microsoft / microsoft/kiota-php
Refactor AccessTokenProvider to relieve some concerns to TokenRequestContext
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 8
- Forks
- 10
- Avg merge
- 10h 16m
- Merged PRs (30d)
- 3
Description
PhpLeagueAccessTokenProvider mixes two many concerns:
- wrapper between the authentication provider and the auth context (original design)
- validates hosts through the validator (original design)
- CAE support (original design)
- provides observability information (original design)
- token caching (not part of original design)
- token refresh (same)
Because of that, and specialization with national endpoints, to expose the full API surface, we're leaking those concerns to derived classes, or required to add this setter.
And even with the latter approach, their does not seem to be a way for a consumer of the Graph Authentication Provider to set the token cache for the access token provider... Masking some of the customization abilities, or loosing the specialization for national clouds etc in the process.
Beyond the degraded developer experience, we risk introducing "experience bugs" where settings things one way doesn't flow all the way down, but does by using another API.
I believe the correct thing to do would be to move the concerns that should not be in PhPLeagueAccessTokenProvider to the token request context. I understand this is a significant undertaking and would be considered a breaking change.
further context: https://github.com/microsoft/kiota-authentication-phpleague-php/pull/106
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing PhpLeagueAccessTokenProvider and TokenRequestContext, then read the further context in pull request #106. Map the listed concerns and how national-endpoint specializations currently use them. Done means the responsibilities are placed in the intended context without losing token-cache, refresh, CAE, validation, observability, or customization capabilities.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authentication, backend
- Issue type
- Refactor
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100