add support for connecting to Azure Front Door with Azure App Configuration store as an origin

src/Microsoft.Extensions.Configuration.AzureAppConfiguration/Afd/AfdConfigurationClientManager.cs

@@ -0,0 +1,72 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT license.
+//
+using Azure.Data.AppConfiguration;
+using Microsoft.Extensions.Azure;
+using System;
+using System.Collections.Generic;
+namespace Microsoft.Extensions.Configuration.AzureAppConfiguration.Afd
+{
+    internal class AfdConfigurationClientManager : IConfigurationClientManager
+    {
+        private readonly ConfigurationClientWrapper _clientWrapper;
+
+        public AfdConfigurationClientManager(
+            IAzureClientFactory<ConfigurationClient> clientFactory,
+            Uri endpoint)
+        {
+            if (clientFactory == null)
+            {
+                throw new ArgumentNullException(nameof(clientFactory));
+            }
+
+            if (endpoint == null)
+            {
+                throw new ArgumentNullException(nameof(endpoint));
+            }
+
+            _clientWrapper = new ConfigurationClientWrapper(endpoint, clientFactory.CreateClient(endpoint.AbsoluteUri));
+        }
+
+        public IEnumerable<ConfigurationClient> GetClients()
+        {
+            return new List<ConfigurationClient> { _clientWrapper.Client };
+        }
+
+        public void RefreshClients()
+        {
+            return;
+        }
+
+        public bool UpdateSyncToken(Uri endpoint, string syncToken)
+        {
+            if (endpoint == null)
+            {
+                throw new ArgumentNullException(nameof(endpoint));
+            }
+
+            if (string.IsNullOrWhiteSpace(syncToken))
+            {
+                throw new ArgumentNullException(nameof(syncToken));
+            }
+
+            if (new EndpointComparer().Equals(_clientWrapper.Endpoint, endpoint))
+            {
+                _clientWrapper.Client.UpdateSyncToken(syncToken);
+                return true;
+            }
+
+            return false;
+        }
+
+        public Uri GetEndpointForClient(ConfigurationClient client)
+        {
+            if (client == null)
+            {
+                throw new ArgumentNullException(nameof(client));
+            }
+
+            return _clientWrapper.Client == client ? _clientWrapper.Endpoint : null;
+        }
+    }
+}

src/Microsoft.Extensions.Configuration.AzureAppConfiguration/Afd/AfdPolicy.cs

@@ -0,0 +1,84 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT license.
+//
+using Azure.Core;
+using Azure.Core.Pipeline;
+using System;
+using System.Diagnostics;
+using System.Web;
+
+namespace Microsoft.Extensions.Configuration.AzureAppConfiguration.Afd
+{
+    /// <summary>
+    /// HTTP pipeline policy that injects current token into the query string for AFD cache breakage and consistency.
+    /// The injected token ensures AFD cache invalidation when configuration changes are detected and maintaining eventual consistency across distributed instances.
+    /// </summary>
+    internal class AfdPolicy : HttpPipelinePolicy
+    {
+        private const string AfdTokenQueryParameter = "_";
+
+        private readonly IAfdTokenAccessor _afdTokenAccessor;
+
+        /// <summary>
+        /// Initializes a new instance of the <see cref="AfdPolicy"/> class.
+        /// </summary>
+        /// <param name="afdTokenAccessor">The token accessor that provides current token to be used for AFD cache breakage/consistency.</param>
+        public AfdPolicy(IAfdTokenAccessor afdTokenAccessor)
+        {
+            _afdTokenAccessor = afdTokenAccessor ?? throw new ArgumentNullException(nameof(afdTokenAccessor));
+        }
+
+        /// <summary>
+        /// Processes the HTTP message and injects token into query string to break AFD cache when changes are detected.
+        /// This ensures fresh configuration data is retrieved when sentinel keys or collections have been modified.
+        /// It also maintains eventual consistency across distributed instances by ensuring that the same token is used for all subsequent watch requests, until a new change is detected.
+        /// </summary>
+        /// <param name="message">The HTTP message.</param>
+        /// <param name="pipeline">The pipeline.</param>
+        public override void Process(HttpMessage message, ReadOnlyMemory<HttpPipelinePolicy> pipeline)
+        {
+            message.Request.Headers.Remove("Authorization");
+            string token = _afdTokenAccessor.Current;
+            if (!string.IsNullOrEmpty(token))
+            {
+                message.Request.Uri.Reset(AddTokenToUri(message.Request.Uri.ToUri(), token));
+            }
+
+            ProcessNext(message, pipeline);
+        }
+
+        /// <summary>
+        /// Processes the HTTP message asynchronously and injects token into query string to break AFD cache when changes are detected.
+        /// This ensures fresh configuration data is retrieved when sentinel keys or collections have been modified.
+        /// It also maintains eventual consistency across distributed instances by ensuring that the same token is used for all subsequent watch requests, until a new change is detected.
+        /// </summary>
+        /// <param name="message">The HTTP message.</param>
+        /// <param name="pipeline">The pipeline.</param>
+        /// <returns>A task representing the asynchronous operation.</returns>
+        public override async System.Threading.Tasks.ValueTask ProcessAsync(HttpMessage message, ReadOnlyMemory<HttpPipelinePolicy> pipeline)
+        {
+            message.Request.Headers.Remove("Authorization");
+            string token = _afdTokenAccessor.Current;
+            if (!string.IsNullOrEmpty(token))
+            {
+                message.Request.Uri.Reset(AddTokenToUri(message.Request.Uri.ToUri(), token));
+            }
+
+            await ProcessNextAsync(message, pipeline).ConfigureAwait(false);
+        }
+
+        private static Uri AddTokenToUri(Uri uri, string token)
+        {
+            Debug.Assert(!string.IsNullOrEmpty(token));
+
+            var uriBuilder = new UriBuilder(uri);
+
+            var query = HttpUtility.ParseQueryString(uriBuilder.Query);
+            query[AfdTokenQueryParameter] = token;
+
+            uriBuilder.Query = query.ToString();
+
+            return uriBuilder.Uri;
+        }
+    }
+}

