Merge pull request #154 from willvelida/013-apim-managed-identity

feat: Add JWT validation to APIM for managed identity authentication

Author: willvelida

.github/workflows/deploy-activity-api.yml

@@ -32,7 +32,7 @@ jobs:
     run-unit-tests:
           name: Run Unit Tests with Coverage
           needs: env-setup
-          uses: willvelida/biotrackr/.github/workflows/template-dotnet-run-unit-tests.yml@main
+          uses: willvelida/biotrackr/.github/workflows/template-dotnet-run-unit-tests.yml@013-apim-managed-identity
           with:
             dotnet-version: ${{ needs.env-setup.outputs.dotnet-version }}
             working-directory: ./src/Biotrackr.Activity.Api/Biotrackr.Activity.Api.UnitTests
@@ -42,7 +42,7 @@ jobs:
     run-contract-tests:
           name: Run API Contract Tests
           needs: env-setup
-          uses: willvelida/biotrackr/.github/workflows/template-dotnet-run-contract-tests.yml@main
+          uses: willvelida/biotrackr/.github/workflows/template-dotnet-run-contract-tests.yml@013-apim-managed-identity
           with:
             dotnet-version: ${{ needs.env-setup.outputs.dotnet-version }}
             working-directory: ./src/Biotrackr.Activity.Api/Biotrackr.Activity.Api.IntegrationTests
@@ -51,7 +51,7 @@ jobs:
     build-container-image-dev:
           name: Build and Push Container Image
           needs: [run-unit-tests, run-contract-tests]
-          uses: willvelida/biotrackr/.github/workflows/template-acr-push-image.yml@main
+          uses: willvelida/biotrackr/.github/workflows/template-acr-push-image.yml@013-apim-managed-identity
           with:
             working-directory: ./src/Biotrackr.Activity.Api
             app-name: biotrackr-activity-api
@@ -84,17 +84,17 @@ jobs:
     lint:
         name: Run Bicep Linter
         needs: retrieve-container-image-dev
-        uses: willvelida/biotrackr/.github/workflows/template-bicep-linter.yml@main
+        uses: willvelida/biotrackr/.github/workflows/template-bicep-linter.yml@013-apim-managed-identity
         with:
             template-file: './infra/apps/activity-api/main.bicep'
 
     validate:
         name: Validate Template
         needs: [lint, retrieve-container-image-dev]
-        uses: willvelida/biotrackr/.github/workflows/template-bicep-validate.yml@main
+        uses: willvelida/biotrackr/.github/workflows/template-bicep-validate.yml@013-apim-managed-identity
         with:
           template-file: './infra/apps/activity-api/main.bicep'
-          parameters-file: ./infra/apps/activity-api/main.dev.bicepparam
+          parameters-file: ./infra/apps/activity-api/main.dev.bicepparam 
           parameters: '{"imageName": "${{ needs.retrieve-container-image-dev.outputs.loginServer }}/biotrackr-activity-api:${{ github.sha }}"}'
           scope: resourceGroup
         secrets:
@@ -106,7 +106,7 @@ jobs:
     preview:
         name: Preview Changes
         needs: [validate, retrieve-container-image-dev]
-        uses: willvelida/biotrackr/.github/workflows/template-bicep-whatif.yml@main
+        uses: willvelida/biotrackr/.github/workflows/template-bicep-whatif.yml@013-apim-managed-identity
         with:
           scope: resourceGroup
           template-file: './infra/apps/activity-api/main.bicep'
@@ -121,7 +121,7 @@ jobs:
     deploy-dev:
         name: Deploy Template to Dev
         needs: [preview, retrieve-container-image-dev]
-        uses: willvelida/biotrackr/.github/workflows/template-bicep-deploy.yml@main
+        uses: willvelida/biotrackr/.github/workflows/template-bicep-deploy.yml@013-apim-managed-identity
         with:
           template-file: './infra/apps/activity-api/main.bicep'
           parameters-file: ./infra/apps/activity-api/main.dev.bicepparam
@@ -137,7 +137,7 @@ jobs:
     run-e2e-tests:
         name: Run E2E Tests Against Dev
         needs: [deploy-dev, env-setup]
-        uses: willvelida/biotrackr/.github/workflows/template-dotnet-run-e2e-tests.yml@main
+        uses: willvelida/biotrackr/.github/workflows/template-dotnet-run-e2e-tests.yml@013-apim-managed-identity
         with:
           dotnet-version: ${{ needs.env-setup.outputs.dotnet-version }}
           working-directory: ./src/Biotrackr.Activity.Api/Biotrackr.Activity.Api.IntegrationTests

