@microsoft/agents-hosting 1.6.0-beta.9.gce9d8facd2 → 1.6.1

package/src/auth/authConfiguration.ts

@@ -3,102 +3,291 @@
  * Licensed under the MIT License.
  */
 
-import { debug } from '@microsoft/agents-telemetry'
-import { ConnectionMapItem } from './msalConnectionManager'
-import objectPath from 'object-path'
+import type { ConnectionMapItem } from './msalConnectionManager'
+import { debug, redactString, redactScopes, redactUrl } from '@microsoft/agents-telemetry'
+import { loadEnvSettings, AuthConfiguration, envParser, envParserUtils, LoadEnv, applyDefaultSettings, DEFAULT_CONNECTION_MAP, ConnectionKeys, ConnectionMapKeys } from './settings'
+
+export { type AuthConfiguration, AuthType, resolveAuthority } from './settings'
+import { prune } from '../utils'
 
 const logger = debug('agents:authConfiguration')
-const DEFAULT_CONNECTION = 'serviceConnection'
+
+type NonOptional<T> = { [K in keyof Required<T>]: T[K] }
 
 /**
- * Represents the authentication configuration.
+ * Summarizes the authentication configuration for logging by redacting sensitive information and pruning undefined values. This is used to log the loaded authentication settings without exposing secrets or personally identifiable information.
+ * @remarks AuthConfiguration properties can change its shape, since this function is intended for logging, e.g. `scopes` will be a string instead of an array.
  */
-export interface AuthConfiguration {
-  /**
-   * The tenant ID for the authentication configuration.
-   */
-  tenantId?: string
-
-  /**
-   * The client ID for the authentication configuration. Required in production.
-   */
-  clientId?: string
-
-  /**
-   * The client secret for the authentication configuration.
-   */
-  clientSecret?: string
-
-  /**
-   * The path to the certificate PEM file.
-   */
-  certPemFile?: string
-
-  /**
-   * The path to the certificate key file.
-   */
-  certKeyFile?: string
-
-  /**
-   * Indicates whether to send the X5C param or not (for SNI authentication).
-   */
-  sendX5C?: boolean
-
-  /**
-   * A list of valid issuers for the authentication configuration.
-   */
-  issuers?: string[]
-
-  /**
-   * The connection name for the authentication configuration.
-   */
-  connectionName?: string
-
-  /**
-   * The FIC (First-Party Integration Channel) client ID.
-   */
-  FICClientId?: string,
-
-  /**
-   * Entra Authentication Endpoint to use.
-   *
-   * @remarks
-   * If not populated the Entra Public Cloud endpoint is assumed.
-   * This example of Public Cloud Endpoint is https://login.microsoftonline.com
-   * see also https://learn.microsoft.com/entra/identity-platform/authentication-national-cloud
-   */
-  authority?: string
-
-  scope?: string
-
-  /**
-   * A map of connection names to their respective authentication configurations.
-   */
-  connections?: Map<string, AuthConfiguration>
-
-  /**
-   * A list of connection map items to map service URLs to connection names.
-   */
-  connectionsMap?: ConnectionMapItem[],
-
-  /**
-   * An optional alternative blueprint Connection name used when constructing a connector client.
-   */
-  altBlueprintConnectionName?: string
-
-  /**
-   * The path to K8s provided token.
-   */
-  WIDAssertionFile?: string
-
-  /**
-   * The Azure region for ESTS-R regional token acquisition (e.g. 'westus', 'eastus').
-   * When set, MSAL routes token requests to the specified regional endpoint.
-   * See https://learn.microsoft.com/en-us/entra/msal/javascript/node/regional-authorities for details.
