feat(azure.ai.connections): add --metadata flag to update command

[Nathandrake229]

Summary

This PR fixes two issues in the azure.ai.connections extension:

1. [azd ai agent connection] update missing --metadata flag — blocks gateway_connector register-actions #8470 — connection update command missing --metadata flag
2. [azd ai agent connection] create --auth-type oauth2 --connector-name drops empty credentials and fails with 400 #8469 — OAuth2 update path drops empty credentials, causing 400 ValidationError

---

Fix 1: Add --metadata flag to connection update (#8470)

Problem: The update command only supported --target, --key, and --custom-key. There was no way to update metadata on an existing connection without deleting and recreating it. This blocked gateway_connector workflows that require type=gateway_connector metadata.

Changes:

• Added metadata []string and metadataChanged bool to connectionUpdateFlags struct
• Updated validation to accept --metadata as a valid update field
• New --metadata values are merged on top of existing metadata (PUT-based update)
• Registered --metadata key=value flag (repeatable via StringArrayVar)
• Updated command help text, description, and examples

Usage:

# Update metadata only
azd ai connection update my-box --metadata "type=gateway_connector"

# Combine with other updates
azd ai connection update my-conn --target https://new-url.com --metadata "env=prod"

# Multiple metadata pairs
azd ai connection update my-conn --metadata "key1=val1" --metadata "key2=val2"

---

Fix 2: Emit empty credentials on OAuth2 update path (#8469)

Problem: The create path was already fixed (buildOAuth2Credentials ensures "credentials": {} is present for OAuth2), but the update path was not calling buildOAuth2Credentials. Any update to an OAuth2 connection (e.g., changing target or metadata) failed with:

400 ValidationError: "Credentials Property can't be empty for auth type OAuth2"

Root cause: The update flow does GET → merge → PUT. The PUT body for OAuth2 connections was constructed without a Credentials field, and omitempty dropped it from the JSON. The ARM API requires "credentials": {} even when empty.

Fix: Added buildOAuth2Credentials(normalizedAuth, "", "") to the raw REST update path, ensuring the empty credentials object is always present for OAuth2 connections.

---

Testing

Unit tests

• TestUpdateValidation_NoFieldsToUpdate — verifies error message mentions --metadata
• TestUpdateValidation_MetadataAloneIsValid — verifies metadata-only update passes validation
• All existing tests continue to pass (go test ./... -count=1)

Live validation

Tested against e2e-tests-ncus project:

Command	Result
create --auth-type oauth2 --connector-name box (no client creds)	✅ Created
update --metadata "env=production" (metadata-only on OAuth2 conn)	✅ Updated
show confirms merged metadata (type + env)	✅ Correct
delete cleanup	✅ Cleaned

Files changed

• cli/azd/extensions/azure.ai.connections/internal/cmd/connection.go
• cli/azd/extensions/azure.ai.connections/internal/cmd/connection_test.go

Fixes #8470
Fixes #8469

[github-actions]

📋 Prioritization Note

Thanks for the contribution! The linked issue isn't in the current milestone yet.
Review may take a bit longer — reach out to @rajeshkamal5050 or @kristenwomack if you'd like to discuss prioritization.

[Copilot]

Pull request overview

Adds a repeatable --metadata key=value flag to azd ai connection update so users can merge metadata onto an existing Foundry connection without recreating it. The flag is recorded via a metadataChanged sentinel, included in the "no fields to update" validation, and merged on top of existing metadata before the body is rebuilt and PUT through either the raw REST or ARM SDK path.

Changes:

• Added metadata / metadataChanged fields and flag registration on connectionUpdateCommand, and surfaced --metadata in the help/examples.
• Included --metadata in the no-fields-to-update validation message and predicate.
• Merged user-supplied metadata pairs after existing metadata when reconstructing the update body.
• Added two validation tests: one for the missing-fields suggestion text and one for metadata-only update.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
cli/azd/extensions/azure.ai.connections/internal/cmd/connection.go	Adds --metadata flag wiring, validation, and merge logic to the update command; refreshes help/examples.
cli/azd/extensions/azure.ai.connections/internal/cmd/connection_test.go	Adds tests asserting the updated no-fields suggestion and that metadata-only invocations pass validation.

[trangevi]

/check-enforcer override