.github/workflows/deploy-food-api.yml

@@ -32,7 +32,7 @@ jobs:
     run-unit-tests:
           name: Run Unit Tests with Coverage
           needs: env-setup
-          uses: willvelida/biotrackr/.github/workflows/template-dotnet-run-unit-tests.yml@main
+          uses: willvelida/biotrackr/.github/workflows/template-dotnet-run-unit-tests.yml@013-apim-managed-identity
           with:
             dotnet-version: ${{ needs.env-setup.outputs.dotnet-version }}
             working-directory: ./src/Biotrackr.Food.Api/Biotrackr.Food.Api.UnitTests
@@ -42,7 +42,7 @@ jobs:
     run-contract-tests:
           name: Run API Contract Tests
           needs: env-setup
-          uses: willvelida/biotrackr/.github/workflows/template-dotnet-run-contract-tests.yml@main
+          uses: willvelida/biotrackr/.github/workflows/template-dotnet-run-contract-tests.yml@013-apim-managed-identity
           with:
             dotnet-version: ${{ needs.env-setup.outputs.dotnet-version }}
             working-directory: ./src/Biotrackr.Food.Api/Biotrackr.Food.Api.IntegrationTests
@@ -51,7 +51,7 @@ jobs:
     build-container-image-dev:
           name: Build and Push Container Image
           needs: [run-unit-tests, run-contract-tests]
-          uses: willvelida/biotrackr/.github/workflows/template-acr-push-image.yml@main
+          uses: willvelida/biotrackr/.github/workflows/template-acr-push-image.yml@013-apim-managed-identity
           with:
             working-directory: ./src/Biotrackr.Food.Api
             app-name: biotrackr-food-api
@@ -84,17 +84,17 @@ jobs:
     lint:
         name: Run Bicep Linter
         needs: retrieve-container-image-dev
-        uses: willvelida/biotrackr/.github/workflows/template-bicep-linter.yml@main
+        uses: willvelida/biotrackr/.github/workflows/template-bicep-linter.yml@013-apim-managed-identity
         with:
             template-file: './infra/apps/food-api/main.bicep'
 
     validate:
         name: Validate Template
         needs: [lint, retrieve-container-image-dev]
-        uses: willvelida/biotrackr/.github/workflows/template-bicep-validate.yml@main
+        uses: willvelida/biotrackr/.github/workflows/template-bicep-validate.yml@013-apim-managed-identity
         with:
           template-file: './infra/apps/food-api/main.bicep'
-          parameters-file: ./infra/apps/food-api/main.dev.bicepparam
+          parameters-file: ./infra/apps/food-api/main.dev.bicepparam 
           parameters: '{"imageName": "${{ needs.retrieve-container-image-dev.outputs.loginServer }}/biotrackr-food-api:${{ github.sha }}"}'
           scope: resourceGroup
         secrets:
@@ -106,7 +106,7 @@ jobs:
     preview:
         name: Preview Changes
         needs: [validate, retrieve-container-image-dev]
-        uses: willvelida/biotrackr/.github/workflows/template-bicep-whatif.yml@main
+        uses: willvelida/biotrackr/.github/workflows/template-bicep-whatif.yml@013-apim-managed-identity
         with:
           scope: resourceGroup
           template-file: './infra/apps/food-api/main.bicep'
@@ -121,7 +121,7 @@ jobs:
     deploy-dev:
         name: Deploy Template to Dev
         needs: [preview, retrieve-container-image-dev]
-        uses: willvelida/biotrackr/.github/workflows/template-bicep-deploy.yml@main
+        uses: willvelida/biotrackr/.github/workflows/template-bicep-deploy.yml@013-apim-managed-identity
         with:
           template-file: './infra/apps/food-api/main.bicep'
           parameters-file: ./infra/apps/food-api/main.dev.bicepparam
@@ -137,7 +137,7 @@ jobs:
     run-e2e-tests:
         name: Run E2E Tests Against Dev
         needs: [deploy-dev, env-setup]
-        uses: willvelida/biotrackr/.github/workflows/template-dotnet-run-e2e-tests.yml@main
+        uses: willvelida/biotrackr/.github/workflows/template-dotnet-run-e2e-tests.yml@013-apim-managed-identity
         with:
           dotnet-version: ${{ needs.env-setup.outputs.dotnet-version }}
           working-directory: ./src/Biotrackr.Food.Api/Biotrackr.Food.Api.IntegrationTests

