Merge pull request #604 from Azure/rossgrambo/merge-main-to-preview

rossgrambo · web-flow · commit 92164371b9ab · 2024-10-23T12:37:55.000-07:00
Merge main to preview with resolved conflicts
diff --git a/src/Microsoft.Azure.AppConfiguration.AspNetCore/Microsoft.Azure.AppConfiguration.AspNetCore.csproj b/src/Microsoft.Azure.AppConfiguration.AspNetCore/Microsoft.Azure.AppConfiguration.AspNetCore.csproj
@@ -21,7 +21,7 @@
   <!-- Nuget Package Version Settings -->
 
   <PropertyGroup>
-    <OfficialVersion>8.0.0-preview.3</OfficialVersion>
+    <OfficialVersion>8.0.0</OfficialVersion>
   </PropertyGroup>
   
   <PropertyGroup Condition="'$(CDP_PATCH_NUMBER)'!='' AND '$(CDP_BUILD_TYPE)'=='Official'">
diff --git a/src/Microsoft.Azure.AppConfiguration.Functions.Worker/Microsoft.Azure.AppConfiguration.Functions.Worker.csproj b/src/Microsoft.Azure.AppConfiguration.Functions.Worker/Microsoft.Azure.AppConfiguration.Functions.Worker.csproj
@@ -24,7 +24,7 @@
   <!-- Nuget Package Version Settings -->
 
   <PropertyGroup>
-    <OfficialVersion>8.0.0-preview.3</OfficialVersion>
+    <OfficialVersion>8.0.0</OfficialVersion>
   </PropertyGroup>
 
   <PropertyGroup Condition="'$(CDP_PATCH_NUMBER)'!='' AND '$(CDP_BUILD_TYPE)'=='Official'">
diff --git a/src/Microsoft.Extensions.Configuration.AzureAppConfiguration/AzureAppConfigurationKeyVaultOptions.cs b/src/Microsoft.Extensions.Configuration.AzureAppConfiguration/AzureAppConfigurationKeyVaultOptions.cs
@@ -14,7 +14,17 @@ namespace Microsoft.Extensions.Configuration.AzureAppConfiguration
     /// </summary>
     public class AzureAppConfigurationKeyVaultOptions
     {
+        // 6 retries is the highest number that will make the total retry time comfortably fall under the default startup timeout of 100 seconds.
+        // This allows the provider to throw a KeyVaultReferenceException with all relevant information and halt startup instead of timing out.
+        private const int KeyVaultMaxRetries = 6;
+
         internal TokenCredential Credential;
+        internal SecretClientOptions ClientOptions = new SecretClientOptions
+        {
+            Retry = {
+                MaxRetries = KeyVaultMaxRetries
+            }
+        };
         internal List<SecretClient> SecretClients = new List<SecretClient>();
         internal Func<Uri, ValueTask<string>> SecretResolver;
         internal Dictionary<string, TimeSpan> SecretRefreshIntervals = new Dictionary<string, TimeSpan>();
@@ -31,6 +41,17 @@ public AzureAppConfigurationKeyVaultOptions SetCredential(TokenCredential creden
             return this;
         }
 
+        /// <summary>
+        /// Configures the client options used when connecting to key vaults that have no registered <see cref="SecretClient"/>. 
+        /// The client options will not affect <see cref="SecretClient"/> instances registered via <see cref="Register(SecretClient)"/>.
+        /// </summary>
+        /// <param name="configure">A callback used to configure secret client options.</param>
+        public AzureAppConfigurationKeyVaultOptions ConfigureClientOptions(Action<SecretClientOptions> configure)
+        {
+            configure?.Invoke(ClientOptions);
+            return this;
+        }
+
         /// <summary>
         /// Registers the specified <see cref="SecretClient"/> instance to use to resolve key vault references for secrets from associated key vault.
         /// </summary>
diff --git a/src/Microsoft.Extensions.Configuration.AzureAppConfiguration/AzureAppConfigurationProvider.cs b/src/Microsoft.Extensions.Configuration.AzureAppConfiguration/AzureAppConfigurationProvider.cs
@@ -390,7 +390,15 @@ await CallWithRequestTracing(
                             // Invalidate the cached Key Vault secret (if any) for this ConfigurationSetting
                             foreach (IKeyValueAdapter adapter in _options.Adapters)
                             {
-                                adapter.OnChangeDetected(change.Current);
+                                // If the current setting is null, try to pass the previous setting instead
+                                if (change.Current != null)
+                                {
+                                    adapter.OnChangeDetected(change.Current);
+                                }
+                                else if (change.Previous != null)
+                                {
+                                    adapter.OnChangeDetected(change.Previous);
+                                }
                             }
                         }
                     }
@@ -671,17 +679,6 @@ private async Task<bool> TryInitializeAsync(IEnumerable<ConfigurationClient> cli
 
