setup-auth: multi-provider authentication and SPA flows support (#173)

Multi-provider authentication for Power Pages code sites — Entra ID (workforce + External ID/CIAM), generic OIDC, SAML2, WS-Federation, local username/password, and social (Microsoft/Facebook/Google). AUTH_PROVIDERS array drives the SPA; Login page renders providers from configuration with the layout chosen by the maker (single button / multi-button / dropdown).
All server-rendered auth pages SPA-ified via Code-Site-Shell-Header — /Account/Login/{ResetPassword,RedeemInvitation,Register,ExternalLoginCallback,TermsAndConditions,ExternalAuthenticationFailed} and /SignIn redirect to SPA equivalents, preserving query params. Server-bounce paths (e.g., /profile → /SignIn?ReturnUrl=...) stay inside the SPA.
Optional /user-profile SPA page (opt-in in Phase 2.1) — getMyProfile/updateMyProfile via Power Pages Web API with anti-forgery + If-Match, Self-scope table permission on contact, simplified form (firstname, lastname, mobile, address), read-only Account Details, header repaints instantly after save via applyContactUpdateLocally + spread-on-refresh fix.
New helper scripts — check-solution-installed.js auto-detects the GDPR Privacy Extensions solution for the Terms prereq (falls back to manual prompt on infra failure). render-auth-report.js produces a Fluent-styled HTML report at docs/auth-setup-report.html after every run, masking any setting whose name contains Secret.
Quality-of-life fixes — workforce Entra ID claims mapping uses upn (v1.0 tokens lack email); getUserDisplayName falls back to email before the OIDC subject; external provider button text wraps instead of mid-string ellipsis; defaults flipped to "First sign-in only" sync and "Link to existing contact" linking to match the common CRM workflow; built-in 2FA explicitly NOT scaffolded (server-rendered SendCode/VerifyCode can't be SPA-ified — recommend IdP-level MFA).
25 eval scenarios covering every flow above (was 9 before).

