Release 2.5.1

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,102 @@
+name: Bug Report
+description: Broken or unintended behavior with the library.
+labels: 'bug-unconfirmed'
+body:
+  - type: markdown
+    attributes:
+      value: |
+        ## Before Submitting Your Issue
+        Our GitHub issues are meant exclusively for bug reports and feature requests. For questions about using MSAL for iOS and macOS, please refer to the [common issues and FAQ](https://github.com/AzureAD/microsoft-authentication-library-for-objc/wiki#getting-help-common-issues-and-faq). If your question is not addressed there, we encourage you to utilize Chat with Copilot for further assistance.
+
+        For issues affecting your app in production, please create a support ticket with your Microsoft representative.
+
+  - type: checkboxes
+    attributes:
+      label: Copilot Usage Confirmation
+      description: "Please confirm before submitting:"
+      options:
+        - label: I have tried using GitHub Copilot to resolve this issue.
+          required: true
+
+  - type: markdown
+    attributes:
+      value: |
+        ## Issue Details
+
+  - type: input
+    attributes:
+      label: MSAL Version
+      description: "Please enter the latest MSAL version where the issue can be reproduced."
+      placeholder: "1.3.0"
+    validations:
+      required: true
+
+  - type: textarea
+    attributes:
+      label: Description
+      description: "Briefly describe the issue."
+    validations:
+      required: true
+
+  - type: textarea
+    attributes:
+      label: Error Details
+      description: |
+        Provide any error messages, stack traces, or unexpected behavior.
+
+        **⚠️ Do not include sensitive information (PII, credentials, secrets, tokens).**
+    validations:
+     required: true
+
+  - type: textarea
+    attributes:
+      label: MSAL Logs
+      description: |
+        Share [verbose or trace level log messages](https://learn.microsoft.com/en-us/entra/msal/objc/logging-ios?tabs=objc#logging-levels) from MSAL. For detailed instructions on collecting MSAL logs, refer to our [Logging Guide](https://learn.microsoft.com/en-us/entra/msal/objc/logging-ios?tabs=objc).
+
+        **⚠️ Do not include sensitive information (PII, credentials, secrets, tokens).**
+    validations:
+      required: true
+
+  - type: textarea
+    attributes:
+      label: Reproduction Steps
+      description: "Provide steps to reproduce the issue."
+      placeholder: |
+        1.
+        2.
+        3.
+    validations:
+      required: true
+
+  - type: textarea
+    attributes:
+      label: Expected Behavior
+      description: "Describe the expected behavior."
+    validations:
+      required: true
+
+  - type: input
+    attributes:
+      label: Regression
+      description: "If this behavior worked previously, provide the last working MSAL version(s)."
+      placeholder: "1.3.0"
+
+  - type: textarea
+    attributes:
+      label: Screenshots & Screen Recordings
+      description: "If applicable, add screenshots or screen recordings to help illustrate the issue."
+
+  - type: textarea
+    attributes:
+      label: Additional context
+      description: "Add any additional context about the issue."
+
+  - type: markdown
+    attributes:
+      value: "## Security Reporting"
+
+  - type: markdown
+    attributes:
+      value: |
+        For **privacy/security** issues, please follow the instructions [here](https://github.com/AzureAD/microsoft-authentication-library-for-objc?tab=readme-ov-file#security-reporting)

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,2 @@
+# *OPTIONAL* Disables the ability to open blank issues without selecting a template
+blank_issues_enabled: false

.github/ISSUE_TEMPLATE/documentation.yml

@@ -0,0 +1,21 @@
+name: Documentation
+description: Issues with documentation for the library.
+labels: 'documentation-update-needed'
+body:
+
+  - type: input
+    attributes:
+      label: Documentation Location
+      description: "Please provide a link to the documentation related to this issue."
+      placeholder: "learn.microsoft.com"
+    validations:
+      required: true
+
+  - type: textarea
+    attributes:
+      label: Description
+      description: "Please briefly describe your issue."
+      placeholder: "Describe the issue clearly, including any errors or missing details."
+    validations:
+      required: true
+

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,18 @@
+name: Feature request
+description: Suggest a new feature for the library.
+labels: 'feature-unconfirmed'
+body:
+  - type: markdown
+    attributes:
+      value: |
+        ## Before Submitting Your Issue
+        Our GitHub issues are meant exclusively for bug reports and feature requests. For questions about using MSAL for iOS and macOS, please refer to the [common issues and FAQ](https://github.com/AzureAD/microsoft-authentication-library-for-objc/wiki#getting-help-common-issues-and-faq). If your question is not addressed there, we encourage you to utilize Chat with Copilot for further assistance.
+
+        If this feature is essential for your app in production, please create a support ticket with your Microsoft representative.
+
+  - type: textarea
+    attributes:
+      label: Description
+      description: "Please briefly describe the feature you are requesting."
+    validations:
+      required: true

CHANGELOG.md

@@ -1,3 +1,139 @@
+## [2.5.0]
+* Awaiting MFA Delegate now automatically returns the AuthMethods to be used when calling MFA Challenge #2687
+* SDK now handles SMS as strong authentication method #2722
+
+## [2.4.2]
+* Bug fix to prevent crash when deallocating STK SecKeyRef
+
+## [2.4.1]
+* Allow cookies in duna resume request (#2732)
+
+## [2.4.0]
+* Prevent double conversion of MSALInternal error #2688
+
+## [2.3.0]
+* Fix automation tests (#2673)
+
+## [2.2.0]
+* Make native auth MFA feature more backward compatible (#2645)
+
+## [2.1.0]
+* Integrate Broker XPC service into Mac Sample app
+* Update minimum supported version to iOS 16.0 and macOS 11.0 (#2623)
+* Handle account removed suberror in brokers and MSALs (#2630)
+
+## [2.0.0]
+* Use a single family refresh token (#2550)
+* Removed deprecated APIs, including legacy initializers, account management methods and token acquisition methods, and the MSALTelemetry interface (#2577)
+* Enforced requirement for a valid ParentViewController (with a window) in interactive token requests (#2590)
+* Removed deprecated methods from native auth public interface (#2588)
+* Removed the deprecated MSALLogger interface and implementation class (#2591)
+* Enforced a valid broker-capable redirect URI format for AAD scenarios (#2592)
+* Merged the MSALAccount (MultiTenantAccount) category into the MSALAccount protocol and removed the MSALAccount+MultiTenantAccount.h (#2594)
+* Added [MSAL 2.x Migration Guide](docs/MSAL_2x_Migration_Guide.md) to assist developers in upgrading from MSAL 1.x to 2.x. (#2614)
+
+## [1.9.0]
+* Add feature flags provider to be controlled from broker (#2540)
+* Added GitHub issue templates for better issue tracking and reporting (#2554)
+
+## [1.8.1]
+* Cherry pick DUNA "resume" action fix #2558
+
+## [1.8.0]
+* Support sendable result (#2518)
+* Support DUNA protocol for CBA flow (#2508)
+
+## [1.7.0]
+* Add support for claims request in native authentication signIn (#2496)
+* Move native auth public methods to parameter class (#2492)
+
+## [1.6.3]
+* Merge 1.6.1-hotfix
+
+## [1.6.2]:
+* Add native auth instructions to error description when reset password required is returned (#2582)
+* Save error received from ESTS, and return it to the client on silent broker calls (#2379)
+* Support web_page_uri (#2384)
+
+## [1.6.1-hotfix]
+* Add support of "lookup" mode in broker #2414
+
+## [1.6.1]:
+* Support extra query parameters on logout endpoint (#2339)
+* Add support functions to help broker improve cross cloud experience (#2361)
+
+## [1.6.0]:
+* Support extra query parameters on logout endpoint (#2339)
+
+## [1.5.1]:
+* Parse and add STS error codes in token error result (#2319)
+* VisionOS support added (#2139)
+
+## [1.5.0]
+* Increased macOS minimum version to 10.15 (#2220)
+* Added Native Auth feature for MacOS to interact with the Microsoft Entra ID services (#2220)
+
+## [1.4.2]
+* Fix invalid cert auth request handling (hotfix). (#2278)
+
+## [1.4.1]
+* Update Native Auth logging levels for improved clarity and consistency. (#2184)
+* Update common core submodule with changes related to upgrade registration. (#2180)
+* Add a new flag MSALThrottlingCacheHitKey for error returned from client's throttling. (#2257)
+* Update common core submodule with device register action with token protection hint. (#2244)
+* Native Auth logs are appropriately masked to ensure sensitive information is protected. (#2253)
+
+## [1.4.0]:
+* Add platform sequence param. #2192
+* Native auth can now store multiple access tokens related to different resources.
+
+## [1.3.3]
+* Update common core submodule.
+* Automation improvements.
+
+## [1.3.2]
+* Add forceRefresh param to ignore AT in cache and request a new AT.
+
+## [1.3.1]
+* Preferred auth method added to device information, returned from broker
+
+## [1.3.0]
+* Added Native Auth feature to interact with the Microsoft Entra ID services
+
+## [1.2.24]
+* Fix pkey auth after server side removal of registration to use isDeviceRegistered flag from ssoContext.
+
+## [1.2.23]
+* Fix pkey auth after server side removal of registration
+
+## [1.2.22]
+* Add privacy manifest (#1984)
+
+## [1.2.21]
+* Add additional error codes for PSSO KeyId mismatch (#1946)
+
+## [1.2.20]
+* Updated common core submodule with changes for platform sso and mapping broker version in token result 
+
+## [1.2.19]
+* Introduce a way to inject external WKWebviewConfiguration for MSIDWebviewUIController - needed for MSAL C++ (#1308)
+
+## [1.2.18]
+* Fix duplicate values for error JIT codes (#1893)
+
+## [1.2.17]
+* Added ccs request id header (#1844)
+* Report WPJ v2 telemetry capability. (common core #1297)
+* Add separate error code for OneAuth telemetry purpose (common core #1292)
+* Logging improvements (common core #1290)
+* Rename some internal macro (common core #1300)
+
+## [1.2.16]
+* Expose APIs for manually setting time_Interval for request and session resource (#1288)
+
+## [1.2.15]
+* Moving master branch history to main (#1787)
+
 ## [1.2.14]
 * Added method name with line number for errors in telemetry (#1795)
 

CODEOWNERS

@@ -2,6 +2,29 @@
 # Unless a later match takes precedence, these users will be requested
 # for review whenever someone opens a pull request.
 *       @AzureAD/AppleIdentityTeam
+# @AzureAD/AppleIdentityTeam and @AzureAD/MSAL-ObjC-CIAM will be the co-owners of the following files:
+/MSAL/MSAL.xcodeproj/project.pbxproj @AzureAD/AppleIdentityTeam @AzureAD/MSAL-ObjC-CIAM
+CHANGELOG.md @AzureAD/AppleIdentityTeam @AzureAD/MSAL-ObjC-CIAM
+/azure_pipelines/ @AzureAD/AppleIdentityTeam @AzureAD/MSAL-ObjC-CIAM
+/Package.swift @AzureAD/AppleIdentityTeam @AzureAD/MSAL-ObjC-CIAM
+/MSAL/src/public/MSAL.h @AzureAD/AppleIdentityTeam @AzureAD/MSAL-ObjC-CIAM
+# @AzureAD/MSAL-ObjC-CIAM owns any files in the */native_auth
+# directories, subdirectories and other files related to native auth.
+/MSAL/module.modulemap @AzureAD/MSAL-ObjC-CIAM
+/MSAL/.swiftlint.yml @AzureAD/MSAL-ObjC-CIAM
+/MSAL/src/native_auth/ @AzureAD/MSAL-ObjC-CIAM
+/MSAL/test/unit/native_auth/ @AzureAD/MSAL-ObjC-CIAM
+/MSAL/test/integration/native_auth/ @AzureAD/MSAL-ObjC-CIAM
+/MSAL/MSAL\ iOS\ Native\ Auth\ E2E\ Tests.xctestplan @AzureAD/MSAL-ObjC-CIAM
+/MSAL/test/testplan/NativeAuthEndToEndTestPlan.xctestplan @AzureAD/MSAL-ObjC-CIAM
+/MSAL/test/testplan/NativeAuthEndToEndTestPlan\ Mac.xctestplan @AzureAD/MSAL-ObjC-CIAM
+/MSAL/test/testplan/MSAL\ iOS\ Native\ Auth\ E2E\ Tests.xctestplan @AzureAD/MSAL-ObjC-CIAM
+/MSAL/test/testplan/MSAL\ Mac\ Native\ Auth\ E2E\ Tests.xctestplan @AzureAD/MSAL-ObjC-CIAM
+/MSAL/MSAL.xcodeproj/xcshareddata/xcschemes/unit-test-host.xcscheme @AzureAD/MSAL-ObjC-CIAM
+/MSAL/MSAL.xcodeproj/xcshareddata/xcschemes/unit-test-host-mac.xcscheme @AzureAD/MSAL-ObjC-CIAM
+/MSAL/MSAL.xcodeproj/xcshareddata/xcschemes/MSAL\ iOS\ Native\ Auth\ E2E\ Tests.xcscheme @AzureAD/MSAL-ObjC-CIAM
+/MSAL/MSAL.xcodeproj/xcshareddata/xcschemes/MSAL\ Mac\ Native\ Auth\ E2E\ Tests.xcscheme @AzureAD/MSAL-ObjC-CIAM
+/spm-integration-test.sh @AzureAD/MSAL-ObjC-CIAM
 # For more details about inheritance patterns, or to assign different
 # owners for individual file extensions, see:
 # https://help.github.com/articles/about-codeowners/

MSAL.podspec

@@ -1,6 +1,6 @@
 Pod::Spec.new do |s|
   s.name         = "MSAL"
-  s.version      = "1.2.14"
+  s.version      = "2.5.0"
   s.summary      = "Microsoft Authentication Library (MSAL) for iOS"
   s.description  = <<-DESC
                    The MSAL library for iOS gives your app the ability to begin using the Microsoft Cloud by supporting Microsoft Azure Active Directory and Microsoft Accounts in a converged experience using industry standard OAuth2 and OpenID Connect. The library also supports Microsoft Azure B2C for those using our hosted identity management service.
@@ -14,42 +14,52 @@ Pod::Spec.new do |s|
   s.social_media_url   = "https://twitter.com/azuread"
   s.platform     = :ios, :osx
   s.ios.deployment_target = "14.0"
-  s.osx.deployment_target = "10.13"
+  s.osx.deployment_target = "10.15"
   s.source       = { 
     :git => "https://github.com/AzureAD/microsoft-authentication-library-for-objc.git",
     :tag => s.version.to_s,
     :submodules => true
   }
-
-  s.pod_target_xcconfig = { 'CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF' => 'NO' }
+  s.swift_versions = '5.0'
+  s.resource_bundles = {"MSAL" => ["MSAL/PrivacyInfo.xcprivacy"]}
   s.default_subspecs ='app-lib'
 
   s.prefix_header_file = "MSAL/src/MSAL.pch"
   s.header_dir = "MSAL"
 
