@aifabrix/builder 2.57.0 → 2.58.0

package/lib/utils/registry-credentials.js

@@ -0,0 +1,236 @@
+/**
+ * Host-scoped container registry credentials in the primary user secrets file.
+ *
+ * Keys are exactly `<registry>-username` and `<registry>-password` in the user's
+ * `secrets.local.yaml` (never the shared store). Values are encrypted through the existing
+ * local-secret writer and reach Docker only via `docker login --password-stdin`.
+ *
+ * @fileoverview Registry credential storage, lookup, removal, and per-command Docker login
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const fs = require('fs');
+const yaml = require('js-yaml');
+const config = require('../core/config');
+const pathsUtil = require('./paths');
+const { loadExistingSecrets, mergeSecretsIntoFile } = require('./secrets-generator');
+const { saveLocalSecret } = require('./local-secrets');
+const { decryptSecret, isEncrypted } = require('./secrets-encryption');
+const { normalizeRegistryHost } = require('./config-registry-preference');
+
+/** Hosts already authenticated during this CLI process. */
+const authenticatedHosts = new Set();
+
+/**
+ * @param {string} registry - Registry host
+ * @returns {{ host: string, usernameKey: string, passwordKey: string }}
+ */
+function registryCredentialKeys(registry) {
+  const host = normalizeRegistryHost(registry);
+  return { host, usernameKey: `${host}-username`, passwordKey: `${host}-password` };
+}
+
+function hasValue(value) {
+  return typeof value === 'string' ? value.trim() !== '' : value !== undefined && value !== null;
+}
+
+function readRawPair(keys) {
+  const file = pathsUtil.getPrimaryUserSecretsLocalPath();
+  const raw = loadExistingSecrets(file);
+  return { file, username: raw[keys.usernameKey], password: raw[keys.passwordKey] };
+}
+
+function partialPairError(keys) {
+  return new Error(
+    `Registry credentials for ${keys.host} are incomplete: both ${keys.usernameKey} and ${keys.passwordKey} ` +
+    `must be set. Run "aifabrix dev set-registry ${keys.host} --username <username> --password-stdin" ` +
+    `or "aifabrix dev set-registry ${keys.host} --clear-credentials".`
+  );
+}
+
+/**
+ * Credential presence for a registry without decrypting anything.
+ * @param {string} registry - Registry host
+ * @returns {'complete'|'absent'|'partial'}
+ */
+function getRegistryCredentialStatus(registry) {
+  const keys = registryCredentialKeys(registry);
+  const pair = readRawPair(keys);
+  const count = [pair.username, pair.password].filter(hasValue).length;
+  if (count === 2) return 'complete';
+  return count === 0 ? 'absent' : 'partial';
+}
+
+async function decryptStoredValue(value, label) {
+  const text = String(value);
+  if (!isEncrypted(text)) return text;
+  const key = await config.getSecretsEncryptionKey();
+  if (!key) {
+    throw new Error(`Cannot decrypt the stored ${label}: the local secrets encryption key is not configured`);
+  }
+  return decryptSecret(text, key);
+}
+
+/**
+ * Loads a complete credential pair for the registry.
+ * @param {string} registry - Registry host
+ * @returns {Promise<{ username: string, password: string }|null>} null when no pair is stored
+ * @throws {Error} When only one of the two keys is stored
+ */
+async function loadRegistryCredentials(registry) {
+  const keys = registryCredentialKeys(registry);
+  const pair = readRawPair(keys);
+  const present = [pair.username, pair.password].filter(hasValue).length;
+  if (present === 0) return null;
+  if (present === 1) throw partialPairError(keys);
+  return {
+    username: await decryptStoredValue(pair.username, `${keys.host} username`),
+    password: await decryptStoredValue(pair.password, `${keys.host} password`)
+  };
+}
+
+function removeKeysFromFile(file, keyNames) {
+  if (!fs.existsSync(file)) return false;
+  const data = loadExistingSecrets(file);
+  const present = keyNames.filter((key) => Object.prototype.hasOwnProperty.call(data, key));
+  if (present.length === 0) return false;
+  for (const key of present) delete data[key];
+  const { assertWritableSecretsPathForTests } = require('./aifabrix-test-runtime-guard');
+  assertWritableSecretsPathForTests(file);
+  fs.writeFileSync(file, yaml.dump(data, { indent: 2, lineWidth: -1, noRefs: true, sortKeys: false }), { mode: 0o600 });
+  // `mode` applies only on creation; keep an existing file owner-only too.
+  fs.chmodSync(file, 0o600);
+  return true;
+}
+
+function restorePair(keys, snapshot) {
+  const restore = {};
+  const remove = [];
+  for (const [key, value] of [[keys.usernameKey, snapshot.username], [keys.passwordKey, snapshot.password]]) {
+    if (value === undefined) remove.push(key);
+    else restore[key] = value;
+  }
+  removeKeysFromFile(snapshot.file, remove);
+  mergeSecretsIntoFile(snapshot.file, restore);
+}
+
+/**
+ * Saves a complete pair. On any write failure the previous entries are restored.
+ * @param {string} registry - Registry host
+ * @param {string} username - Registry username
+ * @param {string} password - Registry password or token
+ * @returns {Promise<{ host: string, rollback: Function }>} rollback restores the prior entries
+ */
+async function saveRegistryCredentials(registry, username, password) {
+  const keys = registryCredentialKeys(registry);
+  if (!hasValue(username) || !hasValue(password)) {
+    throw new Error('Registry username and password must both be non-empty');
+  }
+  const snapshot = readRawPair(keys);
+  await config.ensureSecretsEncryptionKey();
+  try {
+    await saveLocalSecret(keys.usernameKey, String(username));
+    await saveLocalSecret(keys.passwordKey, String(password));
+  } catch (error) {
+    restorePair(keys, snapshot);
+    throw new Error(`Could not save registry credentials for ${keys.host}; previous values were restored (${error.message})`);
+  }
+  authenticatedHosts.delete(keys.host);
+  return { host: keys.host, rollback: () => restorePair(keys, snapshot) };
+}
+
+/**
+ * Removes both credential keys for the registry (idempotent).
+ * @param {string} registry - Registry host
+ * @returns {boolean} true when at least one key was removed
+ */
+function removeRegistryCredentials(registry) {
+  const keys = registryCredentialKeys(registry);
+  authenticatedHosts.delete(keys.host);
+  return removeKeysFromFile(pathsUtil.getPrimaryUserSecretsLocalPath(), [keys.usernameKey, keys.passwordKey]);
+}
+
+/**
+ * Authenticates Docker to the registry once per process: stored pair first, then the optional
+ * fallback (for example Azure CLI for ACR). The password is sent only on stdin.
+ * @param {string} registry - Registry host
+ * @param {Object} [options] - Options
+ * @param {Function} [options.fallback] - async (host) => void when no pair is stored
+ * @param {Function} [options.login] - async (host, username, password) => void (tests)
+ * @returns {Promise<'cached'|'credentials'|'fallback'|'none'>}
+ */
+async function ensureRegistryLogin(registry, options = {}) {
+  const host = normalizeRegistryHost(registry);
+  if (authenticatedHosts.has(host)) return 'cached';
+  const credentials = await loadRegistryCredentials(host);
+  if (credentials) {
+    const login = options.login || require('../deployment/push').authenticateExternalRegistry;
+    await login(host, credentials.username, credentials.password);
+    authenticatedHosts.add(host);
+    return 'credentials';
+  }
+  if (typeof options.fallback === 'function') {
+    await options.fallback(host);
+    authenticatedHosts.add(host);
+    return 'fallback';
+  }
+  return 'none';
+}
+
+/**
+ * Registry host of an image reference, or '' for Docker Hub style refs.
+ * @param {string} imageRef - Image reference (`host/repo:tag`, `repo:tag`, ...)
+ * @returns {string}
+ */
+function registryHostFromImageRef(imageRef) {
+  const ref = String(imageRef || '').trim();
+  const slash = ref.indexOf('/');
+  if (slash <= 0) return '';
+  const first = ref.slice(0, slash);
+  if (!(first.includes('.') || first.includes(':') || first === 'localhost')) return '';
+  try {
+    return normalizeRegistryHost(first);
+  } catch {
+    return '';
+  }
+}
+
+/**
+ * Logs in once per distinct registry host of the given image refs when a stored pair exists.
+ * Hosts without stored credentials are pulled anonymously (or with the user's own Docker login).
+ * @param {string[]} imageRefs - Image references
+ * @returns {Promise<string[]>} Hosts logged in with stored credentials
+ */
+async function ensureLoginForImageRefs(imageRefs) {
+  const hosts = [...new Set((imageRefs || []).map(registryHostFromImageRef).filter(Boolean))];
+  const used = [];
+  for (const host of hosts) {
+    const outcome = await ensureRegistryLogin(host);
+    if (outcome === 'credentials') used.push(host);
+  }
+  return used;
+}
+
+/**
+ * Forgets cached logins (used before re-authentication and in tests).
+ * @param {string} [registry] - Host to forget; all when omitted
+ */
+function resetRegistryLoginCache(registry) {
+  if (registry) authenticatedHosts.delete(normalizeRegistryHost(registry));
+  else authenticatedHosts.clear();
+}
+
+module.exports = {
+  registryCredentialKeys,
+  getRegistryCredentialStatus,
+  loadRegistryCredentials,
+  saveRegistryCredentials,
+  removeRegistryCredentials,
+  ensureRegistryLogin,
+  ensureLoginForImageRefs,
+  registryHostFromImageRef,
+  resetRegistryLoginCache
+};

