Disable broker on Intel-based Macs

[Ashok Kumar Ramakrishnan (ashok672)]

Broker on macOS is supported only on Apple Silicon (arm64). On Intel Macs (x86_64 / i386) MSAL Python will now force-disable broker in ClientApplication._decide_broker, regardless of whether a broker is installed on the device or whether the app opted in via enable_broker_on_mac=True. Apple Silicon Macs and all non-Mac platforms are unaffected.

The check sits in the single broker-decision chokepoint and reuses the existing 'broker unavailable, falling back to non-broker' warning path.

Tests:

• tests/test_application.py::TestBrokerDisabledOnIntelMac covers the three architecture branches (arm64, x86_64, i386) by patching sys.platform and platform.machine, matching the existing broker-test pattern in this file. CI runs on ubuntu-latest only, so the mock is the only way to exercise the darwin branch.
• tests/intel_mac_broker_smoke_test.py is a credential-free, no-UI manual smoke test that runs in a few seconds on real hardware (especially useful on an Intel Mac, which CI cannot cover).

[Copilot]

Pull request overview

This PR enforces the product policy that MSAL Python’s macOS broker support is Apple-Silicon-only by force-disabling broker on Intel-based Macs (x86_64/i386) inside the central broker-decision path (ClientApplication._decide_broker). It adds unit coverage for the architecture branches and a small manual smoke-test script intended for real-hardware verification.

Changes:

• Force-disable broker on macOS when platform.machine() reports x86_64 or i386, using the existing “fallback to non-broker” warning path.
• Add unit tests that patch sys.platform and platform.machine() to validate arm64 vs Intel behavior.
• Add a manual (credential-free) smoke test script for running the broker gate on real machines.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
msal/application.py	Adds Intel-macOS architecture gate that disables broker and logs a warning before broker initialization.
tests/test_application.py	Adds unit tests covering arm64 vs Intel macOS broker enablement behavior via patching.
tests/intel_mac_broker_smoke_test.py	Adds a manual smoke test script to validate the gate on real hardware.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Bogdan Gavril (bgavrilMS)]

Ashok Kumar Ramakrishnan (@ashok672) - pls have a look at the build failures

[Copilot]

🟡 Changes recommended

The manual smoke test’s expected behavior conflicts with the broker-enabling flags it passes on non-mac platforms, and the new warning message should be clarified to match the actual architecture-based condition.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (3)

Previously missed (1) — in code that hasn't changed since the last review.

msal/application.py:778

• The warning message says "Intel-based Macs", but the gate is triggered by the current process architecture (platform.machine()). This will also apply to Apple Silicon running an x86_64 Python under Rosetta, so the message should reflect the actual condition to avoid misleading users.

tests/intel_mac_broker_smoke_test.py:58

• The manual smoke test sets enable_broker_on_windows=True and enable_broker_on_linux=True, but _expected_broker_state() assumes non-mac hosts should always have _enable_broker == False. On Windows (or Linux with broker support installed), this can make the script fail even though the Intel-mac gate is working.

    app = msal.PublicClientApplication(
        _CLIENT_ID,
        authority=_AUTHORITY,
        enable_broker_on_mac=True,
        enable_broker_on_windows=True,
        enable_broker_on_linux=True,
        )

tests/test_application.py:1062

• There’s an explanatory comment line placed between decorators. It’s clearer to keep the decorator stack contiguous and put the comment on the decorator line it describes.

@patch("msal.application.platform.machine", new=Mock(return_value="arm64"))
# Pretend Apple Silicon, because broker is not supported on Intel-based Macs.

• Files reviewed: 3/3 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

The new manual smoke test’s expected behavior conflicts with its app construction on non-macOS platforms (it opts into Windows/Linux broker but expects _enable_broker to remain False).

Review details

Suppressed comments (2)

tests/intel_mac_broker_smoke_test.py:58

• In this manual smoke test, _expected_broker_state() assumes that on non-macOS platforms _enable_broker stays False, but the test app is constructed with enable_broker_on_windows=True and enable_broker_on_linux=True. On Windows/Linux with msal[broker] installed, this can legitimately enable broker and make the script fail even though the Intel-macOS gate is behaving correctly. To keep the script focused on validating the macOS behavior, don’t opt into broker on other platforms (or update the expected-state logic accordingly).

    app = msal.PublicClientApplication(
        _CLIENT_ID,
        authority=_AUTHORITY,
        enable_broker_on_mac=True,
        enable_broker_on_windows=True,
        enable_broker_on_linux=True,
        )

msal/application.py:828

• This gate keys off platform.machine() (the current Python process architecture), but the warning/error text says “Intel-based Macs”. On Apple Silicon running an x86_64 Python (e.g., under Rosetta), platform.machine() will be "x86_64" and the broker will be disabled even though the hardware isn’t Intel; the warning would be misleading. Consider wording the comment and warning in terms of the detected architecture (x86_64/i386) rather than the hardware family.

            # Broker on macOS is supported only on Apple Silicon (arm64).
            # Intel Macs are excluded by product policy, regardless of whether
            # a broker is actually installed on the device.
            self._enable_broker = False
            logger.warning(

• Files reviewed: 3/3 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

The macOS architecture gate and the smoke-test expectations should be tightened to explicitly allowlist arm64 to match the stated “Apple Silicon only” policy and avoid enabling broker on unexpected darwin architectures.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 3
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

A new user-facing warning message is misleading for non-arm64 macOS cases (not strictly “Intel-based”), and the smoke-test failure message can misattribute failures to the gate rather than missing broker dependencies.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

🟢 Approval recommended

The architecture gate is narrowly scoped in the broker decision chokepoint, matches the stated policy, and is covered by targeted unit tests plus a practical manual smoke test.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 0 new
• Review effort level: Lite

[xinyuxu1026]

Do we also need to do the same for dotnet mac?

[xinyuxu1026]

do we need to update public documentation?