auth: Watch sovereign cloud config and fire onRefreshSuggested

[alexweininger]

Summary

The auth provider now watches the microsoft-sovereign-cloud config section for changes. When the sovereign cloud environment is switched, it:

1. Clears all cached accounts, tenants, and subscriptions
2. Fires onRefreshSuggested with a new 'cloudChange' reason

Why

Previously, consumers (e.g. vscode-azureresourcegroups) had to manually clear caches and refresh views when the sovereign cloud changed. The auth provider already watches azureResourceGroups.selectedSubscriptions and fires refresh events — sovereign cloud changes should follow the same pattern since they fundamentally invalidate all cached auth data.

Changes

• RefreshSuggestedEvent.reason: Added 'cloudChange' to the union type
• VSCodeAzureSubscriptionProvider: Added cloudChangeListener that watches microsoft-sovereign-cloud config, clears all caches, and fires onRefreshSuggested({ reason: 'cloudChange' })

Consumer impact

Consumers that listen to all onRefreshSuggested events (the default) will automatically refresh on sovereign cloud changes with no code changes needed.

Consumers that filter by reason (like the Accounts & Tenants tree, which only listens for sessionChange) need to also accept cloudChange. A corresponding change is in microsoft/vscode-azureresourcegroups#1416.

[Copilot]

Pull request overview

This PR updates the auth subscription provider to react to sovereign cloud configuration changes by clearing cached auth data and notifying consumers via onRefreshSuggested, aligning sovereign cloud switching behavior with existing refresh patterns in the codebase.

Changes:

• Added 'cloudChange' to RefreshSuggestedEvent.reason.
• Added a VS Code configuration watcher for the microsoft-sovereign-cloud section that clears caches and fires onRefreshSuggested({ reason: 'cloudChange' }).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
auth/src/providers/VSCodeAzureSubscriptionProvider.ts	Watches sovereign cloud config changes, clears caches, and emits refresh suggested events.
auth/src/contracts/AzureSubscriptionProvider.ts	Extends RefreshSuggestedEvent.reason union to include 'cloudChange'.

Comments suppressed due to low confidence (2)

auth/src/providers/VSCodeAzureSubscriptionProvider.ts:58

• fireRefreshSuggestedIfNeeded debounces/suppresses events for reasons other than subscriptionFilterChange. That means a cloudChange refresh can be swallowed (e.g., within the 2s debounce window or during sign-in suppression), leaving consumers unaware they need to refresh after a cloud switch. If cloud switches should always trigger refresh, update the suppression logic (likely in AzureSubscriptionProviderBase.fireRefreshSuggestedIfNeeded) to treat cloudChange like an explicit user action.

                this.clearAllCaches();
                this.fireRefreshSuggestedIfNeeded({ reason: 'cloudChange' });
            }

auth/src/providers/VSCodeAzureSubscriptionProvider.ts:84

• clearAllCaches clears account/tenant/subscription caches, but it doesn’t clear availableSubscriptionsPromises. If a getAvailableSubscriptions call is in-flight during a cloud switch, a subsequent call with the same coalescence key can await and return results from the previous cloud. Consider also clearing the coalescence map (and/or making the key incorporate the configured cloud) when the environment changes.

    private clearAllCaches(): void {
        this.accountCache.clear();
        this.tenantCache.clear();
        this.subscriptionCache.clear();
        this.log('Cleared all caches due to cloud environment change');

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[alexweininger]

Self-review notes:

All prior review feedback has been addressed:

• Cloud config watcher is folded into the existing onDidChangeConfiguration listener as an else if ✅
• Cache-clearing is inlined rather than a separate method ✅
• CustomCloudConfigurationSection is now imported from configuredAzureEnv.ts instead of duplicated ✅

The cache invalidation correctly clears all three caches (accounts, tenants, subscriptions) before firing onRefreshSuggested. The availableSubscriptionsPromises map doesn't need clearing since it's ephemeral promise coalescence, not a persistent cache.

Minor note: the reason type on RefreshSuggestedEvent is a string union — if more reasons keep getting added, it might eventually be worth extracting to a named type alias, but not needed now.