chore: dev to main merge

[Ragini-Microsoft]

Purpose

This pull request updates how Azure credentials are selected throughout the backend and improves related test coverage. The main change is to consistently choose between DefaultAzureCredential and ManagedIdentityCredential based on the APP_ENV environment variable, simplifying local development and production authentication logic. Corresponding tests are updated to explicitly set APP_ENV to ensure correct credential selection.

Credential selection logic improvements:

• Updated credential selection in image_content_agent.py, blob_service.py, and cosmos_service.py to use DefaultAzureCredential when APP_ENV is "dev", and ManagedIdentityCredential otherwise. This standardizes authentication logic across services. [1] [2] [3] [4]
• Added os imports where needed to support environment variable access. [1] [2] [3]

Test improvements:

• Updated tests for image_content_agent, blob_service, and cosmos_service to patch os.environ["APP_ENV"] as "dev" or "prod" to explicitly test both credential paths. [1] [2] [3] [4] [5]
• Ensured that tests for default credential paths check that DefaultAzureCredential is called without arguments. [1] [2]
• Set APP_ENV to "dev" by default in the mock_environment test fixture for local authentication, with managed-identity tests overriding as needed.

Does this introduce a breaking change?

• Yes
• No

Golden Path Validation

• I have tested the primary workflows (the "golden path") to ensure they function correctly without errors.

Deployment Validation

• I have validated the deployment process successfully and all services are running as expected with this change.

[github-actions]

Coverage Report •

File	Stmts	Miss	Cover	Missing
src/backend/agents
image_content_agent.py	106	7	93%	48, 63, 183, 185–186, 329, 375
src/backend/services
blob_service.py	89	0	100%
cosmos_service.py	230	2	99%	313, 575
src/tests
conftest.py	111	49	55%	38, 51, 53, 56–62, 64, 217–226, 236–238, 241–243, 245–246, 248–250, 252, 261–268, 285–288, 300–303
src/tests/agents
test_image_content_agent.py	306	0	100%
src/tests/services
test_blob_service.py	255	0	100%
test_cosmos_service.py	401	0	100%
TOTAL	7699	371	95%

Tests	Skipped	Failures	Errors	Time
426	0 💤	0 ❌	0 🔥	12.756s ⏱️

[Copilot]

Pull request overview

This pull request standardizes Azure credential selection across backend services and the image content agent by switching between DefaultAzureCredential and ManagedIdentityCredential based on APP_ENV, and updates tests/fixtures to make the environment-driven behavior explicit and deterministic.

Changes:

• Updated credential selection in backend services and image_content_agent to use DefaultAzureCredential when APP_ENV=dev, otherwise ManagedIdentityCredential.
• Added APP_ENV defaults in the test environment fixture and patched APP_ENV per-test for dev/prod credential-path coverage.
• Tightened assertions in tests to ensure DefaultAzureCredential() is called with no arguments.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/backend/agents/image_content_agent.py	Switches OpenAI auth to environment-based credential selection for both image-generation paths.
src/backend/services/blob_service.py	Switches Blob Storage auth to environment-based credential selection.
src/backend/services/cosmos_service.py	Switches Cosmos DB auth to environment-based credential selection.
src/tests/agents/test_image_content_agent.py	Forces APP_ENV in the managed-identity test to validate the prod path.
src/tests/services/test_blob_service.py	Forces APP_ENV per test and asserts DefaultAzureCredential() is called without args.
src/tests/services/test_cosmos_service.py	Forces APP_ENV per test and asserts DefaultAzureCredential() is called without args.
src/tests/conftest.py	Sets APP_ENV=dev by default for tests (with per-test overrides for prod paths).

Suppressed comments (1)

src/backend/agents/image_content_agent.py:329

• This prod path always constructs ManagedIdentityCredential(client_id=app_settings.base_settings.azure_client_id), but azure_client_id is optional (settings.py:466). Passing None explicitly can be rejected by the SDK and makes it harder to use system-assigned managed identity. Consider only passing client_id when it’s set, otherwise call ManagedIdentityCredential() with no args (and add a test for prod with no client id if supported).

        app_env = os.environ.get("APP_ENV", "prod").lower()
        if app_env == "dev":
            credential = DefaultAzureCredential()
        else:
            credential = ManagedIdentityCredential(

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.