{Core} Handle JSONDecodeError for corrupted MSAL token cache and SP entries

[Copilot]

Related command
az login

Description

az login crashes with json.decoder.JSONDecodeError: Extra data when ~/.azure/msal_token_cache.json is corrupted (e.g., partial/concurrent writes). The msal_extensions.PersistedTokenCache._reload_if_necessary() only catches PersistenceNotFound, letting JSONDecodeError propagate unhandled.

Changes:

• AzureCliTokenCache (persistence.py): New subclass of PersistedTokenCache that overrides _reload_if_necessary to catch json.JSONDecodeError, emit a warning, and reset the in-memory cache to empty via self.deserialize(None). The subsequent modify() call then writes a fresh valid cache to disk, overwriting the corrupt file.
• load_persisted_token_cache: Updated to return AzureCliTokenCache instead of bare PersistedTokenCache.
• SecretStore.load: Also catches json.JSONDecodeError for the service principal entries file, returning [] rather than raising.

Testing Guide

Manually corrupt ~/.azure/msal_token_cache.json by appending extra bytes, then run az login:

echo "corrupted" >> ~/.azure/msal_token_cache.json
az login

Before this fix: crashes with JSONDecodeError: Extra data.
After this fix: logs a warning and proceeds with a fresh cache.

Unit tests added in src/azure-cli-core/azure/cli/core/auth/tests/test_persistence.py covering corrupted and valid JSON for both AzureCliTokenCache and SecretStore.

History Notes

[Core] az login: Fix JSONDecodeError crash when MSAL token cache file is corrupted

---

This checklist is used to make sure that common guidelines for a pull request are followed.

• The PR title and description has followed the guideline in Submitting Pull Requests.

• I adhere to the Command Guidelines.

• I adhere to the Error Handling Guidelines.

[azure-client-tools-bot-prd]

Validation for Azure CLI Full Test Starting...

Thanks for your contribution!

[azure-client-tools-bot-prd]

Validation for Breaking Change Starting...

Thanks for your contribution!

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[azure-client-tools-agent]

Live test skipped

⏭️ Skipping the live test for this revision because the only test file(s) changed are azure-cli-core unit tests, which the live-test pipeline (azdev test --live) does not run — it covers command-module and extension tests only.

These azure-cli-core tests are exercised by upstream CI's unit-test jobs instead. This is informational; no action is required.

---

Posted by agent-assist (autonomous bug-fix pipeline).

[azure-client-tools-agent]

Automated Review Summary

PR: {Core} Handle JSONDecodeError for corrupted MSAL token cache and SP entries

• Live test: Skipped (neutral) — this PR only changes azure-cli-core unit tests, which are not runnable via azdev test --live. No other test files were changed.
• CI checks: All 1/1 checks passed, none pending, none failed.

No blocking issues found. This PR appears ready based on the CI status observed at this head commit (027cbcc).

---

Posted by agent-assist (autonomous bug-fix pipeline).

[yonzhan]

Core