-   */
-  azureRegion?: string
+function summarizeAuthConfiguration (authConfig: AuthConfiguration) {
+  return [...authConfig.connections?.entries() ?? []].reduce((summary, [name, config]) => {
+    summary[name] = prune({
+      clientId: redactString(config.clientId, true),
+      tenantId: redactString(config.tenantId, true),
+      clientSecret: redactString(config.clientSecret),
+      authorityEndpoint: config.authorityEndpoint ? redactUrl(config.authorityEndpoint) : undefined,
+      scopes: (config.scopes ? redactScopes(config.scopes) : undefined) as any,
+      issuers: config.issuers?.map(redactUrl).filter(e => e !== undefined),
+      federatedClientId: redactString(config.federatedClientId, true),
+      certPemFile: redactString(config.certPemFile),
+      certKeyFile: redactString(config.certKeyFile),
+      WIDAssertionFile: redactString(config.WIDAssertionFile),
+      federatedTokenFile: config.federatedTokenFile ? redactString(config.federatedTokenFile) : undefined,
+      authType: config.authType ?? undefined,
+      idpmResource: config.idpmResource ? redactUrl(config.idpmResource) : undefined,
+      connectionName: config.connectionName,
+      altBlueprintConnectionName: config.altBlueprintConnectionName,
+      azureRegion: config.azureRegion,
+      sendX5C: config.sendX5C,
+      // Don't log the following properties
+      authority: undefined, // Deprecated, same as authorityEndpoint, avoid logging duplicate info
+      FICClientId: undefined, // Deprecated, same as federatedClientId, avoid logging duplicate info
+      scope: undefined, // Deprecated, same as scopes, avoid logging duplicate info
+      connections: undefined, // Avoid logging nested connections
+      connectionsMap: undefined, // Avoid logging nested connections map
+    } satisfies NonOptional<AuthConfiguration>)
+    return summary
+  }, {} as Record<string, AuthConfiguration>)
 }
 
+/**
+ * Latest authentication configuration loaded from environment variables, with support for hot-reloading in test mode.
+ * Environment variables for connections should be in the format Connections__<id>__Settings__<property>, e.g. Connections__MyConnection__Settings__ClientId, Connections__MyConnection__Settings__TenantId, etc.
+ * Environment variables for connections map should be in the format ConnectionsMap__<index>__<property>, e.g. ConnectionsMap__0__ServiceUrl, ConnectionsMap__0__Connection, etc.
+ */
+const connectionsEnv = {
+  connections: new Map<string, AuthConfiguration>(),
+  parser: envParser<ConnectionKeys>({
+    authType: envParserUtils.bypass,
+    tenantId: envParserUtils.bypass,
+    clientId: envParserUtils.bypass,
+    clientSecret: envParserUtils.bypass,
+    certPemFile: envParserUtils.bypass,
+    certKeyFile: envParserUtils.bypass,
+    connectionName: envParserUtils.bypass,
+    federatedClientId: envParserUtils.bypass,
+    FICClientId (value) {
+      logger.warn('Connections__<id>__Settings__FICClientId is deprecated, please use Connections__<id>__Settings__FederatedClientId instead.')
+      return { key: 'federatedClientId', value } // redirect
+    },
+    authorityEndpoint: envParserUtils.bypass,
+    authority (value) {
+      logger.warn('Connections__<id>__Settings__Authority is deprecated, please use Connections__<id>__Settings__AuthorityEndpoint instead.')
+      return { key: 'authorityEndpoint', value }  // redirect
+    },
+    scopes (value) {
+      return this.issuers(value) // scopes can be comma or space separated list, same as issuers.
+    },
+    scope (value) {
+      logger.warn('Connections__<id>__Settings__Scope is deprecated, please use Connections__<id>__Settings__Scopes instead.')
+      return { key: 'scopes', value: this.scopes(value)?.value } // redirect with single scope
+    },
+    altBlueprintConnectionName: envParserUtils.bypass,
+    WIDAssertionFile: envParserUtils.bypass,
+    federatedTokenFile: envParserUtils.bypass,
+    idpmResource: envParserUtils.bypass,
+    azureRegion: envParserUtils.bypass,
+    sendX5C: (value) => ({ value: value === 'true' }),
+    issuers (value) {
+      if (value.includes(',')) {
+        return { value: value.split(',').map(s => s.trim()).filter(Boolean) }
+      }
+      return { value: value.split(/\s+/).filter(Boolean) }
+    },
+  }),
+  default (connections?: AuthConfiguration['connections'], connectionsMap?: AuthConfiguration['connectionsMap']) {
+    const conn = connections ?? this.connections
+    const map = connectionsMap ?? connectionsMapEnv.connectionsMap
+    const name = map?.find((item) => item.serviceUrl === '*')?.connection
+    if (!name) {
+      throw new Error('No default connection found in environment connections.')
