Fix panic in AcquireTokenSilent for public clients due to nil Credential

[4gust]

Fix panic in AcquireTokenSilent for public clients due to nil Credential

Description

This PR addresses a nil panic occurring during AcquireTokenSilent calls for public clients in the Microsoft Authentication Library for Go. #580

Root Cause

In apps/internal/base/base.go, the Token.Credential(...) function is called unconditionally within AcquireTokenSilent, even for public clients. This function expects a non-nil *accesstokens.Credential (specifically, silent.Credential), but for public clients, this value is nil.

The panic occurs in apps/internal/oauth/oauth.go at line 104:

if cred.TokenProvider != nil {

Here, cred is nil, leading to a runtime panic.

Fix

Added a conditional check to ensure that Token.Credential(...) is only called for confidential client flows (i.e., when silent.RequestType == accesstokens.ATConfidential), preventing the use of a nil credential for public clients.

Issue

#580

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud