Merge branch 'feature/azure-cli-auth-poc' of https://github.com/shirasassoon/fabric-cli into feature/azure-cli-auth-poc

Author: Shira Sassoon

src/fabric_cli/commands/auth/fab_auth.py

@@ -226,55 +226,68 @@ def logout(args: Namespace) -> None:
 def status(args: Namespace) -> None:
     auth = FabAuth()
     tenant_id = auth.get_tenant_id()
+    identity_type = auth.get_identity_type() or "N/A"
 
-    def __get_token_info(scope):
-        try:
-            token = auth.get_access_token(scope, interactive_renew=False)
-        except FabricCLIError as e:
-            if e.status_code in [
-                fab_constant.ERROR_UNAUTHORIZED,
-                fab_constant.ERROR_AUTHENTICATION_FAILED,
-            ]:
-                return {}
-            else:
-                raise e
-        if isinstance(token, str):
-            token = token.encode()  # Ensure bytes type
-        return _get_token_info_from_bearer_token(token) if token else {}
-
-    token_info = __get_token_info(fab_constant.SCOPE_FABRIC_DEFAULT)
-
-    upn = token_info.get("upn") or "N/A"
-    oid = token_info.get("oid") or "N/A"
-    tid = token_info.get("tid", tenant_id) or "N/A"
-    appid = token_info.get("appid") or "N/A"
-
-    def __mask_token(scope):
-        try:
-            token = auth.get_access_token(scope, interactive_renew=False)
-        except FabricCLIError as e:
-            if e.status_code in [
-                fab_constant.ERROR_UNAUTHORIZED,
-                fab_constant.ERROR_AUTHENTICATION_FAILED,
-            ]:
-                return "N/A"
-            else:
-                raise e
-        if isinstance(token, str):
-            token = token.encode()  # Ensure bytes type
-        return (
-            token[:4].decode() + "************************************"
-            if token
-            else "N/A"
-        )
+    # Suppress noisy Azure SDK stderr logging during status checks
+    # (AzureCliCredential logs "Please run 'az login'" before raising)
+    import logging
+
+    azure_logger = logging.getLogger("azure.identity")
+    original_level = azure_logger.level
+    azure_logger.setLevel(logging.CRITICAL)
+
+    try:
+
+        def __get_token_info(scope):
+            try:
+                token = auth.get_access_token(scope, interactive_renew=False)
+            except FabricCLIError as e:
+                if e.status_code in [
+                    fab_constant.ERROR_UNAUTHORIZED,
+                    fab_constant.ERROR_AUTHENTICATION_FAILED,
+                ]:
+                    return {}
+                else:
+                    raise e
+            if isinstance(token, str):
+                token = token.encode()  # Ensure bytes type
+            return _get_token_info_from_bearer_token(token) if token else {}
+
+        token_info = __get_token_info(fab_constant.SCOPE_FABRIC_DEFAULT)
+
+        upn = token_info.get("upn") or "N/A"
+        oid = token_info.get("oid") or "N/A"
+        tid = token_info.get("tid", tenant_id) or "N/A"
+        appid = token_info.get("appid") or "N/A"
+
+        def __mask_token(scope):
+            try:
+                token = auth.get_access_token(scope, interactive_renew=False)
+            except FabricCLIError as e:
+                if e.status_code in [
+                    fab_constant.ERROR_UNAUTHORIZED,
+                    fab_constant.ERROR_AUTHENTICATION_FAILED,
+                ]:
+                    return "N/A"
+                else:
+                    raise e
+            if isinstance(token, str):
+                token = token.encode()  # Ensure bytes type
+            return (
+                token[:4].decode() + "************************************"
+                if token
+                else "N/A"
+            )
+
+        fabric_secret = __mask_token(fab_constant.SCOPE_FABRIC_DEFAULT)
+        storage_secret = __mask_token(fab_constant.SCOPE_ONELAKE_DEFAULT)
+        azure_secret = __mask_token(fab_constant.SCOPE_AZURE_DEFAULT)
 
-    fabric_secret = __mask_token(fab_constant.SCOPE_FABRIC_DEFAULT)
-    storage_secret = __mask_token(fab_constant.SCOPE_ONELAKE_DEFAULT)
-    azure_secret = __mask_token(fab_constant.SCOPE_AZURE_DEFAULT)
+    finally:
+        azure_logger.setLevel(original_level)
 
     # Check login status
     is_logged_in = fabric_secret != "N/A"
-    identity_type = auth.get_identity_type() or "N/A"
     login_status = (
         "✓ Logged in to app.fabric.microsoft.com"
         if is_logged_in
@@ -283,6 +296,11 @@ def __mask_token(scope):
     fab_ui.print_grey(login_status)
     if identity_type == "azure_cli" and is_logged_in:
         fab_ui.print_grey(f"  Auth mode: Azure CLI (tenant: {tid})")
+    elif identity_type == "azure_cli" and not is_logged_in:
+        fab_ui.print_grey(
+            "  Azure CLI session expired or logged out. "
+            "Run 'az login' then 'fab auth login --azure-cli' to re-authenticate."
+        )
 
     auth_data = {
         "logged_in": is_logged_in,

src/fabric_cli/core/fab_auth.py

@@ -4,6 +4,7 @@
 import json
 import os
 import base64
+import binascii
 import uuid
 from binascii import hexlify
 from typing import Any, NamedTuple, Optional
@@ -491,12 +492,12 @@ def _decode_jwt_claims(token: str) -> dict:
             parts = token.split(".")
             if len(parts) < 2:
                 return {}
-            # Add padding for base64url decoding
+            # Add padding for base64url decoding (avoid adding 4 when already aligned)
             payload = parts[1]
-            payload += "=" * (4 - len(payload) % 4)
+            payload += "=" * ((-len(payload)) % 4)
             decoded = base64.urlsafe_b64decode(payload)
             return json.loads(decoded)
-        except (ValueError, json.JSONDecodeError, UnicodeDecodeError):
+        except (ValueError, json.JSONDecodeError, UnicodeDecodeError, binascii.Error):
             return {}
 
     def _acquire_token_from_azure_cli(self, scope: list[str]) -> dict:

tests/test_commands/test_auth.py

@@ -966,7 +966,7 @@ def test_init_with_azure_cli_flag(self, mock_fab_auth, mock_fab_context):
         mock_fab_auth_instance.set_access_mode.assert_called_with(
             "azure_cli", None
         )
-        mock_set_azure_cli.assert_called_once_with(None)
+        mock_set_azure_cli.assert_called_once_with(tenant_id=None)
         assert result is True
 
     def test_init_with_azure_cli_flag_and_tenant(
@@ -985,7 +985,7 @@ def test_init_with_azure_cli_flag_and_tenant(
         mock_fab_auth_instance.set_access_mode.assert_called_with(
             "azure_cli", "my-tenant"
         )
-        mock_set_azure_cli.assert_called_once_with("my-tenant")
+        mock_set_azure_cli.assert_called_once_with(tenant_id="my-tenant")
         assert result is True
 
     def test_init_with_interactive_azure_cli_selection(
@@ -1008,7 +1008,7 @@ def test_init_with_interactive_azure_cli_selection(
         mock_fab_auth_instance.set_access_mode.assert_called_with(
             "azure_cli", None
         )
-        mock_set_azure_cli.assert_called_once_with(None)
+        mock_set_azure_cli.assert_called_once_with(tenant_id=None)
         assert_get_access_token(mock_fab_auth_instance)
         assert_fab_context(mock_fab_context)
         assert result is True