Fix PowerShell app update flow

scripts/create-pca.sh

@@ -42,15 +42,21 @@ function main() {
     # Find the app by name
     APP_ID=$(az ad app list --display-name "$APP_NAME" --query "[0].appId" -o tsv)
     if [[ -n "$APP_ID" ]]; then
-        echo "Error: Application '$APP_NAME' already exists."
-        exit 1
+        local USER_CONFIRMATION
+        read -r -p "Application '$APP_NAME' already exists. Update it? [y/N]: " USER_CONFIRMATION
+        if [[ ! "$USER_CONFIRMATION" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+            echo "Canceled."
+            exit 0
+        fi
     fi
 
-    # Create the app
-    APP_ID=$(az ad app create --display-name "$APP_NAME" --query "appId" -o tsv)
+    # Create the app when it does not already exist.
     if [[ -z "$APP_ID" ]]; then
-        echo "Error: Failed to create application '$APP_NAME'."
-        exit 1
+        APP_ID=$(az ad app create --display-name "$APP_NAME" --query "appId" -o tsv)
+        if [[ -z "$APP_ID" ]]; then
+            echo "Error: Failed to create application '$APP_NAME'."
+            exit 1
+        fi
     fi
 
     local M365_GRAPH_APP_ID="00000003-0000-0000-c000-000000000000"
@@ -94,25 +100,26 @@ function main() {
 EOF
 )
 
-    local PUBLIC_CLIENT_REDIRECT_URIS_JSON
-    PUBLIC_CLIENT_REDIRECT_URIS_JSON=$(cat <<EOF
-[
-  "http://localhost",
-  "msal${APP_ID}://auth"
-]
-EOF
-)
+    local REQUIRED_RESOURCE_ACCESS_FILE
+    REQUIRED_RESOURCE_ACCESS_FILE=$(mktemp)
+    echo "$REQUIRED_RESOURCE_ACCESS_JSON" > "$REQUIRED_RESOURCE_ACCESS_FILE"
 
     # Configure app to match "Azure Node Playground Public".
     az ad app update \
       --id "$APP_ID" \
-      --set signInAudience=AzureADMyOrg \
-            isFallbackPublicClient=true \
-            requiredResourceAccess="$REQUIRED_RESOURCE_ACCESS_JSON" \
-            publicClient.redirectUris="$PUBLIC_CLIENT_REDIRECT_URIS_JSON" \
-            web.implicitGrantSettings.enableAccessTokenIssuance=true \
-            web.implicitGrantSettings.enableIdTokenIssuance=true \
+      --sign-in-audience AzureADMyOrg \
+      --is-fallback-public-client true \
+      --required-resource-accesses @"$REQUIRED_RESOURCE_ACCESS_FILE" \
+      --public-client-redirect-uris "http://localhost" "msal${APP_ID}://auth" \
+      --enable-access-token-issuance true \
+      --enable-id-token-issuance true \
       1>/dev/null
+    local UPDATE_EXIT_CODE=$?
+    rm -f "$REQUIRED_RESOURCE_ACCESS_FILE"
+    if [[ $UPDATE_EXIT_CODE -ne 0 ]]; then
+      echo "Error: Failed to configure application '$APP_NAME' ($APP_ID)."
+      exit 1
+    fi
 
     # Ensure service principal exists before granting tenant-wide admin consent.
     az ad sp create --id "$APP_ID" 1>/dev/null 2>/dev/null || true
@@ -124,8 +131,26 @@ EOF
       exit 1
     fi
 
-    echo "Created application '$APP_NAME'"
+    local TENANT_ID
+    TENANT_ID=$(az account show --query tenantId -o tsv)
+    if [[ -z "$TENANT_ID" ]]; then
+      echo "Error: Failed to resolve tenantId from current Azure CLI context."
+      exit 1
+    fi
+
+    if [[ -z "$USER_CONFIRMATION" ]]; then
+      echo "Created application '$APP_NAME'"
+    else
+      echo "Updated application '$APP_NAME'"
+    fi
     echo "appId: $APP_ID"
+    cat <<EOF
+export const config = {
+    "appName": "$APP_NAME",
+    "tenantId": "$TENANT_ID",
+    "clientId": "$APP_ID"
+};
+EOF
 }
 
 main "$@"