@microsoft/agents-hosting 1.6.0-beta.8.g226709c215 → 1.6.1

package/dist/src/auth/authConfiguration.js

@@ -3,18 +3,271 @@
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.envParserUtils = exports.loadPrevAuthConfigFromEnv = exports.loadAuthConfigFromEnv = void 0;
+exports.loadPrevAuthConfigFromEnv = exports.loadAuthConfigFromEnv = exports.resolveAuthority = exports.AuthType = void 0;
 exports.getAuthConfigWithDefaults = getAuthConfigWithDefaults;
-exports.resolveAuthority = resolveAuthority;
-exports.envParser = envParser;
 const agents_telemetry_1 = require("@microsoft/agents-telemetry");
-const object_path_1 = __importDefault(require("object-path"));
+const settings_1 = require("./settings");
+var settings_2 = require("./settings");
+Object.defineProperty(exports, "AuthType", { enumerable: true, get: function () { return settings_2.AuthType; } });
+Object.defineProperty(exports, "resolveAuthority", { enumerable: true, get: function () { return settings_2.resolveAuthority; } });
+const utils_1 = require("../utils");
 const logger = (0, agents_telemetry_1.debug)('agents:authConfiguration');
-const DEFAULT_CONNECTION = 'serviceConnection';
+/**
+ * Summarizes the authentication configuration for logging by redacting sensitive information and pruning undefined values. This is used to log the loaded authentication settings without exposing secrets or personally identifiable information.
+ * @remarks AuthConfiguration properties can change its shape, since this function is intended for logging, e.g. `scopes` will be a string instead of an array.
+ */
+function summarizeAuthConfiguration(authConfig) {
+    var _a, _b;
+    return [...(_b = (_a = authConfig.connections) === null || _a === void 0 ? void 0 : _a.entries()) !== null && _b !== void 0 ? _b : []].reduce((summary, [name, config]) => {
+        var _a, _b;
+        summary[name] = (0, utils_1.prune)({
+            clientId: (0, agents_telemetry_1.redactString)(config.clientId, true),
+            tenantId: (0, agents_telemetry_1.redactString)(config.tenantId, true),
+            clientSecret: (0, agents_telemetry_1.redactString)(config.clientSecret),
+            authorityEndpoint: config.authorityEndpoint ? (0, agents_telemetry_1.redactUrl)(config.authorityEndpoint) : undefined,
+            scopes: (config.scopes ? (0, agents_telemetry_1.redactScopes)(config.scopes) : undefined),
+            issuers: (_a = config.issuers) === null || _a === void 0 ? void 0 : _a.map(agents_telemetry_1.redactUrl).filter(e => e !== undefined),
+            federatedClientId: (0, agents_telemetry_1.redactString)(config.federatedClientId, true),
+            certPemFile: (0, agents_telemetry_1.redactString)(config.certPemFile),
+            certKeyFile: (0, agents_telemetry_1.redactString)(config.certKeyFile),
+            WIDAssertionFile: (0, agents_telemetry_1.redactString)(config.WIDAssertionFile),
+            federatedTokenFile: config.federatedTokenFile ? (0, agents_telemetry_1.redactString)(config.federatedTokenFile) : undefined,
+            authType: (_b = config.authType) !== null && _b !== void 0 ? _b : undefined,
+            idpmResource: config.idpmResource ? (0, agents_telemetry_1.redactUrl)(config.idpmResource) : undefined,
+            connectionName: config.connectionName,
+            altBlueprintConnectionName: config.altBlueprintConnectionName,
+            azureRegion: config.azureRegion,
+            sendX5C: config.sendX5C,
+            // Don't log the following properties
+            authority: undefined, // Deprecated, same as authorityEndpoint, avoid logging duplicate info
+            FICClientId: undefined, // Deprecated, same as federatedClientId, avoid logging duplicate info
+            scope: undefined, // Deprecated, same as scopes, avoid logging duplicate info
+            connections: undefined, // Avoid logging nested connections
+            connectionsMap: undefined, // Avoid logging nested connections map
+        });
+        return summary;
+    }, {});
+}
+/**
+ * Latest authentication configuration loaded from environment variables, with support for hot-reloading in test mode.
