Promote Development to Staging (v0.261.027) - #1486
Merged
Merged
Conversation
Support OpenAI, Azure OpenAI, and Anthropic API contracts across global, personal, and group endpoint scopes with manual models, API-key authentication, runtime integration, and hardened outbound networking. Refs #1222 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Preserve the Custom model endpoint release notes alongside the latest Development history and advance the application version to 0.250.172. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Resolves the merge conflicts with Development (VERSION and release notes) and replaces the IS_DEVELOPMENT gate with a correct fix. Logout redirected to /.auth/logout and returned 404 whenever WEBSITE_AUTH_AAD_ALLOWED_TENANTS was set without Easy Auth actually running. That variable is configured by hand per the advanced environment variable guidance, so it was never evidence Easy Auth was intercepting requests. This affected production deployments, not just development ones. Detection now relies only on the X-MS-CLIENT-PRINCIPAL headers App Service injects into requests it intercepts, so Easy Auth logout is preserved wherever Easy Auth is genuinely active, including in development. Adds DISABLE_APP_SERVICE_EASY_AUTH_LOGOUT for deployments where Easy Auth is active but /.auth/* is not routed to the origin, plus debug logging of the logout path decision and a Logout Behavior Across Environments section in the local development guide. Also removes a customer hostname from the test fixture and replaces an exact VERSION assertion in the idle logout test with the shared version helper. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
v0.260.028
This prevents 404 error after logout.
…y prevent confusion.
Version and test updates.
v0.261.001
…load overloaded cosmos gate.
Fixed goofy github conflict
Updating with latest fixes to deploy to dev for testing
… workspace document uploads are fixed.
…smos gate is not overwhelmed when many documents are uploaded.
Promote Staging to main for v0.261.002
…ng that throws orderddict error.
Bumps [snowflake-connector-python](https://github.com/snowflakedb/snowflake-connector-python) from 3.18.0 to 3.18.1. - [Release notes](https://github.com/snowflakedb/snowflake-connector-python/releases) - [Commits](snowflakedb/snowflake-connector-python@v3.18.0...v3.18.1) --- updated-dependencies: - dependency-name: snowflake-connector-python dependency-version: 3.18.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
…updates Bumps the github-actions group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `3.7.0` | `7.0.1` | | [actions/setup-python](https://github.com/actions/setup-python) | `5` | `7` | | [tj-actions/changed-files](https://github.com/tj-actions/changed-files) | `46.0.1` | `47.0.6` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4` | `7` | | [actions/github-script](https://github.com/actions/github-script) | `7.1.0` | `9.0.0` | | [azure/login](https://github.com/azure/login) | `2.3.1` | `3.0.1` | | [Azure/setup-azd](https://github.com/azure/setup-azd) | `2.3.0` | `2.4.0` | | [actions/setup-node](https://github.com/actions/setup-node) | `4.4.0` | `7.0.0` | Updates `actions/checkout` from 3.7.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Commits](actions/checkout@v3.7.0...v7.0.1) Updates `actions/setup-python` from 5 to 7 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@v5...v7) Updates `tj-actions/changed-files` from 46.0.1 to 47.0.6 - [Release notes](https://github.com/tj-actions/changed-files/releases) - [Changelog](https://github.com/tj-actions/changed-files/blob/main/HISTORY.md) - [Commits](tj-actions/changed-files@2f7c5bf...9426d40) Updates `actions/upload-artifact` from 4 to 7 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v4...v7) Updates `actions/github-script` from 7.1.0 to 9.0.0 - [Release notes](https://github.com/actions/github-script/releases) - [Commits](actions/github-script@f28e40c...3a2844b) Updates `azure/login` from 2.3.1 to 3.0.1 - [Release notes](https://github.com/azure/login/releases) - [Commits](Azure/login@7184910...f5d393a) Updates `Azure/setup-azd` from 2.3.0 to 2.4.0 - [Release notes](https://github.com/azure/setup-azd/releases) - [Changelog](https://github.com/Azure/setup-azd/blob/main/CHANGELOG.md) - [Commits](Azure/setup-azd@634ad92...0b7e3a3) Updates `actions/setup-node` from 4.4.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@49933ea...8207627) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/github-script dependency-version: 9.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-python dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: azure/login dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: Azure/setup-azd dependency-version: 2.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: tj-actions/changed-files dependency-version: 47.0.6 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [pypdf](https://github.com/py-pdf/pypdf) from 6.15.0 to 6.16.1. - [Release notes](https://github.com/py-pdf/pypdf/releases) - [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md) - [Commits](py-pdf/pypdf@6.15.0...6.16.1) --- updated-dependencies: - dependency-name: pypdf dependency-version: 6.16.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
Documentation Updates
…t return to pass github security check.
