Authenticate Entra ID marketplace API requests via RFC 9728 PRM negotiation - #325804
Open
Michael Cummings (MSFT) (mcumming) wants to merge 49 commits into
Open
Authenticate Entra ID marketplace API requests via RFC 9728 PRM negotiation#325804Michael Cummings (MSFT) (mcumming) wants to merge 49 commits into
Michael Cummings (MSFT) (mcumming) wants to merge 49 commits into
Conversation
Copilot started reviewing on behalf of
Michael Cummings (MSFT) (mcumming)
July 14, 2026 14:36
View session
Contributor
There was a problem hiding this comment.
Pull request overview
Implements authenticated access to Private Marketplaces by discovering RFC 9728 Protected Resource Metadata (PRM) and negotiating a resource-scoped bearer token, then threading that token through all VS Code surfaces that perform marketplace requests (workbench, shared process/remote, gallery API, and extension resource loading).
Changes:
- Add PRM discovery + resource-scoped token negotiation for auth-gated marketplace service indexes, exposing the negotiated token via
IExtensionGalleryManifestService.getAccessToken(). - Attach the negotiated token to marketplace API/asset requests and extension resource requests, guarded by same-secure-origin checks to prevent token leakage.
- Extend marketplace status modeling + UX (new statuses, provider-aware sign-in) and add unit tests covering negotiation/error/cache paths.
Show a summary per file
| File | Description |
|---|---|
| src/vs/workbench/services/extensionManagement/test/electron-browser/extensionGalleryManifestService.test.ts | Adds unit coverage for Microsoft/GitHub routing, negotiation (401→PRM), caching, and status transitions. |
| src/vs/workbench/services/extensionManagement/electron-browser/extensionGalleryManifestService.ts | Implements negotiation, caching, eligibility checks, token threading to IPC channels, and new status handling. |
| src/vs/workbench/contrib/extensions/common/extensions.ts | Re-exports the marketplace auth-provider context key for workbench contributions. |
| src/vs/workbench/contrib/extensions/browser/extensionsViewlet.ts | Updates welcome content and badges for new marketplace statuses and provider-specific sign-in messaging. |
| src/vs/workbench/contrib/extensions/browser/extensions.contribution.ts | Registers extensions.gallery.authProvider setting + policy, and updates the marketplace sign-in action to support Microsoft/PRM consent. |
| src/vs/platform/extensionResourceLoader/common/extensionResourceLoaderService.ts | Passes resource URI into header computation for authenticated marketplace resource requests. |
| src/vs/platform/extensionResourceLoader/common/extensionResourceLoader.ts | Adds guarded Authorization header attachment for extension resource (README/etc.) fetches. |
| src/vs/platform/extensionResourceLoader/browser/extensionResourceLoaderService.ts | Mirrors resource-aware header computation for browser fetch paths. |
| src/vs/platform/extensionManagement/common/extensionGalleryService.ts | Attaches negotiated bearer token to extensionquery, stats/control, and asset download requests (same-secure-origin guarded). |
| src/vs/platform/extensionManagement/common/extensionGalleryManifestServiceIpc.ts | Threads negotiated access token over the manifest IPC channel and exposes getAccessToken() in non-window processes. |
| src/vs/platform/extensionManagement/common/extensionGalleryManifestService.ts | Adds a default getAccessToken() implementation returning undefined for open marketplaces. |
| src/vs/platform/extensionManagement/common/extensionGalleryManifest.ts | Introduces provider context key, new statuses, new config key/scopes, and PRM discovery helper/types. |
| src/vs/base/common/product.ts | Adds enableExtensionGalleryEntraAuth product gate for Microsoft/Entra marketplace auth path. |
| product.json | Extends product data to include a microsoft entry under the relevant auth access structure. |
| build/lib/policies/policyData.jsonc | Updates generated policy catalog to include ExtensionGalleryAuthProvider. |
Review details
- Files reviewed: 15/15 changed files
- Comments generated: 1
- Review effort level: Low
Comment on lines
+384
to
+387
| name: 'ExtensionGalleryAuthProvider', | ||
| category: PolicyCategory.Extensions, | ||
| minimumVersion: '1.121', | ||
| localization: { |
Michael Cummings (MSFT) (mcumming)
changed the title
…ntext key Introduce the `extensions.gallery.authProvider` policy that selects which identity provider (github or microsoft) gates Private Marketplace access, and register it in the exported policy data. Add the marketplace auth-provider context key and the Entra ID resource scope constant used to acquire a Private Marketplace-audienced token. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Resolve the marketplace access strategy in the workbench gallery manifest service: cache-first startup, provider-routed access handling, Microsoft eligibility probing against the eligibility resource from the gallery manifest, the GitHub DefaultAccount path, the marketplace auth-provider context key, and access telemetry. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Surface a provider-aware sign-in prompt and access-denied state in the extensions viewlet, driven by the marketplace auth-provider context key so the correct identity provider is presented to the user. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Allow the built-in extensions gallery to silently use Microsoft (Entra ID) authentication sessions for Private Marketplace access. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Cover provider selection, cache-first startup, Microsoft eligibility handling, and the GitHub access path in the gallery manifest service. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…ndling Address rubber-duck review findings on the Entra ID marketplace path: - Scope the cached access verdict to the marketplace it was computed against (authProvider + accountId + serviceUrl), rejecting stale caches on any mismatch. - Guard cache application and background validation with a monotonic epoch so a session/account/config change mid-validation supersedes an in-flight result. - Register session/account listeners before applying the cache, and the config listener before initial validation, closing startup TOCTOU windows. - Route transient auth-service and marketplace-fetch failures to Unreachable instead of leaving a configured marketplace on a blank Unavailable view. - Split 401 (missing/expired token -> RequiresSignIn, not cached) from 403 (durable denial -> AccessDenied, cached ineligible). - Never follow redirects on token-bearing requests; only send the Entra token to an HTTPS same-origin target; reject non-2xx and non-manifest 200 responses before parsing. - Restore the galleryservice:custom:marketplace telemetry on the GitHub path and drop the unused server-provided eligibility reason from persisted cache. Expand unit coverage to 45 tests across provider routing, eligibility, caching, error classification, and the epoch race paths. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…g, resource validation, UX copy - Policy: make the `extensions.gallery.authProvider` schema enum and enumDescriptions unconditional (`github`, `microsoft`). Gating the enum on the Entra product flag left the policy metadata exporting two enum descriptions against a single-value enum, which fails the policy-artifact generator's equal-length requirement on a clean export. The Entra gate is already enforced at runtime in getEffectiveAuthProvider(), and the setting is hidden (included: false), so this advertises nothing new in the UI. - Cross-account authorization leak: on Microsoft session change and GitHub default-account change, revoke the active manifest (drop `Available`) before revalidating. Previously the active status stayed `Available`, so a transient index/eligibility failure on the new account preserved the prior account's access. - Layering: move CONTEXT_MARKETPLACE_AUTH_PROVIDER down to the platform extensionGalleryManifest module so the workbench service no longer imports from a workbench/contrib module. The Extensions contribution re-exports it for existing consumers. - Resource validation: reject a 200 service index whose `resources` entries are malformed (missing string `id`/`type`), not just a non-array `resources`. Endpoint discovery calls `resource.type.split()` outside the fetch try/catch, so an undefined `type` would crash initialization instead of surfacing `Unreachable`. - UX: make the Microsoft AccessDenied welcome message generic. A bare 403 gives no typed reason, so asserting that an Entra ID account or Visual Studio Subscription is required could tell an already-signed-in user to obtain access they already have. Adds a unit test covering the malformed-resources -> Unreachable path. All 47 gallery tests pass; typecheck-client and valid-layers-check are clean. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Replace the two `as any` casts flagged by the local/code-no-any-casts ESLint rule that failed hygiene: complete the stubbed IProductService.extensionsGallery so it satisfies Partial<IProductService> without a cast, and cast the entitlements literal to IEntitlementsData. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Extract all eligibility/access-validation logic out of WorkbenchExtensionGalleryManifestService into a dedicated, provider-agnostic ExtensionGalleryAccessValidator, and split the GitHub-vs-Microsoft branching into IExtensionGalleryAccessProvider strategy classes. This debloats the host service (it now only builds a status sink and delegates) and isolates each identity system's account resolution + eligibility check. Replace the hand-rolled monotonic validationEpoch TOCTOU counter with a CancellationTokenSource held in a MutableDisposable: assigning a new source cancels/disposes the prior one, and each validation re-checks token.isCancellationRequested immediately before mutating status/cache/manifest, so a superseded in-flight validation cannot commit a stale verdict for an account that is no longer current. Addresses reviewer feedback that the epoch machinery bloated the service. New files: - extensionGalleryAccess.ts: shared leaf contracts (IExtensionGalleryAccessCore, IExtensionGalleryAccessProvider, IExtensionGalleryAccessSink, ICachedAccess, AccountResolution, ExtensionGalleryAccessProviderId, isSafeTokenTarget). - extensionGalleryAccessProviders.ts: GitHub and Microsoft access providers. - extensionGalleryAccessValidator.ts: provider-agnostic orchestrator. Security invariants preserved: no microsoft->github fallback, cache scoped to provider+serviceUrl, bearer only over HTTPS same-origin with followRedirects:0, and the 401/403/transient status mappings are unchanged. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fe244b45-6362-4563-880d-fa3d9a27a07c
