react-native-intune 0.1.2 → 1.0.0-rc.1

package/scripts/lib/edits.mjs

@@ -0,0 +1,329 @@
+/**
+ * The text edits `setup` makes to iOS project files, as pure functions.
+ *
+ * Text, not a parse-and-serialise round trip, for plists and project.pbxproj alike.
+ * `plutil` would have been simpler and it drops comments: React Native's template keeps
+ * "Do not change NSAllowsArbitraryLoads to true, or you will risk app rejection!" inside
+ * Info.plist, and a setup that silently deletes the template's warnings has made a change
+ * nobody asked for. Every function here inserts or replaces the smallest span it can and
+ * leaves the rest of the file byte for byte.
+ *
+ * Each returns the new text, or null when the file does not have the shape the edit
+ * needs. Null becomes "do this by hand" — the same answer as a check without an apply,
+ * which beats an edit landing somewhere it has no effect.
+ */
+
+import crypto from 'node:crypto';
+
+// ---------------------------------------------------------------- plist
+
+/** The top-level dict's closing tag — the last `</dict>` before `</plist>`. */
+function topLevelEnd(xml) {
+  const plist = xml.lastIndexOf('</plist>');
+  const at = plist > -1 ? xml.lastIndexOf('</dict>', plist) : -1;
+  return at > -1 ? at : null;
+}
+
+/** Adds `<key>…</key>` and its value at the end of the top-level dict. */
+export function plistAddKey(xml, key, valueXml) {
+  const at = topLevelEnd(xml);
+  if (at === null) {
+    return null;
+  }
+  const entry = `\t<key>${key}</key>\n${valueXml.replace(/^/gm, '\t')}\n`;
+  return `${xml.slice(0, at)}${entry}${xml.slice(at)}`;
+}
+
+/** The span of the `<array>` that follows a top-level `<key>`, or null. */
+function arrayAfterKey(xml, key) {
+  const m = new RegExp(`<key>${key}</key>\\s*<array>`).exec(xml);
+  if (!m) {
+    return null;
+  }
+  const start = m.index + m[0].length;
+  const end = xml.indexOf('</array>', start);
+  return end > -1 ? { start, end } : null;
+}
+
+/** The indentation the existing items of an array use, or a sensible default. */
+function itemIndent(xml, span, fallback) {
+  return xml.slice(span.start, span.end).match(/\n([ \t]*)</)?.[1] ?? fallback;
+}
+
+/**
+ * Makes `strings` present in the array under `key`, creating the key if it is absent.
+ * Existing entries are left where they are; missing ones are appended.
+ */
+export function plistEnsureStrings(xml, key, strings) {
+  const span = arrayAfterKey(xml, key);
+  if (!span) {
+    if (new RegExp(`<key>${key}</key>`).test(xml)) {
+      return null; // present, but not an array — not ours to reshape
+    }
+    return plistAddKey(
+      xml,
+      key,
+      `<array>\n${strings.map((s) => `\t<string>${s}</string>`).join('\n')}\n</array>`
+    );
+  }
+  const body = xml.slice(span.start, span.end);
+  const missing = strings.filter(
+    (s) => !body.includes(`<string>${s}</string>`)
+  );
+  if (missing.length === 0) {
+    return xml;
+  }
+  const indent = itemIndent(xml, span, '\t\t');
+  const closing = body.match(/\n([ \t]*)$/)?.[0] ?? '\n\t';
+  const trimmed = body.replace(/\s*$/, '');
+  const added = missing.map((s) => `\n${indent}<string>${s}</string>`).join('');
+  return `${xml.slice(0, span.start)}${trimmed}${added}${closing}${xml.slice(span.end)}`;
+}
+
+/**
+ * Adds a URL type carrying `scheme` to CFBundleURLTypes, creating the key if needed.
+ * A scheme already present in any URL type is left alone.
+ */
+export function plistEnsureUrlScheme(xml, scheme) {
+  if (xml.includes(`<string>${scheme}</string>`)) {
+    return xml;
+  }
+  const type = `<dict>\n\t<key>CFBundleURLSchemes</key>\n\t<array>\n\t\t<string>${scheme}</string>\n\t</array>\n</dict>`;
+  const span = arrayAfterKey(xml, 'CFBundleURLTypes');
+  if (!span) {
+    if (/<key>CFBundleURLTypes<\/key>/.test(xml)) {
+      return null;
