[pjohari-ms]

🤖 PR Validation — ️✔️ All clear

Breaking Changes	Tests	Suppressions
️✔️ None	️✔️ 130/130	️✔️ None

Related command

• az cosmosdb sql container update
• az cosmosdb fleetspace create
• az cosmosdb fleetspace update
• az cosmosdb fleetspace account create

Description

Port the applicable maintenance fixes from Azure/azure-cli-extensions#10509 and Azure/azure-cli-extensions#10436 into the hand-written core Cosmos DB module:

• Preserve existing computed properties when a SQL container is updated, including indexing-policy and TTL updates. Keep the existing behavior for containers with absent or empty computed properties.
• Allow non-pooled fleetspace creation when properties.throughputPoolConfiguration is omitted, null, or {}. Continue requiring a nonblank service tier and a nonempty list of nonblank data regions on create.
• Require positive integer throughput bounds, reject booleans, and require maximum throughput to be at least minimum throughput. Keep updates strict: both bounds are still required; partial updates and absent/null/empty update configurations remain unsupported.
• Validate database account ARM IDs structurally, reject child resources and wrong resource types, require a nonblank location, and require the attachment name to match the database account name case-insensitively. Preserve accepted input spelling.
• Align argument help and examples with the implemented behavior. Add real generated-SDK model assertions, public-command regressions, a stable-API non-pooled lifecycle recording, and service-backed SQL computed-property preservation evidence.

Compatibility: malformed inputs, inverted bounds, blank locations, and attachment aliases now fail before the write. Valid pooled request payloads and existing public flags are unchanged. This does not add partial throughput updates, pooling-disable commands, new API-kind behavior, SDK upgrades, or raw HTTP workarounds.

Source provenance: Azure/azure-cli-extensions#10509 was open when ported, using head 6a1cf6778af33139be0264e9a8b2db70be8f2fc9; Azure/azure-cli-extensions#10436 was merged, using head c88c75f1d4d9dfcde269fd2e0ba8d9cb3df05491. Extension-only SDK imports and unrelated recording refreshes were not copied.

Testing Guide

Validated commit: e65572d075098f1663676ab082b236dc2e6e9111. Runtime: Python 3.14.7, Azure CLI/core 2.91.0, declared and installed azure-mgmt-cosmosdb==10.0.0, native default API 2026-03-15.

Full Cosmos DB module playback follow-up

The entire latest-profile module passed locally on this same head: 106 passed, 18 existing skips, no failures, in 53.34 seconds (124 collected tests; JUnit totals additionally account for 127 passing unittest subtests). No test was newly excluded to obtain this result; all 18 skips are existing repository decorators.

For playback, remove AZURE_TEST_RUN_LIVE instead of assigning the string 'false': the SDK configuration parses that string as false, but @live_only uses environment-value truthiness. The temporary, uncommitted pytest plugin below also rejects unskipped missing cassettes, forces VCR read-only mode, and blocks DNS/socket operations. A process-local thread switch interval of 0.0001 seconds prevents the test SDK's no-sleep CLI polling loop from starving the SDK polling thread. It changes no requests, cassette contents, output assertions, or production code.

Exact full-module command executed (passed):

. .\env\Scripts\Activate.ps1
$env:PYTHONPATH = (Join-Path (Get-Location) '.git') + ';' + (Join-Path (Get-Location) 'src\azure-cli')
$env:AZURE_TEST_RUN_LIVE = $null
azdev test cosmosdb --profile latest --no-exitfirst --pytest-args '-n 4 -q -p cosmosdb_playback_guard -o faulthandler_timeout=30 --durations=10'

Temporary playback safety/timing plugin used for this run

The following was saved temporarily as .git\cosmosdb_playback_guard.py for the command above and removed after validation. It is not part of the feature patch.