…d-in Microsoft accounts When a signed-in Microsoft account made an authenticated Marketplace request that returned 401, the previous logic mapped it to RequiresSignIn, which re-prompted the same account whose token had just been rejected - producing an infinite sign-in loop. Map both Microsoft 401 branches (service-index and eligibility) to AccessDenied so the condition is surfaced to the user, and do not cache the 401 verdict (unlike a durable 403 denial) so a later config/account/session change re-evaluates cleanly. Lower the MarketplaceAuthRequiredError log level to trace. First-time no-session flows are unchanged (still RequiresSignIn). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fe244b45-6362-4563-880d-fa3d9a27a07c
Keep the extensions.gallery.authProvider setting while moving its policy declaration and generated catalog entry to a separate maintainer-authored change.\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>\nCopilot-Session: 449a6246-235a-4c42-8d6d-ef65fd83a190
Replace ExtensionGalleryAccessValidator and the provider/sink strategy classes with two plain services and restore the manifest service toward its upstream-main shape (minimal diff): - ExtensionGalleryAccountService: mirrors IDefaultAccountService (getAccount/getCachedAccess/clearCache/onDidChangeAccount); owns GitHub + Microsoft account resolution, the eligibility check, and the ICachedAccess read/write/validate. - ExtensionGalleryServiceIndexService: memoized service-index fetch. - extensionGalleryManifestService: delegates all account/eligibility/ index/cache work to the two services; keeps the added validation orchestration with a MutableDisposable<CancellationTokenSource> for the TOCTOU supersession guard. - extensionGalleryAccess: trimmed leaf (removed orphaned sink/core interfaces), keeps shared helpers and error types. The onDidChangeAccount subscription is registered before the initial awaited validation so a sign-out mid-flight is observed. All 46 existing manifest-service tests pass unchanged. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fe244b45-6362-4563-880d-fa3d9a27a07c
…che path, restore logs, trim comments Continue the Private Marketplace access refactor on the extracted services: - Thread CancellationToken through the account service's cache mutations (denyFromAuthError and the eligible fast-path), guarding every write with token.isCancellationRequested so a superseded validation can never restore or persist a verdict for an account that is no longer current (TOCTOU guard). - Materialize the service index inside the account service's cached-access path and add invalidateServiceIndexCache(), so the host maps a verdict to status without any further fetching and each validation generation re-fetches cleanly. - Restore the [Marketplace] debug log messages (sign-in / access / SKU / enterprise) for parity with main's observability. - Trim branch-added comments to why-only, leaving main's pre-existing comments untouched. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fe244b45-6362-4563-880d-fa3d9a27a07c
…olved provider Replace the DI-service parameters on getEffectiveAuthProvider with plain primitives (configured provider string + Entra product flag) so the helper never reaches into a service, and cache the resolved provider in a field on the manifest service to avoid resolving it twice. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fe244b45-6362-4563-880d-fa3d9a27a07c
…e entry The microsoft and github/default access-denied welcome blocks carried near-identical messages and together covered every provider state, so replace them with a single entry gated on the AccessDenied status alone. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fe244b45-6362-4563-880d-fa3d9a27a07c
galleryservice:custom:marketplace was gated on the github provider, so successful Microsoft/Entra marketplace access went uncounted. It now fires for any successfully accessed serviceUrl-configured marketplace, restoring its original meaning (custom-marketplace access, independent of provider). The github-vs-microsoft distinction is instead tracked by marketplace:auth:checked, which is now emitted from cacheAccess so every definitive eligibility verdict reports its authProvider + eligible for both providers (previously only the Microsoft 200 path emitted it). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fe244b45-6362-4563-880d-fa3d9a27a07c
Add a dedicated extensionGalleryAccess.test.ts exercising the pure getEffectiveAuthProvider and isSafeTokenTarget helpers directly, and telemetry-assertion cases in the manifest service suite verifying galleryservice:custom:marketplace fires for both GitHub and Microsoft on eligible access, and marketplace:auth:checked reports the correct authProvider+eligible at each definitive verdict. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fe244b45-6362-4563-880d-fa3d9a27a07c
Import the context key directly from the platform extensionGalleryManifest module in extensionsViewlet.ts (its only consumer) instead of re-exporting it from contrib/extensions/common/extensions.ts, so there is a single import source. Addresses PR review feedback. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fe244b45-6362-4563-880d-fa3d9a27a07c
Assign onDidChangeAccount directly via Event.signal over the provider-specific source instead of relaying through a private Emitter with Event.map. Removes the now-unused Emitter import. Addresses PR review feedback. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fe244b45-6362-4563-880d-fa3d9a27a07c
Set the default for the marketplace auth-provider setting to 'github' instead of the empty string, so the default is a member of the declared enum. Both readers treat any non-'microsoft' value as the GitHub path, so behavior is unchanged. Addresses PR review feedback. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fe244b45-6362-4563-880d-fa3d9a27a07c
Drop the empty 'microsoft': [] placeholder from trustedExtensionAuthAccess in product.json. It granted no silent access (no-op) and was local scaffolding for the Entra path. Addresses PR review feedback. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fe244b45-6362-4563-880d-fa3d9a27a07c
Replace the lazy `galleryAccountService: | undefined` field and its `createInstance` in the manifest service with a proper `InstantiationType.Delayed` singleton behind a new `IExtensionGalleryAccountService` decorator, injected into the ctor. The Delayed proxy makes ctor-time injection and the `onDidChangeAccount` subscription non-instantiating, so the account service (and its transitively-cyclic `IAuthenticationService` dependency) only materializes on first non-event access. A `galleryAccountServiceActive` flag guards the config-change handler so an unrelated config change never force-instantiates the resolver when no private marketplace was configured. The ctor microtask is kept: it defers the eager bootstrap's first access past ctor return so the re-entry resolves the cached instance instead of throwing "RECURSIVELY instantiating". Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fe244b45-6362-4563-880d-fa3d9a27a07c
The Microsoft auth provider returns one session per signed-in account, so
picking sessions[0] was arbitrary when several accounts are signed in.
Persist a provider-scoped account slot (marketplace.account = { authProvider,
id }) and add a single getMicrosoftSession() selector that both the live check
and cache validation use: prefer the remembered account, adopt-and-persist a
lone account, and refuse to guess (require sign-in) when several accounts are
signed in with no remembered choice or the remembered one is gone.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: fe244b45-6362-4563-880d-fa3d9a27a07c
Address PR review: the Microsoft sign-in action no longer blindly
creates a session. When multiple Microsoft accounts are signed in, a
quick pick lets the user choose one (with a "different account" escape
hatch); a single account is bound directly, and no accounts falls
through to interactive sign-in. The chosen account is persisted so
selection stays grounded across restarts.
The browser-layer sign-in action delegates to a command registered in
the electron-browser account service (mirroring the GitHub branch's
DEFAULT_ACCOUNT_SIGN_IN_COMMAND delegation), respecting the layer
boundary. Binding uses createSession({ account }) so an already
signed-in account is bound without a fresh login while still firing the
session-change event that drives marketplace re-validation.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: fe244b45-6362-4563-880d-fa3d9a27a07c
Address PR review: the two methods read as similar. Add JSDoc on each contrasting it with the other so the distinct responsibilities are clear at the call site: getAccount is the heavier public eligibility verdict (may hit the network), while resolveCurrentAccount is an identity-only silent resolution used solely for cache validation. The overlapping "current account" selection logic was already unified into the single getMicrosoftSession() selector. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fe244b45-6362-4563-880d-fa3d9a27a07c
Decide Private Marketplace eligibility locally from the account's ID-token tenant (`tid`) claim instead of round-tripping to a server-side EligibilityService endpoint, mirroring how the GitHub path already gates locally. A work/school (Entra) tenant is eligible; a personal Microsoft Account (MSA) is not. The check runs before any index fetch, so an ineligible account never touches the (possibly auth-gated) index, and fails closed on an undecodable/opaque token or a token with no `tid`. Removes the EligibilityService resource type, its URL discovery, the same-origin token-target guard for it, and the IRequestService dependency and POST round-trip in ExtensionGalleryAccountService. Adds an optional `tid` claim to IAuthorizationJWTClaims and rewrites the surrounding docs. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fe244b45-6362-4563-880d-fa3d9a27a07c
