[Tony Tang (anthony0t)]

Commit Type

• feature - New functionality
• fix - Bug fix
• refactor - Code restructuring without behavior change
• perf - Performance improvement
• docs - Documentation update
• test - Test-related changes
• chore - Maintenance/tooling

Risk Level

• Low - Minor changes, limited scope
• Medium - Moderate changes, some user impact
• High - Major changes, significant user/system impact

What & Why

Align Standard direct management with BPM commit 9c4df2df4a2:

• Use /api/v1 and the { endpoint, apiKey, expiresOn } response.
• Send the opaque credential through X-API-Key; remove bearer and extension-key headers.
• Preserve ARM fallback, caching, renewal, and default-off enablement.
• Update documentation, synthetic fixtures, and regression tests.

Follow-up to #9668.

Impact of Change

• Users: Opted-in Standard management requests use the updated backend contract.
• Developers: Issuer fixtures use apiKey instead of extensionCode/accessToken.
• System: No new dependencies or enablement changes. Legacy ARM routing remains unchanged.

Test Plan

• Unit tests added/updated
• E2E tests added/updated
• Manual testing completed
• Tested in: local Windows unit/mocked integration tests and live Standalone against la0

550 tests passed: 399 shared-client/service tests and 151 Standalone tests.
Shared-library TypeScript, Biome, and diff whitespace checks passed.
Coverage includes credential-header stripping, opaque key length limits,
legacy-response rejection, and real fetch-transport header assertions.

Live read-only validation on 2026-10-27 using https://localhost:4200 against
/subscriptions/80d4fe69-c95b-4dd2-a938-9250f1c8ab03/resourceGroups/tonyrg0/providers/Microsoft.Web/sites/la0:

• Loaded the DobbyMcpEcho workflow and displayed its existing succeeded run.
• Browser Reader issuance returned HTTP 200 with exactly endpoint/apiKey/expiresOn.
• Browser run-history list/refresh and run-detail requests returned HTTP 200 from /api/v1.
• Verified direct requests carry X-API-Key and no Authorization or x-functions-key.
• Verified localhost-origin CORS preflight returns HTTP 200 and permits x-api-key.
• Toggled the client feature gate off/on and verified fresh issuance and successful direct reads.
• Did not run workflows, save changes, or change Azure settings.

Contributors

Tony Tang (@anthony0t)
Implementation assistance: Copilot.

Screenshots/Videos

Not applicable; no visual changes.

[github-actions]

🤖 AI PR Validation Report

PR Review Results

Thank you for your submission! Here's detailed feedback on your PR title and body compliance:

✅ PR Title

• Current: fix: align Standard management with API-key backend contract
• Issue: The title is specific, follows the conventional commit format, and accurately summarizes the change.
• Recommendation: No changes required.

---

✅ Commit Type

• Properly selected (fix).
• Only one commit type is selected, and the code change is a bug fix/contract alignment.

---

✅ Risk Level

• The submitted risk is High, and the risk:high label matches the body.
• The advised risk is also High because the change modifies authentication credentials, direct-management routing, backend response validation, and multiple shared service paths. The risk estimate is appropriate.

---

✅ What & Why

• Current: Clearly explains the API version, response shape, X-API-Key usage, preserved ARM fallback, feature-gate behavior, and related tests/documentation.
• Issue: No material issue found.
• Recommendation: No changes required.

---

✅ Impact of Change

• The impact section identifies affected users, developers, and system behavior, including the opt-in nature of the feature and preservation of legacy ARM routing.
• Recommendation:
  • Users: Adequately describes the effect on opted-in Standard management requests.
  • Developers: Adequately identifies fixture and credential-contract changes.
  • System: Adequately describes routing, dependency, and enablement impact.

---

✅ Test Plan

• Unit tests are marked and are backed by substantial updated test code in the diff, including management integration, header validation, enablement behavior, fallback behavior, and API-key contract coverage.
• Manual testing is also marked with a clear description of the live, read-only validation performed.

---

⚠️ Contributors

• The submitter and implementation assistance are credited.
• Consider also crediting any PMs, designers, reviewers, or backend contributors who provided requirements or validation, if applicable. This is optional and does not block approval.

---

✅ Screenshots/Videos

• Correctly marked as not applicable because the PR does not introduce visual changes.

