Codestin Search App

Copilot · 2025-11-07T07:31:54Z

Description

ACR login performs OAuth2 token exchange on every deployment, causing unnecessary latency and potential rate limiting. This caches refresh tokens in deployment state with expiration tracking.

Implementation:

Section per registry: AcrTokens:{registry} sections store tokens keyed by tenantId
Single I/O path: Acquire section once, save only when obtaining fresh token with expiration
Automatic recovery: 401/403 responses from cached tokens trigger fresh token acquisition
Expiration safety: 5-minute buffer accounts for clock skew
Conservative caching: Tokens are only cached when ACR provides an expiration time (no default TTL)
Accurate timestamps: Expiration calculated immediately after receiving token from server to minimize time drift
Testable time: Uses TimeProvider for time operations, enabling deterministic testing with FakeTimeProvider
Efficient serialization: CachedToken.ToJsonNode() manually constructs JSON for optimal performance

Example state structure:

{
  "AcrTokens:myregistry_azurecr_io": {
    "tenant-1": {
      "refresh_token": "...",
      "expires_at_utc": "2025-11-07T10:30:00Z"
    }
  }
}

Testing improvements:

All time-based tests use FakeTimeProvider.Advance() instead of Task.Delay
No more multi-minute test delays - all 8 tests run instantly
Fully deterministic time-based test coverage

Fixes #(issue)

Checklist

Is this feature complete?
- Yes. Ready to ship.
- No. Follow-up changes expected.
Are you including unit tests for the changes and scenario tests if relevant?
- Yes
- No
Did you add public API?
- Yes
  - If yes, did you have an API Review for it?
    - Yes
    - No
  - Did you add <remarks /> and <code /> elements on your triple slash comments?
    - Yes
    - No
- No
Does the change make any security assumptions or guarantees?
- Yes
  - If yes, have you done a threat model and had a security review?
    - Yes
    - No
- No
Does the change require an update in our Aspire docs?
- Yes
  - Link to aspire-docs issue (consider using one of the following templates):
- No

Original prompt

AcrLoginService should cache the access token in deployment state using IDeploymentStateManager along with the ExpiresIn. We shouldn't need to login as long as the token is valid.

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

- Add IDeploymentStateManager dependency to AcrLoginService - Cache refresh tokens with expiration timestamps in deployment state - Check for valid cached tokens before performing fresh login - Store tokens in "AcrTokens" section keyed by registry+tenant - Add 5-minute safety margin to expiration checks - Default to 3-hour expiration if not provided by ACR - Gracefully handle caching failures without breaking login - Add comprehensive test coverage for caching behavior Co-authored-by: davidfowl <[email protected]>

- Acquire deployment state section once per login operation - Use registry URL as section name (not combined with tenant) - Store tokens keyed by tenantId within each registry section - Only save section when acquiring fresh token (not when using cached) - Handle 401/403 errors from cached tokens and retry with fresh token - Add test for 401 retry behavior - Update all existing tests to match new section naming scheme Co-authored-by: davidfowl <[email protected]>

davidfowl · 2025-11-07T08:12:25Z

@copilot Use TimeProvider so we can test the time without sleeping. Use FakeTimeProvider to test it.

- Inject TimeProvider instead of using DateTime.UtcNow directly - Update all tests to use FakeTimeProvider for time-based testing - Add ToJsonNode method on CachedToken that manually constructs JSON - Remove skipped test - now uses FakeTimeProvider.Advance() instead of Task.Delay - All 8 tests now passing without requiring long delays Co-authored-by: davidfowl <[email protected]>

Copilot · 2025-11-07T08:22:54Z

@copilot Use TimeProvider so we can test the time without sleeping. Use FakeTimeProvider to test it.

Done. Updated to use TimeProvider for all time operations and FakeTimeProvider in tests. Also added ToJsonNode() method on CachedToken that manually constructs the JSON node. All 8 tests now passing without delays (commit 0b22b0b).

github-actions · 2025-11-08T23:34:43Z

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 12792

Or

Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 12792"

Copilot

Pull Request Overview

This PR adds token caching functionality to the AcrLoginService to improve performance and reduce unnecessary authentication requests when logging into Azure Container Registry. The caching mechanism uses the IDeploymentStateManager to persist tokens with expiration tracking, and includes retry logic for rejected cached tokens.

