feat(azure.ai.agents): add full OAuth2 fields and connector-name support

[Nathandrake229]

Summary

Fixes #8355

Adds missing OAuth2 connection fields (--authorization-url, --token-url, --refresh-url, --scopes, --connector-name) and implements either/or validation for managed connector vs BYO OAuth2 flows.

Problem

The ARM Go SDK ConnectionOAuth2 struct only exposes AuthURL, ClientID, and ClientSecret. It does not model tokenUrl, refreshUrl, scopes, or connectorName — all top-level ARM connection properties required for full OAuth2 support.

Changes

OAuth2 moved to raw REST path

• OAuth2 connections now use the same raw REST pipeline as identity auth types
• Bypasses SDK struct limitations — all fields serialize directly to the ARM wire format
• buildConnectionBody rejects OAuth2 with a clear error if accidentally called

New flags

Flag	Description
--authorization-url	OAuth2 authorization endpoint
--token-url	OAuth2 token endpoint
--refresh-url	OAuth2 token refresh endpoint
--scopes	OAuth2 scopes (space-separated)
--connector-name	Managed connector name (e.g., github, slack)

Either/or validation

Two mutually exclusive modes for --auth-type oauth2:

1. Managed connector: --connector-name alone
2. BYO OAuth2: all of --authorization-url, --token-url, --refresh-url, --scopes, --client-id, --client-secret

Partial combinations are rejected with a clear error listing exactly which flags are missing.

Tests

• 33 tests passing
• Added: connector-name-only body serialization test
• Added: OAuth2 full fields raw REST marshaling test

Files changed

• connection.go — moved OAuth2 to raw REST switch, added flags, either/or validation
• raw_connection.go — added OAuth2 fields, rawCredentials struct
• connection_test.go — updated/added OAuth2 tests

[github-actions]

📋 Prioritization Note

Thanks for the contribution! The linked issue isn't in the current milestone yet.
Review may take a bit longer — reach out to @rajeshkamal5050 or @kristenwomack if you'd like to discuss prioritization.

[Copilot]

Pull request overview

This PR extends the azure.ai.agents extension’s connection create support for OAuth2 by adding missing OAuth2 fields (authorization/token/refresh URLs, scopes, connector name) and routing OAuth2 connection creation through the raw ARM REST path to bypass ARM SDK struct limitations.

Changes:

• Added new OAuth2 CLI flags (--authorization-url, --token-url, --refresh-url, --scopes, --connector-name) and implemented either/or validation for managed connector vs BYO OAuth2.
• Moved OAuth2 connection creation to the raw REST pipeline (shared with identity-based auth types) and made the typed SDK path reject OAuth2.
• Added/updated tests around raw OAuth2 body marshaling and auth-type normalization.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

File	Description
cli/azd/extensions/azure.ai.agents/internal/connections/cmd/raw_connection.go	Extends raw ARM connection body to include OAuth2 fields and credentials.
cli/azd/extensions/azure.ai.agents/internal/connections/cmd/connection.go	Adds new OAuth2 flags, validation, and routes OAuth2 through raw REST for create/update.
cli/azd/extensions/azure.ai.agents/internal/connections/cmd/connection_test.go	Updates tests for OAuth2 handling (typed path rejection + raw body marshal assertions).

Comments suppressed due to low confidence (1)

cli/azd/extensions/azure.ai.agents/internal/connections/cmd/connection.go:570

• connection update now routes OAuth2 (and identity auth types) through rawCreateConnection, but the body built here only includes authType, category, target, and metadata. Since rawCreateConnection does an ARM PUT, omitting OAuth2/identity-specific properties (e.g., connectorName, authorizationUrl/tokenUrl/scopes, audience, credentials) will likely clear them or cause the service to reject the request. Consider either (1) fetching the full current resource via raw REST and merging preserved fields into the PUT body, or (2) explicitly disallowing connection update for these auth types until preservation is implemented.

	// Route to raw REST or typed SDK based on auth type
	switch normalizedAuth {
	case "oauth2", "user-entra-token", "project-managed-identity", "agentic-identity":
		// Auth types that lack full ARM SDK support — update via raw REST
		err = rawCreateConnection(
			ctx, connCtx,
			a.flags.name,
			rawConnectionProperties{
				AuthType: normalizeAuthTypeToARM(normalizedAuth),
				Category: kindStr,
				Target:   newTarget,
				Metadata: parseKVMap(metaPairs),
			},
		)

[trangevi]

/check-enforcer override