fix: address review feedback from hemarina

vhvb1989 · Copilot · vhvb1989 · commit 80f64c79ce5d · 2026-06-04T00:23:02.000Z
- Add links field to AADSTS700082 error suggestion rule
- Broaden login-state gate: only skip cleanup on ErrNoCurrentUser,
  proceed with cleanup for any other result (including corrupted cache)
- Add telemetry attribute for cache-clear failures
- Update test to verify links in AADSTS700082 rule

Co-authored-by: Copilot &lt;223556219+Copilot@users.noreply.github.com&gt;
diff --git a/cli/azd/cmd/auth_login.go b/cli/azd/cmd/auth_login.go
@@ -33,6 +33,7 @@ import (
 	"github.com/azure/azure-dev/cli/azd/pkg/tools/github"
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
+	"go.opentelemetry.io/otel/attribute"
 )
 
 // The parent of the login command.
@@ -367,14 +368,17 @@ func (la *loginAction) Run(ctx context.Context) (*actions.ActionResult, error) {
 		}
 	}
 
-	// When already logged in, clear cached auth data before re-authenticating.
-	// This prevents issues with stale MSAL tokens or corrupted credential cache files
-	// that can cause AADSTS700082 errors even after a successful login.
-	if _, err := la.authManager.LogInDetails(ctx); err == nil {
+	// When already logged in (or when login state cannot be determined due to corrupted cache),
+	// clear cached auth data before re-authenticating. This prevents issues with stale MSAL
+	// tokens or corrupted credential cache files that can cause AADSTS700082 errors even after
+	// a successful login. Only skip cleanup when definitively not logged in.
+	if _, err := la.authManager.LogInDetails(ctx); !errors.Is(err, auth.ErrNoCurrentUser) {
 		if err := la.authManager.CleanAllAuthCache(); err != nil {
+			tracing.SetUsageAttributes(attribute.String("auth.cache_clear_failed", "auth"))
 			return nil, fmt.Errorf("clearing auth cache: %w", err)
 		}
 		if err := la.accountSubManager.ClearSubscriptions(ctx); err != nil {
+			tracing.SetUsageAttributes(attribute.String("auth.cache_clear_failed", "subscriptions"))
 			return nil, fmt.Errorf("clearing subscriptions cache: %w", err)
 		}
 	}
diff --git a/cli/azd/pkg/errorhandler/pipeline_test.go b/cli/azd/pkg/errorhandler/pipeline_test.go
@@ -728,6 +728,8 @@ func TestErrorSuggestionsYaml_AADSTS700082_SpecificRule(t *testing.T) {
 	assert.Equal(t, "The refresh token has expired or been revoked.", result.Message)
 	assert.Contains(t, result.Suggestion, "azd auth login")
 	assert.Contains(t, result.Suggestion, "automatically clears stale cached tokens")
+	require.Len(t, result.Links, 1)
+	assert.Contains(t, result.Links[0].URL, "azd-auth-login")
 }
 
 func TestErrorSuggestionsYaml_AADSTS_GenericRule(t *testing.T) {
diff --git a/cli/azd/resources/error_suggestions.yaml b/cli/azd/resources/error_suggestions.yaml
@@ -611,6 +611,9 @@ rules:
       Run 'azd auth login' to sign in again.
       When already logged in, azd automatically clears stale cached tokens before
       re-authenticating.
+    links:
+      - url: "https://learn.microsoft.com/azure/developer/azure-developer-cli/reference#azd-auth-login"
+        title: "azd auth login reference"
 
   - patterns:
       - "AADSTS"

Original file line number	Diff line number	Diff line change
`@@ -33,6 +33,7 @@ import (`
`33`	`33`	`"github.com/azure/azure-dev/cli/azd/pkg/tools/github"`
`34`	`34`	`"github.com/spf13/cobra"`
`35`	`35`	`"github.com/spf13/pflag"`
	`36`	`+ "go.opentelemetry.io/otel/attribute"`
`36`	`37`	`)`
`37`	`38`
`38`	`39`	`// The parent of the login command.`
`@@ -367,14 +368,17 @@ func (la loginAction) Run(ctx context.Context) (actions.ActionResult, error) {`
`367`	`368`	`}`
`368`	`369`	`}`
`369`	`370`
`370`		`- // When already logged in, clear cached auth data before re-authenticating.`
`371`		`- // This prevents issues with stale MSAL tokens or corrupted credential cache files`
`372`		`- // that can cause AADSTS700082 errors even after a successful login.`
`373`		`- if _, err := la.authManager.LogInDetails(ctx); err == nil {`
	`371`	`+ // When already logged in (or when login state cannot be determined due to corrupted cache),`
	`372`	`+ // clear cached auth data before re-authenticating. This prevents issues with stale MSAL`
	`373`	`+ // tokens or corrupted credential cache files that can cause AADSTS700082 errors even after`
	`374`	`+ // a successful login. Only skip cleanup when definitively not logged in.`
	`375`	`+ if _, err := la.authManager.LogInDetails(ctx); !errors.Is(err, auth.ErrNoCurrentUser) {`
`374`	`376`	`if err := la.authManager.CleanAllAuthCache(); err != nil {`
	`377`	`+ tracing.SetUsageAttributes(attribute.String("auth.cache_clear_failed", "auth"))`
`375`	`378`	`return nil, fmt.Errorf("clearing auth cache: %w", err)`
`376`	`379`	`}`
`377`	`380`	`if err := la.accountSubManager.ClearSubscriptions(ctx); err != nil {`
	`381`	`+ tracing.SetUsageAttributes(attribute.String("auth.cache_clear_failed", "subscriptions"))`
`378`	`382`	`return nil, fmt.Errorf("clearing subscriptions cache: %w", err)`
`379`	`383`	`}`
`380`	`384`	`}`
Original file line number	Diff line number	Diff line change
`@@ -728,6 +728,8 @@ func TestErrorSuggestionsYaml_AADSTS700082_SpecificRule(t *testing.T) {`
`728`	`728`	`assert.Equal(t, "The refresh token has expired or been revoked.", result.Message)`
`729`	`729`	`assert.Contains(t, result.Suggestion, "azd auth login")`
`730`	`730`	`assert.Contains(t, result.Suggestion, "automatically clears stale cached tokens")`
	`731`	`+ require.Len(t, result.Links, 1)`
	`732`	`+ assert.Contains(t, result.Links[0].URL, "azd-auth-login")`
`731`	`733`	`}`
`732`	`734`
`733`	`735`	`func TestErrorSuggestionsYaml_AADSTS_GenericRule(t *testing.T) {`