import os
import sys

import pytest

from azure.cli.testsdk.scenario_tests.base import ReplayableTest
from azure.cli.testsdk.scenario_tests.config import TestConfig


def _deny_network(event, args):
    if event in {"socket.connect", "socket.getaddrinfo", "socket.sendto"}:
        raise RuntimeError("Playback-only validation blocked a network operation")


def pytest_sessionstart(session):
    if "AZURE_TEST_RUN_LIVE" in os.environ or TestConfig().record_mode:
        raise pytest.UsageError("Playback-only validation refuses live mode")
    sys.setswitchinterval(0.0001)
    sys.addaudithook(_deny_network)


@pytest.hookimpl(tryfirst=True)
def pytest_runtest_setup(item):
    case = getattr(item, "instance", None)
    if isinstance(case, ReplayableTest):
        method = getattr(case, case._testMethodName)
        if getattr(case, "__unittest_skip__", False) or getattr(
            method, "__unittest_skip__", False
        ):
            return
        if case.in_recording:
            pytest.fail(
                "Playback-only validation refuses a missing cassette or live mode",
                pytrace=False,
            )
        case.vcr.record_mode = "none"

The follow-up addresses the review's service-backed coverage gap; it changes only the existing SQL-container scenario and its recording, with no production changes. The existing computed-property unit tests are retained.

The SQL scenario seeds two populated computed properties (normalizedName and nameLength) with typed generated SDK models, then uses public CLI commands to update indexing policy, show the container independently, update TTL from 1000 to 2000, and show independently again. Each update/show asserts both exact names and queries, the requested index paths, and the expected TTL. The recording contains 40 real service interactions, including the pre-update GET, update PUT, completed-resource GET, and separate show GET for both changes. Its only HTTP error is the expected initial container exists 404; update requests succeeded. Subscription IDs are scrubbed and credential headers/common tokens were checked.

Run from the repository root in the development virtual environment:

. .\env\Scripts\Activate.ps1
$env:PYTHONPATH = Join-Path (Get-Location) 'src\azure-cli'
$env:AZURE_TEST_RUN_LIVE = $null
azdev test CosmosdbSqlContainerUpdateTest CosmosdbFleetValidationTest CosmosdbFleetCommandTest test_cosmosdb_fleet_fleetspace_fleetspaceAccount test_cosmosdb_fleetspace_non_pooled test_cosmosdb_sql_container --profile latest --series --no-exitfirst --pytest-args '-q'

Result on the follow-up: 24 passed in 138.25 seconds, including the refreshed SQL scenario and both fleet playbacks.

Additional offline regression run:

python -m pytest src\azure-cli\azure\cli\command_modules\cosmosdb\tests\latest\test_cosmosdb_sql_container_update.py src\azure-cli\azure\cli\command_modules\cosmosdb\tests\latest\test_cosmosdb_fleet_fleetspace_fleetspaceAccount_scenario.py -k 'not CosmosdbFleetScenarioTest' -q

Result: 21 passed, 2 deselected, 127 passing subtests in 3.63 seconds, covering numeric boundaries, omitted/null/empty values, typed request object graphs and serialization, attachment validation, inline/file input, help/examples, and public update/show mapping.

SQL live recording command already executed:

$env:AZURE_TEST_RUN_LIVE = 'true'
python -m pytest src\azure-cli\azure\cli\command_modules\cosmosdb\tests\latest\test_cosmosdb_commands.py::CosmosDBTests::test_cosmosdb_sql_container -q
$env:AZURE_TEST_RUN_LIVE = $null

Result: 1 passed in 315.86 seconds. The resulting cassette passed the focused playback run above. Request/response inspection confirms both computed-property names/queries survive both updates and the subsequent independent shows; indexing paths and TTL changes persist in service responses.

The unchanged non-pooled cassette was recorded for the original port with:

$env:AZURE_TEST_RUN_LIVE = 'true'
python -m pytest src\azure-cli\azure\cli\command_modules\cosmosdb\tests\latest\test_cosmosdb_fleet_fleetspace_fleetspaceAccount_scenario.py::CosmosdbFleetScenarioTest::test_cosmosdb_fleetspace_non_pooled -q
$env:AZURE_TEST_RUN_LIVE = $null

Result at the original port: 1 passed in 109.51 seconds. Its stable-API create/show/delete and cleanup recording passed playback again on the follow-up.

Other validation:

Command/check	Result
azdev style cosmosdb	Passed on the follow-up: pylint and flake8.
python -m compileall -q src\azure-cli\azure\cli\command_modules\cosmosdb	Passed.
git diff --check 0fb575456532726e3c83aadb300957424dde8e9c	Passed.
azdev linter cosmosdb	Blocked locally during global command initialization by the unrelated Backup SDK package azure-mgmt-recoveryservicesbackup-passivestamp==1.0.0b1, whose installed wheel lacks its models. This is not a local full-linter pass.
Native Cosmos DB-isolated linter (exact invocation below)	Passed at medium severity; completed with No violations found for linter rules.
Pre-commit hook (azdev scan)	Passed for the follow-up commit.
Pre-push hook	Reported an editable-install detection error and exited 0; it is not claimed as a validation pass. Push succeeded, and the remote head was verified independently. Tests/style/linter were run explicitly as described above.

Exact native Cosmos DB-isolated linter invocation (passed)

@'
from unittest.mock import patch
from azure.cli.core import MainCommandsLoader
from azure.cli.testsdk.reverse_dependency import get_dummy_cli
from azdev.operations.linter import run_linter
class CosmosdbOnlyLoader(MainCommandsLoader):
    def load_command_table(self, args):
        self.cli_ctx.invocation.data['command_string'] = ''
        return super().load_command_table(args)
    def _load_modules(self, args, command_modules):
        return super()._load_modules(args, ['cosmosdb'])
cli = get_dummy_cli(commands_loader_cls=CosmosdbOnlyLoader)
with patch('azure.cli.core.get_default_cli', return_value=cli):
    run_linter(modules=['cosmosdb'], min_severity='medium')
'@ | python -

Hosted CI must validate the new follow-up head. The successful checks reported for the previously reviewed head 4298fb33a41c75fbaa7882daa03c5ac99da298cb are not claimed as CI evidence for this commit. No Agent live-test dispatch was requested; the SQL recording above is author-run native test evidence.

History Notes

[CosmosDB] az cosmosdb sql container update: Fix loss of existing computed properties during container updates
[CosmosDB] az cosmosdb fleetspace create: Support non-pooled creation with omitted, null, or empty throughput pool configuration
[CosmosDB] az cosmosdb fleetspace: Fix throughput-bound and database account attachment input validation

---

This checklist is used to make sure that common guidelines for a pull request are followed.

• The PR title and description has followed the guideline in Submitting Pull Requests.

• I adhere to the Command Guidelines.

• I adhere to the Error Handling Guidelines.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🟢 Approval recommended

Static review found the implementation and regression coverage consistent with the intended behavior, with no blocking issues; tests were not executed.

No open issues 🎉

What changed in this PR

Ports Cosmos DB fixes from the extension into core using the existing SDK, preserving computed properties during SQL container updates and improving fleetspace creation and validation.

Changes:

• Preserve computed properties when updating SQL containers.
• Support non-pooled fleetspace creation and validate throughput bounds and account attachment inputs.
• Align help and examples, with typed SDK tests, public-command regressions, and a non-pooled scenario recording.

File	Description
src/​azure-cli/​azure/​cli/​command_modules/​cosmosdb/​tests/​latest/​test_cosmosdb_sql_container_update.py	Adds computed-property preservation regressions.
src/​azure-cli/​azure/​cli/​command_modules/​cosmosdb/​tests/​latest/​test_cosmosdb_fleet_fleetspace_fleetspaceAccount_scenario.py	Adds validation, command, help, and non-pooled scenario coverage.
src/​azure-cli/​azure/​cli/​command_modules/​cosmosdb/​tests/​latest/​recordings/​test_cosmosdb_fleetspace_non_pooled.yaml	Records the non-pooled fleetspace lifecycle.
src/​azure-cli/​azure/​cli/​command_modules/​cosmosdb/​custom.py	Preserves computed properties and handles non-pooled creation and attachment-name checks.
src/​azure-cli/​azure/​cli/​command_modules/​cosmosdb/​_validators.py	Validates creation settings, throughput bounds, and account inputs.
src/​azure-cli/​azure/​cli/​command_modules/​cosmosdb/​_params.py	Wires creation-specific validation and updates argument guidance.
src/​azure-cli/​azure/​cli/​command_modules/​cosmosdb/​_help.py	Documents supported behavior and updates examples.