src/Microsoft.Extensions.Configuration.AzureAppConfiguration/Afd/AfdTokenAccessor.cs

@@ -0,0 +1,23 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT license.
+//
+namespace Microsoft.Extensions.Configuration.AzureAppConfiguration.Afd
+{
+    /// <summary>
+    /// Implementation of IAfdTokenAccessor that manages the current token for AFD cache breakage/consistency.
+    /// </summary>
+    internal class AfdTokenAccessor : IAfdTokenAccessor
+    {
+        private string _currentToken;
+
+        /// <summary>
+        /// Gets or sets the current token value to be used for AFD cache breakage/consistency.
+        /// When null, AFD cache breakage/consistency is disabled. When not null, the token will be injected into requests.
+        /// </summary>
+        public string Current
+        {
+            get => _currentToken;
+            set => _currentToken = value;
+        }
+    }
+}

src/Microsoft.Extensions.Configuration.AzureAppConfiguration/Afd/EmptyTokenCredential.cs

@@ -0,0 +1,38 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT license.
+//
+using Azure.Core;
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace Microsoft.Extensions.Configuration.AzureAppConfiguration.Afd
+{
+    /// <summary>
+    /// A token credential that provides an empty token.
+    /// </summary>
+    internal class EmptyTokenCredential : TokenCredential
+    {
+        /// <summary>
+        /// Gets an empty token.
+        /// </summary>
+        /// <param name="requestContext">The context of the token request.</param>
+        /// <param name="cancellationToken">A cancellation token to cancel the operation.</param>
+        /// <returns>An empty access token.</returns>
+        public override AccessToken GetToken(TokenRequestContext requestContext, CancellationToken cancellationToken)
+        {
+            return new AccessToken(string.Empty, DateTimeOffset.MaxValue);
+        }
+
+        /// <summary>
+        /// Asynchronously gets an empty token.
+        /// </summary>
+        /// <param name="requestContext">The context of the token request.</param>
+        /// <param name="cancellationToken">A cancellation token to cancel the operation.</param>
+        /// <returns>A task that represents the asynchronous operation. The task result contains an empty access token.</returns>
+        public override ValueTask<AccessToken> GetTokenAsync(TokenRequestContext requestContext, CancellationToken cancellationToken)
+        {
+            return new ValueTask<AccessToken>(new AccessToken(string.Empty, DateTimeOffset.MaxValue));
+        }
+    }
+}

src/Microsoft.Extensions.Configuration.AzureAppConfiguration/Afd/IAfdTokenAccessor.cs

@@ -0,0 +1,17 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT license.
+//
+namespace Microsoft.Extensions.Configuration.AzureAppConfiguration.Afd
+{
+    // <summary>
+    // Interface for accessing the AFD cache breakage/consistency token.
+    // </summary>
+    internal interface IAfdTokenAccessor
+    {
+        /// <summary>
+        /// Gets or sets the current token value to be used for AFD cache breakage/consistency.
+        /// When null, AFD cache breakage/consistency is disabled. When not null, the token will be injected into requests.
+        /// </summary>
+        string Current { get; set; }
+    }
+}

src/Microsoft.Extensions.Configuration.AzureAppConfiguration/AzureAppConfigurationOptions.cs

