Alan-Jowett / sonde / 25833525199
82%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 124
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 83.13%. Remained the same
25833525199

push

github

web-flow 
Replace ProgramIngest API key auth with Entra ID EasyAuth (#901)

* Replace ProgramIngest API key auth with Entra ID EasyAuth

The ProgramIngest Azure Function endpoint previously used
authLevel "function" (Azure Functions API key). This is unsuitable
for SPA clients because the key would be embedded in browser-accessible
code.

This change replaces API key authentication with Azure App Service
Authentication (EasyAuth / authSettingsV2), which validates Entra ID
bearer tokens at the platform level before the request reaches the
custom handler.

Infrastructure:
- function.json: authLevel changed from "function" to "anonymous"
  (EasyAuth handles auth upstream)
- function-placeholder.bicep: added authSettingsV2 resource with
  Entra ID provider, Return401 for unauthenticated requests, and
  allowedAudiences including api://<clientId>
- stack.bicep / main.bicep: thread functionAuthClientId and
  functionAuthTenantId from companionIdentity outputs
- deploy.sh: expose api://<clientId>/user_impersonation API scope
  on Entra app + configure EasyAuth via ARM REST API

SPA:
- app.js: added getFunctionToken() that acquires a token scoped to
  api://<clientId>/user_impersonation; ProgramIngest upload uses
  this instead of the Storage-scoped token

Specifications:
- web-ui-design.md: updated auth, deploy steps, function app changes,
  new EasyAuth section
- web-ui-validation.md: updated T-WEB-0503, added T-WEB-0504-0507
  (negative auth tests), T-WEB-0606-0607 (infra tests)
- azure-companion-requirements.md: AZC-0410 step 6 + criterion 8
- azure-companion-design.md: bootstrap step 17g
- azure-companion-validation.md: T-AZC-0418 step 8
- azure-provisioning-design.md: EasyAuth + Bicep param flow

Queue-triggered invocations are unaffected -- they bypass HTTP auth.
No Rust code changes required.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Address PR review: bootstrap.sh API scope, ... (continued)

34248 of 41198 relevant lines covered (83.13%)

194.79 hits per line

Jobs
ID Job ID Ran Files Coverage
1 25833525199.1 124
83.13
 GitHub Action Run
Source Files on build 25833525199