   s.subspec 'app-lib' do |app|
-  	app.source_files = "MSAL/src/**/*.{h,m}", "MSAL/IdentityCore/IdentityCore/src/**/*.{h,m}"
-  	app.ios.public_header_files = "MSAL/src/public/*.h","MSAL/src/public/ios/**/*.h", "MSAL/src/public/configuration/**/*.h"
-  	app.osx.public_header_files = "MSAL/src/public/mac/*.h","MSAL/src/public/*.h", "MSAL/src/public/configuration/**/*.h"
-
-  	app.ios.exclude_files = "MSAL/src/**/mac/*", "MSAL/IdentityCore/IdentityCore/src/**/mac/*"
-
-  	app.osx.exclude_files = "MSAL/src/**/ios/*", "MSAL/IdentityCore/IdentityCore/src/**/ios/*"
-  	app.requires_arc = true
+    app.pod_target_xcconfig = { 'CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF' => 'NO' }
+    app.source_files = "MSAL/src/**/*.{h,m}", "MSAL/IdentityCore/IdentityCore/src/**/*.{h,m}"
+    app.ios.public_header_files = "MSAL/src/public/ios/**/*.h", "MSAL/src/public/*.h", "MSAL/src/public/configuration/**/*.h", "MSAL/src/native_auth/public/*.h"
+    app.osx.public_header_files = "MSAL/src/public/mac/**/*.h", "MSAL/src/public/*.h", "MSAL/src/public/configuration/**/*.h", "MSAL/src/native_auth/public/*.h"
+    app.ios.exclude_files = "MSAL/src/**/mac/*", "MSAL/IdentityCore/IdentityCore/src/**/mac/*"
+    app.osx.exclude_files = "MSAL/src/**/ios/*", "MSAL/IdentityCore/IdentityCore/src/**/ios/*"
+    app.requires_arc = true
+  end
+
+  s.subspec 'native-auth' do |nat|
+    nat.pod_target_xcconfig = { 'CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF' => 'NO', 'HEADER_SEARCH_PATHS' => "$SRCROOT/MSAL"}
+    nat.source_files = "MSAL/src/**/*.{h,m}", "MSAL/src/native_auth/**/*.{h,m,swift}", "MSAL/IdentityCore/IdentityCore/src/**/*.{h,m}", "MSAL/module.modulemap"
+    nat.ios.public_header_files = "MSAL/src/public/*.h","MSAL/src/public/ios/**/*.h", "MSAL/src/public/configuration/**/*.h", "MSAL/src/native_auth/public/*.h"
+    nat.osx.public_header_files = "MSAL/src/public/*.h","MSAL/src/public/mac/**/*.h", "MSAL/src/public/configuration/**/*.h", "MSAL/src/native_auth/public/*.h"
+    nat.ios.exclude_files = "MSAL/src/**/mac/*", "MSAL/IdentityCore/IdentityCore/src/**/mac/*"
+    nat.osx.exclude_files = "MSAL/src/**/ios/*", "MSAL/IdentityCore/IdentityCore/src/**/ios/*"
+    nat.requires_arc = true
   end
 
   # Note, MSAL has limited support for running in app extensions.
   s.subspec 'extension' do |ext|
-  	ext.compiler_flags = '-DADAL_EXTENSION_SAFE=1'
-  	ext.source_files = "MSAL/src/**/*.{h,m}", "MSAL/IdentityCore/IdentityCore/src/**/*.{h,m}"
-  	ext.ios.public_header_files = "MSAL/src/public/*.h","MSAL/src/public/ios/**/*.h", "MSAL/src/public/configuration/**/*.h"
-  	ext.osx.public_header_files = "MSAL/src/public/mac/*.h","MSAL/src/public/*.h", "MSAL/src/public/configuration/**/*.h"
+    ext.pod_target_xcconfig = { 'CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF' => 'NO' }
+    ext.compiler_flags = '-DADAL_EXTENSION_SAFE=1'
+    ext.source_files = "MSAL/src/**/*.{h,m}", "MSAL/IdentityCore/IdentityCore/src/**/*.{h,m}"
+    ext.ios.public_header_files = "MSAL/src/public/*.h", "MSAL/src/public/ios/**/*.h", "MSAL/src/public/configuration/**/*.h", "MSAL/src/native_auth/public/*.h"
+    ext.osx.public_header_files = "MSAL/src/public/*.h", "MSAL/src/public/mac/**/*.h", "MSAL/src/public/configuration/**/*.h", "MSAL/src/native_auth/public/*.h"
 
-  	# There is currently a bug in CocoaPods where it doesn't combine the public headers
-  	# for both the platform and overall.
-  	ext.ios.exclude_files = "MSAL/src/**/mac/*", "MSAL/IdentityCore/IdentityCore/src/**/mac/*"
-  	ext.osx.exclude_files = "MSAL/src/**/ios/*", "MSAL/IdentityCore/IdentityCore/src/**/ios/*"
-  	ext.requires_arc = true
+    # There is currently a bug in CocoaPods where it doesn't combine the public headers
+    # for both the platform and overall.
+    ext.ios.exclude_files = "MSAL/src/**/mac/*", "MSAL/IdentityCore/IdentityCore/src/**/mac/*"
+    ext.osx.exclude_files = "MSAL/src/**/ios/*", "MSAL/IdentityCore/IdentityCore/src/**/ios/*"
+    ext.requires_arc = true
   end
 
 end