_{Review effort: Balanced}

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[x-engineering-agent]

pjohari-ms Reviewed head e65572d075098f1663676ab082b236dc2e6e9111. Regression coverage for the required scenario is not verified: no linked issue establishes its acceptance conditions.

Upstream CI

The router snapshot for this head reports 3 completed checks: 3 passed, 0 failed. These are upstream results, not Agent live-test results.

🧪 Inspected regression evidence

• custom.py:776 preserves existing computed properties. tests/latest/test_cosmosdb_commands.py:670–718 asserts both property names and queries across indexing-policy and TTL updates and independent shows. tests/latest/recordings/test_cosmosdb_sql_container.yaml contains the corresponding requests and persisted responses. The unit tests additionally distinguish absent and empty properties.
• Fleet tests exercise omitted/null/empty creation pools, strict update bounds, boolean rejection, equal/reversed bounds, attachment IDs and case-insensitive names, including public-command failures before writes. tests/latest/recordings/test_cosmosdb_fleetspace_non_pooled.yaml records a pool-free create request and successful service responses. These paths are relative to src/azure-cli/azure/cli/command_modules/cosmosdb/.

Author-provided evidence

The PR reports full Cosmos DB playback on this head (106 passed, 18 existing skips) and an author-run SQL live recording followed by playback. These are author-reported executions; the Agent did not rerun them.

Test validation

• Agent live test: Not run; this is a review-only PR. Check author-provided test evidence and upstream CI separately.
• Regression coverage: For cosmosdb: 3 focused test file(s) and 2 recording file(s) changed. Scenario coverage is unverified; review the issue's required conditions, test setup, and assertions before approval. No linked issue was found in the PR timeline; inspect the source issue and its required scenario manually.

⚖️ Risk assessment — 54/100 · High

The High rating is driven by security-sensitive behavior, public CLI behavior.

• Change scope: 9 changed files, 2435 changed lines (+2179 / -256), including 4 production files.
• Affected components: cosmosdb
• Risk drivers: security-sensitive behavior (+28); public CLI behavior (+18)
• Regression evidence: Changed regression tests are included, reducing risk.
• Confidence: High because changed-line patches were available for every production file.
• Required review: Owning-squad review is required for cosmosdb before merge.

_{X Engineering Agent · Reviewer · react 👍 / 👎 to train the agent}

---

Ask the Agent

Tick a box to queue an action. Requires write access to this repository.

• 🔁 Re-review this PR
• 🧪 Run Agent live tests on this PR

[pjohari-ms]

Addressed the computed-property persistence coverage finding in commit e65572d.

• Retained the existing unit tests; changed only the SQL-container scenario and its existing recording.
• Seeded two populated computed properties with typed generated SDK models. Public indexing-policy and TTL updates, each followed by an independent CLI show, assert both exact property names/queries and the requested indexing/TTL results.
• Re-recorded the scenario against the real service. The 40-interaction cassette contains each pre-update GET, update PUT, completed-resource GET, and separate show GET, all preserving the populated properties.
• Author-run live recording: 1 passed in 315.86s. Focused playback/regression suite: 24 passed in 138.25s. Style, compilation, whitespace, and Cosmos DB-isolated native lint also passed.

The PR description now contains the exact commands/results and explicitly separates local tooling limitations and prior-head CI from validation of this follow-up. No production-code changes or Agent live-test dispatch were made.

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).