ExtensionGalleryAccountService injected IAuthenticationService, forming a service DI cycle (account -> auth -> extensionService -> extensionGalleryService -> manifest -> account) that the instantiation graph walker detects and aborts startup on. `Delayed` does not help: the cycle graph is a static walk over the @iService constructor decorators. Remove the @IAuthenticationService constructor dependency and supply it post-startup through a new connectAuthentication() init API, wired by a small ExtensionGalleryAccountAuthenticationContribution at WorkbenchPhase.AfterRestored (orchestrator wiring, per reviewer guidance - not a service-locator lookup). Until connected the Microsoft path reports "no account"; connecting re-signals onDidChangeAccount once so any verdict resolved in that window is re-validated. Update the manifest service test to play the orchestrator role by calling connectAuthentication after constructing the account service. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fe244b45-6362-4563-880d-fa3d9a27a07c
The class carried a "Service" suffix but is a plain createInstance helper owned by ExtensionGalleryAccountService (an owner-scoped memo cache), not a DI-registered service. Rename the class to ExtensionGalleryServiceIndexFetcher and the field indexService -> serviceIndexFetcher so the name no longer implies a service registration it does not have, per reviewer feedback (either register it properly or rename it). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fe244b45-6362-4563-880d-fa3d9a27a07c
…vice The deferral guarded against "RECURSIVELY instantiating service 'IAuthenticationService'" as introduced in bd44656, when this service resolved authentication itself through instantiationService.invokeFunction while still constructing. af73002 moved access resolution into ExtensionGalleryAccountService and removed authentication from that service graph: IAuthenticationService is now handed over after startup by ExtensionGalleryAccountAuthenticationContribution (WorkbenchPhase.AfterRestored), and the account service reports "no account" until then. Nothing reachable from this constructor can resolve authentication anymore, so the deferral was dead code. Verified by launching a configured private marketplace with and without the deferral on a clean build: both start normally, with no recursion error and identical [Marketplace] trace output. Also corrects the galleryAccountService comment, which described an IAuthenticationService dependency that no longer exists and pointed at the deferral removed here. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4e27c63d-f29e-4ee0-a324-8adb523f5155
The manifest service was orchestrating access validation rather than consuming it: it drove the two-phase cached-then-live resolution, owned the validation generations and cancellation tokens, and reached into the account service to clear caches and invalidate the memoized service index. Roughly 125 of its 272 lines were access machinery, and four account-service internals had to be public for it. Move all of that behind the account service. It now resolves access itself (cache first, then re-validating in the background) and publishes the outcome as a verdict, so the manifest service only maps verdict to ExtensionGalleryManifestStatus. Interface changes: - add onDidChangeAccess: Event<IExtensionGalleryAccessVerdict> and resolveAccess(serviceUrl), which needs no CancellationToken from the caller - add reset() for the configuration-change path - getAccount and getCachedAccess become private; clearCache becomes private; invalidateServiceIndexCache is deleted (unused once the caller moved) No behaviour change: verdict classification, the "never downgrade an already Available marketplace" rule, cancellation semantics and cache lifetimes are preserved. extensionGalleryManifestService.ts drops from 272 to 203 lines and its access-validation section from ~125 lines to a 40-line mapping. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4e27c63d-f29e-4ee0-a324-8adb523f5155
A non-2xx service index response was reported as only a status code, so a marketplace that rejects the client and explains why in the body was indistinguishable from an unreachable network. The workbench surfaces such a failure as "The Extensions Marketplace is currently unavailable. Check your network connection", which sends the user looking in the wrong place. Append a best-effort, truncated response body to the error so the reason reaches the log. For example a marketplace enforcing a minimum client version now reports: Service index returned status 400: Access denied: Only VS Code clients version 1.104.2 or later are allowed. Diagnostics only: the status mapping is unchanged, and reading the body never throws so it cannot mask the status we already have. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4e27c63d-f29e-4ee0-a324-8adb523f5155
…twork With no session the service index is never probed, so a failing marketplace cannot turn RequiresSignIn into Unreachable and leave the user with a "check your network connection" message and a reload link instead of a sign-in affordance. That invariant was untested for the post-startup re-validation path, which runs when authentication connects and re-signals an account change. Adds a test covering that sequence: no session, an index that would reject the client, and a session-change event after the initial resolution. Asserts the status stays RequiresSignIn and that no index request is made. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4e27c63d-f29e-4ee0-a324-8adb523f5155
A marketplace can refuse the client outright — for example one enforcing a
minimum supported VS Code version replies 400 "Only VS Code clients version
1.104.2 or later are allowed". That is durable: retrying cannot help.
Such a response was classified as a transient failure and surfaced as
"The Extensions Marketplace is currently unavailable. Check your network
connection", which points the user at something that is not the problem. On main
any failed fetch of a configured marketplace reports AccessDenied ("please
contact your administrator"), so this was also a regression in what the user is
told.
Classify a non-401/403 4xx as a new MarketplaceClientRejectedError and map it to
a denial, restoring the message main gives. 5xx and network failures stay
transient and continue to report Unreachable. The denial is deliberately not
cached: it belongs to the client, not the account, and can change on upgrade.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 4e27c63d-f29e-4ee0-a324-8adb523f5155
…ce the rest
Review feedback on the previous split: the account service should answer whether
there is a usable account, and nothing else. It was still fetching the service
index, so its verdict carried a manifest and it needed the marketplace URL —
neither of which is its concern.
Account service now resolves identity and entitlement only:
readonly accountStatus: ExtensionGalleryAccountStatus;
readonly onDidChangeAccountStatus: Event<ExtensionGalleryAccountStatus>;
getAccount(): Promise<IExtensionGalleryAccount | undefined>;
readonly onDidChangeAccount: Event<void>;
setPreferredAccount(accountId: string): void;
connectAuthentication(authenticationService: IAuthenticationService): void;
It no longer takes a serviceUrl or a CancellationToken, returns no manifest, and
owns no index cache. getAccount returns the signed-in account even when it is not
entitled, so callers can scope a durable denial to it; accountStatus says whether
it may be used. The marketplace auth-provider context key moves here too, which
also removes a second call to getEffectiveAuthProvider.
The manifest service now owns the marketplace side: the serviceUrl, the
non-HTTPS token-target check, the index fetch, resolution generations, and the
mapping from outcome to ExtensionGalleryManifestStatus.
The durable access verdict moves to a new ExtensionGalleryAccessCache rather than
into either service, so neither carries storage plumbing and the scoping rules —
a verdict is only honoured for the account, marketplace and auth provider it was
written for — live in one testable place. It resolves the effective auth provider
itself via getEffectiveAuthProvider, a pure function, rather than requiring a new
member on the account service.
Two ordering bugs surfaced while testing this and are fixed here: the
configuration-change listener was registered after the initial resolution, so a
change during a slow index fetch was missed entirely; and a transient failure to
resolve the account discarded the cached verdict that a later retry needs.
Behaviour is otherwise unchanged, verified against a deployed private marketplace
and by the existing suite.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 4e27c63d-f29e-4ee0-a324-8adb523f5155
Review feedback: keep code comments minimal. The marketplace files carried long explanatory blocks that restated what the code already says. Trimmed every file this PR touches, keeping rationale only where the code cannot show it — the service DI cycle, why an ineligible account is still returned, why only a 403 is persisted, why a bearer is confined to a same-origin HTTPS target. Net 107 lines removed with no functional change. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4e27c63d-f29e-4ee0-a324-8adb523f5155
The index fetcher only existed to hold a memo that could never be hit: resolve() invalidated it immediately before its single read. With no state left it returns to a private method on the manifest service. The durable access cache is removed. Its `true` verdict was never read, and the `false` written for a client-side ineligible account outlived the condition it recorded - an account later granted entitlement stayed AccessDenied until sign-out. Covered by a new regression test. isSafeTokenTarget was called with the same URL for both arguments, so only its HTTPS check ever ran; it becomes an inline guard. Redirects are already handled by followRedirects: 0. MarketplaceMisconfiguredError was never thrown and is gone. The configuration listener returns to its shape on main, with the auth provider key added. renderAvailable becomes setAvailable. Comment volume across these files drops from 24% to 8%, against 4% in the surrounding extensionManagement code. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4e27c63d-f29e-4ee0-a324-8adb523f5155
A private marketplace is account-scoped, but the success path skipped publishing whenever the status was already Available. Switching to a different eligible account therefore fetched that account's catalog and then discarded it, leaving the previous account's in place until restart. The manifest is now published on every success; the custom-marketplace telemetry still fires only on the transition into Available. Removing the access cache orphaned IExtensionGalleryAccount.id - it existed only to scope a cached verdict to an account - so it goes, along with the comment describing the verdict it scoped. That removal also took with it the only test asserting that an already-available marketplace survives a transient failure. Restored for both the fetch and the account-resolution paths. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4e27c63d-f29e-4ee0-a324-8adb523f5155
Takes c41e451 as-is, with two changes that restore main's outcome: A failed manifest fetch is reported as denied, as on main, rather than asking an already-signed-in user to sign in. This also keeps the minimum-client-version rejection reading the way it does today. A transient failure to resolve the account no longer retracts a marketplace the user already has. On main that throw rejects the promise and no status is published, so an available marketplace survives; here the account service catches it, reports Unknown, and returned undefined would otherwise be read as a sign-out. Authentication moves to the follow-up PR: the bearer on the service index, the HTTPS guard, redirect suppression, and 401/403 typing all go, along with the Unreachable and Misconfigured statuses that only existed to describe them, and their welcome content and badges. Two defects that also reproduce on main are now separate PRs - microsoft#331800 (a sign-out during an in-flight fetch) and microsoft#331804 (a 200 carrying any JSON accepted as a service index) - so the tests covering them move there. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4e27c63d-f29e-4ee0-a324-8adb523f5155
extensions.gallery.authProvider is now the only switch for the Microsoft path. Also removes extensionGalleryAccess.ts, whose remaining exports were already orphaned by the manifest service adoption in e61ce45. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4e27c63d-f29e-4ee0-a324-8adb523f5155
Adds extensionsGallery.accessScopes and drops the hardcoded PRIVATE_MARKETPLACE_SCOPES, following defaultChatAgent.providerScopes. Session lookup and interactive sign-in resolve the scopes through one accessor so they cannot drift. A deployment that enables the Microsoft path without configuring scopes now reports no account instead of requesting a session with scopes it did not ask for. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4e27c63d-f29e-4ee0-a324-8adb523f5155
Follows DefaultAccountProvider: the auth-dependent half becomes an IExtensionGalleryAccountProvider that a workbench contribution builds and hands to the service, so the service no longer takes IAuthenticationService at all and connectAuthentication is gone. Sign-in is now a single signIn() on the service, which removes the provider-specific command id and the cross-layer invoke-by-string. The extensions view welcome content collapses back to one status-gated entry labelled Sign In, leaving CONTEXT_MARKETPLACE_AUTH_PROVIDER with no consumers. The service interface moves to common/ so the browser layer can call it directly. Both desktop entry points import the electron-browser module explicitly: it is now only reachable for its registerSingleton side effect, and without that the renderer fails to start. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4e27c63d-f29e-4ee0-a324-8adb523f5155
The provider is selected once at startup, so changing extensions.gallery.authProvider mid-session had no effect and gave no indication that it had not been applied. The sibling serviceUrl setting already prompts; this reuses that listener and dialog rather than rebuilding the provider live. Each setting keeps its own message: serviceUrl still reports a different Marketplace, and the auth change reports a configuration change. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4e27c63d-f29e-4ee0-a324-8adb523f5155
A Private Marketplace running with authentication enforced refuses its service index outright unless a token minted for the marketplace itself is presented, so signing in is not by itself enough to reach it: the sign-in token identifies the user, but its audience is not the marketplace. Read the index with the bearer the account already carries. If the marketplace refuses it, read the Protected Resource Metadata it advertises (RFC 9728) to learn what a token for it must be minted against, ask the account for one, and read the index again. Whether a marketplace needs this is discovered rather than configured: one that accepts what it is given is never asked what a token for it should look like, and the GitHub path — which carries no bearer at all — is unaffected. The resource descriptor is passed to the existing `getAccount`, and the token comes back on the `accessToken` it already returns, rather than adding a second way to ask for the same thing. The account is resolved before the token is minted, so the token belongs to the identity the user chose. Requests that follow the index are made against the same marketplace and are gated the same way, so the manifest service exposes the headers to authenticate them. It decides which origins may receive the bearer, rather than each caller repeating that rule: a marketplace may serve assets from elsewhere — upstreamed extensions are fetched from the public marketplace — and those requests must stay anonymous. The bearer is dropped whenever the marketplace is retracted, so a sign-out, an account switch or a configuration change cannot leave a usable one behind. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3c5458c9-6cfb-4157-bdad-76383ffab22b
Search, asset and VSIX downloads, and the control manifest are all served by the marketplace that gated its index, so they are refused for the same reason unless they carry the same bearer. Ask the manifest service for the headers each request needs rather than reading a token and deciding here: an asset URL advertised by the manifest may point somewhere other than the marketplace, and the primary and fallback asset URLs can differ in origin, so each is asked separately. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3c5458c9-6cfb-4157-bdad-76383ffab22b
