Add opt-in API test authentication providers

[Prangshuman Das (t-prda)]

Purpose

AB#646383

Add opt-in authentication to Library - Graph Mgt. without API re-enablement or pipeline changes.

Design

• Default None preserves existing behavior. The public enum/interface and public API Test Auth Context retain external provider extensibility.
• The Microsoft provider stays Internal; context Apply stays internal. Internal visibility is API encapsulation, not authorization.
• Credential precedence remains container file, then existing Key Vault only if the file is absent. Invalid configured credentials fail; successful passwords remain instance-scoped SecretText.
• File credentials now use a private file-mapping provider directly, without replacing or clearing the session-wide Azure Key Vault provider/cache. No extra AL plaintext copy is introduced.
• OnAfterInitializeWebRequestWithURL remains last. The pre-existing empty Graph OnRun is restored.

The trust boundary is admitted OnPrem test code and environment credential access, not Internal visibility or a destination-URL restriction.

Tests and scope

All six AL contracts remain: default None, event ordering, provider reuse, instance scoping, same-provider reselection and deselection.
The dedicated recorder is removed. The non-SingleInstance internal mock publishes the test-only OnAfterConfigureAuthentication event; the same manually bound test-codeunit instance owns Library - Variable Storage for both recording and verification. Initialization clears that instance's queue after prior failures; each contract drains it and calls AssertEmpty.

The six source-pattern PowerShell checks are removed, not replaced by other AL-text assertions. The real 401/200/401 HTTP scenario is owned by uptake #11860 after credential provisioning; core has no dependency on that future workflow. This is not a claim of a complete provider-branch matrix.

No caller migration, URL repair, credential provisioning, scheduling, exclusion or work-date rollout belongs to this core.

Native stack #11893: #10085 auth core -> #11862 URL/fixture prerequisites -> #11891 workflow infrastructure -> #11860 AL uptake -> #11224–#11230 -> #11322 -> #11451–#11454.

Current checkpoint

Head 4a76bb71851c158083dbe4d22e84bf40a0577842, tree 12739039e502a3feeea9e98694fb360ea959c606.

Merged main baseline remains 0a602a2481c93ebfe7b1d27d6016fb9926c42111 (permission cleanup from PR 11561). No additional main merge or code changes were made during finalization. Old b195c7a/4eef8ac tree-equality claims remain obsolete after the intentional baseline/auth changes.

Verified AL compile/publish/test run 36131334134 succeeded, attempt 2, at exact validation head 4a76bb71851c158083dbe4d22e84bf40a0577842. 113/113 test jobs and 113/113 cleanup steps succeeded. Core has no credential-file provisioning/removal step (expected).

W1 artifacts verify all 6 auth contracts.

Local Pester at the applicable checkpoint: 28 passed, zero failed/skipped. Core local Pester: 28 passed; no unsupported claim about a separate root PowerShell workflow.

Validation limits

For uptake/full, CU139496 MicrosoftAuthenticationRespectsServerAuthMode is verified in the actual UserPassword fixture (401/200/401). The Windows 200/200/200 expectations are implemented but Windows runtime remains unverified; no foreign local NST was used. Successful GitHub runs do not establish universal native NAV coverage. Excluded PDF cases, country-specific absent/excluded cases and tolerated-native distinctions are not claimed passing. No PR has been merged or auto-merged; validation drafts remain Do Not Merge outside stack #11893.

[Copilot]

Pull request overview

This PR centralizes Basic authentication injection for Library - Graph Mgt-based API tests so they can run in NavUserPassword (UserPassword) containers, and then re-enables several previously disabled API/E2E test suites. It replaces an app-specific Expense Agent auth helper with a shared TestLibraries subscriber and adds a container-side “credential bridge” file so the test runner can obtain the password without requiring Azure Key Vault.

Changes:

• Added Library - Graph Auth Mgt. as an event subscriber to inject Basic auth for non-Windows test users, sourcing the password from a container file or (fallback) Azure Key Vault.
• Removed the Expense Agent test-only auth helper + manual subscription binding; tests now rely on the shared subscriber.
• Re-enabled multiple API/E2E test suites by removing entries from various *.DisabledTest.json files (and deleting the APIV1/APIV2 exclusion lists), and updated container provisioning to create the API-test password bridge file.

