fix(azure): end-to-end deploy verified — KV purge-protection conditional, AppConfig local-auth pragmatic, ARM output-name normalization

- infra/modules/keyvault.bicep: enablePurgeProtection now parameterized (default true, null when false to avoid setting the irreversible flag).
- infra/main.bicep: pass enablePurgeProtection=false for environmentName starting with 'dev' so iterative dev deploys can hard-delete the vault.
- infra/modules/appconfig.bicep: keep disableLocalAuth=false during initial provision (MI workloads still use Entra RBAC). Pass-through auth was blocked by tenant Conditional Access (Forbidden on data-plane writes even with App Configuration Data Owner). Documented inline.
- Deploy-Azure.ps1: query each ARM output individually with the ARM-normalized lowercase-prefix-but-keep-last-upper name (AZURE_LOCATION -> azurE_LOCATION, FUNCTIONS_URI -> functionS_URI, etc.). PSObject-based parsing was unreliable inside the script's pipeline context.
- docs/AZURE-DEPLOY.md: troubleshooting table updated with the 4 issues discovered during this run.

End-to-end verified: 33 resources Provisioned in italynorth, Function App + Web App returning HTTP 200, App Configuration seeded with 9 keys + 1 feature flag, KV secret 'sql-connection-string' written.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: robgrame

Deploy-Azure.ps1

@@ -201,29 +201,56 @@ if ($SkipDeploy) {
 
 Write-Step "6/8  Deploying (az deployment sub create)"
 Write-Host "    Deployment name: $DeploymentName"
-$deploy = az deployment sub create `
+az deployment sub create `
     --name $DeploymentName `
     --location $Location `
     --template-file $BicepEntry `
     --parameters "@$paramFile" `
-    --output json | ConvertFrom-Json
-
-if ($LASTEXITCODE -ne 0 -or $deploy.properties.provisioningState -ne 'Succeeded') {
-    throw "Deployment failed (state: $($deploy.properties.provisioningState))."
-}
-
-Write-Host "    Deployment state: $($deploy.properties.provisioningState)"
-
-$outputs = $deploy.properties.outputs
+    --output none
+if ($LASTEXITCODE -ne 0) { throw "az deployment sub create exited with $LASTEXITCODE" }
+
+# Fetch deployment status (just to confirm it succeeded; outputs are read individually below).
+$provState = az deployment sub show --name $DeploymentName --query "properties.provisioningState" -o tsv 2>$null
+if ($LASTEXITCODE -ne 0) { throw "az deployment sub show failed for $DeploymentName" }
+if ($provState -ne 'Succeeded') { throw "Deployment failed (state: $provState)." }
+Write-Host "    Deployment state: $provState"
+
+# Read each declared output via az --query to bypass JSON enumeration entirely.
+# (Earlier attempts that parsed properties.outputs in this script context
+# consistently saw zero keys despite the file on disk being valid — likely a
+# PowerShell pipeline-context interaction. The direct --query path is robust.)
+$outputNames = @(
+    'AZURE_LOCATION', 'AZURE_TENANT_ID', 'AZURE_RESOURCE_GROUP',
+    'AZURE_APP_CONFIG_ENDPOINT', 'AZURE_KEY_VAULT_NAME', 'AZURE_KEY_VAULT_URI',
+    'AZURE_SERVICE_BUS_FQDN', 'AZURE_SQL_SERVER_FQDN', 'AZURE_SQL_DATABASE_NAME',
+    'WEB_URI', 'FUNCTIONS_URI', 'WEB_IDENTITY_CLIENT_ID', 'FUNC_IDENTITY_CLIENT_ID'
+)
 $script:Outputs = @{}
-foreach ($prop in $outputs.PSObject.Properties) {
-    $script:Outputs[$prop.Name] = $prop.Value.value
+foreach ($name in $outputNames) {
+    # ARM normalizes output names by lower-casing every leading uppercase letter
+    # EXCEPT the last one before a lowercase/underscore boundary. So:
+    #   AZURE_LOCATION   -> azurE_LOCATION
+    #   FUNCTIONS_URI    -> functionS_URI
+    #   WEB_URI          -> weB_URI
+    # Build the ARM-side name by finding the run of leading uppercase letters,
+    # lower-casing all but the LAST one, then concatenating the remainder.
+    $i = 0
+    while ($i -lt $name.Length -and [char]::IsUpper($name[$i])) { $i++ }
+    if ($i -gt 1) {
+        # Lower-case chars 0..($i-2), keep char ($i-1) and onwards.
+        $armName = $name.Substring(0, $i - 1).ToLower() + $name.Substring($i - 1)
+    }
+    else {
+        $armName = $name.Substring(0, 1).ToLower() + $name.Substring(1)
+    }
+    $val = az deployment sub show --name $DeploymentName --query "properties.outputs.$armName.value" -o tsv 2>$null
+    if (-not [string]::IsNullOrWhiteSpace($val)) { $script:Outputs[$name] = $val }
 }
 
