From 31394c7d77bef02dd2f33ba378cb28b218f3d0e2 Mon Sep 17 00:00:00 2001
From: Copilot <223556219+Copilot@users.noreply.github.com>
Date: Sat, 4 Apr 2026 08:25:01 +0000
Subject: [PATCH] fix: trim whitespace from tenant values in connection string
 parsing

getAdditionallyAllowedTenants() splits comma-separated tenant IDs but
does not trim whitespace from individual entries. This causes
authentication failures when connection strings contain spaces around
tenant IDs (e.g., 'tenant1, tenant2'), since the untrimmed values
(e.g., ' tenant2') are passed directly to WorkloadIdentityCredential.

Also filters out empty entries from trailing commas.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .../src/connection-string.ts                  |  5 +++-
 .../test/unit/connection-string.spec.ts       | 30 +++++++++++++++++++
 2 files changed, 34 insertions(+), 1 deletion(-)

diff --git a/packages/durabletask-js-azuremanaged/src/connection-string.ts b/packages/durabletask-js-azuremanaged/src/connection-string.ts
index a436643..f40af05 100644
--- a/packages/durabletask-js-azuremanaged/src/connection-string.ts
+++ b/packages/durabletask-js-azuremanaged/src/connection-string.ts
@@ -51,7 +51,10 @@ export class DurableTaskAzureManagedConnectionString {
     if (!value || value === "") {
       return undefined;
     }
-    return value.split(",");
+    return value
+      .split(",")
+      .map((t) => t.trim())
+      .filter((t) => t !== "");
   }
 
   /**
diff --git a/packages/durabletask-js-azuremanaged/test/unit/connection-string.spec.ts b/packages/durabletask-js-azuremanaged/test/unit/connection-string.spec.ts
index ca4eed1..7bd4417 100644
--- a/packages/durabletask-js-azuremanaged/test/unit/connection-string.spec.ts
+++ b/packages/durabletask-js-azuremanaged/test/unit/connection-string.spec.ts
@@ -137,6 +137,36 @@ describe("DurableTaskAzureManagedConnectionString", () => {
 
       expect(tenants).toEqual(["tenant1", "tenant2"]);
     });
+
+    it("should trim whitespace from each tenant value", () => {
+      const connectionStringWithSpaces =
+        VALID_CONNECTION_STRING + ";AdditionallyAllowedTenants=tenant1, tenant2 , tenant3";
+
+      const connectionString = new DurableTaskAzureManagedConnectionString(connectionStringWithSpaces);
+      const tenants = connectionString.getAdditionallyAllowedTenants();
+
+      expect(tenants).toEqual(["tenant1", "tenant2", "tenant3"]);
+    });
+
+    it("should filter out empty entries from trailing commas", () => {
+      const connectionStringWithTrailingComma =
+        VALID_CONNECTION_STRING + ";AdditionallyAllowedTenants=tenant1,tenant2,";
+
+      const connectionString = new DurableTaskAzureManagedConnectionString(connectionStringWithTrailingComma);
+      const tenants = connectionString.getAdditionallyAllowedTenants();
+
+      expect(tenants).toEqual(["tenant1", "tenant2"]);
+    });
+
+    it("should handle wildcard tenant value", () => {
+      const connectionStringWithWildcard =
+        VALID_CONNECTION_STRING + ";AdditionallyAllowedTenants=*";
+
+      const connectionString = new DurableTaskAzureManagedConnectionString(connectionStringWithWildcard);
+      const tenants = connectionString.getAdditionallyAllowedTenants();
+
+      expect(tenants).toEqual(["*"]);
+    });
   });
 
   describe("getClientId", () => {