address pr comments

GladwinJohnson · GladwinJohnson · commit 69c1e47ca9b5 · 2025-05-06T09:29:50.000-07:00
diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/ManagedIdentityTestHooks.cs b/src/Microsoft.Identity.Web.TokenAcquisition/ManagedIdentityTestHooks.cs
diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net462/InternalAPI.Unshipped.txt b/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net462/InternalAPI.Unshipped.txt
@@ -1,4 +1,7 @@
 Microsoft.Identity.Web.ManagedIdentityTestHooks
+Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks
 static Microsoft.Identity.Web.ManagedIdentityTestHooks.HttpClientFactoryOverride.get -> Microsoft.Identity.Client.IMsalHttpClientFactory?
 static Microsoft.Identity.Web.ManagedIdentityTestHooks.HttpClientFactoryOverride.set -> void
-const Microsoft.Identity.Web.IDWebErrorMessage.ExceptionAcquiringTokenForConfidentialClient = "IDW10501: Exception acquiring token for a confidential client: " -> string!
+const Microsoft.Identity.Web.IDWebErrorMessage.ExceptionAcquiringTokenForConfidentialClient = "IDW10501: Exception acquiring token for a confidential client: " -> string!
+static Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks.HttpClientFactoryOverride.get -> Microsoft.Identity.Client.IMsalHttpClientFactory?
+static Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks.UseTestHttpClientFactory(Microsoft.Identity.Client.IMsalHttpClientFactory! factory) -> void
diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net462/PublicAPI.Unshipped.txt b/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net462/PublicAPI.Unshipped.txt
@@ -1 +0,0 @@
-static Microsoft.Identity.Web.TestOnly.TokenAcquirerFactoryTesting.UseTestHttpClientFactory(Microsoft.Identity.Client.IMsalHttpClientFactory! factory) -> void
diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net472/InternalAPI.Unshipped.txt b/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net472/InternalAPI.Unshipped.txt
@@ -1,4 +1,7 @@
 Microsoft.Identity.Web.ManagedIdentityTestHooks
+Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks
 static Microsoft.Identity.Web.ManagedIdentityTestHooks.HttpClientFactoryOverride.get -> Microsoft.Identity.Client.IMsalHttpClientFactory?
 static Microsoft.Identity.Web.ManagedIdentityTestHooks.HttpClientFactoryOverride.set -> void
-const Microsoft.Identity.Web.IDWebErrorMessage.ExceptionAcquiringTokenForConfidentialClient = "IDW10501: Exception acquiring token for a confidential client: " -> string!
+const Microsoft.Identity.Web.IDWebErrorMessage.ExceptionAcquiringTokenForConfidentialClient = "IDW10501: Exception acquiring token for a confidential client: " -> string!
+static Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks.HttpClientFactoryOverride.get -> Microsoft.Identity.Client.IMsalHttpClientFactory?
+static Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks.UseTestHttpClientFactory(Microsoft.Identity.Client.IMsalHttpClientFactory! factory) -> void
diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net472/PublicAPI.Unshipped.txt b/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net472/PublicAPI.Unshipped.txt
@@ -1 +0,0 @@
-static Microsoft.Identity.Web.TestOnly.TokenAcquirerFactoryTesting.UseTestHttpClientFactory(Microsoft.Identity.Client.IMsalHttpClientFactory! factory) -> void
diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net6.0/InternalAPI.Unshipped.txt b/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net6.0/InternalAPI.Unshipped.txt
@@ -1,4 +1,7 @@
 Microsoft.Identity.Web.ManagedIdentityTestHooks
+Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks
 static Microsoft.Identity.Web.ManagedIdentityTestHooks.HttpClientFactoryOverride.get -> Microsoft.Identity.Client.IMsalHttpClientFactory?
 static Microsoft.Identity.Web.ManagedIdentityTestHooks.HttpClientFactoryOverride.set -> void
-const Microsoft.Identity.Web.IDWebErrorMessage.ExceptionAcquiringTokenForConfidentialClient = "IDW10501: Exception acquiring token for a confidential client: " -> string!
