[CmdPal] Add OAuth sign-in sample and authentication spec (Phase 4) - #49443
Draft
Michael Jolley (michaeljolley) wants to merge 1 commit into
Draft
Conversation
github-actions
Bot
added
the
Product-Command Palette
Phase 4 of the built-in Command Palette authentication feature. Sample (SamplePagesExtension): - SampleOAuthPage: entry page that offers a demo sign-in and shows a graceful message when the host does not support authorization. - OAuthSignInCommand: runs Authorization Code + PKCE via the Toolkit OAuthClient (secretless public client, loopback redirect, Duende public demo defaults), optionally persists with CredentialManagerTokenStore, then calls ExtensionHost.GoToPageAsync to navigate to the signed-in page. - SampleSignedInPage: landing page rendering non-sensitive session facts only (never the raw token). - Registered the entry page in SamplesListPage. Docs: - src/modules/cmdpal/doc/authentication.md: feature spec covering the host-broker vs Toolkit split, a mermaid sequence diagram, the SDK contract, capability detection, the security model, token-storage guidance, and a bring-your-own-provider GitHub example. The sample is illustrative. Running it needs a real identity provider and an interactive browser sign-in, so the live flow was not runtime verified. Co-authored-by: Copilot App <[email protected]> Copilot-Session: 2ee31cb3-848f-43ba-ac48-f4e4485baa33
Michael Jolley (michaeljolley)
force-pushed
the
dev/mjolley/cmdpal-auth-sample
branch
from
July 22, 2026 02:57
efafb9f to
19af73e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Phase 4 (final phase) of the built-in Command Palette authentication feature. This is a stacked draft PR on top of Phase 3 (
dev/mjolley/dev-mjolley-cmdpal-auth-nav).It adds a demonstration OAuth sign-in sample to
SamplePagesExtensionand the feature spec doc.Sample (
src/modules/cmdpal/ext/SamplePagesExtension)SampleOAuthPage(entry page): offers a demo sign-in, and shows a graceful "not available" message whenExtensionHost.SupportsAuthorizationis false.OAuthSignInCommand: runs Authorization Code + PKCE via the Phase 1 ToolkitOAuthClient(secretless public client, loopback redirect). Defaults target the Duende IdentityServer public demo (demo.duendesoftware.com,interactive.public, scopeopenid profile); the constants are labeled as demo values and can be swapped for a developer's own registered client. On success it optionally persists viaCredentialManagerTokenStore(guarded), then calls the Phase 3ExtensionHost.GoToPageAsync(new SampleSignedInPage(token), NavigationMode.Push).SampleSignedInPage: aContentPage+MarkdownContentlanding page that renders non-sensitive session facts only (token type, scope, expiry, whether a refresh/id token was received). It never renders the raw token.SamplesListPage.cs.Docs
src/modules/cmdpal/doc/authentication.md: feature spec covering the host-broker vs Toolkit split, a mermaid sequence diagram of the full flow, the SDK contract (IExtensionHost2,IAuthorizationRequest/IAuthorizationResult,AuthorizationRedirectKind,NavigationMode), capability detection andNotSupportedExceptionbehavior, the security model (PKCE, single-use host-ownedstate, redirect_uri binding, 127.0.0.1-only loopback, no host token storage, timeout caps), token-storage guidance (ITokenStore/CredentialManagerTokenStore+ PasswordVault size caveat), and a bring-your-own-provider GitHub example.No secrets are committed (PKCE public client only). No emdashes.
Verification
tools\build\build.ps1 -Path src\modules\cmdpal -Platform x64 -Configuration Debug-> exit code 0.*.UnitTestsrun with--no-build(built MTP DLLs via the x64 dotnet host): 2483 total, 0 failed, 2481 passed, 2 skipped (pre-existing skips in Shell and Toolkit).Ext.WindowWalkerreports 0 tests (no test methods), as expected.Honest caveat
An interactive OAuth flow cannot be verified end to end in an unattended session (it requires a human to sign in via a browser against a real IdP). The live sign-in was NOT runtime verified. The verification bar met here is build exit 0 plus green unit tests. The sample and its comments describe it as illustrative.