knife-azure 3.0.6 → 5.0.1

data/lib/azure/resource_management/rest/errors.rb

@@ -0,0 +1,57 @@
+#
+# Copyright:: Copyright (c) 2012-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+module Azure
+  class ResourceManagement
+    module Rest
+      # Raised for network/transport failures and throttling (HTTP 429/5xx).
+      # These are considered retryable by the HTTP layer. When Azure supplies a
+      # Retry-After hint, it is carried here so the caller can honour it.
+      class TransientError < StandardError
+        attr_reader :retry_after
+
+        def initialize(message = nil, retry_after: nil)
+          @retry_after = retry_after
+          super(message)
+        end
+      end
+
+      # Raised when Azure Resource Manager returns an API error (HTTP 4xx, or a
+      # failed long-running operation). This is the direct replacement for the
+      # retired SDK's MsRestAzure2::AzureOperationError and preserves the same
+      # accessors that consuming code relied on: #body returns the raw response
+      # body string, and #response.body returns the same string.
+      class OperationError < StandardError
+        # Minimal stand-in for the SDK response object; only #body is consumed.
+        ResponseBody = Struct.new(:body)
+
+        attr_reader :body, :code, :http_status
+
+        def initialize(message, body: nil, code: nil, http_status: nil)
+          @body = body
+          @code = code
+          @http_status = http_status
+          super(message)
+        end
+
+        def response
+          ResponseBody.new(@body)
+        end
+      end
+    end
+  end
+end

