the MSAL redirect in AppDelegate — no open-URL handler ' +
+          'was recognised. Sign-in through Authenticator or Company Portal will not ' +
+          'return to the app until this is done by hand. Run ' +
+          '`npx react-native-intune doctor` for the exact change.'
+      );
+      return c;
+    }
+    c.modResults.contents = result;
+    return c;
+  });
+
 // ---------------------------------------------------------------- android
 
 const withBrokerQueries = (config) =>
@@ -305,6 +331,7 @@ const withIntune = (config, props = {}) => {
   let next = config;
   next = withKeychainGroups(next, { keychainGroup });
   next = withMsalUrlScheme(next, { maxFileProtectionLevel, keychainGroup });
+  next = withMsalRedirectForward(next);
   next = withBrokerQueries(next);
   next = withRedirectActivity(next, { androidSignatureHash });
   next = withGradle(next);

package/scripts/doctor.mjs

@@ -116,7 +116,8 @@ function main() {
         2
       ) + '\n'
     );
-    process.exit(s.blocking.length > 0 ? 1 : 0);
+    process.exitCode = s.blocking.length > 0 ? 1 : 0;
+    return;
   }
 
   process.stdout.write(`\nreact-native-intune doctor\n${project.root}\n`);
@@ -141,7 +142,7 @@ function main() {
         `licensed for Intune, that an App Protection Policy targets this app, and that\n` +
         `a broker is installed on the device. Enrollment needs all three.\n\n`
     );
-    process.exit(0);
+    return;
   }
 
   if (s.silent.length > 0) {
@@ -182,7 +183,10 @@ function main() {
   }
 
   process.stdout.write('\n');
-  process.exit(s.blocking.length > 0 ? 1 : 0);
+  // An exit code, not process.exit(): on macOS a write to a pipe is asynchronous, and
+  // exiting straight after a long report cut it off mid-way whenever doctor's output was
+  // piped — into a CI log, a file, or `| less`.
+  process.exitCode = s.blocking.length > 0 ? 1 : 0;
 }
 
 /**