What should we do about react-native-msal?

[tormodAase]

For those unaware of the history of authentication in our apps:

• Our apps initially used react-native-ms-adal, when ADAL was still maintained by Microsoft.
• We moved over to expo auth-session in 2021, but had to quickly migrate to react-native-msal after users reported not being able to login. We were not able to reproduce those users' issues.
• react-native-msal was a package initially created and maintained by Stashenergy, and was archived in May of last year.
• We created a fork, which we have maintained since then (though it has not been prioritized at all, and none of us have any ownership to the code).

Here are our current issues with react-native-msal:

• Since it's not on NPM, we don't use proper versioning (we install with github repo link + commit hash)
• It's in maintenance mode, and we don't really have any ownership to the code. If something suddenly stops working one day, we are unprepared(!!)
• The iOS integration is written in Objective C. The code would be easier to maintain if written in Swift.

Eventually we have to make a decision on what we should do with this package. The way I see it, we have three choices:

1. Take full ownership of the current package. Learn how the code works, make adjustments, and create a pipeline for publishing to the npm registry (with a new name).
2. Start fresh with a new package. Create the code from scratch (with Swift instead of ObjC?)
   • This may require a lot of work.
3. Transition to expo-auth-session
   • We don't know if using expo-auth-session will reintroduce the issues some users had with authentication.
   • If we use expo-auth-session, we may lose some features, like Microsoft Authenticator integration.
   • expo-auth-session is more barebones than MSAL. We will have to implement more business logic ourselves (e.g. what to do with our refresh token)

Let the discussion begin!