CodeQL flagged the Redis connection test as an information-exposure and clear-text-logging source: the validation handler returned the exception text to the browser, and both handlers interpolated the raw exception into log_event, which CodeQL traces into the shared Application Insights sinks. Both handlers now pass the exception through sanitize_log_message before logging and reply with fixed messages. The route already returns specific 400s for a missing host, key, or Key Vault secret name before reaching the factory, so no actionable detail is lost. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
REDIS_TOKEN_REFRESH_BUFFER_SECONDS and _get_redis_entra_token_scope had no callers outside functions_redis_client, so the back-compat re-export only produced CodeQL py/unused-import noise. REDIS_ENTRA_TOKEN_SCOPE and RedisManagedIdentityCredentialProvider are still re-exported because existing callers and tests reference them through app_settings_cache. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
CodeQL traced the interpolated exception message from the Redis connection test into the shared Application Insights sinks as a clear-text-logging source, since the failing call chain resolves an access key or Key Vault secret. Both handlers now interpolate only the exception class name and pass exceptionTraceback=True, so Application Insights still captures the full exception and stack for diagnosis while no resolved credential material can reach the log message. This matches the _safe_error_summary pattern already used in functions_redis_monitoring. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
CodeQL py/unused-import: REDIS_ENTRA_TOKEN_SCOPE and RedisManagedIdentityCredentialProvider were re-exported for backward compatibility, but no production module imported them through app_settings_cache either before or after this change - on Development they were referenced only inside app_settings_cache itself and by one test. Both are dropped and the test now references them from functions_redis_client, where they are defined. The create_redis_managed_identity_client wrapper is kept, since app.py called it before this change. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…-migration Add Azure Managed Redis support alongside Azure Cache for Redis
Ground segments commonly publish Yamcs through a reverse proxy, such as Apache, that challenges every request with HTTP Basic authentication against a directory before the request reaches Yamcs. Yamcs behind that proxy often has no authentication of its own. The Yamcs action could authenticate to Yamcs but had no way to answer a front-door proxy challenge, so such a server was unreachable even when every Yamcs setting was correct. Adds an optional Reverse Proxy Authentication layer, independent of the Yamcs authentication method and off by default so a directly reachable server, such as a local simulator, is unaffected. Credentials can be entered inline, with the password stored in Key Vault, or supplied by a reusable username/password identity. The proxy credential gets its own identity reference, separate from the Yamcs credential, so one action can use both and a rotating temporary password is maintained once under Workspace > Identities instead of by editing the action. Proxy Basic auth combines with the none and api_key Yamcs methods. It is blocked for username_password and bearer_token: only one Authorization header can be sent, and the Yamcs token exchange would itself be refused by the proxy. The rule is enforced in the plugin, the health checker, the test-connection route, and the action modal, so the conflict surfaces before an agent depends on it. Implementation notes: - yamcs-client 2.1.0 already ships BasicAuthCredentials, so no dependency change is needed. It is imported separately from the other credential classes so a deployment on an older client keeps working for every non-proxy method. - basic_auth_password is registered in YAMCS_SENSITIVE_ADDITIONAL_FIELDS, which routes it through the existing Key Vault store, redact, retrieve, and delete handling. - The proxy identity reference is resolved inside validate_action_identity_reference and hydrate_action_identity_reference, so personal, group, and global action paths pick it up unchanged. UI hydration returns the identity username but never its password. - Turning the toggle off preserves the stored credential rather than blanking it, which would drop the Key Vault reference and orphan the secret. Fixes #1435 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Validate the OAuth2 token endpoint when the token is fetched, not only when the endpoint is saved. Checking at save time leaves the request itself unguarded, because settings can be written by another path, restored from backup, or changed after validation, so code scanning was right to call this a server-side request forgery. The token URL is now revalidated against the same outbound policy as the inference endpoint and the request runs on the same pinned transport, so its addresses are validated at connection time. That transport refuses redirects, which the previous code avoided on the stated grounds that token endpoints commonly redirect. That reasoning was wrong: redirects belong to the browser-based authorization-code flow, while a client-credentials token endpoint answers a server-to-server POST with a JSON body. A regression test now asserts a blocked token URL is refused before any HTTP client is constructed. Remove backtracking from the version-segment pattern. Its optional suffix could begin with a digit, making it ambiguous with the preceding digits and quadratic on a long run of them: 8,000 characters took about 0.19s to reject and now takes 0.0003s. Requiring the suffix to begin with a letter matches exactly the same segments. Move the auth-type constants and their normalizer to the provider registry so validation no longer imports the authentication module. That removes the real coupling behind several cyclic-import findings and lets the token fetch import validation normally rather than through a deferred import whose comment would otherwise have become untrue. Drop genuinely dead imports, and declare the deliberate re-exports in functions_model_endpoint_types with __all__, since functions_settings and the provider tests import