Credentials use azure_core Pipelines (#2986)

This entails significant supporting changes:

- removed the mostly vestigial TokenCredentialOptions
    - ClientOptions now configures a credential's HttpClient
- authority_host now comes from credential options; this is an interim
replacement pending #2439
- tests which used this to mock env vars now do so via a test-only
option
- Added TokenRequestOptions.ClientMethodOptions (and the necessary
lifetime parameter) so get_token can propagate the caller's Context
- Added an optional ClientMethodOptions argument to
`ClientAssertion::secret()`
- this could instead be an optional Context but ClientMethodOptions
seems more future-proof

Closes #2436

---------

Co-authored-by: Heath Stewart <[email protected]>

Author: chlowell

sdk/core/azure_core/CHANGELOG.md

@@ -6,6 +6,7 @@
 
 - Added `RawResponse` to `ErrorKind::HttpResponse` that contains the HTTP status code, headers, and complete error response body.
 - Added `RequestContent::from_slice()`.
+- Added `TokenRequestOptions { method_options: ClientMethodOptions }`.
 - Added `TryFrom<T> for RequestContent<T, JsonFormat>` for JSON primitives.
 - Added support for WASM to the `async_runtime` module.
 - Added logging policy to log HTTP requests and responses in the pipeline. As a part of this change, sanitization support was added to places which log HTTP headers and URLs. The `azure_core::http::ClientOptions` has been enhanced with a `LoggingOptions` which allows a user/service client to specify headers or URL query parameters which should be allowed. Note that the sanitization feature is disabled if you build with the `debug` feature enabled.
@@ -14,6 +15,7 @@
 
 ### Breaking Changes
 
+- Added a lifetime parameter to `TokenRequestOptions`.
 - Added the ability to configure pipeline configuration independently from `ClientOptions`. This adds a new optional `PipelineOptions` parameter to `azure_core::http::Pipeline::new()`. If not specified, it defaults to the expected options for `azure_core` services.
 - Changed `FromStr for RequestContent<T, F>` to `RequestContent::from_str()`.
 - Changed `TryFrom<&'static str> for RequestContent<T, F>` to `RequestContent::from_static()`.

sdk/core/azure_core/src/credentials.rs

@@ -5,7 +5,7 @@
 
 use serde::{Deserialize, Serialize};
 use std::{borrow::Cow, fmt::Debug};
-use typespec_client_core::{fmt::SafeDebug, time::OffsetDateTime};
+use typespec_client_core::{fmt::SafeDebug, http::ClientMethodOptions, time::OffsetDateTime};
 
 /// Default Azure authorization scope.
 pub static DEFAULT_SCOPE_SUFFIX: &str = "/.default";
@@ -89,7 +89,9 @@ impl AccessToken {
 
 /// Options for getting a token from a [`TokenCredential`]
 #[derive(Clone, Default, SafeDebug)]
-pub struct TokenRequestOptions;
+pub struct TokenRequestOptions<'a> {
+    pub method_options: ClientMethodOptions<'a>,
+}
 
 /// Represents a credential capable of providing an OAuth token.
 #[cfg_attr(target_arch = "wasm32", async_trait::async_trait(?Send))]
@@ -99,6 +101,6 @@ pub trait TokenCredential: Send + Sync + Debug {
     async fn get_token(
         &self,
         scopes: &[&str],
-        options: Option<TokenRequestOptions>,
+        options: Option<TokenRequestOptions<'_>>,
     ) -> crate::Result<AccessToken>;
 }

sdk/core/azure_core/src/http/policies/bearer_token_policy.rs

@@ -2,7 +2,7 @@
 // Licensed under the MIT License.
 
 use crate::{
-    credentials::{AccessToken, TokenCredential},
+    credentials::{AccessToken, TokenCredential, TokenRequestOptions},
     error::{Error, ErrorKind},
     http::{
         headers::AUTHORIZATION,
@@ -12,7 +12,7 @@ use crate::{
 use async_lock::RwLock;
 use async_trait::async_trait;
 use std::sync::Arc;
-use typespec_client_core::http::{Context, Request};
+use typespec_client_core::http::{ClientMethodOptions, Context, Request};
 use typespec_client_core::time::{Duration, OffsetDateTime};
 
