* Add Cosmos DB Shell (NoSQL) support to Cloud Shell
Adds Cosmos DB (NoSQL) support to the Cloud Shell experience and wires up authentication for RBAC / local-auth-disabled accounts:
- Enable the Open Cosmos DB Shell button behind the enableCloudShell feature flag.
- Bootstrap .NET SDK 10 in Cloud Shell before installing the CosmosDBShell tool.
- Force gateway connection mode and add --verbose to surface connection errors.
- Select Entra ID vs account-key auth via isCloudShellEntraAuthEnabled (covers dataplane RBAC and disableLocalAuth accounts).
- Acquire a data-plane-scoped Entra token on demand when no cached aadToken exists, and omit --connect-tenant so a missing token falls through to DefaultAzureCredential (Cloud Shell az session) instead of interactive/device-code auth.
* Fix popup_window_error in CosmosDB Cloud Shell Entra auth
Acquiring an Entra token on demand via acquireMsalTokenForAccount triggered a browser loginPopup (even in silent mode when no MSAL account was cached), which fails with popup_window_error inside the hosted Cloud Shell context. getKey now returns the cached userContext.aadToken when present, or an empty string otherwise. With no token exported, the CosmosDBShell tool falls through to DefaultAzureCredential, which uses the Cloud Shell's signed-in az session.
* Force --connect-azure-cli whenever no credential env var is exported
In Azure Cloud Shell, DefaultAzureCredential tries ManagedIdentityCredential first, which cannot mint a token for the *.documents.azure.com audience (AudienceNotSupported). Force AzureCliCredential via --connect-azure-cli whenever no key/token env var is exported, covering both the Entra-no-token and key-auth-empty-key cases. Also auto-update the CosmosDBShell tool so cached installs pick up the new flag.
* Silently mint a Cosmos data-plane token for the Cloud Shell Entra path
A disableLocalAuth Cosmos account whose Data Explorer session is still in key mode has no cached userContext.aadToken, and the ephemeral Cloud Shell can obtain a Cosmos token from neither its managed identity (AudienceNotSupported for *.documents.azure.com) nor its az session (not logged in). Mint a Cosmos-scoped token in the browser and export it via COSMOSDB_SHELL_TOKEN. The acquisition is guarded on an existing cached MSAL account so it can never trigger an interactive popup, and any failure returns an empty string so the tool falls back to --connect-azure-cli.
* Only accept Y/N at the Cloud Shell consent prompt
askConfirmation now ignores any key that is not Y or N instead of treating every non-Y key as a decline, so an accidental keypress no longer aborts the Cloud Shell consent flow. Also add diagnostic warnings on the Cloud Shell token path so the browser console reveals whether the silent Cosmos token mint was skipped (no cached MSAL account) or returned empty.
* Use device-code auth when Cloud Shell has no token
* Pass the Data Explorer credential to the Cosmos DB shell instead of signing in interactively
Azure Cloud Shell cannot authenticate to Cosmos DB on its own: its managed identity
is rejected with AudienceNotSupported for the *.documents.azure.com audience, its az
session is not signed in, and neither the interactive browser nor the device-code flow
is usable from the embedded terminal.
Resolve the credential in Data Explorer and hand it to the shell out-of-band:
- getCosmosDBShellCredential() returns an Entra ID data-plane token (cached aadToken,
or one minted silently only when an MSAL account already exists so it can never
trigger a popup), falling back to the account master key unless local auth is
disabled. It reports which kind it resolved so the correct env var is exported.
- CosmosDBShellHandler exports COSMOSDB_SHELL_TOKEN or COSMOSDB_SHELL_ACCOUNT_KEY and
drops every credential flag, so the tool always lands on a terminal, non-interactive
step of its credential chain.
- When nothing can be resolved, print actionable guidance instead of launching the
tool with no credential.
* Fix TS7011 in ShellTypeFactory tests by typing the mocked getAllAccounts
The empty array literal in the getMsalInstance mock had no contextual type, so
tsc inferred an implicit any[] return under noImplicitAny. Route every mock
through a typed mockMsalAccounts helper.
* Reuse DE's cached credential for Cosmos DB Shell; add read-only key fallback
* Deliver Cosmos DB Shell key as a full connection string; harden key resolution
* Surface the specific reason a Cosmos DB Shell credential could not be resolved
* Deliver Cosmos DB Shell credential inline (export+connect on one line), mirroring Mongo handler
* Log which Cosmos DB Shell credential kind was resolved for debugging
* Increase ARM timeout for Cloud Shell provisioning calls to avoid spurious abort errors
* Gate Cosmos DB Shell button behind enableCosmosDBShell feature flag
* Fix TS2741: add missing enableCosmosDBShell to Features test fixture
* Update Az CLI to use new secrets.
* Add test step for Az login
* Remove test step. Fix up account names in test code.
* Fix the account prefix env. variable.
* Fix it in the CI config as well.
* Try to fix the CI config for some tests
* Clean up access tokens for NoSQL.
* Disable most tests while sorting out account setup. Add debug tracing.
* Comment out most tests.
* Set RG Name var in CI config.
* Fix up tenant id.
* Enable other API tests
* e-enable more tests.
* Re-enable remaining tests.
* Remove all of the test.skip() calls.
* Remove debug traces.
* Remove function to retrieve SQL RBAC token, this is handled by the CI config now.
* Fix rbac token detection for table and resource token tests.
* Minor cleanup and fixing the cleanup config.
* Preview site and storage changes. Cleanup script changes.
* Clean up before PR.
* Fix resource group name in test results email.
Express was bumped 4.21.2 -> 5.2.1, whose router uses path-to-regexp v8 which removed inline-regex route params. The route /pull/:pr(\d+) threw PathError at startup. Switch to /pull/:pr (handler already validates with /^\d+\$/ and returns 400).
Also update deploy runtime to NODE:22-lts and drop the stray 'node' and unused top-level 'path-to-regexp' dependencies.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 7793a516-0204-44e1-bed5-d8ad91b9400a
Removes the GitHub notebook-repo integration that only existed to pin/browse notebook repositories. Deletes src/GitHub/, the GitHub controls/panes, GitHubUtils, JunoUtils, and the connectToGitHub webpack entry. Decouples NotebookManager, useNotebook, the resource tree, and Explorer from GitHub wiring. Trims JunoClient's GitHub-only methods while keeping the Schema and gallery methods. Removes GitHub config fields from ConfigContext and strips the dead github:// branches from NotebookUtil.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address exposed connection string in Data Explorer code
* Address exposed connection string in Data Explorer code
---------
Co-authored-by: Asier Isayas <aisayas@microsoft.com>
* Fix query tab view: respect default setting and add toggle behavior
- Use getDefaultQueryResultsView() when splitterDirection prop is not
provided, so the user's configured default from Settings is respected
- Add onCommandClick to the View split button that toggles between
Vertical and Horizontal layout when the main button is clicked
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add Playwright E2E tests for query tab View toggle and dropdown
- Add View to CommandBarButton enum in test fixtures
- Add test: clicking main View button toggles between vertical/horizontal
- Add test: selecting options from View dropdown changes layout
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add Playwright E2E tests for query tab View toggle and dropdown
- Add View to CommandBarButton enum in test fixtures
- Add test: clicking main View button toggles between vertical/horizontal
- Add test: selecting options from View dropdown changes layout
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fix issue that was failing tests when using account keys for access.
* Remove commented code.
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add implementation plan for removing Phoenix and notebooks
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Phase 1: Decouple database shells from Phoenix to CloudShell-only
Migrate all shell terminals to the CloudShell path and remove the legacy Phoenix notebook-server terminal code so shells no longer depend on notebook provisioning.
- TerminalTab now always uses CloudShellTerminalComponentAdapter; removed the notebook-server adapter branch, getNotebookServerInfo, and the dead VCoreMongo firewall check
- Migrate Postgres and VCore Mongo quickstart tabs to CloudShellTerminalComponent (drop allocateContainer/useNotebook dependencies)
- Refactor useTerminal to send input via the CloudShell WebSocket instead of postRobot/iframe; register the socket from CloudShellTerminalComponent
- Simplify Explorer.openNotebookTerminal to always open a CloudShell terminal
- Delete NotebookTerminalComponent(+test/less/snapshot), NotebookTerminalComponentAdapter, and the src/Terminal/ entry point
- Remove the terminal.html webpack entry/HTML plugin and src/Terminal from tsconfig.strict.json
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* ci: route Playwright reports through private Azure Storage container
Replaces the public `/playwright-reports/*` static-website uploads and all GitHub Actions artifact uploads for Playwright traces/videos/blob-reports with uploads to a new private container `playwright-reports` on the same storage account. PR comments now link to an Azure Portal blob-properties deep link (requires AAD sign-in) instead of the previously anonymous static-site URL.
Fixes MSRC finding: Playwright traces captured on test failure embed Authorization: Bearer headers, and the existing publish path made them anonymously downloadable. The new private container is RBAC-gated (Storage Blob Data Reader/Contributor at container scope) and the storage account already has anonymous blob access and shared-key access disabled.