                 throw;
             }
-            catch (KeyVaultReferenceException exception)
-            {
-                if (IsFailOverable(exception))
-                {
-                    startupExceptions.Add(exception);
-
-                    return false;
-                }
-
-                throw;
-            }
             catch (AggregateException exception)
             {
                 if (exception.InnerExceptions?.Any(e => e is OperationCanceledException) ?? false)
@@ -1065,15 +1062,6 @@ private async Task<T> ExecuteWithFailOverPolicyAsync<T>(
                         throw;
                     }
                 }
-                catch (KeyVaultReferenceException kvre)
-                {
-                    if (!IsFailOverable(kvre) || !clientEnumerator.MoveNext())
-                    {
-                        backoffAllClients = true;
-
-                        throw;
-                    }
-                }
                 catch (AggregateException ae)
                 {
                     if (!IsFailOverable(ae) || !clientEnumerator.MoveNext())
@@ -1145,7 +1133,9 @@ private bool IsFailOverable(RequestFailedException rfe)
         {
             if (rfe.Status == HttpStatusCodes.TooManyRequests ||
                 rfe.Status == (int)HttpStatusCode.RequestTimeout ||
-                rfe.Status >= (int)HttpStatusCode.InternalServerError)
+                rfe.Status >= (int)HttpStatusCode.InternalServerError ||
+                rfe.Status == (int)HttpStatusCode.Forbidden ||
+                rfe.Status == (int)HttpStatusCode.Unauthorized)
             {
                 return true;
             }
@@ -1167,20 +1157,6 @@ innerException is SocketException ||
                    innerException is IOException;
         }
 
-        private bool IsFailOverable(KeyVaultReferenceException kvre)
-        {
-            if (kvre.InnerException is RequestFailedException rfe && IsFailOverable(rfe))
-            {
-                return true;
-            }
-            else if (kvre.InnerException is AggregateException ae && IsFailOverable(ae))
-            {
-                return true;
-            }
-
-            return false;
-        }
-
         private async Task<Dictionary<string, ConfigurationSetting>> MapConfigurationSettings(Dictionary<string, ConfigurationSetting> data)
         {
             Dictionary<string, ConfigurationSetting> mappedData = new Dictionary<string, ConfigurationSetting>(StringComparer.OrdinalIgnoreCase);
diff --git a/src/Microsoft.Extensions.Configuration.AzureAppConfiguration/AzureKeyVaultReference/AzureKeyVaultKeyValueAdapter.cs b/src/Microsoft.Extensions.Configuration.AzureAppConfiguration/AzureKeyVaultReference/AzureKeyVaultKeyValueAdapter.cs
@@ -84,7 +84,15 @@ public void OnChangeDetected(ConfigurationSetting setting = null)
             }
             else
             {
-                _secretProvider.RemoveSecretFromCache(setting.Key);
+                if (CanProcess(setting))
+                {
+                    string secretRefUri = ParseSecretReferenceUri(setting);
+
+                    if (!string.IsNullOrEmpty(secretRefUri) && Uri.TryCreate(secretRefUri, UriKind.Absolute, out Uri secretUri) && KeyVaultSecretIdentifier.TryCreate(secretUri, out KeyVaultSecretIdentifier secretIdentifier))
+                    {
+                        _secretProvider.RemoveSecretFromCache(secretIdentifier.SourceId);
+                    }
+                }
             }
         }
 
diff --git a/src/Microsoft.Extensions.Configuration.AzureAppConfiguration/AzureKeyVaultReference/AzureKeyVaultSecretProvider.cs b/src/Microsoft.Extensions.Configuration.AzureAppConfiguration/AzureKeyVaultReference/AzureKeyVaultSecretProvider.cs
@@ -15,14 +15,14 @@ internal class AzureKeyVaultSecretProvider
     {
         private readonly AzureAppConfigurationKeyVaultOptions _keyVaultOptions;
         private readonly IDictionary<string, SecretClient> _secretClients;
-        private readonly Dictionary<string, CachedKeyVaultSecret> _cachedKeyVaultSecrets;
-        private string _nextRefreshKey;
+        private readonly Dictionary<Uri, CachedKeyVaultSecret> _cachedKeyVaultSecrets;
+        private Uri _nextRefreshSourceId;
         private DateTimeOffset? _nextRefreshTime;
 
         public AzureKeyVaultSecretProvider(AzureAppConfigurationKeyVaultOptions keyVaultOptions = null)
         {
             _keyVaultOptions = keyVaultOptions ?? new AzureAppConfigurationKeyVaultOptions();
-            _cachedKeyVaultSecrets = new Dictionary<string, CachedKeyVaultSecret>(StringComparer.OrdinalIgnoreCase);
+            _cachedKeyVaultSecrets = new Dictionary<Uri, CachedKeyVaultSecret>();
             _secretClients = new Dictionary<string, SecretClient>(StringComparer.OrdinalIgnoreCase);
 
             if (_keyVaultOptions.SecretClients != null)
@@ -39,7 +39,7 @@ public async Task<string> GetSecretValue(KeyVaultSecretIdentifier secretIdentifi
         {
             string secretValue = null;
 
-            if (_cachedKeyVaultSecrets.TryGetValue(key, out CachedKeyVaultSecret cachedSecret) &&
+            if (_cachedKeyVaultSecrets.TryGetValue(secretIdentifier.SourceId, out CachedKeyVaultSecret cachedSecret) &&
                     (!cachedSecret.RefreshAt.HasValue || DateTimeOffset.UtcNow < cachedSecret.RefreshAt.Value))
             {
                 return cachedSecret.SecretValue;
@@ -68,12 +68,12 @@ public async Task<string> GetSecretValue(KeyVaultSecretIdentifier secretIdentifi
                     secretValue = await _keyVaultOptions.SecretResolver(secretIdentifier.SourceId).ConfigureAwait(false);
                 }
 
-                cachedSecret = new CachedKeyVaultSecret(secretValue);
+                cachedSecret = new CachedKeyVaultSecret(secretValue, secretIdentifier.SourceId);
                 success = true;
             }
             finally
             {
-                SetSecretInCache(key, cachedSecret, success);
+                SetSecretInCache(secretIdentifier.SourceId, key, cachedSecret, success);
             }
 
             return secretValue;
@@ -86,16 +86,34 @@ public bool ShouldRefreshKeyVaultSecrets()
 
         public void ClearCache()
         {
-            _cachedKeyVaultSecrets.Clear();
-            _nextRefreshKey = null;
-            _nextRefreshTime = null;
+            var sourceIdsToRemove = new List<Uri>();
+
+            var utcNow = DateTimeOffset.UtcNow;
+
+            foreach (KeyValuePair<Uri, CachedKeyVaultSecret> secret in _cachedKeyVaultSecrets)
+            {
+                if (secret.Value.LastRefreshTime + RefreshConstants.MinimumSecretRefreshInterval < utcNow)
+                {
+                    sourceIdsToRemove.Add(secret.Key);
+                }
+            }
+
+            foreach (Uri sourceId in sourceIdsToRemove)
+            {
+                _cachedKeyVaultSecrets.Remove(sourceId);
+            }
+
+            if (_cachedKeyVaultSecrets.Any())
+            {
+                UpdateNextRefreshableSecretFromCache();
+            }
         }
 
-        public void RemoveSecretFromCache(string key)
+        public void RemoveSecretFromCache(Uri sourceId)
         {
-            _cachedKeyVaultSecrets.Remove(key);
+            _cachedKeyVaultSecrets.Remove(sourceId);
 
-            if (key == _nextRefreshKey)
+            if (sourceId == _nextRefreshSourceId)
             {
                 UpdateNextRefreshableSecretFromCache();
             }
@@ -115,44 +133,49 @@ private SecretClient GetSecretClient(Uri secretUri)
                 return null;
             }
 
