feat: Proxy authentication mode with mock token - #283
Open
tarostok wants to merge 1 commit into
Open
Conversation
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
It changes security-sensitive authentication behavior and currently has a proxy-auth scope/TokenCredential mismatch that needs correction and team review.
Pull request overview
Adds a proxy authentication mode (gated by FAB_PROXY_AUTH_ENABLED) to let the CLI emit a placeholder Bearer mockToken that downstream proxies can replace, while bypassing MSAL/JWT validation and blocking interactive auth flows.
Changes:
- Introduces proxy-auth detection and placeholder token/expiry behavior in
FabAuth, including skipping env-var auth validation/loading when enabled. - Updates
fab authcommands to block login/logout with actionable errors and to returnproxy authentication modefromfab auth status. - Adds/extends tests to validate proxy-auth behavior across auth, API requests, and Azure TokenCredential bridging.
File summaries
| File | Description |
|---|---|
| tests/test_core/test_fab_msal_bridge_azure_cli.py | Adds a proxy-auth test for MsalTokenCredential behavior. |
| tests/test_core/test_fab_auth.py | Adds proxy-auth mode unit tests and adjusts auth singleton test setup/reset. |
| tests/test_core/test_fab_api_client.py | Verifies API requests send Bearer mockToken when proxy-auth is enabled. |
| tests/test_commands/test_auth.py | Ensures auth login/logout/status behave correctly in proxy-auth mode. |
| tests/conftest.py | Ensures proxy-auth env var is cleaned up in Azure CLI auth fixture. |
| src/fabric_cli/errors/auth.py | Adds new error messages for login/logout being unavailable in proxy-auth mode. |
| src/fabric_cli/core/fab_auth.py | Implements proxy-auth mode switch, placeholder token, and JWT/MSAL bypass behavior. |
| src/fabric_cli/commands/auth/fab_auth.py | Blocks login/logout and adjusts auth status output for proxy-auth mode. |
Review details
- Files reviewed: 8/8 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+56
to
+65
| def test_bridge_returns_access_token_in_proxy_auth_mode( | ||
| self, monkeypatch, azure_cli_auth_fixture | ||
| ): | ||
| """Proxy auth placeholders should satisfy the TokenCredential contract.""" | ||
| monkeypatch.setenv("FAB_PROXY_AUTH_ENABLED", "true") | ||
| auth = FabAuth() | ||
|
|
||
| credential = MsalTokenCredential(auth) | ||
| result = credential.get_token(con.SCOPE_FABRIC_DEFAULT[0]) | ||
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📥 Pull Request
Adds an explicit proxy authentication mode controlled by
FAB_PROXY_AUTH_ENABLED=trueor1.When enabled, the CLI:
mockTokenfor Fabric, OneLake, Azure, and custom scopes.TokenCredentialcompatibility.proxy authentication modefromfab auth status.Bearer mockTokenthrough the API client for downstream proxy replacement.This enables environments where an authentication proxy replaces the placeholder
token with the appropriate credential.
No additional dependencies are required.
Tests cover mode detection, authentication precedence, supported scopes, API
headers, JWT bypass, auth commands, and the MSAL credential bridge.