Small improvements

Author: Avery-Dunn

msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/AadInstanceDiscoveryProvider.java

@@ -246,7 +246,7 @@ static AadInstanceDiscoveryResponse sendInstanceDiscoveryRequest(URL authorityUr
         AadInstanceDiscoveryResponse response = JsonHelper.convertJsonStringToJsonSerializableObject(httpResponse.body(), AadInstanceDiscoveryResponse::fromJson);
 
         if (httpResponse.statusCode() != HttpStatus.HTTP_OK) {
-            if (httpResponse.statusCode() == HttpStatus.HTTP_BAD_REQUEST && response.error().equals("invalid_instance")) {
+            if (httpResponse.statusCode() == HttpStatus.HTTP_BAD_REQUEST && response.error().equals(AuthenticationErrorCode.INVALID_INSTANCE)) {
                 // instance discovery failed due to an invalid authority, throw an exception.
                 throw MsalServiceExceptionFactory.fromHttpResponse(httpResponse);
             }
@@ -355,10 +355,9 @@ private static void doInstanceDiscoveryAndCache(URL authorityUrl,
             try {
                 aadInstanceDiscoveryResponse = sendInstanceDiscoveryRequest(authorityUrl, msalRequest, serviceBundle);
             } catch (MsalServiceException ex) {
-                // Only propagate "invalid_instance" — this means the authority itself is invalid.
-                // All other HTTP-level errors (500, 502, 404, etc.) should fall through to the
-                // fallback path, matching the behavior of MSAL .NET's InstanceDiscoveryManager.
-                if ("invalid_instance".equals(ex.errorCode())) {
+                // Throw "invalid_instance" errors: this means the authority itself is invalid.
+                // All other HTTP-level errors (500, 502, 404, etc.) should fall through to the fallback path.
+                if (ex.errorCode().equals(AuthenticationErrorCode.INVALID_INSTANCE)) {
                     throw ex;
                 }
                 LOG.warn("Instance discovery request failed with a service error. " +

msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/AuthenticationErrorCode.java

@@ -160,4 +160,10 @@ public class AuthenticationErrorCode {
     public static final String CRYPTO_ERROR = "crypto_error";
 
     public static final String INVALID_TIMESTAMP_FORMAT = "invalid_timestamp_format";
+
+    /**
+     * Indicates that instance discovery failed because the authority is not a valid instance.
+     * This is returned by the instance discovery endpoint when the provided authority host is unknown.
+     */
+    public static final String INVALID_INSTANCE = "invalid_instance";
 }

msal4j-sdk/src/test/java/com/microsoft/aad/msal4j/KnownMetadataProviderTest.java

@@ -60,40 +60,6 @@ void getMetadataEntry_publicCloudAliases_resolvesToSameEntry() {
         assertSame(entry3, entry4);
     }
 
-    @Test
-    void getMetadataEntry_chinaCloud_returnsCorrectAliases() {
-        // Act
-        InstanceDiscoveryMetadataEntry entry = KnownMetadataProvider.getMetadataEntry("login.chinacloudapi.cn");
-
-        // Assert
-        assertNotNull(entry);
-        assertEquals("login.partner.microsoftonline.cn", entry.preferredNetwork());
-        assertEquals("login.partner.microsoftonline.cn", entry.preferredCache());
-        assertEquals(2, entry.aliases().size());
-        assertTrue(entry.aliases().contains("login.partner.microsoftonline.cn"));
-        assertTrue(entry.aliases().contains("login.chinacloudapi.cn"));
-
-        // Both aliases should resolve to the same entry
-        assertSame(entry, KnownMetadataProvider.getMetadataEntry("login.partner.microsoftonline.cn"));
-    }
-
-    @Test
-    void getMetadataEntry_usGov_returnsCorrectAliases() {
-        // Act
-        InstanceDiscoveryMetadataEntry entry = KnownMetadataProvider.getMetadataEntry("login.microsoftonline.us");
-
-        // Assert
-        assertNotNull(entry);
-        assertEquals("login.microsoftonline.us", entry.preferredNetwork());
-        assertEquals("login.microsoftonline.us", entry.preferredCache());
-        assertEquals(2, entry.aliases().size());
-        assertTrue(entry.aliases().contains("login.microsoftonline.us"));
-        assertTrue(entry.aliases().contains("login.usgovcloudapi.net"));
-
-        // Both aliases should resolve to the same entry
-        assertSame(entry, KnownMetadataProvider.getMetadataEntry("login.usgovcloudapi.net"));
-    }
-
     @Test
     void getMetadataEntry_unknownHost_returnsNull() {
         assertNull(KnownMetadataProvider.getMetadataEntry("custom.authority.example.com"));