add support for connecting to Azure Front Door with Azure App Configuration store as an origin

src/Microsoft.Extensions.Configuration.AzureAppConfiguration/AzureAppConfigurationOptions.cs

@@ -6,6 +6,7 @@
 using Azure.Data.AppConfiguration;
 using Microsoft.Extensions.Azure;
 using Microsoft.Extensions.Configuration.AzureAppConfiguration.AzureKeyVault;
+using Microsoft.Extensions.Configuration.AzureAppConfiguration.Cdn;
 using Microsoft.Extensions.Configuration.AzureAppConfiguration.Extensions;
 using Microsoft.Extensions.Configuration.AzureAppConfiguration.FeatureManagement;
 using Microsoft.Extensions.Configuration.AzureAppConfiguration.Models;
@@ -156,6 +157,16 @@ internal IEnumerable<IKeyValueAdapter> Adapters
         /// </summary>
         internal IAzureClientFactory<ConfigurationClient> ClientFactory { get; private set; }
 
+        /// <summary>
+        /// An accessor for current token to be used for CDN cache breakage/consistency.
+        /// </summary>
+        internal ICdnTokenAccessor CdnTokenAccessor { get; set; }
+
+        /// <summary>
+        /// Gets a value indicating whether CDN is enabled.
+        /// </summary>
+        internal bool IsCdnEnabled { get; private set; } = false;
+
         /// <summary>
         /// Initializes a new instance of the <see cref="AzureAppConfigurationOptions"/> class.
         /// </summary>
@@ -339,6 +350,11 @@ public AzureAppConfigurationOptions Connect(string connectionString)
         /// </param>
         public AzureAppConfigurationOptions Connect(IEnumerable<string> connectionStrings)
         {
+            if (IsCdnEnabled)
+            {
+                throw new InvalidOperationException("Cannot connect to both Azure App Configuration and CDN at the same time.");
+            }
+
             if (connectionStrings == null || !connectionStrings.Any())
             {
                 throw new ArgumentNullException(nameof(connectionStrings));
@@ -355,6 +371,29 @@ public AzureAppConfigurationOptions Connect(IEnumerable<string> connectionString
             return this;
         }
 
+        /// <summary>
+        /// Connect the provider to CDN endpoint.
+        /// </summary>
+        /// <param name="endpoint">The endpoint of the CDN instance to connect to.</param>
+        public AzureAppConfigurationOptions ConnectCdn(Uri endpoint)
+        {
+            if ((Credential != null && !(Credential is EmptyTokenCredential)) || (ConnectionStrings?.Any() ?? false))
+            {
+                throw new InvalidOperationException("Cannot connect to both Azure App Configuration and CDN at the same time.");
+            }
+
+            if (endpoint == null)
+            {
+                throw new ArgumentNullException(nameof(endpoint));
+            }
+
+            var result = Connect(new List<Uri>() { endpoint }, new EmptyTokenCredential());
+
+            IsCdnEnabled = true;
+
+            return result;
+        }
+
         /// <summary>
         /// Connect the provider to Azure App Configuration using endpoint and token credentials.
         /// </summary>
@@ -382,6 +421,11 @@ public AzureAppConfigurationOptions Connect(Uri endpoint, TokenCredential creden
         /// <param name="credential">Token credential to use to connect.</param>
         public AzureAppConfigurationOptions Connect(IEnumerable<Uri> endpoints, TokenCredential credential)
         {
+            if (IsCdnEnabled)
+            {
+                throw new InvalidOperationException("Cannot connect to both Azure App Configuration and CDN at the same time.");
+            }
+
             if (endpoints == null || !endpoints.Any())
             {
                 throw new ArgumentNullException(nameof(endpoints));

src/Microsoft.Extensions.Configuration.AzureAppConfiguration/AzureAppConfigurationProvider.cs

@@ -15,6 +15,7 @@
 using System.Net.Http;
 using System.Net.Sockets;
 using System.Security;
+using System.Security.Cryptography;
 using System.Text;
 using System.Threading;
 using System.Threading.Tasks;
@@ -39,6 +40,11 @@ internal class AzureAppConfigurationProvider : ConfigurationProvider, IConfigura
         private Dictionary<Uri, ConfigurationClientBackoffStatus> _configClientBackoffs = new Dictionary<Uri, ConfigurationClientBackoffStatus>();
         private DateTimeOffset _nextCollectionRefreshTime;
 
