Startup configuration logging of connections and connections map

[Rodrigo Brandão (rodrigobr-msft)]

This pull request introduces logging and redaction utilities for authentication configuration, improves configuration handling, and adds comprehensive tests. The main focus is on securely logging authentication-related configuration while ensuring sensitive data is not exposed. Below are the most important changes:

Logging and Redaction Utilities

• Added _log_config and related redaction helper functions (e.g., _redact_str, _redact_url, _summarize_auth_configs) in authorization/_log_config.py to safely log authentication configuration by redacting secrets and summarizing sensitive fields.
• Integrated _log_config into the ConnectionManager class to automatically log the configuration summary (with secrets redacted) when a new instance is created. [1] [2]

Configuration Handling Improvements

• Changed the default value for CONNECTIONSMAP in load_configuration_from_env to an empty list instead of an empty dict, ensuring consistent type usage.
• In authorization.py, ensured handler configuration defaults to an empty dict if not present, and made handler type default to an empty string instead of None.
• Improved normalization of the connections map in ConnectionManager to always use a list, handling both dict and list input.

Testing

• Added a new test module test_log_config.py with comprehensive unit tests for all redaction and logging utilities, verifying correct redaction of secrets, proper summarization, and correct logging behavior.

[Copilot]

Pull request overview

This PR adds secure startup logging for authentication connection configuration in the hosting-core layer, including redaction/summarization helpers and unit tests, and tightens configuration normalization for CONNECTIONSMAP/handler defaults.

Changes:

• Introduces authorization/_log_config.py to summarize authentication configs and connection maps with redaction, and logs this summary from ConnectionManager construction.
• Normalizes configuration defaults (CONNECTIONSMAP now defaults to []; handler config defaults are hardened).
• Adds comprehensive unit tests covering redaction, summarization, and parameterized logging behavior.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
tests/hosting_core/test_log_config.py	Adds unit tests validating redaction/summarization outputs and logger parameterization.
libraries/microsoft-agents-hosting-core/microsoft_agents/hosting/core/authorization/connection_manager.py	Logs a redacted configuration summary on initialization and normalizes CONNECTIONSMAP shape.
libraries/microsoft-agents-hosting-core/microsoft_agents/hosting/core/authorization/_log_config.py	Implements redaction + summarization utilities and _log_config() for safe config logging.
libraries/microsoft-agents-hosting-core/microsoft_agents/hosting/core/app/oauth/authorization.py	Makes handler config parsing more robust by defaulting missing config sections/fields.
libraries/microsoft-agents-activity/microsoft_agents/activity/config/_load_configuration.py	Changes CONNECTIONSMAP default from {} to [] for consistent runtime typing.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

libraries/microsoft-agents-hosting-core/microsoft_agents/hosting/core/authorization/_log_config.py:77

• _redact_url() relies on urlparse() raising for invalid/non-URL inputs, but urlparse() typically does not raise. For values like regex patterns (e.g., CONNECTIONSMAP SERVICEURL can be "agentic"), this currently logs as "://...", which is confusing and not a valid redaction output. Consider treating inputs without both scheme and netloc as non-URLs and returning "...".

    try:
        url_parsed = urlparse(url)
        return f"{url_parsed.scheme}://{url_parsed.netloc}/..."
    except Exception:
        return "..."