[Vincent Biret (baywet)]

Description

Return a Fiber yielding nil for missing or disallowed request targets before initializing scopes or requesting a token. Preserve token acquisition for allowed HTTPS hosts and when no host list is configured.

Validation

• Regression tests executed before the fix: 5 examples, 3 expected failures.
• After the fix: 5 focused examples passing; 134 OAuth and abstractions examples passing.
• OAuth component rake task passes (10 examples).
• RuboCop passes for both changed files.
• All Ruby validation ran in a Ruby 3.3 Docker container.

[Copilot]

🟢 Approval recommended

The focused fix preserves the caller’s Fiber contract, and the regression tests cover rejected targets and successful token acquisition.

No open issues 🎉

What changed in this PR

Fixes OAuth allowed-host enforcement by returning a Fiber yielding nil for missing or disallowed targets before scope initialization or token acquisition.

Changes:

• Adds an explicit early return while preserving the Fiber contract.
• Adds regression tests for rejected targets, allowed hosts, unrestricted host configuration, and authorization-header omission.

File	Description
components/​authentication/​oauth/​spec/​oauth_access_token_provider_spec.rb	Tests host filtering, missing targets, token acquisition, and header behavior.
components/​authentication/​oauth/​lib/​microsoft_kiota_authentication_oauth/​oauth_access_token_provider.rb	Stops processing missing or disallowed targets with a nil-returning Fiber.

_{Review effort: Balanced}