+    }
+
+    const connection = conn?.get(name ?? '')
+    if (!connection) {
+      throw new Error(`Connection "${name}" not found in environment connections.`)
+    }
+
+    return applyDefaultSettings({ ...connection, connections: conn, connectionsMap: map })
+  },
+  process (key:string, value: string) {
+    const format = 'Connections__<id>__Settings__<property>'
+    const parts = key.split('__')
+    const [connections, id, settings, prop] = parts
+
+    if (`${connections}/${settings}`.toUpperCase() !== 'CONNECTIONS/SETTINGS') {
+      return false
+    }
+
+    if (parts.length !== 4) {
+      logger.warn(`Invalid connection environment variable: ${key}. Expected format: ${format}.`)
+      return false
+    }
+
+    if (!id?.trim()) {
+      logger.warn(`Invalid connection <id> in environment variable: ${key}. Expected format: ${format}.`)
+      return false
+    }
+
+    if (!prop?.trim()) {
+      logger.warn(`Invalid connection <property> in environment variable: ${key}. Expected format: ${format}.`)
+      return false
+    }
+
+    const result = this.parser.parse(prop as ConnectionKeys, value)
+    if (!result.key) {
+      return false
+    }
+
+    const config = this.connections.get(id) ?? {}
+    config[result.key as keyof AuthConfiguration] = result.value
+    this.connections.set(id, config)
+    return true
+  },
+}
+
+const connectionsMapEnv = {
+  connectionsMap: [] as ConnectionMapItem[],
+  parser: envParser<ConnectionMapKeys>({
+    serviceUrl: envParserUtils.bypass,
+    connection: envParserUtils.bypass,
+    audience: envParserUtils.bypass,
+  }),
+  process (key: string, value: string) {
+    const format = 'ConnectionsMap__<index>__<property>'
+    const parts = key.split('__')
+    const [connectionsMap, index, prop] = parts
+
+    if (connectionsMap.toUpperCase() !== 'CONNECTIONSMAP') {
+      return false
+    }
+
+    if (parts.length !== 3) {
+      logger.warn(`Invalid connection map environment variable: ${key}. Expected format: ${format}.`)
+      return false
+    }
+
+    const indexNumber = parseInt(index, 10)
+    if (!index?.trim() || isNaN(indexNumber) || indexNumber < 0) {
+      logger.warn(`Invalid connection map <index> in environment variable: ${key}. Expected format: ${format}, where <index> is a number.`)
+      return false
+    }
+
+    if (!prop?.trim()) {
+      logger.warn(`Invalid connection map <property> in environment variable: ${key}. Expected format: ${format}.`)
+      return false
+    }
+
+    const result = this.parser.parse(prop as ConnectionMapKeys, value)
+    if (!result.key) {
+      return false
+    }
+
+    const mapItem = this.connectionsMap[indexNumber] ?? { ...DEFAULT_CONNECTION_MAP }
+    mapItem[result.key as keyof ConnectionMapItem] = result.value
+    this.connectionsMap[indexNumber] = mapItem
+    return true
+  },
+}
+
+/**
+ * Legacy BotFramework style-like authentication configuration loaded from environment variables, with support for hot-reloading in test mode.
+ * Environment variables should be named MicrosoftAppTenantId, MicrosoftAppId, MicrosoftAppPassword, etc.