Reviewed changes

Copilot reviewed 14 out of 15 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/Layers/W1/Tests/TestLibraries/LibraryGraphAuthMgt.Codeunit.al	New shared subscriber that injects Basic auth into Library - Graph Mgt requests for NavUserPassword scenarios.
build/scripts/NewBcContainer.ps1	Writes the container password bridge file and sets ACLs so server-side AL can read it.
src/Apps/W1/ExpenseAgent/test/src/Helper/ExpenseAPITestAuthHelper.Codeunit.al	Removes app-specific auth injection helper in favor of shared TestLibraries implementation.
src/Apps/W1/ExpenseAgent/test/src/API/ExpenseUsersAPITest.Codeunit.al	Drops manual subscription binding to the removed helper.
src/Apps/W1/ExpenseAgent/test/src/API/ExpenseProjectsAPITest.Codeunit.al	Drops manual subscription binding to the removed helper.
src/Apps/W1/ExpenseAgent/test/src/API/ExpensePerDiemLocationsTest.Codeunit.al	Drops manual subscription binding to the removed helper.
src/Apps/W1/ExpenseAgent/test/src/API/ExpenseCapabilitiesAPITest.Codeunit.al	Drops manual subscription binding to the removed helper.
src/DisabledTests/Tests-Integration/Tests-Integration.DisabledTest.json	Re-enables specific integration API tests by removing disable entries.
src/DisabledTests/Tests-Graph/Tests-Graph.DisabledTest.json	Re-enables specific Graph E2E tests by removing disable entries.
src/DisabledTests/Sustainability_Tests/Sustainability_Tests.DisabledTest.json	Re-enables Sustainability API tests by removing disable entries.
src/DisabledTests/Quality_Management-Tests/Quality_Management-Tests.DisabledTest.json	Re-enables Quality Management API tests by removing disable entry.
src/DisabledTests/IRS_Forms_Tests/IRS_Forms_Tests.DisabledTest.json	Re-enables IRS 1099 API test by removing disable entry.
src/DisabledTests/E-Document_Core_Tests/E-Document Core Tests.DisabledTest.json	Re-enables E-Document API tests by removing disable entry.
src/DisabledTests/_Exclude_APIV2__Tests/_Exclude_APIV2__Tests.DisabledTest.json	Deletes the APIV2 exclusion list (re-enables APIV2 suite).
src/DisabledTests/_Exclude_APIV1__Tests/_Exclude_APIV1__Tests.DisabledTest.json	Deletes the APIV1 exclusion list (re-enables APIV1 suite).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Prangshuman Das (t-prda)]

Agentic PR Review - Round 1

Recommendation: Accept

What this PR does

This PR adds an explicit authentication bridge for API tests that use Library - Graph Mgt. in BCApps UserPassword containers. The subscriber is manual, each affected API test codeunit opts in, Windows-authenticated NAV gates keep their existing behavior, and local NAV UserPassword runs can use the existing Key Vault secret.

The change addresses the gate difference directly. It does not change application API behavior, and it avoids making partner test code automatically depend on the BCApps credential bridge.

Suggestions

None.

Risk assessment and necessity

Risk: The change touches shared test infrastructure and re-enables many existing suites, so CI isolation and concurrency failures may still need separate gate work. The authentication subscriber itself is manually scoped and internal.

Necessity: The change is required because BCApps runs these tests with UserPassword while NAV's normal uptake gates use Windows authentication. Without the bridge, the API suites fail with 401 responses and remain disabled.

---

[AI-PR-REVIEW] version=1 promptVersion=1 system=github pr=10085 round=1 by=t-prda at=2026-08-12T09:27:33Z lastSha=6fe7981474d813fcafab57bc6e6fa0c429df80a5 reviewKey=e0d301ad1af589367637a08b287af9af4fb26402df7532abc2876a0a48dbabc7 suggestions=none

[Prangshuman Das (t-prda)]

Implemented the approved Round 19 follow-ups and refreshed the stack baseline.

• S9: 595eda2 reads the container file through a private mock secret-provider instance directly into SecretText. It never installs that provider into the session Azure Key Vault singleton or clears its cache, so both success and failure leave the existing provider intact. File-first / Key-Vault-only-when-file-absent precedence and instance caching remain unchanged.
• S10: [API tests] Adopt shared authentication and re-enable scoped AL tests #11860 adds CU139494.MicrosoftAuthenticationIsRequiredForHttpRequest: actual service requests must return 401/200/401 for None/Microsoft/None. It fails on Windows/SaaS instead of silently passing and needs no fixture writes or new isolation. It is intentionally in uptake after credential provisioning: core cannot rely on the later workflow's random container credential file.
• Dedicated recorder and six AL-source-pattern PowerShell checks removed. The same bound test instance owns recording, dequeue assertions, AssertEmpty and initialization/failure-boundary clearing. All six contracts and five later URL tests remain; the internal non-SingleInstance mock owns the only new test event.
• Empty Graph OnRun restored; public context/enum/interface retained, Apply and Microsoft provider internal.

Main 0a602a2481c93ebfe7b1d27d6016fb9926c42111 (including #11561 permission cleanup) was honestly merged into core and forward-propagated through native stack #11893. All 19 review/validation branch refs were published atomically without force; no PR merged or auto-merged. #11862 retains its 18-file prerequisite patch, #11891 remains workflow-only, and #11860 owns adoption plus the real request regression.

Local Pester: core 28, workflow 95, uptake 98, zero failures/skips. Fresh GitHub AL compile/publish/test runs are started/pending; the new HTTP runtime result is not yet verified. Earlier successful trees are historical after this intentional baseline/auth update.

[github-actions]

Issue #11561 is not valid. Please make sure you link an issue that exists, is open and is approved.

[github-actions]

Issue #11561 is not valid. Please make sure you link an issue that exists, is open and is approved.

