Add Nested App Authentication (NAA) bridge for MSAL v5 extensions

[mihaelams1]

Summary

Adds Nested App Authentication (NAA) support to the Azure DevOps extension SDK, enabling extensions to use MSAL v5's createNestablePublicClientApplication for authentication in cross-origin iframes.

Problem

Extensions running in cross-origin iframes cannot use MSAL v5's BroadcastChannel-based redirect flow due to browser storage partitioning -- the popup and iframe cannot communicate across partitions.

Solution

The NAA bridge delegates token acquisition to the host frame, where the MSAL PublicClientApplication runs in the top-level browsing context without partitioning issues.

Extensions opt in by calling SDK.enableNestedAppAuth() after SDK.init(). This sets up window.nestedAppAuthBridge, which MSAL's createNestablePublicClientApplication discovers automatically.

How it works

1. Extension calls SDK.enableNestedAppAuth() after SDK.init()
2. The SDK obtains the DevOps.NestedAppAuth remote proxy from the host via XDM
3. It sets window.nestedAppAuthBridge with addEventListener/postMessage (the interface MSAL expects)
4. When MSAL calls postMessage(requestJson), the shim forwards it to the host via XDM
5. The host response is dispatched to registered message listeners

If the host doesn't support NAA, enableNestedAppAuth() throws with a clear error message.

Files changed

• src/NestedAppAuthBridge.ts (new) -- Bridge shim implementation
• src/SDK.ts -- Exports enableNestedAppAuth() and disableNestedAppAuth() functions

Extension usage

import * as SDK from 'azure-devops-extension-sdk';
import { createNestablePublicClientApplication, InteractionRequiredAuthError } from '@azure/msal-browser';

await SDK.init();
await SDK.enableNestedAppAuth();

const pca = await createNestablePublicClientApplication({
    auth: { clientId: 'your-entra-client-id' }
});

try {
    const result = await pca.acquireTokenSilent({
        scopes: ['https://graph.microsoft.com/.default'],
    });
} catch (err) {
    if (err instanceof InteractionRequiredAuthError) {
        const result = await pca.acquireTokenPopup({
            scopes: ['https://graph.microsoft.com/.default'],
        });
    } else {
        throw err;
    }
}

Prerequisites

• Register a SPA app in the Azure Portal with redirect URI: https://dev.azure.com/_public/_MsalPopup
• Configure API permissions for the scopes your extension needs
• No changes to the extension manifest are required