[Pages] Allow az auth without an Azure subscription (#132)

Pass `--allow-no-subscriptions` on AAD-only Azure CLI calls so the
plugin works for users whose Microsoft account has no Azure subscription
(Dataverse and Power Platform tokens are AAD-scoped and don't require a
subscription).

- Update the shared `getAuthToken` helper in `validation-helpers.js` to
  pass the flag on `az account get-access-token`.
- Refresh user-facing `az login` hint strings across scripts, SKILL.md,
  agent, and reference files to recommend `az login --allow-no-subscriptions`.
- Clarify the `list-azure-keyvaults.js` error message — Key Vault is
  subscription-scoped, the flag does not apply there.
- Document the convention in `plugins/power-pages/AGENTS.md`: apply the
  flag on AAD-only commands, never on subscription-scoped ones.
- Add `validation-helpers.test.js` (stubs `child_process.execSync` via
  require.cache) to lock the flag in.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: priyanshu92

plugins/power-pages/AGENTS.md

@@ -14,6 +14,7 @@ Read `PLUGIN_DEVELOPMENT_GUIDE.md` for UX and reliability standards when creatin
 - **Power Pages config loading** must reuse `scripts/lib/powerpages-config.js` anywhere a script reads `.powerpages-site` table-permission or site-setting YAML. Keep that module focused on loading/parsing code-site config only; put validation or business rules in separate validator modules.
 - **Script changes require tests** — Whenever you add a new script or modify an existing script, add or update `node:test` coverage under `scripts/tests/`. Prefer one `*.test.js` file per script/module being tested, and keep the test command passing: `node --test plugins/power-pages/scripts/tests/` (Node's built-in runner discovers `*.test.js` files under the given directory). Validator changes are not an exception; they must always ship with test coverage.
 - **Dataverse-backed validation** must stay opt-in for local runs only. Do not require live Dataverse connectivity in CI workflows or default test runs; gate it behind explicit local flags such as `--validate-dataverse-relationships`.
+- **Azure CLI `--allow-no-subscriptions`** — pass this flag on AAD-only `az` operations (`az account get-access-token`, `az login`, `az account show`) so the plugin works for users whose Microsoft account has no Azure subscription. Do NOT add it to subscription-scoped commands (`az keyvault create|list`, `az group ...`, `az resource ...`) — those genuinely require a subscription. Reuse the shared `getAuthToken` helper in `scripts/lib/validation-helpers.js` instead of shelling out to `az` directly.
 - **Reference docs** shared across skills live in `references/` — reference via `${CLAUDE_PLUGIN_ROOT}/references/` paths, don't duplicate.
 - **Templates** use `__PLACEHOLDER__` tokens (e.g., `__SITE_NAME__`) replaced during scaffolding. The `gitignore` file is stored without the dot prefix and renamed to `.gitignore` during scaffolding.
 - **Hooks** are defined centrally in `hooks/hooks.json`, using `PostToolUse` with matcher `Skill` so validation runs when a tracked Power Pages skill completes.

plugins/power-pages/agents/data-model-architect.md

@@ -93,7 +93,7 @@ Verify Dataverse access and obtain authentication details using the shared scrip
 node "${CLAUDE_PLUGIN_ROOT}/scripts/verify-dataverse-access.js" <envUrl>
 ```
 
-This outputs JSON with `token`, `userId`, `organizationId`, and `tenantId`. If it fails, inform the user that Azure CLI login is required (`az login`).
+This outputs JSON with `token`, `userId`, `organizationId`, and `tenantId`. If it fails, inform the user that Azure CLI login is required (`az login --allow-no-subscriptions` — works whether or not the user has an Azure subscription).
 
 ### 2.3 Query Existing Tables
 
@@ -148,7 +148,7 @@ If still unable to determine the prefix, use `cr` as a placeholder and note in t
 If any of the above commands fail, include the error in your plan output so the user can see what went wrong:
 
 - If `pac env who` fails: Note that PAC CLI auth is required (`pac auth create`)
-- If `verify-dataverse-access.js` fails: Note that Azure CLI login is required (`az login`)
+- If `verify-dataverse-access.js` fails: Note that Azure CLI login is required (`az login --allow-no-subscriptions`)
 - If `dataverse-request.js` returns a non-2xx `status`: Check the status code — 401/403 means permissions are insufficient, 404 means the environment URL or API path may be incorrect
 - The `dataverse-request.js` script handles 401 token refresh and 429/5xx retries automatically
 

plugins/power-pages/agents/table-permissions-architect.md

@@ -378,7 +378,7 @@ Result:
 If any API calls fail:
 
 - **`pac env who` fails**: Note that PAC CLI auth is required (`pac auth create`)
-- **`verify-dataverse-access.js` fails**: Note that Azure CLI login is required (`az login`)
+- **`verify-dataverse-access.js` fails**: Note that Azure CLI login is required (`az login --allow-no-subscriptions`)
 - **OData 401/403**: The `dataverse-request.js` script handles 401 token refresh automatically; persistent 401/403 indicates insufficient privileges — note in plan
 - **OData 404**: Table doesn't exist — exclude from plan
 

plugins/power-pages/agents/webapi-settings-architect.md

@@ -238,7 +238,7 @@ Store the results as a lookup map for each table:
 If any API calls fail:
 
 - **`pac env who` fails**: Note that PAC CLI auth is required (`pac auth create`)
-- **`verify-dataverse-access.js` fails**: Note that Azure CLI login is required (`az login`)
+- **`verify-dataverse-access.js` fails**: Note that Azure CLI login is required (`az login --allow-no-subscriptions`)
 - **OData 401/403**: Token expired or insufficient privileges — note in plan
 - **OData 404**: Table doesn't exist — exclude from plan
 

plugins/power-pages/references/dataverse-prerequisites.md

@@ -24,4 +24,6 @@ Run the shared script to obtain an Azure CLI token and verify Dataverse API acce
 node "${CLAUDE_PLUGIN_ROOT}/scripts/verify-dataverse-access.js" <envUrl>
 ```
 