+        #region Cdn
+        private string _configVersion = null;
+        private string _ffCollectionVersion = null;
+        #endregion
+
         private readonly TimeSpan MinRefreshInterval;
 
         // The most-recent time when the refresh operation attempted to load the initial configuration
@@ -280,8 +286,8 @@ public async Task RefreshAsync(CancellationToken cancellationToken)
                     List<KeyValueChange> keyValueChanges = null;
                     Dictionary<string, ConfigurationSetting> data = null;
                     Dictionary<string, ConfigurationSetting> ffCollectionData = null;
-                    bool ffCollectionUpdated = false;
-                    bool refreshAll = false;
+                    string ffCollectionUpdatedChangedEtag = null;
+                    string refreshAllChangedEtag = null;
                     StringBuilder logInfoBuilder = new StringBuilder();
                     StringBuilder logDebugBuilder = new StringBuilder();
 
@@ -294,8 +300,8 @@ await ExecuteWithFailOverPolicyAsync(clients, async (client) =>
                         keyValueChanges = new List<KeyValueChange>();
                         data = null;
                         ffCollectionData = null;
-                        ffCollectionUpdated = false;
-                        refreshAll = false;
+                        ffCollectionUpdatedChangedEtag = null;
+                        refreshAllChangedEtag = null;
                         logDebugBuilder.Clear();
                         logInfoBuilder.Clear();
                         Uri endpoint = _configClientManager.GetEndpointForClient(client);
@@ -305,7 +311,12 @@ await ExecuteWithFailOverPolicyAsync(clients, async (client) =>
                             // Get key value collection changes if RegisterAll was called
                             if (isRefreshDue)
                             {
-                                refreshAll = await HaveCollectionsChanged(
+                                if (_options.IsCdnEnabled)
+                                {
+                                    _options.CdnTokenAccessor.Current = _configVersion;
+                                }
+
+                                refreshAllChangedEtag = await GetCollectionsChangeEtag(
                                     _options.Selectors.Where(selector => !selector.IsFeatureFlagSelector),
                                     _kvEtags,
                                     client,
@@ -314,7 +325,12 @@ await ExecuteWithFailOverPolicyAsync(clients, async (client) =>
                         }
                         else
                         {
-                            refreshAll = await RefreshIndividualKvWatchers(
+                            if (_options.IsCdnEnabled)
+                            {
+                                _options.CdnTokenAccessor.Current = _configVersion;
+                            }
+
+                            refreshAllChangedEtag = await RefreshIndividualKvWatchers(
                                 client,
                                 keyValueChanges,
                                 refreshableIndividualKvWatchers,
@@ -324,22 +340,39 @@ await ExecuteWithFailOverPolicyAsync(clients, async (client) =>
                                 cancellationToken).ConfigureAwait(false);
                         }
 
-                        if (refreshAll)
+                        if (refreshAllChangedEtag != null)
                         {
                             // Trigger a single load-all operation if a change was detected in one or more key-values with refreshAll: true,
                             // or if any key-value collection change was detected.
                             kvEtags = new Dictionary<KeyValueSelector, IEnumerable<MatchConditions>>();
                             ffEtags = new Dictionary<KeyValueSelector, IEnumerable<MatchConditions>>();
                             ffKeys = new HashSet<string>();
 
+                            if (_options.IsCdnEnabled)
+                            {
+                                //
+                                // Break cdn cache
+                                _options.CdnTokenAccessor.Current = refreshAllChangedEtag;
+
+                                // 
+                                // Reset versions so that next watch request will not use stale versions.
+                                _configVersion = refreshAllChangedEtag;
+                                _ffCollectionVersion = refreshAllChangedEtag;
+                            }
+
                             data = await LoadSelected(client, kvEtags, ffEtags, _options.Selectors, ffKeys, cancellationToken).ConfigureAwait(false);
                             watchedIndividualKvs = await LoadKeyValuesRegisteredForRefresh(client, data, cancellationToken).ConfigureAwait(false);
                             logInfoBuilder.AppendLine(LogHelper.BuildConfigurationUpdatedMessage());
                             return;
                         }
 
                         // Get feature flag changes
-                        ffCollectionUpdated = await HaveCollectionsChanged(
+                        if (_options.IsCdnEnabled)
+                        {
+                            _options.CdnTokenAccessor.Current = _ffCollectionVersion;
+                        }
+
+                        ffCollectionUpdatedChangedEtag = await GetCollectionsChangeEtag(
                             refreshableFfWatchers.Select(watcher => new KeyValueSelector
                             {
                                 KeyFilter = watcher.Key,
@@ -350,11 +383,22 @@ await ExecuteWithFailOverPolicyAsync(clients, async (client) =>
                             client,
                             cancellationToken).ConfigureAwait(false);
 
-                        if (ffCollectionUpdated)
+                        if (ffCollectionUpdatedChangedEtag != null)
                         {
                             ffEtags = new Dictionary<KeyValueSelector, IEnumerable<MatchConditions>>();
                             ffKeys = new HashSet<string>();
 
+                            if (_options.IsCdnEnabled)
+                            {
+                                //
+                                // Break cdn cache
+                                _options.CdnTokenAccessor.Current = ffCollectionUpdatedChangedEtag;
+
+                                //
+                                // Reset ff collection version so that next ff watch request will not use stale version.
+                                _ffCollectionVersion = ffCollectionUpdatedChangedEtag;
+                            }
+
                             ffCollectionData = await LoadSelected(
                                 client,
                                 new Dictionary<KeyValueSelector, IEnumerable<MatchConditions>>(),
@@ -373,6 +417,9 @@ await ExecuteWithFailOverPolicyAsync(clients, async (client) =>
                     cancellationToken)
                     .ConfigureAwait(false);
 
+                    bool refreshAll = !string.IsNullOrEmpty(refreshAllChangedEtag);
+                    bool ffCollectionUpdated = !string.IsNullOrEmpty(ffCollectionUpdatedChangedEtag);
+
                     if (refreshAll)
                     {
                         _mappedData = await MapConfigurationSettings(data).ConfigureAwait(false);
@@ -940,7 +987,7 @@ private async Task<Dictionary<KeyValueIdentifier, ConfigurationSetting>> LoadKey
             return watchedIndividualKvs;
         }
 
-        private async Task<bool> RefreshIndividualKvWatchers(
+        private async Task<string> RefreshIndividualKvWatchers(
             ConfigurationClient client,
             List<KeyValueChange> keyValueChanges,
             IEnumerable<KeyValueWatcher> refreshableIndividualKvWatchers,
@@ -963,7 +1010,7 @@ private async Task<bool> RefreshIndividualKvWatchers(
                 if (_watchedIndividualKvs.TryGetValue(watchedKeyLabel, out ConfigurationSetting watchedKv))
                 {
                     await TracingUtils.CallWithRequestTracing(_requestTracingEnabled, RequestType.Watch, _requestTracingOptions,
-                        async () => change = await client.GetKeyValueChange(watchedKv, cancellationToken).ConfigureAwait(false)).ConfigureAwait(false);
+                        async () => change = await client.GetKeyValueChange(watchedKv, makeConditionalRequest: !_options.IsCdnEnabled, cancellationToken).ConfigureAwait(false)).ConfigureAwait(false);
                 }
                 else
                 {
@@ -1000,7 +1047,19 @@ await CallWithRequestTracing(
 
                     if (kvWatcher.RefreshAll)
                     {
-                        return true;
+                        string changedEtag;
+
+                        if (change.ChangeType == KeyValueChangeType.Deleted)
+                        {
+                            using SHA256 sha256 = SHA256.Create();
+                            changedEtag = sha256.ComputeHash(Encoding.UTF8.GetBytes($"ResourceDeleted\n{change.Previous.ETag}")).ToBase64Url();
+                        }
+                        else
+                        {
+                            changedEtag = change.Current.ETag.ToString();
+                        }
+
+                        return changedEtag;
                     }
                 }
                 else
@@ -1009,7 +1068,7 @@ await CallWithRequestTracing(
                 }
             }
 
-            return false;
+            return null;
         }
 
         private void SetData(IDictionary<string, string> data)
@@ -1065,7 +1124,8 @@ private void SetRequestTracingOptions()
                 IsKeyVaultConfigured = _options.IsKeyVaultConfigured,
                 IsKeyVaultRefreshConfigured = _options.IsKeyVaultRefreshConfigured,
                 FeatureFlagTracing = _options.FeatureFlagTracing,
-                IsLoadBalancingEnabled = _options.LoadBalancingEnabled
+                IsLoadBalancingEnabled = _options.LoadBalancingEnabled,
+                IsCdnEnabled = _options.IsCdnEnabled
             };
         }
 
