add support for connecting to Azure Front Door with Azure App Configuration store as an origin

src/Microsoft.Extensions.Configuration.AzureAppConfiguration/AzureAppConfigurationOptions.cs

@@ -156,6 +156,17 @@ internal IEnumerable<IKeyValueAdapter> Adapters
         /// </summary>
         internal IAzureClientFactory<ConfigurationClient> ClientFactory { get; private set; }
 
+        /// <summary>
+        /// Accessor for CDN cache busting context that manages ETag injection into requests.
+        /// When null, CDN cache busting is disabled. When not null, CDN cache busting is enabled.
+        /// </summary>
+        internal ICdnCacheBustingAccessor CdnCacheBustingAccessor { get; private set; }
+
+        /// <summary>
+        /// Gets a value indicating whether CDN is enabled.
+        /// </summary>
+        internal bool IsCdnEnabled => CdnCacheBustingAccessor != null;
+
         /// <summary>
         /// Initializes a new instance of the <see cref="AzureAppConfigurationOptions"/> class.
         /// </summary>
@@ -339,6 +350,11 @@ public AzureAppConfigurationOptions Connect(string connectionString)
         /// </param>
         public AzureAppConfigurationOptions Connect(IEnumerable<string> connectionStrings)
         {
+            if (IsCdnEnabled)
+            {
+                throw new InvalidOperationException("Cannot connect to both Azure App Configuration and CDN at the same time.");
+            }
+
             if (connectionStrings == null || !connectionStrings.Any())
             {
                 throw new ArgumentNullException(nameof(connectionStrings));
@@ -355,6 +371,35 @@ public AzureAppConfigurationOptions Connect(IEnumerable<string> connectionString
             return this;
         }
 
+        /// <summary>
+        /// Connect the provider to CDN endpoint.
+        /// </summary>
+        /// <param name="endpoint">The endpoint of the CDN instance to connect to.</param>
+        public AzureAppConfigurationOptions ConnectCdn(Uri endpoint)
+        {
+            if (IsCdnEnabled)
+            {
+                throw new InvalidOperationException("Please call ConnectCdn() only once.");
+            }
+
+            if ((Credential != null) || (ConnectionStrings?.Any() ?? false))
+            {
+                throw new InvalidOperationException("Cannot connect to both Azure App Configuration and CDN at the same time.");
+            }
+
+            if (endpoint == null)
+            {
+                throw new ArgumentNullException(nameof(endpoint));
+            }
+
+            var result = Connect(new List<Uri>() { endpoint }, new EmptyTokenCredential());
+
+            CdnCacheBustingAccessor = new CdnCacheBustingAccessor();
+            ClientOptions.AddPolicy(new CdnCacheBustingPolicy(CdnCacheBustingAccessor), HttpPipelinePosition.PerCall);
+
+            return result;
+        }
+
         /// <summary>
         /// Connect the provider to Azure App Configuration using endpoint and token credentials.
         /// </summary>
@@ -382,6 +427,11 @@ public AzureAppConfigurationOptions Connect(Uri endpoint, TokenCredential creden
         /// <param name="credential">Token credential to use to connect.</param>
         public AzureAppConfigurationOptions Connect(IEnumerable<Uri> endpoints, TokenCredential credential)
         {
+            if (IsCdnEnabled)
+            {
+                throw new InvalidOperationException("Cannot connect to both Azure App Configuration and CDN at the same time.");
+            }
+
             if (endpoints == null || !endpoints.Any())
             {
                 throw new ArgumentNullException(nameof(endpoints));

src/Microsoft.Extensions.Configuration.AzureAppConfiguration/AzureAppConfigurationProvider.cs

@@ -15,6 +15,7 @@
 using System.Net.Http;
 using System.Net.Sockets;
 using System.Security;
+using System.Security.Cryptography;
 using System.Text;
 using System.Threading;
 using System.Threading.Tasks;
@@ -39,6 +40,11 @@ internal class AzureAppConfigurationProvider : ConfigurationProvider, IConfigura
         private Dictionary<Uri, ConfigurationClientBackoffStatus> _configClientBackoffs = new Dictionary<Uri, ConfigurationClientBackoffStatus>();
         private DateTimeOffset _nextCollectionRefreshTime;
 
+        #region Cdn
+        private string _configVersion = null;
+        private string _ffCollectionVersion = null;
+        #endregion
+
         private readonly TimeSpan MinRefreshInterval;
 