@@ -5,6 +5,7 @@
 using Azure.Data.AppConfiguration;
 using Microsoft.Extensions.Azure;
 using Microsoft.Extensions.Configuration.AzureAppConfiguration.AzureKeyVault;
+using Microsoft.Extensions.Configuration.AzureAppConfiguration.Afd;
 using Microsoft.Extensions.Configuration.AzureAppConfiguration.Extensions;
 using Microsoft.Extensions.Configuration.AzureAppConfiguration.FeatureManagement;
 using Microsoft.Extensions.Configuration.AzureAppConfiguration.Models;
@@ -127,7 +128,7 @@ internal IEnumerable<IKeyValueAdapter> Adapters
         /// <summary>
         /// Options used to configure the client used to communicate with Azure App Configuration.
         /// </summary>
-        internal ConfigurationClientOptions ClientOptions { get; } = GetDefaultClientOptions();
+        internal ConfigurationClientOptions ClientOptions { get; private set; } = GetDefaultClientOptions();
 
         /// <summary>
         /// Flag to indicate whether Key Vault options have been configured.
@@ -154,6 +155,16 @@ internal IEnumerable<IKeyValueAdapter> Adapters
         /// </summary>
         internal IAzureClientFactory<ConfigurationClient> ClientFactory { get; private set; }
 
+        /// <summary>
+        /// An accessor for current token to be used for AFD cache breakage/consistency.
+        /// </summary>
+        internal IAfdTokenAccessor AfdTokenAccessor { get; set; }
+
+        /// <summary>
+        /// Gets a value indicating whether AFD is enabled.
+        /// </summary>
+        internal bool IsAfdEnabled { get; private set; }
+
         /// <summary>
         /// Initializes a new instance of the <see cref="AzureAppConfigurationOptions"/> class.
         /// </summary>
@@ -181,6 +192,7 @@ public AzureAppConfigurationOptions()
         public AzureAppConfigurationOptions SetClientFactory(IAzureClientFactory<ConfigurationClient> factory)
         {
             ClientFactory = factory ?? throw new ArgumentNullException(nameof(factory));
+
             return this;
         }
 
@@ -357,6 +369,11 @@ public AzureAppConfigurationOptions Connect(string connectionString)
         /// </param>
         public AzureAppConfigurationOptions Connect(IEnumerable<string> connectionStrings)
         {
+            if (IsAfdEnabled)
+            {
+                throw new InvalidOperationException("Cannot connect to both Azure App Configuration and AFD at the same time.");
+            }
+
             if (connectionStrings == null || !connectionStrings.Any())
             {
                 throw new ArgumentNullException(nameof(connectionStrings));
@@ -373,6 +390,33 @@ public AzureAppConfigurationOptions Connect(IEnumerable<string> connectionString
             return this;
         }
 
+        /// <summary>
+        /// Connect the provider to Azure Front Door endpoint.
+        /// </summary>
+        /// <param name="endpoint">The endpoint of the Azure Front Door (AFD) instance to connect to.</param>
+        public AzureAppConfigurationOptions ConnectAzureFrontDoor(Uri endpoint)
+        {
+            if ((Credential != null && !(Credential is EmptyTokenCredential)) || (ConnectionStrings?.Any() ?? false))
+            {
+                throw new InvalidOperationException("Cannot connect to both Azure App Configuration and Azure Front Door at the same time.");
+            }
+
+            if (endpoint == null)
+            {
+                throw new ArgumentNullException(nameof(endpoint));
+            }
+
+            Credential ??= new EmptyTokenCredential();
+
+            Endpoints = new List<Uri>() { endpoint };
+            ConnectionStrings = null;
+
+            IsAfdEnabled = true;
+            AfdTokenAccessor = new AfdTokenAccessor();
+
+            return this;
+        }
+
         /// <summary>
         /// Connect the provider to Azure App Configuration using endpoint and token credentials.
         /// </summary>
@@ -400,6 +444,11 @@ public AzureAppConfigurationOptions Connect(Uri endpoint, TokenCredential creden
         /// <param name="credential">Token credential to use to connect.</param>
         public AzureAppConfigurationOptions Connect(IEnumerable<Uri> endpoints, TokenCredential credential)
         {
+            if (IsAfdEnabled)
+            {
+                throw new InvalidOperationException("Cannot connect to both Azure App Configuration and AFD at the same time.");
+            }
+
             if (endpoints == null || !endpoints.Any())
             {
                 throw new ArgumentNullException(nameof(endpoints));