Repository: Azure/azure-sdk-for-net
File: sdk/identity/Azure.Identity/tests/AzureDeveloperCliCredentialTests.cs (C#)

Code before:
        }

        [Test]
        public async Task AuthenticateWithDeveloperCliCredential(
            [Values(null, TenantIdHint)] string tenantId,
            [Values(true)] bool allowMultiTenantAuthentication,
            [Values(null, TenantId)] string explicitTenantId)
        {
            var context = new TokenRequestContext(new[] { Scope }, tenantId: tenantId);
            var options = new AzureDeveloperCliCredentialOptions { TenantId = explicitTenantId, AdditionallyAllowedTenants = { TenantIdHint } };
            string expectedTenantId = TenantIdResolverBase.Default.Resolve(explicitTenantId, context, TenantIdResolverBase.AllTenants);
            var (expectedToken, expectedExpiresOn, processOutput) = CredentialTestHelpers.CreateTokenForAzureDeveloperCli();

            var testProcess = new TestProcess { Output = processOutput };
            AzureDeveloperCliCredential credential =
                InstrumentClient(new AzureDeveloperCliCredential(CredentialPipeline.GetInstance(null), new TestProcessService(testProcess, true), options));
            AccessToken actualToken = await credential.GetTokenAsync(context);

            Assert.AreEqual(expectedToken, actualToken.Token);
            Assert.AreEqual(expectedExpiresOn, actualToken.ExpiresOn);

            var expectTenantId = expectedTenantId != null;
            if (expectTenantId)
            {
                Assert.That(testProcess.StartInfo.Arguments, Does.Contain($"-tenant-id {expectedTenantId}"));
            }
            else
            {
                Assert.That(testProcess.StartInfo.Arguments, Does.Not.Contain("-tenant-id"));
            }
        }

        [Test]
        public async Task AuthenticateWithDeveloperCliCredential_IncludesNoPromptFlag()
        {
            var context = new TokenRequestContext(new[] { Scope });
            var (expectedToken, expectedExpiresOn, processOutput) = CredentialTestHelpers.CreateTokenForAzureDeveloperCli();

            var testProcess = new TestProcess { Output = processOutput };
            AzureDeveloperCliCredential credential =
                InstrumentClient(new AzureDeveloperCliCredential(CredentialPipeline.GetInstance(null), new TestProcessService(testProcess, true)));
            AccessToken actualToken = await credential.GetTokenAsync(context);

            Assert.AreEqual(expectedToken, actualToken.Token);
            Assert.AreEqual(expectedExpiresOn, actualToken.ExpiresOn);
            Assert.That(testProcess.StartInfo.Arguments, Does.Contain("--no-prompt"));
        }

        [Test]
        public void AzureDeveloperCliCredential_ClaimsChallenge_NoTenant_ThrowsWithGuidance()
        {

Review comment (security):
This could also potentially go in the helper as:

```c#
TCred CreateBareCredential<TCred>() => Activator.CreateInstance(typeof(TCred));
```

Code after:
        }

        #region Virtual Factory Methods
        protected virtual TokenCredential CreateCredential(IProcessService processService, string tenantId = null, bool addTenantIdHint = false)
        {
            var options = new AzureDeveloperCliCredentialOptions { TenantId = tenantId };
            if (addTenantIdHint)
            {
                options.AdditionallyAllowedTenants.Add(TenantIdHint);
            }
            return InstrumentClient(new AzureDeveloperCliCredential(CredentialPipeline.GetInstance(null), processService, options));
        }

        protected virtual TokenCredential CreateCredentialWithTimeout(IProcessService processService, TimeSpan timeout, bool isChained = false)
        {
            var options = new AzureDeveloperCliCredentialOptions { ProcessTimeout = timeout, IsChainedCredential = isChained };
            return InstrumentClient(new AzureDeveloperCliCredential(CredentialPipeline.GetInstance(null), processService, options));
        }

        protected virtual TokenCredential CreateCredentialWithChainedOption(IProcessService processService, bool isChained)
        {
            var options = new AzureDeveloperCliCredentialOptions { IsChainedCredential = isChained };
            return InstrumentClient(new AzureDeveloperCliCredential(CredentialPipeline.GetInstance(null), processService, options));
        }

        protected virtual TokenCredential CreateBareCredential()
        {
            return InstrumentClient(new AzureDeveloperCliCredential());
        }

        /// <summary>
        /// Creates a credential with only a tenant ID for construction validation tests.
        /// No instrumentation needed since the credential is never used to get a token.
        /// </summary>
        protected virtual void CreateCredentialForTenantValidation(string tenantId)
        {
            new AzureDeveloperCliCredential(new AzureDeveloperCliCredentialOptions { TenantId = tenantId });
        }

        /// <summary>
        /// Returns the expected exception type for error scenarios.
        /// Base: AuthenticationFailedException when not chained, CredentialUnavailableException when chained.
        /// ConfigurableCredential always wraps in DefaultAzureCredential (chained), so always CredentialUnavailableException.
        /// </summary>
        protected virtual Type GetExpectedExceptionType(bool isChained)
            => isChained ? typeof(CredentialUnavailableException) : typeof(AuthenticationFailedException);
        #endregion

        [Test]
        public async Task AuthenticateWithDeveloperCliCredential(
            [Values(null, TenantIdHint)] string tenantId,