fix(acr): address review feedback on connected-registry MI support

- Simplify _get_current_auth_type to use authType as the sole source of truth (drop identity-based inference and try/except guard; matches pre-existing direct-access style).

- get-settings (MI mode): emit only the spec-required connection string; drop the extra ACR_MANAGED_IDENTITY_CLIENT_ID / ACR_MANAGED_IDENTITY_RESOURCE_ID env vars.

- Coerce connection_state via .value before comparing to CONNECTION_STATE_OFFLINE (defensive against future SDK regen; symmetry with auth_type).

- Help/params/constants tidy-ups: typo fixes (midnight, its, immediate), MI parameter help, SyncToken caveats on permissions show/update.

- Tests: update _fake_cr helper so has_identity=True implies MI auth_type; rework TestGetCurrentAuthType; add plain-Enum coercion regression guard for connection_state; tighten MI get-settings assertions.

Author: Dhawal Jain

src/azure-cli/azure/cli/command_modules/acr/_constants.py

@@ -15,7 +15,9 @@
 
 USER_ASSIGNED_IDENTITY_RESOURCE_ID_TEMPLATE = '/subscriptions/{sub_id}/resourceGroups/{rg}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identity_name}'
 
-CONNECTED_REGISTRY_AUTH_TYPES = ['SyncToken', 'ManagedIdentity']
+class ConnectedRegistryAuthType(Enum):
+    SYNC_TOKEN = 'SyncToken'
+    MANAGED_IDENTITY = 'ManagedIdentity'
 
 TASK_RESOURCE_TYPE = REGISTRY_RESOURCE_TYPE + '/tasks'
 TASK_VALID_VSTS_URLS = ['visualstudio.com', 'dev.azure.com']

src/azure-cli/azure/cli/command_modules/acr/_help.py

@@ -1650,7 +1650,7 @@
     text: |
         az acr connected-registry create --registry mycloudregistry  --name myreadonlyacr \\
             --mode readonly --parent myconnectedregistry --sync-token mySyncTokenName
-  - name: Create a read only connected registry with client tokens, that syncs every day at midninght and sync window of 4 hours.
+  - name: Create a read only connected registry with client tokens, that syncs every day at midnight and sync window of 4 hours.
     text: |
         az acr connected-registry create -r mycloudregistry -n myreadonlyacr -p myconnectedregistry \\
             --repository "app/mycomponent" -m ReadOnly -s "0 12 * * *" -w PT4H \\
@@ -1659,7 +1659,7 @@
     text: |
         az acr connected-registry create --registry mycloudregistry --name myconnectedregistry \\
             --auth-type ManagedIdentity \\
-            --identity /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<msi>
+            --identity "/subscriptions/<SUBSCRIPTON ID>/resourcegroups/<RESOURCE GROUP>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myUserAssignedIdentitiy"
 """
 
 helps['acr connected-registry delete'] = """
@@ -1669,7 +1669,7 @@
   - name: Delete a read only connected registry 'myconnectedregistry' from parent registry 'mycloudregistry'.
     text: >
         az acr connected-registry delete --registry mycloudregistry --name myconnectedregistry
-  - name: Delete a read only connected registry 'myconnectedregistry' and it's sync token and scope-map from parent registry 'mycloudregistry'.
+  - name: Delete a read only connected registry 'myconnectedregistry' and its sync token and scope-map from parent registry 'mycloudregistry'.
     text: >
         az acr connected-registry delete -r mycloudregistry -n myconnectedregistry --cleanup
 """
@@ -1690,7 +1690,7 @@
   - name: List all the connected registries of 'mycloudregistry' in table format.
     text: >
         az acr connected-registry list --registry mycloudregistry --output table
-  - name: List only the inmediate children of 'mycloudregistry' in expanded form in a table.
+  - name: List only the immediate children of 'mycloudregistry' in expanded form in a table.
     text: >
         az acr connected-registry list --registry mycloudregistry --no-children --output table
   - name: List all the offspring of 'myconnectedregistry' in expanded form inside a table.
@@ -1737,7 +1737,7 @@
     text: |
         az acr connected-registry update --registry mycloudregistry --name myconnectedregistry \\
             --auth-type ManagedIdentity \\
-            --identity /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<msi>
+            --identity "/subscriptions/<SUBSCRIPTON ID>/resourcegroups/<RESOURCE GROUP>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myUserAssignedIdentitiy"
 """
 
