Skip to content

Allow disabling AuthenticationProvider extension for workspace if not yet activated#293130

Closed
gjsjohnmurray wants to merge 5 commits into
microsoft:mainfrom
gjsjohnmurray:fix-269367
Closed

Allow disabling AuthenticationProvider extension for workspace if not yet activated#293130
gjsjohnmurray wants to merge 5 commits into
microsoft:mainfrom
gjsjohnmurray:fix-269367

Conversation

@gjsjohnmurray

Copy link
Copy Markdown
Contributor

This PR fixes #269367

If an extension contributing an AuthenticationProvider hasn't yet been activated then it is safe to disable for the current workspace.

Copilot AI review requested due to automatic review settings February 5, 2026 15:24

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR addresses issue #269367 by allowing workspace-level disabling of authentication provider extensions that haven't been activated yet. Previously, all authentication provider extensions were blocked from workspace-level disablement to prevent issues with Settings Sync.

Changes:

  • Added IExtensionService import to check extension activation status
  • Modified throwErrorIfCannotChangeWorkspaceEnablement to only prevent workspace-level disabling for auth provider extensions that are already activated
  • Made instantiationService a private readonly member to enable lazy service access

throw new Error(localize('cannot disable auth extension in workspace', "Cannot change enablement of {0} extension in workspace because it contributes authentication providers", extension.manifest.displayName || extension.identifier.id));
this.instantiationService.invokeFunction(accessor => {
const extensionService = accessor.get(IExtensionService);
if (extensionService.getExtensionsStatus()[extension.identifier.id]?.activationTimes) {

Copilot AI Feb 5, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The check should also verify activationStarted in addition to activationTimes. Currently, the code only prevents disabling if the extension has fully activated (when activationTimes is populated). However, if activation has started but not yet completed (activationStarted: true, activationTimes: undefined), the extension could be in an intermediate state and shouldn't be disabled either. Consider checking: if (extensionService.getExtensionsStatus()[extension.identifier.id]?.activationStarted)

Suggested change
if (extensionService.getExtensionsStatus()[extension.identifier.id]?.activationTimes) {
const status = extensionService.getExtensionsStatus()[extension.identifier.id];
if (status?.activationStarted || status?.activationTimes) {

Copilot uses AI. Check for mistakes.
Comment on lines +232 to +237
this.instantiationService.invokeFunction(accessor => {
const extensionService = accessor.get(IExtensionService);
if (extensionService.getExtensionsStatus()[extension.identifier.id]?.activationTimes) {
throw new Error(localize('cannot disable active auth extension in workspace', "Cannot change enablement of {0} extension in workspace because it contributes authentication providers and is already active", extension.manifest.displayName || extension.identifier.id));
}
});

Copilot AI Feb 5, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The new logic allows workspace-level disabling of non-activated auth provider extensions, which changes existing behavior. The test at line 540 in extensionEnablementService.test.ts ('test canChangeWorkspaceEnablement return false for auth extension') will now fail because it expects all auth extensions to be non-changeable at workspace level, but with these changes, non-activated auth extensions should be changeable. New test coverage is needed to verify: 1) auth extensions that are not activated can be disabled at workspace level, and 2) auth extensions that are activated cannot be disabled at workspace level.

Copilot uses AI. Check for mistakes.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I do not think we should access IExtensionService here. This caused cyclic dependency. The way you are using is a hack. Can you please explain why you need this?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I want to discover whether the extension has already been activated. The extension service seemed to offer a way to do this. Initially I tried adding that service to the constructor but this flagged a cyclical dependency. So instead I am getting the service when I need it, which is a pattern I found in other places in the codebase.

If you don't think this is the right thing to do please suggest an alternative.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you please remind me why we need to know if the extension is activated or not? Sorry that if it is mentioned already and me asking it again.

@sandy081 sandy081 added this to the March 2026 milestone Feb 23, 2026
@sandy081 sandy081 modified the milestones: 1.111.0, On Deck Mar 5, 2026
@sandy081

sandy081 commented Mar 9, 2026

Copy link
Copy Markdown
Member

@gjsjohnmurray Probably the right fix here is to allow disabling extensions contributing auth providers which are not settings sync providers?

@gjsjohnmurray

Copy link
Copy Markdown
Contributor Author

@sandy081 that sounds good. If you give me a pointer I'm willing to try that strategy instead. However after Thursday I shall be OOO for 2 weeks.

@sandy081

Copy link
Copy Markdown
Member

@gjsjohnmurray Here you go -

readonly authenticationProviders: IAuthenticationProvider[];

@gjsjohnmurray

Copy link
Copy Markdown
Contributor Author

Closed unmerged in favour of #320415 which implements this feedback above from @sandy081

Probably the right fix here is to allow disabling extensions contributing auth providers which are not settings sync providers?

@gjsjohnmurray gjsjohnmurray deleted the fix-269367 branch June 8, 2026 14:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Not permitted to disable an extension at workspace level if it contributes an authentication provider

3 participants