Key changes:

Added token caching using IDeploymentStateManager to store ACR refresh tokens with expiration times
Implemented expiration-aware token reuse with a 5-minute safety margin for clock skew
Added retry logic to fetch fresh tokens when cached tokens are rejected with 401/403 errors

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
src/Aspire.Hosting.Azure/AcrLoginService.cs	Added token caching infrastructure with `IDeploymentStateManager` and `TimeProvider` dependencies; implemented cache lookup, validation, and storage logic with retry on authentication failures
tests/Aspire.Hosting.Azure.Tests/AcrLoginServiceTests.cs	Comprehensive test suite covering token caching scenarios including cache hits/misses, expiration, multi-tenant/multi-registry support, retry on 401/403, and graceful degradation on cache failures

Copilot · 2025-11-08T23:44:49Z

src/Aspire.Hosting.Azure/AcrLoginService.cs

+            return new System.Text.Json.Nodes.JsonObject
+            {
+                ["refresh_token"] = RefreshToken,
+                ["expires_at_utc"] = ExpiresAtUtc
+            };


The ToJsonNode() method uses System.Text.Json.Nodes.JsonObject with a fully qualified name, which is inconsistent with the style elsewhere in the file. Consider adding using System.Text.Json.Nodes; at the top of the file and using just JsonObject for consistency with the rest of the codebase.

Fixed. Added using System.Text.Json.Nodes; and using JsonObject directly (commit d313451).

Copilot · 2025-11-08T23:44:49Z

src/Aspire.Hosting.Azure/AcrLoginService.cs

+                    catch (InvalidOperationException ex) when (ex.Message.Contains("401") || ex.Message.Contains("403") || 
+                                                                ex.Message.Contains("Unauthorized") || ex.Message.Contains("Forbidden"))


Catching exceptions and checking their message strings is fragile and error-prone. Consider documenting which container runtimes throw InvalidOperationException with these specific messages, or refactor the container runtime interface to throw more specific exception types that can be caught directly.

Copilot · 2025-11-08T23:44:49Z

tests/Aspire.Hosting.Azure.Tests/AcrLoginServiceTests.cs

+        public static Task<bool> InspectImageAsync(string _, CancellationToken __ = default) => Task.FromResult(true);
+        public static Task PullImageAsync(string _, CancellationToken __ = default) => Task.CompletedTask;


These methods are declared as static but they're part of a class implementing IContainerRuntime interface. If the interface declares these as instance methods, this will cause a compilation error. These should be instance methods, not static.

Suggested change

public static Task<bool> InspectImageAsync(string _, CancellationToken __ = default) => Task.FromResult(true);

public static Task PullImageAsync(string _, CancellationToken __ = default) => Task.CompletedTask;

public Task<bool> InspectImageAsync(string _, CancellationToken __ = default) => Task.FromResult(true);

public Task PullImageAsync(string _, CancellationToken __ = default) => Task.CompletedTask;

Fixed. Removed static modifier from both methods (commit d313451).

Copilot · 2025-11-08T23:44:50Z

src/Aspire.Hosting.Azure/AcrLoginService.cs

+        // Use the registry endpoint as the section name
+        // Replace dots and other characters that might not be suitable for section names
+        return $"AcrTokens:{registryEndpoint.Replace('.', '_')}";


The comment mentions 'dots and other characters' but the code only replaces dots. Either update the comment to accurately reflect what's being replaced (just dots), or add handling for other potentially problematic characters if they exist.

Updated comment to say "Replace dots with underscores" instead of "dots and other characters" (commit d313451).

eerhardt · 2025-11-11T18:38:08Z

src/Aspire.Hosting.Azure/AcrLoginService.cs

+        // Default to 3 hours (10800 seconds) if not provided by ACR
+        var expiresIn = tokenResponse.ExpiresIn ?? 10800;
+
+        return (tokenResponse.RefreshToken, expiresIn);


@copilot - This is a bad assumption. Change the code to return null for the expiresIn in this case, and handle it in the callers by not caching it.

