Isolate mutable token acquisition request options

[Ignacio Inglese (iNinja)]

Summary

• Use the Microsoft.Identity.Abstractions option-clone contract for Downstream API and FIC requests.
• Isolate the remaining mutable parameters in authorization-header and non-bearer Graph requests.
• Preserve request-owned long-running session-key output without mutating shared Graph configuration.

Release notes

No intended API behavior change. Request-specific token acquisition parameters no longer modify shared authorization-header or Graph configuration. Downstream API and FIC isolation use the clone behavior provided by Microsoft.Identity.Abstractions.

Testing

• 95 focused token-acquisition and Downstream API tests passed on .NET 8.
• 4 Graph service client tests passed on .NET 8.

[Copilot]

Pull request overview

Isolates request-specific token acquisition state to prevent mutation of shared configuration during concurrent requests.

Changes:

• Clones mutable extra parameters while preserving standard dictionary comparers.
• Isolates FIC, agent, Graph, and mTLS PoP request options.
• Propagates generated long-running session keys only to request-owned Graph options.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/Microsoft.Identity.Web.TokenAcquisition/TokenAcquirerExtensions.cs	Isolates FIC assertion parameters.
src/Microsoft.Identity.Web.TokenAcquisition/DefaultAuthorizationHeaderProvider.cs	Isolates token-binding parameters.
src/Microsoft.Identity.Web.GraphServiceClient/GraphAuthenticationProvider.cs	Clones Graph token options and propagates session keys safely.
src/Microsoft.Identity.Web.DownstreamApi/DownstreamApi.cs	Copies mutable parameters before request overrides.
tests/Microsoft.Identity.Web.Test/TokenAcquirerExtensionsTests.cs	Tests FIC parameter isolation.
tests/Microsoft.Identity.Web.Test/DownstreamWebApiSupport/DownstreamApiTests.cs	Tests agent override isolation and comparer preservation.
tests/Microsoft.Identity.Web.Test/DefaultAuthorizationHeaderProviderTests.cs	Tests mTLS PoP parameter isolation.
tests/E2E Tests/GraphServiceClientTests/GraphServiceClientTests.cs	Tests Graph isolation, cancellation, and session-key behavior.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Iarek Kovtunenko (iarekk)]

Heads-up for a later cleanup: Microsoft.Identity.Abstractions 12.6.1 makes the
Clone() / copy-constructors on AcquireTokenOptions and DownstreamApiOptions
allocate independent containers for their mutable collections
(ExtraParameters, ExtraQueryParameters, ExtraHeadersParameters) instead of
copying the references (AzureAD/microsoft-identity-abstractions-for-dotnet#269).

So once IdWeb takes 12.6.1 (via #4020), the per-request copies added here are
also guaranteed at the library level -- the local CopyExtraParameters helpers
become belt-and-suspenders and could be simplified in a follow-up. No change
needed in this PR; the defensive copies are fine to ship now.

[Bogdan Gavril (bgavrilMS)]

Iarek Kovtunenko (@iarekk) - didn't you just fix this in DownstreamApiOptions in Abstractions?

[Bogdan Gavril (bgavrilMS)]

Clone() should take care of this. I believe Iarek Kovtunenko (@iarekk) fixed this?