azure.yaml

# yaml-language-server: $schema=https://raw.githubusercontent.com/Azure/azure-dev/main/schemas/v1.0/azure.yaml.json

name: no-show-predictor
metadata:
    template: custom
services:
    appointment-agent:
        project: appointment-agent
        host: azure.ai.agent
        language: docker
        docker:
            remoteBuild: true
        config:
            container:
                resources:
                    cpu: "1"
                    memory: 2Gi
                scale:
                    maxReplicas: 3
                    minReplicas: 1
    frontend:
        project: ""
        host: staticwebapp
        language: ""
        dist: ./frontend/src/NoShowPredictor.Web/bin/Release/net10.0/publish/wwwroot
    noshow-predictor:
        project: agent
        host: azure.ai.agent
        language: docker
        docker:
            remoteBuild: true
        config:
            container:
                resources:
                    cpu: "1"
                    memory: 2Gi
                scale:
                    maxReplicas: 3
                    minReplicas: 1
            deployments:
                - model:
                    format: OpenAI
                    name: gpt-4o
                    version: "2024-11-20"
                  name: gpt-4o
                  sku:
                    capacity: 30
                    name: Standard
infra:
    provider: terraform
    path: infra
hooks:
    postdeploy:
        name: postdeploy
        shell: pwsh
        run: |
            # --- Deploy Dashboard API to Container App via ACR ---
            $acrServer = azd env get-value AZURE_CONTAINER_REGISTRY_ENDPOINT 2>$null
            $containerAppName = azd env get-value CONTAINER_APP_NAME 2>$null
            $rg = $env:AZURE_RESOURCE_GROUP
            $sqlServer = azd env get-value AZURE_SQL_SERVER 2>$null
            $sqlDatabase = azd env get-value AZURE_SQL_DATABASE 2>$null
            $allowedOrigin = azd env get-value AZURE_STATIC_WEB_APP_URL 2>$null
            if ($acrServer -and $containerAppName) {
                Write-Host "Building and deploying Dashboard API..."
                $acrName = $acrServer.Split('.')[0]
                $tag = "dashboard-api:$(Get-Date -Format 'yyyyMMddHHmmss')"
                $image = "$acrServer/$tag"

                az acr build --registry $acrName `
                    --image $tag `
                    --file agent/Dockerfile.dashboard `
                    agent/

                # Configure ACR registry with system identity
                az containerapp registry set `
                    --name $containerAppName `
                    --resource-group $rg `
                    --server $acrServer `
                    --identity system

                # Update container with real image, env vars, and port
                $sqlConnStr = "Server=$sqlServer;Database=$sqlDatabase;Authentication=Active Directory Default;Encrypt=True;TrustServerCertificate=False;"
                az containerapp update `
                    --name $containerAppName `
                    --resource-group $rg `
                    --image $image `
                    --container-name dashboard-api `
                    --set-env-vars "SQL_CONNECTION_STRING=$sqlConnStr" "ALLOWED_ORIGIN=$allowedOrigin" "ASPNETCORE_ENVIRONMENT=Production" `
                    --min-replicas 1 --max-replicas 3

                # Update ingress target port and CORS
                az containerapp ingress update `
                    --name $containerAppName `
                    --resource-group $rg `
                    --target-port 5200

                az containerapp ingress cors update `
                    --name $containerAppName `
                    --resource-group $rg `
                    --allowed-origins "$allowedOrigin" `
                    --allowed-methods GET POST PUT DELETE OPTIONS `
                    --allowed-headers "*"

                Write-Host "  Dashboard API deployed: $image"
            }
            else {
                Write-Warning "Skipping Dashboard API deploy (AZURE_CONTAINER_REGISTRY_ENDPOINT or CONTAINER_APP_NAME not set)"
            }

            Write-Host ""
            Write-Host "Deployment complete!"
            Write-Host ""
            Write-Host "Application URLs:"
            Write-Host "  Frontend:          $env:AZURE_STATIC_WEB_APP_URL"
            $dashUrl = azd env get-value DASHBOARD_API_URL 2>$null
            if ($dashUrl) { Write-Host "  Dashboard API:     $dashUrl" }
            $agentEndpoint = azd env get-value AZURE_AI_AGENT_ENDPOINT 2>$null
            if ($agentEndpoint) {
                Write-Host "  NoShow Agent:      $agentEndpoint/agents/noshow-predictor"
                Write-Host "  Appointment Agent: $agentEndpoint/agents/appointment-agent"
            }
            Write-Host ""
            Write-Host "Database Seeding:"
            Write-Host "  To seed the database with sample data, run:"
            Write-Host "    .\infra\scripts\seed-database.ps1 ``"
            Write-Host "      -SqlServer `$(azd env get-value AZURE_SQL_SERVER) ``"
            Write-Host "      -SqlDatabase `$(azd env get-value AZURE_SQL_DATABASE)"
    postprovision:
        name: postprovision
        shell: pwsh
        run: |
            Write-Host "Infrastructure provisioned successfully"

            # Get Terraform outputs from azd's state location
            $stateFile = ".azure/$env:AZURE_ENV_NAME/infra/terraform.tfstate"
            $outputs = terraform output -json -state="$stateFile" | ConvertFrom-Json