Icons, READMEs and CHANGELOGs are read from the marketplace through a separate path, so a gated marketplace refuses them too and the details view renders with broken images and empty content. Ask the manifest service for the headers each resource needs. The resource is now required rather than optional: every caller already passes one, and leaving it optional invites a future caller to silently drop the credentials. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3c5458c9-6cfb-4157-bdad-76383ffab22b
Installing and updating an extension resolves its manifest and downloads its VSIX from the shared process, which cannot negotiate with the marketplace itself. Those requests would stay anonymous and be refused, so installs and updates fail against a gated marketplace even though the window has access. Send the negotiated bearer and the service index it belongs to over the channel that already carries the manifest, so that process applies the same rule to the same marketplace. They travel with the manifest and are therefore coherent with it: a retracted marketplace arrives with nothing to authenticate with. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3c5458c9-6cfb-4157-bdad-76383ffab22b
Acquiring the resource-scoped token during a normal access check is silent by contract, so it cannot ask the user for consent. A user whose tenant has not already consented to the marketplace's resource scopes would therefore sign in successfully and still be returned to the sign-in prompt, with nothing in the UI explaining what was missing. Ask for that consent while the user is already in an interactive sign-in, using the resource the marketplace advertised on the request it gated. The silent path is tried first, so a user who is already consented is not prompted twice. Failure is not fatal: the identity session stands and the access check reports whatever the marketplace says next, rather than turning a consent problem into a failed sign-in. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3c5458c9-6cfb-4157-bdad-76383ffab22b
Exercises the negotiation against a marketplace that only accepts a token minted for itself, so the tests fail if the sign-in token is presented in its place. Covers reaching the marketplace through negotiation, skipping it entirely when the marketplace accepts what it is given, refusing access when the marketplace gates its index but advertises no resource to mint a token against, and dropping the bearer once the marketplace is retracted. Pins the rule about which origins may receive the bearer, since that is what keeps a private marketplace's token away from the public marketplace serving an upstreamed extension's assets: a foreign origin, a neighbour sharing the parent domain, the same host over cleartext, and an unparseable URL all get nothing. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3c5458c9-6cfb-4157-bdad-76383ffab22b
Michael Cummings (MSFT) (mcumming)
force-pushed
the
entra-marketplace-pr2-prm-auth
branch
from
September 1, 2026 13:39
d708ccf to
4438731
Compare
Contributor
📬 CODENOTIFYThe following users are being notified based on files changed in this PR: TylerLeonhardtMatched files:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Builds on #325331, which adds Microsoft Entra ID sign-in as a licensing signal for a Private Marketplace. This PR depends on it, so the commit range below currently includes #325331's commits and will reduce to just the negotiation work once #325331 merges.
Partially addresses #325412 (Entra path only; the GitHub auth-enabled path is tracked for a separate PR).
Summary
#325331 established Entra ID sign-in as a licensing signal for a Private Marketplace (index negotiation + eligibility check). This PR makes the marketplace's API requests actually authenticate against an
[Authorize]-gated marketplace by negotiating a resource-scoped bearer token via RFC 9728 Protected Resource Metadata (PRM) discovery and threading that token to every process/surface that talks to the marketplace — for the Entra/Microsoft provider.Discovery is driven by the marketplace's well-known
/.well-known/oauth-protected-resourcedocument (CORS-readable) rather than theWWW-Authenticatechallenge header, which the renderer's cross-origin index fetch usually cannot read. The negotiated token is bound to the advertised authorization server and resource scopes (RFC 8707), set only on the eligible→Available transition, and cleared on every non-Available transition so it can never outlive its access.Commits (the negotiation work; #325331's commits also appear in the range until it merges)
discoverMarketplaceProtectedResourcehelper + types.getAccessToken(). (includes tests: gated negotiation, CORS-stripped 401, open-index no-token, negotiated-but-forbidden 403).getManifest/ VSIX download (which never negotiate) authenticate; pushed over the manifest channel.Follow-up (separate PR)
checkAccess()retained, no/eligibilityPOST.onDidChangeSessions('github')invalidation for the auth-enabled path.Testing
extensionGalleryManifestService.test.tscover the Entra negotiation paths (commit 2).typecheck-client✅ andvalid-layers-check✅.Notes
getAccessToken()returnsundefinedand all requests stay anonymous — no behavior change.