[ManagedCleanroom] Add --subdirectory parameter for dataset publish (Azure#9852)

Adds support for mounting a subdirectory/prefix inside the storage
container when publishing analytics datasets, providing parity with the
upstream cleanroom extension's blobfuse subdirectory feature.

Changes:
* Added --subdirectory parameter to
  `az managedcleanroom frontend analytics dataset publish`.
* The new field is propagated into the request body's `store.subdirectory`
  property only when set.
* Added validation: --subdirectory combined with --encryption-mode CPK
  raises a CLIError, matching the service-side restriction in the
  cleanroom-side schema and reference CLI.
* Updated the auto-generated `analytics_frontend_api` SDK JSON dict
  templates (sync + async operations) to include `subdirectory` after
  `awsCgsSecretId`. The change matches what a fresh autorest regen
  produces from the updated frontend.yaml; only the substantive subdirectory
  delta is included to avoid unrelated cosmetic churn from the team's SDK
  post-processing.
* Added unit tests covering: subdirectory propagation in SSE mode,
  default omission when not provided, and CPK rejection.
* Updated _help.py with the new parameter doc entry and an example
  showing SSE publish with --subdirectory.
* Bumped extension version 1.0.0b5 -> 1.0.0b6 and added HISTORY.rst entry.

Validation:
* azdev style managedcleanroom: PASSED (pylint + flake8)
* python scripts/ci/test_index.py -q: OK
* All 57 unit tests pass (3 new subdirectory tests included).

Co-authored-by: Md Danish <mddanish@microsoft.com>

Author: imddanish

src/managedcleanroom/HISTORY.rst

@@ -73,3 +73,11 @@ Release History
   - Fixed schema_file parameter handling in dataset publish to support Azure CLI auto-loading (dict, string, and @file formats)
   - Fixed runhistory API endpoint method name
   - Fixed runresult API endpoint method name
+
+1.0.0b7
++++++++
+* Added: ``--subdirectory`` parameter to ``az managedcleanroom frontend analytics dataset publish``
+  to mount a specific subdirectory/prefix inside the storage container. Validation of
+  encryption-mode compatibility is enforced by the service.
+* SDK: ``analytics_frontend_api`` updated with the new ``store.subdirectory`` field
+  in the JSON dict templates (sync + async) to match the regenerated autorest output.

src/managedcleanroom/azext_managedcleanroom/_frontend_custom.py

@@ -253,6 +253,7 @@ def frontend_collaboration_dataset_publish(
     kek_keyvault_url=None,
     kek_secret_id=None,
     kek_maa_url=None,
+    subdirectory=None,
     api_version=None,
 ):
     """Publish a dataset
@@ -278,6 +279,7 @@ def frontend_collaboration_dataset_publish(
     :param kek_keyvault_url: KEK Key Vault URL (CPK mode)
     :param kek_secret_id: KEK secret ID (CPK mode)
     :param kek_maa_url: KEK MAA URL (CPK mode)
+    :param subdirectory: Optional subdirectory/prefix inside the storage container
     :param api_version: API version to use for this request
     :return: Publish result
     """
@@ -402,6 +404,8 @@ def frontend_collaboration_dataset_publish(
         "storageAccountType": storage_account_type,
         "encryptionMode": encryption_mode,
     }
+    if subdirectory:
+        store["subdirectory"] = subdirectory
 
     # Build identity
     identity = {

src/managedcleanroom/azext_managedcleanroom/_help.py

@@ -411,6 +411,9 @@
         - name: --kek-maa-url
           type: string
           short-summary: MAA URL for KEK (CPK mode only)
+        - name: --subdirectory
+          type: string
+          short-summary: Optional subdirectory/prefix inside the storage container to mount
     examples:
         - name: Publish a dataset using SSE encryption with individual parameters
           text: |
@@ -454,6 +457,22 @@
               --collaboration-id my-collab-123 \
               --document-id my-dataset \
               --body @dataset-config.json
+        - name: Publish a dataset mounted at a subdirectory
+          text: |
+            az managedcleanroom frontend analytics dataset publish \
+              --collaboration-id my-collab-123 \
+              --document-id my-dataset \
+              --storage-account-url https://mystorageaccount.blob.core.windows.net \
+              --container-name datasets \
+              --storage-account-type AzureStorageAccount \
+              --encryption-mode SSE \
+              --schema-file @schema.json \
+              --access-mode ReadWrite \
+              --identity-name northwind-identity \
+              --identity-client-id fb907136-1234-5678-9abc-def012345678 \
+              --identity-tenant-id 72f988bf-1234-5678-9abc-def012345678 \
+              --identity-issuer-url https://oidc.example.com/issuer \
+              --subdirectory year=2026/month=05
 """
 
 

src/managedcleanroom/azext_managedcleanroom/_params.py

@@ -204,6 +204,10 @@ def load_arguments(self, _):  # pylint: disable=unused-argument
             'kek_maa_url',
             options_list=['--kek-maa-url'],
             help='MAA URL for KEK (CPK mode only)')
+        c.argument(
+            'subdirectory',
+            options_list=['--subdirectory'],
+            help='Optional subdirectory/prefix inside the storage container to mount.')
 
     # Dataset queries context
     with self.argument_context('managedcleanroom frontend analytics dataset queries') as c:

src/managedcleanroom/azext_managedcleanroom/analytics_frontend_api/aio/operations/_operations.py

@@ -1304,7 +1304,8 @@ async def analytics_datasets_document_id_get(
                             "encryptionMode": "str",
                             "storageAccountType": "str",
                             "storageAccountUrl": "str",
-                            "awsCgsSecretId": "str"
+                            "awsCgsSecretId": "str",
+                            "subdirectory": ""
                         },
                         "dek": {
                             "keyVaultUrl": "str",
@@ -1441,7 +1442,8 @@ async def analytics_datasets_document_id_publish_post(  # pylint: disable=name-t
                         "encryptionMode": "str",
                         "storageAccountType": "str",
                         "storageAccountUrl": "str",
-                        "awsCgsSecretId": "str"
+                        "awsCgsSecretId": "str",
+                        "subdirectory": ""
                     },
                     "dek": {
                         "keyVaultUrl": "str",
@@ -1555,7 +1557,8 @@ async def analytics_datasets_document_id_publish_post(  # pylint: disable=name-t
                         "encryptionMode": "str",
                         "storageAccountType": "str",
                         "storageAccountUrl": "str",
-                        "awsCgsSecretId": "str"
+                        "awsCgsSecretId": "str",
+                        "subdirectory": ""
                     },
                     "dek": {
                         "keyVaultUrl": "str",

src/managedcleanroom/azext_managedcleanroom/analytics_frontend_api/operations/_operations.py

@@ -2247,7 +2247,8 @@ def analytics_datasets_document_id_get(
                             "encryptionMode": "str",
                             "storageAccountType": "str",
                             "storageAccountUrl": "str",
-                            "awsCgsSecretId": "str"
+                            "awsCgsSecretId": "str",
+                            "subdirectory": ""
                         },
                         "dek": {
                             "keyVaultUrl": "str",
@@ -2384,7 +2385,8 @@ def analytics_datasets_document_id_publish_post(  # pylint: disable=name-too-lon
                         "encryptionMode": "str",
                         "storageAccountType": "str",
                         "storageAccountUrl": "str",
-                        "awsCgsSecretId": "str"
+                        "awsCgsSecretId": "str",
+                        "subdirectory": ""
                     },
                     "dek": {
                         "keyVaultUrl": "str",
@@ -2498,7 +2500,8 @@ def analytics_datasets_document_id_publish_post(  # pylint: disable=name-too-lon
                         "encryptionMode": "str",
                         "storageAccountType": "str",
                         "storageAccountUrl": "str",
-                        "awsCgsSecretId": "str"
+                        "awsCgsSecretId": "str",
+                        "subdirectory": ""
                     },
                     "dek": {
                         "keyVaultUrl": "str",

src/managedcleanroom/azext_managedcleanroom/tests/latest/test_frontend_dataset.py

