Add client assertion authentication

[Dongle (dongle-the-gadget)]

Add support for MSAL Client Assertion authentication. Client Assertion authentication enables users to use GitHub Actions OpenID Connect, which is a more secure way to authenticate to Microsoft services without requiring client secrets.

The Client Assertion mechanism uses the MSSTORE_CLIENT_ASSERTION/MSSTORE_CLIENT_ASSERTION_FILE environment variables, and is activated by msstore reconfigure --clientAssertion.

[Alexandre Zollinger Chohfi (azchohfi)]

Could we get a --clientAssertion case in ReconfigureCommandUnitTests alongside the existing --clientSecret one? Good to have the new option covered end to end.

[Alexandre Zollinger Chohfi (azchohfi)]

This is a big improvement — thanks for taking it on. Storing just the flag, supporting both the variable and a file, checking the assertion branch before the certificate, and short-circuiting the retry loop all look right to me. Three small things left, then I think we're there.

[Copilot]

Pull request overview

Adds client assertion authentication across the CLI and Store APIs, including environment/file-based assertion retrieval.

Changes:

• Adds client assertion configuration and CLI support.
• Adds MSAL client assertion authentication overloads.
• Adds assertion handling for packaged and unpackaged APIs.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
MSStore.CLI/Services/StoreAPIFactory.cs	Selects assertion authentication.
MSStore.CLI/Services/ICLIConfigurator.cs	Extends configuration contract.
MSStore.CLI/Services/EnvironmentInfo.cs	Reads assertions from environment or file.
MSStore.CLI/Services/Configurations.cs	Persists authentication mode.
MSStore.CLI/Services/CLIConfigurator.cs	Configures and validates assertion authentication.
MSStore.CLI/MicrosoftStoreCLI.cs	Recognizes assertion-based configuration.
MSStore.CLI/Commands/ReconfigureCommand.cs	Adds the client assertion option.
MSStore.API/SubmissionClient.cs	Adds MSAL assertion token acquisition.
MSStore.API/StoreAPI.cs	Supports assertions for Store API access.
MSStore.API/Packaged/StorePackagedAPI.cs	Supports assertions for Dev Center access.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Alexandre Zollinger Chohfi (azchohfi)]

All three from last round look good — thanks. The Func<Task<string>> change is exactly right, and the trim and the pre-flight check both do what I was after. One thing got lost in the last commit though, plus two small ones.

[Alexandre Zollinger Chohfi (azchohfi)]

All three fixed — thanks. One follow-on from the error-reporting change, and an answer to your testing question.

[Alexandre Zollinger Chohfi (azchohfi)]

This is in good shape now — thanks for sticking with it through the back and forth.

Worth saying what this ended up as, because it moved a long way from where it started: the assertion never touches disk, it's resolved fresh on each invocation from either MSSTORE_CLIENT_ASSERTION or MSSTORE_CLIENT_ASSERTION_FILE, a missing or unreadable token fails immediately with a message that names the variable instead of dropping into a prompt nobody can answer in CI, and the file path works for setups like AKS that project a rotating token. That's a genuinely better shape than what any of us sketched at the start.

The tests are a nice touch too — using a fixture with real leading and trailing whitespace is a more honest trim test than asserting on a string literal.

One unrelated thing I noticed while reading through: reconfigure clears the stored credential before it validates, so a failed switch from a secret to another auth mode can leave you with no secret and a config that still expects one. That's pre-existing and not caused by your change — the certificate path reaches it too — so I'll handle it separately.

Thanks again for the contribution and for your patience with the review.

[Dave Smits (davesmits)]

is there an example how to use? I guess somewhere the env variable MSSTORE_CLIENT_ASSERTION needs to be set in the action?