fix(auth): report a missing Azure AD access token as a 400

[lihongyuan99]

Description

The two Azure AD providers (AzureADOAuthProvider.get_token and AzureADHybridOAuthProvider.get_token) read the token endpoint response with json["access_token"]. When the token endpoint replies with an OAuth error body — for example {"error": "invalid_grant"} — this raises an unhandled KeyError, which surfaces to the user as a 500.

The if not token: raise HTTPException(400, ACCESS_TOKEN_MISSING) check immediately below never runs, because the subscript raises before it is reached.

Every other provider in this file reads the field with .get() and raises HTTPException(400, ACCESS_TOKEN_MISSING). There are 12 access_token reads in total; the other 10 all use .get(...), and ACCESS_TOKEN_MISSING is referenced 11 times in the file. This change brings the two Azure AD providers in line with that convention.

Changes

• backend/chainlit/oauth_providers.py: use json.get("access_token") in both Azure AD providers.
• backend/tests/test_oauth_providers.py: add two regression tests (plain top-level test_* functions, per AGENTS.md).

Tests

cd backend
python -m pytest tests/test_oauth_providers.py -q

• Before: the two new tests fail with KeyError: 'access_token'; the pre-existing TestGithubOAuthProvider::test_github_get_token_missing_access_token control passes.
• After: 57 passed (55 pre-existing + 2 new).

Checklist

• Conventional Commits format used.
• Change is backward-compatible; the success path is unchanged.
• Tests pass locally, and ruff check / ruff format --check pass.

---

Summary by cubic

Reports a missing Azure AD access token as a 400 instead of an unhandled 500 when the token endpoint returns an OAuth error body. Both Azure AD providers now read access_token with .get() to match the other providers, and regression tests cover the two providers.

^{Written for commit eab2482. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 2 files

_{Re-trigger cubic}