8000 [rush] New parameters for Azure Storage plugin (#4995) · atingmicrosoft/rushstack@9193215 · GitHub
[go: up one dir, main page]
Skip to content

Commit 9193215

Browse files
dmichon-msftdmichon-msft
authored
[rush] New parameters for Azure Storage plugin (microsoft#4995)
* [rush] New parameters for Azure Storage plugin * Fixup schema --------- Co-authored-by: David Michon <dmichon-msft@users.noreply.github.com>
1 parent d83665c commit 9193215

File tree

8 files changed

+61
-14
lines changed

8 files changed

+61
-14
lines changed

‎common/changes/@microsoft/rush/azure-default-credential_2024-11-07-22-38.json

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line nu 8000 mberDiff line change
@@ -0,0 +1,10 @@
1+
{
2+
"changes": [
3+
{
4+
"packageName": "@microsoft/rush",
5+
"comment": "Adds two new properties to the configuration for `rush-azure-storage-build-cache-plugin`: `loginFlow` selects the flow to use for interactive authentication to Entra ID, and `readRequiresAuthentication` specifies that a SAS token is required for read and therefore expired authentication is always fatal.",
6+
"type": "none"
7+
}
8+
],
9+
"packageName": "@microsoft/rush"
10+
}

‎common/reviews/api/rush-azure-storage-build-cache-plugin.api.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ export abstract class AzureAuthenticationBase {
4747
tryGetCachedCredentialAsync(options: ITryGetCachedCredentialOptionsLogWarning): Promise<ICredentialCacheEntry | undefined>;
4848
// (undocumented)
4949
updateCachedCredentialAsync(terminal: ITerminal, credential: string): Promise<void>;
50-
updateCachedCredentialInteractiveAsync(terminal: ITerminal, onlyIfExistingCredentialExpiresAfter?: Date): Promise<void>;
50+
updateCachedCredentialInteractiveAsync(terminal: ITerminal, onlyIfExistingCredentialExpiresBefore?: Date): Promise<void>;
5151
}
5252

5353
// @public (undocumented)

‎rush-plugins/rush-azure-storage-build-cache-plugin/src/AzureAuthenticationBase.ts

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -146,9 +146,13 @@ export abstract class AzureAuthenticationBase {
146146
}
147147

148148
public constructor(options: IAzureAuthenticationBaseOptions) {
149-
this._azureEnvironment = options.azureEnvironment || 'AzurePublicCloud';
149+
const {
150+
azureEnvironment = 'AzurePublicCloud',
151+
loginFlow = process.env.CODESPACES === 'true' ? 'AdoCodespacesAuth' : 'InteractiveBrowser'
152+
} = options;
153+
this._azureEnvironment = azureEnvironment;
150154
this._credentialUpdateCommandForLogging = options.credentialUpdateCommandForLogging;
151-
this._loginFlow = options.loginFlow || 'DeviceCode';
155+
this._loginFlow = loginFlow< 8000 span class="pl-kos">;
152156
this._failoverOrder = options.loginFlowFailover || {
153157
AdoCodespacesAuth: 'InteractiveBrowser',
154158
InteractiveBrowser: 'DeviceCode',
@@ -174,25 +178,25 @@ export abstract class AzureAuthenticationBase {
174178
* Launches an interactive flow to renew a cached credential.
175179
*
176180
* @param terminal - The terminal to log output to
177-
* @param onlyIfExistingCredentialExpiresAfter - If specified, and a cached credential exists that is still valid
178-
* after the date specified, no action will be taken.
181+
* @param onlyIfExistingCredentialExpiresBefore - If specified, and a cached credential exists, action will only
182+
* be taken if the cached credential expires before the specified date.
179183
*/
180184
public async updateCachedCredentialInteractiveAsync(
181185
terminal: ITerminal,
182-
onlyIfExistingCredentialExpiresAfter?: Date
186+
onlyIfExistingCredentialExpiresBefore?: Date
183187
): Promise<void> {
184188
await CredentialCache.usingAsync(
185189
{
186190
supportEditing: true
187191
},
188192
async (credentialsCache: CredentialCache) => {
189-
if (onlyIfExistingCredentialExpiresAfter) {
193+
if (onlyIfExistingCredentialExpiresBefore) {
190194
const existingCredentialExpiration: Date | undefined = credentialsCache.tryGetCacheEntry(
191195
this._credentialCacheId
192196
)?.expires;
193197
if (
194198
existingCredentialExpiration &&
195-
existingCredentialExpiration > onlyIfExistingCredentialExpiresAfter
199+
existingCredentialExpiration > onlyIfExistingCredentialExpiresBefore
196200
) {
197201
return;
198202
}

