mirror of
https://github.com/microsoft/vscode.git
synced 2026-09-03 16:15:28 +01:00
TylerLeonhardtandClaude Opus 5
5ca078d771
* Add "Continue with Microsoft" sign in for GitHub Brokers a GitHub session from an Entra token the built-in `microsoft` provider already holds, so someone signed in to Microsoft can reach Copilot without a second browser round trip. The flow is deliberately two exchanges. The first buys a `read:user` discovery token, just enough to `GET /user` and show which GitHub account the Entra identity maps to. Nothing is published until the user confirms that identity. The second exchange then mints the scopes the caller actually asked for. The discovery token is never persisted and never published as a session. Entra-brokered sessions live in memory for the life of the window and are never written to the Keychain. What survives a reload is the user's consent, recorded in global state as a GitHub label, a Microsoft label, and the GitHub user id. A fresh window mints the session again from that row, silently, re-verifying through discovery that the row still points at the same account. Rows are keyed by GitHub account label, because that is what VS Code itself keys an account by: `getAccounts` collapses sessions by label and the account preference is stored by label. The id is kept for one job only, checking that the token GitHub just returned belongs to the account the row names. Signing out of the Microsoft account drops the sessions, since nothing can renew them, but leaves the rows alone. The Microsoft account list is a per-window cache that reads empty for a moment while it repopulates, and the rows are global state shared by every window, so acting on a blink of that list would sign the user out everywhere with no way back. Dropping only the sessions self-heals: the next read mints them again from the row that is still there. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * Fix CI: hygiene warnings and a missing test stub The hygiene job fails on eslint warnings, and both warnings were in entraTokenExchange.test.ts: an `in` operator check and a double-quoted string outside of localization. The harness override is now a positive `noExchangeEndpoint` boolean, and the assertion uses single quotes. The browser test broke because main added @INativeManagedSettingsService to the DefaultAccountProvider constructor. The signIn helper now stubs both managed-settings services with their existing Null implementations. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * Address review comments on Microsoft-brokered sessions Verify the granted token against the account the user confirmed, not just the discovery token, and give that mismatch its own failure kind so a restore only forgets a link when GitHub positively names somebody else. Make a failed unlink write stick for the window that did it, so a sign out cannot leave a row behind that silently signs the user back in. Discard a token whose Microsoft account was signed out while the exchange was in flight, settle every expired session rather than only those with nothing to hand back, and warn when GitHub grants fewer scopes than asked. Adds a provider-level test suite driven through the real getSessions. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
GitHub Authentication for Visual Studio Code
Notice: This extension is bundled with Visual Studio Code. It can be disabled but not uninstalled.
Features
This extension provides support for authenticating to GitHub. It registers the github Authentication Provider that can be leveraged by other extensions. This also provides the GitHub authentication used by Settings Sync.