-            client = new SecretClient(new Uri(secretUri.GetLeftPart(UriPartial.Authority)), _keyVaultOptions.Credential);
+            client = new SecretClient(
+                new Uri(secretUri.GetLeftPart(UriPartial.Authority)),
+                _keyVaultOptions.Credential,
+                _keyVaultOptions.ClientOptions);
+
             _secretClients.Add(keyVaultId, client);
+
             return client;
         }
 
-        private void SetSecretInCache(string key, CachedKeyVaultSecret cachedSecret, bool success = true)
+        private void SetSecretInCache(Uri sourceId, string key, CachedKeyVaultSecret cachedSecret, bool success = true)
         {
             if (cachedSecret == null)
             {
                 cachedSecret = new CachedKeyVaultSecret();
             }
 
             UpdateCacheExpirationTimeForSecret(key, cachedSecret, success);
-            _cachedKeyVaultSecrets[key] = cachedSecret;
+            _cachedKeyVaultSecrets[sourceId] = cachedSecret;
 
-            if (key == _nextRefreshKey)
+            if (sourceId == _nextRefreshSourceId)
             {
                 UpdateNextRefreshableSecretFromCache();
             }
             else if ((cachedSecret.RefreshAt.HasValue && _nextRefreshTime.HasValue && cachedSecret.RefreshAt.Value < _nextRefreshTime.Value)
                     || (cachedSecret.RefreshAt.HasValue && !_nextRefreshTime.HasValue))
             {
-                _nextRefreshKey = key;
+                _nextRefreshSourceId = sourceId;
                 _nextRefreshTime = cachedSecret.RefreshAt.Value;
             }
         }
 
         private void UpdateNextRefreshableSecretFromCache()
         {
-            _nextRefreshKey = null;
+            _nextRefreshSourceId = null;
             _nextRefreshTime = DateTimeOffset.MaxValue;
 
-            foreach (KeyValuePair<string, CachedKeyVaultSecret> secret in _cachedKeyVaultSecrets)
+            foreach (KeyValuePair<Uri, CachedKeyVaultSecret> secret in _cachedKeyVaultSecrets)
             {
                 if (secret.Value.RefreshAt.HasValue && secret.Value.RefreshAt.Value < _nextRefreshTime)
                 {
                     _nextRefreshTime = secret.Value.RefreshAt;
-                    _nextRefreshKey = secret.Key;
+                    _nextRefreshSourceId = secret.Key;
                 }
             }
 
diff --git a/src/Microsoft.Extensions.Configuration.AzureAppConfiguration/AzureKeyVaultReference/CachedKeyVaultSecret.cs b/src/Microsoft.Extensions.Configuration.AzureAppConfiguration/AzureKeyVaultReference/CachedKeyVaultSecret.cs
@@ -22,11 +22,23 @@ internal class CachedKeyVaultSecret
         /// </summary>
         public int RefreshAttempts { get; set; }
 
-        public CachedKeyVaultSecret(string secretValue = null, DateTimeOffset? refreshAt = null, int refreshAttempts = 0)
+        /// <summary>
+        /// The last time this secret was reloaded from Key Vault.
+        /// </summary>
+        public DateTimeOffset LastRefreshTime { get; set; }
+
+        /// <summary>
+        /// The source <see cref="Uri"/> for this secret.
+        /// </summary>
+        public Uri SourceId { get; }
+
+        public CachedKeyVaultSecret(string secretValue = null, Uri sourceId = null, DateTimeOffset? refreshAt = null, int refreshAttempts = 0)
         {
             SecretValue = secretValue;
             RefreshAt = refreshAt;
+            LastRefreshTime = DateTimeOffset.UtcNow;
             RefreshAttempts = refreshAttempts;
+            SourceId = sourceId;
         }
     }
 }
diff --git a/src/Microsoft.Extensions.Configuration.AzureAppConfiguration/Constants/RefreshConstants.cs b/src/Microsoft.Extensions.Configuration.AzureAppConfiguration/Constants/RefreshConstants.cs
@@ -16,7 +16,7 @@ internal class RefreshConstants
         public static readonly TimeSpan MinimumFeatureFlagRefreshInterval = TimeSpan.FromSeconds(1);
 