Author: dhiresh06

evals/power-pages/setup-auth/evals.json

@@ -82,6 +82,68 @@
         "Closes the browser session after all testing is complete",
         "Provides prioritized next steps focusing on resolving the API failures"
       ]
+    },
+    {
+      "id": 5,
+      "prompt": "Test my Power Pages site at https://intranet.powerappsportals.com. It uses SAML2 authentication with our corporate ADFS server, so you'll need to let me log in first.",
+      "expected_output": "The agent uses the provided URL, launches a Playwright browser, resizes the viewport, and navigates to the homepage. It detects a redirect to the ADFS login page (a SAML2 identity provider on a different domain). It informs the user that the site redirected to a SAML2/ADFS login page and asks the user to complete authentication in the browser window. After the user logs in through the ADFS portal and is redirected back to the Power Pages site, the agent verifies the homepage loaded with authenticated content. It then crawls up to 25 pages, captures API requests, and generates a test report.",
+      "files": [],
+      "expectations": [
+        "Uses the user-provided URL https://intranet.powerappsportals.com directly",
+        "Resizes the browser viewport to an appropriate dimension",
+        "Navigates to the homepage and detects a redirect to a SAML2/ADFS identity provider login page",
+        "Recognizes the ADFS login page as a private site gate authentication redirect",
+        "Informs the user that the site requires SAML2/ADFS authentication and asks them to log in",
+        "Waits for the user to complete the ADFS login process before continuing",
+        "After authentication, verifies the homepage loads correctly with authenticated content",
+        "Captures browser console errors and network requests throughout testing",
+        "Crawls discoverable links up to a maximum of 25 pages in the authenticated context",
+        "Identifies /_api/ requests and analyzes their HTTP status codes",
+        "Generates a test report with per-page and per-API pass/fail results",
+        "Closes the browser session after testing is complete",
+        "Provides next steps or recommendations based on the test outcomes"
+      ]
+    },
+    {
+      "id": 6,
+      "prompt": "Test https://self-service.powerappsportals.com. This site uses local authentication with username/password login. I'll create a test account and log in.",
+      "expected_output": "The agent uses the provided URL, launches a Playwright browser, resizes the viewport, and navigates to the homepage. The homepage loads successfully as a public site. The agent detects site-level authentication indicators (a Sign in or Log in link in the navigation) and recognizes the site supports local authentication (login form with username/password fields rather than external provider redirect). It asks the user to log in through the browser's login form. After the user authenticates with their local credentials, the agent proceeds to crawl pages and test APIs, generating a comprehensive report.",
+      "files": [],
+      "expectations": [
+        "Uses the user-provided URL https://self-service.powerappsportals.com directly",
+        "Resizes the browser viewport before navigating to the site",
+        "Navigates to the homepage and verifies it loads without critical errors",
+        "Detects site-level authentication indicators such as Sign in or Log in links",
+        "Recognizes local authentication when the login page shows username/email and password fields instead of redirecting to an external identity provider",
+        "Asks the user to complete the local login through the browser window",
+        "After authentication, verifies the user is now logged in",
+        "Crawls discoverable links up to a maximum of 25 pages",
+        "Captures and analyzes /_api/ network requests",
+        "Generates a test report with per-page and per-API pass/fail results",
+        "Closes the browser session after testing is complete",
+        "Provides recommendations based on test findings"
+      ]
+    },
+    {
+      "id": 7,
+      "prompt": "Run tests on https://partner-hub.powerappsportals.com. The site uses OpenID Connect with Okta for authentication. Some pages are public and some require login.",
+      "expected_output": "The agent uses the provided URL, launches a Playwright browser, and navigates to the homepage. The homepage loads as a public site with a Sign in option visible. The agent detects site-level authentication and asks whether the user wants to log in or skip authenticated pages. If the user logs in through the Okta OIDC flow (redirect to Okta login page, then back to the site), the agent tests both public and authenticated pages. The report distinguishes between public and authenticated page results and notes any APIs returning 401/403 for unauthenticated vs authenticated contexts.",
+      "files": [],
+      "expectations": [
+        "Uses the user-provided URL https://partner-hub.powerappsportals.com directly",
+        "Resizes the browser viewport to an appropriate dimension",
+        "Navigates to the homepage and verifies it loads correctly as a public page",
+        "Detects site-level authentication indicators (Sign in link)",
+        "Asks user whether to log in or skip authenticated pages",
+        "If user logs in, recognizes the redirect to Okta as an OpenID Connect authentication flow",
+        "Waits for the user to complete the Okta login process",
+        "After authentication, verifies the user is logged in on the site",
+        "Crawls discoverable links up to a maximum of 25 pages",
+        "Captures and analyzes /_api/ network requests with status codes",
+        "Generates a test report distinguishing public and authenticated page results",
+        "Closes the browser session after testing is complete",
+        "Provides recommendations based on test findings"
+      ]
     }
   ]
 }

evals/power-pages/test-site/evals.json

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+
+// Checks whether a Dataverse solution is installed in the current PAC environment.
+// Usage:
+//   node check-solution-installed.js --solutionName <uniqueName> [--envUrl <url>]
+//
+// If --envUrl is omitted, the environment URL is read from `pac env who`.
+//
+// Outputs JSON to stdout on success:
+//   { "installed": true,  "solutionName": "...", "version": "1.0.0.5" }
+//   { "installed": false, "solutionName": "..." }
+//
+// On infrastructure failure (no PAC env, no Azure CLI token, network error, 4xx/5xx),
+// writes a human-readable message to stderr and exits 1 — the caller (skill) should
+// treat this as "unknown" and fall back to asking the user manually.
+//
+// The query itself lives in lib/check-solution-installed.js so it can be unit-
+// tested without spawning a subprocess or making real network calls.
+
+const { getAuthToken, getEnvironmentUrl } = require('./lib/validation-helpers');
+const { checkSolutionInstalled, sanitizeEnvUrl } = require('./lib/check-solution-installed');
+
+function parseArgs(argv) {
+  const args = {};
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === '--solutionName') args.solutionName = argv[++i];
+    else if (a === '--envUrl') args.envUrl = argv[++i];
+  }
+  return args;
+}
+
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+  if (!args.solutionName) {
+    process.stderr.write('Usage: node check-solution-installed.js --solutionName <uniqueName> [--envUrl <url>]\n');
+    process.exit(1);
+  }
+
+  const rawEnvUrl = args.envUrl || getEnvironmentUrl();
+  if (!rawEnvUrl) {
+    process.stderr.write('No environment URL provided and `pac env who` did not return one. Run `pac auth create` and `pac env select` first.\n');
+    process.exit(1);
+  }
+
+  // Sanitize before passing anywhere that interpolates the URL into a shell
+  // command (getAuthToken builds `az account get-access-token --resource
+  // "${envUrl}"`). sanitizeEnvUrl strips everything except scheme+host+port,
+  // so a `--envUrl 'x"; rm -rf ~; echo "'` can't escape the quotes.
+  let envUrl;
+  try {
+    envUrl = sanitizeEnvUrl(rawEnvUrl);
+  } catch (err) {
+    process.stderr.write(`${err.message}\n`);
+    process.exit(1);
+  }
+
+  const token = getAuthToken(envUrl);
+  if (!token) {
+    process.stderr.write('Failed to get Azure CLI token. Run `az login` first.\n');
+    process.exit(1);
+  }
+
+  try {
+    const result = await checkSolutionInstalled({
+      envUrl,
+      token,
+      solutionName: args.solutionName,
+    });
+    console.log(JSON.stringify(result));
+  } catch (err) {
+    process.stderr.write(`${err.message}\n`);
+    process.exit(1);
+  }
+}
+
+main();

plugins/power-pages/scripts/check-solution-installed.js

@@ -85,9 +85,47 @@ try {
 
 // --- Helpers ---
 
+function needsQuoting(value) {
+  if (typeof value !== 'string') return false;
+
+  // Empty string and the bareword-reserved values that YAML 1.2 reads as
+  // booleans / null instead of as strings.
+  if (value === '' || value === 'true' || value === 'false' || value === 'null') return true;
+
+  // Leading/trailing whitespace (a leading tab would also be caught by the
+  // leading-char check below — keeping this for clarity).
+  if (value !== value.trim()) return true;
+
+  // YAML-special characters anywhere in the value. Without quoting, these can
+  // start comments (#), terminate scalars (:), open flow collections ([ { , ]),
+  // start anchors/aliases/tags/directives (& * ! %), or be reserved/unsupported
+  // (` @ < > = ?). Pipe and gt are block-scalar indicators.
+  if (/[:#{}[\],&*?|<>=!%@`]/.test(value)) return true;
+
+  // Leading characters that change parser semantics even when no other special
+  // character appears in the value. These cases were missed by the
+  // character-class check above:
+  //   "-foo"  → ambiguous: parsers may interpret a leading "-" as a block
+  //             sequence indicator or a numeric sign, depending on context.
+  //   "'foo"  → leading single quote opens a quoted scalar that never closes.
+  //   '"foo'  → leading double quote opens a quoted scalar that never closes.
+  //   "\tfoo" → leading tab is not allowed by YAML 1.2 in plain scalars.
+  // Quoting the entire value sidesteps every one of these.
+  const first = value.charAt(0);
+  if (first === '-' || first === "'" || first === '"' || first === '\t') return true;
+
+  return false;
+}
+
+function yamlValue(value) {
+  if (typeof value === 'boolean' || typeof value === 'number') return String(value);
+  if (needsQuoting(value)) return `"${String(value).replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
+  return String(value);
+}
+
 function writeYaml(fields) {
   const keys = Object.keys(fields).sort();
-  return keys.map(k => `${k}: ${fields[k]}`).join('\n') + '\n';
+  return keys.map(k => `${k}: ${yamlValue(fields[k])}`).join('\n') + '\n';
 }
 