+ * Environment variables for connections should be in the format Connections__<id>__Settings__<property>, e.g. Connections__MyConnection__Settings__ClientId, Connections__MyConnection__Settings__TenantId, etc.
+ * Environment variables for connections map should be in the format ConnectionsMap__<index>__<property>, e.g. ConnectionsMap__0__ServiceUrl, ConnectionsMap__0__Connection, etc.
+ */
+const connectionsEnv = {
+    connections: new Map(),
+    parser: (0, settings_1.envParser)({
+        authType: settings_1.envParserUtils.bypass,
+        tenantId: settings_1.envParserUtils.bypass,
+        clientId: settings_1.envParserUtils.bypass,
+        clientSecret: settings_1.envParserUtils.bypass,
+        certPemFile: settings_1.envParserUtils.bypass,
+        certKeyFile: settings_1.envParserUtils.bypass,
+        connectionName: settings_1.envParserUtils.bypass,
+        federatedClientId: settings_1.envParserUtils.bypass,
+        FICClientId(value) {
+            logger.warn('Connections__<id>__Settings__FICClientId is deprecated, please use Connections__<id>__Settings__FederatedClientId instead.');
+            return { key: 'federatedClientId', value }; // redirect
+        },
+        authorityEndpoint: settings_1.envParserUtils.bypass,
+        authority(value) {
+            logger.warn('Connections__<id>__Settings__Authority is deprecated, please use Connections__<id>__Settings__AuthorityEndpoint instead.');
+            return { key: 'authorityEndpoint', value }; // redirect
+        },
+        scopes(value) {
+            return this.issuers(value); // scopes can be comma or space separated list, same as issuers.
+        },
+        scope(value) {
+            var _a;
+            logger.warn('Connections__<id>__Settings__Scope is deprecated, please use Connections__<id>__Settings__Scopes instead.');
+            return { key: 'scopes', value: (_a = this.scopes(value)) === null || _a === void 0 ? void 0 : _a.value }; // redirect with single scope
+        },
+        altBlueprintConnectionName: settings_1.envParserUtils.bypass,
+        WIDAssertionFile: settings_1.envParserUtils.bypass,
+        federatedTokenFile: settings_1.envParserUtils.bypass,
+        idpmResource: settings_1.envParserUtils.bypass,
+        azureRegion: settings_1.envParserUtils.bypass,
+        sendX5C: (value) => ({ value: value === 'true' }),
+        issuers(value) {
+            if (value.includes(',')) {
+                return { value: value.split(',').map(s => s.trim()).filter(Boolean) };
+            }
+            return { value: value.split(/\s+/).filter(Boolean) };
+        },
+    }),
+    default(connections, connectionsMap) {
+        var _a;
+        const conn = connections !== null && connections !== void 0 ? connections : this.connections;
+        const map = connectionsMap !== null && connectionsMap !== void 0 ? connectionsMap : connectionsMapEnv.connectionsMap;
+        const name = (_a = map === null || map === void 0 ? void 0 : map.find((item) => item.serviceUrl === '*')) === null || _a === void 0 ? void 0 : _a.connection;
+        if (!name) {
+            throw new Error('No default connection found in environment connections.');
+        }
+        const connection = conn === null || conn === void 0 ? void 0 : conn.get(name !== null && name !== void 0 ? name : '');
+        if (!connection) {
+            throw new Error(`Connection "${name}" not found in environment connections.`);
+        }
+        return (0, settings_1.applyDefaultSettings)({ ...connection, connections: conn, connectionsMap: map });
+    },
+    process(key, value) {
+        var _a;
+        const format = 'Connections__<id>__Settings__<property>';
+        const parts = key.split('__');
+        const [connections, id, settings, prop] = parts;
+        if (`${connections}/${settings}`.toUpperCase() !== 'CONNECTIONS/SETTINGS') {
+            return false;
+        }
+        if (parts.length !== 4) {
+            logger.warn(`Invalid connection environment variable: ${key}. Expected format: ${format}.`);
+            return false;
+        }
+        if (!(id === null || id === void 0 ? void 0 : id.trim())) {
+            logger.warn(`Invalid connection <id> in environment variable: ${key}. Expected format: ${format}.`);
+            return false;
+        }
+        if (!(prop === null || prop === void 0 ? void 0 : prop.trim())) {
+            logger.warn(`Invalid connection <property> in environment variable: ${key}. Expected format: ${format}.`);
+            return false;
+        }
+        const result = this.parser.parse(prop, value);
+        if (!result.key) {
+            return false;
+        }
+        const config = (_a = this.connections.get(id)) !== null && _a !== void 0 ? _a : {};
+        config[result.key] = result.value;
+        this.connections.set(id, config);
+        return true;
+    },
+};
+const connectionsMapEnv = {
+    connectionsMap: [],
+    parser: (0, settings_1.envParser)({
+        serviceUrl: settings_1.envParserUtils.bypass,
+        connection: settings_1.envParserUtils.bypass,
+        audience: settings_1.envParserUtils.bypass,
+    }),
+    process(key, value) {
+        var _a;
+        const format = 'ConnectionsMap__<index>__<property>';
+        const parts = key.split('__');
+        const [connectionsMap, index, prop] = parts;
+        if (connectionsMap.toUpperCase() !== 'CONNECTIONSMAP') {
+            return false;
+        }
+        if (parts.length !== 3) {
+            logger.warn(`Invalid connection map environment variable: ${key}. Expected format: ${format}.`);
+            return false;
+        }
+        const indexNumber = parseInt(index, 10);
+        if (!(index === null || index === void 0 ? void 0 : index.trim()) || isNaN(indexNumber) || indexNumber < 0) {
+            logger.warn(`Invalid connection map <index> in environment variable: ${key}. Expected format: ${format}, where <index> is a number.`);
+            return false;
+        }
+        if (!(prop === null || prop === void 0 ? void 0 : prop.trim())) {
+            logger.warn(`Invalid connection map <property> in environment variable: ${key}. Expected format: ${format}.`);
+            return false;
+        }
+        const result = this.parser.parse(prop, value);
+        if (!result.key) {
+            return false;
+        }
+        const mapItem = (_a = this.connectionsMap[indexNumber]) !== null && _a !== void 0 ? _a : { ...settings_1.DEFAULT_CONNECTION_MAP };
+        mapItem[result.key] = result.value;
+        this.connectionsMap[indexNumber] = mapItem;
+        return true;
+    },
+};
+/**
+ * Legacy BotFramework style-like authentication configuration loaded from environment variables, with support for hot-reloading in test mode.
+ * Environment variables should be named MicrosoftAppTenantId, MicrosoftAppId, MicrosoftAppPassword, etc.
+ */
+const legacyBotFrameworkEnv = {
+    parser: (0, settings_1.envParser)({
+        MicrosoftAppTenantId: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'tenantId'),
+        MicrosoftAppId: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'clientId'),
+        MicrosoftAppPassword: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'clientSecret'),
+        certPemFile: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'certPemFile'),
+        certKeyFile: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'certKeyFile'),
+        connectionName: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'connectionName'),
+        MicrosoftAppClientId: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'federatedClientId'),
+        authorityEndpoint: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'authorityEndpoint'),
+        scope: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'scopes'),
+        altBlueprintConnectionName: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'altBlueprintConnectionName'),
+        WIDAssertionFile: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'WIDAssertionFile'),
+        azureRegion: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'azureRegion'),
+        sendX5C: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'sendX5C'),
+        authType: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'authType'),
+        federatedTokenFile: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'federatedTokenFile'),
+        idpmResource: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'idpmResource'),
+    }),
+    process(env) {
+        return legacyPrefixEnv.process.call(this, env);
+    },
+};
+/**
+ * Legacy prefix-based authentication configuration loaded from environment variables, with support for hot-reloading in test mode.
+ * Environment variables should be prefixed with the connection name, e.g. <CONNECTION_NAME>_ClientId, <CONNECTION_NAME>_TenantId, etc.
+ */
+const legacyPrefixEnv = {
+    parser: (0, settings_1.envParser)({
+        tenantId: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'tenantId'),
+        clientId: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'clientId'),
+        clientSecret: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'clientSecret'),
+        certPemFile: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'certPemFile'),
+        certKeyFile: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'certKeyFile'),
+        connectionName: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'connectionName'),
+        FICClientId: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'federatedClientId'),
+        authorityEndpoint: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'authorityEndpoint'),
+        scope: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'scopes'),
+        altBlueprintConnectionName: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'altBlueprintConnectionName'),
+        WIDAssertionFile: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'WIDAssertionFile'),
+        azureRegion: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'azureRegion'),
+        sendX5C: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'sendX5C'),
+        authType: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'authType'),
+        federatedTokenFile: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'federatedTokenFile'),
+        idpmResource: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'idpmResource'),
+    }),
+    process(env, prefix) {
+        const settings = {};
+        for (const key of this.parser.keys) {
+            const k = prefix ? `${prefix}_${key}` : key;
+            const envValue = env[k.toUpperCase()];
+            if (!envValue) {
+                continue;
+            }
+            const result = this.parser.parse(key, envValue.value);
+            if (result.key) {
+                settings[result.key] = result.value;
+            }
+        }
+        return settings;
+    },
+};
+const loadEnv = () => {
+    connectionsEnv.connections = new Map();
+    connectionsMapEnv.connectionsMap = [];
+    const env = (0, settings_1.loadEnvSettings)((key, value) => {
+        // Process the first parser that matches the environment variable key and value,
+        // otherwise it continues to the next parser.
+        return connectionsEnv.process(key, value) ||
+            connectionsMapEnv.process(key, value);
+    });
+    if (connectionsEnv.connections.size === 0) {
+        logger.warn('No connections found in configuration.');
+    }
+    if (connectionsMapEnv.connectionsMap.length === 0 && connectionsEnv.connections.size > 0) {
+        logger.warn('No connections map found in configuration, assuming default connection map with serviceUrl "*" for the first connection.');
+        const [key] = connectionsEnv.connections.keys();
+        connectionsMapEnv.connectionsMap.push({ ...settings_1.DEFAULT_CONNECTION_MAP, connection: key });
+    }
+    return {
+        env,
+        legacyBotFrameworkSettings: legacyBotFrameworkEnv.process(env),
+        legacyPrefixSettings: legacyPrefixEnv.process(env)
+    };
+};
+// Initial load of environment variables
+let globalEnv = loadEnv();
 /**
  * Loads the authentication configuration from environment variables.
  *
@@ -42,44 +295,23 @@ const DEFAULT_CONNECTION = 'serviceConnection';
  *
  */
 const loadAuthConfigFromEnv = (cnxName) => {
-    var _a, _b, _c;
-    const envConnections = loadConnectionsMapFromEnv();
-    let authConfig;
-    if (envConnections.connectionsMap.length === 0) {
-        // No connections provided, we need to populate the connections map with the old config settings
-        authConfig = buildLegacyAuthConfig(cnxName);
-        envConnections.connections.set(DEFAULT_CONNECTION, authConfig);
-        envConnections.connectionsMap.push({
-            serviceUrl: '*',
-            connection: DEFAULT_CONNECTION,
-        });
+    var _a;
+    if (process.env.TEST_MODE === 'true') {
+        globalEnv = loadEnv();
     }
-    else {
-        // There are connections provided, use the default or specified connection
-        if (cnxName) {
-            const entry = envConnections.connections.get(cnxName);
-            if (entry) {
-                authConfig = entry;
-            }
-            else {
-                throw new Error(`Connection "${cnxName}" not found in environment.`);
-            }
-        }
-        else {
-            const defaultItem = envConnections.connectionsMap.find((item) => item.serviceUrl === '*');
-            const defaultConn = defaultItem ? envConnections.connections.get(defaultItem.connection) : undefined;
-            if (!defaultConn) {
-                throw new Error('No default connection found in environment connections.');
-            }
-            authConfig = defaultConn;
-        }
-        (_a = authConfig.authority) !== null && _a !== void 0 ? _a : (authConfig.authority = 'https://login.microsoftonline.com');
-        (_b = authConfig.issuers) !== null && _b !== void 0 ? _b : (authConfig.issuers = getDefaultIssuers((_c = authConfig.tenantId) !== null && _c !== void 0 ? _c : '', authConfig.authority));
+    if (connectionsEnv.connections.size > 0) {
+        return (cnxName === null || cnxName === void 0 ? void 0 : cnxName.trim()) ? connectionsEnv.default(undefined, [{ ...settings_1.DEFAULT_CONNECTION_MAP, connection: cnxName }]) : connectionsEnv.default();
     }
-    return {
-        ...authConfig,
-        ...envConnections,
-    };
+    // No connections provided, we need to populate the connections map with the old config settings
+    const result = (0, settings_1.applyDefaultSettings)((cnxName === null || cnxName === void 0 ? void 0 : cnxName.trim()) ? legacyPrefixEnv.process(globalEnv.env, cnxName) : globalEnv.legacyPrefixSettings);
+    if (cnxName && !result.clientId) {
+        throw new Error(`ClientId not found for connection: ${cnxName}`);
+    }
+    logger.info('Auth settings loaded from environment', {
+        connections: summarizeAuthConfiguration(result),
+        connectionsMap: (_a = result.connectionsMap) === null || _a === void 0 ? void 0 : _a.map(e => ({ ...e, serviceUrl: e.serviceUrl !== '*' ? (0, agents_telemetry_1.redactUrl)(e.serviceUrl) : e.serviceUrl })),
+    });
+    return result;
 };
 exports.loadAuthConfigFromEnv = loadAuthConfigFromEnv;
 /**
@@ -97,96 +329,21 @@ exports.loadAuthConfigFromEnv = loadAuthConfigFromEnv;
  *
  */
 const loadPrevAuthConfigFromEnv = () => {
-    var _a, _b, _c, _d, _e;
-    const envConnections = loadConnectionsMapFromEnv();
-    let authConfig = {};
-    if (envConnections.connectionsMap.length === 0) {
-        // No connections provided, we need to populate the connection map with the old config settings
-        if (process.env.MicrosoftAppId === undefined && process.env.NODE_ENV === 'production') {
-            throw new Error('ClientId required in production');
-        }
-        const authority = (_a = process.env.authorityEndpoint) !== null && _a !== void 0 ? _a : 'https://login.microsoftonline.com';
-        authConfig = {
-            tenantId: process.env.MicrosoftAppTenantId,
-            clientId: process.env.MicrosoftAppId,
-            clientSecret: process.env.MicrosoftAppPassword,
-            certPemFile: process.env.certPemFile,
-            certKeyFile: process.env.certKeyFile,
-            sendX5C: process.env.sendX5C === 'true',
-            connectionName: process.env.connectionName,
-            FICClientId: process.env.MicrosoftAppClientId,
-            authority,
-            scope: process.env.scope,
-            issuers: getDefaultIssuers((_b = process.env.MicrosoftAppTenantId) !== null && _b !== void 0 ? _b : '', authority),
-            altBlueprintConnectionName: process.env.altBlueprintConnectionName,
-            WIDAssertionFile: process.env.WIDAssertionFile,
-            azureRegion: process.env.azureRegion,
-        };
-        envConnections.connections.set(DEFAULT_CONNECTION, authConfig);
-        envConnections.connectionsMap.push({
-            serviceUrl: '*',
-            connection: DEFAULT_CONNECTION,
-        });
+    if (process.env.TEST_MODE === 'true') {
+        globalEnv = loadEnv();
+    }
+    let result;
+    if (connectionsEnv.connections.size > 0) {
+        result = connectionsEnv.default();
     }
     else {
-        // There are connections provided, use the default one.
-        const defaultItem = envConnections.connectionsMap.find((item) => item.serviceUrl === '*');
-        const defaultConn = defaultItem ? envConnections.connections.get(defaultItem.connection) : undefined;
-        if (!defaultConn) {
-            throw new Error('No default connection found in environment connections.');
-        }
-        authConfig = defaultConn;
+        // No connections provided, we need to populate the connection map with the old config settings
+        result = (0, settings_1.applyDefaultSettings)(globalEnv.legacyBotFrameworkSettings);
     }
-    (_c = authConfig.authority) !== null && _c !== void 0 ? _c : (authConfig.authority = 'https://login.microsoftonline.com');
-    (_d = authConfig.issuers) !== null && _d !== void 0 ? _d : (authConfig.issuers = getDefaultIssuers((_e = authConfig.tenantId) !== null && _e !== void 0 ? _e : '', authConfig.authority));
-    return { ...authConfig, ...envConnections };
+    logger.info('Legacy auth settings loaded from environment', summarizeAuthConfiguration(result), result.connectionsMap);
+    return result;
 };
 exports.loadPrevAuthConfigFromEnv = loadPrevAuthConfigFromEnv;
-function loadConnectionsMapFromEnv() {
-    const envVars = process.env;
-    const connectionsObj = {};
-    const connectionsMap = [];
-    const CONNECTIONS_PREFIX = 'connections__';
-    const CONNECTIONS_MAP_PREFIX = 'connectionsMap__';
-    for (const [key, rawValue] of Object.entries(envVars)) {
-        if (key.startsWith(CONNECTIONS_PREFIX)) {
-            // Convert to dot notation
-            let path = key.substring(CONNECTIONS_PREFIX.length).replace(/__/g, '.');
-            // Remove ".settings." from the path
-            path = path.replace('.settings.', '.');
-            // Convert "true"/"false" strings into boolean values
-            const value = rawValue === 'true' ? true : rawValue === 'false' ? false : rawValue;
-            object_path_1.default.set(connectionsObj, path, value);
-        }
-        else if (key.startsWith(CONNECTIONS_MAP_PREFIX)) {
-            const path = key.substring(CONNECTIONS_MAP_PREFIX.length).replace(/__/g, '.');
-            object_path_1.default.set(connectionsMap, path, rawValue);
-        }
-    }
-    // Convert connectionsObj to Map<string, AuthConfiguration>
-    const connections = new Map(Object.entries(connectionsObj));
-    if (connections.size === 0) {
-        logger.warn('No connections found in configuration.');
-    }
-    if (connectionsMap.length === 0) {
-        logger.warn('No connections map found in configuration.');
-        if (connections.size > 0) {
-            const firstEntry = connections.entries().next().value;
-            if (firstEntry) {
-                const [firstKey] = firstEntry;
-                // Provide a default connection map if none is specified
-                connectionsMap.push({
-                    serviceUrl: '*',
-                    connection: firstKey,
-                });
-            }
-        }
-    }
-    return {
-        connections,
-        connectionsMap,
-    };
-}
 /**
  * Loads the authentication configuration from the provided config or from the environment variables
  * providing default values for authority and issuers.
@@ -212,137 +369,24 @@ function loadConnectionsMapFromEnv() {
  *
  */
 function getAuthConfigWithDefaults(config) {
-    var _a, _b, _c, _d;
-    if (!config)
-        return (0, exports.loadAuthConfigFromEnv)();
-    const providedConnections = config.connections && config.connectionsMap
-        ? { connections: config.connections, connectionsMap: config.connectionsMap }
-        : undefined;
-    const connections = providedConnections !== null && providedConnections !== void 0 ? providedConnections : loadConnectionsMapFromEnv();
-    let mergedConfig;
-    if (connections && ((_a = connections.connectionsMap) === null || _a === void 0 ? void 0 : _a.length) === 0) {
-        // No connections provided, we need to populate the connections map with the old config settings
-        mergedConfig = buildLegacyAuthConfig(undefined, config);
-        (_b = connections.connections) === null || _b === void 0 ? void 0 : _b.set(DEFAULT_CONNECTION, mergedConfig);
-        connections.connectionsMap.push({ serviceUrl: '*', connection: DEFAULT_CONNECTION });
+    var _a;
+    if (process.env.TEST_MODE === 'true') {
+        globalEnv = loadEnv();
+    }
+    let result;
+    if (!config) {
+        result = (0, exports.loadAuthConfigFromEnv)();
     }
     else {
-        // There are connections provided, use the default connection
-        const defaultItem = (_c = connections.connectionsMap) === null || _c === void 0 ? void 0 : _c.find((item) => item.serviceUrl === '*');
-        const defaultConn = defaultItem ? (_d = connections.connections) === null || _d === void 0 ? void 0 : _d.get(defaultItem.connection) : undefined;
-        if (!defaultConn) {
-            throw new Error('No default connection found in environment connections.');
+        const { connections, connectionsMap } = ((_a = config.connections) === null || _a === void 0 ? void 0 : _a.size) ? config : { connections: connectionsEnv.connections, connectionsMap: connectionsMapEnv.connectionsMap };
+        if (connections === null || connections === void 0 ? void 0 : connections.size) {
+            result = { ...globalEnv.legacyPrefixSettings, ...connectionsEnv.default(connections, connectionsMap) };
         }
-        mergedConfig = buildLegacyAuthConfig(undefined, defaultConn);
-    }
-    return {
-        ...mergedConfig,
-        ...connections,
-    };
-}
-function buildLegacyAuthConfig(envPrefix = '', customConfig) {
-    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q;
-    const prefix = envPrefix ? `${envPrefix}_` : '';
-    const authority = (_b = (_a = customConfig === null || customConfig === void 0 ? void 0 : customConfig.authority) !== null && _a !== void 0 ? _a : process.env[`${prefix}authorityEndpoint`]) !== null && _b !== void 0 ? _b : 'https://login.microsoftonline.com';
-    const clientId = (_c = customConfig === null || customConfig === void 0 ? void 0 : customConfig.clientId) !== null && _c !== void 0 ? _c : process.env[`${prefix}clientId`];
-    if (!clientId && !envPrefix && process.env.NODE_ENV === 'production') {
-        throw new Error('ClientId required in production');
-    }
-    if (!clientId && envPrefix) {
-        throw new Error(`ClientId not found for connection: ${envPrefix}`);
-    }
-    const tenantId = (_d = customConfig === null || customConfig === void 0 ? void 0 : customConfig.tenantId) !== null && _d !== void 0 ? _d : process.env[`${prefix}tenantId`];
-    return {
-        tenantId,
-        clientId: clientId,
-        clientSecret: (_e = customConfig === null || customConfig === void 0 ? void 0 : customConfig.clientSecret) !== null && _e !== void 0 ? _e : process.env[`${prefix}clientSecret`],
-        certPemFile: (_f = customConfig === null || customConfig === void 0 ? void 0 : customConfig.certPemFile) !== null && _f !== void 0 ? _f : process.env[`${prefix}certPemFile`],
-        certKeyFile: (_g = customConfig === null || customConfig === void 0 ? void 0 : customConfig.certKeyFile) !== null && _g !== void 0 ? _g : process.env[`${prefix}certKeyFile`],
-        sendX5C: (_h = customConfig === null || customConfig === void 0 ? void 0 : customConfig.sendX5C) !== null && _h !== void 0 ? _h : (process.env[`${prefix}sendX5C`] === 'true'),
-        connectionName: (_j = customConfig === null || customConfig === void 0 ? void 0 : customConfig.connectionName) !== null && _j !== void 0 ? _j : process.env[`${prefix}connectionName`],
-        FICClientId: (_k = customConfig === null || customConfig === void 0 ? void 0 : customConfig.FICClientId) !== null && _k !== void 0 ? _k : process.env[`${prefix}FICClientId`],
-        authority,
-        scope: (_l = customConfig === null || customConfig === void 0 ? void 0 : customConfig.scope) !== null && _l !== void 0 ? _l : process.env[`${prefix}scope`],
-        issuers: (_m = customConfig === null || customConfig === void 0 ? void 0 : customConfig.issuers) !== null && _m !== void 0 ? _m : getDefaultIssuers(tenantId, authority),
-        altBlueprintConnectionName: (_o = customConfig === null || customConfig === void 0 ? void 0 : customConfig.altBlueprintConnectionName) !== null && _o !== void 0 ? _o : process.env[`${prefix}altBlueprintConnectionName`],
-        WIDAssertionFile: (_p = customConfig === null || customConfig === void 0 ? void 0 : customConfig.WIDAssertionFile) !== null && _p !== void 0 ? _p : process.env[`${prefix}WIDAssertionFile`],
-        azureRegion: (_q = customConfig === null || customConfig === void 0 ? void 0 : customConfig.azureRegion) !== null && _q !== void 0 ? _q : process.env[`${prefix}azureRegion`]
-    };
-}
-/**
- * Resolves the full authority URL including the tenant ID.
- * Supports both patterns:
- *   - Tenant embedded in authority: https://login.microsoftonline.com/my-tenant
- *   - Authority + separate tenantId: https://login.microsoftonline.com + tenantId
- * Also handles trailing slashes on authority.
- */
-function resolveAuthority(authority, tenantId) {
-    const base = (authority !== null && authority !== void 0 ? authority : 'https://login.microsoftonline.com').replace(/\/+$/, '');
-    const url = new URL(base);
-    const hasPathSegment = url.pathname !== '/';
-    if (hasPathSegment) {
-        return base;
-    }
-    return `${base}/${tenantId !== null && tenantId !== void 0 ? tenantId : 'botframework.com'}`;
-}
-function getDefaultIssuers(tenantId, authority) {
-    // Convert empty string to undefined so resolveAuthority applies its 'botframework.com' default
-    const t = tenantId || undefined;
-    if (!t) {
-        logger.warn('tenantId is not configured, defaulting to botframework.com');
-    }
-    return [
-        'https://api.botframework.com',
-        `${resolveAuthority('https://sts.windows.net', t)}/`,
-        `${resolveAuthority(authority, t)}/v2.0`
-    ];
-}
-/**
- * Creates an environment variable parser that maps the variable keys to parsing functions.
- * @param settings An object where each key is an environment variable name and the value is a function
- * that takes the variable value as input and returns an object with optional `key` and `value` properties.
- * @remarks
- * The `key` property in the returned object can be used to rename the environment variable key,
- * while the `value` property contains the parsed value.
- * @returns An object with a `parse` method that takes an environment variable key and value,
- * and returns the parsed result.
- */
-function envParser(settings) {
-    const keys = Object.keys(settings);
-    return {
-        /**
-         * Parses the given environment variable key and value using the provided settings.
-         * @param key The environment variable key.
-         * @param value The environment variable value.
-         * @returns The parsed result with optional renamed key and parsed value.
-         */
-        parse(key, value) {
-            var _a;
-            const match = keys.find(k => k.toUpperCase() === key.toUpperCase());
-            if (!match) {
-                return {};
-            }
-            const result = settings[match](value);
-            return { key: (_a = result === null || result === void 0 ? void 0 : result.key) !== null && _a !== void 0 ? _a : match, value: result === null || result === void 0 ? void 0 : result.value };
+        else {
+            result = (0, settings_1.applyDefaultSettings)({ ...globalEnv.legacyPrefixSettings, ...config });
         }
-    };
+    }
+    logger.info('Auth settings loaded from runtime configuration', summarizeAuthConfiguration(result), result.connectionsMap);
+    return result;
 }
-/**
- * Utility functions for environment variable parsers.
- */
-exports.envParserUtils = {
-    /**
-     * Bypass parser that returns the value as is.
-     * @param value The environment variable value.
-     * @returns An object with the original value.
-     */
-    bypass: (value) => ({ value }),
-    /**
-     * Redirects the parsing to another parser for a specific key.
-     * @param parser The target parser to redirect to.
-     * @param key The key to use in the target parser.
-     * @returns A function that takes the environment variable value and returns the parsed result from the target parser.
-     */
-    redirect: (parser, key) => (value) => parser.parse(key, value)
-};
 //# sourceMappingURL=authConfiguration.js.map