         // Key Vault secrets
-        public static readonly TimeSpan MinimumSecretRefreshInterval = TimeSpan.FromSeconds(1);
+        public static readonly TimeSpan MinimumSecretRefreshInterval = TimeSpan.FromMinutes(1);
 
         // Backoff during refresh failures
         public static readonly TimeSpan DefaultMinBackoff = TimeSpan.FromSeconds(30);
diff --git a/src/Microsoft.Extensions.Configuration.AzureAppConfiguration/Extensions/ConfigurationClientExtensions.cs b/src/Microsoft.Extensions.Configuration.AzureAppConfiguration/Extensions/ConfigurationClientExtensions.cs
@@ -36,6 +36,7 @@ public static async Task<KeyValueChange> GetKeyValueChange(this ConfigurationCli
                     return new KeyValueChange
                     {
                         ChangeType = KeyValueChangeType.Modified,
+                        Previous = setting,
                         Current = response.Value,
                         Key = setting.Key,
                         Label = setting.Label
@@ -47,6 +48,7 @@ public static async Task<KeyValueChange> GetKeyValueChange(this ConfigurationCli
                 return new KeyValueChange
                 {
                     ChangeType = KeyValueChangeType.Deleted,
+                    Previous = setting,
                     Current = null,
                     Key = setting.Key,
                     Label = setting.Label
@@ -56,6 +58,7 @@ public static async Task<KeyValueChange> GetKeyValueChange(this ConfigurationCli
             return new KeyValueChange
             {
                 ChangeType = KeyValueChangeType.None,
+                Previous = setting,
                 Current = setting,
                 Key = setting.Key,
                 Label = setting.Label
@@ -158,6 +161,7 @@ await TracingUtils.CallWithRequestTracing(options.RequestTracingEnabled, Request
                                     ChangeType = KeyValueChangeType.Modified,
                                     Key = setting.Key,
                                     Label = options.Label.NormalizeNull(),
+                                    Previous = null,
                                     Current = setting
                                 });
                                 string key = setting.Key.Substring(FeatureManagementConstants.FeatureFlagMarker.Length);
@@ -176,6 +180,7 @@ await TracingUtils.CallWithRequestTracing(options.RequestTracingEnabled, Request
                         ChangeType = KeyValueChangeType.Deleted,
                         Key = kvp.Key,
                         Label = options.Label.NormalizeNull(),
+                        Previous = null,
                         Current = null
                     });
                     string key = kvp.Key.Substring(FeatureManagementConstants.FeatureFlagMarker.Length);
diff --git a/src/Microsoft.Extensions.Configuration.AzureAppConfiguration/KeyValueChange.cs b/src/Microsoft.Extensions.Configuration.AzureAppConfiguration/KeyValueChange.cs
@@ -21,5 +21,7 @@ internal struct KeyValueChange
         public string Label { get; set; }
 
         public ConfigurationSetting Current { get; set; }
+
+        public ConfigurationSetting Previous { get; set; }
     }
 }
diff --git a/src/Microsoft.Extensions.Configuration.AzureAppConfiguration/Microsoft.Extensions.Configuration.AzureAppConfiguration.csproj b/src/Microsoft.Extensions.Configuration.AzureAppConfiguration/Microsoft.Extensions.Configuration.AzureAppConfiguration.csproj
@@ -35,7 +35,7 @@
   <!-- Nuget Package Version Settings -->
   
   <PropertyGroup>
-    <OfficialVersion>8.0.0-preview.3</OfficialVersion>
+    <OfficialVersion>8.0.0</OfficialVersion>
   </PropertyGroup>
   
   <PropertyGroup Condition="'$(CDP_PATCH_NUMBER)'!='' AND '$(CDP_BUILD_TYPE)'=='Official'">
diff --git a/tests/Tests.AzureAppConfiguration/FailoverTests.cs b/tests/Tests.AzureAppConfiguration/FailoverTests.cs
diff --git a/tests/Tests.AzureAppConfiguration/KeyVaultReferenceTests.cs b/tests/Tests.AzureAppConfiguration/KeyVaultReferenceTests.cs
diff --git a/tests/Tests.AzureAppConfiguration/LoggingTests.cs b/tests/Tests.AzureAppConfiguration/LoggingTests.cs
diff --git a/tests/Tests.AzureAppConfiguration/MapTests.cs b/tests/Tests.AzureAppConfiguration/MapTests.cs

