Lack of Credential Reuse in `GetTokenForScopes`

[mattdot]

The GetTokenForScopes method in auth.go creates a new credential object for every call instead of reusing a single instance. This bypasses the internal token caching and renewal mechanisms provided by the Azure SDK (azidentity), leading to unnecessary overhead from repeatedly initializing credentials.

Affected Code

The issue lies in the GetTokenForScopes function and the authentication methods it calls (AuthenticateClientSecret, AuthenticateUsingCli, etc.). Each of these methods creates a new credential object unnecessarily.

Example from AuthenticateClientSecret:

clientSecretCredential, err := azidentity.NewClientSecretCredential(...)
accessToken, err := clientSecretCredential.GetToken(ctx, policy.TokenRequestOptions{...})

This behavior is repeated in other methods like AuthenticateUsingCli, AuthenticateClientCertificate, etc.

Steps to Reproduce

1. Call GetTokenForScopes multiple times in a short period with the same configuration (scopes, tenant ID, client ID, etc.).
2. Observe that new credential objects are created for each call, despite the configuration being consistent.

Expected Behavior

• Credential objects (e.g., ClientSecretCredential, AzureCLICredential) should be created once and reused across multiple calls to GetTokenForScopes.
• The Azure SDK's internal token caching and renewal mechanisms should handle token expiration and renewal automatically.

Actual Behavior

• A new credential object is instantiated for every call to GetTokenForScopes, bypassing the internal optimizations provided by the Azure SDK.
• This results in unnecessary overhead from credential initialization.

Impact of fix

• Reduces unnecessary overhead from repeatedly creating credential objects.
• Improves efficiency and performance by leveraging the Azure SDK's built-in token caching and renewal mechanisms.
• Simplifies the implementation and avoids redundant instantiation of credentials.

Environment

• Repository: terraform-provider-power-platform
• File: internal/api/auth.go
• Affected Method: GetTokenForScopes
• Azure SDK Version: Confirmed to use azidentity and azcore.

Additional Context

This issue was identified in the following file:
auth.go

[mawasile]

@mattdot as you can see on the proxy dump, there is only single authentication happening, although it is correctly pointed that mentioned code is being hit with every request.

what I can do is to singletonize clientSecretCredential objects?