 /// Authentication policy for a bearer token.
@@ -66,7 +66,16 @@ impl Policy for BearerTokenCredentialPolicy {
                 drop(access_token);
                 let mut access_token = self.access_token.write().await;
                 if access_token.is_none() {
-                    *access_token = Some(self.credential.get_token(&self.scopes(), None).await?);
+                    let options = TokenRequestOptions {
+                        method_options: ClientMethodOptions {
+                            context: ctx.clone(),
+                        },
+                    };
+                    *access_token = Some(
+                        self.credential
+                            .get_token(&self.scopes(), Some(options))
+                            .await?,
+                    );
                 }
             }
             Some(token) if should_refresh(&token.expires_on) => {
@@ -78,7 +87,16 @@ impl Policy for BearerTokenCredentialPolicy {
                 // access_token shouldn't be None here, but check anyway to guarantee unwrap won't panic
                 if access_token.is_none() || access_token.as_ref().unwrap().expires_on == expires_on
                 {
-                    match self.credential.get_token(&self.scopes(), None).await {
+                    let options = TokenRequestOptions {
+                        method_options: ClientMethodOptions {
+                            context: ctx.clone(),
+                        },
+                    };
+                    match self
+                        .credential
+                        .get_token(&self.scopes(), Some(options))
+                        .await
+                    {
                         Ok(new_token) => {
                             *access_token = Some(new_token);
                         }
@@ -176,7 +194,7 @@ mod tests {
         async fn get_token(
             &self,
             _: &[&str],
-            _: Option<TokenRequestOptions>,
+            _: Option<TokenRequestOptions<'_>>,
         ) -> Result<AccessToken> {
             let i = self.calls.fetch_add(1, Ordering::SeqCst);
             self.tokens

sdk/core/azure_core_test/src/credentials.rs

@@ -4,13 +4,16 @@
 //! Credentials for live and recorded tests.
 use azure_core::{
     credentials::{AccessToken, Secret, TokenCredential, TokenRequestOptions},
+    http::ClientOptions,
     time::{Duration, OffsetDateTime},
 };
 #[cfg(target_arch = "wasm32")]
 use azure_core::{error::ErrorKind, Error};
 #[cfg(not(target_arch = "wasm32"))]
 use azure_identity::DeveloperToolsCredential;
-use azure_identity::{AzurePipelinesCredential, TokenCredentialOptions};
+use azure_identity::{
+    AzurePipelinesCredential, AzurePipelinesCredentialOptions, ClientAssertionCredentialOptions,
+};
 use std::{env, sync::Arc};
 
 /// A mock [`TokenCredential`] useful for testing.
@@ -30,7 +33,7 @@ impl TokenCredential for MockCredential {
     async fn get_token(
         &self,
         scopes: &[&str],
-        _: Option<TokenRequestOptions>,
+        _: Option<TokenRequestOptions<'_>>,
     ) -> azure_core::Result<AccessToken> {
         let token: Secret = format!("TEST TOKEN {}", scopes.join(" ")).into();
         let expires_on = OffsetDateTime::now_utc().saturating_add(Duration::minutes(5));
@@ -43,9 +46,7 @@ impl TokenCredential for MockCredential {
 ///
 /// When running in Azure Pipelines, this will return an [`AzurePipelinesCredential`];
 /// otherwise, it will return a [`DeveloperToolsCredential`].
-pub fn from_env(
-    options: Option<TokenCredentialOptions>,
-) -> azure_core::Result<Arc<dyn TokenCredential>> {
+pub fn from_env(options: Option<ClientOptions>) -> azure_core::Result<Arc<dyn TokenCredential>> {
     // cspell:ignore accesstoken azuresubscription
     let tenant_id = env::var("AZURESUBSCRIPTION_TENANT_ID").ok();
     let client_id = env::var("AZURESUBSCRIPTION_CLIENT_ID").ok();
@@ -65,7 +66,12 @@ pub fn from_env(
                 client_id,
                 &connection_id,
                 access_token,
-                options.map(Into::into),
+                Some(AzurePipelinesCredentialOptions {
+                    credential_options: ClientAssertionCredentialOptions {
+                        client_options: options.unwrap_or_default(),
+                        ..Default::default()
+                    },
+                }),
             )? as Arc<dyn TokenCredential>);
         }
     }

sdk/cosmos/azure_data_cosmos/src/pipeline/authorization_policy.rs

@@ -170,7 +170,7 @@ mod tests {
         async fn get_token(
             &self,
             scopes: &[&str],
-            _: Option<TokenRequestOptions>,
+            _: Option<TokenRequestOptions<'_>>,
         ) -> azure_core::Result<AccessToken> {
             let token = format!("{}+{}", self.0, scopes.join(","));
             Ok(AccessToken::new(

sdk/eventhubs/azure_messaging_eventhubs/src/common/authorizer.rs

@@ -412,7 +412,7 @@ mod tests {
         async fn get_token(
             &self,
             _scopes: &[&str],
-            _options: Option<TokenRequestOptions>,
+            _options: Option<TokenRequestOptions<'_>>,
         ) -> Result<AccessToken> {
             // Simulate a token refresh by incrementing the token get count
             // and updating the token expiration time

sdk/eventhubs/azure_messaging_eventhubs/src/consumer/README.md

@@ -10,7 +10,7 @@ and manage the lifecycle of the consumer client.
 ### Creating a new [`ConsumerClient`] instance
 
 ```rust no_run
-use azure_identity::{DeveloperToolsCredential, TokenCredentialOptions};
+use azure_identity::DeveloperToolsCredential;
 use azure_messaging_eventhubs::ConsumerClient;
 
 #[tokio::main]
@@ -26,7 +26,7 @@ async fn main() -> Result<(), azure_core::Error> {
 ### Opening a connection to the Event Hub
 
 ```rust no_run
-use azure_identity::{DeveloperToolsCredential, TokenCredentialOptions};
+use azure_identity::DeveloperToolsCredential;
 use azure_messaging_eventhubs::ConsumerClient;
 
 #[tokio::main]
@@ -53,7 +53,7 @@ async fn main() -> Result<(), azure_core::Error> {
 ### Closing the connection to the Event Hub
 
 ```rust no_run
-use azure_identity::{DeveloperToolsCredential, TokenCredentialOptions};
+use azure_identity::DeveloperToolsCredential;
 use azure_messaging_eventhubs::ConsumerClient;
 
 #[tokio::main]
@@ -83,7 +83,7 @@ async fn main() -> Result<(), azure_core::Error> {
 
 ```rust no_run
 use futures::stream::StreamExt;
-use azure_identity::{DeveloperToolsCredential, TokenCredentialOptions};
+use azure_identity::DeveloperToolsCredential;
 use azure_messaging_eventhubs::ConsumerClient;
 use futures::pin_mut;
 

sdk/eventhubs/azure_messaging_eventhubs/src/consumer/event_receiver.rs

@@ -19,7 +19,7 @@ use tracing::trace;
 ///
 /// ```no_run
 /// use azure_messaging_eventhubs::ConsumerClient;
-/// use azure_identity::{DeveloperToolsCredential, TokenCredentialOptions};
+/// use azure_identity::DeveloperToolsCredential;
 /// use futures::stream::StreamExt;
 ///
 /// #[tokio::main]

