fix: clear token cache on set_azure_cli to prevent stale cross-tenant tokens

When transitioning from no stored tenant to a stored tenant, set_tenant()
did not call logout() (only triggers on tenant mismatch). This left stale
cached tokens from the previous no-tenant session. Now set_azure_cli()
always clears _azure_cli_token_cache at the start of every login.

Adds regression test verifying cache is cleared on no-tenant → tenant-B.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: Shira Sassoon

src/fabric_cli/core/fab_auth.py

@@ -436,6 +436,9 @@ def set_azure_cli(self, tenant_id=None):
         from Azure CLI's active session via 'az account show'.
         Always forces a fresh query (bypasses cache) since this is a login action.
         """
+        # Clear token cache on every login to prevent stale tokens from a
+        # previous tenant (or no-tenant) session from being reused.
+        self._azure_cli_token_cache.clear()
         # Set tenant first — set_tenant() may call logout() which clears auth info
         if tenant_id:
             self.set_tenant(tenant_id)

tests/test_core/test_fab_auth_azure_cli.py

@@ -542,6 +542,29 @@ def test_identity_type_preserved_after_tenant_change(
         assert auth.get_identity_type() == "azure_cli"
         assert auth.get_tenant_id() == "tenant-B"
 
+    @patch("fabric_cli.core.fab_auth.AzureCliCredential")
+    def test_login_clears_token_cache_from_no_tenant_state(
+        self, mock_credential_class, temp_dir_fixture
+    ):
+        """set_azure_cli should clear token cache even when transitioning from no tenant."""
+        mock_token = MagicMock()
+        mock_token.token = "stale-token"
+        mock_token.expires_on = int(time.time()) + 3600
+
+        mock_credential = MagicMock()
+        mock_credential.get_token.return_value = mock_token
+        mock_credential_class.return_value = mock_credential
+
+        auth = FabAuth()
+        auth.set_access_mode("azure_cli")
+        # Acquire a token with no tenant stored
+        auth._acquire_token_from_azure_cli(con.SCOPE_FABRIC_DEFAULT)
+        assert auth._azure_cli_token_cache.get(con.SCOPE_FABRIC_DEFAULT[0]) is not None
+
+        # Login with explicit tenant — cache must be cleared
+        auth.set_azure_cli(tenant_id="new-tenant")
+        assert auth._azure_cli_token_cache.get(con.SCOPE_FABRIC_DEFAULT[0]) is None
+
 
 class TestAzureCliTenantDiscoveryFailures:
     """Test _get_azure_cli_tenant failure paths."""