src/vs/platform/agentHost/node/agentHostAuthenticationService.ts

121 LOC · 111 covered · 10 uncovered · 36 ranges · 917 concepts · 16 introducers · 483 tests

File neighbourhood

The centred file is linked to every concept that introduces one of its ranges, every test that runs code from the file, and the gray connector concepts standing between those tests and the file's own introducer concepts. Undirected links join concepts to every file where they introduce source and concepts to the tests they introduce; arrows show specialization between the displayed concepts and bridge only concepts omitted from this view. Concept colors match the source ranges below; connector concepts have no source color and are shown in gray.

Focused file, its introducer and connector concepts, their introduced files, and tests that run code from the file

In the embedded map, ordinary wheel input scrolls the page; use the visible controls to zoom and drag to pan. Open the full-screen map for canvas navigation: wheel pans, Ctrl/Command plus wheel zooms, and arrow keys pan when this region is focused. On touch screens, open the full-screen map to pan or pinch. If JavaScript or WebGL is unavailable, use the related-file, concept, and source links on this page.

Graph controls are ready.

Interactive rendering requires JavaScript and WebGL. Use the related-file, concept, and source links on this page while the interactive map is unavailable.

1 > /*--------------------------------------------------------------------------------------------- agentService.ts ×122
2 > * Copyright (c) Microsoft Corporation. All rights reserved.
3 > * Licensed under the MIT License. See License.txt in the project root for license information.
4 > *--------------------------------------------------------------------------------------------*/
5 >
6 > import type { ILogService } from '../../log/common/log.js';
7 > import type { AuthenticateParams, AuthenticateResult, IAgent, IAgentHostAuthTokenRequest } from '../common/agentService.js';
8 >
9 > interface IStoredAuthToken {
10 > readonly resource: string;
11 > readonly scopes: readonly string[];
12 > readonly token: string;
13 > }
14 >
15 > export class AgentHostAuthenticationService {
16 >
17 > private readonly _tokens = new Map<string, IStoredAuthToken>();
18 >
19 > constructor(
20 > private readonly _logService: ILogService, agentService.ts ×10
21 > ) { }
23 > async authenticate(params: AuthenticateParams, providers: Iterable<IAgent>): Promise<AuthenticateResult> {
24 > this._logService.trace(`[AgentHostAuthenticationService] authenticate called: resource=${params.resource}`); agentHostAuthenticationService.ts ×4
25 > const providerList = [...providers];
26 > // Multiple providers may share the same protected resource (e.g.
27 > // both Copilot CLI and Claude consume the GitHub Copilot token).
28 > // Fan out to every matching provider in parallel; the request is
29 > // considered authenticated if at least one accepts. Provider
30 > // failures are isolated -- one provider rejecting (e.g. proxy
31 > // server bind failure) MUST NOT prevent another provider from
32 > // accepting the same token.
33 > const matching = providerList.filter(
34 > p => p.getProtectedResources().some(r => r.resource === params.resource),
35 > );
36 > const settled = await Promise.allSettled(
37 > matching.map(p => p.authenticate(params.resource, params.token)),
38 > );
39 > let authenticated = false;
40 > for (let i = 0; i < settled.length; i++) {
41 > const result = settled[i]; agentHostAuthenticationService.ts ×3
42 > if (result.status === 'fulfilled') {
43 > authenticated ||= result.value; agentHostAuthenticationService.ts ×2
45 > this._logService.error( agentHostAuthenticationService.ts ×1
46 > result.reason,
47 > `[AgentHostAuthenticationService] Provider '${matching[i].id}' authenticate threw for resource=${params.resource}`,
48 > );
49 > }
51 > const sessionResourceHandlers = providerList.filter(p => p.handleAuthenticationToken); agentHostAuthenticationService.ts ×4
52 > const sessionResourceSettled = await Promise.allSettled(
53 > sessionResourceHandlers.map(p => p.handleAuthenticationToken ? p.handleAuthenticationToken(params) : Promise.resolve(false)),
54 > );
55 > for (let i = 0; i < sessionResourceSettled.length; i++) {
56 const result = sessionResourceSettled[i];
57 if (result.status === 'fulfilled') {
58 authenticated ||= result.value;
59 } else {
60 this._logService.error(
61 result.reason,
62 `[AgentHostAuthenticationService] Provider '${sessionResourceHandlers[i].id}' handleAuthenticationToken threw for resource=${params.resource}`,
63 );
64 }
65 }
66 > if (authenticated) { agentHostAuthenticationService.ts ×4
67 > const scopes = this._normalizeScopes(params.scopes); agentHostAuthenticationService.ts ×2
68 > this._tokens.set(this._key(params.resource, scopes), { resource: params.resource, scopes, token: params.token });
69 > }
70 > return { authenticated }; agentHostAuthenticationService.ts ×4
71 > }
73 > getAuthToken(request: IAgentHostAuthTokenRequest): string | undefined {
74 > const scopes = this._normalizeScopes(request.scopes); agentHostAuthenticationService.ts ×2
75 > const exact = this._tokens.get(this._key(request.resource, scopes));
76 > if (exact) {
77 > return exact.token; agentHostAuthenticationService.ts ×1
78 > }
79 > if (scopes.length === 0) { agentHostAuthenticationService.ts ×1
80 > return undefined; agentHostAuthenticationService.ts ×1
81 > }
83 > const requested = new Set(scopes);
84 > let best: IStoredAuthToken | undefined;
85 > for (const candidate of this._tokens.values()) {
86 > if (candidate.resource !== request.resource || candidate.scopes.length === 0) { agentHostAuthenticationService.ts ×3
88 > }
89 > if (!this._containsAll(candidate.scopes, requested)) { agentHostAuthenticationService.ts ×4
90 > continue;
91 > }
92 > if (!best || candidate.scopes.length < best.scopes.length) { agentHostAuthenticationService.ts ×3
93 > best = candidate; agentHostAuthenticationService.ts ×4
94 > }
97 > return best.token; agentHostAuthenticationService.ts ×4
98 > }
100 > // Compatibility for clients that resolved the right token before scopes
101 > // were forwarded through the authenticate command.
102 > return this._tokens.get(this._key(request.resource, []))?.token;
105 > private _containsAll(scopes: readonly string[], requested: ReadonlySet<string>): boolean {
106 > for (const scope of requested) { agentHostAuthenticationService.ts ×4
107 > if (!scopes.includes(scope)) {
108 > return false;
109 > }
110 > }
111 > return true;
112 > }
114 > private _key(resource: string, scopes: readonly string[]): string {
115 > return `${resource}\x00${scopes.join('\x00')}`; agentHostAuthenticationService.ts ×2
116 > }
118 > private _normalizeScopes(scopes: readonly string[] | undefined): readonly string[] {
119 > return scopes ? [...new Set(scopes)].sort() : []; agentHostAuthenticationService.ts ×2
120 > }