         // The most-recent time when the refresh operation attempted to load the initial configuration
@@ -280,8 +286,8 @@ public async Task RefreshAsync(CancellationToken cancellationToken)
                     List<KeyValueChange> keyValueChanges = null;
                     Dictionary<string, ConfigurationSetting> data = null;
                     Dictionary<string, ConfigurationSetting> ffCollectionData = null;
-                    bool ffCollectionUpdated = false;
-                    bool refreshAll = false;
+                    string ffCollectionUpdatedChangedEtag = null;
+                    string refreshAllChangedEtag = null;
                     StringBuilder logInfoBuilder = new StringBuilder();
                     StringBuilder logDebugBuilder = new StringBuilder();
 
@@ -294,8 +300,8 @@ await ExecuteWithFailOverPolicyAsync(clients, async (client) =>
                         keyValueChanges = new List<KeyValueChange>();
                         data = null;
                         ffCollectionData = null;
-                        ffCollectionUpdated = false;
-                        refreshAll = false;
+                        ffCollectionUpdatedChangedEtag = null;
+                        refreshAllChangedEtag = null;
                         logDebugBuilder.Clear();
                         logInfoBuilder.Clear();
                         Uri endpoint = _configClientManager.GetEndpointForClient(client);
@@ -305,7 +311,17 @@ await ExecuteWithFailOverPolicyAsync(clients, async (client) =>
                             // Get key value collection changes if RegisterAll was called
                             if (isRefreshDue)
                             {
-                                refreshAll = await HaveCollectionsChanged(
+                                if (_options.IsCdnEnabled)
+                                {
+                                    if (_configVersion == null && _kvEtags.Count > 0)
+                                    {
+                                        _configVersion = CalculateHash(_kvEtags.SelectMany(kvp => kvp.Value.Select(mc => mc.IfNoneMatch.ToString())));
+                                    }
+
+                                    _options.CdnCacheBustingAccessor.CurrentToken = _configVersion;
+                                }
+
+                                refreshAllChangedEtag = await HaveCollectionsChanged(
                                     _options.Selectors.Where(selector => !selector.IsFeatureFlagSelector),
                                     _kvEtags,
                                     client,
@@ -314,7 +330,17 @@ await ExecuteWithFailOverPolicyAsync(clients, async (client) =>
                         }
                         else
                         {
-                            refreshAll = await RefreshIndividualKvWatchers(
+                            if (_options.IsCdnEnabled)
+                            {
+                                if (_configVersion == null && _watchedIndividualKvs.Count > 0)
+                                {
+                                    _configVersion = CalculateHash(_watchedIndividualKvs.Select(kvp => kvp.Value.ETag.ToString()));
+                                }
+
+                                _options.CdnCacheBustingAccessor.CurrentToken = _configVersion;
+                            }
+
+                            refreshAllChangedEtag = await RefreshIndividualKvWatchers(
                                 client,
                                 keyValueChanges,
                                 refreshableIndividualKvWatchers,
@@ -324,22 +350,43 @@ await ExecuteWithFailOverPolicyAsync(clients, async (client) =>
                                 cancellationToken).ConfigureAwait(false);
                         }
 
-                        if (refreshAll)
+                        if (refreshAllChangedEtag != null)
                         {
                             // Trigger a single load-all operation if a change was detected in one or more key-values with refreshAll: true,
                             // or if any key-value collection change was detected.
                             kvEtags = new Dictionary<KeyValueSelector, IEnumerable<MatchConditions>>();
                             ffEtags = new Dictionary<KeyValueSelector, IEnumerable<MatchConditions>>();
                             ffKeys = new HashSet<string>();
 
+                            if (_options.IsCdnEnabled)
+                            {
+                                //
+                                // Bust cdn cache
+                                _options.CdnCacheBustingAccessor.CurrentToken = refreshAllChangedEtag;
+
+                                // Reset versions so that next watch request will not use stale versions.
+                                _configVersion = null;
+                                _ffCollectionVersion = null;
+                            }
+
                             data = await LoadSelected(client, kvEtags, ffEtags, _options.Selectors, ffKeys, cancellationToken).ConfigureAwait(false);
                             watchedIndividualKvs = await LoadKeyValuesRegisteredForRefresh(client, data, cancellationToken).ConfigureAwait(false);
                             logInfoBuilder.AppendLine(LogHelper.BuildConfigurationUpdatedMessage());
                             return;
                         }
 
                         // Get feature flag changes
-                        ffCollectionUpdated = await HaveCollectionsChanged(
+                        if (_options.IsCdnEnabled)
+                        {
+                            if (_ffCollectionVersion == null && _ffEtags.Count > 0)
+                            {
+                                _ffCollectionVersion = CalculateHash(_ffEtags.SelectMany(kvp => kvp.Value.Select(mc => mc.IfNoneMatch.ToString())));
+                            }
+
+                            _options.CdnCacheBustingAccessor.CurrentToken = _ffCollectionVersion;
+                        }
+
+                        ffCollectionUpdatedChangedEtag = await HaveCollectionsChanged(
                             refreshableFfWatchers.Select(watcher => new KeyValueSelector
                             {
                                 KeyFilter = watcher.Key,
@@ -350,11 +397,20 @@ await ExecuteWithFailOverPolicyAsync(clients, async (client) =>
                             client,
                             cancellationToken).ConfigureAwait(false);
 
-                        if (ffCollectionUpdated)
+                        if (ffCollectionUpdatedChangedEtag != null)
                         {
                             ffEtags = new Dictionary<KeyValueSelector, IEnumerable<MatchConditions>>();
                             ffKeys = new HashSet<string>();
 
+                            if (_options.IsCdnEnabled)
+                            {
+                                //
+                                // Bust cdn cache
+                                _options.CdnCacheBustingAccessor.CurrentToken = ffCollectionUpdatedChangedEtag;
+                                // Reset ff collection version so that next ff watch request will not use stale version.
+                                _ffCollectionVersion = null;
+                            }
+
                             ffCollectionData = await LoadSelected(
                                 client,
                                 new Dictionary<KeyValueSelector, IEnumerable<MatchConditions>>(),
@@ -373,6 +429,9 @@ await ExecuteWithFailOverPolicyAsync(clients, async (client) =>
                     cancellationToken)
                     .ConfigureAwait(false);
 
+                    bool refreshAll = !string.IsNullOrEmpty(refreshAllChangedEtag);
+                    bool ffCollectionUpdated = !string.IsNullOrEmpty(ffCollectionUpdatedChangedEtag);
+
                     if (refreshAll)
                     {
                         _mappedData = await MapConfigurationSettings(data).ConfigureAwait(false);
@@ -940,7 +999,7 @@ private async Task<Dictionary<KeyValueIdentifier, ConfigurationSetting>> LoadKey
             return watchedIndividualKvs;
         }
 
-        private async Task<bool> RefreshIndividualKvWatchers(
+        private async Task<string> RefreshIndividualKvWatchers(
             ConfigurationClient client,
             List<KeyValueChange> keyValueChanges,
             IEnumerable<KeyValueWatcher> refreshableIndividualKvWatchers,
@@ -963,7 +1022,7 @@ private async Task<bool> RefreshIndividualKvWatchers(
                 if (_watchedIndividualKvs.TryGetValue(watchedKeyLabel, out ConfigurationSetting watchedKv))
                 {
                     await TracingUtils.CallWithRequestTracing(_requestTracingEnabled, RequestType.Watch, _requestTracingOptions,
-                        async () => change = await client.GetKeyValueChange(watchedKv, cancellationToken).ConfigureAwait(false)).ConfigureAwait(false);
+                        async () => change = await client.GetKeyValueChange(watchedKv, makeConditionalRequest: !_options.IsCdnEnabled, cancellationToken).ConfigureAwait(false)).ConfigureAwait(false);
                 }
                 else
                 {
@@ -1000,7 +1059,14 @@ await CallWithRequestTracing(
 
                     if (kvWatcher.RefreshAll)
                     {
-                        return true;
+                        return change.Current.ETag.ToString();
+                    }
+
+                    if (_options.IsCdnEnabled)
+                    {
+                        //
+                        // even if the change is not refresh all, we still need to reset stale version.
+                        _configVersion = null;
                     }
                 }
                 else
@@ -1009,7 +1075,7 @@ await CallWithRequestTracing(
                 }
             }
 
-            return false;
+            return null;
         }
 
         private void SetData(IDictionary<string, string> data)
@@ -1065,7 +1131,8 @@ private void SetRequestTracingOptions()
                 IsKeyVaultConfigured = _options.IsKeyVaultConfigured,
                 IsKeyVaultRefreshConfigured = _options.IsKeyVaultRefreshConfigured,
                 FeatureFlagTracing = _options.FeatureFlagTracing,
-                IsLoadBalancingEnabled = _options.LoadBalancingEnabled
+                IsLoadBalancingEnabled = _options.LoadBalancingEnabled,
+                IsCdnEnabled = _options.IsCdnEnabled
             };
         }
 
@@ -1328,33 +1395,56 @@ private void UpdateClientBackoffStatus(Uri endpoint, bool successful)
             _configClientBackoffs[endpoint] = clientBackoffStatus;
         }
 
-        private async Task<bool> HaveCollectionsChanged(
+        private async Task<string> HaveCollectionsChanged(
             IEnumerable<KeyValueSelector> selectors,
             Dictionary<KeyValueSelector, IEnumerable<MatchConditions>> pageEtags,
             ConfigurationClient client,
             CancellationToken cancellationToken)
         {
-            bool haveCollectionsChanged = false;
+            string changedEtag = null;
 
             foreach (KeyValueSelector selector in selectors)
             {
                 if (pageEtags.TryGetValue(selector, out IEnumerable<MatchConditions> matchConditions))
                 {
                     await TracingUtils.CallWithRequestTracing(_requestTracingEnabled, RequestType.Watch, _requestTracingOptions,
-                        async () => haveCollectionsChanged = await client.HaveCollectionsChanged(
+                        async () => changedEtag = await client.HaveCollectionsChanged(
                             selector,
                             matchConditions,
                             _options.ConfigurationSettingPageIterator,
+                            makeConditionalRequest: !_options.IsCdnEnabled,
                             cancellationToken).ConfigureAwait(false)).ConfigureAwait(false);
                 }
 
-                if (haveCollectionsChanged)
+                if (changedEtag != null)
                 {
-                    return true;
+                    // If we have a changed ETag, we can stop checking further selectors
+                    return changedEtag;
                 }
             }
 
-            return haveCollectionsChanged;
+            return changedEtag;
+        }
+
+        private static string CalculateHash(IEnumerable<string> etags)
+        {
+            Debug.Assert(etags != null && etags.Any());
+
+            StringBuilder inputBuilder = new StringBuilder();
+
+            //
+            // purpose
+            inputBuilder.Append("etags\n");
+
+            foreach (string etag in etags)
+            {
+                inputBuilder.Append(etag);
+                inputBuilder.Append('\n');
+            }
+
+            using SHA256 sha256 = SHA256.Create();
+
+            return sha256.ComputeHash(Encoding.UTF8.GetBytes(inputBuilder.ToString())).ToBase64Url();
         }
 
         private async Task ProcessKeyValueChangesAsync(

src/Microsoft.Extensions.Configuration.AzureAppConfiguration/AzureAppConfigurationSource.cs

@@ -56,10 +56,17 @@ public IConfigurationProvider Build(IConfigurationBuilder builder)
                 }
                 else
                 {
-                    throw new ArgumentException($"Please call {nameof(AzureAppConfigurationOptions)}.{nameof(AzureAppConfigurationOptions.Connect)} to specify how to connect to Azure App Configuration.");
+                    throw new ArgumentException($"Please call {nameof(AzureAppConfigurationOptions)}.{nameof(AzureAppConfigurationOptions.Connect)} or {nameof(AzureAppConfigurationOptions)}.{nameof(AzureAppConfigurationOptions.ConnectCdn)} to specify how to connect to Azure App Configuration.");
                 }
 
-                provider = new AzureAppConfigurationProvider(new ConfigurationClientManager(clientFactory, endpoints, options.ReplicaDiscoveryEnabled, options.LoadBalancingEnabled), options, _optional);
+                if (options.IsCdnEnabled)
+                {
+                    provider = new AzureAppConfigurationProvider(new CdnConfigurationClientManager(clientFactory, endpoints), options, _optional);
+                }
+                else
+                {
+                    provider = new AzureAppConfigurationProvider(new ConfigurationClientManager(clientFactory, endpoints, options.ReplicaDiscoveryEnabled, options.LoadBalancingEnabled), options, _optional);
+                }
             }
             catch (InvalidOperationException ex) // InvalidOperationException is thrown when any problems are found while configuring AzureAppConfigurationOptions or when SDK fails to create a configurationClient.
             {

src/Microsoft.Extensions.Configuration.AzureAppConfiguration/Cdn/CdnCacheBustingAccessor.cs

@@ -0,0 +1,23 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT license.
+//
+namespace Microsoft.Extensions.Configuration.AzureAppConfiguration
+{
+    /// <summary>
+    /// Implementation of ICdnCacheBustingAccessor that manages the current token for cache busting.
+    /// </summary>
+    internal class CdnCacheBustingAccessor : ICdnCacheBustingAccessor
+    {
+        private string _currentToken;
+
+        /// <summary>
+        /// Gets or sets the current token value to be used for cache busting.
+        /// When null, CDN cache busting is disabled. When not null, the token will be injected into requests.
+        /// </summary>
+        public string CurrentToken
+        {
+            get => _currentToken;
+            set => _currentToken = value;
+        }
+    }
+}