.github/workflows/deploy-sleep-api.yml

@@ -35,7 +35,7 @@ jobs:
     run-unit-tests:
           name: Run Unit Tests with Coverage
           needs: env-setup
-          uses: willvelida/biotrackr/.github/workflows/template-dotnet-run-unit-tests.yml@main
+          uses: willvelida/biotrackr/.github/workflows/template-dotnet-run-unit-tests.yml@013-apim-managed-identity
           with:
             dotnet-version: ${{ needs.env-setup.outputs.dotnet-version }}
             working-directory: ./src/Biotrackr.Sleep.Api/Biotrackr.Sleep.Api.UnitTests
@@ -45,7 +45,7 @@ jobs:
     run-contract-tests:
           name: Run API Contract Tests
           needs: env-setup
-          uses: willvelida/biotrackr/.github/workflows/template-dotnet-run-contract-tests.yml@main
+          uses: willvelida/biotrackr/.github/workflows/template-dotnet-run-contract-tests.yml@013-apim-managed-identity
           with:
             dotnet-version: ${{ needs.env-setup.outputs.dotnet-version }}
             working-directory: ./src/Biotrackr.Sleep.Api/Biotrackr.Sleep.Api.IntegrationTests
@@ -100,17 +100,17 @@ jobs:
     lint:
         name: Run Bicep Linter
         needs: retrieve-container-image-dev
-        uses: willvelida/biotrackr/.github/workflows/template-bicep-linter.yml@main
+        uses: willvelida/biotrackr/.github/workflows/template-bicep-linter.yml@013-apim-managed-identity
         with:
             template-file: './infra/apps/sleep-api/main.bicep'
 
     validate:
         name: Validate Template
         needs: [lint, retrieve-container-image-dev]
-        uses: willvelida/biotrackr/.github/workflows/template-bicep-validate.yml@main
+        uses: willvelida/biotrackr/.github/workflows/template-bicep-validate.yml@013-apim-managed-identity
         with:
           template-file: './infra/apps/sleep-api/main.bicep'
-          parameters-file: ./infra/apps/sleep-api/main.dev.bicepparam
+          parameters-file: ./infra/apps/sleep-api/main.dev.bicepparam 
           parameters: '{"imageName": "${{ needs.retrieve-container-image-dev.outputs.loginServer }}/biotrackr-sleep-api:${{ github.sha }}"}'
           scope: resourceGroup
         secrets:
@@ -122,7 +122,7 @@ jobs:
     preview:
         name: Preview Changes
         needs: [validate, retrieve-container-image-dev]
-        uses: willvelida/biotrackr/.github/workflows/template-bicep-whatif.yml@main
+        uses: willvelida/biotrackr/.github/workflows/template-bicep-whatif.yml@013-apim-managed-identity
         with:
           template-file: './infra/apps/sleep-api/main.bicep'
           parameters-file: ./infra/apps/sleep-api/main.dev.bicepparam
@@ -137,7 +137,7 @@ jobs:
     deploy-dev:
         name: Deploy Template to Dev
         needs: [preview, retrieve-container-image-dev]
-        uses: willvelida/biotrackr/.github/workflows/template-bicep-deploy.yml@main
+        uses: willvelida/biotrackr/.github/workflows/template-bicep-deploy.yml@013-apim-managed-identity
         with:
           template-file: './infra/apps/sleep-api/main.bicep'
           parameters-file: ./infra/apps/sleep-api/main.dev.bicepparam

