Add acquire_token() public method for cross-resource auth by athanipavan · Pull Request #182 · microsoft/PowerPlatform-DataverseClient-Python

athanipavan · 2026-05-14T10:18:32Z

Summary

Adds _AuthManager.acquire_token(resource_url) -- a thin public helper over the existing _acquire_token: appends /.default and delegates to the underlying TokenCredential. Lets callers reuse the same credential to obtain tokens for any Microsoft AAD-protected resource (notably a linked Finance & Operations env) via client.auth.acquire_token(fno_url).
Refactors internal _ODataClient._headers() to call the new method, so the DV and external paths share one scope-construction site (no duplication).
README, both SKILL.md copies, and CHANGELOG updated. Inline DummyAuth mocks in conftest.py and three test modules updated to also expose acquire_token so existing _odata._headers tests still pass with the refactored call site.

End-to-end verification

Probe against a real F&O int env using the modified SDK + AzureCliCredential:

Step	Result
`client.auth.acquire_token("https://aurorabapenvf94ec.operations.int.dynamics.com")`	Token issued, length 2948
Token `aud` claim (decoded JWT)	`https://aurorabapenvf94ec.operations.int.dynamics.com` (F&O resource, not DV)
`GET <fno_url>/data/$metadata` with that token	HTTP 200, ~53 MB of F&O EDMX (`Microsoft.Dynamics.DataEntities` namespace)

F&O accepted the token. The same code path is taken for DV's own header construction, so the DV experience is unchanged.

Test plan

pytest tests/unit -q -- 1393 passed (4 new acquire_token tests + existing suite)
_auth.py line coverage: 100%
Manual end-to-end probe against live F&O env (HTTP 200 + correct token audience)
DV-only flows unchanged (no extra AAD roundtrips; _headers() still uses base_url from constructor)

Notes for reviewers

client.py is untouched; the new method lives on _AuthManager (single source of truth for scope construction).
F&O usage is fully opt-in: the SDK never calls acquire_token with an F&O URL on its own. Customers explicitly pass the F&O URL when they need it.
Both SKILL.md copies verified byte-identical per the dataverse-sdk-dev contract.

🤖 Generated with Claude Code

Adds _AuthManager.acquire_token(resource_url) as a thin public helper over the existing _acquire_token: appends /.default and delegates to the underlying TokenCredential. Lets callers reuse the same credential to obtain tokens for any Microsoft AAD-protected resource (notably a linked Finance & Operations env) via client.auth.acquire_token(fno_url). Internal _ODataClient._headers() now goes through the same method, so the DV and external paths share one scope-construction site. Verified end-to-end against a real F&O int env (operations.int.dynamics.com) using AzureCliCredential: token issued with aud=<fno_url>, F&O accepted the token and returned $metadata (HTTP 200, ~53 MB OData XML). Tests: 4 new unit tests in tests/unit/core/test_auth.py (default-scope, trailing-slash strip, alternate resource, empty-URL ValueError); _auth.py coverage 100%. Inline DummyAuth in tests/conftest.py plus three test modules updated to also expose acquire_token so _odata._headers callsites keep passing. Full suite: 1393 passed. Docs: README adds a subsection covering F&O token acquisition; both SKILL.md copies updated (byte-identical per dataverse-sdk-dev contract); CHANGELOG [Unreleased] entry added. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Adds a public client.auth.acquire_token(resource_url) helper so callers can reuse the Dataverse client credential for other Microsoft AAD-protected resources, and routes Dataverse OData header token acquisition through the same scope-construction path.