package/lib/utils/resolve-docker-image-ref.js

@@ -1,6 +1,7 @@
 /**
  * Resolve Docker repository path and tag from application config and optional CLI overrides.
- * Precedence: --image (full ref), --registry CLI, image.registry in manifest, else unqualified name.
+ * Precedence: --image (full ref), --registry CLI, installation `registry` in config.yaml,
+ * image.registry in manifest, else unqualified name.
  *
  * For refs like localhost:5000/repo without an explicit tag, prefer --image with :tag (parse ambiguity).
  *
@@ -12,6 +13,7 @@
 'use strict';
 
 const { parseImageOverride } = require('./parse-image-ref');
+const { readInstallationRegistrySync } = require('./config-registry-preference');
 const DOCKER_REPOSITORY_RE = /^[a-z0-9][a-z0-9._/-]*$/i;
 const DOCKER_TAG_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
 
@@ -92,6 +94,73 @@ function normalizeDockerRegistryPrefix(registry) {
   return t.slice(0, end);
 }
 
+/**
+ * Remove a registry host prefix from a Docker repository path.
+ * The first segment is a host when it contains `.` or `:` or equals `localhost`.
+ * @param {string} repository
+ * @returns {string}
+ */
+function stripRegistryHostFromRepository(repository) {
+  if (!repository || typeof repository !== 'string') {
+    return repository;
+  }
+  const parts = repository.split('/');
+  if (parts.length <= 1) {
+    return repository;
+  }
+  const host = parts[0];
+  if (host.includes('.') || host.includes(':') || host === 'localhost') {
+    return parts.slice(1).join('/');
+  }
+  return repository;
+}
+
+/**
+ * Effective registry for an application image.
+ * Precedence: `options.registry` (CLI) > installation `registry` > manifest `image.registry`.
+ * @param {Object} [appConfig] - Application manifest
+ * @param {Object} [options] - `registry` (CLI) and optional `installationRegistry` (preloaded; '' = none)
+ * @returns {{ registry: string, source: 'cli'|'installation'|'manifest'|'none' }}
+ */
+function resolveEffectiveRegistry(appConfig, options = {}) {
+  const opts = options || {};
+  const cli = normalizeDockerRegistryPrefix(opts.registry);
+  if (cli) return { registry: cli, source: 'cli' };
+  const installation = opts.installationRegistry !== undefined
+    ? normalizeDockerRegistryPrefix(opts.installationRegistry)
+    : readInstallationRegistrySync();
+  if (installation) return { registry: installation, source: 'installation' };
+  const manifest = normalizeDockerRegistryPrefix(appConfig?.image?.registry ?? '');
+  if (manifest) return { registry: manifest, source: 'manifest' };
+  return { registry: '', source: 'none' };
+}
+
+/**
+ * Prefix a repository with a registry exactly once (replacing any existing host).
+ * @param {string} registry - Registry prefix ('' keeps the repository unchanged)
+ * @param {string} repository - Repository path, possibly already qualified
+ * @returns {string}
+ */
+function qualifyRepository(registry, repository) {
+  const prefix = normalizeDockerRegistryPrefix(registry);
+  if (!prefix) return repository;
+  return `${prefix}/${stripRegistryHostFromRepository(repository)}`;
+}
+
+/**
+ * Deployment/registration image reference (`registry/name:tag`) using the shared precedence.
+ * @param {Object} variables - Application manifest
+ * @param {string} fallbackName - Name when the manifest has no image name or app key
+ * @param {Object} [options] - Same options as {@link resolveEffectiveRegistry}
+ * @returns {string}
+ */
+function buildManifestImageReference(variables, fallbackName, options = {}) {
+  const imageName = variables?.image?.name || variables?.app?.key || fallbackName;
+  const tag = variables?.image?.tag || 'latest';
+  const { registry } = resolveEffectiveRegistry(variables, options);
+  return `${qualifyRepository(registry, imageName)}:${tag}`;
+}
+
 /**
  * Effective image repository (may include registry prefix) and tag for Docker.
  * @param {string} appName - Application name
@@ -118,13 +187,8 @@ function resolveDockerImageRef(appName, appConfig, runOptions = {}) {
 
   const baseRepo = assertSafeRepository(getRepositoryPathFromConfig(appConfig, appName));
   const imageTag = assertSafeTag(tagFromOpts || imageTagFromConfig(appConfig));
-  const prefix =
-    normalizeDockerRegistryPrefix(opts.registry) ||
-    normalizeDockerRegistryPrefix(appConfig?.image?.registry ?? '');
-  if (prefix) {
-    return { imageName: assertSafeRepository(`${prefix}/${baseRepo}`), imageTag };
-  }
-  return { imageName: baseRepo, imageTag };
+  const { registry } = resolveEffectiveRegistry(appConfig, opts);
+  return { imageName: assertSafeRepository(qualifyRepository(registry, baseRepo)), imageTag };
 }
 
 /**
@@ -137,7 +201,7 @@ function resolveDockerImageRef(appName, appConfig, runOptions = {}) {
 function resolveComposeImageOverrideString(appName, appConfig, options = {}) {
   if (options.image) return options.image;
   if (options.imageOverride) return options.imageOverride;
-  const runOpts = { registry: options.registry, image: undefined };
+  const runOpts = { registry: options.registry, installationRegistry: options.installationRegistry, image: undefined };
   if (options.tag) {
     const { imageName } = resolveDockerImageRef(appName, appConfig, runOpts);
     return `${imageName}:${options.tag}`;
@@ -154,6 +218,11 @@ function resolveComposeImageOverrideString(appName, appConfig, options = {}) {
 module.exports = {
   resolveDockerImageRef,
   resolveComposeImageOverrideString,
+  resolveEffectiveRegistry,
+  qualifyRepository,
+  buildManifestImageReference,
+  stripRegistryHostFromRepository,
+  assertSafeTag,
   normalizeDockerRegistryPrefix,
   getRepositoryPathFromConfig,
   imageTagFromConfig

package/lib/utils/secrets-helpers.js

@@ -29,7 +29,15 @@ const { collectUniqueKvPathStrings, isCommentOrEmptyLine, activeEnvLineForKvScan
  * @returns {string} Interpolated content
  */
 function interpolateEnvVars(content, envVars) {
-  return content.replace(/\$\{([A-Z_]+)\}/g, (match, envVar) => {
+  const hasOwn = (key) => Object.prototype.hasOwnProperty.call(envVars, key);
+  const interpolated = content.replace(
+    /\$\{DEV_USERNAME\}\.\$\{REMOTE_HOST\}/g,
+    (match) => {
+      if (!hasOwn('DEV_USERNAME') || !hasOwn('REMOTE_HOST')) return match;
+      return [envVars.DEV_USERNAME, envVars.REMOTE_HOST].filter(Boolean).join('.');
+    }
+  );
+  return interpolated.replace(/\$\{([A-Z_]+)\}/g, (match, envVar) => {
     return envVars[envVar] || match;
   });
 }

