@microsoft/agents-hosting 1.8.1 → 1.9.0-beta.18.g6b8111bba5

package/dist/src/auth/authConfiguration.js

@@ -13,9 +13,11 @@ Object.defineProperty(exports, "AuthType", { enumerable: true, get: function ()
 Object.defineProperty(exports, "resolveAuthority", { enumerable: true, get: function () { return settings_2.resolveAuthority; } });
 Object.defineProperty(exports, "resolveAuthType", { enumerable: true, get: function () { return settings_2.resolveAuthType; } });
 const utils_1 = require("../utils");
-const env_1 = require("../utils/env");
 const agents_activity_1 = require("@microsoft/agents-activity");
 const errorHelper_1 = require("../errorHelper");
+const configuration_1 = require("../configuration/configuration");
+const environmentConfiguration_1 = require("../configuration/environmentConfiguration");
+const botFrameworkEnvironmentCompatibility_1 = require("../configuration/botFrameworkEnvironmentCompatibility");
 const logger = (0, agents_telemetry_1.debug)('agents:authConfiguration');
 /**
  * Summarizes the authentication configuration for logging by redacting sensitive information and pruning undefined values. This is used to log the loaded authentication settings without exposing secrets or personally identifiable information.
@@ -70,253 +72,254 @@ function summarizeAuthConfiguration(authConfig) {
  * Environment variables for connections map should be in the format ConnectionsMap__<index>__<property>, e.g. ConnectionsMap__0__ServiceUrl, ConnectionsMap__0__Connection, etc.
  */
 const connectionsEnv = {
-    connections: new Map(),
-    parser: (0, settings_1.envParser)({
-        authType: settings_1.envParserUtils.bypass,
-        tenantId: settings_1.envParserUtils.bypass,
-        clientId: settings_1.envParserUtils.bypass,
-        clientSecret: settings_1.envParserUtils.bypass,
-        certPemFile: settings_1.envParserUtils.bypass,
-        certKeyFile: settings_1.envParserUtils.bypass,
-        connectionName: settings_1.envParserUtils.bypass,
-        federatedClientId: settings_1.envParserUtils.bypass,
-        FICClientId(value) {
-            logger.warn('Connections__<id>__Settings__FICClientId is deprecated, please use Connections__<id>__Settings__FederatedClientId instead.');
-            return { key: 'federatedClientId', value }; // redirect
-        },
-        authorityEndpoint: settings_1.envParserUtils.bypass,
-        authority(value) {
-            logger.warn('Connections__<id>__Settings__Authority is deprecated, please use Connections__<id>__Settings__AuthorityEndpoint instead.');
-            return { key: 'authorityEndpoint', value }; // redirect
-        },
-        scopes(value) {
-            return this.issuers(value); // scopes can be comma or space separated list, same as issuers.
-        },
-        scope(value) {
-            var _a;
-            logger.warn('Connections__<id>__Settings__Scope is deprecated, please use Connections__<id>__Settings__Scopes instead.');
-            return { key: 'scopes', value: (_a = this.scopes(value)) === null || _a === void 0 ? void 0 : _a.value }; // redirect with single scope
-        },
-        altBlueprintConnectionName: settings_1.envParserUtils.bypass,
-        alternateBlueprintConnectionName: (value) => ({ key: 'altBlueprintConnectionName', value }), // .NET parity alias
-        WIDAssertionFile: settings_1.envParserUtils.bypass,
-        federatedTokenFile: settings_1.envParserUtils.bypass,
-        idpmResource: settings_1.envParserUtils.bypass,
-        azureRegion: settings_1.envParserUtils.bypass,
-        sendX5C: (value) => ({ value: value === 'true' }),
-        msalRetryCount: (value) => {
-            const n = parseInt(value, 10);
-            return { value: Number.isFinite(n) && n >= 0 ? n : undefined };
-        },
-        sidecarBaseUrl: settings_1.envParserUtils.bypass,
-        serviceName: settings_1.envParserUtils.bypass,
-        blueprintServiceName: settings_1.envParserUtils.bypass,
-        bypassLocalNetworkRestriction: (value) => ({ value: value === 'true' }),
-        requestTimeout: (value) => {
-            const n = parseInt(value, 10);
-            return { value: Number.isFinite(n) && n > 0 ? n : undefined };
-        },
-        retryCount: (value) => {
-            const n = parseInt(value, 10);
-            return { value: Number.isFinite(n) && n >= 0 ? n : undefined };
-        },
-        issuers(value) {
-            if (value.includes(',')) {
-                return { value: value.split(',').map(s => s.trim()).filter(Boolean) };
-            }
-            return { value: value.split(/\s+/).filter(Boolean) };
-        },
-        validateIssuer: (value) => ({ value: (0, env_1.parseBooleanEnv)(value) }),
-    }),
-    default(connections, connectionsMap) {
-        var _a;
-        const conn = connections !== null && connections !== void 0 ? connections : this.connections;
-        const map = connectionsMap !== null && connectionsMap !== void 0 ? connectionsMap : connectionsMapEnv.connectionsMap;
-        const name = (_a = map === null || map === void 0 ? void 0 : map.find((item) => item.serviceUrl === '*')) === null || _a === void 0 ? void 0 : _a.connection;
-        if (!name) {
-            throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.NoDefaultConnectionFound);
-        }
-        const connection = conn === null || conn === void 0 ? void 0 : conn.get(name !== null && name !== void 0 ? name : '');
-        if (!connection) {
-            throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.ConnectionNotFoundInEnvironment, undefined, { connectionName: name });
-        }
-        return (0, settings_1.applyDefaultSettings)({ ...connection, connections: conn, connectionsMap: map });
-    },
-    process(key, value) {
-        var _a;
-        const format = 'Connections__<id>__Settings__<property>';
-        const parts = key.split('__');
-        const [connections, id, settings, prop] = parts;
-        if (`${connections}/${settings}`.toUpperCase() !== 'CONNECTIONS/SETTINGS') {
-            return false;
-        }
-        if (parts.length !== 4) {
-            logger.warn(`Invalid connection environment variable: ${key}. Expected format: ${format}.`);
-            return false;
-        }
-        if (!(id === null || id === void 0 ? void 0 : id.trim())) {
-            logger.warn(`Invalid connection <id> in environment variable: ${key}. Expected format: ${format}.`);
-            return false;
-        }
-        if (!(prop === null || prop === void 0 ? void 0 : prop.trim())) {
-            logger.warn(`Invalid connection <property> in environment variable: ${key}. Expected format: ${format}.`);
-            return false;
-        }
-        const result = this.parser.parse(prop, value);
-        if (!result.key) {
-            return false;
-        }
-        const config = (_a = this.connections.get(id)) !== null && _a !== void 0 ? _a : {};
-        config[result.key] = result.value;
-        this.connections.set(id, config);
-        return true;
-    },
+    connections: new Map()
 };
 const connectionsMapEnv = {
-    connectionsMap: [],
-    parser: (0, settings_1.envParser)({
-        serviceUrl: settings_1.envParserUtils.bypass,
-        connection: settings_1.envParserUtils.bypass,
-        audience: settings_1.envParserUtils.bypass,
-    }),
-    process(key, value) {
-        var _a;
-        const format = 'ConnectionsMap__<index>__<property>';
-        const parts = key.split('__');
-        const [connectionsMap, index, prop] = parts;
-        if (connectionsMap.toUpperCase() !== 'CONNECTIONSMAP') {
-            return false;
+    connectionsMap: new Map(),
+    finalized: []
+};
+const loadEnv = () => {
+    const modern = (0, environmentConfiguration_1.loadModernEnvironmentConfiguration)();
+    connectionsEnv.connections.clear();
+    for (const connection of modern.connections.values()) {
+        connectionsEnv.connections.set(connection.id, { ...connection.settings });
+    }
+    connectionsMapEnv.connectionsMap.clear();
+    for (const [index, item] of modern.connectionsMap) {
+        connectionsMapEnv.connectionsMap.set(index, { ...item });
+    }
+    if (connectionsEnv.connections.size === 0) {
+        logger.warn('No connections found in configuration.');
+    }
+    if (connectionsMapEnv.connectionsMap.size === 0 && connectionsEnv.connections.size > 0) {
+        logger.warn('No connections map found in configuration, assuming default connection map with serviceUrl "*" for the first connection.');
+        const [key] = connectionsEnv.connections.keys();
+        connectionsMapEnv.connectionsMap.set(0, { ...settings_1.DEFAULT_CONNECTION_MAP, connection: key });
+    }
+    return {
+        legacyBotFrameworkSettings: configurationLayerSettings((0, botFrameworkEnvironmentCompatibility_1.loadBotFrameworkEnvironmentConfiguration)()),
+        legacyPrefixSettings: configurationLayerSettings((0, botFrameworkEnvironmentCompatibility_1.loadBotFrameworkPrefixedEnvironmentConfiguration)(''))
+    };
+};
+function externalAuthOperation(layer) {
+    return {
+        connections: new Map([...layer.connections.values()].map(connection => [connection.id, connection.settings])),
+        connectionsMap: layer.connectionsMap
+    };
+}
+function configurationLayerSettings(layer, connectionName) {
+    const connection = connectionName
+        ? layer.connections.get(connectionName.toLowerCase())
+        : layer.connections.values().next().value;
+    return connection ? { ...connection.settings } : {};
+}
+function settingsOperation(settings, synthesizeFlatConnection = false, materializeRequestedConnection = false) {
+    const { connections, connectionsMap, ...flatSettings } = settings;
+    return {
+        flatSettings,
+        connections,
+        connectionsMap: connectionsMap
+            ? new Map(connectionsMap.map((item, index) => [index, item]))
+            : undefined,
+        synthesizeFlatConnection,
+        materializeRequestedConnection
+    };
+}
+function registryOperation(settings) {
+    return {
+        connections: settings.connections,
+        connectionsMap: settings.connectionsMap
+            ? new Map(settings.connectionsMap.map((item, index) => [index, item]))
+            : undefined,
+        replaceRegistry: true
+    };
+}
+function validateDirectIssuerConfiguration(config) {
+    var _a;
+    validateDirectIssuerValue(config, 'validateIssuer');
+    for (const [id, settings] of (_a = config.connections) !== null && _a !== void 0 ? _a : []) {
+        validateDirectIssuerValue(settings, `connections.${id}.settings.validateIssuer`);
+    }
+}
+function validateDirectIssuerValue(settings, path) {
+    if (settings.validateIssuer !== undefined && typeof settings.validateIssuer !== 'boolean') {
+        throw agents_activity_1.ExceptionHelper.generateException(TypeError, errorHelper_1.Errors.InvalidBooleanConfigurationValue, undefined, { sourceName: 'runtime configuration', path });
+    }
+}
+function environmentRegistryOperation() {
+    return {
+        connections: connectionsEnv.connections,
+        connectionsMap: connectionsMapEnv.connectionsMap
+    };
+}
+function environmentRouteOperation() {
+    return {