* ci: TEMP smoke-test single Playwright spec to validate MSRC plumbing
Reduces the Playwright matrix to 1 shard and restricts the run to a single test in the searchableDropdown component fixture on Chrome. The fixture hits the local dev server only, so no Cosmos auth and no token captures happen \u2014 isolates the smoke test to the new Azure Storage upload/download/zip/PR-comment plumbing.
REVERT THIS COMMIT before merging the parent PR.
* ci: grant id-token: write to merge-playwright-reports job
The merge job overrides workflow-level permissions with its own block (contents: read, pull-requests: write), which silently drops the workflow-level id-token: write. Without it, Azure/login@v2 cannot fetch the federated OIDC token and fails.
Bug introduced when the Az login was relocated from the deleted publish-playwright-report job (which had id-token: write) into the merge job.
* ci: trigger re-run after RBAC propagation
* ci: trigger re-run after E2E_TESTS_CLIENT_ID SP grant
* ci: flatten downloaded shard reports before merge
az storage blob download-batch preserves the full blob path, but playwright merge-reports expects .zip files directly in the target directory. Flatten with find + mv after download.
* ci: switch PR comment to ContainerMenuBlade deep link
BlobPropertiesBladeV2 requires undocumented 'tabToload' and 'isDeleted' params we couldn't get past the Portal's grammar validator. ContainerMenuBlade has no required params and drops users directly into the playwright-reports container, where they navigate to \{run_id}-{attempt}/report.zip\ (one extra click vs. blob-direct).
* ci: make report path more prominent in PR comment
Surface the {run_id}-{attempt}/report.zip path on its own line so reviewers can copy-paste it into the Portal search instead of scanning the navigation prose.
* Revert "ci: TEMP smoke-test single Playwright spec to validate MSRC plumbing"
This reverts commit 308005f02b.
* ci: refresh OIDC token before shard upload
GitHub OIDC client assertions are valid for only 5 minutes (JWT iat -> exp window). Playwright shards that take >5 min exhaust the validity window before the upload step runs, causing AADSTS700024 'Client assertion is not within its valid time range'. Add a fresh Azure/login@v2 step right before the upload to mint a new OIDC token.
* Adding further console logging but also fixed lines with JSON.stringify(error)
* Added retry mechanism for GETs for armRequest workflow
* Moved stringifyError into its own file as it was causing strict compile issues in ErrorHandlingUtils
* Removing temporary debug logging
* Undoing eslint change as well
* Adding further console logging but also fixed lines with JSON.stringify(error)
* Added retry mechanism for GETs for armRequest workflow
* Moved stringifyError into its own file as it was causing strict compile issues in ErrorHandlingUtils
* Security hardening for Try Cosmos DB connection string flow
- Validate connection string format via parseConnectionString before accepting postMessage
- Restrict localhost:12900 in allowedHostedExplorerEndpoints to development builds only
- Export App component for testability with null-check on render target
- Add 12 unit tests covering origin validation, format validation, and message handling
* Fix HostedExplorer test mock types for compile
---------
Co-authored-by: Asier Isayas <aisayas@microsoft.com>
* Initial change for online partition key change
* Refactoring container copy strings so they can be locallized
* Missed a file
* Fixing some issues found by lint
* Fixing errors
* Fixing unit tests
* Fixing error caused by merging from master
* Fixing minor error from merge
* Fixing merge error
* Addressing comments
* Addressing some PR comments
* Minor issues
* Refixing a formatting issue
* Fixed localization error
* Localized file check-in by OneLocBuild Task: Build definition ID 13114: Build ID 2537086
* Localized file check-in by OneLocBuild Task: Build definition ID 13114: Build ID 2538719
* Localized file check-in by OneLocBuild Task: Build definition ID 13114: Build ID 2542662
* Localized file check-in by OneLocBuild Task: Build definition ID 13114: Build ID 2543180
* Localized file check-in by OneLocBuild Task: Build definition ID 13114: Build ID 2545050
* Localized file check-in by OneLocBuild Task: Build definition ID 13114: Build ID 2546636
* Localized file check-in by OneLocBuild Task: Build definition ID 13114: Build ID 2549709
---------
Co-authored-by: sunghyunkang1111 <114709653+sunghyunkang1111@users.noreply.github.com>
vchske
Mike Krüger
jawelton74
asier-isayas
dependabot[bot]
sakshigupta12feb
Nishtha Ahuja
sunghyunkang1111
BChoudhury-ms
Laurent Nguyen
olprod