[ponces]

Summary

• Validate Customer Portal PATs through the existing credential-provider validation hook before saving credentials or syncing tool configuration, including with --store-only.
• Reject blank/malformed tokens, missing or invalid expiration claims, and expired tokens with actionable errors without exposing token contents.
• Accept all future expirations, including tokens expiring tomorrow; do not apply the five-day renewal threshold to login validation.
• Support Base64URL JWT payloads and preserve interactive login and the existing sync renewal policy.
• Add documentation and deterministic regression tests for expiration boundaries, failed login leaving credential files unchanged, and explicitly supplied tokens never invoking browser login.

Motivation

Implements the CLI-side behavior for US 158030, following the review feedback on DevOps PR 96279: PAT expiration should fail the existing cmf login --token ... command rather than require a separate pipeline validation command.

The DevOps PR is unchanged. Once pipelines consume a CLI release containing this fix, the separate validation step can be removed.

Validation

• dotnet test tests/tests.csproj --configuration Release --no-restore --filter \"TestCategory!=Integration\" --verbosity minimal: 811 passed, 2 skipped, 0 failed.
• git diff --check: passed.
• Local expiration validation only; no signature verification or server-side revocation check.

[github-actions]

.NET Test Results

View full test report

[github-actions]

Package	Line Rate	Branch Rate	Health
cmf	48%	48%	➖
core	77%	60%	✔
Summary	60% (6474 / 10854)	54% (3405 / 6296)	➖