* Add Cosmos DB Shell (NoSQL) support to Cloud Shell
Adds Cosmos DB (NoSQL) support to the Cloud Shell experience and wires up authentication for RBAC / local-auth-disabled accounts:
- Enable the Open Cosmos DB Shell button behind the enableCloudShell feature flag.
- Bootstrap .NET SDK 10 in Cloud Shell before installing the CosmosDBShell tool.
- Force gateway connection mode and add --verbose to surface connection errors.
- Select Entra ID vs account-key auth via isCloudShellEntraAuthEnabled (covers dataplane RBAC and disableLocalAuth accounts).
- Acquire a data-plane-scoped Entra token on demand when no cached aadToken exists, and omit --connect-tenant so a missing token falls through to DefaultAzureCredential (Cloud Shell az session) instead of interactive/device-code auth.
* Fix popup_window_error in CosmosDB Cloud Shell Entra auth
Acquiring an Entra token on demand via acquireMsalTokenForAccount triggered a browser loginPopup (even in silent mode when no MSAL account was cached), which fails with popup_window_error inside the hosted Cloud Shell context. getKey now returns the cached userContext.aadToken when present, or an empty string otherwise. With no token exported, the CosmosDBShell tool falls through to DefaultAzureCredential, which uses the Cloud Shell's signed-in az session.
* Force --connect-azure-cli whenever no credential env var is exported
In Azure Cloud Shell, DefaultAzureCredential tries ManagedIdentityCredential first, which cannot mint a token for the *.documents.azure.com audience (AudienceNotSupported). Force AzureCliCredential via --connect-azure-cli whenever no key/token env var is exported, covering both the Entra-no-token and key-auth-empty-key cases. Also auto-update the CosmosDBShell tool so cached installs pick up the new flag.
* Silently mint a Cosmos data-plane token for the Cloud Shell Entra path
A disableLocalAuth Cosmos account whose Data Explorer session is still in key mode has no cached userContext.aadToken, and the ephemeral Cloud Shell can obtain a Cosmos token from neither its managed identity (AudienceNotSupported for *.documents.azure.com) nor its az session (not logged in). Mint a Cosmos-scoped token in the browser and export it via COSMOSDB_SHELL_TOKEN. The acquisition is guarded on an existing cached MSAL account so it can never trigger an interactive popup, and any failure returns an empty string so the tool falls back to --connect-azure-cli.
* Only accept Y/N at the Cloud Shell consent prompt
askConfirmation now ignores any key that is not Y or N instead of treating every non-Y key as a decline, so an accidental keypress no longer aborts the Cloud Shell consent flow. Also add diagnostic warnings on the Cloud Shell token path so the browser console reveals whether the silent Cosmos token mint was skipped (no cached MSAL account) or returned empty.
* Use device-code auth when Cloud Shell has no token
* Pass the Data Explorer credential to the Cosmos DB shell instead of signing in interactively
Azure Cloud Shell cannot authenticate to Cosmos DB on its own: its managed identity
is rejected with AudienceNotSupported for the *.documents.azure.com audience, its az
session is not signed in, and neither the interactive browser nor the device-code flow
is usable from the embedded terminal.
Resolve the credential in Data Explorer and hand it to the shell out-of-band:
- getCosmosDBShellCredential() returns an Entra ID data-plane token (cached aadToken,
or one minted silently only when an MSAL account already exists so it can never
trigger a popup), falling back to the account master key unless local auth is
disabled. It reports which kind it resolved so the correct env var is exported.
- CosmosDBShellHandler exports COSMOSDB_SHELL_TOKEN or COSMOSDB_SHELL_ACCOUNT_KEY and
drops every credential flag, so the tool always lands on a terminal, non-interactive
step of its credential chain.
- When nothing can be resolved, print actionable guidance instead of launching the
tool with no credential.
* Fix TS7011 in ShellTypeFactory tests by typing the mocked getAllAccounts
The empty array literal in the getMsalInstance mock had no contextual type, so
tsc inferred an implicit any[] return under noImplicitAny. Route every mock
through a typed mockMsalAccounts helper.
* Reuse DE's cached credential for Cosmos DB Shell; add read-only key fallback
* Deliver Cosmos DB Shell key as a full connection string; harden key resolution
* Surface the specific reason a Cosmos DB Shell credential could not be resolved
* Deliver Cosmos DB Shell credential inline (export+connect on one line), mirroring Mongo handler
* Log which Cosmos DB Shell credential kind was resolved for debugging
* Increase ARM timeout for Cloud Shell provisioning calls to avoid spurious abort errors
* Gate Cosmos DB Shell button behind enableCosmosDBShell feature flag
* Fix TS2741: add missing enableCosmosDBShell to Features test fixture
* Adding further console logging but also fixed lines with JSON.stringify(error)
* Added retry mechanism for GETs for armRequest workflow
* Moved stringifyError into its own file as it was causing strict compile issues in ErrorHandlingUtils
* Reapply "MSAL browser migration changes"
This reverts commit 60a65efb7b.
* Fix redirect URI for localhost
* Fix URI for logout and other minor fix
* Remove unnecessary files
* Fix tests
* Fix tests
* Run npm format
* Address comments
* Address comment
* Add copilot instructions and skills for build and tests.
* Add dev-server skill.
* Auth Util changes to fix Entra login while running from copilot.
* Fix lint issue.
* Fix API endpoint for CassandraProxy query API
* activate Mongo Proxy and Cassandra Proxy in Prod
* Add CP Prod endpoint
* Run npm format and tests
* Revert code
* fix bug that blocked local mongo proxy and cassandra proxy development
* Add prod endpoint
* fix pr check tests
* Remove prod
* Remove prod endpoint
* Remove dev endpoint
* Support data plane RBAC
* Support data plane RBAC
* Add additional changes for Portal RBAC functionality
* Remove unnecessary code
* Remove unnecessary code
* Add code to fix VCoreMongo/PG bug
* Address feedback
* Add more logs for RBAC feature
* Add more logs for RBAC features
* Add AAD endpoints for all environments
* Add AAD endpoints
* Run npm format
* Support multi-tenant switching for Data Plane RBAC
* Remove tenantID duplicates
---------
Co-authored-by: Senthamil Sindhu <sindhuba@microsoft.com>
Co-authored-by: Asier Isayas <aisayas@microsoft.com>
* Add a silent parameter to acquireTokenWithMsal
If true, the function won't retry to sign in using a Popup if silent token acquisition fails.
* Improve Login for Entra ID RBAC button logic
Try to reuse an existing signed-in MSAL account to get the AAD token
and fall back to full sign-in otherwise.
Also move the logic to AuthorizationUtils
* Try to acquire an Entra ID token silently on startup.
When running in Portal MSAL should be able to reuse the
MSAL account from Portal and allow us to silently get
the RBAC token. If it fails we'll show the Login for Entry ID RBAC
button as usual.
* Small code improvements
* Remove the RBAC notice from settings pane
and try to acquire RBAC token silently after enabling RBAC.
* Use msal.ssoSilent with an optional login hint
to avoid more sign-in popups.
msal.loginPopup will be used as a backup option if ssoSilent fails.
Ideally the parent environment (Portal/Fabric) should send
a loginHint with the username of the currently signed in user that
can be passed to the token acquisition flow.
* Improve RBAC error wording, clarifying where to find the Login button.
* Mostly working - some cosmetic changes remaining.
* Cosmetic changes and other tidy ups.
* More clean up.
* Move msal back to dependencies. Fix typo.
* msal should be prod dependency
* Revert msal package update as it is causing issues with unit test
execution.
* Add tracing for unhandled exceptions when acquiring tokens.
Mike Krüger
vchske
sindhuba
jawelton74
sunghyunkang1111
asier-isayas
BChoudhury-ms
Vsevolod Kukol
Laurent Nguyen
Steve Faulkner
Zachary Foster
Jordi Bunster
Sunil Kumar Yadav
victor-meng