 // --- Create site setting ---

plugins/power-pages/scripts/create-site-setting.js

@@ -0,0 +1,131 @@
+'use strict';
+
+// Core logic for the `check-solution-installed` CLI, exposed as a function so
+// the unit tests can mock `helpers.makeRequest` without spawning a subprocess
+// or hitting the network.
+//
+// The CLI wrapper at scripts/check-solution-installed.js just resolves env
+// URL + auth token and calls checkSolutionInstalled below.
+
+const helpers = require('./validation-helpers');
+
+const UNIQUE_NAME_RE = /^[A-Za-z0-9_]+$/;
+
+/**
+ * Validates and normalizes a Dataverse environment URL before it is passed
+ * to anything that interpolates it into a shell command (notably
+ * helpers.getAuthToken, which calls `az account get-access-token --resource
+ * "${url}"` via execSync). Returns the URL's `origin` only (scheme + host +
+ * optional port) so path, query, fragment, and userinfo are all stripped.
+ *
+ * Throws on:
+ *   - non-string / empty input
+ *   - input that `new URL()` can't parse
+ *   - non-https protocol (Dataverse refuses http and we don't want file: etc.)
+ *   - URLs with embedded userinfo (https://user:pass@host) — credentials in
+ *     URLs are a smell and can confuse downstream tooling
+ *
+ * The normalized origin is safe to interpolate into a shell command because
+ * URL.origin only contains scheme, host, and port — characters that the
+ * URL spec disallows from carrying shell metacharacters.
+ *
+ * @param {unknown} envUrl
+ * @returns {string} sanitized origin, e.g. "https://contoso.crm.dynamics.com"
+ * @throws Error with a human-readable message on rejection
+ */
+function sanitizeEnvUrl(envUrl) {
+  if (typeof envUrl !== 'string' || envUrl.trim() === '') {
+    throw new Error('envUrl must be a non-empty string.');
+  }
+
+  let parsed;
+  try {
+    parsed = new URL(envUrl);
+  } catch {
+    throw new Error(`envUrl is not a valid URL: "${envUrl}".`);
+  }
+
+  if (parsed.protocol !== 'https:') {
+    throw new Error(`envUrl must use https (got "${parsed.protocol}").`);
+  }
+
+  if (parsed.username || parsed.password) {
+    throw new Error('envUrl must not contain userinfo (username/password). Authentication uses the Azure CLI token, not credentials in the URL.');
+  }
+
+  // url.origin is the scheme + host + port — no path, no query, no fragment.
+  // For "https://contoso.crm.dynamics.com:443/api/data/v9.2/?x=1#anchor"
+  // it returns "https://contoso.crm.dynamics.com:443".
+  return parsed.origin;
+}
+
+/**
+ * @typedef {Object} CheckResult
+ * @property {boolean} installed
+ * @property {string}  solutionName
+ * @property {string|null} [version]
+ */
+
+/**
+ * Queries the Dataverse `solutions` table for a row matching the given
+ * uniquename. The presence of a row means the solution is installed.
+ *
+ * @param {Object} options
+ * @param {string} options.envUrl       — Dataverse environment URL (no trailing slash)
+ * @param {string} options.token        — Azure CLI bearer token
+ * @param {string} options.solutionName — solution unique name (alphanumeric + underscore)
+ * @returns {Promise<CheckResult>}
+ * @throws Error with a human-readable message on infrastructure failure
+ *         (network error, 401/403, non-200, malformed JSON, etc.)
+ */
+async function checkSolutionInstalled({ envUrl, token, solutionName } = {}) {
+  if (!envUrl) throw new Error('envUrl is required');
+  if (!token) throw new Error('token is required');
+  if (!solutionName) throw new Error('solutionName is required');
+  if (!UNIQUE_NAME_RE.test(solutionName)) {
+    throw new Error(`Invalid solution unique name: "${solutionName}". Expected alphanumeric + underscore.`);
+  }
+
+  const filter = `uniquename eq '${solutionName}'`;
+  const url = `${envUrl}/api/data/v9.2/solutions?$filter=${encodeURIComponent(filter)}&$select=uniquename,version&$top=1`;
+
+  const res = await helpers.makeRequest({
+    url,
+    headers: {
+      Authorization: `Bearer ${token}`,
+      Accept: 'application/json',
+      'OData-MaxVersion': '4.0',
+      'OData-Version': '4.0',
+    },
+  });
+
+  if (res.error) {
+    throw new Error(`Solution query failed: ${res.error}`);
+  }
+
+  if (res.statusCode === 401 || res.statusCode === 403) {
+    throw new Error(
+      `Authentication / authorization failed (${res.statusCode}) querying solutions table. ` +
+      'Either the token is expired (run `az login`) or the signed-in user lacks Read permission on the solutions table.'
+    );
+  }
+
+  if (res.statusCode !== 200) {
+    throw new Error(`Unexpected response (${res.statusCode}): ${res.body}`);
+  }
+
+  let data;
+  try {
+    data = JSON.parse(res.body);
+  } catch {
+    throw new Error(`Failed to parse Dataverse response as JSON: ${res.body}`);
+  }
+
+  const row = Array.isArray(data.value) && data.value.length > 0 ? data.value[0] : null;
+  if (row) {
+    return { installed: true, solutionName, version: row.version || null };
+  }
+  return { installed: false, solutionName };
+}
+
+module.exports = { checkSolutionInstalled, sanitizeEnvUrl, UNIQUE_NAME_RE };

plugins/power-pages/scripts/lib/check-solution-installed.js

@@ -7,6 +7,25 @@ const WEB_ROLE_FILE_SUFFIX = '.webrole.yml';
 
 function parseYamlScalar(value) {
   const trimmed = value.trim();
+
+  // Unwrap quoted scalars BEFORE the bareword tests so that a value written
+  // as `"true"` (the literal 4-character string) is read back as a string,
+  // not coerced to the boolean true. Same for `"null"` / `"123"` etc. This
+  // is symmetric with the quoting strategy in create-site-setting.js, which
+  // wraps any value that would otherwise change meaning when read as YAML.
+
+  // Double-quoted: "...". YAML 1.2 supports many escape sequences; our writer
+  // only emits \\ and \", so we only unescape those.
+  if (trimmed.length >= 2 && trimmed.startsWith('"') && trimmed.endsWith('"')) {
+    return trimmed.slice(1, -1).replace(/\\([\\"])/g, '$1');
+  }
+
+  // Single-quoted: '...'. YAML 1.2 single-quoted strings escape '' for a
+  // literal single quote and otherwise pass through verbatim.
+  if (trimmed.length >= 2 && trimmed.startsWith("'") && trimmed.endsWith("'")) {
+    return trimmed.slice(1, -1).replace(/''/g, "'");
+  }
+
   if (trimmed === 'true') {
     return true;
   }

plugins/power-pages/scripts/lib/powerpages-config.js

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+/**
+ * render-auth-report.js — Renders the setup-auth post-execution report HTML
+ * from a JSON data file.
+ *
+ * Usage:
+ *   node render-auth-report.js --output <path> --data <json-file>
+ *
+ * Required keys in the JSON data file:
+ *   META_DATA             — { siteName, reportDate, framework, nextStepsHtml }
+ *   PROVIDERS_DATA        — array of provider objects (may be empty)
+ *   LOCAL_AUTH_DATA       — object or null
+ *   OPTIONAL_FEATURES_DATA — object (may be empty)
+ *   SITE_SETTINGS_DATA    — array of { name, value } (may be empty)
+ *   TABLE_PERMISSIONS_DATA — array of permission objects (may be empty)
+ *   FILES_DATA            — array of { path, action, notes } (may be empty)
+ */
+
+const path = require('path');
+const { renderTemplate, parseArgs } = require('./lib/render-template');
+
+const args = parseArgs(process.argv);
+
+if (!args.output || !args.data) {
+  console.error(
+    'Usage: node render-auth-report.js --output <path> --data <json-file>'
+  );
+  process.exit(1);
+}
+
+renderTemplate({
+  templatePath: path.join(__dirname, '..', 'skills', 'setup-auth', 'assets', 'auth-report.html'),
+  outputPath: path.resolve(args.output),
+  dataPath: path.resolve(args.data),
+  requiredKeys: [
+    'META_DATA',
+    'PROVIDERS_DATA',
+    'LOCAL_AUTH_DATA',
+    'OPTIONAL_FEATURES_DATA',
+    'SITE_SETTINGS_DATA',
+    'TABLE_PERMISSIONS_DATA',
+    'FILES_DATA',
+  ],
+});