sdk/eventhubs/azure_messaging_eventhubs/src/consumer/mod.rs

@@ -66,7 +66,7 @@ impl ConsumerClient {
     /// # #[tokio::main]
     /// # async fn main() -> Result<(), Box<dyn std::error::Error>> {
     /// use azure_messaging_eventhubs::ConsumerClient;
-    /// use azure_identity::{DeveloperToolsCredential, TokenCredentialOptions};
+    /// use azure_identity::DeveloperToolsCredential;
     ///
     ///     let my_credential = DeveloperToolsCredential::new(None)?;
     /// let consumer = ConsumerClient::builder()
@@ -124,7 +124,7 @@ impl ConsumerClient {
     ///
     /// ``` no_run
     /// use azure_messaging_eventhubs::ConsumerClient;
-    /// use azure_identity::{DeveloperToolsCredential, TokenCredentialOptions};
+    /// use azure_identity::DeveloperToolsCredential;
     ///
     /// #[tokio::main]
     /// async fn main() {
@@ -199,7 +199,7 @@ impl ConsumerClient {
     ///
     /// ```no_run
     /// use azure_messaging_eventhubs::ConsumerClient;
-    /// use azure_identity::{DeveloperToolsCredential, TokenCredentialOptions};
+    /// use azure_identity::DeveloperToolsCredential;
     /// use futures::stream::StreamExt;
     ///
     /// #[tokio::main]
@@ -301,7 +301,7 @@ impl ConsumerClient {
     ///
     /// ``` no_run
     /// use azure_messaging_eventhubs::ConsumerClient;
-    /// use azure_identity::{DeveloperToolsCredential, TokenCredentialOptions};
+    /// use azure_identity::DeveloperToolsCredential;
     ///
     /// #[tokio::main]
     /// async fn main(){
@@ -347,7 +347,7 @@ impl ConsumerClient {
     ///
     /// ``` no_run
     /// use azure_messaging_eventhubs::ConsumerClient;
-    /// use azure_identity::{DeveloperToolsCredential, TokenCredentialOptions};
+    /// use azure_identity::DeveloperToolsCredential;
     ///
     /// #[tokio::main]
     /// async fn main() {
@@ -548,7 +548,7 @@ pub mod builders {
     ///
     /// ```no_run
     /// use azure_messaging_eventhubs::ConsumerClient;
-    /// use azure_identity::{DeveloperToolsCredential, TokenCredentialOptions};
+    /// use azure_identity::DeveloperToolsCredential;
     ///
     /// #[tokio::main]
     /// async fn main() -> Result<(), Box<dyn std::error::Error>> {
@@ -591,7 +591,7 @@ pub mod builders {
         ///
         /// ```no_run
         /// use azure_messaging_eventhubs::ConsumerClient;
-        /// use azure_identity::{DeveloperToolsCredential, TokenCredentialOptions};
+        /// use azure_identity::DeveloperToolsCredential;
         ///
         /// #[tokio::main]
         /// async fn main() -> Result<(), Box<dyn std::error::Error>> {
@@ -651,7 +651,7 @@ pub mod builders {
         ///
         /// ```
         /// use azure_messaging_eventhubs::ConsumerClient;
-        /// use azure_identity::{DeveloperToolsCredential, TokenCredentialOptions};
+        /// use azure_identity::DeveloperToolsCredential;
         ///
         /// #[tokio::main]
         /// async fn main() -> Result<(), Box<dyn std::error::Error>> {

sdk/eventhubs/azure_messaging_eventhubs/src/models/mod.rs

@@ -49,7 +49,7 @@ use std::time::SystemTime;
 /// Basic usage:
 ///
 /// ```no_run
-/// # use azure_identity::{DeveloperToolsCredential, TokenCredentialOptions};
+/// # use azure_identity::DeveloperToolsCredential;
 /// # #[tokio::main]
 /// # async fn main() -> Result<(), Box<dyn std::error::Error>> {
 /// # let my_credentials = DeveloperToolsCredential::new(None)?;
@@ -95,7 +95,7 @@ pub struct EventHubProperties {
 /// Basic usage:
 ///
 /// ```no_run
-/// # use azure_identity::{DeveloperToolsCredential, TokenCredentialOptions};
+/// # use azure_identity::DeveloperToolsCredential;
 /// # #[tokio::main]
 /// # async fn main() -> Result<(), Box<dyn std::error::Error>> {
 /// # let my_credentials = DeveloperToolsCredential::new(None)?;