 helps['acr connected-registry get-settings'] = """
@@ -1754,12 +1754,12 @@
 
 helps['acr connected-registry permissions'] = """
 type: group
-short-summary: Manage the repository permissions accross multiple connected registries. Only supported for connected registries configured with SyncToken authentication (output is derived from the sync-token scope map). Please see https://aka.ms/acr/connected-registry for more information.
+short-summary: Manage the repository permissions across multiple connected registries. Only supported for connected registries configured with SyncToken authentication (output is derived from the sync-token scope map). Please see https://aka.ms/acr/connected-registry for more information.
 """
 
 helps['acr connected-registry permissions update'] = """
 type: command
-short-summary: Add and remove repository permissions accross all the necessary connected registry sync scope maps.
+short-summary: Add and remove repository permissions across all the necessary connected registry sync scope maps. Only supported for connected registries configured with SyncToken authentication.
 examples:
   - name: Add permissions to synchronize images from 'repo1' and 'repo2' to the connected registry 'myconnectedregistry' and its ancestors.
     text: >
@@ -1774,7 +1774,7 @@
 
 helps['acr connected-registry permissions show'] = """
 type: command
-short-summary: Show the connected registry sync scope map information.
+short-summary: Show the connected registry sync scope map information. Only supported for connected registries configured with SyncToken authentication.
 examples:
   - name: Show details and attributes of a sync scope map for a connected registry.
     text: >

src/azure-cli/azure/cli/command_modules/acr/_params.py

@@ -25,7 +25,7 @@
 
 from ._constants import (
     AbacRoleAssignmentMode,
-    CONNECTED_REGISTRY_AUTH_TYPES,
+    ConnectedRegistryAuthType,
     REGISTRY_RESOURCE_TYPE,
     WEBHOOK_RESOURCE_TYPE,
     REPLICATION_RESOURCE_TYPE,
@@ -585,7 +585,7 @@ def load_arguments(self, _):  # pylint: disable=too-many-statements
         c.argument('garbage_collection_schedule', options_list=['--gc-schedule'],
                    help='Used to determine garbage collection schedule. Uses cron expression to determine the schedule. If not specified, garbage collection is set to run once a day.', required=False, default="0 0 * * *")
         c.argument('identity', help='Resource ID of a user-assigned managed identity to authenticate the connected registry with its parent. Required when --auth-type is ManagedIdentity.')
-        c.argument('auth_type', arg_type=get_enum_type(CONNECTED_REGISTRY_AUTH_TYPES), options_list=['--auth-type'], help='Authentication type used by the connected registry to sync with its parent. Defaults to SyncToken.')
+        c.argument('auth_type', arg_type=get_enum_type([e.value for e in ConnectedRegistryAuthType]), options_list=['--auth-type'], help='Authentication type used by the connected registry to sync with its parent. Defaults to SyncToken.')
 
     with self.argument_context('acr connected-registry update') as c:
         c.argument('log_level', help='Set the log level for logging on the instance. Accepted log levels are Debug, Information, Warning, Error, and None.')
@@ -604,7 +604,7 @@ def load_arguments(self, _):  # pylint: disable=too-many-statements
                    help='Indicate whether garbage collection is enabled. It is enabled by default.', arg_type=get_three_state_flag())
         c.argument('garbage_collection_schedule', options_list=['--gc-schedule'], help='Used to determine garbage collection schedule. Uses cron expression to determine the schedule. If not specified, garbage collection is set to run once a day.')
         c.argument('identity', help='Resource ID of a user-assigned managed identity. Required when migrating --auth-type to ManagedIdentity.')
-        c.argument('auth_type', arg_type=get_enum_type(CONNECTED_REGISTRY_AUTH_TYPES), options_list=['--auth-type'], help='Target authentication type. Only one-way migration from SyncToken to ManagedIdentity is supported. Connected registry must be in Offline state.')
+        c.argument('auth_type', arg_type=get_enum_type([ConnectedRegistryAuthType.MANAGED_IDENTITY.value]), options_list=['--auth-type'], help='Target authentication type. Only one-way migration from SyncToken to ManagedIdentity is supported. Connected registry must be in Offline state.')
     with self.argument_context('acr connected-registry permissions') as c:
         c.argument('add_repos', options_list=['--add'], nargs='*',
                    help='repository permissions to be added to the targeted connected registry and it\'s ancestors sync scope maps. Use the format "--add [REPO1 REPO2 ...]" per flag. ' + repo_valid_actions)