            # Set environment variables for services
            azd env set AZURE_SQL_SERVER "$($outputs.sql_server_fqdn.value)"
            azd env set AZURE_SQL_DATABASE "$($outputs.sql_database_name.value)"
            azd env set AZURE_ML_ENDPOINT_URI "$($outputs.ml_endpoint_url.value)"
            azd env set AZURE_STATIC_WEB_APP_URL "$($outputs.static_web_app_url.value)"
            azd env set AZURE_OPENAI_ENDPOINT "$($outputs.foundry_endpoint.value)"
            $endpoint = $outputs.foundry_endpoint.value.TrimEnd('/')
            $project = $outputs.foundry_project_name.value
            # Agent endpoint should be the project endpoint without agent name suffix
            # azd deploy will append /agents/{name}/versions automatically
            $projectEndpoint = "$endpoint/api/projects/$project"
            azd env set AZURE_AI_PROJECT_ENDPOINT "$projectEndpoint"
            azd env set AZURE_AI_AGENT_ENDPOINT "$projectEndpoint"
            azd env set APPLICATIONINSIGHTS_CONNECTION_STRING "$($outputs.application_insights_connection_string.value)"
            azd env set AZURE_CONTAINER_REGISTRY_ENDPOINT "$($outputs.acr_login_server.value)"
            azd env set AZURE_AD_CLIENT_ID "$($outputs.aad_app_client_id.value)"
            azd env set AZURE_AD_TENANT_ID "$($outputs.aad_tenant_id.value)"

            # Dashboard API (Container App) and A2A routing
            $dashboardApiUrl = $outputs.container_app_url.value
            azd env set DASHBOARD_API_URL "$dashboardApiUrl"
            azd env set CONTAINER_APP_NAME "$($outputs.container_app_name.value)"
            azd env set ALLOWED_ORIGIN "$($outputs.static_web_app_url.value)"
            $appointmentAgentUrl = "$projectEndpoint/agents/appointment-agent"
            azd env set APPOINTMENT_AGENT_URL "$appointmentAgentUrl"

            Write-Host "Environment variables configured:"
            Write-Host "  SQL_SERVER: $($outputs.sql_server_fqdn.value)"
            Write-Host "  SQL_DATABASE: $($outputs.sql_database_name.value)"
            Write-Host "  ML_ENDPOINT_URI: $($outputs.ml_endpoint_url.value)"
            Write-Host "  FOUNDRY_ENDPOINT: $($outputs.foundry_endpoint.value)"
            Write-Host "  STATIC_WEB_APP_URL: $($outputs.static_web_app_url.value)"
            Write-Host "  ACR: $($outputs.acr_login_server.value)"
            Write-Host "  DASHBOARD_API_URL: $dashboardApiUrl"
            Write-Host "  APPOINTMENT_AGENT_URL: $appointmentAgentUrl"

            # --- SQL identity provisioning ---
            $sqlServer = $outputs.sql_server_fqdn.value
            $sqlDatabase = $outputs.sql_database_name.value

            # Helper function to create SQL user and ensure role membership
            function New-SqlIdentityUser {
                param([string]$IdentityName, [string]$Role, [object]$Connection)
                try {
                    $sql = @"
                    IF NOT EXISTS (SELECT 1 FROM sys.database_principals WHERE name = '$IdentityName')
                    BEGIN
                        CREATE USER [$IdentityName] FROM EXTERNAL PROVIDER;
                    END

                    IF NOT EXISTS (
                        SELECT 1
                        FROM sys.database_role_members rm
                        INNER JOIN sys.database_principals r ON rm.role_principal_id = r.principal_id
                        INNER JOIN sys.database_principals u ON rm.member_principal_id = u.principal_id
                        WHERE r.name = '$Role' AND u.name = '$IdentityName'
                    )
                    BEGIN
                        ALTER ROLE [$Role] ADD MEMBER [$IdentityName];
                    END
                    "@
                    $cmd = $Connection.CreateCommand()
                    $cmd.CommandText = $sql
                    $cmd.ExecuteNonQuery() | Out-Null
                    Write-Host "  SQL user '$IdentityName' ($Role) configured successfully"
                }
                catch {
                    Write-Warning "  Could not create SQL user '$IdentityName': $_"
                }
            }

            try {
                $token = az account get-access-token --resource https://database.windows.net/ --query accessToken -o tsv
                $conn = New-Object System.Data.SqlClient.SqlConnection
                $conn.ConnectionString = "Server=$sqlServer;Database=$sqlDatabase;Encrypt=True;"
                $conn.AccessToken = $token
                $conn.Open()

                # 1. Foundry project identity (used by hosted agents) — read + write actions
                $accountName = $outputs.foundry_account_name.value
                $projectName = $outputs.foundry_project_name.value
                $identityName = "$accountName/projects/$projectName"
                Write-Host ""
                Write-Host "Creating SQL database users for managed identities..."
                Write-Host "  Foundry project identity: $identityName"
                New-SqlIdentityUser -IdentityName $identityName -Role "db_datareader" -Connection $conn
                New-SqlIdentityUser -IdentityName $identityName -Role "db_datawriter" -Connection $conn

                # 2. Container App identity (Dashboard API) — db_datareader
                $containerAppName = $outputs.container_app_name.value
                Write-Host "  Container App identity: $containerAppName"
                New-SqlIdentityUser -IdentityName $containerAppName -Role "db_datareader" -Connection $conn

                $conn.Close()
            }
            catch {
                Write-Warning "  Could not connect to SQL Server for identity provisioning: $_"
            }
    predeploy:
        name: predeploy
        shell: pwsh
        run: |
            & ./scripts/build-frontend-artifact.ps1
    prepackage:
        name: prepackage
        shell: pwsh
        run: |
            & ./scripts/build-frontend-artifact.ps1