Secure handling and validation of protected secrets #150
+456
−124
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Validate existing client secrets for blueprints; create new secret only if invalid or expired - Decrypt protected secrets before writing to .env/appsettings.json for Python, Node.js, and .NET projects - Refactor FIC creation logic for clarity and idempotency - Lower log level for existing FIC detection to Debug - Add tests to verify correct decryption and writing of secrets for all supported platforms - Improves security, reliability, and test coverage of secret management
Contributor
There was a problem hiding this comment.
Pull request overview
This PR enhances secret management security by validating existing client secrets before creating new ones, properly decrypting protected secrets before writing them to configuration files, and refactoring Federated Identity Credential (FIC) creation logic for improved clarity and idempotency.
Key changes:
- Implements client secret validation with retry logic to avoid unnecessary secret regeneration for existing blueprints
- Adds secret decryption calls in ProjectSettingsSyncHelper for Python, Node.js, and .NET projects to ensure plaintext secrets are written to .env and appsettings.json files
- Refactors FIC creation logic to use a unified code path for both new and existing blueprints, simplifying the implementation
- Adds comprehensive test coverage for protected and unprotected secret handling across platforms
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| ProjectSettingsSyncHelperTests.cs | Adds six new test methods verifying correct decryption and writing of protected/unprotected secrets for Python, Node.js, and .NET platforms |
| FederatedCredentialService.cs | Changes log level from Information to Debug for existing FIC detection to reduce log noise |
| ProjectSettingsSyncHelper.cs | Adds SecretProtectionHelper.UnprotectSecret calls to decrypt secrets before writing to .env files (Python/Node.js) with logger parameter additions |
| BlueprintSubcommand.cs | Implements ValidateClientSecretAsync method for secret validation, adds conditional secret creation logic, and simplifies FIC creation with unified retry logic |
src/Tests/Microsoft.Agents.A365.DevTools.Cli.Tests/Helpers/ProjectSettingsSyncHelperTests.cs
Show resolved
Hide resolved
src/Microsoft.Agents.A365.DevTools.Cli/Commands/SetupSubcommands/BlueprintSubcommand.cs
Outdated
Show resolved
Hide resolved
src/Microsoft.Agents.A365.DevTools.Cli/Commands/SetupSubcommands/BlueprintSubcommand.cs
Outdated
Show resolved
Hide resolved
Refactored BlueprintSubcommand to decrypt secrets and create HttpClient outside the retry loop, improving efficiency and preventing socket exhaustion. Added a test to ProjectSettingsSyncHelperTests to verify that unprotected client secrets are written as-is to appsettings.json.
mengyimicro
approved these changes
Jan 9, 2026
skg-marimuthu
approved these changes
Jan 9, 2026
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #148