[AAD token revocation]: Adds logic for handling emergency token revocation and CAE token revocation.

Microsoft.Azure.Cosmos/src/Authorization/AuthorizationTokenProviderTokenCredential.cs

@@ -6,6 +6,7 @@ namespace Microsoft.Azure.Cosmos
 {
     using System;
     using System.Globalization;
+    using System.Net;
     using System.Threading.Tasks;
     using global::Azure.Core;
     using Microsoft.Azure.Cosmos.Core.Trace;
@@ -18,7 +19,7 @@ internal sealed class AuthorizationTokenProviderTokenCredential : AuthorizationT
         private const string InferenceTokenPrefix = "Bearer ";
         internal readonly TokenCredentialCache tokenCredentialCache;
         private bool isDisposed = false;
-
+       
         internal readonly TokenCredential tokenCredential;
 
         public AuthorizationTokenProviderTokenCredential(
@@ -116,5 +117,78 @@ public override void Dispose()
                 this.tokenCredentialCache.Dispose();
             }
         }
+
+        /// <summary>
+        /// Attempts to handle CAE (Continuous Access Evaluation) token revocation.
+        /// Extracts claims challenge from WWW-Authenticate header and resets cache for retry.
+        /// </summary>
+        /// <param name="statusCode">HTTP status code from the response</param>
+        /// <param name="headers">Response headers containing WWW-Authenticate</param>
+        /// <returns>True if CAE revocation detected and request should be retried; false otherwise</returns>
+        internal bool TryHandleCaeRevocation(
+            HttpStatusCode statusCode,
+            INameValueCollection headers)
+        {
+            if (statusCode != HttpStatusCode.Unauthorized || headers == null)
+            {
+                return false;
+            }
+
+            string wwwAuth = headers[HttpConstants.HttpHeaders.WwwAuthenticate];
+            if (string.IsNullOrEmpty(wwwAuth))
+            {
+                return false;
+            }
+
+            // Check for CAE claims challenge indicators
+            bool hasCaeIndicators = wwwAuth.IndexOf("insufficient_claims", StringComparison.OrdinalIgnoreCase) >= 0
+                || wwwAuth.IndexOf("claims=", StringComparison.OrdinalIgnoreCase) >= 0;
+
+            if (!hasCaeIndicators)
+            {
+                return false;
+            }
+
+            string claimsChallenge = AuthorizationTokenProviderTokenCredential.ExtractClaimsFromWwwAuthenticate(wwwAuth);
+
+            // Reset cache with claims challenge for next token request
+            this.tokenCredentialCache.ResetCachedToken(claimsChallenge);
+
+            DefaultTrace.TraceInformation(
+                "AAD CAE revocation detected. Token cache reset with claims challenge. " +
+                "Request will be retried with fresh token including claims. HasClaims={0}",
+                claimsChallenge != null);
+
+            return true;
+        }
+
+        /// <summary>
+        /// Extracts the claims challenge from the WWW-Authenticate header value.
+        /// </summary>
+        /// <param name="wwwAuthenticateHeader">WWW-Authenticate header value</param>
+        /// <returns>Base64-encoded claims string, or null if not present</returns>
+        private static string ExtractClaimsFromWwwAuthenticate(string wwwAuthenticateHeader)
+        {
+            if (string.IsNullOrEmpty(wwwAuthenticateHeader))
+            {
+                return null;
+            }
+
+            const string claimsPrefix = "claims=\"";
+            int claimsIndex = wwwAuthenticateHeader.IndexOf(claimsPrefix, StringComparison.OrdinalIgnoreCase);
+            if (claimsIndex < 0)
+            {
+                return null;
+            }
+
+            int startIndex = claimsIndex + claimsPrefix.Length;
+            int endIndex = wwwAuthenticateHeader.IndexOf("\"", startIndex, StringComparison.Ordinal);
+            if (endIndex < 0)
+            {
+                return null;
+            }
+
+            return wwwAuthenticateHeader.Substring(startIndex, endIndex - startIndex);
+        }
     }
 }