[alexei-dobriansky]

Good Sense Reviewer - Round 20

Recommendation: Accept with Suggestions

What this PR does

This round isolates container credential reading from the session-wide Azure Key Vault provider and moves authentication-call recording into the manually bound test instance. It also restores the required namespace and typed conversion needed by the new credential and mock-provider code.

The private file-mapping provider addresses the shared-state problem from the previous round: it reads the configured file without replacing or clearing the existing provider or cache. Authentication is still applied through the existing Http Web Request Mgt.AddBasicAuthentication path before the final request event, and no BaseApp event publisher or timing contract is changed.

Status of previous suggestions

ID	Title	Status	Author response
S1	Separate the production report change	Addressed	The unrelated production change is not in the net PR diff.
S2	Cache the mock Key Vault setup	Addressed	Successful credentials remain cached on the retained provider instance.
S3	Keep the affected-app test exact	Addressed	Caller migration and suite enablement remain outside this narrowed change.
S4	Clarify the E-Doc Graph variables	Addressed	The related caller changes are not in the net PR diff.
S5	Clean up the container password file	Addressed	Credential-file provisioning and cleanup are outside this authentication core.
S6	Narrow the transient error match	Addressed	Retry and test-runner error handling are outside this narrowed change.
S7	Use separate clean-test result files	Addressed	Clean-tenant execution and result aggregation are outside this narrowed change.
S8	Plaintext SecureString fixture fails code scanning	Addressed	The affected PowerShell credential fixture is not in the net PR diff.
S9	Restore Key Vault provider after container read	Addressed	The file is now read through a private provider without changing the session provider or cache.
S10	Verify authentication reaches the request	Disputed	A later stacked change will validate the real 401/200/401 request sequence after credential provisioning; this PR still has no direct request assertion.

New observations (commits since round 19)

None. The new commits address the shared Key Vault state and test-recorder design without introducing another material issue.

Risk assessment and necessity

Risk: Existing callers retain the None default, and authentication remains opt-in per Library - Graph Mgt. instance. The private credential reader removes the main shared-session risk. The remaining non-blocking risk is test coverage: the tests verify provider selection, reuse, deselection, and event ordering, but the real request effect is deferred to a later stacked change. Exact-head AL builds are still running, with no current failures.

Necessity: UserPassword test environments need reusable request credentials while Windows and SaaS environments preserve ambient authentication. This is a focused and necessary foundation, although caller migration and actual API-suite enablement remain later work.

[AI-PR-REVIEW] version=1 promptVersion=4 system=github pr=10085 round=20 by=alexei-dobriansky at=2026-09-25T12:16:59Z lastSha=4a76bb71851c158083dbe4d22e84bf40a0577842 reviewKey=0577eb8ed2c6a9365605230f229eba81e04e4359c42b5147fcbed60db9b05fd6 suggestions=S9@9a9e057a:addressed,S10@b5b6666a:disputed parentRound=19

[Prangshuman Das (t-prda)]

Final validation update for Round20/S10 (supersedes the earlier pending-runtime comment):

• Auth core4a76bb71851c158083dbe4d22e84bf40a0577842: AL run36131334134 succeeded (attempt2), all6 auth contracts verified.
• The real-request assertion intentionally remains uptake-owned after credential provisioning, not in the core. CU139496 MicrosoftAuthenticationRespectsServerAuthMode passed its actual UserPassword401/200/401 sequence in uptake run36162562150 at f846c7b and full run36162564729 at da6d82d; both succeeded (attempt2). Windows200/200/200 is implemented, but Windows runtime is still unverified.
• All four final AL runs succeeded, each with113 test jobs and cleanup steps. Core has no credential-file step; workflow/uptake/full each verified113 credential removals.
• Private Key Vault reading preserves session provider/cache; bound test-owned queue and non-SingleInstance test-only OnAfterConfigureAuthentication mock remain. The empty Graph OnRun is retained and six source-pattern auth checks stay removed. No production/public test event was added.

S10 is therefore validated at its approved stack boundary; no additional core source change is proposed. Exact-head details and native/PDF/exclusion limits are now in the PR descriptions.

[alexei-dobriansky]

Good Sense Reviewer - Reply

Thanks for the details. Response to your point:

• S10 - Agree. The core applies the configured Basic authentication before the final request event, while the credential-provisioned uptake test verifies the real 401/200/401 request sequence. This is the correct stack boundary, so I withdraw this point.

---

[AI-PR-REPLY] version=1 promptVersion=4 system=github pr=10085 reviewRound=20 by=alexei-dobriansky at=2026-09-27T12:05:45Z respondsTo=2026-09-27T10:32:43Z reviewKey=0577eb8ed2c6a9365605230f229eba81e04e4359c42b5147fcbed60db9b05fd6

[github-actions]

⚠️ Stale Status Check Deleted

The Pull Request Build workflow run for this PR was older than 72 hours and has been deleted.

📋 Why was it deleted?

Status checks that are too old may no longer reflect the current state of the target branch. To ensure this PR is validated against the latest code and passes up-to-date checks, a fresh build is required.

---

🔄 How to trigger a new status check:

1. 📤 Push a new commit to the PR branch, or
2. 🔁 Close and reopen the PR

This will automatically trigger a new Pull Request Build workflow run.