FIX: surface auth config fetch failures instead of treating them as auth-disabled - #2460
Open
fei (feiiiiii5) wants to merge 3 commits into
Open
FIX: surface auth config fetch failures instead of treating them as auth-disabled#2460fei (feiiiiii5) wants to merge 3 commits into
fei (feiiiiii5) wants to merge 3 commits into
Conversation
Roman Lutz (romanlutz)
changed the title
… them as auth-disabled fetchAuthConfig collapsed both non-2xx responses and network errors into an empty AuthConfig, which AuthProvider interpreted as "authentication disabled". When /api/auth/config failed transiently while protected APIs returned 401, the app rendered the normal shell with raw "Missing or invalid Authorization header" text and no login control or error surface (microsoft#2441). The two failure paths now throw so the existing AuthProvider catch renders its Authentication Error page. A 200 response with an empty config still means auth is disabled (local dev), unchanged. Fixes microsoft#2441 Signed-off-by: fei <204683769+feiiiiii5@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Roman Lutz (romanlutz)
force-pushed
the
fix/auth-config-fetch-failure
branch
from
August 22, 2026 13:15
0458e23 to
a6519ab
Compare
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Roman Lutz (romanlutz)
approved these changes
Aug 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Root Cause
fetchAuthConfig()infrontend/src/auth/msalConfig.tscollapsed both non-2xx responses and network errors into an emptyAuthConfig.AuthProviderreads an empty config as "authentication disabled", so a transient failure of/api/auth/configrendered the normal app shell while protected APIs returned rawMissing or invalid Authorization headertext — no login control, no error surface, no recovery path (#2441).Fix
The two failure paths in
fetchAuthConfignow throw with contextual messages instead of returning an empty config. The existingAuthProvidercatch already renders its Authentication Error page for thrown errors, so it picks this up unchanged.A 200 response carrying an empty config still means auth is disabled (local development), and that path is unchanged.
Test
fetchAuthConfigtests that asserted the old swallow behaviour: non-2xx and network-error now expect rejects with the contextual messages.msalConfig.test.ts+AuthProvider.test.tsx: 22/22 passing locally."shows error when initialization fails with Error"provider test covers the consumer side of the new throw path.Diff Scope
frontend/src/auth/msalConfig.ts: failure paths throw (+ comments explaining why)frontend/src/auth/msalConfig.test.ts: two regression tests updated to the new contractDevelopment was AI-assisted with human review of all changes.
Fixes #2441