+const Microsoft.Identity.Web.IDWebErrorMessage.ExceptionAcquiringTokenForConfidentialClient = "IDW10501: Exception acquiring token for a confidential client: " -> string!
+static Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks.HttpClientFactoryOverride.get -> Microsoft.Identity.Client.IMsalHttpClientFactory?
+static Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks.UseTestHttpClientFactory(Microsoft.Identity.Client.IMsalHttpClientFactory! factory) -> void
diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net6.0/PublicAPI.Unshipped.txt b/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net6.0/PublicAPI.Unshipped.txt
@@ -1 +0,0 @@
-static Microsoft.Identity.Web.TestOnly.TokenAcquirerFactoryTesting.UseTestHttpClientFactory(Microsoft.Identity.Client.IMsalHttpClientFactory! factory) -> void
diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net7.0/InternalAPI.Unshipped.txt b/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net7.0/InternalAPI.Unshipped.txt
@@ -1,4 +1,7 @@
 Microsoft.Identity.Web.ManagedIdentityTestHooks
+Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks
 static Microsoft.Identity.Web.ManagedIdentityTestHooks.HttpClientFactoryOverride.get -> Microsoft.Identity.Client.IMsalHttpClientFactory?
 static Microsoft.Identity.Web.ManagedIdentityTestHooks.HttpClientFactoryOverride.set -> void
-const Microsoft.Identity.Web.IDWebErrorMessage.ExceptionAcquiringTokenForConfidentialClient = "IDW10501: Exception acquiring token for a confidential client: " -> string!
+const Microsoft.Identity.Web.IDWebErrorMessage.ExceptionAcquiringTokenForConfidentialClient = "IDW10501: Exception acquiring token for a confidential client: " -> string!
+static Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks.HttpClientFactoryOverride.get -> Microsoft.Identity.Client.IMsalHttpClientFactory?
+static Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks.UseTestHttpClientFactory(Microsoft.Identity.Client.IMsalHttpClientFactory! factory) -> void
diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net7.0/PublicAPI.Unshipped.txt b/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net7.0/PublicAPI.Unshipped.txt
@@ -1 +0,0 @@
-static Microsoft.Identity.Web.TestOnly.TokenAcquirerFactoryTesting.UseTestHttpClientFactory(Microsoft.Identity.Client.IMsalHttpClientFactory! factory) -> void
diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net8.0/InternalAPI.Unshipped.txt b/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net8.0/InternalAPI.Unshipped.txt
@@ -1,4 +1,7 @@
 Microsoft.Identity.Web.ManagedIdentityTestHooks
+Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks
 static Microsoft.Identity.Web.ManagedIdentityTestHooks.HttpClientFactoryOverride.get -> Microsoft.Identity.Client.IMsalHttpClientFactory?
 static Microsoft.Identity.Web.ManagedIdentityTestHooks.HttpClientFactoryOverride.set -> void
-const Microsoft.Identity.Web.IDWebErrorMessage.ExceptionAcquiringTokenForConfidentialClient = "IDW10501: Exception acquiring token for a confidential client: " -> string!
+const Microsoft.Identity.Web.IDWebErrorMessage.ExceptionAcquiringTokenForConfidentialClient = "IDW10501: Exception acquiring token for a confidential client: " -> string!
+static Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks.HttpClientFactoryOverride.get -> Microsoft.Identity.Client.IMsalHttpClientFactory?
+static Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks.UseTestHttpClientFactory(Microsoft.Identity.Client.IMsalHttpClientFactory! factory) -> void
diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net8.0/PublicAPI.Unshipped.txt b/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net8.0/PublicAPI.Unshipped.txt
@@ -1 +0,0 @@
-static Microsoft.Identity.Web.TestOnly.TokenAcquirerFactoryTesting.UseTestHttpClientFactory(Microsoft.Identity.Client.IMsalHttpClientFactory! factory) -> void
diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net9.0/InternalAPI.Unshipped.txt b/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net9.0/InternalAPI.Unshipped.txt
@@ -1,4 +1,7 @@
 Microsoft.Identity.Web.ManagedIdentityTestHooks
+Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks
 static Microsoft.Identity.Web.ManagedIdentityTestHooks.HttpClientFactoryOverride.get -> Microsoft.Identity.Client.IMsalHttpClientFactory?
 static Microsoft.Identity.Web.ManagedIdentityTestHooks.HttpClientFactoryOverride.set -> void
-const Microsoft.Identity.Web.IDWebErrorMessage.ExceptionAcquiringTokenForConfidentialClient = "IDW10501: Exception acquiring token for a confidential client: " -> string!
+const Microsoft.Identity.Web.IDWebErrorMessage.ExceptionAcquiringTokenForConfidentialClient = "IDW10501: Exception acquiring token for a confidential client: " -> string!
+static Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks.HttpClientFactoryOverride.get -> Microsoft.Identity.Client.IMsalHttpClientFactory?
+static Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks.UseTestHttpClientFactory(Microsoft.Identity.Client.IMsalHttpClientFactory! factory) -> void
diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net9.0/PublicAPI.Unshipped.txt b/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net9.0/PublicAPI.Unshipped.txt
@@ -1 +0,0 @@
-static Microsoft.Identity.Web.TestOnly.TokenAcquirerFactoryTesting.UseTestHttpClientFactory(Microsoft.Identity.Client.IMsalHttpClientFactory! factory) -> void
diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/netstandard2.0/InternalAPI.Unshipped.txt b/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/netstandard2.0/InternalAPI.Unshipped.txt
@@ -1,4 +1,7 @@
 Microsoft.Identity.Web.ManagedIdentityTestHooks
+Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks
 static Microsoft.Identity.Web.ManagedIdentityTestHooks.HttpClientFactoryOverride.get -> Microsoft.Identity.Client.IMsalHttpClientFactory?
 static Microsoft.Identity.Web.ManagedIdentityTestHooks.HttpClientFactoryOverride.set -> void
-const Microsoft.Identity.Web.IDWebErrorMessage.ExceptionAcquiringTokenForConfidentialClient = "IDW10501: Exception acquiring token for a confidential client: " -> string!
+const Microsoft.Identity.Web.IDWebErrorMessage.ExceptionAcquiringTokenForConfidentialClient = "IDW10501: Exception acquiring token for a confidential client: " -> string!
+static Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks.HttpClientFactoryOverride.get -> Microsoft.Identity.Client.IMsalHttpClientFactory?
+static Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks.UseTestHttpClientFactory(Microsoft.Identity.Client.IMsalHttpClientFactory! factory) -> void
diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/netstandard2.0/PublicAPI.Unshipped.txt b/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/netstandard2.0/PublicAPI.Unshipped.txt
@@ -1 +0,0 @@
-static Microsoft.Identity.Web.TestOnly.TokenAcquirerFactoryTesting.UseTestHttpClientFactory(Microsoft.Identity.Client.IMsalHttpClientFactory! factory) -> void
diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/TokenAcquirerFactoryTesting.cs b/src/Microsoft.Identity.Web.TokenAcquisition/TokenAcquirerFactoryTesting.cs
@@ -1,9 +1,6 @@
 ﻿// Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
-using System.Net.Http;
-using Microsoft.Identity.Client;
-
 namespace Microsoft.Identity.Web.TestOnly
 {
     /// <summary>
@@ -20,13 +17,5 @@ public static void ResetTokenAcquirerFactoryInTest()
         {
             TokenAcquirerFactory.ResetDefaultInstance();
         }
-
-        /// <summary>
-        /// Injects a custom <see cref="IMsalHttpClientFactory"/> so that all
-        /// Managed-Identity calls made during the current test use the supplied
-        /// (mocked) <see cref="HttpClient"/>.
-        /// </summary>
-        public static void UseTestHttpClientFactory(IMsalHttpClientFactory factory)
-            => ManagedIdentityTestHooks.HttpClientFactoryOverride = factory;
     }
 }
diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/TokenAcquirerTestHooks.cs b/src/Microsoft.Identity.Web.TokenAcquisition/TokenAcquirerTestHooks.cs
@@ -0,0 +1,24 @@
+﻿// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License.
+
+using Microsoft.Identity.Client;
+
+namespace Microsoft.Identity.Web.TestOnly
+{
+    /// <summary>
+    /// INTERNAL – intended solely for unit-tests.