data/lib/azure/resource_management/rest/http.rb

@@ -0,0 +1,335 @@
+#
+# Copyright:: Copyright (c) 2012-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require "net/http" unless defined?(Net::HTTP)
+require "uri" unless defined?(URI)
+require "json" unless defined?(JSON)
+require "time" unless defined?(Time.httpdate)
+require_relative "errors"
+require_relative "secure_connection"
+require_relative "environments"
+
+module Azure
+  class ResourceManagement
+    module Rest
+      # Thin Net::HTTP wrapper for talking to Azure Resource Manager. It:
+      #
+      #   * separates transient/transport failures (retried) from Azure API
+      #     errors (surfaced immediately as OperationError), instead of the
+      #     retired SDK's behaviour of retrying every failure five times;
+      #   * follows nextLink paging for list operations;
+      #   * polls long-running operations (LRO) to a terminal state.
+      class Http
+        # Simple value object for a completed HTTP response.
+        Response = Struct.new(:status, :headers, :body)
+
+        TRANSIENT_STATUS = [429, 500, 502, 503, 504].freeze
+        DEFAULT_MAX_RETRIES = 3
+        DEFAULT_RETRY_INTERVAL = 5 # seconds
+        # Hard caps so a stuck long-running operation cannot poll forever.
+        DEFAULT_LRO_TIMEOUT = 30 * 60 # seconds
+        DEFAULT_MAX_POLLS = 360
+
+        def initialize(token_provider, max_retries: DEFAULT_MAX_RETRIES, retry_interval: DEFAULT_RETRY_INTERVAL,
+                       lro_timeout: DEFAULT_LRO_TIMEOUT, max_polls: DEFAULT_MAX_POLLS,
+                       open_timeout: SecureConnection::DEFAULT_OPEN_TIMEOUT,
+                       read_timeout: SecureConnection::DEFAULT_READ_TIMEOUT,
+                       environment: Environments.default)
+          @token_provider = token_provider
+          @max_retries = max_retries
+          @retry_interval = retry_interval
+          @lro_timeout = lro_timeout
+          @max_polls = max_polls
+          @open_timeout = open_timeout
+          @read_timeout = read_timeout
+          # nextLink, Location and Azure-AsyncOperation URLs are followed from
+          # values Azure itself returns and are requested with the same bearer
+          # token as the original call. Pin them to the configured ARM host so
+          # a malformed/compromised follow-up URL can never exfiltrate the
+          # token to an unrelated HTTPS host.
+          @allowed_host = URI.parse(environment.resource_manager_endpoint_url).host
+        end
+
+        def get(url)
+          request(:get, url)
+        end
+
+        def head(url)
+          request(:head, url)
+        end
+
+        def put(url, body)
+          request(:put, url, body)
+        end
+
+        def post(url, body)
+          request(:post, url, body)
+        end
+
+        def delete(url)
+          request(:delete, url)
+        end
+
+        # Issues a GET and returns the full list of items. Handles both ARM
+        # list shapes: most endpoints return a paged { "value": [...],
+        # "nextLink": ... } envelope, but a few (e.g. VM extension image
+        # versions) return a bare JSON array. nextLink is followed for the
+        # paged shape.
+        def get_all(url)
+          items = []
+          next_url = url
+          until next_url.nil?
+            body = get(next_url).body
+            if body.is_a?(Array)
+              items.concat(body)
+              next_url = nil
+            else
+              body ||= {}
+              items.concat(Array(body["value"]))
+              next_url = body["nextLink"]
+            end
+          end
+          items
+        end
+
+        # Performs an LRO request (PUT/DELETE) and polls the async operation to
+        # completion. Returns the final resource body (for a PUT) or nil.
+        def request_and_poll(method, url, body = nil)
+          response = request(method, url, body)
+          poll_until_complete(response)
+        end
+
+        private
+
+        def request(method, url, body = nil)
+          attempts = 0
+          begin
+            do_request(method, url, body)
+          rescue TransientError => e
+            attempts += 1
+            raise if attempts > @max_retries
+
+            # Honour the server's Retry-After hint (throttling) when present.
+            sleep(e.retry_after || @retry_interval)
+            retry
+          end
+        end
+
+        def do_request(method, url, body)
+          uri = URI.parse(url)
+          validate_uri!(uri, url)
+
+          http = SecureConnection.build(uri, open_timeout: @open_timeout, read_timeout: @read_timeout)
+
+          request = build_request(method, uri, body)
+
+          begin
+            raw = http.request(request)
+          rescue Timeout::Error, SocketError, Errno::ECONNRESET, Errno::ECONNREFUSED, IOError => e
+            raise TransientError, "Transport error talking to Azure: #{e.message}"
+          end
+
+          handle_response(raw)
+        end
+
+        # ARM-supplied follow-up URLs (nextLink, Location, Azure-AsyncOperation)
+        # are requested with the same bearer token as the original call, so a
+        # malformed or compromised monitor URL must never be allowed to
+        # downgrade the connection to plaintext HTTP, nor redirect the token to
+        # a host outside the configured ARM cloud.
+        def validate_uri!(uri, url)
+          unless uri.scheme == "https"
+            raise ArgumentError, "Refusing to send an Azure request to a non-HTTPS URL: #{url}"
+          end
+
+          unless uri.host && uri.host.casecmp?(@allowed_host)
+            raise ArgumentError,
+              "Refusing to send an Azure request (with the bearer token) to untrusted host " \
+                "'#{uri.host}'; expected '#{@allowed_host}': #{url}"
+          end
+        end
+
+        def build_request(method, uri, body)
+          klass = {
+            get: Net::HTTP::Get,
+            head: Net::HTTP::Head,
+            put: Net::HTTP::Put,
+            post: Net::HTTP::Post,
+            delete: Net::HTTP::Delete,