+    }
+    return plistAddKey(
+      xml,
+      'CFBundleURLTypes',
+      `<array>\n${type.replace(/^/gm, '\t')}\n</array>`
+    );
+  }
+  // The URL types array holds dicts, and `arrayAfterKey` stops at the first </array> —
+  // the inner CFBundleURLSchemes one. Insert right after the opening tag instead, which
+  // needs no knowledge of what follows.
+  const indent = itemIndent(
+    xml,
+    { start: span.start, end: span.start + 200 },
+    '\t\t'
+  );
+  const entry = `\n${type.replace(/^/gm, indent)}`;
+  return `${xml.slice(0, span.start)}${entry}${xml.slice(span.start)}`;
+}
+
+/** Removes `<key>K</key>` and the one value that follows it, wherever it appears. */
+export function plistRemoveKeys(xml, keys) {
+  let next = xml;
+  for (const key of keys) {
+    next = next.replace(
+      new RegExp(
+        `\\n?[ \\t]*<key>${key}</key>\\s*<(string|integer|true|false)\\b[^>]*?(?:/>|>[\\s\\S]*?</\\1>)`,
+        'g'
+      ),
+      ''
+    );
+  }
+  return next;
+}
+
+// ---------------------------------------------------------------- entitlements
+
+/**
+ * The keychain groups in the required order — the app's own first, which is where iOS
+ * writes items that name no group — followed by any the app already had.
+ */
+export function entitlementsWithKeychainGroups(xml, groups) {
+  const fresh = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+</dict>
+</plist>
+`;
+  const source = xml || fresh;
+  const span = arrayAfterKey(source, 'keychain-access-groups');
+  const existing = span
+    ? [
+        ...source
+          .slice(span.start, span.end)
+          .matchAll(/<string>([^<]*)<\/string>/g),
+      ].map((m) => m[1])
+    : [];
+  const ordered = [...groups, ...existing.filter((g) => !groups.includes(g))];
+  const array = `<array>\n${ordered.map((g) => `\t<string>${g}</string>`).join('\n')}\n</array>`;
+  if (!span) {
+    return plistAddKey(source, 'keychain-access-groups', array);
+  }
+  const keyAt = source.lastIndexOf(
+    '<key>keychain-access-groups</key>',
+    span.start
+  );
+  const lineStart = source.lastIndexOf('\n', keyAt) + 1;
+  const indent = source.slice(lineStart, keyAt);
+  const arrayEnd = span.end + '</array>'.length;
+  const replacement = `<key>keychain-access-groups</key>\n${array.replace(/^/gm, indent).trimStart()}`;
+  return `${source.slice(0, keyAt)}${replacement}${source.slice(arrayEnd)}`;
+}
+
+// ---------------------------------------------------------------- project.pbxproj
+
+const object = (isa) =>
+  new RegExp(
+    `(\\w{24})\\s*(?:/\\*[^*]*\\*/)?\\s*=\\s*\\{\\s*isa\\s*=\\s*${isa};([\\s\\S]*?)\\n\\t\\t\\};`,
+    'g'
+  );
+
+/** The XCBuildConfiguration ids of every application target, and those targets' ids. */
+function applicationTargets(pbxproj) {
+  const lists = new Map();
+  for (const [, id, body] of pbxproj.matchAll(object('XCConfigurationList'))) {
+    const ids = body.match(/buildConfigurations\s*=\s*\(([^)]*)\)/)?.[1] ?? '';
+    lists.set(
+      id,
+      [...ids.matchAll(/\w{24}/g)].map((m) => m[0])
+    );
+  }
+  const targets = [];
+  for (const [, id, body] of pbxproj.matchAll(object('PBXNativeTarget'))) {
+    if (
+      !/productType\s*=\s*"com\.apple\.product-type\.application"/.test(body)
+    ) {
+      continue;
+    }
+    const list = body.match(/buildConfigurationList\s*=\s*(\w{24})/)?.[1];
+    targets.push({ id, configs: lists.get(list) ?? [] });
+  }
+  return targets;
+}
+
+/** Applies `change` to the buildSettings body of each configuration id. */
+function editBuildSettings(pbxproj, ids, change) {
+  let next = pbxproj;
+  for (const id of ids) {
+    const re = new RegExp(
+      `(${id}\\s*(?:/\\*[^*]*\\*/)?\\s*=\\s*\\{[\\s\\S]*?buildSettings\\s*=\\s*\\{)([\\s\\S]*?)(\\n\\t\\t\\t\\};)`
+    );
+    next = next.replace(
+      re,
