Refactor Authorization flow

[sw-joelmut]

Fixes #377
Fixes #466
Fixes #516
Fixes #517
Fixes #628

Doesn't fix these issues yet
#590

Important

The new internal authorization structure removed all related classes like authorization.ts, oAuthFlow.ts, and samples.
More information of breaking changes can be found in compat/baseline/agents-hosting.api.md

Description

This PR refactors the internals of the AgentApplication authorization flow, leaving just the necessary functionality to be used from a sample's perspective, getToken, exchangeToken, signout, etc.
We removed the use of beginOrContinueFlow as this is intended to be used internally.

The new auth flow consists of detecting when a route handler is authorized to be executed. When having an authorization handler configured, the new auth flow will detect it and initiate the authentication flow, retrieving the signin oAuth card, then, the user will copy&paste the magic code, and the auth flow will detect there is an active auth flow, and send the magic code to the service, retrieving the token.

Related classes for the structure:

• AgentApplication
  • in charge of executing the route handler if the auth flow is authorized.
• AuthorizationManager
  • in charge of managing the state of the active auth handler, and executing the signin operation of each one.
• Authorization
  • the public class, having all operations like getToken, exchangeToken, signOut, etc.
• AzureBotAuthorization
  • having all operations of performing a signin, signout, etc. against the Azure Bot Service provider.
  • in charge of getting the oAuth card, sending the magic code, etc.
• HandlerStorage
  • a simple class to communicate with the configured storage (blobs, cosmos, etc)

Sequence diagram

Testing

The following image shows a few of the tested flows.

[Copilot]

Pull Request Overview

This PR refactors the internal authorization structure in the AgentApplication, removing deprecated classes while preserving public API functionality for samples. The changes streamline the authentication flow by replacing the complex beginOrContinueFlow mechanism with a simpler authorization manager approach.

• Complete removal of deprecated OAuthFlow class and related internal authorization classes
• Replacement with new AuthorizationManager system that handles route-level authorization checking
• Preservation of essential public methods (getToken, exchangeToken, signOut) for backward compatibility

Reviewed Changes

Copilot reviewed 32 out of 32 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
test-agents/web-chat/src/webChatSso.ts	Removed deprecated WebChatSsoHandler using old OAuthFlow approach
test-agents/web-chat/src/index.ts	Removed webChatSso agent registration from test agents
test-agents/application-style/src/webChatSso.ts	Removed deprecated application-style SSO implementation
test-agents/application-style/src/index.ts	Removed webChatSso module loading
samples/compat/oauthFlowHandler.ts	Removed compatibility sample using deprecated OAuthFlowHandler
samples/auth/oneProvider.ts	Removed deprecated beginOrContinueFlow call
samples/auth/oAuthAgent.ts	Removed deprecated OAuth agent sample implementation
samples/auth/createAppDemo.ts	Removed deprecated create app demo
samples/auth/autoAuth.ts	Updated to use new authorization flow patterns and improved error handling
packages/agents-hosting/test/hosting/oauthflow.test.ts	Removed tests for deprecated OAuthFlow class
packages/agents-hosting/test/hosting/app/authorization.test.ts	Updated tests for new authorization structure
packages/agents-hosting/test/cases/	Added comprehensive authentication test documentation
packages/agents-hosting/src/oauth/userTokenClient.types.ts	Added optional connectionName to TokenExchangeRequest
packages/agents-hosting/src/oauth/oAuthFlow.ts	Removed deprecated OAuthFlow class
packages/agents-hosting/src/oauth/index.ts	Removed OAuthFlow export
packages/agents-hosting/src/app/auth/	Added new authorization system with handlers and manager
packages/agents-hosting/src/app/agentApplication.ts	Updated to use new authorization manager for route processing
compat/baseline/agents-hosting.api.md	Updated API documentation reflecting breaking changes

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

Incorrect import path. The debug function should be imported from '@microsoft/agents-activity/logger', not '@microsoft/agents-activity'.

Suggested change

	import { debug } from '@microsoft/agents-activity'
	import { debug } from '@microsoft/agents-activity/logger'

[Copilot]

Corrected spelling of 'signin' to 'signin' in method name.