+ */
+const legacyBotFrameworkEnv = {
+  parser: envParser({
+    MicrosoftAppTenantId: envParserUtils.redirect(connectionsEnv.parser, 'tenantId'),
+    MicrosoftAppId: envParserUtils.redirect(connectionsEnv.parser, 'clientId'),
+    MicrosoftAppPassword: envParserUtils.redirect(connectionsEnv.parser, 'clientSecret'),
+    certPemFile: envParserUtils.redirect(connectionsEnv.parser, 'certPemFile'),
+    certKeyFile: envParserUtils.redirect(connectionsEnv.parser, 'certKeyFile'),
+    connectionName: envParserUtils.redirect(connectionsEnv.parser, 'connectionName'),
+    MicrosoftAppClientId: envParserUtils.redirect(connectionsEnv.parser, 'federatedClientId'),
+    authorityEndpoint: envParserUtils.redirect(connectionsEnv.parser, 'authorityEndpoint'),
+    scope: envParserUtils.redirect(connectionsEnv.parser, 'scopes'),
+    altBlueprintConnectionName: envParserUtils.redirect(connectionsEnv.parser, 'altBlueprintConnectionName'),
+    WIDAssertionFile: envParserUtils.redirect(connectionsEnv.parser, 'WIDAssertionFile'),
+    azureRegion: envParserUtils.redirect(connectionsEnv.parser, 'azureRegion'),
+    sendX5C: envParserUtils.redirect(connectionsEnv.parser, 'sendX5C'),
+    authType: envParserUtils.redirect(connectionsEnv.parser, 'authType'),
+    federatedTokenFile: envParserUtils.redirect(connectionsEnv.parser, 'federatedTokenFile'),
+    idpmResource: envParserUtils.redirect(connectionsEnv.parser, 'idpmResource'),
+  }),
+  process (env: LoadEnv) {
+    return legacyPrefixEnv.process.call(this, env)
+  },
+}
+
+/**
+ * Legacy prefix-based authentication configuration loaded from environment variables, with support for hot-reloading in test mode.
+ * Environment variables should be prefixed with the connection name, e.g. <CONNECTION_NAME>_ClientId, <CONNECTION_NAME>_TenantId, etc.
+ */
+const legacyPrefixEnv = {
+  parser: envParser({
+    tenantId: envParserUtils.redirect(connectionsEnv.parser, 'tenantId'),
+    clientId: envParserUtils.redirect(connectionsEnv.parser, 'clientId'),
+    clientSecret: envParserUtils.redirect(connectionsEnv.parser, 'clientSecret'),
+    certPemFile: envParserUtils.redirect(connectionsEnv.parser, 'certPemFile'),
+    certKeyFile: envParserUtils.redirect(connectionsEnv.parser, 'certKeyFile'),
+    connectionName: envParserUtils.redirect(connectionsEnv.parser, 'connectionName'),
+    FICClientId: envParserUtils.redirect(connectionsEnv.parser, 'federatedClientId'),
+    authorityEndpoint: envParserUtils.redirect(connectionsEnv.parser, 'authorityEndpoint'),
+    scope: envParserUtils.redirect(connectionsEnv.parser, 'scopes'),
+    altBlueprintConnectionName: envParserUtils.redirect(connectionsEnv.parser, 'altBlueprintConnectionName'),
+    WIDAssertionFile: envParserUtils.redirect(connectionsEnv.parser, 'WIDAssertionFile'),
+    azureRegion: envParserUtils.redirect(connectionsEnv.parser, 'azureRegion'),
+    sendX5C: envParserUtils.redirect(connectionsEnv.parser, 'sendX5C'),
+    authType: envParserUtils.redirect(connectionsEnv.parser, 'authType'),
+    federatedTokenFile: envParserUtils.redirect(connectionsEnv.parser, 'federatedTokenFile'),
+    idpmResource: envParserUtils.redirect(connectionsEnv.parser, 'idpmResource'),
+  }),
+  process (env: LoadEnv, prefix?: string) {
+    const settings: Partial<AuthConfiguration> = {}
+    for (const key of this.parser.keys) {
+      const k = prefix ? `${prefix}_${key}` : key
+      const envValue = env[k.toUpperCase()]
+      if (!envValue) {
+        continue
+      }
+      const result = this.parser.parse(key, envValue.value)
+      if (result.key) {
+        settings[result.key as keyof AuthConfiguration] = result.value
+      }
+    }
+    return settings
+  },
+}
+
+const loadEnv = () => {
+  connectionsEnv.connections = new Map<string, AuthConfiguration>()
+  connectionsMapEnv.connectionsMap = []
+
+  const env = loadEnvSettings((key, value) => {
+    // Process the first parser that matches the environment variable key and value,
+    // otherwise it continues to the next parser.