@@ -1328,33 +1388,35 @@ private void UpdateClientBackoffStatus(Uri endpoint, bool successful)
             _configClientBackoffs[endpoint] = clientBackoffStatus;
         }
 
-        private async Task<bool> HaveCollectionsChanged(
+        private async Task<string> GetCollectionsChangeEtag(
             IEnumerable<KeyValueSelector> selectors,
             Dictionary<KeyValueSelector, IEnumerable<MatchConditions>> pageEtags,
             ConfigurationClient client,
             CancellationToken cancellationToken)
         {
-            bool haveCollectionsChanged = false;
+            string changedEtag = null;
 
             foreach (KeyValueSelector selector in selectors)
             {
                 if (pageEtags.TryGetValue(selector, out IEnumerable<MatchConditions> matchConditions))
                 {
                     await TracingUtils.CallWithRequestTracing(_requestTracingEnabled, RequestType.Watch, _requestTracingOptions,
-                        async () => haveCollectionsChanged = await client.HaveCollectionsChanged(
+                        async () => changedEtag = await client.GetCollectionChangeEtag(
                             selector,
                             matchConditions,
                             _options.ConfigurationSettingPageIterator,
+                            makeConditionalRequest: !_options.IsCdnEnabled,
                             cancellationToken).ConfigureAwait(false)).ConfigureAwait(false);
                 }
 
-                if (haveCollectionsChanged)
+                if (changedEtag != null)
                 {
-                    return true;
+                    // If we have a changed ETag, we can stop checking further selectors
+                    return changedEtag;
                 }
             }
 
-            return haveCollectionsChanged;
+            return changedEtag;
         }
 
         private async Task ProcessKeyValueChangesAsync(

src/Microsoft.Extensions.Configuration.AzureAppConfiguration/AzureAppConfigurationSource.cs

@@ -1,8 +1,10 @@
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
 //
+using Azure.Core;
 using Azure.Data.AppConfiguration;
 using Microsoft.Extensions.Azure;
+using Microsoft.Extensions.Configuration.AzureAppConfiguration.Cdn;
 using System;
 using System.Collections.Generic;
 using System.Linq;
@@ -56,10 +58,25 @@ public IConfigurationProvider Build(IConfigurationBuilder builder)
                 }
                 else
                 {
-                    throw new ArgumentException($"Please call {nameof(AzureAppConfigurationOptions)}.{nameof(AzureAppConfigurationOptions.Connect)} to specify how to connect to Azure App Configuration.");
+                    throw new ArgumentException($"Please call {nameof(AzureAppConfigurationOptions)}.{nameof(AzureAppConfigurationOptions.Connect)} or {nameof(AzureAppConfigurationOptions)}.{nameof(AzureAppConfigurationOptions.ConnectCdn)} to specify how to connect to Azure App Configuration.");
                 }
 
-                provider = new AzureAppConfigurationProvider(new ConfigurationClientManager(clientFactory, endpoints, options.ReplicaDiscoveryEnabled, options.LoadBalancingEnabled), options, _optional);
+                if (options.IsCdnEnabled)
+                {
+                    if (options.LoadBalancingEnabled)
+                    {
+                        throw new InvalidOperationException("Load balancing is not supported for CDN endpoint.");
+                    }
+
+                    options.CdnTokenAccessor = new CdnTokenAccessor();
+                    options.ClientOptions.AddPolicy(new CdnPolicy(options.CdnTokenAccessor), HttpPipelinePosition.PerCall);
+
+                    provider = new AzureAppConfigurationProvider(new CdnConfigurationClientManager(clientFactory, endpoints.First()), options, _optional);
+                }
+                else
+                {
+                    provider = new AzureAppConfigurationProvider(new ConfigurationClientManager(clientFactory, endpoints, options.ReplicaDiscoveryEnabled, options.LoadBalancingEnabled), options, _optional);
+                }
             }
             catch (InvalidOperationException ex) // InvalidOperationException is thrown when any problems are found while configuring AzureAppConfigurationOptions or when SDK fails to create a configurationClient.
             {