refactor(apple): port 'entitlements.rb' to JS

ios/entitlements.mjs

@@ -0,0 +1,70 @@
+// @ts-check
+import * as nodefs from "node:fs";
+import * as path from "node:path";
+import { isObject, toPlist } from "./utils.mjs";
+
+/** @import { ApplePlatform, JSONObject } from "../scripts/types.js"; */
+
+const DEFAULT_IOS_ENTITLEMENTS = {
+  "keychain-access-groups": ["$(AppIdentifierPrefix)com.microsoft.adalcache"],
+};
+
+const DEFAULT_MACOS_ENTITLEMENTS = {
+  "com.apple.security.app-sandbox": true,
+  "com.apple.security.files.user-selected.read-only": true,
+  "com.apple.security.network.client": true,
+};
+
+/**
+ * @param {JSONObject} appConfig
+ * @param {ApplePlatform} targetPlatform
+ * @returns {string | JSONObject | undefined}
+ */
+function getCodeSignEntitlements(appConfig, targetPlatform) {
+  const platformConfig = appConfig[targetPlatform];
+  if (!isObject(platformConfig)) {
+    return;
+  }
+
+  const codeSignEntitlements = platformConfig["codeSignEntitlements"];
+  if (
+    typeof codeSignEntitlements !== "string" &&
+    !isObject(codeSignEntitlements)
+  ) {
+    return;
+  }
+
+  return codeSignEntitlements;
+}
+
+/**
+ * @param {JSONObject} appConfig
+ * @param {ApplePlatform} targetPlatform
+ * @param {string} destination
+ * @returns {Promise<void>}
+ */
+export async function generateEntitlements(
+  appConfig,
+  targetPlatform,
+  destination,
+  fs = nodefs
+) {
+  // If `codeSignEntitlements` is a string, set `CODE_SIGN_ENTITLEMENTS` instead
+  const userEntitlements = getCodeSignEntitlements(appConfig, targetPlatform);
+  if (typeof userEntitlements === "string") {
+    return;
+  }
+
+  const filename = "App.entitlements";
+  const entitlements = await toPlist(
+    {
+      ...(targetPlatform === "macos"
+        ? DEFAULT_MACOS_ENTITLEMENTS
+        : DEFAULT_IOS_ENTITLEMENTS),
+      ...userEntitlements,
+    },
+    filename
+  );
+
+  fs.writeFileSync(path.join(destination, filename), entitlements);
+}

ios/privacyManifest.mjs

@@ -106,6 +106,7 @@ export async function generatePrivacyManifest(
     }
   }
 
-  const xcprivacy = await toPlist(manifest);
-  fs.writeFileSync(path.join(destination, "PrivacyInfo.xcprivacy"), xcprivacy);
+  const filename = "PrivacyInfo.xcprivacy";
+  const xcprivacy = await toPlist(manifest, filename);
+  fs.writeFileSync(path.join(destination, filename), xcprivacy);
 }

ios/utils.mjs

@@ -29,9 +29,10 @@ export function projectPath(p, targetPlatform) {
 
 /**
  * @param {JSONObject} source
+ * @param {string} filename
  * @returns {Promise<string>}
  */
-export function toPlist(source) {
+export function toPlist(source, filename) {
   return new Promise((resolve, reject) => {
     const args = ["-convert", "xml1", "-r", "-o", "-", "--", "-"];
     const plutil = spawn("/usr/bin/plutil", args, {
@@ -44,7 +45,7 @@ export function toPlist(source) {
 
     plutil.on("exit", (exitCode) => {
       if (exitCode !== 0) {
-        reject(new Error("Failed to generate 'PrivacyInfo.xcprivacy'"));
+        reject(new Error(`Failed to generate '${filename}'`));
       } else {
         resolve(data.join(""));
       }

test/ios/entitlements.test.ts

@@ -0,0 +1,165 @@
+import { deepEqual, throws } from "node:assert/strict";
+import { afterEach, describe, it } from "node:test";
+import { generateEntitlements as generateEntitlementsActual } from "../../ios/entitlements.mjs";
+import type { JSONObject } from "../../scripts/types.ts";
+import { fs, setMockFiles } from "../fs.mock.ts";
+
+const macosOnly = { skip: process.platform === "win32" };
+
+describe("generatePrivacyManifest()", macosOnly, () => {
+  const targetPlatforms = ["ios", "macos", "visionos"] as const;
+
+  function generateEntitlements(
+    config: JSONObject,
+    platform: (typeof targetPlatforms)[number]
+  ): Promise<void> {
+    const destination = ".";
+    fs.mkdirSync(destination, { recursive: true, mode: 0o755 });
+    return generateEntitlementsActual(config, platform, destination, fs);
+  }
+
+  function readEntitlements() {
+    return fs
+      .readFileSync("App.entitlements", { encoding: "utf-8" })
+      .split("\n");
+  }
+
+  afterEach(() => {
+    setMockFiles();
+  });
+
+  for (const platform of targetPlatforms) {
+    it(`[${platform}] generates a default manifest`, async () => {
+      await generateEntitlements({}, platform);
+
+      deepEqual(readEntitlements(), DEFAULT_ENTITLEMENTS[platform]);
+    });
+
+    it(`[${platform}] handles invalid manifest`, async () => {
+      await generateEntitlements(
+        { [platform]: { codeSignEntitlements: false } },
+        platform
+      );
+
+      deepEqual(readEntitlements(), DEFAULT_ENTITLEMENTS[platform]);
+    });
+
+    it(`[${platform}] does not generate a manifest when a path is specified`, async () => {
+      await generateEntitlements(
+        { [platform]: { codeSignEntitlements: "App.entitlements" } },
+        platform
+      );
+
+      throws(readEntitlements);
+    });
+
+    it(`[${platform}] appends to default manifest`, async () => {
+      await generateEntitlements(
+        {
+          [platform]: {
+            codeSignEntitlements: {
+              "com.apple.developer.game-center": true,
+            },
+          },
+        },
+        platform
+      );
+
+      deepEqual(readEntitlements(), APP_ENTITLEMENTS[platform]);
+    });
+  }
+});
+
+const DEFAULT_ENTITLEMENTS = {
+  ios: [
+    '<?xml version="1.0" encoding="UTF-8"?>',
+    '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
+    '<plist version="1.0">',
+    "<dict>",
+    "	<key>keychain-access-groups</key>",
+    "	<array>",
+    "		<string>$(AppIdentifierPrefix)com.microsoft.adalcache</string>",
+    "	</array>",
+    "</dict>",
+    "</plist>",
+    "",
+  ],
+  macos: [
+    '<?xml version="1.0" encoding="UTF-8"?>',
+    '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
+    '<plist version="1.0">',
+    "<dict>",
+    "	<key>com.apple.security.app-sandbox</key>",
+    "	<true/>",
+    "	<key>com.apple.security.files.user-selected.read-only</key>",
+    "	<true/>",
+    "	<key>com.apple.security.network.client</key>",
+    "	<true/>",
+    "</dict>",
+    "</plist>",
+    "",
+  ],
+  visionos: [
+    '<?xml version="1.0" encoding="UTF-8"?>',
+    '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
+    '<plist version="1.0">',
+    "<dict>",
+    "	<key>keychain-access-groups</key>",
+    "	<array>",
+    "		<string>$(AppIdentifierPrefix)com.microsoft.adalcache</string>",
+    "	</array>",
+    "</dict>",
+    "</plist>",
+    "",
+  ],
+};
+
+const APP_ENTITLEMENTS = {
+  ios: [
+    '<?xml version="1.0" encoding="UTF-8"?>',
+    '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
+    '<plist version="1.0">',
+    "<dict>",
+    "	<key>com.apple.developer.game-center</key>",
+    "	<true/>",
+    "	<key>keychain-access-groups</key>",
+    "	<array>",
+    "		<string>$(AppIdentifierPrefix)com.microsoft.adalcache</string>",
+    "	</array>",
+    "</dict>",
+    "</plist>",
+    "",
+  ],
+  macos: [
+    '<?xml version="1.0" encoding="UTF-8"?>',
+    '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
+    '<plist version="1.0">',
+    "<dict>",
+    "	<key>com.apple.developer.game-center</key>",
+    "	<true/>",
+    "	<key>com.apple.security.app-sandbox</key>",
+    "	<true/>",
+    "	<key>com.apple.security.files.user-selected.read-only</key>",
+    "	<true/>",
+    "	<key>com.apple.security.network.client</key>",
+    "	<true/>",
+    "</dict>",
+    "</plist>",
+    "",
+  ],
+  visionos: [
+    '<?xml version="1.0" encoding="UTF-8"?>',
+    '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
+    '<plist version="1.0">',
+    "<dict>",
+    "	<key>com.apple.developer.game-center</key>",
+    "	<true/>",
+    "	<key>keychain-access-groups</key>",
+    "	<array>",
+    "		<string>$(AppIdentifierPrefix)com.microsoft.adalcache</string>",
+    "	</array>",
+    "</dict>",
+    "</plist>",
+    "",
+  ],
+};

test/pack.test.ts

@@ -153,6 +153,7 @@ describe("npm pack", () => {
       "ios/ReactTestAppUITests/ReactTestAppUITests.swift",
       "ios/assetsCatalog.mjs",
       "ios/assets_catalog.rb",
+      "ios/entitlements.mjs",
       "ios/entitlements.rb",
       "ios/info_plist.rb",
       "ios/node.rb",