---

Summary Table

Section	Status	Recommendation
Title	✅	No changes required.
Commit Type	✅	Keep only fix selected.
Risk Level	✅	Keep High risk and the risk:high label.
What & Why	✅	No changes required.
Impact of Change	✅	No changes required.
Test Plan	✅	Unit-test and manual-test evidence is adequate.
Contributors	⚠️	Add other contributors if applicable.
Screenshots/Videos	✅	Not applicable for this non-visual change.

---

The PR title and body pass review. The submitted High risk level is consistent with the code diff and matches the risk:high label.

---

Powered by: Logic App (fallback) | Last updated: Tue, 27 Oct 2026 21:24:00 GMT

[github-actions]

📊 Coverage Check

The following changed files need attention:

⚠️ libs/logic-apps-shared/src/designer-client-services/lib/standard/connector.ts - 62% covered (needs improvement)
⚠️ libs/logic-apps-shared/src/designer-client-services/lib/standard/operationmanifest.ts - 33% covered (needs improvement)
⚠️ libs/logic-apps-shared/src/designer-client-services/lib/standard/run.ts - 48% covered (needs improvement)
⚠️ libs/logic-apps-shared/src/designer-client-services/lib/standard/search.ts - 54% covered (needs improvement)

Please add tests for the uncovered files before merging.

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

3 open issues

• The synthetic host asserts that Authorization and x-functions-key are absent using… · New
• This assertion requires the headers object to match exactly. That makes the test brittle if the… · New
• Requiring Object.keys(envelope).length === 3 makes the issuer contract non-extensible: any future… · New

What changed in this PR

Aligns Standard direct management client behavior with the updated backend issuer contract by switching to /api/v1, accepting { endpoint, apiKey, expiresOn }, and sending only the issued API key via X-API-Key.

Changes:

• Update direct-management endpoint/pathing to /api/v1 and switch session shape to { endpoint, apiKey, expiresOn }.
• Replace Authorization + x-functions-key usage with X-API-Key, and strip caller-supplied credential headers case-insensitively.
• Update docs, synthetic host fixtures, and unit/integration tests to cover the new contract (including size/character constraints and legacy-shape fallback).

File	Description
libs/​logic-apps-shared/​src/​designer-client-services/​lib/​standard/​management.ts	Implements new issuer envelope validation and switches direct calls to X-API-Key + /api/v1.
libs/​logic-apps-shared/​src/​designer-client-services/​lib/​standard/​__tests__/​management.spec.ts	Updates unit tests to the new envelope/header contract and adds regression cases.
libs/​logic-apps-shared/​src/​designer-client-services/​lib/​standard/​README.md	Documents the new contract and header behavior.
apps/​Standalone/​src/​designer/​app/​LocalDesigner/​__test__/​standardManagementHost.ts	Updates the synthetic runtime/issuer fixture to emit/require the new envelope + X-API-Key.
apps/​Standalone/​src/​designer/​app/​AzureLogicAppsDesigner/​__test__/​vitest.config.ts	Includes the LocalDesigner synthetic-host spec in this test project.
apps/​Standalone/​src/​designer/​app/​AzureLogicAppsDesigner/​__test__/​standardManagement.spec.tsx	Updates designer helper tests to expect /api/v1 and { apiKey }.
apps/​Standalone/​src/​designer/​app/​AzureLogicAppsDesigner/​__test__/​standaloneManagementIntegration.spec.tsx	Extends integration test to validate header stripping and X-API-Key usage on fetch calls.

_{Review effort: Lite}

[Copilot]

🟡 Changes recommended

The generic GET/POST adapter still rejects valid /api/v1 management URLs because it recognizes only the old prefix.

1 open issue

• Recognize direct API paths in generic request routing · New

3 resolved since last review

• Requiring Object.keys(envelope).length === 3 makes the issuer contract non-extensible: any future…
• This assertion requires the headers object to match exactly. That makes the test brittle if the…
• The synthetic host asserts that Authorization and x-functions-key are absent using…

_{Review effort: Balanced}

[Elaina Lee (Elaina-Lee)]

Had an offline conversation with Tony,

I am approving with with the understanding that this has been fully tested in standalone and won't be a breaking change. This is blocking customers as it is throttling, so considering the urgency I am having this go in, but looping in preetriti1 (original requested reviewer) for another deeper look in case further changes need to be made.