Fix MSAL Entra token flow

[aasimkhan30]

Description

Updates classic MSAL-backed Azure MFA connections to refresh the account cache without passing SQL access tokens to STS, allowing SqlClient's registered authentication provider to acquire SQL tokens from the MSAL cache. Removes the stale connection dialog token refresh action.

The first incorrect MSAL-provider token-setting path appears to have been introduced in OE (Improvements in access token flows (#17670)) on May 3, 2023: when OE decided the account/cache needed refresh, it called refreshAccount(...), which still assigned azureAccountToken/expiresOn even though SQL Auth Provider was enabled. I later copied that OE-style logic when centralizing connection preparation before connect in 5e1d743b (Refactoring connection management (#18684)) on February 25, 2025, which made the behavior broader for Azure MFA connections.

Potential Issues:

#22078
#22046

Code Changes Checklist

• New or updated unit tests added
• All existing tests pass (npm run test)
• Code follows contributing guidelines
• Telemetry/logging updated if relevant
• No regressions or UX breakage

Reviewers: Please read our reviewer guidelines

[Copilot]

Pull request overview

This PR adjusts the Microsoft Entra (Azure MFA) authentication flow for classic MSAL-backed connections so that the extension refreshes the MSAL account cache but avoids passing SQL access tokens to SQL Tools Service (STS), relying instead on SqlClient’s registered SqlAuthenticationProvider to obtain SQL tokens from the shared MSAL cache. It also removes the now-stale “refresh token” UX from the connection dialog.

Changes:

• Updates ConnectionManager.refreshEntraTokenIfNeeded to refresh the MSAL account cache and then clear azureAccountToken/expiresOn so SQL token acquisition is delegated to STS/SqlClient.
• Removes the connection dialog action that attempted to refresh Entra tokens client-side (and the related error prompt flow).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
extensions/mssql/src/controllers/connectionManager.ts	Reworks Entra token refresh logic to refresh MSAL account cache without sending SQL access tokens to STS; removes now-unneeded local SQL-token caching and refresh dedupe.
extensions/mssql/src/connectionconfig/connectionDialogWebviewController.ts	Removes the Entra token refresh action/button from the connection dialog UX.

Comments suppressed due to low confidence (1)

extensions/mssql/src/connectionconfig/connectionDialogWebviewController.ts:1772

• getAzureActionButtons no longer adds the Entra token refresh action/button. There are existing unit tests that import refreshTokenLabel and assert a refreshToken action/button is present and used in error prompts; those tests will now fail. Please update/remove the affected tests to reflect the new UX (token refresh handled via MSAL cache refresh + STS provider) so CI remains green.

    private async getAzureActionButtons(): Promise<FormItemActionButton[]> {
        const actionButtons: FormItemActionButton[] = [];

        actionButtons.push({
            label: Loc.signIn,
            id: "azureSignIn",
            callback: async () => {

[github-actions]

PR Changes

Category	Target Branch	PR Branch	Difference
vscode-mssql VSIX	78064 KB	78063 KB	⚪ -1 KB ( 0% )
sql-database-projects VSIX	6309 KB	6309 KB	⚪ 0 KB ( 0% )
data-workspace VSIX	535 KB	535 KB	⚪ 0 KB ( 0% )
keymap VSIX	7 KB	7 KB	⚪ 0 KB ( 0% )

[codecov-commenter]

Codecov Report

❌ Patch coverage is 85.71429% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 74.78%. Comparing base (2250e56) to head (dd6459d).

Files with missing lines	Patch %	Lines
...ensions/mssql/src/controllers/connectionManager.ts	84.84%	5 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #22079      +/-   ##
==========================================
- Coverage   74.83%   74.78%   -0.06%     
==========================================
  Files         394      394              
  Lines      120472   120235     -237     
  Branches     7201     7163      -38     
==========================================
- Hits        90159    89917     -242     
- Misses      30313    30318       +5     

Flag	Coverage Δ
data-workspace	77.10% <ø> (ø)
mssql	74.45% <85.71%> (-0.07%)	⬇️
sqlproj	77.36% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...nectionconfig/connectionDialogWebviewController.ts	67.56% <100.00%> (-0.44%)	⬇️
...ensions/mssql/src/controllers/connectionManager.ts	61.23% <84.84%> (-1.11%)	⬇️

... and 2 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.