+    return connectionsEnv.process(key, value) ||
+           connectionsMapEnv.process(key, value)
+  })
+
+  if (connectionsEnv.connections.size === 0) {
+    logger.warn('No connections found in configuration.')
+  }
+
+  if (connectionsMapEnv.connectionsMap.length === 0 && connectionsEnv.connections.size > 0) {
+    logger.warn('No connections map found in configuration, assuming default connection map with serviceUrl "*" for the first connection.')
+    const [key] = connectionsEnv.connections.keys()
+    connectionsMapEnv.connectionsMap.push({ ...DEFAULT_CONNECTION_MAP, connection: key })
+  }
+
+  return {
+    env,
+    legacyBotFrameworkSettings: legacyBotFrameworkEnv.process(env),
+    legacyPrefixSettings: legacyPrefixEnv.process(env)
+  }
+}
+
+// Initial load of environment variables
+let globalEnv = loadEnv()
+
 /**
  * Loads the authentication configuration from environment variables.
  *
@@ -126,43 +315,26 @@ export interface AuthConfiguration {
  *
  */
 export const loadAuthConfigFromEnv = (cnxName?: string): AuthConfiguration => {
-  const envConnections = loadConnectionsMapFromEnv()
-  let authConfig: AuthConfiguration
-
-  if (envConnections.connectionsMap.length === 0) {
-    // No connections provided, we need to populate the connections map with the old config settings
-    authConfig = buildLegacyAuthConfig(cnxName)
-    envConnections.connections.set(DEFAULT_CONNECTION, authConfig)
-    envConnections.connectionsMap.push({
-      serviceUrl: '*',
-      connection: DEFAULT_CONNECTION,
-    })
-  } else {
-    // There are connections provided, use the default or specified connection
-    if (cnxName) {
-      const entry = envConnections.connections.get(cnxName)
-      if (entry) {
-        authConfig = entry
-      } else {
-        throw new Error(`Connection "${cnxName}" not found in environment.`)
-      }
-    } else {
-      const defaultItem = envConnections.connectionsMap.find((item) => item.serviceUrl === '*')
-      const defaultConn = defaultItem ? envConnections.connections.get(defaultItem.connection) : undefined
-      if (!defaultConn) {
-        throw new Error('No default connection found in environment connections.')
-      }
-      authConfig = defaultConn
-    }
+  if (process.env.TEST_MODE === 'true') {
+    globalEnv = loadEnv()
+  }
 
-    authConfig.authority ??= 'https://login.microsoftonline.com'
-    authConfig.issuers ??= getDefaultIssuers(authConfig.tenantId ?? '', authConfig.authority)
+  if (connectionsEnv.connections.size > 0) {
+    return cnxName?.trim() ? connectionsEnv.default(undefined, [{ ...DEFAULT_CONNECTION_MAP, connection: cnxName }]) : connectionsEnv.default()
   }
 
-  return {
-    ...authConfig,
-    ...envConnections,
+  // No connections provided, we need to populate the connections map with the old config settings
+  const result = applyDefaultSettings(cnxName?.trim() ? legacyPrefixEnv.process(globalEnv.env, cnxName) : globalEnv.legacyPrefixSettings)
+  if (cnxName && !result.clientId) {
+    throw new Error(`ClientId not found for connection: ${cnxName}`)
   }
+
+  logger.info('Auth settings loaded from environment', {
+    connections: summarizeAuthConfiguration(result),
+    connectionsMap: result.connectionsMap?.map(e => ({ ...e, serviceUrl: e.serviceUrl !== '*' ? redactUrl(e.serviceUrl) : e.serviceUrl })),
+  })
+
+  return result
 }
 
 /**
@@ -180,100 +352,20 @@ export const loadAuthConfigFromEnv = (cnxName?: string): AuthConfiguration => {
  *
  */
 export const loadPrevAuthConfigFromEnv: () => AuthConfiguration = () => {
-  const envConnections = loadConnectionsMapFromEnv()
