Address potential variations in the value of the authority url

[benbrown]

Resolves #953

Introduce a method to resolve the authority URL that allows for it to include the tenant ID in the configured URL instead of separately.

Previously, we always expected authority to be in the format 'http://login.microsoft.com' and to NOT include the tenantId. This is inconsistent with Python and Dotnet, so this PR addresses that.

Major changes:

1. Introduce resolveAuthority(url, tenant) which will generate the correct tenant
2. Apply resolveAuthority wherever we were using the previous faulty mechanism

NEW:

Prior to these changes, configurations lacking a tenant ID would create urls with undefined in the authority url. This is obviously incorrect. The one exception is that inside the msalTokenProvider, we would default to botframework.com

In this PR, we have added this behavior to all places where this authority URL is used.

TODO:

-[ ] Double check that botframework.com should be used as a default tenant id if not specified

[benbrown]

@copilot please review

[Copilot]

@benbrown I've opened a new pull request, #974, to work on those changes. Once the pull request is ready, I'll request review from you.

[Copilot]

Pull request overview

This PR improves authority URL handling in agents-hosting auth flows by introducing a shared resolveAuthority(authority, tenantId) helper that supports both “base authority + tenantId” and “tenant embedded in authority” configuration styles, aligning behavior with Python/.NET and avoiding malformed URLs containing undefined.

Changes:

• Added resolveAuthority() utility and updated default issuer construction to use it (with botframework.com fallback when tenantId is missing).
• Updated JWT middleware JWKS URI construction and MSAL connection defaults to use the resolved authority.
• Added/updated tests for authority resolution and the embedded-tenant authority scenario.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
packages/agents-hosting/src/auth/authConfiguration.ts	Adds resolveAuthority() and uses it when building default issuers (avoids undefined tenant segments).
packages/agents-hosting/src/auth/jwt-middleware.ts	Uses resolveAuthority() when constructing the JWKS discovery URI.
packages/agents-hosting/src/auth/msalConnectionManager.ts	Uses resolveAuthority() for default issuer URLs in connection defaults.
packages/agents-hosting/src/auth/msalTokenProvider.ts	Refactors authority resolution to delegate to the shared utility and handle agentic overrides more cleanly.
packages/agents-hosting/test/hosting/authConfiguration.test.ts	Updates issuer expectations and adds targeted tests for resolveAuthority().
packages/agents-hosting/test/hosting/jwt-middleware.test.ts	Adds a test case for embedded-tenant authority configuration.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.