refactor: Proposed refactoring of API Plugin from Scratch with OAuth #13063
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Proposed changes to TTK Scaffolding for Declarative Agent with OAuth
The currently generated code requires modifying the middleware to meet application needs; this is not ideal because:
These changes are proposed to better separate the API code (Azure functions) from the "middleware".
It was my intent not to change the logic or default settings at all - these changes should only rearrange things to make it less necessary for agent developers to modify the middleware.
IF accepted, I will submit a similar PR for the JavaScript version.
Summary of changes
Instead of hard-coding, pass arguments to the authMiddleware function for things that are likely to vary in different apps. The default values for optional arguments will be the same as the current hard-coded values, which are indeed the most commonly needed.
a. scope (mandatory) - the authorization scope, currently hard coded to "repairs_read". The proposed argument supports either a single scope (string) or an array of scopes ([string]) since some apps will support many scopes for different permissions.
b. allowedTenants (optional) - an array of tenant IDs that are authorized to use the app
c. cloudType (optional) - the cloud type which is used to retrieve the correct JWKS URI to handle common, government, and national clouds
d. issuer (optional) - the issuer, which will vary for multi-tenant apps and different clouds
Return claims from authMiddleware so the API can access the user ID, name, upn, tenant ID, etc. that are commonly used to organize data for each user and/or tenant
Other changes:
a. Made the req argument on authMiddleWare mandatory; it was optional but the code would fail if it wasn't specified
b. Expose the CloudType enum and EntraJwtPayload interface from authMiddlweare.ts so developers don't take dependencies on the libry functions, which may change
c. Added commonly needed claims such as name and oid to the EntraJwtPayload interface in tokenValidator.ts
Thanks!