+          }[method]
+
+          path = uri.path
+          path += "?#{uri.query}" if uri.query
+          request = klass.new(path)
+          request["Authorization"] = @token_provider.authorization_header
+          request["Content-Type"] = "application/json"
+          request["Accept"] = "application/json"
+          unless body.nil?
+            request.body = body.is_a?(String) ? body : JSON.generate(body)
+          end
+          request
+        end
+
+        def handle_response(raw)
+          status = raw.code.to_i
+          headers = normalize_headers(raw)
+          parsed = parse_body(raw.body)
+
+          if TRANSIENT_STATUS.include?(status)
+            raise TransientError.new(
+              "Azure returned a transient error (HTTP #{status}).",
+              retry_after: parse_retry_after(headers["retry-after"])
+            )
+          elsif status >= 400
+            raise OperationError.new(
+              error_message(parsed, status),
+              body: raw.body,
+              code: error_code(parsed),
+              http_status: status
+            )
+          end
+
+          Response.new(status, headers, parsed)
+        end
+
+        def parse_body(raw_body)
+          return nil if raw_body.nil? || raw_body.strip.empty?
+
+          JSON.parse(raw_body)
+        rescue JSON::ParserError
+          nil
+        end
+
+        def normalize_headers(raw)
+          headers = {}
+          raw.each_header { |k, v| headers[k.downcase] = v }
+          headers
+        end
+
+        # Azure Resource Manager errors are nested ({ "error": { "code",
+        # "message" } }); the AAD/OAuth token endpoint returns a flat shape
+        # ({ "error": "invalid_client", "error_description": "..." }). Both are
+        # handled here so a meaningful message/code is surfaced either way.
+        def error_code(parsed)
+          return nil unless parsed.is_a?(Hash)
+
+          err = parsed["error"]
+          err.is_a?(Hash) ? err["code"] : err
+        end
+
+        def error_message(parsed, status)
+          fallback = "Azure API error (HTTP #{status})."
+          return fallback unless parsed.is_a?(Hash)
+
+          err = parsed["error"]
+          if err.is_a?(Hash)
+            err["message"] || fallback
+          elsif err.is_a?(String)
+            parsed["error_description"] ? "#{err}: #{parsed["error_description"]}" : err
+          else
+            fallback
+          end
+        end
+
+        # Parse a Retry-After header value (delta-seconds or an HTTP-date) into
+        # a number of seconds, or nil when absent/unparseable.
+        def parse_retry_after(value)
+          return nil if value.nil? || value.to_s.strip.empty?
+
+          return value.to_i if value.to_s =~ /\A\d+\z/
+
+          begin
+            seconds = (Time.httpdate(value) - Time.now).round
+            seconds > 0 ? seconds : 0
+          rescue ArgumentError
+            nil
+          end
+        end
+
+        # Poll a long-running operation to a terminal state, honouring
+        # Retry-After. Azure exposes two distinct monitor styles that must be
+        # handled differently:
+        #
+        #   * Azure-AsyncOperation: a status monitor whose body carries a
+        #     "status" field ("InProgress"/"Succeeded"/"Failed"/"Canceled").
+        #     Terminal state comes from that field, not the HTTP code.
+        #   * Location: a resource monitor that returns 202 while the operation
+        #     is still running and a non-202 (200/204, often with no status
+        #     body) once it has completed. Terminal success is signalled by the
+        #     HTTP code, so a bodyless 200/204 here means "done", not "keep
+        #     polling". Azure-AsyncOperation takes precedence when both exist.
+        def poll_until_complete(response)
+          async_op_url = response.headers["azure-asyncoperation"]
+          location_url = response.headers["location"]
+          return response.body if async_op_url.nil? && location_url.nil?
+
+          deadline = Time.now + @lro_timeout
+          polls = 0
+          loop do
+            polls += 1
+            if polls > @max_polls || Time.now >= deadline
+              raise OperationError.new(
+                "Timed out waiting for the long-running operation to complete " \
+                  "(after #{polls - 1} polls / #{@lro_timeout}s).",
+                body: JSON.generate(response.body || {}),
+                code: "PollingTimeout",
+                http_status: response.status
+              )
+            end
+
+            sleep(retry_after(response))
+
+            if async_op_url
+              response = get(async_op_url)
+              state = provisioning_state(response.body)
+              case state
+              when "Succeeded"
+                return response.body
+              when "Failed", "Canceled"
+                raise OperationError.new(
+                  "Long-running operation ended in state '#{state}'.",
+                  body: JSON.generate(response.body || {}),
+                  code: state,
+                  http_status: response.status
+                )
+              end
+              async_op_url = response.headers["azure-asyncoperation"] || async_op_url
+              location_url = response.headers["location"] || location_url
+            else
+              response = get(location_url)
+              # Any non-202 response on a Location monitor is terminal success,
+              # even when there is no status body.
+              return response.body if response.status != 202
+
+              location_url = response.headers["location"] || location_url
+            end
+          end
+        end
+
+        def provisioning_state(body)
+          return nil unless body.is_a?(Hash)
+
+          body["status"] || (body["properties"] && body["properties"]["provisioningState"])
+        end
+
+        def retry_after(response)
+          parse_retry_after(response.headers && response.headers["retry-after"]) || @retry_interval
+        end
+      end
+    end
+  end
+end