+      (all, open, body, close) => `${open}${change(body)}${close}`
+    );
+  }
+  return next;
+}
+
+/** Sets `key = value;` in a buildSettings body, replacing it or adding it. */
+function setBuildSetting(body, key, value) {
+  const line = new RegExp(`(\\n\\t\\t\\t\\t${key}\\s*=\\s*)[^;]*;`);
+  if (line.test(body)) {
+    return body.replace(line, `$1${value};`);
+  }
+  return `${body}\n\t\t\t\t${key} = ${value};`;
+}
+
+/**
+ * Raises IPHONEOS_DEPLOYMENT_TARGET on every configuration of every application target,
+ * setting it on the target rather than relying on the project level it would otherwise
+ * inherit — which is what Expo's prebuild does, and what doctor reads.
+ */
+export function pbxprojSetDeploymentTarget(pbxproj, version, atLeast) {
+  const targets = applicationTargets(pbxproj);
+  if (targets.length === 0) {
+    return null;
+  }
+  const ids = targets.flatMap((t) => t.configs);
+  return editBuildSettings(pbxproj, ids, (body) => {
+    const current = body.match(
+      /IPHONEOS_DEPLOYMENT_TARGET\s*=\s*"?([\d.]+)"?;/
+    )?.[1];
+    return current && atLeast(current)
+      ? body
+      : setBuildSetting(body, 'IPHONEOS_DEPLOYMENT_TARGET', version);
+  });
+}
+
+/** Points every application target's configurations at an entitlements file. */
+export function pbxprojSetEntitlements(pbxproj, relativePath) {
+  const targets = applicationTargets(pbxproj);
+  if (targets.length === 0) {
+    return null;
+  }
+  return editBuildSettings(
+    pbxproj,
+    targets.flatMap((t) => t.configs),
+    (body) =>
+      /CODE_SIGN_ENTITLEMENTS\s*=/.test(body)
+        ? body
+        : setBuildSetting(body, 'CODE_SIGN_ENTITLEMENTS', relativePath)
+  );
+}
+
+/**
+ * Adds a Run Script phase that runs Microsoft's IntuneMAMConfigurator, first in every
+ * application target — before Compile Sources, so the plist and entitlements it writes
+ * are in place for the build that follows.
+ */
+export function pbxprojAddConfiguratorPhase(
+  pbxproj,
+  script,
+  id = newObjectId(pbxproj)
+) {
+  if (/IntuneMAMConfigurator/.test(pbxproj)) {
+    return pbxproj;
+  }
+  const targets = applicationTargets(pbxproj);
+  if (targets.length === 0) {
+    return null;
+  }
+  const escaped = script
+    .replace(/\\/g, '\\\\')
+    .replace(/"/g, '\\"')
+    .replace(/\n/g, '\\n');
+  const phase =
+    `\t\t${id} /* Run IntuneMAMConfigurator */ = {\n` +
+    '\t\t\tisa = PBXShellScriptBuildPhase;\n' +
+    '\t\t\talwaysOutOfDate = 1;\n' +
+    '\t\t\tbuildActionMask = 2147483647;\n' +
+    '\t\t\tfiles = (\n\t\t\t);\n' +
+    '\t\t\tinputPaths = (\n\t\t\t);\n' +
+    '\t\t\tname = "Run IntuneMAMConfigurator";\n' +
+    '\t\t\toutputPaths = (\n\t\t\t);\n' +
+    '\t\t\trunOnlyForDeploymentPostprocessing = 0;\n' +
+    '\t\t\tshellPath = /bin/sh;\n' +
+    `\t\t\tshellScript = "${escaped}";\n` +
+    '\t\t};\n';
+
+  let next = pbxproj;
+  const section = '/* Begin PBXShellScriptBuildPhase section */\n';
+  if (next.includes(section)) {
+    next = next.replace(section, `${section}${phase}`);
+  } else {
+    const anchor = '/* Begin PBXSourcesBuildPhase section */';
+    if (!next.includes(anchor)) {
+      return null;
+    }
+    next = next.replace(
+      anchor,
+      `${section}${phase}/* End PBXShellScriptBuildPhase section */\n\n${anchor}`
+    );
+  }
+  for (const t of targets) {
+    next = next.replace(
+      new RegExp(
+        `(${t.id}\\s*(?:/\\*[^*]*\\*/)?\\s*=\\s*\\{[\\s\\S]*?buildPhases\\s*=\\s*\\(\\n)`
+      ),
+      `$1\t\t\t\t${id} /* Run IntuneMAMConfigurator */,\n`
+    );
+  }
+  return next;
+}
+
+/** A 24-hex-digit object id, the form Xcode uses, not already in the file. */
+function newObjectId(pbxproj) {
+  for (;;) {
+    const id = crypto.randomBytes(12).toString('hex').toUpperCase();
+    if (!pbxproj.includes(id)) {
+      return id;
+    }
+  }
+}