@@ -336,6 +336,71 @@ def test_publish_dataset_cpk_missing_keys(self, mock_get_client):
                 "CPK encryption mode requires", str(
                     context.exception))
 
+    @patch("azext_managedcleanroom._frontend_custom.get_frontend_client")
+    def test_publish_dataset_with_subdirectory(self, mock_get_client):
+        """Test that --subdirectory propagates into the request body's store"""
+        mock_publish_response = {"datasetId": "test-dataset-sub", "status": "published"}
+        mock_client = Mock()
+        mock_client.collaboration.analytics_datasets_document_id_publish_post.return_value = mock_publish_response
+        mock_get_client.return_value = mock_client
+
+        test_schema = {"fields": [], "format": "Delta"}
+
+        with patch("builtins.open", unittest.mock.mock_open(read_data=json.dumps(test_schema))):
+            frontend_collaboration_dataset_publish(
+                cmd=Mock(),
+                collaboration_id="test-collab-123",
+                document_id="test-dataset-sub",
+                body=None,
+                storage_account_url="https://mystorageaccount.blob.core.windows.net",
+                container_name="datasets",
+                storage_account_type="AzureStorageAccount",
+                encryption_mode="SSE",
+                schema_file="@schema.json",
+                access_mode="ReadWrite",
+                identity_name="northwind-identity",
+                identity_client_id="fb907136-1234-5678-9abc-def012345678",
+                identity_tenant_id="72f988bf-1234-5678-9abc-def012345678",
+                identity_issuer_url="https://oidc.example.com/issuer",
+                subdirectory="year=2026/month=05",
+            )
+
+        call_args = mock_client.collaboration.analytics_datasets_document_id_publish_post.call_args
+        body = call_args[0][2]
+        self.assertEqual(body["store"]["subdirectory"], "year=2026/month=05")
+
+    @patch("azext_managedcleanroom._frontend_custom.get_frontend_client")
+    def test_publish_dataset_subdirectory_default_omitted(self, mock_get_client):
+        """Test that subdirectory key is omitted from store when not provided"""
+        mock_publish_response = {"datasetId": "test-dataset-nosub", "status": "published"}
+        mock_client = Mock()
+        mock_client.collaboration.analytics_datasets_document_id_publish_post.return_value = mock_publish_response
+        mock_get_client.return_value = mock_client
+
+        test_schema = {"fields": [], "format": "Delta"}
+
+        with patch("builtins.open", unittest.mock.mock_open(read_data=json.dumps(test_schema))):
+            frontend_collaboration_dataset_publish(
+                cmd=Mock(),
+                collaboration_id="test-collab-123",
+                document_id="test-dataset-nosub",
+                body=None,
+                storage_account_url="https://mystorageaccount.blob.core.windows.net",
+                container_name="datasets",
+                storage_account_type="AzureStorageAccount",
+                encryption_mode="SSE",
+                schema_file="@schema.json",
+                access_mode="ReadWrite",
+                identity_name="northwind-identity",
+                identity_client_id="fb907136-1234-5678-9abc-def012345678",
+                identity_tenant_id="72f988bf-1234-5678-9abc-def012345678",
+                identity_issuer_url="https://oidc.example.com/issuer",
+            )
+
+        call_args = mock_client.collaboration.analytics_datasets_document_id_publish_post.call_args
+        body = call_args[0][2]
+        self.assertNotIn("subdirectory", body["store"])
+
 
 if __name__ == '__main__':
     unittest.main()

src/managedcleanroom/setup.py

@@ -10,7 +10,7 @@
 
 
 # HISTORY.rst entry.
-VERSION = '1.0.0b6'
+VERSION = '1.0.0b7'
 
 # The full list of classifiers is available at
 # https://pypi.python.org/pypi?%3Aaction=list_classifiers