data/lib/azure/resource_management/rest/rest_object.rb

@@ -0,0 +1,103 @@
+#
+# Copyright:: Copyright (c) 2012-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+module Azure
+  class ResourceManagement
+    module Rest
+      # Wraps a parsed ARM JSON response (a Hash) so existing consumers can keep
+      # using SDK-style dot notation. The retired Azure SDK exposed models with
+      # snake_case accessors and flattened the ARM "properties" envelope; this
+      # wrapper reproduces both behaviours:
+      #
+      #   * Key matching ignores case and underscores, so camelCase ARM keys
+      #     line up with the snake_case names the code already uses
+      #     (e.g. "osType" <-> os_type, "publicIPAddress" <-> public_ipaddress).
+      #   * When a name is not found at the top level, the nested "properties"
+      #     object is searched too, mirroring the SDK's flattened models
+      #     (e.g. vm.provisioning_state, vm.storage_profile).
+      class RestObject
+        def initialize(data)
+          @data = data || {}
+        end
+
+        # Wraps a raw value (Hash, Array or scalar) into RestObjects as needed.
+        def self.wrap(value)
+          case value
+          when RestObject
+            value
+          when Hash
+            new(value)
+          when Array
+            value.map { |v| wrap(v) }
+          else
+            value
+          end
+        end
+
+        def to_h
+          @data
+        end
+        alias_method :to_hash, :to_h
+
+        def [](key)
+          RestObject.wrap(@data[key])
+        end
+
+        def key?(name)
+          return true unless lookup_key(name).nil?
+
+          properties = @data["properties"]
+          properties.is_a?(Hash) && !lookup_key(name, properties).nil?
+        end
+
+        def nil?
+          @data.nil? || @data.empty?
+        end
+
+        def respond_to_missing?(_name, _include_private = false)
+          true
+        end
+
+        def method_missing(name, *args)
+          key = lookup_key(name)
+          return RestObject.wrap(@data[key]) unless key.nil?
+
+          properties = @data["properties"]
+          if properties.is_a?(Hash)
+            pkey = lookup_key(name, properties)
+            return RestObject.wrap(properties[pkey]) unless pkey.nil?
+          end
+
+          nil
+        end
+
+        private
+
+        def lookup_key(name, hash = @data)
+          return nil unless hash.is_a?(Hash)
+
+          target = normalize(name)
+          hash.keys.find { |k| normalize(k) == target }
+        end
+
+        def normalize(str)
+          str.to_s.delete("_").downcase
+        end
+      end
+    end
+  end
+end

data/lib/azure/resource_management/rest/secure_connection.rb

@@ -0,0 +1,57 @@
+#
+# Copyright:: Copyright (c) 2012-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require "net/http" unless defined?(Net::HTTP)
+require "openssl" unless defined?(OpenSSL)
+
+module Azure
+  class ResourceManagement
+    module Rest
+      # Builds Net::HTTP connections with TLS certificate verification always
+      # enabled for HTTPS, so bearer tokens and client secrets are never sent
+      # over a channel where a forged/man-in-the-middle certificate could be
+      # accepted. All outbound connections in this layer go through here.
+      module SecureConnection
+        module_function
+
+        # Bounded, overridable defaults. Net::HTTP defaults both timeouts to
+        # unlimited, so without these a stalled Azure or token endpoint could
+        # block the CLI forever (and the HTTP layer's LRO deadline can't help
+        # while http.request itself is blocked).
+        DEFAULT_OPEN_TIMEOUT = 60  # seconds to establish the connection
+        DEFAULT_READ_TIMEOUT = 120 # seconds to wait for each response
+
+        def build(uri, open_timeout: DEFAULT_OPEN_TIMEOUT, read_timeout: DEFAULT_READ_TIMEOUT)
+          http = Net::HTTP.new(uri.host, uri.port)
+          http.open_timeout = open_timeout
+          http.read_timeout = read_timeout
+          if uri.scheme == "https"
+            http.use_ssl = true
+            http.verify_mode = OpenSSL::SSL::VERIFY_PEER
+            http.cert_store = default_cert_store
+          end
+          http
+        end
+
+        # System CA trust store, loaded once and reused.
+        def default_cert_store
+          @default_cert_store ||= OpenSSL::X509::Store.new.tap(&:set_default_paths)
+        end
+      end
+    end
+  end
+end

data/lib/azure/resource_management/rest/token_provider.rb

@@ -0,0 +1,125 @@
+#
+# Copyright:: Copyright (c) 2012-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require "net/http" unless defined?(Net::HTTP)
+require "uri" unless defined?(URI)
+require "json" unless defined?(JSON)
+require_relative "environments"
+require_relative "errors"
+require_relative "secure_connection"
+
+module Azure
+  class ResourceManagement
+    module Rest
+      # Provides a bearer token for ARM requests. It supports the same two
+      # inputs the caller already produces (see azurerm_base.rb):
+      #
+      #   * service principal: {azure_tenant_id, azure_client_id,
+      #     azure_client_secret} -> client-credentials grant, cached until it
+      #     is close to expiry;
+      #   * pre-fetched token (the `az login` path): {token, tokentype} -> used
+      #     as-is.
+      class TokenProvider
+        # Refresh a client-credentials token this many seconds before expiry.
+        EXPIRY_SKEW = 120
+
+        def initialize(params = {}, environment = Environments.default)
+          @params = params
+          @environment = environment
+        end
+
+        def authorization_header
+          "#{token_type} #{access_token}"
+        end
+
+        def token_type
+          @params[:tokentype] || "Bearer"
+        end
+
+        def access_token
+          if @params[:azure_client_secret]
+            client_credentials_token
+          else
+            @params[:token]
+          end
+        end
+
+        private
+
+        def client_credentials_token
+          if @cached_token && @expires_at && Time.now.utc < (@expires_at - EXPIRY_SKEW)
+            return @cached_token
+          end
+
+          response = request_client_credentials_token
+          @cached_token = response["access_token"]
+          @expires_at = Time.now.utc + response["expires_in"].to_i
+          @cached_token
+        end
+
+        def request_client_credentials_token
+          uri = URI.parse("#{@environment.active_directory_endpoint_url}/#{@params[:azure_tenant_id]}/oauth2/token")
+          http = SecureConnection.build(uri)
+
+          request = Net::HTTP::Post.new(uri.request_uri)
+          request.set_form_data(
+            "grant_type" => "client_credentials",
+            "client_id" => @params[:azure_client_id],
+            "client_secret" => @params[:azure_client_secret],
+            "resource" => @environment.token_audience
+          )
+
+          raw = http.request(request)
+          if raw.code.to_i >= 400
+            raise OperationError.new(
+              token_error_message(raw),
+              body: raw.body,
+              http_status: raw.code.to_i
+            )
+          end
+
+          JSON.parse(raw.body)
+        end
+
+        # The AAD/OAuth token endpoint returns a flat error shape
+        # ({ "error": "invalid_client", "error_description": "..." }); tolerate
+        # an ARM-style nested error too, and fall back gracefully when the body
+        # is missing or not JSON.
+        def token_error_message(raw)
+          base = "Failed to acquire an Azure access token (HTTP #{raw.code})."
+          parsed = parse_json(raw.body)
+          return base unless parsed.is_a?(Hash)
+
+          detail =
+            if parsed["error"].is_a?(Hash)
+              parsed["error"]["message"]
+            else
+              parsed["error_description"] || parsed["error"]
+            end
+
+          detail ? "#{base} #{detail}" : base
+        end
+
+        def parse_json(body)
+          JSON.parse(body.to_s)
+        rescue JSON::ParserError
+          nil
+        end
+      end
+    end
+  end
+end