Changes:

Added _AuthManager.acquire_token() with scope construction and unit tests.
Refactored _ODataClient._headers() to call the new auth helper.
Updated README, changelog, skill docs, and test auth stubs for the expanded auth surface.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
`src/PowerPlatform/Dataverse/core/_auth.py`	Adds the public token acquisition helper and related documentation.
`src/PowerPlatform/Dataverse/data/_odata.py`	Refactors header construction to use `auth.acquire_token(self.base_url)`.
`tests/unit/core/test_auth.py`	Adds tests for public token acquisition behavior.
`tests/conftest.py`	Updates shared dummy auth fixture with `acquire_token`.
`tests/unit/core/test_http_errors.py`	Updates local dummy auth for `_headers()` refactor.
`tests/unit/data/test_logical_crud.py`	Updates local dummy auth for `_headers()` refactor.
`tests/unit/data/test_enum_optionset_payload.py`	Updates local dummy auth for `_headers()` refactor.
`README.md`	Documents acquiring tokens for linked/non-Dataverse Microsoft resources.
`.claude/skills/dataverse-sdk-use/SKILL.md`	Adds skill guidance for cross-resource token acquisition.
`src/PowerPlatform/Dataverse/claude_skill/dataverse-sdk-use/SKILL.md`	Mirrors the skill guidance update in packaged skill docs.
`CHANGELOG.md`	Records the new auth helper under Unreleased.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+                    "https://myenv.operations.dynamics.com"
+                )
+        """
+        target = (resource_url or "").rstrip("/")


        """Build standard OData headers with bearer auth."""
-        scope = f"{self.base_url}/.default"
-        token = self.auth._acquire_token(scope).access_token
+        token = self.auth.acquire_token(self.base_url)


        """Build standard OData headers with bearer auth."""
-        scope = f"{self.base_url}/.default"
-        token = self.auth._acquire_token(scope).access_token
+        token = self.auth.acquire_token(self.base_url)


+headers = {"Authorization": f"Bearer {fno_token}"}
+```
+
+The `/.default` scope is appended automatically. The customer's AAD app must already have the required permission on the target resource and admin consent granted. For Finance & Operations the standard permissions are `Odata.FullAccess` and `CustomService.FullAccess` on the **Microsoft Dynamics ERP** API (`00000015-0000-0000-c000-000000000000`).


+headers = {"Authorization": f"Bearer {fno_token}"}
+```
+
+The customer's AAD app must already have the required permission on the target resource. For F&O the standard delegated permissions are `Odata.FullAccess` and `CustomService.FullAccess` on the **Microsoft Dynamics ERP** API (`00000015-0000-0000-c000-000000000000`).


+headers = {"Authorization": f"Bearer {fno_token}"}
+```
+
+The customer's AAD app must already have the required permission on the target resource. For F&O the standard delegated permissions are `Odata.FullAccess` and `CustomService.FullAccess` on the **Microsoft Dynamics ERP** API (`00000015-0000-0000-c000-000000000000`).


vrathee-msft · 2026-06-09T19:19:52Z

Please address the merge conflicts and review bot comments.

vrathee-msft · 2026-06-30T19:12:27Z

please add more information in PR description about what it enables. i.e. type of entities, operations etc.

…oken # Conflicts: # tests/unit/core/test_auth.py

Copilot AI review requested due to automatic review settings May 14, 2026 10:18

athanipavan requested a review from a team as a code owner May 14, 2026 10:18

Copilot started reviewing on behalf of athanipavan May 14, 2026 10:20 View session

Copilot AI reviewed May 14, 2026

View reviewed changes

jeffandms previously approved these changes May 18, 2026

View reviewed changes

Merge remote-tracking branch 'origin/main' into pathani/fno-acquire-t…

952a2b6

…oken # Conflicts: # tests/unit/core/test_auth.py

athanipavan dismissed jeffandms’s stale review via 952a2b6 July 6, 2026 12:29

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add acquire_token() public method for cross-resource auth#182

Add acquire_token() public method for cross-resource auth#182
athanipavan wants to merge 2 commits into
microsoft:mainfrom
athanipavan:pathani/fno-acquire-token

athanipavan commented May 14, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

vrathee-msft commented Jun 9, 2026 •

edited

Loading

Uh oh!

vrathee-msft commented Jun 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

athanipavan commented May 14, 2026

Summary

End-to-end verification

Test plan

Notes for reviewers

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

vrathee-msft commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vrathee-msft commented Jun 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

vrathee-msft commented Jun 9, 2026 •

edited

Loading