those constants through it. Close file handles in tests and stop importing the same module both ways. The remaining cyclic-import findings are pre-existing: the same single nine-module cycle is present on Development, and none of the modules in this change participate in an import-time cycle. Refs #1228 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…ease Development published v0.261.010 and v0.261.011 for the Azure Managed Redis work while this branch was using the same numbers, so both release-notes sections and config.py collided. Development's sections are authoritative and are kept exactly as published. This branch's nine sections move above them, to v0.261.012 through v0.261.020, and config.py becomes 0.261.020. The restored PR #1228 entry is renumbered too: its original v0.261.010 claim was vacated when that PR was reverted, so it re-lands alongside the fixes stacked on it. Version references in this branch's tests and feature documentation are updated to match, so each still names the version its behaviour ships in. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
… through an exception' Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Add HTTP Basic authentication to the Yamcs action for proxied servers
…ease Development published v0.261.012 for the Yamcs basic authentication work while this branch was using that number for the restored PR #1228 entry, so the release notes and config.py collided again. Development's sections are kept exactly as published. This branch's nine sections shift up one, to v0.261.013 through v0.261.021, and config.py becomes 0.261.021. Version references in this branch's tests and feature documentation move with them. The sections belonging to this branch are now identified by content rather than by a hardcoded list of numbers, so a further collision while this PR is open is resolved the same way without guessing which sections are whose. The generated release-notes pages are rebuilt from the merged source rather than hand-resolved, since they are build output. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…nts-v2 Re-land Custom model endpoint provider with the provider-coverage gaps closed
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
The delegated permission GUIDs in Initialize-EntraApplication.ps1 were shifted by one entry, so the script configured permissions that did not match the names it logged: - "People.Read.All" used b340eb25-... which is actually User.ReadBasic.All - "User.ReadBasic.All" used b4e74841-... which is actually User.ReadWrite As a result People.Read.All was never granted, and User.ReadWrite - a write scope the application never uses - was granted instead. The app only requires User.Read, User.ReadBasic.All, People.Read.All and Group.Read.All (see SCOPE in application/single_app/config.py). All eight GUIDs verified against the Microsoft Graph service principal oauth2PermissionScopes. Bumps deployers/version.txt to 1.0.29.
Fix incorrect Microsoft Graph permission GUIDs in Entra app registration script
Preserve current Development export, approval, workflow, and streaming behavior while retaining fail-closed XSD ingestion and schema-validated XML publication. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Return only allowlisted XSD ingestion messages and status codes from chat uploads, with a safe fallback for unknown failures. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Add XSD ingestion and schema-driven XML generation
postconfig.py provisioned and RBAC-granted a Redis cache but never wrote the
settings the application reads, leaving a placeholder:
# Scale > Redis Cache
# todo support redis cache configuration
The App Service only receives REDIS_ENTRA_TOKEN_SCOPE, and configure_sessions()
in app.py reads enable_redis_cache and redis_url from the Cosmos settings
document. Those stayed False and empty, so every deployment that enabled Redis
silently fell back to filesystem sessions and in-memory caching.
postconfig now writes enable_redis_cache, redis_url, redis_auth_type,
redis_service_type, redis_port and redis_key when the deployment provisioned a
cache. It is skipped when no cache was provisioned so an operator-configured
external Redis is preserved.
The Bicep redisCacheKind parameter uses managed/classic while the application
uses azure_managed_redis/azure_cache_for_redis, so the value is translated
rather than passed through. Writing it through unchanged would resolve the
wrong TLS port (10000 vs 6380).
Adds functional_tests/test_postconfig_redis_cache_configuration.py, which also
cross-checks the identifiers against the SERVICE_TYPE constants in
functions_redis_client.py so the two vocabularies cannot drift apart.
Bumps deployers/version.txt to 1.0.30.
Write Redis cache settings during post-deployment configuration
Fixes #1472 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…invites Fix group-scoped conversation invite source storage
Fixes #1477 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
[BREAKING] Fix cross-worker settings consistency and Redis Explorer
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
DevelopmentintoStagingfor integration and release validation. At preparation time, the comparison contains 85 commits and 188 changed files;Developmentis not behindStaging.Source snapshot:
b7ee5d1b6808967668542d160fed39d85705b67e(Development).Target snapshot:
c3705afc05f13677813f772c4226b11f669b2be3(Staging).This is a draft branch-promotion PR, not approval to merge or deploy. The PR will track subsequent updates to
Development.Linked issue
No single linked issue; this PR consolidates changes already on
Development.Release Notes & Latest Features
Is this visible to end users?
Is this admin-facing (Admin Settings, governance, deployment, config)?
Latest Feature card and screenshot requirements: pending release-owner review of the included changes. Breaking-change classification also remains to be reviewed.
Version bump
application/single_app/config.pyVERSIONchanged from0.261.003to0.261.027deployers/version.txtchanged from1.0.26to1.0.30Testing / validation
Development->StagingPR before creation.Documentation
Security checklist
Pending reviewer validation; these items have not been independently verified as part of PR creation.
@swagger_route(security=get_auth_security())sanitize_settings_for_user()