package/lib/utils/variable-transformer.js

@@ -126,10 +126,8 @@ function transformFlatStructure(variables, appName) {
  * @returns {string} Image reference string
  */
 function buildImageReference(variables, appName) {
-  const imageName = variables.image?.name || variables.app?.key || appName;
-  const registry = variables.image?.registry;
-  const tag = variables.image?.tag || 'latest';
-  return registry ? `${registry}/${imageName}:${tag}` : `${imageName}:${tag}`;
+  const { buildManifestImageReference } = require('./resolve-docker-image-ref');
+  return buildManifestImageReference(variables, appName);
 }
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aifabrix/builder",
-  "version": "2.57.0",
+  "version": "2.58.0",
   "description": "AI Fabrix Builder — CLI and developer scripts (pnpm + af)",
   "main": "lib/index.js",
   "bin": {
@@ -28,6 +28,7 @@
     "agent-skills:check": "node scripts/pnpm/agent-skills-sync.mjs --check",
     "agent-skills:sync:codex": "node scripts/pnpm/agent-skills-sync.mjs --codex-home",
     "agent-skills:test": "node --test scripts/pnpm/agent-skills-sync.test.mjs",
+    "dev-deploy:test": "node --test scripts/pnpm/dev-deploy.test.mjs",
     "check": "npm run lint && npm run test",
     "lint": "eslint . --ext .js",
     "lint:fix": "eslint . --ext .js --fix",

package/templates/marketplace/main.json

@@ -2379,7 +2379,7 @@
                 "virtualNetworkSubnetId": "[if(not(empty(parameters('vnetSubnetId'))), parameters('vnetSubnetId'), null())]",
                 "siteConfig": {
                   "linuxFxVersion": "[format('DOCKER|{0}', parameters('image'))]",
-                  "acrUseManagedIdentityCreds": true,
+                  "acrUseManagedIdentityCreds": "[not(variables('registryPasswordConfigured'))]",
                   "appCommandLine": "start --optimized=false",
                   "healthCheckPath": "[variables('keycloakHealthCheckPath')]",
                   "alwaysOn": true,
@@ -3083,7 +3083,7 @@
                 "virtualNetworkSubnetId": "[if(not(empty(parameters('vnetSubnetId'))), parameters('vnetSubnetId'), null())]",
                 "siteConfig": {
                   "linuxFxVersion": "[format('DOCKER|{0}', parameters('image'))]",
-                  "acrUseManagedIdentityCreds": true,
+                  "acrUseManagedIdentityCreds": "[not(parameters('registryPasswordConfigured'))]",
                   "healthCheckPath": "/health",
                   "alwaysOn": true,
                   "appSettings": "[concat(createArray(createObject('name', 'WEBSITES_ENABLE_APP_SERVICE_STORAGE', 'value', 'false'), createObject('name', 'WEBSITES_CONTAINER_START_TIME_LIMIT', 'value', '1800'), createObject('name', 'DATABASE_URL', 'value', variables('databaseUrlAppSettingValue')), createObject('name', 'JWT_SECRET', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-secrets-jwtKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'NODE_ENV', 'value', 'production'), createObject('name', 'LOCATION', 'value', parameters('location')), createObject('name', 'PORT', 'value', '3000'), createObject('name', 'CORS_ORIGINS', 'value', format('https://{0}.azurewebsites.net', parameters('name'))), createObject('name', 'ALLOWED_ORIGINS', 'value', format('http://localhost:*,http://127.0.0.1:*,https://{0}.azurewebsites.net', parameters('name'))), createObject('name', 'WEBSITE_VNET_ROUTE_ALL', 'value', if(parameters('enablePostgresPublicAccess'), '0', '1')), createObject('name', 'WEBSITE_DNS_SERVER', 'value', '168.63.129.16'), createObject('name', 'DATABASELOG_URL', 'value', variables('databaseLogUrlAppSettingValue')), createObject('name', 'KEY_VAULT_ENABLED', 'value', 'true'), createObject('name', 'SECURITY_STORAGE_MODE', 'value', 'keyvault'), createObject('name', 'KEY_VAULT_URL', 'value', format('https://{0}.vault.azure.net/', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'ENCRYPTION_KEY', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-encryption-keyKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'AUTO_CREATE_TABLES', 'value', if(parameters('autoCreateTables'), 'true', 'false')), createObject('name', 'KEYCLOAK_REALM', 'value', parameters('keycloakRealm')), createObject('name', 'KEYCLOAK_CLIENT_ID', 'value', parameters('keycloakClientId')), createObject('name', 'KEYCLOAK_ADMIN_USERNAME', 'value', parameters('keycloakAdminUsername')), createObject('name', 'KEYCLOAK_ADMIN_PASSWORD', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-keycloak-admin-password)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'ONBOARDING_ADMIN_PASSWORD', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-onboarding-admin-password)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'KEYCLOAK_SERVER_URL', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=keycloak-web-server-url)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'KEYCLOAK_INTERNAL_SERVER_URL', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=keycloak-internal-server-url)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'KEYCLOAK_TOKEN_TIMEOUT', 'value', '5000'), createObject('name', 'KEYCLOAK_VERIFY_AUDIENCE', 'value', if(parameters('keycloakVerifyAudience'), 'true', 'false')), createObject('name', 'DISABLE_RATE_LIMIT', 'value', variables('shouldDisableRateLimit')), createObject('name', 'SKIP_DB_REDEPLOY', 'value', 'true'), createObject('name', 'MISO_WEB_SERVER_URL', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=miso-controller-web-server-url)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'MISO_CONTROLLER_URL', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=miso-controller-internal-server-urlKeyVault)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'MISO_RELATIVE_PATH', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=miso-controller-vdir-public)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'CONTROLLER_BASE_URL', 'value', if(not(empty(parameters('misoControllerUrl'))), parameters('misoControllerUrl'), format('https://{0}.azurewebsites.net', parameters('name')))), createObject('name', 'AZURE_SUBSCRIPTION_ID', 'value', subscription().subscriptionId), createObject('name', 'TENANT_ID', 'value', subscription().tenantId), createObject('name', 'AZURE_RESOURCE_GROUP_NAME', 'value', parameters('resourceGroupName')), createObject('name', 'INFRASTRUCTURE_NAME', 'value', parameters('prefix')), createObject('name', 'ENTRA_ID_CLIENT_ID', 'value', parameters('entraIdClientId')), createObject('name', 'ENTRA_ID_CLIENT_SECRET', 'value', parameters('entraIdClientSecret')), createObject('name', 'ENTRA_ID_TENANT_ID', 'value', parameters('entraIdTenantId')), createObject('name', 'MISO_CLIENTID', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-miso-clientIdKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'MISO_CLIENTSECRET', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=miso-controller-client-secretKeyVault)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'MORI_BASE_URL', 'value', variables('moriBaseNormalized')), createObject('name', 'MORI_CALLBACK_API_KEY', 'value', parameters('moriCallbackApiKey')), createObject('name', 'ENTRA_GRAPH_DELEGATED_REDIRECT_URI', 'value', variables('moriEntraGraphDelegatedRedirectUri')), createObject('name', 'ENTRA_ID_CENTRAL_CALLBACK_URI', 'value', variables('moriEntraCentralCallbackUri')), createObject('name', 'ENTRA_CALLBACK_STATE_SECRET', 'value', parameters('entraCallbackStateSecret')), createObject('name', 'DOCKER_ENABLE_CI', 'value', 'true'), createObject('name', 'DOCKER_REGISTRY_SERVER_URL', 'value', if(not(empty(parameters('acrLoginServer'))), format('https://{0}', parameters('acrLoginServer')), '')), createObject('name', 'ONBOARDING_CREATE_PIPELINE_CREDENTIALS', 'value', 'true'), createObject('name', 'LICENSE_JWT', 'value', parameters('licenseJwt')), createObject('name', 'LICENSE_EDITION', 'value', parameters('licenseEdition')), createObject('name', 'ONBOARDING_MODE', 'value', parameters('onboardingMode'))), variables('registryCredentialAppSettings'))]",