Azure: scoped delegation in the Share panel no longer fails with 503 (#182)

With org-scoped access on, every /api/delegations request failed at once
with 503 DatabaseUnavailable, even with the database online. mssql's
ConnectionPool deep-copies its config with rfdc, which copies only own
enumerable properties into plain objects, so the getToken that
ManagedIdentityCredential defines on its prototype was lost. tedious then
refused the copy: 'The "config.authentication.options.credential" property
must be an instance of the token credential class.' That isn't an error a
resuming database gives, so the store gave up on the first attempt.

SqlScopeStore now hands the driver an object with a getToken of its own
that calls the credential it uses, injected or the managed identity, and
that survives the copy.

The new test drives the real mssql and tedious with a credential whose
getToken is on its class's prototype. A connector that refuses keeps it
offline: no name lookup, no socket. It fails without the fix and passes
with it.

Co-authored-by: Keith Mcgrane <keithmcgrane@microsoft.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: 3 people

CHANGELOG.md

@@ -252,6 +252,18 @@ sets the number. On Fabric and Azure.
   **Reset filters**, and goes back to this default. Smaller tenants still start on **All dates**.
   Consumption Central and the Agent Evaluator keep every date until you choose a range.
 
+**Fixed:**
+
+- **Azure: scoped delegation in the Share panel no longer fails with 503.** With org-scoped access
+  on, the panel couldn't show, give, take back or approve scopes: each request failed at once with
+  "Couldn't reach the Analytics Hub database. Try again in a minute.", even with the database
+  online, and the web app logged `SQL connection failed` with "must be an instance of the token
+  credential class". The SQL driver copies its settings into plain objects, which dropped the
+  managed identity's `getToken`, so it refused the identity before connecting. Now the web app
+  hands the driver a credential with its own `getToken`, which survives the copy. The fault has
+  been in the web app since 0.6.0, but the Share panel offers scoped delegation on Azure only since
+  0.6.8-rc.2, so released versions, 0.6.7 included, couldn't reach it from the app.
+
 ## Analytics Hub installer 0.6.8-rc.2 (unreleased)
 
 **Release candidate preparation only.** 0.6.8-rc.2 is not published, and 0.6.7 remains Latest. Its

azure/web/src/scope-store.js

@@ -18,7 +18,10 @@ const CONNECT_ATTEMPTS = 4;
 export class SqlScopeStore {
   constructor({ server, database, clientId, sqlModule, credential, sleep = (ms) => new Promise((r) => setTimeout(r, ms)) }) {
     this.server = server; this.database = database; this.sleep = sleep;
-    this.credential = credential || new ManagedIdentityCredential(clientId);
+    const source = credential || new ManagedIdentityCredential(clientId);
+    // mssql deep-copies the pool config into plain objects, dropping methods a credential's class
+    // defines, getToken among them, and tedious then refuses it. A getToken of its own survives.
+    this.credential = { getToken: (scopes, options) => source.getToken(scopes, options) };
     this.sqlModule = sqlModule; this.pool = null;
   }
 

azure/web/test/delegations.test.js

@@ -313,4 +313,44 @@ test('the SQL store keys rows by person and scope, and explains missing tables',
   assert.equal(insert.inputs.createdAt.toISOString(), '2025-01-02T03:04:05.000Z');
   fail = 2627; await assert.rejects(store.insert(row), (e) => e.statusCode === 409);
   fail = 208; await assert.rejects(store.list(), (e) => e.statusCode === 503 && e.code === 'AccessTablesMissing');
+});
+
+test('the SQL store hands tedious a credential that survives mssql copying the pool config', async () => {
+  // The real mssql and tedious. tedious checks the credential when the pool creates a connection,
+  // then gets a connector that refuses, so the test looks up no name and opens no socket.
+  const mssql = (await import('mssql')).default;
+  const made = [];
+  class RecordingPool extends mssql.ConnectionPool {
+    constructor(config) {
+      super({ ...config, options: { ...config.options, connector: async () => { throw new Error('no sockets in tests'); } } });
+      made.push(this);
+    }
+  }
+  // Like ManagedIdentityCredential, getToken is on the class's prototype, not on the instance.
+  class PrototypeCredential {
+    scopes = [];
+    async getToken(scopes) { this.scopes.push(scopes); return { token: 'sql-token', expiresOnTimestamp: 1 }; }
+  }
+  const connect = async (credential) => {
+    const warnings = [];
+    const warn = console.warn;
+    console.warn = (...args) => { warnings.push(args.join(' ')); };
+    try {
+      const store = new SqlScopeStore({ server: 'sql.example.invalid', database: 'db', sqlModule: { ConnectionPool: RecordingPool }, credential, sleep: async () => {} });
+      await assert.rejects(store.connect(), (e) => e.statusCode === 503 && e.code === 'DatabaseUnavailable');
+    } finally {
+      console.warn = warn;
+    }
+    assert.ok(!warnings.some((w) => w.includes('must be an instance of the token credential class')), warnings.join('\n'));
+    assert.ok(warnings.some((w) => w.includes('no sockets in tests')), `tedious took the credential and tried to connect: ${warnings.join('\n')}`);
+    return made.at(-1).config.authentication.options.credential;
+  };
+
+  const credential = new PrototypeCredential();
+  const handed = await connect(credential);
+  assert.equal(typeof handed.getToken, 'function');
+  assert.deepEqual(await handed.getToken('https://database.windows.net/.default'), { token: 'sql-token', expiresOnTimestamp: 1 });
+  assert.deepEqual(credential.scopes, ['https://database.windows.net/.default']);
+  // With none given, the store uses the managed identity, which tedious takes the same way. It's never asked for a token.
+  assert.equal(typeof (await connect(undefined)).getToken, 'function');
 });