fix: derive OIDC ALLOWED_HOSTS from connection string hostname instead of hardcoded *.azure.com (fixes #639)

[hanhan761]

Summary

The OIDC \ALLOWED_HOSTS\ was hardcoded to ['*.azure.com']\ in two places, blocking Entra ID authentication for sovereign clouds (*.azure.cn, *.azure.us), private endpoints, and custom domains.

Changes

• New shared helper \getOidcAllowedHosts()\ in \src/documentdb/auth/oidcAllowedHosts.ts\ that extracts the hostname from the connection string
• Updated \MicrosoftEntraIDAuthHandler.ts\ to use the helper
• Updated \playgroundWorker.ts\ to use the helper
• Falls back to ['*.azure.com']\ if the connection string cannot be parsed

Issue

Fixes #639

Verification

• The two \ALLOWED_HOSTS\ literals are replaced with a single shared helper (prevents drift)
• Sovereign cloud hostnames are now correctly allowed (e.g., \mycluster.mongo.cosmos.azure.cn)
• No new runtime dependencies — uses built-in \URL\ for hostname extraction

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Replaces the hardcoded ['*.azure.com'] OIDC ALLOWED_HOSTS list with a helper that derives the allowed host from the actual connection string, enabling OIDC against sovereign clouds, private endpoints, and custom domains.

Changes:

• Adds a new getOidcAllowedHosts helper that parses the connection string and falls back to ['*.azure.com'] on failure.
• Uses the helper in both MicrosoftEntraIDAuthHandler and the playground worker in place of the hardcoded list.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
src/documentdb/auth/oidcAllowedHosts.ts	New helper to extract the OIDC allowed host from a connection string with a safe fallback.
src/documentdb/auth/MicrosoftEntraIDAuthHandler.ts	Switches the OIDC auth handler to use the new helper.
src/documentdb/playground/playgroundWorker.ts	Switches the playground worker to use the new helper.