+        connectionsMap: connectionsMapEnv.connectionsMap
+    };
+}
+function applyConnectionOperation(connections, operation) {
+    var _a;
+    if (operation.replaceRegistry) {
+        const retained = retainedConnectionIds(operation);
+        for (const id of connections.keys()) {
+            if (!retained.has(id.toLowerCase())) {
+                connections.delete(id);
+            }
         }
-        if (parts.length !== 3) {
-            logger.warn(`Invalid connection map environment variable: ${key}. Expected format: ${format}.`);
-            return false;
+    }
+    for (const [id, settings] of (_a = operation.connections) !== null && _a !== void 0 ? _a : []) {
+        const existingId = findConnectionKey(connections, id);
+        const targetId = existingId !== null && existingId !== void 0 ? existingId : id;
+        connections.set(targetId, { ...connections.get(targetId), ...settings });
+    }
+}
+function retainedConnectionIds(operation) {
+    var _a;
+    var _b;
+    return new Set([...(_b = (_a = operation.connections) === null || _a === void 0 ? void 0 : _a.keys()) !== null && _b !== void 0 ? _b : []].map(id => id.toLowerCase()));
+}
+function findConnectionKey(connections, requested) {
+    if (!connections || !requested) {
+        return undefined;
+    }
+    const normalized = requested.toLowerCase();
+    return [...connections.keys()].find(id => id.toLowerCase() === normalized);
+}
+function resolveConnectionsMap(operations) {
+    var _a;
+    const connectionsMap = new Map();
+    for (const operation of operations) {
+        if (operation.replaceRegistry) {
+            const retained = retainedConnectionIds(operation);
+            for (const [index, item] of connectionsMap) {
+                if (item.connection && !retained.has(item.connection.toLowerCase())) {
+                    connectionsMap.delete(index);
+                }
+            }
         }
-        const indexNumber = parseInt(index, 10);
-        if (!(index === null || index === void 0 ? void 0 : index.trim()) || isNaN(indexNumber) || indexNumber < 0) {
-            logger.warn(`Invalid connection map <index> in environment variable: ${key}. Expected format: ${format}, where <index> is a number.`);
-            return false;
+        for (const [index, item] of (_a = operation.connectionsMap) !== null && _a !== void 0 ? _a : []) {
+            connectionsMap.set(index, { ...connectionsMap.get(index), ...item });
         }
-        if (!(prop === null || prop === void 0 ? void 0 : prop.trim())) {
-            logger.warn(`Invalid connection map <property> in environment variable: ${key}. Expected format: ${format}.`);
-            return false;
+    }
+    return connectionsMap;
+}
+function finalizeConnectionsMap(patches, connections, synthesizeDefault = true) {
+    if (synthesizeDefault && patches.size === 0 && connections.size === 1) {
+        const [connection] = connections.keys();
+        return [{ ...settings_1.DEFAULT_CONNECTION_MAP, connection }];
+    }
+    return [...patches.entries()]
+        .sort(([left], [right]) => left - right)
+        .map(([index, item]) => {
+        if (!item.serviceUrl || !item.connection) {
+            throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.InvalidConnectionMapEntry, undefined, { index: index.toString() });
         }
-        const result = this.parser.parse(prop, value);
-        if (!result.key) {
-            return false;
+        const connection = findConnectionKey(connections, item.connection);
+        if (!connection) {
+            throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.ConnectionNotFoundInEnvironment, undefined, { connectionName: item.connection });
         }
-        const mapItem = (_a = this.connectionsMap[indexNumber]) !== null && _a !== void 0 ? _a : { ...settings_1.DEFAULT_CONNECTION_MAP };
-        mapItem[result.key] = result.value;
-        this.connectionsMap[indexNumber] = mapItem;
-        return true;
-    },
-};
-/**
- * Legacy BotFramework style-like authentication configuration loaded from environment variables, with support for hot-reloading in test mode.
- * Environment variables should be named MicrosoftAppTenantId, MicrosoftAppId, MicrosoftAppPassword, etc.
