{Core} Handle 403/DecodeError when listing tenants in az login#33745
az login#33745Conversation
|
Validation for Azure CLI Full Test Starting...
Thanks for your contribution! |
|
Validation for Breaking Change Starting...
Thanks for your contribution! |
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
microsoft-github-policy-service
Bot
added
Auto-Assign
az login
Live test skipped⏭️ Skipping the live test for this revision because the only test file(s) changed are These Posted by agent-assist (autonomous bug-fix pipeline). |
![azure-client-tools-agent[bot]](https://avatars.githubusercontent.com/in/4205534?s=60&v=4){kind=small}
There was a problem hiding this comment.
Automated Review Summary
Result: ✅ Pass
- Live test (Tester): Skipped (neutral) — this PR only changes
azure-cli-coreunit test files, which are not runnable viaazdev test --live. - CI checks: 1/1 passed, 0 failed, 0 pending.
No blocking issues found. This PR looks good to merge from an automated-review perspective.
Posted by agent-assist (autonomous bug-fix pipeline).
|
Core |
… listing Extract error translation into shared `_raise_friendly_error` helper - Apply the same try/except to `client.subscriptions.list()` in `find_using_specific_tenant` so `az login --tenant TENANT_ID` also surfaces an actionable message instead of a raw `JSON is invalid` traceback - Add unit tests for the specific-tenant 403 and DecodeError paths
Live test skipped⏭️ Skipping the live test for this revision because the only test file(s) changed are These Posted by agent-assist (autonomous bug-fix pipeline). |
Live test skipped⏭️ Skipping the live test for this revision because the only test file(s) changed are These Posted by agent-assist (autonomous bug-fix pipeline). |
Related command
az loginDescription
When
az logincallsGET /tenantsand the response is a 403 with an HTML body (e.g. blocked by a network firewall or proxy), the SDK's JSON deserializer raisesazure.core.exceptions.DecodeError, surfacing the cryptic errorJSON is invalid: Expecting value: line 1 column 1 (char 0)instead of anything actionable.Changes:
SubscriptionFinder.find_using_common_tenant(_profile.py), wrapclient.tenants.list()in atry/except (DecodeError, HttpResponseError)block:DecodeError(non-JSON response, e.g. HTML block page): raisesAzureResponseErrorexplaining the parse failure and suggesting--tenant TENANT_IDas a workaroundHttpResponseError403: raisesAzureResponseErrorexplicitly calling out the 403 and suggesting network/proxy/CAP as causesHttpResponseError: re-raised as-is to preserve SDK error contextBefore this fix, users behind a restrictive network got:
After this fix, the same scenario produces:
Testing Guide
Unit tests added in
test_profile.py:test_login_tenant_list_403_raises_friendly_error— mockstenants.list()raisingHttpResponseError(status_code=403)test_login_tenant_list_decode_error_raises_friendly_error— mockstenants.list()raisingDecodeError(HTML body)History Notes
[Core]
az login: Show a user-friendly error when tenant listing is blocked by a firewall or proxy (HTTP 403 / non-JSON response) instead ofJSON is invalidThis checklist is used to make sure that common guidelines for a pull request are followed.
The PR title and description has followed the guideline in Submitting Pull Requests.
I adhere to the Command Guidelines.
I adhere to the Error Handling Guidelines.