Skip to content

fix(oauth): derive default scopes per request - #192

Open
Slai.life (huong8373tt-beep) wants to merge 1 commit into
microsoft:mainfrom
huong8373tt-beep:fix/oauth-request-local-default-scopes
Open

Slai.life (huong8373tt-beep) wants to merge 1 commit into
microsoft:mainfrom
huong8373tt-beep:fix/oauth-request-local-default-scopes

Conversation

@huong8373tt-beep

Copy link
Copy Markdown

Summary

Fixes OAuth default-scope derivation so it is calculated per request instead of being persisted from the first request. This prevents a provider reused across multiple allowed hosts from sending the wrong default scope and token.

Changes

  • Derive the default https://<host>/.default scope locally for each request.
  • Keep explicitly configured scopes unchanged and avoid mutating the caller's array.
  • Key cached access tokens by their effective scopes so tokens are not reused across hosts.
  • Add regression coverage for consecutive requests to different hosts and cache reuse by effective scope.

Testing

  • bundle exec rake spec — 13 examples, 0 failures
  • bundle exec rubocop — 16 files inspected, no offenses
  • bundle check — dependencies satisfied
  • gem build microsoft_kiota_authentication_oauth.gemspec — passed
  • git diff --check — passed

Disclosure

Slai Agent Runtime assisted with analysis, reproduction, implementation, and test execution. The account owner authorized this contribution and is responsible for the submission.

@huong8373tt-beep
Slai.life (huong8373tt-beep) requested a review from a team as a code owner October 24, 2026 22:23
Copilot AI balanced review requested due to automatic review settings October 24, 2026 22:23

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

The focused implementation and regression coverage support the intended behavior, with no unresolved findings.

No open issues 🎉

What changed in this PR

This PR fixes the OAuth token provider’s reuse across allowed hosts by deriving default scopes per request and caching tokens by effective scopes.

Changes:

  • Calculate request-specific default scopes without modifying configured scopes.
  • Cache and reuse access tokens by effective scopes.
  • Add regression coverage for multiple hosts, cache reuse, and preservation of caller-provided scopes.
File Description
components/​authentication/​oauth/​spec/​oauth_access_token_provider_spec.rb Tests per-request scopes, scope-keyed caching, and configured-scope preservation.
components/​authentication/​oauth/​lib/​microsoft_kiota_authentication_oauth/​oauth_access_token_provider.rb Derives effective scopes locally, copies configured scopes, and keys cached tokens by scope.

Review effort: Balanced

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants