refactor: use signature-validated _decode_jwt_token for Azure CLI auth

Replace lightweight _decode_jwt_claims (base64-only, no signature check)
with existing _decode_jwt_token (PyJWT + AAD JWKS validation) for both
login probe and per-command drift detection. Remove unused binascii import.

Tests monkeypatch _decode_jwt_token in fixture to bypass JWKS since test
JWTs use alg:none with fake signatures.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: Shira Sassoon

src/fabric_cli/core/fab_auth.py

@@ -2,7 +2,6 @@
 # Licensed under the MIT License.
 
 import base64
-import binascii
 import json
 import os
 import uuid
@@ -440,7 +439,7 @@ def set_azure_cli(self, tenant_id=None):
         try:
             probe_credential = AzureCliCredential()
             probe_token = probe_credential.get_token(con.SCOPE_FABRIC_DEFAULT[0])
-            claims = self._decode_jwt_claims(probe_token.token)
+            claims = self._decode_jwt_token(probe_token.token)
         except CredentialUnavailableError:
             raise FabricCLIError(
                 ErrorMessages.Auth.azure_cli_not_available(),
@@ -475,27 +474,6 @@ def set_azure_cli(self, tenant_id=None):
         auth_props[con.FAB_AZURE_CLI_ISSUER] = urlparse(claims["iss"]).hostname
         self._set_auth_properties(auth_props)
 
-    @staticmethod
-    def _decode_jwt_claims(token: str) -> dict:
-        """Decode JWT payload claims without signature validation.
-
-        Used to extract identity claims (iss, tid, oid) from tokens
-        returned by AzureCliCredential. Signature validation is
-        unnecessary here — the token was just returned by the
-        Azure CLI SDK over a local subprocess call.
-        """
-        try:
-            parts = token.split(".")
-            if len(parts) < 2:
-                return {}
-            # Add padding for base64url decoding (avoid adding 4 when already aligned)
-            payload = parts[1]
-            payload += "=" * ((-len(payload)) % 4)
-            decoded = base64.urlsafe_b64decode(payload)
-            return json.loads(decoded)
-        except (ValueError, json.JSONDecodeError, UnicodeDecodeError, binascii.Error):
-            return {}
-
     def _acquire_token_from_azure_cli(self, scope: list[str]) -> dict:
         """Acquire a token using Azure CLI's AzureCliCredential.
 
@@ -513,7 +491,7 @@ def _acquire_token_from_azure_cli(self, scope: list[str]) -> dict:
             azure_token = self._azure_cli_credential.get_token(scope[0])
 
             # Post-acquisition drift detection from actual token claims
-            claims = self._decode_jwt_claims(azure_token.token)
+            claims = self._decode_jwt_token(azure_token.token)
 
             # Fail-closed: reject tokens with missing identity claims
             if not claims.get("iss") or not claims.get("tid") or not claims.get("oid"):

tests/test_core/test_fab_auth_azure_cli.py

@@ -62,6 +62,31 @@ def temp_dir_fixture(monkeypatch, tmp_path):
     # Update file paths to use the test's tmp_path
     monkeypatch.setattr(auth, "auth_file", str(tmp_path / "auth.json"))
     monkeypatch.setattr(auth, "cache_file", str(tmp_path / "cache.bin"))
+
+    # Bypass JWKS signature validation in tests — fake JWTs cannot pass
+    # real signature checks. Decode claims via base64 like the removed
+    # _decode_jwt_claims helper.
+    def _test_decode_jwt_token(self, token, expected_audience=None):
+        """Test-only: decode JWT payload without signature validation."""
+        parts = token.split(".")
+        if len(parts) < 2:
+            raise FabricCLIError(
+                ErrorMessages.Auth.jwt_decode_failed(),
+                con.ERROR_AUTHENTICATION_FAILED,
+            )
+        payload = parts[1]
+        payload += "=" * ((-len(payload)) % 4)
+        try:
+            decoded = base64.urlsafe_b64decode(payload)
+            return _json.loads(decoded)
+        except Exception:
+            raise FabricCLIError(
+                ErrorMessages.Auth.jwt_decode_failed(),
+                con.ERROR_AUTHENTICATION_FAILED,
+            )
+
+    monkeypatch.setattr(auth, "_decode_jwt_token", lambda token, expected_audience=None: _test_decode_jwt_token(auth, token, expected_audience))
+
     return str(tmp_path)
 
 
@@ -596,28 +621,29 @@ def test_login_clears_credential_on_tenant_change(
 
 
 class TestJwtClaimsDecoding:
-    """Test the _decode_jwt_claims helper."""
+    """Test JWT claim extraction via _decode_jwt_token (with test fixture bypassing signature validation)."""
 
     def test_valid_jwt_extracts_claims(self, temp_dir_fixture):
         """Should decode tid and oid from a valid JWT."""
         token = _make_jwt(tid="my-tenant", oid="my-oid")
         auth = FabAuth()
-        claims = auth._decode_jwt_claims(token)
+        claims = auth._decode_jwt_token(token)
         assert claims["tid"] == "my-tenant"
         assert claims["oid"] == "my-oid"
 
-    def test_invalid_jwt_returns_empty(self, temp_dir_fixture):
-        """Should return empty dict for malformed tokens."""
+    def test_invalid_jwt_raises(self, temp_dir_fixture):
+        """Should raise FabricCLIError for malformed tokens."""
         auth = FabAuth()
-        assert auth._decode_jwt_claims("not-a-jwt") == {}
-        assert auth._decode_jwt_claims("") == {}
-        assert auth._decode_jwt_claims("a.!!!.c") == {}
+        with pytest.raises((FabricCLIError, Exception)):
+            auth._decode_jwt_token("not-a-jwt")
+        with pytest.raises((FabricCLIError, Exception)):
+            auth._decode_jwt_token("")
 
     def test_jwt_with_extra_claims(self, temp_dir_fixture):
         """Should extract additional claims."""
         token = _make_jwt(tid="t1", oid="o1", upn="user@contoso.com")
         auth = FabAuth()
-        claims = auth._decode_jwt_claims(token)
+        claims = auth._decode_jwt_token(token)
         assert claims["upn"] == "user@contoso.com"
 
 
@@ -664,7 +690,7 @@ def test_login_rejects_malformed_token(self, mock_class, temp_dir_fixture):
         mock_token.expires_on = int(time.time()) + 3600
         mock_class.return_value.get_token.return_value = mock_token
         auth = FabAuth()
-        with pytest.raises(FabricCLIError, match="Unable to validate"):
+        with pytest.raises(FabricCLIError, match="Failed to decode JWT"):
             auth.set_azure_cli()
 
     @patch("fabric_cli.core.fab_auth.AzureCliCredential")
@@ -680,7 +706,7 @@ def test_acquisition_rejects_token_missing_claims(self, mock_class, temp_dir_fix
         bad_token.token = "not-a-jwt"
         bad_token.expires_on = int(time.time()) + 3600
         mock_class.return_value.get_token.return_value = bad_token
-        with pytest.raises(FabricCLIError, match="Unable to validate"):
+        with pytest.raises(FabricCLIError, match="Failed to decode JWT"):
             auth.acquire_token(con.SCOPE_FABRIC_DEFAULT)