- */
-const legacyBotFrameworkEnv = {
-    parser: (0, settings_1.envParser)({
-        MicrosoftAppTenantId: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'tenantId'),
-        MicrosoftAppId: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'clientId'),
-        MicrosoftAppPassword: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'clientSecret'),
-        certPemFile: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'certPemFile'),
-        certKeyFile: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'certKeyFile'),
-        connectionName: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'connectionName'),
-        MicrosoftAppClientId: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'federatedClientId'),
-        authorityEndpoint: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'authorityEndpoint'),
-        scope: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'scopes'),
-        altBlueprintConnectionName: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'altBlueprintConnectionName'),
-        alternateBlueprintConnectionName: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'altBlueprintConnectionName'),
-        WIDAssertionFile: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'WIDAssertionFile'),
-        azureRegion: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'azureRegion'),
-        sendX5C: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'sendX5C'),
-        msalRetryCount: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'msalRetryCount'),
-        authType: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'authType'),
-        federatedTokenFile: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'federatedTokenFile'),
-        idpmResource: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'idpmResource'),
-        sidecarBaseUrl: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'sidecarBaseUrl'),
-        serviceName: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'serviceName'),
-        blueprintServiceName: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'blueprintServiceName'),
-        bypassLocalNetworkRestriction: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'bypassLocalNetworkRestriction'),
-        requestTimeout: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'requestTimeout'),
-        retryCount: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'retryCount'),
-        validateIssuer: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'validateIssuer'),
-    }),
-    process(env) {
-        return legacyPrefixEnv.process.call(this, env);
-    },
-};
-/**
- * Legacy prefix-based authentication configuration loaded from environment variables, with support for hot-reloading in test mode.
- * Environment variables should be prefixed with the connection name, e.g. <CONNECTION_NAME>_ClientId, <CONNECTION_NAME>_TenantId, etc.
- */
-const legacyPrefixEnv = {
-    parser: (0, settings_1.envParser)({
-        tenantId: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'tenantId'),
-        clientId: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'clientId'),
-        clientSecret: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'clientSecret'),
-        certPemFile: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'certPemFile'),
-        certKeyFile: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'certKeyFile'),
-        connectionName: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'connectionName'),
-        FICClientId: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'federatedClientId'),
-        authorityEndpoint: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'authorityEndpoint'),
-        scope: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'scopes'),
-        altBlueprintConnectionName: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'altBlueprintConnectionName'),
-        alternateBlueprintConnectionName: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'altBlueprintConnectionName'),
-        WIDAssertionFile: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'WIDAssertionFile'),
-        azureRegion: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'azureRegion'),
-        sendX5C: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'sendX5C'),
-        msalRetryCount: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'msalRetryCount'),
-        authType: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'authType'),
-        federatedTokenFile: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'federatedTokenFile'),
-        idpmResource: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'idpmResource'),
-        sidecarBaseUrl: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'sidecarBaseUrl'),
-        serviceName: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'serviceName'),
-        blueprintServiceName: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'blueprintServiceName'),
-        bypassLocalNetworkRestriction: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'bypassLocalNetworkRestriction'),
-        requestTimeout: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'requestTimeout'),
-        retryCount: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'retryCount'),
-        validateIssuer: settings_1.envParserUtils.redirect(connectionsEnv.parser, 'validateIssuer'),
-    }),
-    process(env, prefix) {
-        const settings = {};
-        for (const key of this.parser.keys) {
-            const k = prefix ? `${prefix}_${key}` : key;
-            const envValue = env[k.toUpperCase()];
-            if (!envValue) {
-                continue;
+        return {
+            serviceUrl: item.serviceUrl,
+            connection,
+            ...(item.audience === undefined ? {} : { audience: item.audience })
+        };
+    });
+}
+function resolveAuthOperations(operations, connectionName) {
+    var _a, _b;
+    const connections = new Map();
+    for (const operation of operations) {
+        applyConnectionOperation(connections, operation);
+    }
+    if (connections.size === 0 &&
+        operations.some(operation => operation.synthesizeFlatConnection)) {
+        connections.set(settings_1.DEFAULT_CONNECTION_MAP.connection, {});
+    }
+    const requestedName = connectionName === null || connectionName === void 0 ? void 0 : connectionName.trim();
+    if (requestedName &&
+        !findConnectionKey(connections, requestedName) &&
+        operations.some(operation => operation.materializeRequestedConnection)) {
+        connections.set(requestedName, {});
+    }
+    const requestedConnection = connections.size > 0 ? requestedName : undefined;
+    const requiresDefaultRoute = operations.some(operation => operation.replaceRegistry);
+    let connectionsMap = finalizeConnectionsMap(resolveConnectionsMap(operations), connections, !requiresDefaultRoute);
+    if (connectionsMap.length === 0 && (requiresDefaultRoute || connections.size > 1)) {
+        throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.NoDefaultConnectionFound);
+    }
+    const defaultConnection = (_a = connectionsMap.find(item => item.serviceUrl === '*')) === null || _a === void 0 ? void 0 : _a.connection;
+    if (connectionsMap.length > 0 && !requestedConnection && !defaultConnection) {
+        throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.NoDefaultConnectionFound);
+    }
+    const selectedConnection = requestedConnection || defaultConnection || connections.keys().next().value;
+    if (connections.size > 0 && !selectedConnection) {
+        throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.NoDefaultConnectionFound);
+    }
+    const selectedConnectionKey = findConnectionKey(connections, selectedConnection);
+    if (selectedConnection && !selectedConnectionKey) {
+        throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.ConnectionNotFoundInEnvironment, undefined, { connectionName: selectedConnection });
+    }
+    if (requestedConnection) {
+        connectionsMap = [{ ...settings_1.DEFAULT_CONNECTION_MAP, connection: selectedConnectionKey !== null && selectedConnectionKey !== void 0 ? selectedConnectionKey : requestedConnection }];
+    }
+    if (selectedConnection) {
+        const selectedSettings = {};
+        for (const operation of operations) {
+            const operationConnectionKey = findConnectionKey(operation.connections, selectedConnection);
+            const connectionSettings = operationConnectionKey
+                ? (_b = operation.connections) === null || _b === void 0 ? void 0 : _b.get(operationConnectionKey)
+                : undefined;
+            if (connectionSettings) {
+                Object.assign(selectedSettings, connectionSettings);
             }
-            const result = this.parser.parse(key, envValue.value);
-            if (result.key) {
-                settings[result.key] = result.value;
+            if (operation.flatSettings) {
+                Object.assign(selectedSettings, operation.flatSettings);
             }
         }
-        return settings;
-    },
-};
-const loadEnv = () => {
-    connectionsEnv.connections = new Map();
-    connectionsMapEnv.connectionsMap = [];
-    const env = (0, settings_1.loadEnvSettings)((key, value) => {
-        // Process the first parser that matches the environment variable key and value,
-        // otherwise it continues to the next parser.
-        return connectionsEnv.process(key, value) ||
-            connectionsMapEnv.process(key, value);
-    });
-    if (connectionsEnv.connections.size === 0) {
-        logger.warn('No connections found in configuration.');
+        const resolved = (0, settings_1.applyDefaultSettings)(selectedSettings);
+        const providerSettings = { ...resolved };
+        delete providerSettings.connections;
+        delete providerSettings.connectionsMap;
+        connections.set(selectedConnectionKey !== null && selectedConnectionKey !== void 0 ? selectedConnectionKey : selectedConnection, providerSettings);
+        return { ...providerSettings, connections, connectionsMap };
     }
-    if (connectionsMapEnv.connectionsMap.length === 0 && connectionsEnv.connections.size > 0) {
-        logger.warn('No connections map found in configuration, assuming default connection map with serviceUrl "*" for the first connection.');
-        const [key] = connectionsEnv.connections.keys();
-        connectionsMapEnv.connectionsMap.push({ ...settings_1.DEFAULT_CONNECTION_MAP, connection: key });
+    const flatSettings = {};
+    for (const operation of operations) {
+        Object.assign(flatSettings, operation.flatSettings);
     }
+    return (0, settings_1.applyDefaultSettings)(flatSettings);
+}
+function environmentOperation(legacySettings, connectionName) {
+    return connectionsEnv.connections.size > 0
+        ? environmentRegistryOperation()
+        : settingsOperation(legacySettings, false, Boolean((connectionName === null || connectionName === void 0 ? void 0 : connectionName.trim()) && Object.keys(legacySettings).length > 0));
+}
+function externalOperations(context) {
+    const snapshot = (0, configuration_1.getConfigurationSnapshot)(context);
     return {
-        env,
-        legacyBotFrameworkSettings: legacyBotFrameworkEnv.process(env),
-        legacyPrefixSettings: legacyPrefixEnv.process(env)
+        hasAuth: ['fallback', 'overrideEnvironment', 'enforce'].some(mode => snapshot[mode].connections.size > 0 ||
+            snapshot[mode].connectionsMap.size > 0),
+        fallback: externalAuthOperation(snapshot.fallback),
+        overrideEnvironment: externalAuthOperation(snapshot.overrideEnvironment),
+        enforce: externalAuthOperation(snapshot.enforce)
     };
-};
+}
+function preserveEnvironmentRegistryIdentity(result, external, environmentRegistrySelected) {
+    var _a, _b;
+    if (external.hasAuth || !environmentRegistrySelected) {
+        return result;
+    }
+    for (const [id, settings] of (_a = result.connections) !== null && _a !== void 0 ? _a : []) {
+        const environmentId = findConnectionKey(connectionsEnv.connections, id);
+        if (environmentId) {
+            connectionsEnv.connections.set(environmentId, settings);
+        }
+    }
+    connectionsMapEnv.finalized.splice(0, connectionsMapEnv.finalized.length, ...((_b = result.connectionsMap) !== null && _b !== void 0 ? _b : []));
+    result.connections = connectionsEnv.connections;
+    result.connectionsMap = connectionsMapEnv.finalized;
+    return result;
+}
 // Initial load of environment variables
 let globalEnv = loadEnv();
 /**
@@ -345,16 +348,21 @@ let globalEnv = loadEnv();
  * ```
  *
  */
-const loadAuthConfigFromEnv = (cnxName) => {
+const loadAuthConfigFromEnv = (cnxName, options) => {
     var _a;
     if (process.env.TEST_MODE === 'true') {
         globalEnv = loadEnv();
     }
-    if (connectionsEnv.connections.size > 0) {
-        return (cnxName === null || cnxName === void 0 ? void 0 : cnxName.trim()) ? connectionsEnv.default(undefined, [{ ...settings_1.DEFAULT_CONNECTION_MAP, connection: cnxName }]) : connectionsEnv.default();
-    }
-    // No connections provided, we need to populate the connections map with the old config settings
-    const result = (0, settings_1.applyDefaultSettings)((cnxName === null || cnxName === void 0 ? void 0 : cnxName.trim()) ? legacyPrefixEnv.process(globalEnv.env, cnxName) : globalEnv.legacyPrefixSettings);
+    const legacySettings = (cnxName === null || cnxName === void 0 ? void 0 : cnxName.trim())
+        ? configurationLayerSettings((0, botFrameworkEnvironmentCompatibility_1.loadBotFrameworkPrefixedEnvironmentConfiguration)(cnxName), cnxName)
+        : globalEnv.legacyPrefixSettings;
+    const external = externalOperations(options === null || options === void 0 ? void 0 : options.configurationContext);
+    const result = preserveEnvironmentRegistryIdentity(resolveAuthOperations([
+        external.fallback,
+        environmentOperation(legacySettings, cnxName),
+        external.overrideEnvironment,
+        external.enforce
+    ], cnxName), external, connectionsEnv.connections.size > 0 && !(cnxName === null || cnxName === void 0 ? void 0 : cnxName.trim()));
     if (cnxName && !result.clientId) {
         throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.ClientIdNotFoundForConnection, undefined, { connectionName: cnxName });
     }
@@ -379,18 +387,17 @@ exports.loadAuthConfigFromEnv = loadAuthConfigFromEnv;
  * ```
  *
  */
-const loadPrevAuthConfigFromEnv = () => {
+const loadPrevAuthConfigFromEnv = (options) => {
     if (process.env.TEST_MODE === 'true') {
         globalEnv = loadEnv();
     }
-    let result;
-    if (connectionsEnv.connections.size > 0) {
-        result = connectionsEnv.default();
-    }
-    else {
-        // No connections provided, we need to populate the connection map with the old config settings
-        result = (0, settings_1.applyDefaultSettings)(globalEnv.legacyBotFrameworkSettings);
-    }
+    const external = externalOperations(options === null || options === void 0 ? void 0 : options.configurationContext);
+    const result = preserveEnvironmentRegistryIdentity(resolveAuthOperations([
+        external.fallback,
+        environmentOperation(globalEnv.legacyBotFrameworkSettings),
+        external.overrideEnvironment,
+        external.enforce
+    ]), external, connectionsEnv.connections.size > 0);
     logger.info('Legacy auth settings loaded from environment', summarizeAuthConfiguration(result), result.connectionsMap);
     return result;
 };
@@ -419,22 +426,48 @@ exports.loadPrevAuthConfigFromEnv = loadPrevAuthConfigFromEnv;
  * ```
  *
  */
-function getAuthConfigWithDefaults(config) {
-    var _a;
+function getAuthConfigWithDefaults(config, options) {
+    var _a, _b, _c, _d, _e, _f;
+    if (config) {
+        validateDirectIssuerConfiguration(config);
+    }
     if (process.env.TEST_MODE === 'true') {
         globalEnv = loadEnv();
     }
-    let result;
-    if (!config) {
-        result = (0, exports.loadAuthConfigFromEnv)();
+    const external = externalOperations(options === null || options === void 0 ? void 0 : options.configurationContext);
+    const operations = [external.fallback];
+    if ((_a = config === null || config === void 0 ? void 0 : config.connections) === null || _a === void 0 ? void 0 : _a.size) {
+        operations.push(settingsOperation(globalEnv.legacyPrefixSettings));
+        if (!((_b = config.connectionsMap) === null || _b === void 0 ? void 0 : _b.length)) {
+            operations.push(environmentRouteOperation());
+        }
+        operations.push(external.overrideEnvironment);
+        operations.push(registryOperation(config));
+    }
+    else if (connectionsEnv.connections.size > 0) {
+        if (config) {
+            operations.push(settingsOperation(globalEnv.legacyPrefixSettings));
+        }
+        operations.push(environmentRegistryOperation());
+        operations.push(external.overrideEnvironment);
     }
     else {
-        const { connections, connectionsMap } = ((_a = config.connections) === null || _a === void 0 ? void 0 : _a.size) ? config : { connections: connectionsEnv.connections, connectionsMap: connectionsMapEnv.connectionsMap };
-        if (connections === null || connections === void 0 ? void 0 : connections.size) {
-            result = { ...globalEnv.legacyPrefixSettings, ...connectionsEnv.default(connections, connectionsMap) };
+        operations.push(settingsOperation(globalEnv.legacyPrefixSettings));
+        operations.push(external.overrideEnvironment);
+        if (config) {
+            operations.push(settingsOperation(config, true));
+        }
+    }
+    operations.push(external.enforce);
+    const result = preserveEnvironmentRegistryIdentity(resolveAuthOperations(operations), external, !((_c = config === null || config === void 0 ? void 0 : config.connections) === null || _c === void 0 ? void 0 : _c.size) && connectionsEnv.connections.size > 0);
+    const directParticipates = Boolean((_d = config === null || config === void 0 ? void 0 : config.connections) === null || _d === void 0 ? void 0 : _d.size) ||
+        connectionsEnv.connections.size === 0;
+    if (!external.hasAuth && config && directParticipates) {
+        if ((_e = config.connections) === null || _e === void 0 ? void 0 : _e.size) {
+            result.connections = config.connections;
         }
-        else {
-            result = (0, settings_1.applyDefaultSettings)({ ...globalEnv.legacyPrefixSettings, ...config });
+        if ((_f = config.connectionsMap) === null || _f === void 0 ? void 0 : _f.length) {
+            result.connectionsMap = config.connectionsMap;
         }
     }
     logger.info('Auth settings loaded from runtime configuration', summarizeAuthConfiguration(result), result.connectionsMap);