v3.3.1 schemas and Dev Proxy API security features - #1881
Merged
Merged
Conversation
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Unresolved critical compatibility and credential-protection issues, plus moderate security, binding, schema, and test defects require changes.
Get a fresh assessment by requesting another Copilot review.
Review effort: Lite
Findings: 2
Open (4)
What changed in this PR
Adds authenticated Dev Proxy API access, configurable binding and CORS, secure token handling, Docker/CI updates, and v3.3.1 schemas.
Changes:
- Adds bearer-token authentication, API commands, and credential lifecycle management.
- Updates documentation, examples, tests, Dockerfiles, and API binding configuration.
- Adds v3.3.1 schemas and extends the v4 root schema.
| File | Reviewed change |
|---|---|
tests/devproxy-api.http |
Moderate (1 vote): REST Client token variable syntax prevents token resolution. |
skills/dev-proxy/references/configuration.md |
Documents API security and binding. |
skills/dev-proxy/references/ci-cd-integration.md |
Updates CI authentication guidance. |
skills/dev-proxy/references/analyze-api-usage.md |
Updates authenticated API usage examples. |
scripts/Dockerfile_local |
Enables container API binding and CLI access. |
schemas/v4.0.0/rc.schema.json |
Adds API security configuration fields. |
schemas/v3.3.1/typespecgeneratorplugin.schema.json |
Adds TypeSpec plugin schema. |
schemas/v3.3.1/rewriteplugin.schema.json |
Adds rewrite plugin schema. |
schemas/v3.3.1/rewriteplugin.rewritesfile.schema.json |
Adds rewrite rules schema. |
schemas/v3.3.1/rc.schema.json |
Adds the v3.3.1 root configuration schema. |
schemas/v3.3.1/ratelimitingplugin.schema.json |
Adds rate-limiting schema. |
schemas/v3.3.1/ratelimitingplugin.customresponsefile.schema.json |
Adds rate-limit response schema. |
schemas/v3.3.1/openapispecgeneratorplugin.schema.json |
Adds OpenAPI generator schema. |
schemas/v3.3.1/openaitelemetryplugin.schema.json |
Adds OpenTelemetry schema. |
schemas/v3.3.1/openaitelemetryplugin.pricesfile.schema.json |
Adds telemetry pricing schema. |
schemas/v3.3.1/mockstdioresponseplugin.schema.json |
Adds STDIO mock plugin schema. |
schemas/v3.3.1/mockstdioresponseplugin.mocksfile.schema.json |
Adds STDIO mocks schema. |
schemas/v3.3.1/mockresponseplugin.schema.json |
Adds mock response schema. |
schemas/v3.3.1/mockresponseplugin.mocksfile.schema.json |
Adds mock definitions schema. |
schemas/v3.3.1/mockrequestplugin.schema.json |
Adds mock request schema. |
schemas/v3.3.1/mockrequestplugin.mockfile.schema.json |
Adds mock request file schema. |
schemas/v3.3.1/minimalpermissionsplugin.schema.json |
Adds permissions schema. |
schemas/v3.3.1/minimalpermissionsguidanceplugin.schema.json |
Adds permissions guidance schema. |
schemas/v3.3.1/minimalcsompermissionsplugin.schema.json |
Adds CSOM permissions schema. |
schemas/v3.3.1/minimalcsompermissions.types.schema.json |
Adds CSOM types schema. |
schemas/v3.3.1/latencyplugin.schema.json |
Adds latency schema. |
schemas/v3.3.1/languagemodelratelimitingplugin.schema.json |
Adds language-model rate-limit schema. |
schemas/v3.3.1/languagemodelratelimitingplugin.customresponsefile.schema.json |
Adds language-model response schema. |
schemas/v3.3.1/languagemodelfailureplugin.schema.json |
Adds language-model failure schema. |
schemas/v3.3.1/httpfilegeneratorplugin.schema.json |
Adds HTTP generator schema. |
schemas/v3.3.1/hargeneratorplugin.schema.json |
Adds HAR generator schema. |
schemas/v3.3.1/graphrandomerrorplugin.schema.json |
Adds Graph error schema. |
schemas/v3.3.1/graphminimalpermissionsplugin.schema.json |
Adds Graph permissions schema. |
schemas/v3.3.1/graphminimalpermissionsguidanceplugin.schema.json |
Adds Graph guidance schema. |
schemas/v3.3.1/genericrandomerrorplugin.schema.json |
Adds generic error schema. |
schemas/v3.3.1/genericrandomerrorplugin.errorsfile.schema.json |
Adds generic error response schema. |
schemas/v3.3.1/executionsummaryplugin.schema.json |
Adds execution summary schema. |
schemas/v3.3.1/devtoolsplugin.schema.json |
Moderate (3 votes): invalid JSON and missing supported preferredBrowserPath. |
schemas/v3.3.1/crudapiplugin.schema.json |
Adds CRUD API plugin schema. |
schemas/v3.3.1/crudapiplugin.apifile.schema.json |
Moderate (2 votes): action-level auth omits the supported apiKey value. |
schemas/v3.3.1/cachingguidanceplugin.schema.json |
Adds caching guidance schema. |
schemas/v3.3.1/authplugin.schema.json |
Adds authentication schema. |
schemas/v3.3.1/apicenterproductionversionplugin.schema.json |
Adds API Center production-version schema. |
schemas/v3.3.1/apicenteronboardingplugin.schema.json |
Adds API Center onboarding schema. |
schemas/v3.3.1/apicenterminimalpermissionsplugin.schema.json |
Adds API Center permissions schema. |
Dockerfile_beta |
Configures authenticated container API binding. |
Dockerfile |
Configures authenticated container API binding. |
DevProxy/State/StateManager.cs |
Persists state and cleans credentials. |
DevProxy/State/ProxyInstanceState.cs |
Stores proxy URL state. |
DevProxy/State/PrivateFiles.cs |
Adds protected file and directory handling. |
DevProxy/Proxy/ProxyConfiguration.cs |
Adds API bind-address configuration. |
DevProxy/Proxy/InteractiveConsoleService.cs |
Coordinates startup output. |
DevProxy/Proxy/ConsoleHotkeyHandler.cs |
Prints authenticated API instructions. |
DevProxy/Program.cs |
Critical (3 votes): existing log directories are not secured before logging the bearer token. |
DevProxy/Extensions/IServiceCollectionExtensions.cs |
Configures CORS and hosted services. |
DevProxy/Commands/StopCommand.cs |
Uses authenticated API shutdown. |
DevProxy/Commands/StatusCommand.cs |
Adds authenticated status reporting. |
DevProxy/Commands/DevProxyConfigOptions.cs |
Parses API bind-address options. |
DevProxy/Commands/DevProxyCommand.cs |
Moderate (1 vote): port-conflict checks ignore bind addresses; Nit (1 vote): stale /swagger help text. |
DevProxy/Commands/ApiCommand.cs |
Adds token retrieval and API information commands. |
DevProxy/ApiSecurity.cs |
Moderate (1 vote): lacks automated coverage for authentication, origins, and preflight behavior. |
DevProxy.Tests/Fakes.cs |
Updates test configuration fakes. |
DevProxy.Tests/ConsoleHotkeyHandlerTests.cs |
Covers authenticated API output. |
DevProxy.Integration.Tests/TestProxyConfiguration.cs |
Updates integration test configuration. |
DevProxy.Abstractions/Proxy/IProxyConfiguration.cs |
Critical (2 votes): required public member breaks compatibility for external implementations. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| public interface IProxyConfiguration | ||
| { | ||
| int ApiPort { get; set; } | ||
| string ApiIpAddress { get; set; } |
| { | ||
| _ = Directory.CreateDirectory(logDir); | ||
| PrivateFiles.EnsureDirectory(StateManager.GetConfigFolder()); | ||
| PrivateFiles.EnsureDirectory(logDir); |
Comment on lines
+64
to
+68
| "enum": [ | ||
| "none", | ||
| "entra" | ||
| ], | ||
| "description": "Determines if the action is secured. Allowed values: none, entra. Default is none." |
Comment on lines
+17
to
+21
| ] | ||
| "description": "Which browser to use to launch Dev Tools. Supported values: Edge, EdgeDev, Chrome. Default: Edge." | ||
| } | ||
| }, | ||
| "additionalProperties": false |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.