The error state was lifted into HostedExplorer so a postMessage login could report failures, which meant the connect screen needed a second copy of the error markup for the AAD view. That copy fell outside the connectExplorerContent selector the tooltip styles are scoped to, so it rendered the message as unstyled inline text.
Move the state back into ConnectExplorer and let connectWithConnectionString log the failure as it did before. A failed postMessage login still leaves the user on the connect screen either way.
SQL, Tables, and Gremlin logins probed the account before signing in, so a user whose key was wrong or whose account was unreachable was blocked at the connect form. The probe is now gone: the connection string is accepted as-is and any bad key surfaces on the data-plane requests made from inside the explorer.
Removes validateDirectConnectionStringConnectivity, isAuthorizationError, and the connectExplorer.errors.connectFailed string along with their tests.
Also takes documentEndpoint straight from the AccountEndpoint in SQL and Gremlin connection strings instead of rebuilding it from the account name and a hardcoded DNS zone. Tables still derives it, since a Tables connection string only carries the table endpoint.
Encrypted-token and direct connection-string logins now write to one accountMetadata state instead of two, which also fixes the connect form staying mounted after a successful SQL/Tables/Gremlin login. Deletes the now-unused useTokenMetadata hook and moves fetchAccessData to Platform/Hosted/Helpers/PortalAccessData.ts.
- Lift the login error state into HostedExplorer so failures from the connect form and from a postMessage login share one source of truth
- Show the message returned by the service instead of falling back to a generic unreachable message
- Move isAuthorizationError into AuthorizationUtils alongside the other shared auth helpers
- Widen getErrorMessage to accept unknown so catch variables no longer need a cast
- Show the connect screen error tooltip beside the icon and widen it so long service messages fit
- Consolidate the repeated account lookup and login steps in the SQL connection string spec
- Remove validateDirectConnectionStringLogin and its helpers (extractEndpointHostFromConnectionString, extractHostToken, directLoginAllowlistedEndpointZones)
- Remove old extractMasterKeyfromConnectionString (Gremlin-specific), rename extractAccountKeyFromConnectionString to extractMasterKeyfromConnectionString
- Change validateDirectConnectionStringConnectivity to throw on error instead of returning string|undefined
- Simplify direct-login flow: submit connection string to CosmosClient as-is, no format or endpoint validation
- Keep connectivity pre-check (throws if CosmosClient cannot reach account)
- Remove 6 unused localization keys for validation errors
- Update tests to match new behavior
* Sync CloudShell backend PTY size on terminal resize
Resizing the browser window only re-fit the local xterm; the remote shell kept its original column count, so typed input wrapped/broke at the wrong column. Add resizeTerminal() client call to the CloudShell terminals/{id}/size endpoint and register a debounced terminal.onResize handler that pushes new dimensions to the backend.
* Add unit tests for registerTerminalResizeHandler (debounce, no-op skip, error handling)
* Fix resizeTerminal success test: stub a successful fetch response
Add TestAuthType and fold connection-string account resolution into getAccountName; seed and target the dedicated *-connstring accounts in CI while falling back to the standard per-API account locally.
Move the hardcoded SQL/Tables/Gremlin connection-string login strings into en/Resources.json and reference them via the type-safe Keys object (t(Keys.connectExplorer.errors.*)).
SQL, Tables, and Gremlin now sign data-plane requests client-side with the account key and skip the Portal Backend proxy (generatetoken/accessinputmetadata/authorizationtokens). Adds client-side host/account validation mirroring the backend ValidateHostAndAccount, plus a real CosmosClient connectivity probe that gates opening the Data Explorer. Mongo and Cassandra continue to use the encrypted-token proxy path.
* Add Cosmos DB Shell (NoSQL) support to Cloud Shell
Adds Cosmos DB (NoSQL) support to the Cloud Shell experience and wires up authentication for RBAC / local-auth-disabled accounts:
- Enable the Open Cosmos DB Shell button behind the enableCloudShell feature flag.
- Bootstrap .NET SDK 10 in Cloud Shell before installing the CosmosDBShell tool.
- Force gateway connection mode and add --verbose to surface connection errors.
- Select Entra ID vs account-key auth via isCloudShellEntraAuthEnabled (covers dataplane RBAC and disableLocalAuth accounts).
- Acquire a data-plane-scoped Entra token on demand when no cached aadToken exists, and omit --connect-tenant so a missing token falls through to DefaultAzureCredential (Cloud Shell az session) instead of interactive/device-code auth.
* Fix popup_window_error in CosmosDB Cloud Shell Entra auth
Acquiring an Entra token on demand via acquireMsalTokenForAccount triggered a browser loginPopup (even in silent mode when no MSAL account was cached), which fails with popup_window_error inside the hosted Cloud Shell context. getKey now returns the cached userContext.aadToken when present, or an empty string otherwise. With no token exported, the CosmosDBShell tool falls through to DefaultAzureCredential, which uses the Cloud Shell's signed-in az session.
* Force --connect-azure-cli whenever no credential env var is exported
In Azure Cloud Shell, DefaultAzureCredential tries ManagedIdentityCredential first, which cannot mint a token for the *.documents.azure.com audience (AudienceNotSupported). Force AzureCliCredential via --connect-azure-cli whenever no key/token env var is exported, covering both the Entra-no-token and key-auth-empty-key cases. Also auto-update the CosmosDBShell tool so cached installs pick up the new flag.
* Silently mint a Cosmos data-plane token for the Cloud Shell Entra path
A disableLocalAuth Cosmos account whose Data Explorer session is still in key mode has no cached userContext.aadToken, and the ephemeral Cloud Shell can obtain a Cosmos token from neither its managed identity (AudienceNotSupported for *.documents.azure.com) nor its az session (not logged in). Mint a Cosmos-scoped token in the browser and export it via COSMOSDB_SHELL_TOKEN. The acquisition is guarded on an existing cached MSAL account so it can never trigger an interactive popup, and any failure returns an empty string so the tool falls back to --connect-azure-cli.
* Only accept Y/N at the Cloud Shell consent prompt
askConfirmation now ignores any key that is not Y or N instead of treating every non-Y key as a decline, so an accidental keypress no longer aborts the Cloud Shell consent flow. Also add diagnostic warnings on the Cloud Shell token path so the browser console reveals whether the silent Cosmos token mint was skipped (no cached MSAL account) or returned empty.
* Use device-code auth when Cloud Shell has no token
* Pass the Data Explorer credential to the Cosmos DB shell instead of signing in interactively
Azure Cloud Shell cannot authenticate to Cosmos DB on its own: its managed identity
is rejected with AudienceNotSupported for the *.documents.azure.com audience, its az
session is not signed in, and neither the interactive browser nor the device-code flow
is usable from the embedded terminal.
Resolve the credential in Data Explorer and hand it to the shell out-of-band:
- getCosmosDBShellCredential() returns an Entra ID data-plane token (cached aadToken,
or one minted silently only when an MSAL account already exists so it can never
trigger a popup), falling back to the account master key unless local auth is
disabled. It reports which kind it resolved so the correct env var is exported.
- CosmosDBShellHandler exports COSMOSDB_SHELL_TOKEN or COSMOSDB_SHELL_ACCOUNT_KEY and
drops every credential flag, so the tool always lands on a terminal, non-interactive
step of its credential chain.
- When nothing can be resolved, print actionable guidance instead of launching the
tool with no credential.
* Fix TS7011 in ShellTypeFactory tests by typing the mocked getAllAccounts
The empty array literal in the getMsalInstance mock had no contextual type, so
tsc inferred an implicit any[] return under noImplicitAny. Route every mock
through a typed mockMsalAccounts helper.
* Reuse DE's cached credential for Cosmos DB Shell; add read-only key fallback
* Deliver Cosmos DB Shell key as a full connection string; harden key resolution
* Surface the specific reason a Cosmos DB Shell credential could not be resolved
* Deliver Cosmos DB Shell credential inline (export+connect on one line), mirroring Mongo handler
* Log which Cosmos DB Shell credential kind was resolved for debugging
* Increase ARM timeout for Cloud Shell provisioning calls to avoid spurious abort errors
* Gate Cosmos DB Shell button behind enableCosmosDBShell feature flag
* Fix TS2741: add missing enableCosmosDBShell to Features test fixture
* Update Az CLI to use new secrets.
* Add test step for Az login
* Remove test step. Fix up account names in test code.
* Fix the account prefix env. variable.
* Fix it in the CI config as well.
* Try to fix the CI config for some tests
* Clean up access tokens for NoSQL.
* Disable most tests while sorting out account setup. Add debug tracing.
* Comment out most tests.
* Set RG Name var in CI config.
* Fix up tenant id.
* Enable other API tests
* e-enable more tests.
* Re-enable remaining tests.
* Remove all of the test.skip() calls.
* Remove debug traces.
* Remove function to retrieve SQL RBAC token, this is handled by the CI config now.
* Fix rbac token detection for table and resource token tests.
* Minor cleanup and fixing the cleanup config.
* Preview site and storage changes. Cleanup script changes.
* Clean up before PR.
* Fix resource group name in test results email.
Express was bumped 4.21.2 -> 5.2.1, whose router uses path-to-regexp v8 which removed inline-regex route params. The route /pull/:pr(\d+) threw PathError at startup. Switch to /pull/:pr (handler already validates with /^\d+\$/ and returns 400).
Also update deploy runtime to NODE:22-lts and drop the stray 'node' and unused top-level 'path-to-regexp' dependencies.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 7793a516-0204-44e1-bed5-d8ad91b9400a
Removes the GitHub notebook-repo integration that only existed to pin/browse notebook repositories. Deletes src/GitHub/, the GitHub controls/panes, GitHubUtils, JunoUtils, and the connectToGitHub webpack entry. Decouples NotebookManager, useNotebook, the resource tree, and Explorer from GitHub wiring. Trims JunoClient's GitHub-only methods while keeping the Schema and gallery methods. Removes GitHub config fields from ConfigContext and strips the dead github:// branches from NotebookUtil.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Asier Isayas
asier-isayas
dependabot[bot]
Mike Krüger
vchske
jawelton74
sakshigupta12feb
Nishtha Ahuja