fix: Skip redundant git config writes in SignIn when already correct

Context:
On every `git fetch`, git calls `credential approve` after successful
authentication, which invokes GCM's StoreCredentialAsync. For OAuth
flows against Azure Repos, this calls SignIn(orgName, userName) to
record the user-to-org binding in git config.

In the common single-user steady state — global binding already set
to the authenticated user, no local override — SignIn was still
issuing `git config --global credential.azrepos:org/<org>.username`
and `git config --local --unset credential.azrepos:org/<org>.username`
on every invocation, even though neither write was needed.

Justification:
The else branch of SignIn that handles "global absent or matches"
called Bind(global) + Unbind(local) unconditionally, without first
checking whether the state was already correct. The fix adds minimal
guards: skip Bind(global) if global is already set to the signing-in
user, skip Unbind(local) if local is already absent. This eliminates
the round-trips to git in the steady state without changing the
outcome in any other case.

The same pattern applies to the B|A case (different user holds the
global binding, local is already set to the signing-in user): that
branch also skipped the write check, so it is guarded here too.

Implementation:
Modified SignIn to skip writes when already in the desired state:
  A | -  ->  A | -   no writes (previously Set(global)+Unset(local))
  A | A  ->  A | -   only Unset(local), Set(global) skipped
  A | B  ->  A | -   only Unset(local), Set(global) skipped
  B | A  ->  B | A   no writes (already correct, was also correct)

Added four tests to AzureReposBindingManagerTests using the new
SetCallCount/UnsetCallCount counters to assert the precise number
of config writes for each case.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: derrickstolee

src/shared/Microsoft.AzureRepos.Tests/AzureReposBindingManagerTests.cs

@@ -628,6 +628,93 @@ public void AzureReposBindingManager_SignIn_OtherGlobalOtherLocal_BindsLocal()
             Assert.Equal(user2, actualGlobalUser);
         }
 
+        // Idempotency: SignIn when state is already correct should not write to git config
+
+        [Fact]
+        public void AzureReposBindingManager_SignIn_SameGlobalNoLocal_NoConfigWrites()
+        {
+            // Steady-state: global already bound to signing-in user, no local override.
+            // This is the common case on every 'git fetch' after the first sign-in.
+            const string orgName = "org";
+            const string user1 = "user1";
+
+            var git = new TestGit();
+            var trace = new NullTrace();
+            var manager = new AzureReposBindingManager(trace, git);
+
+            git.Configuration.Global[CreateKey(orgName)] = new[] {user1};
+
+            manager.SignIn(orgName, user1);
+
+            Assert.Equal(0, git.Configuration.SetCallCount);
+            Assert.Equal(0, git.Configuration.UnsetCallCount);
+        }
+
+        [Fact]
+        public void AzureReposBindingManager_SignIn_OtherGlobalSameLocal_NoConfigWrites()
+        {
+            // Steady-state: a different user holds the global binding, and local is already
+            // bound to the signing-in user. No change needed.
+            const string orgName = "org";
+            const string user1 = "user1";
+            const string user2 = "user2";
+
+            var git = new TestGit();
+            var trace = new NullTrace();
+            var manager = new AzureReposBindingManager(trace, git);
+
+            git.Configuration.Global[CreateKey(orgName)] = new[] {user2};
+            git.Configuration.Local[CreateKey(orgName)] = new[] {user1};
+
+            manager.SignIn(orgName, user1);
+
+            Assert.Equal(0, git.Configuration.SetCallCount);
+            Assert.Equal(0, git.Configuration.UnsetCallCount);
+        }
+
+        [Fact]
+        public void AzureReposBindingManager_SignIn_SameGlobalSameLocal_OnlyUnbindsLocal()
+        {
+            // Global already matches, local redundantly mirrors it.
+            // Only the local unset is needed; re-writing the global value is wasteful.
+            const string orgName = "org";
+            const string user1 = "user1";
+
+            var git = new TestGit();
+            var trace = new NullTrace();
+            var manager = new AzureReposBindingManager(trace, git);
+
+            git.Configuration.Global[CreateKey(orgName)] = new[] {user1};
+            git.Configuration.Local[CreateKey(orgName)] = new[] {user1};
+
+            manager.SignIn(orgName, user1);
+
+            Assert.Equal(0, git.Configuration.SetCallCount);
+            Assert.Equal(1, git.Configuration.UnsetCallCount);
+        }
+
+        [Fact]
+        public void AzureReposBindingManager_SignIn_SameGlobalOtherLocal_OnlyUnbindsLocal()
+        {
+            // Global already matches, local has a different user that needs removing.
+            // Only the local unset is needed; re-writing the global value is wasteful.
+            const string orgName = "org";
+            const string user1 = "user1";
+            const string user2 = "user2";
+
+            var git = new TestGit();
+            var trace = new NullTrace();
+            var manager = new AzureReposBindingManager(trace, git);
+
+            git.Configuration.Global[CreateKey(orgName)] = new[] {user1};
+            git.Configuration.Local[CreateKey(orgName)] = new[] {user2};
+
+            manager.SignIn(orgName, user1);
+
+            Assert.Equal(0, git.Configuration.SetCallCount);
+            Assert.Equal(1, git.Configuration.UnsetCallCount);
+        }
+
         #endregion
 
         #region SignOut

src/shared/Microsoft.AzureRepos/AzureReposBindingManager.cs

@@ -283,12 +283,24 @@ public static void SignIn(this IAzureReposBindingManager bindingManager, string
             if (existingBinding?.GlobalUserName != null &&
                 !StringComparer.OrdinalIgnoreCase.Equals(existingBinding.GlobalUserName, userName))
             {
-                bindingManager.Bind(orgName, userName, local: true);
+                // Global is bound to a different user (B); bind this user locally (-> B | A).
+                // Skip the write if local is already correct.
+                if (!StringComparer.OrdinalIgnoreCase.Equals(existingBinding.LocalUserName, userName))
+                {
+                    bindingManager.Bind(orgName, userName, local: true);
+                }
             }
             else
             {
-                bindingManager.Bind(orgName, userName, local: false);
-                bindingManager.Unbind(orgName, local: true);
+                // Global is absent or already matches; ensure global is set and local is clear.
+                if (existingBinding?.GlobalUserName == null)
+                {
+                    bindingManager.Bind(orgName, userName, local: false);
+                }
+                if (existingBinding?.LocalUserName != null)
+                {
+                    bindingManager.Unbind(orgName, local: true);
+                }
             }
         }