Make Azure CLI test doubles portable

Intercept Azure CLI child-process calls through a Node preload so the auth and metadata tests run identically without shell or executable-resolution dependencies.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 3e31c561-a943-4464-92f3-04ab071393c0

Author: Shubham Agarwal

plugins/mobile-apps/scripts/tests/auth-token-resolution.test.js

@@ -23,72 +23,27 @@ const path = require('node:path');
 const { spawnSync } = require('node:child_process');
 
 const HELPERS = path.join(__dirname, '..', 'lib', 'validation-helpers.js');
+const FAKE_AZ_PRELOAD = path.join(__dirname, 'helpers', 'fake-az-preload.js');
 // Connection to port 1 is refused immediately, so the challenge probe (when it
 // is reached at all) resolves fast and deterministically offline.
 const UNREACHABLE_ENV_URL = 'https://127.0.0.1:1';
 
-// The fake `az` writes one line per invocation to $FAKE_AZ_LOG, then emulates
-// just the two subcommands getAuthToken uses:
+// The Node preload intercepts `execFileSync('az', ...)`, writes one line per
+// invocation to $FAKE_AZ_LOG, then emulates the two subcommands getAuthToken uses:
 //   az account show --query tenantId -o tsv
 //   az account get-access-token --resource <url> [--tenant <id>] ...
 // $FAKE_AZ_FAIL_TENANTS is a comma-separated list of tenants for which token
 // acquisition should fail (exit 1), letting a test drive the fallback chain.
-const FAKE_AZ = `#!/usr/bin/env node
-const fs = require('fs');
-const args = process.argv.slice(2);
-fs.appendFileSync(process.env.FAKE_AZ_LOG, args.join(' ') + '\\n');
-
-if (args[0] === 'account' && args[1] === 'show') {
-  process.stdout.write((process.env.FAKE_AZ_ACCOUNT_TENANT || '') + '\\n');
-  process.exit(0);
-}
-
-if (args[0] === 'account' && args[1] === 'get-access-token') {
-  const tenantIndex = args.indexOf('--tenant');
-  const tenant = tenantIndex === -1 ? '' : args[tenantIndex + 1];
-  const failing = (process.env.FAKE_AZ_FAIL_TENANTS || '').split(',').filter(Boolean);
-  if (tenant && failing.includes(tenant)) process.exit(1);
-  process.stdout.write('token-for:' + (tenant || 'active-account') + '\\n');
-  process.exit(0);
-}
-
-process.exit(1);
-`;
-
-function makeFakeAz(t) {
+function makeFakeAzLog(t) {
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'fake-az-'));
   t.after(() => fs.rmSync(dir, { recursive: true, force: true }));
-  const scriptPath = path.join(dir, 'az.js');
-  const azPath = path.join(dir, 'az');
-  const azCmdPath = path.join(dir, 'az.cmd');
-  fs.writeFileSync(scriptPath, FAKE_AZ.replace(/^#![^\n]*\n/, ''));
-  fs.writeFileSync(
-    azPath,
-    `#!${process.execPath}\nrequire(${JSON.stringify(scriptPath)});\n`,
-    { mode: 0o755 },
-  );
-  fs.writeFileSync(
-    azCmdPath,
-    `@echo off\r\n"${process.execPath}" "${scriptPath}" %*\r\n`,
-  );
-  return { dir, logPath: path.join(dir, 'az.log') };
+  return path.join(dir, 'az.log');
 }
 
-function withPrependedPath(dir, overrides = {}) {
-  const env = { ...process.env, ...overrides };
-  const pathEntry = Object.entries(env).find(([key]) => key.toLowerCase() === 'path');
-  const currentPath = pathEntry?.[1] ?? '';
-  for (const key of Object.keys(env)) {
-    if (key.toLowerCase() === 'path') delete env[key];
-  }
-  env.PATH = `${dir}${path.delimiter}${currentPath}`;
-  return env;
-}
-
-// Runs getAuthToken in a child process so PATH/env manipulation cannot leak
+// Runs getAuthToken in a child process so preload/env manipulation cannot leak
 // into the test runner, and returns both the token and the az invocation log.
 function runGetAuthToken(t, env = {}, explicitTenantId = null) {
-  const { dir, logPath } = makeFakeAz(t);
+  const logPath = makeFakeAzLog(t);
   const script = `
     const { getAuthToken } = require(${JSON.stringify(HELPERS)});
     getAuthToken(${JSON.stringify(UNREACHABLE_ENV_URL)}, ${JSON.stringify(explicitTenantId)})
@@ -98,15 +53,17 @@ function runGetAuthToken(t, env = {}, explicitTenantId = null) {
 
   const result = spawnSync(process.execPath, ['-e', script], {
     encoding: 'utf8',
-    env: withPrependedPath(dir, {
+    env: {
+      ...process.env,
+      NODE_OPTIONS: `--require=${FAKE_AZ_PRELOAD}`,
       FAKE_AZ_LOG: logPath,
       // Cleared unless a test opts in — the ambient shell may have them set.
       POWER_PLATFORM_TENANT_ID: '',
       DATAVERSE_TENANT_ID: '',
       FAKE_AZ_ACCOUNT_TENANT: '',
       FAKE_AZ_FAIL_TENANTS: '',
       ...env,
-    }),
+    },
   });
 
   assert.equal(result.status, 0, `getAuthToken failed: ${result.stderr}`);

plugins/mobile-apps/scripts/tests/dataverse-request-metadata-batch.test.js

@@ -9,47 +9,25 @@ const { promisify } = require('node:util');
 
 const execFileAsync = promisify(execFile);
 const scriptPath = path.resolve(__dirname, '..', 'dataverse-request.js');
+const fakeAzPreload = path.join(__dirname, 'helpers', 'fake-az-preload.js');
 
-function makeFakeAz(t, source) {
+function makeTempDir(t) {
   const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'dataverse-fake-az-'));
-  const fakeAzScript = path.join(tempDir, 'az.js');
-  const fakeAz = path.join(tempDir, 'az');
-  const fakeAzCmd = path.join(tempDir, 'az.cmd');
-
-  fs.writeFileSync(fakeAzScript, source);
-  fs.writeFileSync(
-    fakeAz,
-    `#!${process.execPath}\nrequire(${JSON.stringify(fakeAzScript)});\n`,
-    { mode: 0o755 },
-  );
-  fs.writeFileSync(
-    fakeAzCmd,
-    `@echo off\r\n"${process.execPath}" "${fakeAzScript}" %*\r\n`,
-  );
   t.after(() => fs.rmSync(tempDir, { recursive: true, force: true }));
   return tempDir;
 }
 
-function withPrependedPath(dir, overrides = {}) {
-  const env = { ...process.env, ...overrides };
-  const pathEntry = Object.entries(env).find(([key]) => key.toLowerCase() === 'path');
-  const currentPath = pathEntry?.[1] ?? '';
-  for (const key of Object.keys(env)) {
-    if (key.toLowerCase() === 'path') delete env[key];
-  }
-  env.PATH = `${dir}${path.delimiter}${currentPath}`;
-  return env;
+function fakeAzEnv(overrides = {}) {
+  return {
+    ...process.env,
+    NODE_OPTIONS: `--require=${fakeAzPreload}`,
+    FAKE_AZ_STATIC_TOKEN: 'test-token',
+    ...overrides,
+  };
 }
 
 test('BATCH-METADATA reuses auth, preserves order, and stops on first failure', async (t) => {
-  const tempDir = makeFakeAz(
-    t,
-    `const fs = require('node:fs');
-const args = process.argv.slice(2);
-fs.appendFileSync(process.env.FAKE_AZ_LOG, args.join(' ') + '\\n');
-process.stdout.write('{"accessToken":"test-token"}\\n');
-`,
-  );
+  const tempDir = makeTempDir(t);
   const azLog = path.join(tempDir, 'az.log');
 
   const requests = [];
@@ -93,7 +71,7 @@ process.stdout.write('{"accessToken":"test-token"}\\n');
       'explicit-tenant',
     ],
     {
-      env: withPrependedPath(tempDir, {
+      env: fakeAzEnv({
         FAKE_AZ_LOG: azLog,
       }),
     },
@@ -119,10 +97,7 @@ process.stdout.write('{"accessToken":"test-token"}\\n');
 });
 
 test('BATCH-METADATA does not turn a post-throttle collision into success', async (t) => {
-  const tempDir = makeFakeAz(
-    t,
-    `process.stdout.write('{"accessToken":"test-token"}\\n');\n`,
-  );
+  makeTempDir(t);
 
   let requestCount = 0;
   const server = http.createServer((req, res) => {
@@ -151,7 +126,7 @@ test('BATCH-METADATA does not turn a post-throttle collision into success', asyn
       '--tenant-id',
       'explicit-tenant',
     ],
-    { env: withPrependedPath(tempDir) },
+    { env: fakeAzEnv() },
   );
 
   const output = JSON.parse(stdout);

plugins/mobile-apps/scripts/tests/helpers/fake-az-preload.js

@@ -0,0 +1,40 @@
+'use strict';
+
+const childProcess = require('node:child_process');
+const fs = require('node:fs');
+
+const originalExecFileSync = childProcess.execFileSync;
+
+childProcess.execFileSync = function fakeAzExecFileSync(command, args, options) {
+  if (command !== 'az') {
+    return originalExecFileSync.call(this, command, args, options);
+  }
+
+  const cliArgs = Array.isArray(args) ? args : [];
+  if (process.env.FAKE_AZ_LOG) {
+    fs.appendFileSync(process.env.FAKE_AZ_LOG, `${cliArgs.join(' ')}\n`);
+  }
+
+  if (cliArgs[0] === 'account' && cliArgs[1] === 'show') {
+    return `${process.env.FAKE_AZ_ACCOUNT_TENANT || ''}\n`;
+  }
+
+  if (cliArgs[0] === 'account' && cliArgs[1] === 'get-access-token') {
+    const tenantIndex = cliArgs.indexOf('--tenant');
+    const tenant = tenantIndex === -1 ? '' : cliArgs[tenantIndex + 1];
+    const failing = (process.env.FAKE_AZ_FAIL_TENANTS || '').split(',').filter(Boolean);
+    if (tenant && failing.includes(tenant)) {
+      const error = new Error(`Fake Azure CLI rejected tenant ${tenant}`);
+      error.status = 1;
+      throw error;
+    }
+    if (process.env.FAKE_AZ_STATIC_TOKEN) {
+      return `${process.env.FAKE_AZ_STATIC_TOKEN}\n`;
+    }
+    return `token-for:${tenant || 'active-account'}\n`;
+  }
+
+  const error = new Error(`Unexpected fake Azure CLI arguments: ${cliArgs.join(' ')}`);
+  error.status = 1;
+  throw error;
+};