Original file line number	Diff line number	Diff line change
`@@ -84,7 +84,15 @@ public void OnChangeDetected(ConfigurationSetting setting = null)`
`84`	`84`	`}`
`85`	`85`	`else`
`86`	`86`	`{`
`87`		`- _secretProvider.RemoveSecretFromCache(setting.Key);`
	`87`	`+ if (CanProcess(setting))`
	`88`	`+ {`
	`89`	`+ string secretRefUri = ParseSecretReferenceUri(setting);`
	`90`	`+`
	`91`	`+ if (!string.IsNullOrEmpty(secretRefUri) && Uri.TryCreate(secretRefUri, UriKind.Absolute, out Uri secretUri) && KeyVaultSecretIdentifier.TryCreate(secretUri, out KeyVaultSecretIdentifier secretIdentifier))`
	`92`	`+ {`
	`93`	`+ _secretProvider.RemoveSecretFromCache(secretIdentifier.SourceId);`
	`94`	`+ }`
	`95`	`+ }`
`88`	`96`	`}`
`89`	`97`	`}`
`90`	`98`
Original file line number	Diff line number	Diff line change
`@@ -15,14 +15,14 @@ internal class AzureKeyVaultSecretProvider`
`15`	`15`	`{`
`16`	`16`	`private readonly AzureAppConfigurationKeyVaultOptions _keyVaultOptions;`
`17`	`17`	`private readonly IDictionary<string, SecretClient> _secretClients;`
`18`		`- private readonly Dictionary<string, CachedKeyVaultSecret> _cachedKeyVaultSecrets;`
`19`		`- private string _nextRefreshKey;`
	`18`	`+ private readonly Dictionary<Uri, CachedKeyVaultSecret> _cachedKeyVaultSecrets;`
	`19`	`+ private Uri _nextRefreshSourceId;`
`20`	`20`	`private DateTimeOffset? _nextRefreshTime;`
`21`	`21`
`22`	`22`	`public AzureKeyVaultSecretProvider(AzureAppConfigurationKeyVaultOptions keyVaultOptions = null)`
`23`	`23`	`{`
`24`	`24`	`_keyVaultOptions = keyVaultOptions ?? new AzureAppConfigurationKeyVaultOptions();`
`25`		`- _cachedKeyVaultSecrets = new Dictionary<string, CachedKeyVaultSecret>(StringComparer.OrdinalIgnoreCase);`
	`25`	`+ _cachedKeyVaultSecrets = new Dictionary<Uri, CachedKeyVaultSecret>();`
`26`	`26`	`_secretClients = new Dictionary<string, SecretClient>(StringComparer.OrdinalIgnoreCase);`
`27`	`27`
`28`	`28`	`if (_keyVaultOptions.SecretClients != null)`
`@@ -39,7 +39,7 @@ public async Task<string> GetSecretValue(KeyVaultSecretIdentifier secretIdentifi`
`39`	`39`	`{`
`40`	`40`	`string secretValue = null;`
`41`	`41`
`42`		`- if (_cachedKeyVaultSecrets.TryGetValue(key, out CachedKeyVaultSecret cachedSecret) &&`
	`42`	`+ if (_cachedKeyVaultSecrets.TryGetValue(secretIdentifier.SourceId, out CachedKeyVaultSecret cachedSecret) &&`
`43`	`43`	`(!cachedSecret.RefreshAt.HasValue \|\| DateTimeOffset.UtcNow < cachedSecret.RefreshAt.Value))`
`44`	`44`	`{`
`45`	`45`	`return cachedSecret.SecretValue;`
`@@ -68,12 +68,12 @@ public async Task<string> GetSecretValue(KeyVaultSecretIdentifier secretIdentifi`
`68`	`68`	`secretValue = await _keyVaultOptions.SecretResolver(secretIdentifier.SourceId).ConfigureAwait(false);`
`69`	`69`	`}`
`70`	`70`
`71`		`- cachedSecret = new CachedKeyVaultSecret(secretValue);`
	`71`	`+ cachedSecret = new CachedKeyVaultSecret(secretValue, secretIdentifier.SourceId);`
`72`	`72`	`success = true;`
`73`	`73`	`}`
`74`	`74`	`finally`
`75`	`75`	`{`
`76`		`- SetSecretInCache(key, cachedSecret, success);`
	`76`	`+ SetSecretInCache(secretIdentifier.SourceId, key, cachedSecret, success);`
`77`	`77`	`}`
`78`	`78`
`79`	`79`	`return secretValue;`
`@@ -86,16 +86,34 @@ public bool ShouldRefreshKeyVaultSecrets()`
`86`	`86`
`87`	`87`	`public void ClearCache()`
`88`	`88`	`{`
`89`		`- _cachedKeyVaultSecrets.Clear();`
`90`		`- _nextRefreshKey = null;`
`91`		`- _nextRefreshTime = null;`
	`89`	`+ var sourceIdsToRemove = new List<Uri>();`
	`90`	`+`
	`91`	`+ var utcNow = DateTimeOffset.UtcNow;`
	`92`	`+`
	`93`	`+ foreach (KeyValuePair<Uri, CachedKeyVaultSecret> secret in _cachedKeyVaultSecrets)`
	`94`	`+ {`
	`95`	`+ if (secret.Value.LastRefreshTime + RefreshConstants.MinimumSecretRefreshInterval < utcNow)`
	`96`	`+ {`
	`97`	`+ sourceIdsToRemove.Add(secret.Key);`
	`98`	`+ }`
	`99`	`+ }`
	`100`	`+`
	`101`	`+ foreach (Uri sourceId in sourceIdsToRemove)`
	`102`	`+ {`
	`103`	`+ _cachedKeyVaultSecrets.Remove(sourceId);`
	`104`	`+ }`
	`105`	`+`
	`106`	`+ if (_cachedKeyVaultSecrets.Any())`
	`107`	`+ {`
	`108`	`+ UpdateNextRefreshableSecretFromCache();`
	`109`	`+ }`
`92`	`110`	`}`
`93`	`111`
`94`		`- public void RemoveSecretFromCache(string key)`
	`112`	`+ public void RemoveSecretFromCache(Uri sourceId)`
`95`	`113`	`{`
`96`		`- _cachedKeyVaultSecrets.Remove(key);`
	`114`	`+ _cachedKeyVaultSecrets.Remove(sourceId);`
`97`	`115`
`98`		`- if (key == _nextRefreshKey)`
	`116`	`+ if (sourceId == _nextRefreshSourceId)`
`99`	`117`	`{`
`100`	`118`	`UpdateNextRefreshableSecretFromCache();`
`101`	`119`	`}`
`@@ -115,44 +133,49 @@ private SecretClient GetSecretClient(Uri secretUri)`
`115`	`133`	`return null;`
`116`	`134`	`}`
`117`	`135`
`118`		`- client = new SecretClient(new Uri(secretUri.GetLeftPart(UriPartial.Authority)), _keyVaultOptions.Credential);`
	`136`	`+ client = new SecretClient(`
	`137`	`+ new Uri(secretUri.GetLeftPart(UriPartial.Authority)),`
	`138`	`+ _keyVaultOptions.Credential,`
	`139`	`+ _keyVaultOptions.ClientOptions);`
	`140`	`+`
`119`	`141`	`_secretClients.Add(keyVaultId, client);`
	`142`	`+`
`120`	`143`	`return client;`
`121`	`144`	`}`
`122`	`145`
`123`		`- private void SetSecretInCache(string key, CachedKeyVaultSecret cachedSecret, bool success = true)`
	`146`	`+ private void SetSecretInCache(Uri sourceId, string key, CachedKeyVaultSecret cachedSecret, bool success = true)`
`124`	`147`	`{`
`125`	`148`	`if (cachedSecret == null)`
`126`	`149`	`{`
`127`	`150`	`cachedSecret = new CachedKeyVaultSecret();`
`128`	`151`	`}`
`129`	`152`
`130`	`153`	`UpdateCacheExpirationTimeForSecret(key, cachedSecret, success);`
`131`		`- _cachedKeyVaultSecrets[key] = cachedSecret;`
	`154`	`+ _cachedKeyVaultSecrets[sourceId] = cachedSecret;`
`132`	`155`
`133`		`- if (key == _nextRefreshKey)`
	`156`	`+ if (sourceId == _nextRefreshSourceId)`
`134`	`157`	`{`
`135`	`158`	`UpdateNextRefreshableSecretFromCache();`
`136`	`159`	`}`
`137`	`160`	`else if ((cachedSecret.RefreshAt.HasValue && _nextRefreshTime.HasValue && cachedSecret.RefreshAt.Value < _nextRefreshTime.Value)`
`138`	`161`	`\|\| (cachedSecret.RefreshAt.HasValue && !_nextRefreshTime.HasValue))`
`139`	`162`	`{`
`140`		`- _nextRefreshKey = key;`
	`163`	`+ _nextRefreshSourceId = sourceId;`
`141`	`164`	`_nextRefreshTime = cachedSecret.RefreshAt.Value;`
`142`	`165`	`}`
`143`	`166`	`}`
`144`	`167`
`145`	`168`	`private void UpdateNextRefreshableSecretFromCache()`
`146`	`169`	`{`
`147`		`- _nextRefreshKey = null;`
	`170`	`+ _nextRefreshSourceId = null;`
`148`	`171`	`_nextRefreshTime = DateTimeOffset.MaxValue;`
`149`	`172`
`150`		`- foreach (KeyValuePair<string, CachedKeyVaultSecret> secret in _cachedKeyVaultSecrets)`
	`173`	`+ foreach (KeyValuePair<Uri, CachedKeyVaultSecret> secret in _cachedKeyVaultSecrets)`
`151`	`174`	`{`
`152`	`175`	`if (secret.Value.RefreshAt.HasValue && secret.Value.RefreshAt.Value < _nextRefreshTime)`
`153`	`176`	`{`
`154`	`177`	`_nextRefreshTime = secret.Value.RefreshAt;`
`155`		`- _nextRefreshKey = secret.Key;`
	`178`	`+ _nextRefreshSourceId = secret.Key;`
`156`	`179`	`}`
`157`	`180`	`}`
`158`	`181`
Original file line number	Diff line number	Diff line change
`@@ -22,11 +22,23 @@ internal class CachedKeyVaultSecret`
`22`	`22`	`/// </summary>`
`23`	`23`	`public int RefreshAttempts { get; set; }`
`24`	`24`
`25`		`- public CachedKeyVaultSecret(string secretValue = null, DateTimeOffset? refreshAt = null, int refreshAttempts = 0)`
	`25`	`+ /// <summary>`
	`26`	`+ /// The last time this secret was reloaded from Key Vault.`
	`27`	`+ /// </summary>`
	`28`	`+ public DateTimeOffset LastRefreshTime { get; set; }`
	`29`	`+`
	`30`	`+ /// <summary>`
	`31`	`+ /// The source <see cref="Uri"/> for this secret.`
	`32`	`+ /// </summary>`
	`33`	`+ public Uri SourceId { get; }`
	`34`	`+`
	`35`	`+ public CachedKeyVaultSecret(string secretValue = null, Uri sourceId = null, DateTimeOffset? refreshAt = null, int refreshAttempts = 0)`
`26`	`36`	`{`
`27`	`37`	`SecretValue = secretValue;`
`28`	`38`	`RefreshAt = refreshAt;`
	`39`	`+ LastRefreshTime = DateTimeOffset.UtcNow;`
`29`	`40`	`RefreshAttempts = refreshAttempts;`
	`41`	`+ SourceId = sourceId;`
`30`	`42`	`}`
`31`	`43`	`}`
`32`	`44`	`}`
Original file line number	Diff line number	Diff line change
`@@ -21,5 +21,7 @@ internal struct KeyValueChange`
`21`	`21`	`public string Label { get; set; }`
`22`	`22`
`23`	`23`	`public ConfigurationSetting Current { get; set; }`
	`24`	`+`
	`25`	`+ public ConfigurationSetting Previous { get; set; }`
`24`	`26`	`}`
`25`	`27`	`}`