.github/workflows/deploy-weight-api.yml

@@ -32,7 +32,7 @@ jobs:
     run-unit-tests:
           name: Run Unit Tests with Coverage
           needs: env-setup
-          uses: willvelida/biotrackr/.github/workflows/template-dotnet-run-unit-tests.yml@main
+          uses: willvelida/biotrackr/.github/workflows/template-dotnet-run-unit-tests.yml@013-apim-managed-identity
           with:
             dotnet-version: ${{ needs.env-setup.outputs.dotnet-version }}
             working-directory: ./src/Biotrackr.Weight.Api/Biotrackr.Weight.Api.UnitTests
@@ -42,7 +42,7 @@ jobs:
     run-contract-tests:
           name: Run API Contract Tests
           needs: env-setup
-          uses: willvelida/biotrackr/.github/workflows/template-dotnet-run-contract-tests.yml@main
+          uses: willvelida/biotrackr/.github/workflows/template-dotnet-run-contract-tests.yml@013-apim-managed-identity
           with:
             dotnet-version: ${{ needs.env-setup.outputs.dotnet-version }}
             working-directory: ./src/Biotrackr.Weight.Api/Biotrackr.Weight.Api.IntegrationTests
@@ -51,7 +51,7 @@ jobs:
     build-container-image-dev:
           name: Build and Push Container Image
           needs: [run-unit-tests, run-contract-tests]
-          uses: willvelida/biotrackr/.github/workflows/template-acr-push-image.yml@main
+          uses: willvelida/biotrackr/.github/workflows/template-acr-push-image.yml@013-apim-managed-identity
           with:
             working-directory: ./src/Biotrackr.Weight.Api
             app-name: biotrackr-weight-api
@@ -84,14 +84,14 @@ jobs:
     lint:
         name: Run Bicep Linter
         needs: retrieve-container-image-dev
-        uses: willvelida/biotrackr/.github/workflows/template-bicep-linter.yml@main
+        uses: willvelida/biotrackr/.github/workflows/template-bicep-linter.yml@013-apim-managed-identity
         with:
             template-file: './infra/apps/weight-api/main.bicep'
 
     validate:
         name: Validate Template
         needs: [lint, retrieve-container-image-dev]
-        uses: willvelida/biotrackr/.github/workflows/template-bicep-validate.yml@main
+        uses: willvelida/biotrackr/.github/workflows/template-bicep-validate.yml@013-apim-managed-identity
         with:
           template-file: './infra/apps/weight-api/main.bicep'
           parameters-file: ./infra/apps/weight-api/main.dev.bicepparam 
@@ -106,7 +106,7 @@ jobs:
     preview:
         name: Preview Changes
         needs: [validate, retrieve-container-image-dev]
-        uses: willvelida/biotrackr/.github/workflows/template-bicep-whatif.yml@main
+        uses: willvelida/biotrackr/.github/workflows/template-bicep-whatif.yml@013-apim-managed-identity
         with:
           template-file: './infra/apps/weight-api/main.bicep'
           parameters-file: ./infra/apps/weight-api/main.dev.bicepparam
@@ -121,7 +121,7 @@ jobs:
     deploy-dev:
         name: Deploy Template to Dev
         needs: [preview, retrieve-container-image-dev]
-        uses: willvelida/biotrackr/.github/workflows/template-bicep-deploy.yml@main
+        uses: willvelida/biotrackr/.github/workflows/template-bicep-deploy.yml@013-apim-managed-identity
         with:
           template-file: './infra/apps/weight-api/main.bicep'
           parameters-file: ./infra/apps/weight-api/main.dev.bicepparam
@@ -137,7 +137,7 @@ jobs:
     run-e2e-tests:
         name: Run E2E Tests Against Dev
         needs: [deploy-dev, env-setup]
-        uses: willvelida/biotrackr/.github/workflows/template-dotnet-run-e2e-tests.yml@main
+        uses: willvelida/biotrackr/.github/workflows/template-dotnet-run-e2e-tests.yml@013-apim-managed-identity
         with:
           dotnet-version: ${{ needs.env-setup.outputs.dotnet-version }}
           working-directory: ./src/Biotrackr.Weight.Api/Biotrackr.Weight.Api.IntegrationTests