 Write-Host ""
-Write-Host "Deployment outputs:" -ForegroundColor Green
-$script:Outputs.GetEnumerator() | Sort-Object Name | ForEach-Object {
-    Write-Host ("    {0,-32} = {1}" -f $_.Key, $_.Value)
+Write-Host "Deployment outputs ($($script:Outputs.Count)):" -ForegroundColor Green
+foreach ($key in ($script:Outputs.Keys | Sort-Object)) {
+    Write-Host ("    {0,-32} = {1}" -f $key, $script:Outputs[$key])
 }
 
 # --- 7. Optional: populate SQL connection string in Key Vault ----------------

docs/AZURE-DEPLOY.md

@@ -115,7 +115,17 @@ Entrambi i percorsi sono supportati. **`azure.yaml` è mantenuto** per chi prefe
 | Errore | Causa probabile | Soluzione |
 |--------|-----------------|-----------|
 | `Authorization_RequestDenied` su `signed-in-user` | L'utente non ha permessi per leggere il suo profilo Graph | `az ad signed-in-user show` deve funzionare; in alternativa, passare `-SqlAdminPrincipalId <object-id>` esplicitamente |
-| `VaultAlreadyExists` su redeploy | Il nome del KV in soft-delete | Esegui `az keyvault purge --name <kv-name> --location <location>` |
+| `VaultAlreadyExists` su redeploy | Il nome del KV in soft-delete | Esegui `az keyvault purge --name <kv-name> --location <location>`. Se la subscription **vieta DeletedVaultPurge** (tipico delle MCAPS sandbox), cambia `-EnvironmentName` per ottenere un `resourceToken` nuovo (es. `dev` → `dev2`) |
 | `RoleAssignmentExists` | Re-deploy dopo cambio di tenant | Cancella manualmente i role assignment in conflitto, oppure cambia il `resourceToken` (rinominare environment) |
+| App Configuration `keyValues` falliscono con `Forbidden` / *"local authentication is disabled"* | `disableLocalAuth=true` impedisce ad ARM di scrivere le seed key, e su molti tenant la modalità *Pass-through* è bloccata da Conditional Access | Nel Bicep tenere `disableLocalAuth: false` durante il provision iniziale (le MI usano comunque RBAC Entra). Disabilitare le local key in un secondo step post-deploy con `az appconfig update --disable-local-auth true` quando le seed sono complete |
+| Key Vault `EnablePurgeProtectionRequired` | `enablePurgeProtection: true` è **irreversibile** una volta impostato | Per ambienti dev, in `main.bicep` la flag viene passata come `!startsWith(environmentName, 'dev')` → off per `dev*`, on per `prod*`. NON metterla a `true` finché non sei pronto a vivere con la protezione |
 | `BadRequest` su SQL `azureADOnlyAuthentication: true` | L'utente AAD admin non è risolvibile | Verifica che `-SqlAdminPrincipalId` punti a un utente o gruppo Entra ID esistente nel **medesimo tenant** della subscription |
 | What-if mostra molti `Unsupported (Diagnostics)` | Normale: role assignment dipende da MI principalId calcolato a runtime | Ignorabile; il deploy reale risolve correttamente |
+| `Function App zip deploy failed.` con `--resource-group` vuoto | Bug nel parsing degli output ARM dello script (storico) | Risolto in commit successivo: ARM normalizza i nomi output (es. `AZURE_RESOURCE_GROUP` → `azurE_RESOURCE_GROUP`); lo script ora ricostruisce il nome ARM esatto prima di interrogare ogni output via `az deployment sub show --query` |
+
+### Idempotenza e ri-deploy
+
+- Lo script è completamente idempotente: rilanciarlo sullo stesso `EnvironmentName` aggiorna (non ricrea) le risorse.
+- Per ripartire da zero su un ambiente, fai prima `az group delete -n rg-blkmon-<env>-<location> --yes` e poi rilancia.
+- **Attenzione**: KV e App Configuration entrano in soft-delete; se nel tenant non puoi `purge`, cambia `-EnvironmentName` per ottenere un nuovo `resourceToken`.
+

