perf: cache Azure CLI Graph token across publish command Graph API calls

[pratapladhani]

Summary

Optimizes the publish command by caching Azure CLI Graph tokens in memory and eliminating redundant service principal lookups.

Fixes #265

Problem

Every Graph API call in the publish command spawns two az subprocesses (az account show + az account get-access-token). A typical publish with MOS prerequisites check triggers ~11 Graph API calls = ~22 subprocess spawns, adding ~45-60 seconds of overhead.

Additionally, CheckMosPrerequisitesAsync in PublishHelpers.cs performs redundant service principal lookups: Check 3 (admin consent verification) re-looks up the same 3 resource app SP IDs that Check 1 (SP verification) already found.

Changes

1. Token caching in GraphApiService.EnsureGraphHeadersAsync()

• Added in-memory token cache with 5-minute TTL for the Azure CLI code path
• Token is acquired once and reused across all Graph calls within the same command execution
• Cache is tenant-aware -- switching tenants triggers a fresh acquisition
• New fields: _cachedAzCliToken, _cachedAzCliTenantId, _cachedAzCliTokenExpiry

2. Redundant SP lookup elimination in PublishHelpers.CheckMosPrerequisitesAsync()

• Check 1 caches SP IDs in a dictionary as it verifies them
• Check 3 reads from the dictionary instead of re-calling LookupServicePrincipalByAppIdAsync

Impact

Metric	Before	After	Reduction
az subprocess spawns per publish	~22	2	91%
Graph API calls in CheckMosPrerequisitesAsync	~10	~7	30%

Due Diligence

Security review

• Cache is in-memory only -- never persisted to disk, no file I/O
• Token already exists in process memory (on HttpClient.DefaultRequestHeaders.Authorization) regardless of caching
• Process exit clears all cached state -- no cross-session leakage
• 5-minute TTL is conservative vs the token's ~60-minute Azure CLI validity
• Contrast with PR fix: Add persistent MSAL token cache to reduce repeated WAM login prompts #261 (MSAL persistent cache) which correctly uses disk encryption -- different concern

Conflict analysis (4 open PRs checked)

PR	Files	Overlap?
#266 (exit codes)	PublishCommand.cs	None
#263 (MCP protocol)	MockToolingServer/Server.cs	None
#261 (MSAL caching)	MsalBrowserCredential.cs, Directory.Packages.props	None (different auth path)
#257 (endpoint name)	CleanupCommand.cs, EndpointHelper.cs	None

Thread safety

• CLI is single-threaded (sequential command execution) -- no concurrent access to cache fields
• Cache fields are private instance members, not static shared state

Cross-platform

• No platform-specific code introduced -- works on Windows, macOS, Linux
• Uses DateTimeOffset.UtcNow for timezone-safe expiry

Edge cases considered

• Different tenant ID: Cache invalidated, fresh token acquired (tested)
• Token acquisition failure: Not cached, error propagated unchanged
• Cache expiry: Falls through to fresh acquisition naturally
• Existing behavior preserved: CheckServicePrincipalCreationPrivilegesAsync bypasses EnsureGraphHeadersAsync and is unaffected

Testing

• 4 new unit tests covering: same-tenant reuse, different-tenant isolation, mixed GET/POST operations, cache duration constant
• Full test suite: 954 passed, 0 failed, 17 skipped
• Real-world validation: a365 publish --verbose confirmed 1x token acquisition + 10x cache hits

Before (verbose output)

[DEBUG] Acquiring Graph API access token for tenant ...  (x11)
[DEBUG] Executing: az account show                       (x11)
[DEBUG] Executing: az account get-access-token ...       (x11)

After (verbose output)

[DEBUG] Acquiring Graph API access token for tenant ...  (x1)
[DEBUG] Executing: az account show                       (x1)
[DEBUG] Executing: az account get-access-token ...       (x1)
[DEBUG] Cached Azure CLI Graph token for 5 minutes
[DEBUG] Using cached Azure CLI Graph token (expires in 5.0 minutes)  (x10)

[Copilot]

Pull request overview

Improves a365 publish performance by avoiding repeated Azure CLI (az) subprocess token acquisitions for Graph API calls, and by reusing previously resolved service principal IDs during MOS prerequisites checks.

Changes:

• Add an in-memory, tenant-aware Azure CLI Graph token cache (5-minute TTL) in GraphApiService.EnsureGraphHeadersAsync().
• Eliminate redundant service principal lookups in PublishHelpers.CheckMosPrerequisitesAsync() by caching SP object IDs from the initial verification step.
• Add unit tests validating token reuse behavior across multiple Graph calls.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
src/Tests/Microsoft.Agents.A365.DevTools.Cli.Tests/Services/GraphApiServiceTokenCacheTests.cs	New tests covering Azure CLI token cache behavior across Graph GET/POST calls and tenants.
src/Microsoft.Agents.A365.DevTools.Cli/Services/GraphApiService.cs	Adds tenant-aware in-memory caching for Azure CLI Graph tokens in EnsureGraphHeadersAsync().
src/Microsoft.Agents.A365.DevTools.Cli/Helpers/PublishHelpers.cs	Reuses cached resource SP IDs to avoid duplicate Graph lookups during MOS prerequisites checks.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.