-On success (exit 0), it outputs JSON to stdout with `token`, `userId`, `organizationId`, and `tenantId`. On failure (exit 1), stderr explains the issue (missing `az login`, expired token, etc.).
+On success (exit 0), it outputs JSON to stdout with `token`, `userId`, `organizationId`, and `tenantId`. On failure (exit 1), stderr explains the issue (missing `az login --allow-no-subscriptions`, expired token, etc.).
+
+> **Note for users without an Azure subscription**: Dataverse and Power Platform tokens are AAD-scoped, so they work even when the signed-in Microsoft account has no Azure subscriptions attached. Use `az login --allow-no-subscriptions` to authenticate — it succeeds in both cases. Subscription-scoped Azure operations (Key Vault, resource groups, etc.) still require an actual subscription.

plugins/power-pages/scripts/clear-site-cache.js

@@ -53,7 +53,7 @@ const ppApiBaseUrl = CLOUD_TO_API[pacInfo.cloud] || CLOUD_TO_API['Public'];
 // --- Get Power Platform API token ---
 const token = getAuthToken(ppApiBaseUrl);
 if (!token) {
-  output({ success: false, error: 'Failed to get Azure CLI access token. Ensure you are logged in with: az login' });
+  output({ success: false, error: 'Failed to get Azure CLI access token. Ensure you are logged in with: az login --allow-no-subscriptions' });
 }
 
 // --- Find the website and restart it to clear cache ---

plugins/power-pages/scripts/create-environment-variable.js

@@ -97,7 +97,7 @@ async function apiPost(envUrl, token, entitySet, body) {
 async function main() {
   const token = getAuthToken(envUrl);
   if (!token) {
-    process.stderr.write('Failed to get Azure CLI token. Run `az login` first.\n');
+    process.stderr.write('Failed to get Azure CLI token. Run `az login --allow-no-subscriptions` first.\n');
     process.exit(1);
   }
 

plugins/power-pages/scripts/dataverse-request.js

@@ -76,7 +76,7 @@ async function main() {
 
   let token = getAuthToken(envUrl);
   if (!token) {
-    process.stderr.write('Failed to get Azure CLI token. Run `az login` first.\n');
+    process.stderr.write('Failed to get Azure CLI token. Run `az login --allow-no-subscriptions` first.\n');
     process.exit(1);
   }
 
@@ -94,7 +94,7 @@ async function main() {
     if (res.statusCode === 401 && attempt < maxRetries) {
       token = getAuthToken(envUrl);
       if (!token) {
-        process.stderr.write('Token refresh failed. Run `az login` again.\n');
+        process.stderr.write('Token refresh failed. Run `az login --allow-no-subscriptions` again.\n');
         process.exit(1);
       }
       continue;

plugins/power-pages/scripts/lib/validation-helpers.js

@@ -94,12 +94,13 @@ const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12
 
 /**
  * Gets an Azure CLI access token for the given resource URL.
+ * `--allow-no-subscriptions` lets accounts without an Azure subscription mint AAD-scoped Dataverse/PP tokens.
  * @returns {string|null} Access token, or null if unavailable
  */
 function getAuthToken(resourceUrl) {
   try {
     return execSync(
-      `az account get-access-token --resource "${resourceUrl}" --query accessToken -o tsv`,
+      `az account get-access-token --resource "${resourceUrl}" --allow-no-subscriptions --query accessToken -o tsv`,
       { encoding: 'utf8', timeout: 15000 }
     ).trim();
   } catch {

plugins/power-pages/scripts/list-azure-keyvaults.js

@@ -28,7 +28,7 @@ function main() {
   }
 
   if (result.status !== 0) {
-    process.stderr.write('Failed to list Azure Key Vaults. Ensure you are logged in (`az login`).\n');
+    process.stderr.write('Failed to list Azure Key Vaults. Ensure `az login` succeeded AND your account has a subscription with Key Vault access (Key Vaults are subscription-scoped).\n');
     if (result.stderr) process.stderr.write(result.stderr);
     process.exit(1);
   }