package/scripts/lib/project.mjs

@@ -178,11 +178,24 @@ function walk(dir, onFile, depth = 0) {
   }
 }
 
+/**
+ * Edits `setup` has decided on but not yet written, by path.
+ *
+ * Several checks change the same file — three edit Info.plist, three project.pbxproj —
+ * and each computes its edit from what it reads. Reading through this means the second
+ * edit starts from the first one's result instead of from the original file, which it
+ * would otherwise silently overwrite.
+ */
+export const pending = new Map();
+
 /** Reads a file, or returns an empty string. Callers treat absent and empty alike. */
 export function read(file) {
   if (!file) {
     return '';
   }
+  if (pending.has(file)) {
+    return pending.get(file);
+  }
   try {
     return fs.readFileSync(file, 'utf8');
   } catch {

package/scripts/setup.mjs

@@ -20,7 +20,8 @@
 
 import fs from 'node:fs';
 import readline from 'node:readline';
-import { findProject, rel } from './lib/project.mjs';
+import path from 'node:path';
+import { findProject, pending, rel } from './lib/project.mjs';
 import { gitIsClean, runChecks, summarise } from './doctor.mjs';
 
 const args = process.argv.slice(2);
@@ -37,7 +38,8 @@ async function main() {
     const project = findProject();
     const s = summarise(runChecks(project));
     report(project, s);
-    process.exit(s.blocking.length > 0 ? 1 : 0);
+    process.exitCode = s.blocking.length > 0 ? 1 : 0;
+    return;
   }
 
   const project = findProject();
@@ -51,6 +53,26 @@ async function main() {
     );
   }
 
+  // Under Expo, android/ and ios/ are generated by prebuild and regenerated by the next
+  // one, so everything written here would vanish without a trace. The config plugin is
+  // the same edits, applied where they survive.
+  const pkg = (() => {
+    try {
+      return JSON.parse(fs.readFileSync(path.join(project.root, 'package.json'), 'utf8'));
+    } catch {
+      return {};
+    }
+  })();
+  if ((pkg.dependencies?.expo || pkg.devDependencies?.expo) && !flags.force) {
+    fail(
+      `This is an Expo project. Its android/ and ios/ directories are generated by\n` +
+        `\`expo prebuild\`, so the next prebuild would overwrite anything written here.\n\n` +
+        `Add the config plugin to app.json instead and run prebuild:\n\n` +
+        `  "plugins": [["react-native-intune", { "androidSignatureHash": "…" }]]\n\n` +
+        `doctor still works here, for checking what prebuild produced.`
+    );
+  }
+
   if (!project.android && !project.ios) {
     fail(
       `No native project found under ${project.root}.\n` +
@@ -75,16 +97,37 @@ async function main() {
   const results = runChecks(project);
   const s = summarise(results);
 
-  const edits = [];
+  // Applied one after another through `pending`, so each edit reads the ones before it.
+  // One check may change several files — creating the entitlements file and pointing the
+  // Xcode target at it — and several checks may change the same one.
+  const originals = new Map();
+  const reasons = new Map();
   for (const r of s.failing) {
     if (typeof r.check.apply !== 'function') {
       continue;
     }
-    const edit = r.check.apply(project);
-    if (edit) {
-      edits.push({ ...edit, check: r.check, before: fs.readFileSync(edit.file, 'utf8') });
+    const result = r.check.apply(project);
+    for (const edit of [result].flat().filter(Boolean)) {
+      if (!originals.has(edit.file)) {
+        originals.set(
+          edit.file,
+          fs.existsSync(edit.file) ? fs.readFileSync(edit.file, 'utf8') : null
+        );
+      }
+      pending.set(edit.file, edit.contents);
+      reasons.set(edit.file, [...(reasons.get(edit.file) ?? []), r.check.title]);
     }
   }
+  const edits = [...originals]
+    .map(([file, before]) => ({
+      file,
+      before: before ?? '',
+      created: before === null,
+      contents: pending.get(file),
+      titles: [...new Set(reasons.get(file))],
+    }))
+    .filter((e) => e.created || e.contents !== e.before);
+  pending.clear();
 
   if (edits.length === 0) {
     process.stdout.write(
@@ -95,16 +138,20 @@ async function main() {
   } else {
     process.stdout.write(`\nThese files will change:\n\n`);
     for (const e of edits) {
-      process.stdout.write(`  ${rel(project, e.file)}  — ${e.check.title}\n`);
+      process.stdout.write(
+        `  ${rel(project, e.file)}${e.created ? ' (new)' : ''}  — ${e.titles.join('; ')}\n`
+      );
       process.stdout.write(diff(e.before, e.contents));
     }
 
     if (!flags.yes && !(await confirm())) {
       process.stdout.write(`\nNothing written.\n\n`);
-      process.exit(1);
+      process.exitCode = 1;
+      return;
     }
 
     for (const e of edits) {
+      fs.mkdirSync(path.dirname(e.file), { recursive: true });
       fs.writeFileSync(e.file, e.contents);
       process.stdout.write(`  wrote ${rel(project, e.file)}\n`);
     }
@@ -115,7 +162,10 @@ async function main() {
   // own apply is a bug worth surfacing here instead of at the next build.
   const after = summarise(runChecks(findProject()));
   report(project, after, { afterApply: true });
-  process.exit(after.blocking.length > 0 ? 1 : 0);
+  // An exit code, not process.exit(): on macOS a write to a pipe is asynchronous, and
+  // exiting straight after the diff cut it off — every file after the project.pbxproj
+  // diff, and every "wrote" line, silently missing whenever setup's output was piped.
+  process.exitCode = after.blocking.length > 0 ? 1 : 0;
 }
 
 function report(project, s, { afterApply = false } = {}) {

package/sdk-lock.json

@@ -1,17 +1,18 @@
 {
   "ios": {
     "repo": "microsoftconnect/ms-intune-app-sdk-ios",
-    "tag": "21.8.0",
-    "fetchedAt": "2026-09-03T10:39:33.572Z",
+    "tag": "21.9.0",
+    "fetchedAt": "2026-09-30T10:58:03.813Z",
     "files": {
-      "ios/IntuneMAMSwift.xcframework": "f38f0f130bd2adf0dd936acb26958f6c6ebc0b2d5a4bf886d4c8c7d4ae0870ab",
-      "ios/IntuneMAMSwiftStub.xcframework": "a03e563feec36f719bfca34b061e590e1c54a03650a3855a8298988e49b9ea9c",
-      "ios/IntuneMAMTelemetry.xcframework": "d4582c8ffa014611cb1c10b5717cf13cdbeeb50e34b67624dc884e194636b3de",
-      "ios/IntuneMAMResources.bundle": "51d6f666efb80eddb6d35467c9d6491b746405a72c8ebe6cde5de5c68e7181f3",
-      "ios/IntuneMAMConfigurator.dmg": "4fc4fbcd6211e62fa355ef1976970e230d806855703f75788727d5dbcb454b61",
+      "ios/IntuneMAMSwift.xcframework": "6100e987caed8d4286056d04c003b71ad7ea15d3523495ab3cf7a3aa7d39565d",
+      "ios/IntuneMAMSwiftStub.xcframework": "b6906db29374ffbd4e8b708975572bc0cb3bb02199e36c61f5b359573175deb8",
+      "ios/IntuneMAMTelemetry.xcframework": "e218e261dbc28a70a390bc249905884a97790560ab4bd0e57633fc548cdef1d9",
+      "ios/IntuneMAMResources.bundle": "3d71e06a0261c4904b8104ef7405bdf22114ed60ccf09b6ab4094cd56199b7dd",
+      "ios/IntuneMAMConfigurator.dmg": "753a563e336e40884d2f30cfaad80663f6bd63a81c5bc53c5a232c49bec6ab07",
+      "ios/IntuneMAMConfigurator": "b8c747c49b114ad6171820edcf7562bcd43831c1da4dbdfcb6993c81c5136c72",
       "ios/REDIST.txt": "31c5b0e0c3ee48b60c6f12e56d5a8b6d47754f127750f27627800d2b44b79e56",
       "ios/Microsoft License Terms Intune App SDK for iOS.pdf": "5b12b9a6ee3671a138b67884ff69c5bda17b6cb7bec0646f108cf072930c7394",
-      "ios/ThirdPartyNotices.txt": "aa0bbc665cfd7b7549b05c3bd747faa5d383c1ea4a297fb4dc33184180e3663f"
+      "ios/ThirdPartyNotices.txt": "f99b09285acd2944c0dde5773f68cfa1179e8a743e0e6ba913d1f688a79d439f"
     }
   },
   "android": {