fix: derive OIDC ALLOWED_HOSTS from connection string hostname instead of hardcoded *.azure.com (fixes #639)

[hanhan761]

Summary

The OIDC ALLOWED_HOSTS was hardcoded to ['*.azure.com'] in two places, blocking Entra ID authentication for sovereign clouds (*.azure.cn, *.azure.us). This PR introduces a shared helper that widens the allowlist across the Azure host family while keeping it a meaningful security control.

Changes

• New shared helper getOidcAllowedHosts() in src/documentdb/auth/oidcAllowedHosts.ts
• Updated MicrosoftEntraIDAuthHandler.ts and playgroundWorker.ts to use the helper
• Unit tests in oidcAllowedHosts.test.ts

Scope and security note (updated after review)

ALLOWED_HOSTS is a security control: the driver only sends the OIDC token to a server whose hostname matches one of these patterns. For that reason the helper does NOT echo the raw connection-string host back into the allowlist (an earlier draft did *.${host}, which would let an attacker-supplied host such as evil.com self-authorize *.evil.com and also produced patterns that did not match the host once a port was present).

Instead the helper recognizes the Azure-family registrable suffix (azure.<tld>) and allows only *.azure.<tld>:

• asdf.xyz.mongocluster.cosmos.azure.com to *.azure.com
• sovereign clouds: *.azure.us, *.azure.cn
• lookalikes such as node.azure.com.evil.com are rejected (the azure label must be the registrable second level)
• anything not positively classified as Azure falls back to the safe ['*.azure.com']

This keeps the public-cloud posture identical to the previous hardcoded value while transparently extending it to sovereign clouds. Azure private endpoints are still covered because they resolve under *.azure.com. Truly custom (non-Azure) domains are intentionally NOT auto-trusted; supporting them safely would require an explicit, opt-in setting and is out of scope here.

Follow-up (separate work): sovereign clouds also use a different Entra token endpoint, which this PR does not change.

Issue

Fixes #639

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Replaces the hardcoded ['*.azure.com'] OIDC ALLOWED_HOSTS list with a helper that derives the allowed host from the actual connection string, enabling OIDC against sovereign clouds, private endpoints, and custom domains.

Changes:

• Adds a new getOidcAllowedHosts helper that parses the connection string and falls back to ['*.azure.com'] on failure.
• Uses the helper in both MicrosoftEntraIDAuthHandler and the playground worker in place of the hardcoded list.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
src/documentdb/auth/oidcAllowedHosts.ts	New helper to extract the OIDC allowed host from a connection string with a safe fallback.
src/documentdb/auth/MicrosoftEntraIDAuthHandler.ts	Switches the OIDC auth handler to use the new helper.
src/documentdb/playground/playgroundWorker.ts	Switches the playground worker to use the new helper.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

[hanhan761]

Hi Tomasz / team,

Sorry for the slightly off-topic note. I’ve been actively contributing to this repository under @hanhan761, including PR #700 which has been merged, and I’m very interested in continuing to contribute more deeply to VS Code database tooling.

I’d like to ask whether there is a suitable public contact channel for discussing a possible remote internship or mentored contributor opportunity with the team.

I previously tried an old public Alpaqa Studio email address, but it bounced. I’d really appreciate any guidance on the right way to reach out.

Thank you.

[tnaum-ms]

Maintainer note (review-driven rewrite)

The helper was reworked during review. The original approach derived the allowlist directly from the connection-string host (*.${host}), which had two problems:

1. Security: it let an attacker-supplied host widen its own allowlist (a string pointing at evil.com would self-authorize *.evil.com), which defeats the purpose of ALLOWED_HOSTS.
2. Correctness: hosts entries can carry a port, so *.${host} produced patterns like *.cluster.azure.com:10255 that don't match the host under the driver's endsWith matching.

It now extracts only the Azure-family registrable suffix and returns *.azure.<tld> (public and sovereign clouds), rejects lookalikes such as node.azure.com.evil.com, and falls back to ['*.azure.com'] when it cannot positively classify the host. The PR description has been updated to document this narrowed scope, and oidcAllowedHosts.test.ts covers the cases.

Separate follow-up (not in this PR): sovereign clouds also use a different Entra token endpoint.