test: add parser and MSAL bridge coverage for Azure CLI auth

Parser tests (4 new):
- --azure-cli flag maps to args.azure_cli=True
- --azure-cli --tenant maps both attributes
- Absent flag defaults to False
- --tenant alone works for other auth modes

Bridge tests (2 new):
- MsalTokenCredential.get_token returns AccessToken via Azure CLI dispatch
- Invalid scope is rejected with ClientAuthenticationError

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: Shira Sassoon

tests/test_core/test_fab_msal_bridge_azure_cli.py

@@ -0,0 +1,67 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+
+"""Tests for the MSAL bridge with Azure CLI identity type."""
+
+import time
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+from fabric_cli.core import fab_constant as con
+from fabric_cli.core.fab_auth import FabAuth
+from fabric_cli.core.fab_msal_bridge import MsalTokenCredential
+
+
+@pytest.fixture(autouse=True)
+def temp_dir_fixture(monkeypatch, tmp_path):
+    """Isolate FabAuth singleton for bridge tests."""
+    monkeypatch.setattr(
+        "fabric_cli.core.fab_state_config.config_location", lambda: str(tmp_path)
+    )
+    monkeypatch.delenv("FAB_TOKEN", raising=False)
+    monkeypatch.delenv("FAB_TOKEN_ONELAKE", raising=False)
+    monkeypatch.delenv("FAB_TOKEN_AZURE", raising=False)
+    auth = FabAuth()
+    auth._azure_cli_token_cache.clear()
+    auth._cached_az_tenant = None
+    auth._cached_az_tenant_time = 0.0
+    auth._auth_info = {}
+
+
+class TestMsalBridgeAzureCli:
+    """Verify MsalTokenCredential works when identity_type is azure_cli."""
+
+    @patch("fabric_cli.core.fab_auth.AzureCliCredential")
+    def test_bridge_returns_access_token_for_azure_cli(
+        self, mock_credential_class
+    ):
+        """MsalTokenCredential.get_token should return an AccessToken via Azure CLI."""
+        mock_token = MagicMock()
+        mock_token.token = "bridge-azure-cli-token"
+        mock_token.expires_on = int(time.time()) + 3600
+
+        mock_credential = MagicMock()
+        mock_credential.get_token.return_value = mock_token
+        mock_credential_class.return_value = mock_credential
+
+        auth = FabAuth()
+        auth.set_access_mode("azure_cli")
+
+        credential = MsalTokenCredential(auth)
+        result = credential.get_token(con.SCOPE_FABRIC_DEFAULT[0])
+
+        assert result.token == "bridge-azure-cli-token"
+        assert result.expires_on == mock_token.expires_on
+
+    @patch("fabric_cli.core.fab_auth.AzureCliCredential")
+    def test_bridge_rejects_invalid_scope(self, mock_credential_class):
+        """MsalTokenCredential should reject scopes not in the allowlist."""
+        from azure.core.exceptions import ClientAuthenticationError
+
+        auth = FabAuth()
+        auth.set_access_mode("azure_cli")
+
+        credential = MsalTokenCredential(auth)
+        with pytest.raises(ClientAuthenticationError):
+            credential.get_token("https://evil.example.com/.default")

tests/test_parsers/test_fab_auth_parser.py

@@ -0,0 +1,49 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+
+"""Tests for the auth parser module — verifies argparse flag mapping."""
+
+import argparse
+
+from fabric_cli.core.fab_parser_setup import CustomArgumentParser
+from fabric_cli.parsers import fab_auth_parser
+
+
+def _build_auth_parser():
+    """Build a parser with auth subcommands registered."""
+    parser = CustomArgumentParser()
+    subparsers = parser.add_subparsers(dest="command")
+    fab_auth_parser.register_parser(subparsers)
+    return parser
+
+
+class TestAuthParserAzureCli:
+    """Verify --azure-cli flag is parsed correctly."""
+
+    def test_azure_cli_flag_sets_attribute(self):
+        """--azure-cli should map to args.azure_cli=True."""
+        parser = _build_auth_parser()
+        args = parser.parse_args(["auth", "login", "--azure-cli"])
+        assert args.azure_cli is True
+
+    def test_azure_cli_flag_with_tenant(self):
+        """--azure-cli --tenant should set both attributes."""
+        parser = _build_auth_parser()
+        args = parser.parse_args(
+            ["auth", "login", "--azure-cli", "--tenant", "my-tenant-id"]
+        )
+        assert args.azure_cli is True
+        assert args.tenant == "my-tenant-id"
+
+    def test_azure_cli_flag_absent_defaults_false(self):
+        """Without --azure-cli, azure_cli should be falsy."""
+        parser = _build_auth_parser()
+        args = parser.parse_args(["auth", "login"])
+        assert not args.azure_cli
+
+    def test_tenant_flag_without_azure_cli(self):
+        """--tenant alone should work (used by other auth modes)."""
+        parser = _build_auth_parser()
+        args = parser.parse_args(["auth", "login", "--tenant", "some-tenant"])
+        assert args.tenant == "some-tenant"
+        assert not args.azure_cli