+    /// Allows tests to inject their own IMsalHttpClientFactory so that
+    /// Managed-Identity flows use mocked HTTP Client Factory.
+    /// </summary>
+    internal static class TokenAcquirerTestHooks
+    {
+        /// <remarks>
+        /// Tests call this *before* the first MI token request.
+        /// Product code never sets this value.
+        /// </remarks>
+        internal static void UseTestHttpClientFactory(IMsalHttpClientFactory factory)
+            => HttpClientFactoryOverride = factory;
+
+        internal static IMsalHttpClientFactory? HttpClientFactoryOverride { get; private set; }
+    }
+}
diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/TokenAcquisition.ManagedIdentity.cs b/src/Microsoft.Identity.Web.TokenAcquisition/TokenAcquisition.ManagedIdentity.cs
@@ -9,6 +9,7 @@
 using Microsoft.Identity.Abstractions;
 using Microsoft.Identity.Client;
 using Microsoft.Identity.Client.AppConfig;
+using Microsoft.Identity.Web.TestOnly;
 using Microsoft.IdentityModel.Tokens;
 
 namespace Microsoft.Identity.Web
@@ -105,10 +106,10 @@ private IManagedIdentityApplication BuildManagedIdentityApplication(
 
             // TEST-ONLY: if a test has supplied a factory, use it; otherwise stay default
             // Default factory is handled by MSAL
-            if (ManagedIdentityTestHooks.HttpClientFactoryOverride is not null)
+            if (TokenAcquirerTestHooks.HttpClientFactoryOverride is not null)
             { 
                 miBuilder.WithHttpClientFactory(
-                ManagedIdentityTestHooks.HttpClientFactoryOverride);
+                TokenAcquirerTestHooks.HttpClientFactoryOverride);
             }
 
             return miBuilder.Build();
diff --git a/tests/DevApps/daemon-app/daemon-app-msi/Program - SDK.cs b/tests/DevApps/daemon-app/daemon-app-msi/Program - SDK.cs
diff --git a/tests/DevApps/daemon-app/daemon-app-msi/Program-net60.cs b/tests/DevApps/daemon-app/daemon-app-msi/Program-net60.cs
diff --git a/tests/DevApps/daemon-app/daemon-app-msi/Program.cs b/tests/DevApps/daemon-app/daemon-app-msi/Program.cs
@@ -7,31 +7,44 @@
 using Microsoft.Identity.Web;
 using System.Net;
 using System.Text.Json;
+
 // ── 1. bootstrap factory (reads appsettings.json automatically) ─────────
 var factory = TokenAcquirerFactory.GetDefaultInstance();
+
 // optional console logging
 factory.Services.AddLogging(b => b.AddConsole().SetMinimumLevel(LogLevel.Warning));
+
 // ── 2. register the downstream API using the "AzureKeyVault" section ────
 factory.Services.AddDownstreamApi("AzureKeyVault",
     factory.Configuration.GetSection("AzureKeyVault"));
-var sp = factory.Build();
-var api = sp.GetRequiredService<IDownstreamApi>();
+IServiceProvider sp = factory.Build();
+IDownstreamApi api = sp.GetRequiredService<IDownstreamApi>();
+
 // ── 3. call the vault (app-token path) ──────────────────────────────────
-var response = await api.CallApiForAppAsync("AzureKeyVault");
-if (response.StatusCode == HttpStatusCode.OK)
+HttpResponseMessage response = await api.CallApiForAppAsync("AzureKeyVault");
+
+if (response.StatusCode != HttpStatusCode.OK)
+{
+    Console.WriteLine($"Vault returned {(int)response.StatusCode} {response.ReasonPhrase}");
+    return;
+}
+
+//Get the secret value from the response
+using var doc = JsonDocument.Parse(await response.Content.ReadAsStringAsync());
+
+// Check if the "value" property exists and is a string
+if (doc.RootElement.TryGetProperty("value", out var valueElement) && valueElement.ValueKind == JsonValueKind.String)
 {