.github/workflows/template-bicep-deploy.yml

@@ -44,6 +44,19 @@ jobs:
             tenant-id: ${{ secrets.tenant-id }}
             subscription-id: ${{ secrets.subscription-id }}
 
+        - name: Prepare Parameters with Tenant ID
+          id: prepare-params
+          shell: bash
+          run: |
+            if [ -n "${{ inputs.parameters }}" ]; then
+              # Merge user parameters with tenantId
+              PARAMS=$(echo '${{ inputs.parameters }}' | jq -c '. + {"tenantId": "${{ secrets.tenant-id }}"}')
+            else
+              # Only tenantId
+              PARAMS='{"tenantId": "${{ secrets.tenant-id }}"}'
+            fi
+            echo "params=$PARAMS" >> "$GITHUB_OUTPUT"
+
         - uses: azure/bicep-deploy@v2
           name: Deploy Bicep Template
           with:
@@ -54,5 +67,5 @@ jobs:
             resource-group-name: ${{ secrets.resource-group-name }}
             template-file: ${{ inputs.template-file }}
             parameters-file: ${{ inputs.parameters-file }}
-            parameters: ${{ inputs.parameters }}
+            parameters: ${{ steps.prepare-params.outputs.params }}
             name: ${{ github.run_number }} 

.github/workflows/template-bicep-validate.yml

@@ -40,6 +40,19 @@ jobs:
                 tenant-id: ${{ secrets.tenant-id }}
                 subscription-id: ${{ secrets.subscription-id }}
 
+            - name: Prepare Parameters with Tenant ID
+              id: prepare-params
+              shell: bash
+              run: |
+                if [ -n "${{ inputs.parameters }}" ]; then
+                  # Merge user parameters with tenantId
+                  PARAMS=$(echo '${{ inputs.parameters }}' | jq -c '. + {"tenantId": "${{ secrets.tenant-id }}"}')
+                else
+                  # Only tenantId
+                  PARAMS='{"tenantId": "${{ secrets.tenant-id }}"}'
+                fi
+                echo "params=$PARAMS" >> "$GITHUB_OUTPUT"
+
             - uses: azure/bicep-deploy@v2
               name: Run preflight validation
               with:
@@ -50,5 +63,5 @@ jobs:
                 name: ${{ github.run_number }}
                 template-file: ${{ inputs.template-file }}
                 parameters-file: ${{ inputs.parameters-file }}
-                parameters: ${{ inputs.parameters }}
+                parameters: ${{ steps.prepare-params.outputs.params }}
                 operation: validate

.github/workflows/template-bicep-whatif.yml

@@ -40,6 +40,19 @@ jobs:
             tenant-id: ${{ secrets.tenant-id }}
             subscription-id: ${{ secrets.subscription-id }}
 
+        - name: Prepare Parameters with Tenant ID
+          id: prepare-params
+          shell: bash
+          run: |
+            if [ -n "${{ inputs.parameters }}" ]; then
+              # Merge user parameters with tenantId
+              PARAMS=$(echo '${{ inputs.parameters }}' | jq -c '. + {"tenantId": "${{ secrets.tenant-id }}"}')
+            else
+              # Only tenantId
+              PARAMS='{"tenantId": "${{ secrets.tenant-id }}"}'
+            fi
+            echo "params=$PARAMS" >> "$GITHUB_OUTPUT"
+
         - uses: azure/bicep-deploy@v2
           name: Perform What-If
           with:
@@ -52,4 +65,4 @@ jobs:
             name: ${{ github.run_number }}
             template-file: ${{ inputs.template-file }}
             parameters-file: ${{ inputs.parameters-file }}
-            parameters: ${{ inputs.parameters }}
+            parameters: ${{ steps.prepare-params.outputs.params }}