‎rush-plugins/rush-azure-storage-build-cache-plugin/src/AzureStorageBuildCacheProvider.ts

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ import {
2424

2525
export interface IAzureStorageBuildCacheProviderOptions extends IAzureStorageAuthenticationOptions {
2626
blobPrefix?: string;
27+
readRequiresAuthentication?: boolean;
2728
}
2829

2930
interface IBlobError extends Error {
@@ -43,6 +44,7 @@ export class AzureStorageBuildCacheProvider
4344
{
4445
private readonly _blobPrefix: string | undefined;
4546
private readonly _environmentCredential: string | undefined;
47+
private readonly _readRequiresAuthentication: boolean;
4648

4749
public get isCacheWriteAllowed(): boolean {
4850
return EnvironmentConfiguration.buildCacheWriteAllowed ?? this._isCacheWriteAllowedByConfiguration;
@@ -58,6 +60,7 @@ export class AzureStorageBuildCacheProvider
5860

5961
this._blobPrefix = options.blobPrefix;
6062
this._environmentCredential = EnvironmentConfiguration.buildCacheCredential;
63+
this._readRequiresAuthentication = !!options.readRequiresAuthentication;
6164

6265
if (!(this._azureEnvironment in AzureAuthorityHosts)) {
6366
throw new Error(
@@ -208,8 +211,8 @@ export class AzureStorageBuildCacheProvider
208211
if (sasString) {
209212
const connectionString: string = this._getConnectionString(sasString);
210213
blobServiceClient = BlobServiceClient.fromConnectionString(connectionString);
211-
} else if (!this._isCacheWriteAllowedByConfiguration) {
212-
// If cache write isn't allowed and we don't have a credential, assume the blob supports anonymous read
214+
} else if (!this._readRequiresAuthentication && !this._isCacheWriteAllowedByConfiguration) {
215+
// If we don't have a credential and read doesn't require authentication, we can still read from the cache.
213216
blobServiceClient = new BlobServiceClient(this._storageAccountUrl);
214217
} else {
215218
throw new Error(

‎rush-plugins/rush-azure-storage-build-cache-plugin/src/RushAzureInteractiveAuthPlugin.ts

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ export interface IAzureInteractiveAuthOptions {
2727

2828
/**
2929
* Login flow to use for interactive authentication.
30-
* @defaultValue 'deviceCode'
30+
* @defaultValue 'AdoCodespacesAuth' if on GitHub Codespaces, 'InteractiveBrowser' otherwise
3131
*/
3232
readonly loginFlow?: LoginFlowType;
3333

@@ -86,7 +86,7 @@ export default class RushAzureInteractieAuthPlugin implements IRushPlugin {
8686
storageContainerName,
8787
azureEnvironment = 'AzurePublicCloud',
8888
minimumValidityInMinutes,
89-
loginFlow = 'DeviceCode'
89+
loginFlow = process.env.CODESPACES ? 'AdoCodespacesAuth' : 'InteractiveBrowser'
9090
} = options;
9191

9292
const logger: ILogger = rushSession.getLogger(PLUGIN_NAME);

‎rush-plugins/rush-azure-storage-build-cache-plugin/src/RushAzureStorageBuildCachePlugin.ts

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
// See LICENSE in the project root for license information.
33

44
import type { IRushPlugin, RushSession, RushConfiguration } from '@rushstack/rush-sdk';
5-
import type { AzureEnvironmentName } from './AzureAuthenticationBase';
5+
import type { AzureEnvironmentName, LoginFlowType } from './AzureAuthenticationBase';
66

77
const PLUGIN_NAME: string = 'AzureStorageBuildCachePlugin';
88

@@ -25,6 +25,12 @@ interface IAzureBlobStorageConfigurationJson {
2525
*/
2626
azureEnvironment?: AzureEnvironmentName;
2727

28+
/**
29+
* Login flow to use for interactive authentication.
30+
* @defaultValue 'AdoCodespacesAuth' if on GitHub Codespaces, 'InteractiveBrowser' otherwise
31+
*/
32+
readonly loginFlow?: LoginFlowType;
33+
2834
/**
2935
* An optional prefix for cache item blob names.
3036
*/
@@ -34,6 +40,11 @@ interface IAzureBlobStorageConfigurationJson {
3440
* If set to true, allow writing to the cache. Defaults to false.
3541
*/
3642
isCacheWriteAllowed?: boolean;
43+
44+
/**
45+
* If set to true, reading the cache requires authentication. Defaults to false.
46+
*/
47+
readRequiresAuthentication?: boolean;
3748
}
3849

3950
/**
@@ -55,7 +66,9 @@ export class RushAzureStorageBuildCachePlugin implements IRushPlugin {
5566
storageContainerName: azureBlobStorageConfiguration.storageContainerName,
5667
azureEnvironment: azureBlobStorageConfiguration.azureEnvironment,
5768
blobPrefix: azureBlobStorageConfiguration.blobPrefix,
58-
isCacheWriteAllowed: !!azureBlobStorageConfiguration.isCacheWriteAllowed
69+
loginFlow: azureBlobStorageConfiguration.loginFlow,
70+
isCacheWriteAllowed: !!azureBlobStorageConfiguration.isCacheWriteAllowed,
71+
readRequiresAuthentication: !!azureBlobStorageConfiguration.readRequiresAuthentication
5972
});
6073
});
6174
});

‎rush-plugins/rush-azure-storage-build-cache-plugin/src/schemas/azure-blob-storage-config.schema.json

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,12 @@
2525
"enum": ["AzurePublicCloud", "AzureChina", "AzureGermany", "AzureGovernment"]
2626
},
2727

28+
"loginFlow": {
29+
"type": "string",
30+
"description": "The Entra ID login flow to use. Defaults to 'AdoCodespacesAuth' on GitHub Codespaces, 'InteractiveBrowser' otherwise.",
31+
"enum": ["AdoCodespacesAuth", "InteractiveBrowser", "DeviceCode"]
32+
},
33+
2834
"blobPrefix": {
2935
"type": "string",
3036
"description": "An optional prefix for cache item blob names."
@@ -33,6 +39,11 @@
3339
"isCacheWriteAllowed": {
3440
"type": "boolean",
3541
"description": "If set to true, allow writing to the cache. Defaults to false."
42+
},
43+
44+
"readRequiresAuthentication": {
45+
"type": "boolean",
46+
"description": "If set to true, reading the cache requires authentication. Defaults to false."
3647
}
3748
}
3849
}

‎rush-plugins/rush-azure-storage-build-cache-plugin/src/schemas/azure-interactive-auth.schema.json

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,12 @@
2525
"enum": ["AzurePublicCloud", "AzureChina", "AzureGermany", "AzureGovernment"]
2626
},
2727

28+
"loginFlow": {
29+
"type": "string",
30+
"description": "The Entra ID login flow to use. Defaults to 'AdoCodespacesAuth' on GitHub Codespaces, 'InteractiveBrowser' otherwise.",
31+
"enum": ["AdoCodespacesAuth", "InteractiveBrowser", "DeviceCode"]
32+
},
33+
2834
"minimumValidityInMinutes": {
2935
"type": "number",
3036
"description": "If specified and a credential exists that will be valid for at least this many minutes from the time of execution, no action will be taken."

0 commit comments

Comments
 (0)
0