Skip to content

Skip legacy B2C local-account Todo UI test in WebAppUiTests#3778

Merged
bgavrilMS merged 2 commits into
masterfrom
copilot/disable-susi-b2c-test
Apr 15, 2026
Merged

Skip legacy B2C local-account Todo UI test in WebAppUiTests#3778
bgavrilMS merged 2 commits into
masterfrom
copilot/disable-susi-b2c-test

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Apr 15, 2026

The B2C local-account Todo E2E test depends on deprecated legacy infra (webappsapistests Key Vault / fabrikamb2c tenant). This PR disables only that test using the project’s existing xUnit skip pattern.

  • Targeted change

    • Updated a single attribute on Susi_B2C_LocalAccount_TodoAppFunctionsCorrectlyAsync in tests/E2E Tests/WebAppUiTests/B2CWebAppCallsWebApiLocally.cs.
    • No test logic, setup, or other files were modified.
  • Skip reason alignment

    • Uses an explicit infrastructure deprecation reason, consistent with existing skip usage in this test project.
- [Fact]
+ [Fact(Skip = "Legacy B2C test infrastructure (webappsapistests Key Vault / fabrikamb2c tenant) is no longer valid.")]
Original prompt

In tests/E2E Tests/WebAppUiTests/B2CWebAppCallsWebApiLocally.cs, disable the single test method Susi_B2C_LocalAccount_TodoAppFunctionsCorrectlyAsync by changing its [Fact] attribute to include a Skip reason.

The change should be on line 42 only:

-    [Fact]
+    [Fact(Skip = "Legacy B2C test infrastructure (webappsapistests Key Vault / fabrikamb2c tenant) is no longer valid.")]

This follows the existing skip pattern already used in the same test project (e.g., TestingWebAppLocally.cs line 48 and WebAppCallsApiCallsGraphLocally.cs line 186).

Do NOT modify anything else — no other files, no other lines, no deletions. Only this single attribute change.

The following is the prior conversation context from the user's chat exploration (may be truncated):

User: Please search the repo for all tests that depend on the legacy B2C test setup backed by Key Vault webappsapistests.

I already confirmed one example:

  • Susi_B2C_LocalAccount_TodoAppFunctionsCorrectlyAsync

I need the full list of tests that use any of these:

  • Key Vault URI: https://webappsapistests.vault.azure.net

  • secret names:

    • IdWeb-B2C-user
    • IdWeb-B2C-password
    • IdWeb-B2C-Client-ClientSecret

Please return:

  1. all matching test method names
  2. file paths
  3. whether they are UI/E2E/integration tests
  4. any shared helper/base class that centralizes this setup
  5. any appsettings or config files tied to the same B2C setup

Also check for equivalent patterns, not just exact string matches, such as:

  • constants like KeyvaultEmailName, KeyvaultPasswordName, KeyvaultClientSecretName
  • _keyvaultUri
  • B2C local account Todo app test flows
  • any references to test@id4s.authsdk.org

Goal: identify every test that should be reviewed or potentially disabled if this old B2C infra is no longer valid.

Assistant:

I'll conduct a thorough search across the repository to find all tests and configuration tied to the legacy B2C test infrastructure. Let me search for each indicator systematically.

Assistant: Now let me check for any other test files that might reference these B2C patterns and the UiTestHelpers shared class:

Assistant: Now let me also check the DevApps config files for the B2C setup:

Assistant: Now I have a comprehensive picture. Let me verify there are no other test files referencing this B2C Key Vault setup that I might have missed:

Assistant: Now I have a comprehensive picture. Let me verify no other test files reference webappsapistests or the B2C keyvault secrets by checking one more pattern:

Assistant: Based on the thorough search across the repository, here is the complete inventory of everything tied to the legacy B2C test setup backed by Key Vault webappsapistests.


1. Matching Test Methods

There is exactly one test method that directly depends on the webappsapistests Key Vault and the B2C secrets:

# Test Method File Type
1 Susi_B2C_LocalAccount_TodoAppFunctionsCorrectlyAsync tests/E2E Tests/WebAppUiTests/B2CWebAppCallsWebApiLocally.cs UI / E2E test (Playwright-based, [Fact], Windows-only)

No other test class or test method in the repository references webappsapistests.vault.azure.net, IdWeb-B2C-user, IdWeb-B2C-password, or IdWeb-B2C-Client-ClientSecret. The string test@id4s.authsdk.org also has zero matches in the repository.


2. File Paths (Full Blast Radius)

Test file

    private const string KeyvaultEmailName = "IdWeb-B2C-user";
    private const string KeyvaultPasswordName = "IdWeb-B2C-password";
    private const string KeyvaultClientSecretName = "IdWeb-B2C-Client-ClientSecret";
    private const string NameOfUser = "unknown";
    private const uint TodoListClientPort = 5000;
    private const uint TodoListServicePort = 44332;
    private const string TraceClassName = "B2CWebAppCallsWebApiLocally";
    private readonly LocatorAssertionsToBeVisibleOptions _assertVisibleOptions = new() { Timeout = 25000 };
    private readonly string _devAppPath = Path.Join("DevApps", "B2CWebAppCallsWebApi");
    private readonly Uri _keyvaultUri = new("https://webappsapistests.vault.azure.net");

DevApp (SUT) launched by the test

File Purpose
tests/DevApps/B2CWebAppCallsWebApi/Client/appsettings.json B2C client config (fabrikamb2c tenant, client ID fdb91ff5-...)
tests/DevApps/B2CWebAppCallsWebApi/TodoListService/appsettings.json B2C service config (fabrikamb2c tenant, client ID 90c0fe63-...)
tests/DevApps/B2CWebAppCallsWebApi/Client/Startup.cs Client app startup (reads AzureAdB2C section)
tests/DevApps/B2CWebAppCallsWebApi/Client/TodoListClient.csproj Client project
`tests/DevApps/B2CWebAp...

This pull request was created from Copilot chat.

Copilot AI changed the title [WIP] Disable Susi_B2C_LocalAccount_TodoAppFunctionsCorrectlyAsync test Skip legacy B2C local-account Todo UI test in WebAppUiTests Apr 15, 2026
Copilot AI requested a review from gladjohn April 15, 2026 21:31
@gladjohn gladjohn marked this pull request as ready for review April 15, 2026 21:33
@gladjohn gladjohn requested a review from a team as a code owner April 15, 2026 21:33
@Avery-Dunn
Copy link
Copy Markdown
Contributor

Approved, but you should make a Github issue to track re-enabling skipped tests (if there isn't one already)

@bgavrilMS bgavrilMS merged commit fb710b8 into master Apr 15, 2026
2 of 6 checks passed
@bgavrilMS bgavrilMS deleted the copilot/disable-susi-b2c-test branch April 15, 2026 21:58
This was referenced May 25, 2026
gunndabad added a commit to DFE-Digital/teaching-record-system that referenced this pull request Jun 4, 2026
Updated
[Microsoft.Identity.Web](https://github.com/AzureAD/microsoft-identity-web)
from 4.7.0 to 4.10.0.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.Identity.Web's
releases](https://github.com/AzureAD/microsoft-identity-web/releases)._

## 4.10.0

### New features
- Add `WithExtraBodyParameters` fluent API for attaching extra body
parameters to token acquisition requests. See
[#​3819](AzureAD/microsoft-identity-web#3819).
- Add `IConfidentialClientApplicationProvider` extensibility interface
and `CachePartitionKey` support for silent token acquisition. See
[#​3822](AzureAD/microsoft-identity-web#3822).

### Bug fixes
- Redirect URI sanitization in authorization scenarios; centralize
redirect URI validation in a shared helper. See
[#​3825](AzureAD/microsoft-identity-web#3825).
- Reject dSTS-shaped `Authority` values with a clearer exception,
steering users to use `Instance` + `TenantId` instead. See
[#​3805](AzureAD/microsoft-identity-web#3805).
- Improve regex handling and adding length/timeout safeguards for
SameSite User Agent. See
[#​3811](AzureAD/microsoft-identity-web#3811).

### Behavior changes
- **B2C OpenID Connect event handler: LRU cache for issuer address.**
Issuer address lookups in the B2C OIDC event handler are now cached with
an LRU cache, improving performance for repeated lookups. See
[#​3821](AzureAD/microsoft-identity-web#3821).

### Dependencies updates
- Update MSAL.NET to 4.84.1. See
[#​3822](AzureAD/microsoft-identity-web#3822).
- Pin `Microsoft.Kiota.Abstractions` to 1.22.0 for GraphServiceClient.
See
[#​3817](AzureAD/microsoft-identity-web#3817).
- Bump `uuid` and `@​azure/msal-node` in SidecarAdapter TypeScript test
app. See
[#​3826](AzureAD/microsoft-identity-web#3826).
- Bump `qs` in SidecarAdapter TypeScript test app. See
[#​3829](AzureAD/microsoft-identity-web#3829).

## 4.9.0

### New features
- **Sidecar: per-route override gating.** New `Sidecar:AllowOverrides`
configuration section provides explicit, per-route control over whether
`optionsOverride.*` query-string parameters are honored. Authenticated
routes default to allowing overrides (preserving existing behavior);
unauthenticated routes default to rejecting them.
`optionsOverride.BaseUrl` is unconditionally rejected on all routes as a
hardening measure. See
[#​3794](AzureAD/microsoft-identity-web#3794).

### Bug fixes
- Fix `AccountController.Challenge` redirect URI validation to reject
percent-encoded protocol-relative bypasses (`%2F%2F`, `%5C%2F`, etc.)
that could be decoded by misconfigured reverse proxies. See
[#​3792](AzureAD/microsoft-identity-web#3792).

### Behavior changes
- **DownstreamApi: reserved header filtering.** Headers supplied via
`DownstreamApiOptions.ExtraHeaderParameters` whose names match reserved
HTTP headers (`Authorization`, `Host`, `Content-Length`,
`Proxy-Authorization`, `Sec-*`, `Proxy-*`, etc.) or duplicate a header
the library already set are now silently skipped. A warning-level log
entry (`ReservedHeaderIgnored` / `DuplicateHeaderIgnored`) is emitted so
operators can spot misconfigurations. No exception is thrown. See
[#​3793](AzureAD/microsoft-identity-web#3793).

### Dependencies updates
- **Update Azure.Identity 1.11.4 → 1.17.2 and establish
Microsoft.Extensions.\* 8.0.x minimum on older TFMs.** Azure.Identity
1.17.2 (sovereign-cloud fixes) pulls in Azure.Core 1.50.0, which
introduces a transitive dependency on
`Microsoft.Extensions.DependencyInjection.Abstractions` 8.0.2 on
non-framework-coupled TFMs (net462, net472, netstandard2.0). This caused
a `CS0433` type collision with the previously-pinned
`Microsoft.Extensions.DependencyInjection` 2.1.0. Rather than patch
individual packages, the entire `Microsoft.Extensions.*` stack on these
older TFMs has been bumped to 8.0.x, closing several 5-year version gaps
and aligning with the net8.0 baseline. **If your application targets
net462, net472, or netstandard2.0**, your resolved
`Microsoft.Extensions.*` versions will increase (e.g., `Extensions.Http`
3.1.3 → 8.0.0, `Extensions.DependencyInjection` 2.1.0 → 8.0.0,
`Extensions.Caching.Memory` 2.1.0/6.0.2 → 8.0.1). Applications already
targeting net8.0+ are unaffected. See
[#​3787](AzureAD/microsoft-identity-web#3787).
- Bump `System.Text.Json` 8.0.5 → 8.0.6 (CVE-2024-43485). See
[#​3787](AzureAD/microsoft-identity-web#3787).
- Bump `Microsoft.AspNetCore.DataProtection` to 10.0.7 for CVE fix on
net10.0. See
[#​3796](AzureAD/microsoft-identity-web#3796).
- Bump `OpenTelemetry.Exporter.OpenTelemetryProtocol` 1.14.0 → 1.15.3.
See
[#​3788](AzureAD/microsoft-identity-web#3788).

**Full Changelog**:
AzureAD/microsoft-identity-web@4.8.0...4.9.0

## 4.8.0

## What's Changed
* Bump flatted from 3.3.3 to 3.4.2 in
/tests/DevApps/SidecarAdapter/typescript by @​dependabot[bot] in
AzureAD/microsoft-identity-web#3753
* Update changelog.md for ID.Web 4.6.0 by @​bgavrilMS in
AzureAD/microsoft-identity-web#3756
* Add token binding to MicrosoftIdentityMessageHandler by @​cpp11nullptr
in AzureAD/microsoft-identity-web#3743
* Bump picomatch in /tests/DevApps/SidecarAdapter/typescript by
@​dependabot[bot] in
AzureAD/microsoft-identity-web#3759
* Documentation: Clarify managed identity credential types for
containerized vs. VM/App Service deployments by @​Copilot in
AzureAD/microsoft-identity-web#3585
* Bump path-to-regexp from 8.3.0 to 8.4.0 in
/tests/DevApps/SidecarAdapter/typescript by @​dependabot[bot] in
AzureAD/microsoft-identity-web#3762
* Upgrade Microsoft Application Insights packages by @​RojaEnnam in
AzureAD/microsoft-identity-web#3763
* Use Abstractions 12 by @​pmaytak in
AzureAD/microsoft-identity-web#3761
* Post-4.7.0 by @​pmaytak in
AzureAD/microsoft-identity-web#3768
* Fix Comp Gov DOTNET-Security-10.0 by @​reginayap8 in
AzureAD/microsoft-identity-web#3769
* Upgrade CodeQL to V4: Fix 10 CodeQL Analysis Warnings and Errors by
@​reginayap8 in
AzureAD/microsoft-identity-web#3770
* fix warnings by @​gladjohn in
AzureAD/microsoft-identity-web#3771
* adding examples for using postgres as a distributed cache by
@​JaredMSFT in
AzureAD/microsoft-identity-web#3766
* Suppress AOT configuration-binding SYSLIB warnings in AotCompatibility
test app by @​Copilot in
AzureAD/microsoft-identity-web#3774
* Bump vite from 7.1.11 to 7.3.2 in
/tests/DevApps/SidecarAdapter/typescript by @​dependabot[bot] in
AzureAD/microsoft-identity-web#3772
* Skip legacy B2C local-account Todo UI test in WebAppUiTests by
@​Copilot in AzureAD/microsoft-identity-web#3778
* Fix initialization of ConfidentialClientApplicationOptions in
MergedOptions by @​cpp11nullptr in
AzureAD/microsoft-identity-web#3760
* Bump net8/net9/net10 runtime package baselines to patched crypto
servicing versions by @​Copilot in
AzureAD/microsoft-identity-web#3779
* Fix flaky certificate test failures on CI by @​gladjohn in
AzureAD/microsoft-identity-web#3780
* MTLS Without Tokens Support by @​tlupes in
AzureAD/microsoft-identity-web#3747
* Fix CredentialsProvider DI lifetime mismatch causing startup crash in
Development by @​Avery-Dunn in
AzureAD/microsoft-identity-web#3783
* Remove unused DataProtection configuration from Sidecar by @​Copilot
in AzureAD/microsoft-identity-web#3776

## New Contributors
* @​RojaEnnam made their first contribution in
AzureAD/microsoft-identity-web#3763
* @​reginayap8 made their first contribution in
AzureAD/microsoft-identity-web#3769
* @​JaredMSFT made their first contribution in
AzureAD/microsoft-identity-web#3766

**Full Changelog**:
AzureAD/microsoft-identity-web@4.6.0...4.8.0

Commits viewable in [compare
view](AzureAD/microsoft-identity-web@4.7.0...4.10.0).
</details>

[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=Microsoft.Identity.Web&package-manager=nuget&previous-version=4.7.0&new-version=4.10.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: James Gunn <james@gunn.io>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants