feat(azdext): add P1 core extension primitives and hardening#6954
feat(azdext): add P1 core extension primitives and hardening#6954jongio wants to merge 3 commits intoAzure:mainfrom
Conversation
Implements Azure#6944 core primitives for token provider, scope detection, resilient HTTP client, and pagination with tests. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Addresses MQ findings for Azure#6944: bounded response reads, nextLink SSRF protections, retry/body semantics, token-over-http guard, deterministic scope rules, and added regression tests. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Apply required gofmt and cspell updates so mage preflight passes for draft PR Azure#6954. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Azure Dev CLI Install InstructionsInstall scriptsMacOS/Linux
bash: pwsh: WindowsPowerShell install MSI install Standalone Binary
MSI
Documentationlearn.microsoft.com documentationtitle: Azure Developer CLI reference
|
Summary
Implements #6944 (P1 core primitives for
azdext) and includes the quality/security hardening required by the quality gate for this scope.Feature-by-feature rationale
1) Token provider primitives (
token_provider*)Why implemented: extensions need a standard, reusable way to acquire/refresh Azure tokens without each extension re-implementing auth plumbing. This reduces duplicated credential logic and inconsistent token handling across extensions.
2) Scope detector primitives (
scope_detector*)Why implemented: extensions call multiple Azure resource/data-plane endpoints; scope selection is easy to get wrong and causes auth failures. Centralizing scope derivation provides consistent, testable behavior and fewer endpoint-specific auth bugs.
3) Resilient HTTP client primitives (
resilient_http_client*)Why implemented: extensions need a shared HTTP baseline for retries/timeouts/auth/error behavior. A common client avoids copy-paste retry code and enforces safer defaults and consistent failure handling.
4) Pagination primitives (
pagination*)Why implemented: Azure list APIs commonly return
nextLinkpaging. Without a shared primitive, every extension must hand-roll paging loops, which leads to duplication and inconsistent edge-case handling.Why hardening is included in this PR
These are not unrelated extras; they are direct safeguards on the new #6944 primitives discovered during MQ:
nextLinktraversal (SSRF resistance)Scope / Non-goals
In scope:
cli/azd/pkg/azdext/{token_provider*,scope_detector*,resilient_http_client*,pagination*}Out of scope: integration helpers (#6945), output/logging (#6946), security utility workstream (#6947), runtime utilities (#6948), cleanup/migration (#6949), docs umbrella (#6863).
Validation
Executed in isolated worktree branch:
GOWORK=off go vet ./pkg/azdext/...GOWORK=off go test ./pkg/azdext -count=1GOWORK=off staticcheck ./pkg/azdext/...mage preflightLinked work
Reviewer guidance
Please review as the first stacked PR in the series; follow-ups build on this branch with narrow scope per issue.