-  let authConfig: AuthConfiguration = {}
+  if (process.env.TEST_MODE === 'true') {
+    globalEnv = loadEnv()
+  }
 
-  if (envConnections.connectionsMap.length === 0) {
-    // No connections provided, we need to populate the connection map with the old config settings
-    if (process.env.MicrosoftAppId === undefined && process.env.NODE_ENV === 'production') {
-      throw new Error('ClientId required in production')
-    }
-    const authority = process.env.authorityEndpoint ?? 'https://login.microsoftonline.com'
-    authConfig = {
-      tenantId: process.env.MicrosoftAppTenantId,
-      clientId: process.env.MicrosoftAppId,
-      clientSecret: process.env.MicrosoftAppPassword,
-      certPemFile: process.env.certPemFile,
-      certKeyFile: process.env.certKeyFile,
-      sendX5C: process.env.sendX5C === 'true',
-      connectionName: process.env.connectionName,
-      FICClientId: process.env.MicrosoftAppClientId,
-      authority,
-      scope: process.env.scope,
-      issuers: getDefaultIssuers(process.env.MicrosoftAppTenantId ?? '', authority),
-      altBlueprintConnectionName: process.env.altBlueprintConnectionName,
-      WIDAssertionFile: process.env.WIDAssertionFile,
-      azureRegion: process.env.azureRegion,
-    }
-    envConnections.connections.set(DEFAULT_CONNECTION, authConfig)
-    envConnections.connectionsMap.push({
-      serviceUrl: '*',
-      connection: DEFAULT_CONNECTION,
-    })
+  let result: AuthConfiguration
+  if (connectionsEnv.connections.size > 0) {
+    result = connectionsEnv.default()
   } else {
-    // There are connections provided, use the default one.
-    const defaultItem = envConnections.connectionsMap.find((item) => item.serviceUrl === '*')
-    const defaultConn = defaultItem ? envConnections.connections.get(defaultItem.connection) : undefined
-    if (!defaultConn) {
-      throw new Error('No default connection found in environment connections.')
-    }
-    authConfig = defaultConn
+    // No connections provided, we need to populate the connection map with the old config settings
+    result = applyDefaultSettings(globalEnv.legacyBotFrameworkSettings)
   }
 
-  authConfig.authority ??= 'https://login.microsoftonline.com'
-  authConfig.issuers ??= getDefaultIssuers(authConfig.tenantId ?? '', authConfig.authority)
-
-  return { ...authConfig, ...envConnections }
-}
-
-function loadConnectionsMapFromEnv () {
-  const envVars = process.env
-  const connectionsObj: Record<string, any> = {}
-  const connectionsMap: ConnectionMapItem[] = []
-  const CONNECTIONS_PREFIX = 'connections__'
-  const CONNECTIONS_MAP_PREFIX = 'connectionsMap__'
-
-  for (const [key, rawValue] of Object.entries(envVars)) {
-    if (key.startsWith(CONNECTIONS_PREFIX)) {
-      // Convert to dot notation
-      let path = key.substring(CONNECTIONS_PREFIX.length).replace(/__/g, '.')
-      // Remove ".settings." from the path
-      path = path.replace('.settings.', '.')
-      // Convert "true"/"false" strings into boolean values
-      const value = rawValue === 'true' ? true : rawValue === 'false' ? false : rawValue
-      objectPath.set(connectionsObj, path, value)
-    } else if (key.startsWith(CONNECTIONS_MAP_PREFIX)) {
-      const path = key.substring(CONNECTIONS_MAP_PREFIX.length).replace(/__/g, '.')
-      objectPath.set(connectionsMap, path, rawValue)
-    }
-  }
-
-  // Convert connectionsObj to Map<string, AuthConfiguration>
-  const connections: Map<string, AuthConfiguration> = new Map(Object.entries(connectionsObj))
-
-  if (connections.size === 0) {
-    logger.warn('No connections found in configuration.')
-  }
-
-  if (connectionsMap.length === 0) {
-    logger.warn('No connections map found in configuration.')
-    if (connections.size > 0) {
-      const firstEntry = connections.entries().next().value
-
-      if (firstEntry) {
-        const [firstKey] = firstEntry
-        // Provide a default connection map if none is specified
-        connectionsMap.push({
-          serviceUrl: '*',
-          connection: firstKey,
-        })
-      }
-    }
-  }
-  return {
-    connections,
-    connectionsMap,
-  }
+  logger.info('Legacy auth settings loaded from environment', summarizeAuthConfiguration(result), result.connectionsMap)
+  return result
 }
 
 /**
@@ -301,153 +393,22 @@ function loadConnectionsMapFromEnv () {
  *
  */
 export function getAuthConfigWithDefaults (config?: AuthConfiguration): AuthConfiguration {
-  if (!config) return loadAuthConfigFromEnv()
-
-  const providedConnections = config.connections && config.connectionsMap
-    ? { connections: config.connections, connectionsMap: config.connectionsMap }
-    : undefined
-
-  const connections = providedConnections ?? loadConnectionsMapFromEnv()
-
-  let mergedConfig: AuthConfiguration
-
-  if (connections && connections.connectionsMap?.length === 0) {
-    // No connections provided, we need to populate the connections map with the old config settings
-    mergedConfig = buildLegacyAuthConfig(undefined, config)
-    connections.connections?.set(DEFAULT_CONNECTION, mergedConfig)
-    connections.connectionsMap.push({ serviceUrl: '*', connection: DEFAULT_CONNECTION })
-  } else {
-    // There are connections provided, use the default connection
-    const defaultItem = connections.connectionsMap?.find((item) => item.serviceUrl === '*')
-    const defaultConn = defaultItem ? connections.connections?.get(defaultItem.connection) : undefined
-    if (!defaultConn) {
-      throw new Error('No default connection found in environment connections.')
-    }
-    mergedConfig = buildLegacyAuthConfig(undefined, defaultConn)
-  }
-
-  return {
-    ...mergedConfig,
-    ...connections,
-  }
-}
-
-function buildLegacyAuthConfig (envPrefix: string = '', customConfig?: AuthConfiguration): AuthConfiguration {
-  const prefix = envPrefix ? `${envPrefix}_` : ''
-  const authority = customConfig?.authority ?? process.env[`${prefix}authorityEndpoint`] ?? 'https://login.microsoftonline.com'
-
-  const clientId = customConfig?.clientId ?? process.env[`${prefix}clientId`]
-
-  if (!clientId && !envPrefix && process.env.NODE_ENV === 'production') {
-    throw new Error('ClientId required in production')
-  }
-  if (!clientId && envPrefix) {
-    throw new Error(`ClientId not found for connection: ${envPrefix}`)
+  if (process.env.TEST_MODE === 'true') {
+    globalEnv = loadEnv()
   }
 
-  const tenantId = customConfig?.tenantId ?? process.env[`${prefix}tenantId`]
-
-  return {
-    tenantId,
-    clientId: clientId!,
-    clientSecret: customConfig?.clientSecret ?? process.env[`${prefix}clientSecret`],
-    certPemFile: customConfig?.certPemFile ?? process.env[`${prefix}certPemFile`],
-    certKeyFile: customConfig?.certKeyFile ?? process.env[`${prefix}certKeyFile`],
-    sendX5C: customConfig?.sendX5C ?? (process.env[`${prefix}sendX5C`] === 'true'),
-    connectionName: customConfig?.connectionName ?? process.env[`${prefix}connectionName`],
-    FICClientId: customConfig?.FICClientId ?? process.env[`${prefix}FICClientId`],
-    authority,
-    scope: customConfig?.scope ?? process.env[`${prefix}scope`],
-    issuers: customConfig?.issuers ?? getDefaultIssuers(tenantId as string, authority),
-    altBlueprintConnectionName: customConfig?.altBlueprintConnectionName ?? process.env[`${prefix}altBlueprintConnectionName`],
-    WIDAssertionFile: customConfig?.WIDAssertionFile ?? process.env[`${prefix}WIDAssertionFile`],
-    azureRegion: customConfig?.azureRegion ?? process.env[`${prefix}azureRegion`]
-  }
-}
-
-/**
- * Resolves the full authority URL including the tenant ID.
- * Supports both patterns:
- *   - Tenant embedded in authority: https://login.microsoftonline.com/my-tenant
- *   - Authority + separate tenantId: https://login.microsoftonline.com + tenantId
- * Also handles trailing slashes on authority.
- */
-export function resolveAuthority (authority?: string, tenantId?: string): string {
-  const base = (authority ?? 'https://login.microsoftonline.com').replace(/\/+$/, '')
-  const url = new URL(base)
-  const hasPathSegment = url.pathname !== '/'
-  if (hasPathSegment) {
-    return base
-  }
-  return `${base}/${tenantId ?? 'botframework.com'}`
-}
-
-function getDefaultIssuers (tenantId: string, authority: string) : string[] {
-  // Convert empty string to undefined so resolveAuthority applies its 'botframework.com' default
-  const t = tenantId || undefined
-  if (!t) {
-    logger.warn('tenantId is not configured, defaulting to botframework.com')
-  }
-  return [
-    'https://api.botframework.com',
-    `${resolveAuthority('https://sts.windows.net', t)}/`,
-    `${resolveAuthority(authority, t)}/v2.0`
-  ]
-}
-
-/**
- * A type representing a parser settings object.
- */
-type ParserSettings<K extends string> = {
-  [key in K]: (value: string) => { key?: string, value?: any } | undefined
-}
-
-/**
- * Creates an environment variable parser that maps the variable keys to parsing functions.
- * @param settings An object where each key is an environment variable name and the value is a function
- * that takes the variable value as input and returns an object with optional `key` and `value` properties.
- * @remarks
- * The `key` property in the returned object can be used to rename the environment variable key,
- * while the `value` property contains the parsed value.
- * @returns An object with a `parse` method that takes an environment variable key and value,
- * and returns the parsed result.
- */
-export function envParser<K extends string> (settings: ParserSettings<K> & ThisType<ParserSettings<K>>) {
-  const keys = Object.keys(settings) as K[]
-  return {
-    /**
-     * Parses the given environment variable key and value using the provided settings.
-     * @param key The environment variable key.
-     * @param value The environment variable value.
-     * @returns The parsed result with optional renamed key and parsed value.
-     */
-    parse (key: K, value: string) {
-      const match = keys.find(k => k.toUpperCase() === key.toUpperCase())
-      if (!match) {
-        return {}
-      }
-
-      const result = settings[match](value)
-      return { key: result?.key ?? match, value: result?.value }
+  let result: AuthConfiguration
+  if (!config) {
+    result = loadAuthConfigFromEnv()
+  } else {
+    const { connections, connectionsMap } = config.connections?.size ? config : { connections: connectionsEnv.connections, connectionsMap: connectionsMapEnv.connectionsMap }
+    if (connections?.size) {
+      result = { ...globalEnv.legacyPrefixSettings, ...connectionsEnv.default(connections, connectionsMap) }
+    } else {
+      result = applyDefaultSettings({ ...globalEnv.legacyPrefixSettings, ...config })
     }
   }
-}
 
-/**
- * Utility functions for environment variable parsers.
- */
-export const envParserUtils = {
-  /**
-   * Bypass parser that returns the value as is.
-   * @param value The environment variable value.
-   * @returns An object with the original value.
-   */
-  bypass: (value: string) => ({ value }),
-  /**
-   * Redirects the parsing to another parser for a specific key.
-   * @param parser The target parser to redirect to.
-   * @param key The key to use in the target parser.
-   * @returns A function that takes the environment variable value and returns the parsed result from the target parser.
-   */
-  redirect: <Parser extends ReturnType<typeof envParser>>(parser: Parser, key: Parameters<Parser['parse']>[0]) => (value: string) => parser.parse(key, value)
+  logger.info('Auth settings loaded from runtime configuration', summarizeAuthConfiguration(result), result.connectionsMap)
+  return result
 }