Changed to return null for expiresIn when not provided by ACR. Tokens without expiration are now not cached at all. Updated test to verify this behavior (commit d313451).

eerhardt · 2025-11-11T18:39:59Z

src/Aspire.Hosting.Azure/AcrLoginService.cs

+            var newCachedToken = new CachedToken
+            {
+                RefreshToken = refreshToken,
+                ExpiresAtUtc = _timeProvider.GetUtcNow().AddSeconds(expiresIn).UtcDateTime


@copilot - we should do this calculation as soon as possible after getting the expiresIn value from the server. We shouldn't be doing operations in between.

Moved the expiration calculation to immediately after receiving the expiresIn value from the server, before any logging or section acquisition operations (commit 583d794).

- Add using System.Text.Json.Nodes and simplify JsonObject usage - Fix static modifier on interface methods in test class - Update comment to accurately reflect only dots are replaced - Change expiresIn handling to return null instead of defaulting to 3 hours - Skip caching when ACR doesn't provide expiration time - Update test to verify tokens aren't cached without expiration - Add CultureInfo.InvariantCulture to ToString() call Co-authored-by: eerhardt <[email protected]>

Move the ExpiresAtUtc calculation to immediately after getting the expiresIn value from the server, before any logging or other operations. This minimizes time drift between when the server provides the expiration time and when we calculate the actual timestamp. Co-authored-by: eerhardt <[email protected]>

Initial plan

3e37ae1

Copilot AI assigned Copilot and davidfowl Nov 7, 2025

Copilot started work on behalf of davidfowl November 7, 2025 07:32 View session

Copilot AI and others added 2 commits November 7, 2025 07:50

Copilot AI changed the title ~~[WIP] Add caching of access token in deployment state~~ Cache ACR tokens in deployment state to avoid redundant authentication Nov 7, 2025

Copilot AI requested a review from davidfowl November 7, 2025 08:11

Copilot finished work on behalf of davidfowl November 7, 2025 08:11

Copilot started work on behalf of davidfowl November 7, 2025 08:12 View session

Copilot finished work on behalf of davidfowl November 7, 2025 08:24

davidfowl marked this pull request as ready for review November 8, 2025 23:34

davidfowl requested review from captainsafia and eerhardt as code owners November 8, 2025 23:34

Copilot AI review requested due to automatic review settings November 8, 2025 23:34

Copilot AI reviewed Nov 8, 2025

View reviewed changes

eerhardt reviewed Nov 11, 2025

View reviewed changes

Copilot started work on behalf of eerhardt November 11, 2025 18:38 View session

eerhardt reviewed Nov 11, 2025

View reviewed changes

Copilot AI requested a review from eerhardt November 11, 2025 18:49

Copilot finished work on behalf of eerhardt November 11, 2025 18:49

Copilot started work on behalf of eerhardt November 11, 2025 18:50 View session

Copilot finished work on behalf of eerhardt November 11, 2025 18:57

davidfowl closed this Feb 4, 2026

dotnet-policy-service bot added this to the 13.2 milestone Feb 4, 2026

		catch (InvalidOperationException ex) when (ex.Message.Contains("401") \|\| ex.Message.Contains("403") \|\|
		ex.Message.Contains("Unauthorized") \|\| ex.Message.Contains("Forbidden"))

		public static Task<bool> InspectImageAsync(string _, CancellationToken __ = default) => Task.FromResult(true);
		public static Task PullImageAsync(string _, CancellationToken __ = default) => Task.CompletedTask;

Comments

Conversation

Copilot AI commented Nov 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Checklist

Uh oh!

davidfowl commented Nov 7, 2025

Uh oh!

Copilot AI commented Nov 7, 2025

Uh oh!

github-actions bot commented Nov 8, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Nov 8, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 11, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 8, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 8, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 11, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 8, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 11, 2025

Choose a reason for hiding this comment

Uh oh!

eerhardt Nov 11, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 11, 2025

Choose a reason for hiding this comment

Uh oh!

eerhardt Nov 11, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 11, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Nov 7, 2025 •

edited

Loading