infra/main.bicep

@@ -73,6 +73,7 @@ module keyvault 'modules/keyvault.bicep' = {
       identity.outputs.webIdentityPrincipalId
       identity.outputs.funcIdentityPrincipalId
     ]
+    enablePurgeProtection: !startsWith(environmentName, 'dev')
   }
 }
 

infra/modules/appconfig.bicep

@@ -26,13 +26,24 @@ resource appConfig 'Microsoft.AppConfiguration/configurationStores@2024-05-01' =
     name: 'standard'
   }
   properties: {
-    disableLocalAuth: true
+    // NOTE: local auth is intentionally LEFT ENABLED for the initial deploy.
+    // Rationale:
+    //   - ARM-driven keyValues seeding (the resources below) uses the store's local access keys.
+    //   - Pass-through + caller Entra ID was attempted but blocked by tenant policy (HTTP 403
+    //     on data-plane writes even with App Configuration Data Owner role assigned).
+    //   - Runtime workloads (Functions, Web) still authenticate via Managed Identity + Entra RBAC
+    //     (App Configuration Data Reader) — they DO NOT use the access keys.
+    //   - For hardened production: a post-deploy step can set disableLocalAuth=true via
+    //     `az appconfig update --disable-local-auth true` once seeding is complete.
+    disableLocalAuth: false
     enablePurgeProtection: false
     publicNetworkAccess: 'Enabled'
     softDeleteRetentionInDays: 7
   }
 }
 
+// Grant the deployer App Configuration Data Owner so that an operator can manage keyValues
+// post-deploy via Entra ID (in tenants where data-plane Entra auth is permitted).
 resource ownerRa 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(deployerPrincipalId)) {
   scope: appConfig
   name: guid(appConfig.id, deployerPrincipalId, dataOwnerRoleId)

infra/modules/keyvault.bicep

@@ -6,6 +6,8 @@ param tenantId string
 param deployerPrincipalId string
 @description('Object IDs of workload identities (web, func) that need wrapKey/unwrapKey for the KEK and Get for secrets resolved via App Configuration KV-references.')
 param consumerPrincipalIds array
+@description('Enable purge protection. Once enabled, CANNOT be disabled. Keep true for prod, set false for ephemeral dev environments.')
+param enablePurgeProtection bool = true
 
 var kvAdminRoleId = '00482a5a-887f-4fb3-b363-3b7fe8e74483' // Key Vault Administrator
 var kvCryptoUserRoleId = '12338af0-0e69-4776-bea7-57ae8d297424' // Key Vault Crypto User
@@ -24,7 +26,7 @@ resource keyVault 'Microsoft.KeyVault/vaults@2024-11-01' = {
     enableRbacAuthorization: true
     enableSoftDelete: true
     softDeleteRetentionInDays: 7
-    enablePurgeProtection: true
+    enablePurgeProtection: enablePurgeProtection ? true : null
     publicNetworkAccess: 'Enabled'
     networkAcls: {
       bypass: 'AzureServices'