-    using var doc = JsonDocument.Parse(await response.Content.ReadAsStringAsync());
-    if (doc.RootElement.TryGetProperty("value", out var valueElement) && valueElement.ValueKind == JsonValueKind.String)
+    // Retrieve the secret value but do not print it
+    string secret = valueElement.GetString()!;
+
+    // Optionally, you can check if the secret is not null or empty
+    if (!string.IsNullOrEmpty(secret))
     {
-        string secret = valueElement.GetString()!;
-        Console.WriteLine($"Secret value = {secret}");
+        Console.WriteLine("Secret retrieved successfully (non-null).");
     }
     else
     {
-        Console.WriteLine("The 'value' property is missing or is not a string.");
+        Console.WriteLine("Secret value was empty.");
     }
 }
-else
-{
-    Console.WriteLine($"Vault returned {(int)response.StatusCode} {response.ReasonPhrase}");
-}
diff --git a/tests/DevApps/daemon-app/daemon-app-msi/daemon-app-msi.csproj b/tests/DevApps/daemon-app/daemon-app-msi/daemon-app-msi.csproj
@@ -10,16 +10,6 @@
     <IsPackable>false</IsPackable>
   </PropertyGroup>
 
-  <ItemGroup>
-    <Compile Remove="Program - SDK.cs" />
-    <Compile Remove="Program-net60.cs" />
-  </ItemGroup>
-
-  <ItemGroup>
-    <None Include="Program - SDK.cs" />
-    <None Include="Program-net60.cs" />
-  </ItemGroup>
-
   <ItemGroup>
     <PackageReference Include="Newtonsoft.Json" Version="13.0.1" />
   </ItemGroup>
diff --git a/tests/DevApps/daemon-app/daemon-app-msi/readme.md b/tests/DevApps/daemon-app/daemon-app-msi/readme.md
@@ -0,0 +1,48 @@
+﻿# VM-Hosted Key Vault Secret Retriever
+
+Tiny console app that runs **inside an Azure VM** configured with a **User-Assigned Managed Identity (UAMI)**.  
+Its only job is to fetch **Secret** from an Azure Key Vault section in *appsettings.json*.
+
+---
+
+## 1. Prerequisites
+
+| Requirement | Notes |
+|-------------|-------|
+| Azure VM     | Any OS; the UAMI must be **assigned** to the VM. |
+| User-Assigned Managed Identity | Needs ** `Get`** permission on the Key Vault’s **Secrets**. |
+| Key Vault    | Secret named `secret` (or whatever your *AzureKeyVault* section points to). |
+| .NET 8 SDK   | Build / run the app locally or on the VM. |
+| *appsettings.json* | Contains an `AzureKeyVault` block with `BaseUrl`, `RelativePath`, etc. |
+
+> 💡 **Least privilege**: grant the UAMI only the `secrets/get` permission.
+
+---
+
+## 2. How the Code Works
+
+```txt
+┌─────────────┐    1. TokenAcquirerFactory auto-binds
+│ appsettings │─── to Azure credentials (UAMI) on the VM.
+└─────────────┘
+        │
+        ▼
+┌────────────────────┐   2. Register “AzureKeyVault” downstream API
+│  DI Service graph  │── using the config section.
+└────────────────────┘
+        │
+        ▼
+┌───────────────────────┐
+│  IDownstreamApi.Call  │ 3. GET {vault-url}/secrets/secret?api-version=7.4
+└───────────────────────┘
+        │
+        ▼
+┌───────────────────────┐
+│  HttpResponseMessage  │ 4. Parse JSON; extract `value`.
+└───────────────────────┘
+        │
+        ▼
+┌───────────────────────┐
+│  Console logging      │ 5. Log *success*.
+└───────────────────────┘
+```
diff --git a/tests/Microsoft.Identity.Web.Test/ManagedIdentityCaeTests.cs b/tests/Microsoft.Identity.Web.Test/ManagedIdentityCaeTests.cs

Original file line number	Diff line number	Diff line change
`@@ -1 +0,0 @@`
`1`		`-static Microsoft.Identity.Web.TestOnly.TokenAcquirerFactoryTesting.UseTestHttpClientFactory(Microsoft.Identity.Client.IMsalHttpClientFactory! factory) -> void`