Merge branch 'bugfix/codeQL-suggestions' of https://github.com/microsoft/Multi-Agent-Custom-Automation-Engine-Solution-Accelerator into bugfix/codeQL-suggestions

# Please enter a commit message to explain why this merge is necessary,
# especially if it merges an updated upstream into a topic branch.
#
# Lines starting with '#' will be ignored, and an empty message aborts
# the commit.

Author: Ayaz-Microsoft

.coveragerc

@@ -11,6 +11,7 @@ omit =
     */env/*
     */.pytest_cache/*
     */node_modules/*
+    src/backend/v4/api/router.py
 
 [paths]
 source =

src/backend/app.py

@@ -17,6 +17,8 @@
 from fastapi import FastAPI, Request
 from fastapi.middleware.cors import CORSMiddleware
 
+from opentelemetry.instrumentation.fastapi import FastAPIInstrumentor
+
 # Local imports
 from middleware.health_check import HealthCheckMiddleware
 from v4.api.router import app_v4
@@ -51,20 +53,6 @@ async def lifespan(app: FastAPI):
     logger.info("👋 MACAE application shutdown complete")
 
 
-# Check if the Application Insights Instrumentation Key is set in the environment variables
-connection_string = config.APPLICATIONINSIGHTS_CONNECTION_STRING
-if connection_string:
-    # Configure Application Insights if the Instrumentation Key is found
-    configure_azure_monitor(connection_string=connection_string)
-    logging.info(
-        "Application Insights configured with the provided Instrumentation Key"
-    )
-else:
-    # Log a warning if the Instrumentation Key is not found
-    logging.warning(
-        "No Application Insights Instrumentation Key found. Skipping configuration"
-    )
-
 # Configure logging levels from environment variables
 # logging.basicConfig(level=getattr(logging, config.AZURE_BASIC_LOGGING_LEVEL.upper(), logging.INFO))
 
@@ -80,10 +68,32 @@ async def lifespan(app: FastAPI):
 
 logging.getLogger("azure.core.pipeline.policies.http_logging_policy").setLevel(logging.WARNING)
 
+# Suppress noisy Azure Monitor exporter "Transmission succeeded" logs
+logging.getLogger("azure.monitor.opentelemetry.exporter.export._base").setLevel(logging.WARNING)
+
 # Initialize the FastAPI app
 app = FastAPI(lifespan=lifespan)
 
 frontend_url = config.FRONTEND_SITE_NAME
+# Configure Azure Monitor and instrument FastAPI for OpenTelemetry
+# This enables automatic request tracing, dependency tracking, and proper operation_id
+if config.APPLICATIONINSIGHTS_CONNECTION_STRING:
+    # Configure Application Insights telemetry with live metrics
+    configure_azure_monitor(
+        connection_string=config.APPLICATIONINSIGHTS_CONNECTION_STRING,
+        enable_live_metrics=True
+    )
+
+    # Instrument FastAPI app — exclude WebSocket URLs to reduce telemetry noise
+    FastAPIInstrumentor.instrument_app(
+        app,
+        excluded_urls="socket,ws"
+    )
+    logging.info("Application Insights configured with live metrics and WebSocket filtering")
+else:
+    logging.warning(
+        "No Application Insights connection string found. Telemetry disabled."
+    )
 
 # Add this near the top of your app.py, after initializing the app
 app.add_middleware(

src/backend/common/config/app_config.py

@@ -6,6 +6,10 @@
 from azure.ai.projects.aio import AIProjectClient
 from azure.cosmos import CosmosClient
 from azure.identity import DefaultAzureCredential, ManagedIdentityCredential
+from azure.identity.aio import (
+    DefaultAzureCredential as DefaultAzureCredentialAsync,
+    ManagedIdentityCredential as ManagedIdentityCredentialAsync,
+)
 from dotenv import load_dotenv
 
 
@@ -113,7 +117,8 @@ def get_azure_credential(self, client_id=None):
         """
         Returns an Azure credential based on the application environment.
 
-        If the environment is 'dev', it uses DefaultAzureCredential.
+        If the environment is 'dev', it uses DefaultAzureCredential with exclude_environment_credential=True
+        to avoid EnvironmentCredential exceptions in Application Insights traces.
         Otherwise, it uses ManagedIdentityCredential.
 
         Args:
@@ -123,10 +128,29 @@ def get_azure_credential(self, client_id=None):
             Credential object: Either DefaultAzureCredential or ManagedIdentityCredential.
         """
         if self.APP_ENV == "dev":
-            return DefaultAzureCredential()  # CodeQL [SM05139]: DefaultAzureCredential is safe here
+            return DefaultAzureCredential(exclude_environment_credential=True)  # CodeQL [SM05139]: DefaultAzureCredential is safe here
         else:
             return ManagedIdentityCredential(client_id=client_id)
 
+    def get_azure_credential_async(self, client_id=None):
+        """
+        Returns an async Azure credential based on the application environment.
+
+        If the environment is 'dev', it uses DefaultAzureCredential (async) with exclude_environment_credential=True
+        to avoid EnvironmentCredential exceptions in Application Insights traces.
+        Otherwise, it uses ManagedIdentityCredential (async).
+
+        Args:
+            client_id (str, optional): The client ID for the Managed Identity Credential.
+
+        Returns:
+            Async Credential object: Either DefaultAzureCredentialAsync or ManagedIdentityCredentialAsync.
+        """
+        if self.APP_ENV == "dev":
+            return DefaultAzureCredentialAsync(exclude_environment_credential=True)
+        else:
+            return ManagedIdentityCredentialAsync(client_id=client_id)
+
     def get_azure_credentials(self):
         """Retrieve Azure credentials, either from environment variables or managed identity."""
         if self._azure_credentials is None: