@aifabrix/builder 2.59.0 → 2.60.0

package/templates/marketplace/main.json

@@ -5,7 +5,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.47.16.16243",
-      "templateHash": "15679444522742934591"
+      "templateHash": "6752412774681258733"
     }
   },
   "parameters": {
@@ -26,12 +26,7 @@
     "capacityProfile": {
       "type": "string",
       "defaultValue": "s",
-      "allowedValues": [
-        "s",
-        "m",
-        "l",
-        "xl"
-      ],
+      "allowedValues": ["s", "m", "l", "xl"],
       "metadata": {
         "description": "Baseline capacity of the Miso/Keycloak foundation: s (B3), m (P2v3), l (P3v3), xl (P3mv3). One compute instance for every profile. Select the purchased capacity independently of licenseEdition; this does not provision workload environment topology."
       }
@@ -95,11 +90,7 @@
     "deploymentEnvironment": {
       "type": "string",
       "defaultValue": "evaluation",
-      "allowedValues": [
-        "prod",
-        "nonprod",
-        "evaluation"
-      ],
+      "allowedValues": ["prod", "nonprod", "evaluation"],
       "metadata": {
         "description": "Deployment environment used for app runtime defaults. MP UI hardcodes evaluation for now."
       }
@@ -181,20 +172,6 @@
         "description": "Expected `iss` claim on a Mori licence."
       }
     },
-    "moriCallbackApiKey": {
-      "type": "securestring",
-      "defaultValue": "",
-      "metadata": {
-        "description": "Optional shared secret for Mori → controller callback. Configure through the Miso installation/application contract."
-      }
-    },
-    "entraCallbackStateSecret": {
-      "type": "securestring",
-      "defaultValue": "",
-      "metadata": {
-        "description": "Optional shared HMAC secret for Entra consent OAuth state. Configure through the Miso installation contract."
-      }
-    },
     "entraIdClientId": {
       "type": "string",
       "defaultValue": "481251f2-a318-47ba-9ad8-40c36f790df1",
@@ -240,10 +217,7 @@
     "onboardingMode": {
       "type": "string",
       "defaultValue": "customerOwned",
-      "allowedValues": [
-        "customerOwned",
-        "saasDirect"
-      ],
+      "allowedValues": ["customerOwned", "saasDirect"],
       "metadata": {
         "description": "Tenant onboarding mode for Miso (ONBOARDING_MODE). customerOwned = portal/Marketplace wizard; saasDirect = Builder SaaS installation. Not exposed in createUiDefinition."
       }
@@ -439,9 +413,7 @@
               "tags": "[parameters('tags')]",
               "properties": {
                 "addressSpace": {
-                  "addressPrefixes": [
-                    "[parameters('vnetAddressSpace')]"
-                  ]
+                  "addressPrefixes": ["[parameters('vnetAddressSpace')]"]
                 },
                 "subnets": [
                   {
@@ -793,9 +765,7 @@
             "value": "[reference(resourceId('Microsoft.Resources/deployments', 'network'), '2025-04-01').outputs.keyVaultPrivateDnsZoneId.value]"
           },
           "allowedIPs": {
-            "value": [
-              "*"
-            ]
+            "value": ["*"]
           },
           "currentUserObjectId": {
             "value": ""
@@ -875,10 +845,7 @@
             "sku": {
               "type": "string",
               "defaultValue": "standard",
-              "allowedValues": [
-                "standard",
-                "premium"
-              ],
+              "allowedValues": ["standard", "premium"],
               "metadata": {
                 "description": "Key Vault SKU (standard or premium)"
               }
@@ -900,11 +867,7 @@
                   "tenantId": "[subscription().tenantId]",
                   "objectId": "[parameters('deploymentIdentityObjectIds')[copyIndex('deploymentIdentityPolicies')]]",
                   "permissions": {
-                    "secrets": [
-                      "get",
-                      "list",
-                      "set"
-                    ],
+                    "secrets": ["get", "list", "set"],
                     "keys": [],
                     "certificates": [],
                     "storage": []
@@ -959,9 +922,7 @@
               "properties": {
                 "accessPolicies": "[variables('currentUserPolicy')]"
               },
-              "dependsOn": [
-                "[resourceId('Microsoft.KeyVault/vaults', parameters('name'))]"
-              ]
+              "dependsOn": ["[resourceId('Microsoft.KeyVault/vaults', parameters('name'))]"]
             },
             {
               "condition": "[and(not(empty(variables('deploymentIdentityPolicies'))), not(variables('shouldGrantCurrentUserPolicy')))]",
@@ -971,9 +932,7 @@
               "properties": {
                 "accessPolicies": "[variables('deploymentIdentityPolicies')]"
               },
-              "dependsOn": [
-                "[resourceId('Microsoft.KeyVault/vaults', parameters('name'))]"
-              ]
+              "dependsOn": ["[resourceId('Microsoft.KeyVault/vaults', parameters('name'))]"]
             },
             {
               "condition": "[and(variables('shouldGrantCurrentUserPolicy'), not(empty(variables('deploymentIdentityPolicies'))))]",
@@ -983,9 +942,7 @@
               "properties": {
                 "accessPolicies": "[concat(variables('currentUserPolicy'), variables('deploymentIdentityPolicies'))]"
               },
-              "dependsOn": [
-                "[resourceId('Microsoft.KeyVault/vaults', parameters('name'))]"
-              ]
+              "dependsOn": ["[resourceId('Microsoft.KeyVault/vaults', parameters('name'))]"]
             },
             {
               "type": "Microsoft.Network/privateEndpoints",
@@ -1003,16 +960,12 @@
                     "name": "kv-pls",
                     "properties": {
                       "privateLinkServiceId": "[resourceId('Microsoft.KeyVault/vaults', parameters('name'))]",
-                      "groupIds": [
-                        "vault"
-                      ]
+                      "groupIds": ["vault"]
                     }
                   }
                 ]
               },
-              "dependsOn": [
-                "[resourceId('Microsoft.KeyVault/vaults', parameters('name'))]"
-              ]
+              "dependsOn": ["[resourceId('Microsoft.KeyVault/vaults', parameters('name'))]"]
             },
             {
               "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
@@ -1178,9 +1131,7 @@
           }
         }
       },
-      "dependsOn": [
-        "[resourceId('Microsoft.Resources/deployments', 'keyVault')]"
-      ]
+      "dependsOn": ["[resourceId('Microsoft.Resources/deployments', 'keyVault')]"]
     },
     {
       "type": "Microsoft.Resources/deployments",
@@ -1244,12 +1195,7 @@
             "sku": {
               "type": "string",
               "defaultValue": "Standard_LRS",
-              "allowedValues": [
-                "Standard_LRS",
-                "Standard_GRS",
-                "Standard_RAGRS",
-                "Premium_LRS"
-              ],
+              "allowedValues": ["Standard_LRS", "Standard_GRS", "Standard_RAGRS", "Premium_LRS"],
               "metadata": {
                 "description": "Storage account SKU (e.g., Standard_LRS, Standard_GRS, Premium_LRS)"
               }
@@ -1353,9 +1299,7 @@
               "apiVersion": "2024-01-01",
               "name": "[format('{0}/{1}', parameters('name'), 'default')]",
               "properties": {},
-              "dependsOn": [
-                "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"
-              ]
+              "dependsOn": ["[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"]
             },
             {
               "type": "Microsoft.Storage/storageAccounts/blobServices/containers",
@@ -1373,9 +1317,7 @@
               "type": "Microsoft.Storage/storageAccounts/fileServices",
               "apiVersion": "2021-04-01",
               "name": "[format('{0}/{1}', parameters('name'), 'default')]",
-              "dependsOn": [
-                "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"
-              ]
+              "dependsOn": ["[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"]
             },
             {
               "type": "Microsoft.Storage/storageAccounts/fileServices/shares",
@@ -1404,16 +1346,12 @@
                     "name": "blob-pls",
                     "properties": {
                       "privateLinkServiceId": "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]",
-                      "groupIds": [
-                        "blob"
-                      ]
+                      "groupIds": ["blob"]
                     }
                   }
                 ]
               },
-              "dependsOn": [
-                "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"
-              ]
+              "dependsOn": ["[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"]
             },
             {
               "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
@@ -1449,16 +1387,12 @@
                     "name": "file-pls",
                     "properties": {
                       "privateLinkServiceId": "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]",
-                      "groupIds": [
-                        "file"
-                      ]
+                      "groupIds": ["file"]
                     }
                   }
                 ]
               },
-              "dependsOn": [
-                "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"
-              ]
+              "dependsOn": ["[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"]
             },
             {
               "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
@@ -1485,9 +1419,7 @@
               "properties": {
                 "value": "[listKeys(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '2024-01-01').keys[0].value]"
               },
-              "dependsOn": [
-                "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"
-              ]
+              "dependsOn": ["[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"]
             }
           ],
           "outputs": {
@@ -1579,15 +1511,7 @@
             },
             "skuDisplay": {
               "type": "string",
-              "allowedValues": [
-                "B1",
-                "B2",
-                "B3",
-                "P1v3",
-                "P2v3",
-                "P3v3",
-                "P3mv3"
-              ],
+              "allowedValues": ["B1", "B2", "B3", "P1v3", "P2v3", "P3v3", "P3mv3"],
               "metadata": {
                 "description": "Select a Linux-compatible App Service Plan SKU with details"
               }
@@ -1829,9 +1753,7 @@
           }
         }
       },
-      "dependsOn": [
-        "[resourceId('Microsoft.Resources/deployments', 'keyVault')]"
-      ]
+      "dependsOn": ["[resourceId('Microsoft.Resources/deployments', 'keyVault')]"]
     },
     {
       "type": "Microsoft.Resources/deployments",
@@ -1955,11 +1877,7 @@
             "skuTier": {
               "type": "string",
               "defaultValue": "Burstable",
-              "allowedValues": [
-                "Burstable",
-                "GeneralPurpose",
-                "MemoryOptimized"
-              ],
+              "allowedValues": ["Burstable", "GeneralPurpose", "MemoryOptimized"],
               "metadata": {
                 "description": "SKU tier for PostgreSQL Flexible Server"
               }
@@ -2526,9 +2444,7 @@
                   "enabled": true
                 }
               },
-              "dependsOn": [
-                "[resourceId('Microsoft.Web/sites', parameters('name'))]"
-              ]
+              "dependsOn": ["[resourceId('Microsoft.Web/sites', parameters('name'))]"]
             }
           ],
           "outputs": {
@@ -2602,9 +2518,6 @@
           "encryptionKey": {
             "value": "[reference(resourceId('Microsoft.Resources/deployments', 'bootstrapSecrets'), '2025-04-01').outputs.encryptionKey.value]"
           },
-          "entraCallbackStateSecret": {
-            "value": "[parameters('entraCallbackStateSecret')]"
-          },
           "entraIdClientSecret": {
             "value": "[parameters('entraIdClientSecret')]"
           },
@@ -2613,9 +2526,6 @@
           },
           "moriBaseUrl": {
             "value": "[parameters('moriBaseUrl')]"
-          },
-          "moriCallbackApiKey": {
-            "value": "[parameters('moriCallbackApiKey')]"
           }
         },
         "template": {
@@ -2625,7 +2535,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.47.16.16243",
-              "templateHash": "9634353332764264230"
+              "templateHash": "445562478593270876"
             }
           },
           "parameters": {
@@ -2694,13 +2604,6 @@
                 "description": "MISO Client Secret (auto-generated if not provided)"
               }
             },
-            "entraCallbackStateSecret": {
-              "type": "securestring",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Shared HMAC secret for Entra consent OAuth state (ENTRA_CALLBACK_STATE_SECRET). Generated when empty."
-              }
-            },
             "entraIdClientSecret": {
               "type": "securestring",
               "defaultValue": "",
@@ -2721,17 +2624,9 @@
               "metadata": {
                 "description": "Mori base URL, stored so App Service can reference it instead of holding a literal."
               }
-            },
-            "moriCallbackApiKey": {
-              "type": "securestring",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Mori callback API key, shared by the Miso Controller and Mori."
-              }
             }
           },
           "variables": {
-            "resolvedEntraCallbackStateSecret": "[if(not(empty(parameters('entraCallbackStateSecret'))), parameters('entraCallbackStateSecret'), format('ecs_{0}{1}', uniqueString(resourceGroup().id, parameters('prefix'), 'entra-callback-state-v1'), uniqueString(parameters('prefix'), 'entra-cb-b')))]",
             "resolvedEntraIdClientSecret": "[if(not(empty(parameters('entraIdClientSecret'))), parameters('entraIdClientSecret'), format('PLACEHOLDER_ENTRA_CLIENT_SECRET_MUST_BE_REPLACED_{0}', uniqueString(resourceGroup().id, parameters('prefix'))))]",
             "misoWebAppOrigin": "[if(endsWith(parameters('misoWebAppUrl'), '/'), substring(parameters('misoWebAppUrl'), 0, max(0, sub(length(parameters('misoWebAppUrl')), 1))), parameters('misoWebAppUrl'))]",
             "misoVdirSegment": "[if(or(equals(parameters('misoVdirPublic'), ''), equals(parameters('misoVdirPublic'), '/')), '', if(startsWith(parameters('misoVdirPublic'), '/'), parameters('misoVdirPublic'), format('/{0}', parameters('misoVdirPublic'))))]",
@@ -2823,14 +2718,6 @@
                 "value": "[if(not(empty(parameters('misoClientSecret'))), parameters('misoClientSecret'), format('PLACEHOLDER_CLIENT_SECRET_MUST_BE_REPLACED_{0}', uniqueString(resourceGroup().id, parameters('prefix'))))]"
               }
             },
-            {
-              "type": "Microsoft.KeyVault/vaults/secrets",
-              "apiVersion": "2023-07-01",
-              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'entra-callback-state-secret')]",
-              "properties": {
-                "value": "[variables('resolvedEntraCallbackStateSecret')]"
-              }
-            },
             {
               "type": "Microsoft.KeyVault/vaults/secrets",
               "apiVersion": "2023-07-01",
@@ -2856,15 +2743,6 @@
               "properties": {
                 "value": "[parameters('moriBaseUrl')]"
               }
-            },
-            {
-              "condition": "[not(empty(parameters('moriCallbackApiKey')))]",
-              "type": "Microsoft.KeyVault/vaults/secrets",
-              "apiVersion": "2023-07-01",
-              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'mori-callback-api-keyKeyVault')]",
-              "properties": {
-                "value": "[parameters('moriCallbackApiKey')]"
-              }
             }
           ]
         }
@@ -2972,9 +2850,6 @@
           "moriLicenseIssuer": {
             "value": "[parameters('moriLicenseIssuer')]"
           },
-          "moriCallbackApiKey": {
-            "value": "[parameters('moriCallbackApiKey')]"
-          },
           "entraIdClientId": {
             "value": "[parameters('entraIdClientId')]"
           },
@@ -2987,6 +2862,9 @@
           "onboardingMode": {
             "value": "[parameters('onboardingMode')]"
           },
+          "capacityProfile": {
+            "value": "[parameters('capacityProfile')]"
+          },
           "resourceGroupName": {
             "value": "[resourceGroup().name]"
           },
@@ -3001,7 +2879,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.47.16.16243",
-              "templateHash": "2563187238594401937"
+              "templateHash": "13342696621269025420"
             }
           },
           "parameters": {
@@ -3178,11 +3056,7 @@
             "deploymentEnvironment": {
               "type": "string",
               "defaultValue": "nonprod",
-              "allowedValues": [
-                "prod",
-                "nonprod",
-                "evaluation"
-              ],
+              "allowedValues": ["prod", "nonprod", "evaluation"],
               "metadata": {
                 "description": "Deployment environment. Use prod for production; non-prod disables API rate limiting by default"
               }
@@ -3201,13 +3075,6 @@
                 "description": "Mori base URL (no trailing slash); used for tenant activation / handoff"
               }
             },
-            "moriCallbackApiKey": {
-              "type": "securestring",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Optional shared secret for Mori → controller callback, supplied through the Miso installation/application contract."
-              }
-            },
             "moriLicensePublicKey": {
               "type": "string",
               "defaultValue": "",
@@ -3226,7 +3093,7 @@
               "type": "string",
               "defaultValue": "481251f2-a318-47ba-9ad8-40c36f790df1",
               "metadata": {
-                "description": "Vendor multi-tenant Entra app client ID."
+                "description": "Vendor multi-tenant Entra app client ID. No longer emitted as an app setting — Miso does not hold provider credentials; Mori does. Retained so the marketplace parameter surface is unchanged."
               }
             },
             "entraIdTenantId": {
@@ -3246,14 +3113,18 @@
             "onboardingMode": {
               "type": "string",
               "defaultValue": "customerOwned",
-              "allowedValues": [
-                "customerOwned",
-                "saasDirect"
-              ],
+              "allowedValues": ["customerOwned", "saasDirect"],
               "metadata": {
                 "description": "Tenant onboarding mode (ONBOARDING_MODE)."
               }
             },
+            "capacityProfile": {
+              "type": "string",
+              "defaultValue": "s",
+              "metadata": {
+                "description": "Capacity the installation was provisioned at (s/m/l/xl). Emitted as INSTALLATION_CAPACITY_PROFILE so the controller sizes the platform environment from the installation rather than guessing; without it the controller assumed m and rewrote an S App Service Plan to P2v3."
+              }
+            },
             "resourceGroupName": {
               "type": "string",
               "defaultValue": "[resourceGroup().name]",
@@ -3335,7 +3206,7 @@
                   "acrUseManagedIdentityCreds": "[not(parameters('registryPasswordConfigured'))]",
                   "healthCheckPath": "/health",
                   "alwaysOn": true,
-                  "appSettings": "[concat(createArray(createObject('name', 'WEBSITES_ENABLE_APP_SERVICE_STORAGE', 'value', 'false'), createObject('name', 'WEBSITES_CONTAINER_START_TIME_LIMIT', 'value', '1800'), createObject('name', 'DATABASE_URL', 'value', variables('databaseUrlAppSettingValue')), createObject('name', 'JWT_SECRET', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-secrets-jwtKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'NODE_ENV', 'value', 'production'), createObject('name', 'LOCATION', 'value', parameters('location')), createObject('name', 'PORT', 'value', '3000'), createObject('name', 'ALLOWED_ORIGINS', 'value', format('http://localhost:*,http://127.0.0.1:*,https://{0}.azurewebsites.net', parameters('name'))), createObject('name', 'WEBSITE_VNET_ROUTE_ALL', 'value', if(parameters('enablePostgresPublicAccess'), '0', '1')), createObject('name', 'WEBSITE_DNS_SERVER', 'value', '168.63.129.16'), createObject('name', 'DATABASELOG_URL', 'value', variables('databaseLogUrlAppSettingValue')), createObject('name', 'KEY_VAULT_ENABLED', 'value', 'true'), createObject('name', 'SECURITY_STORAGE_MODE', 'value', 'keyvault'), createObject('name', 'KEY_VAULT_URL', 'value', format('https://{0}.vault.azure.net/', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'ENCRYPTION_KEY', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-encryption-keyKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'AUTO_CREATE_TABLES', 'value', if(parameters('autoCreateTables'), 'true', 'false')), createObject('name', 'KEYCLOAK_REALM', 'value', parameters('keycloakRealm')), createObject('name', 'KEYCLOAK_CLIENT_ID', 'value', parameters('keycloakClientId')), createObject('name', 'KEYCLOAK_ADMIN_USERNAME', 'value', parameters('keycloakAdminUsername')), createObject('name', 'KEYCLOAK_ADMIN_PASSWORD', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-keycloak-admin-password)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'ONBOARDING_ADMIN_PASSWORD', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-onboarding-admin-password)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'KEYCLOAK_SERVER_URL', 'value', variables('keycloakPublicUrl')), createObject('name', 'KEYCLOAK_INTERNAL_SERVER_URL', 'value', variables('keycloakInternalUrl')), createObject('name', 'KEYCLOAK_TOKEN_TIMEOUT', 'value', '5000'), createObject('name', 'KEYCLOAK_VERIFY_AUDIENCE', 'value', if(parameters('keycloakVerifyAudience'), 'true', 'false')), createObject('name', 'DISABLE_RATE_LIMIT', 'value', variables('shouldDisableRateLimit')), createObject('name', 'SKIP_DB_REDEPLOY', 'value', 'true'), createObject('name', 'MISO_WEB_SERVER_URL', 'value', variables('misoPublicUrl')), createObject('name', 'MISO_CONTROLLER_URL', 'value', variables('misoInternalUrl')), createObject('name', 'MISO_RELATIVE_PATH', 'value', variables('misoVdirValue')), createObject('name', 'CONTROLLER_BASE_URL', 'value', if(not(empty(parameters('misoControllerUrl'))), parameters('misoControllerUrl'), format('https://{0}.azurewebsites.net', parameters('name')))), createObject('name', 'AZURE_SUBSCRIPTION_ID', 'value', subscription().subscriptionId), createObject('name', 'TENANT_ID', 'value', subscription().tenantId), createObject('name', 'AZURE_RESOURCE_GROUP_NAME', 'value', parameters('resourceGroupName')), createObject('name', 'INFRASTRUCTURE_NAME', 'value', parameters('prefix')), createObject('name', 'ENTRA_ID_CLIENT_ID', 'value', parameters('entraIdClientId')), createObject('name', 'ENTRA_ID_CLIENT_SECRET', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=entra-client-secretKeyVault)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'ENTRA_ID_TENANT_ID', 'value', parameters('entraIdTenantId')), createObject('name', 'MISO_CLIENTID', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-miso-clientIdKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'MISO_CLIENTSECRET', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=miso-controller-client-secretKeyVault)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'MORI_BASE_URL', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=mori-base-urlKeyVault)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'MORI_LICENSE_PUBLIC_KEY', 'value', if(empty(parameters('moriLicensePublicKey')), '', format('@Microsoft.KeyVault(VaultName={0};SecretName=mori-license-public-keyKeyVault)', last(split(parameters('keyVaultId'), '/'))))), createObject('name', 'MORI_LICENSE_ISSUER', 'value', parameters('moriLicenseIssuer')), createObject('name', 'MORI_CALLBACK_API_KEY', 'value', if(empty(parameters('moriCallbackApiKey')), '', format('@Microsoft.KeyVault(VaultName={0};SecretName=mori-callback-api-keyKeyVault)', last(split(parameters('keyVaultId'), '/'))))), createObject('name', 'ENTRA_GRAPH_DELEGATED_REDIRECT_URI', 'value', variables('moriEntraGraphDelegatedRedirectUri')), createObject('name', 'ENTRA_ID_CENTRAL_CALLBACK_URI', 'value', variables('moriEntraCentralCallbackUri')), createObject('name', 'ENTRA_CALLBACK_STATE_SECRET', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=entra-callback-state-secret)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'DOCKER_ENABLE_CI', 'value', 'true'), createObject('name', 'DOCKER_REGISTRY_SERVER_URL', 'value', if(not(empty(parameters('acrLoginServer'))), format('https://{0}', parameters('acrLoginServer')), '')), createObject('name', 'ONBOARDING_CREATE_PIPELINE_CREDENTIALS', 'value', 'true'), createObject('name', 'BOOTSTRAP_APPKEYS', 'value', parameters('bootstrapAppKeys')), createObject('name', 'LICENSE_JWT', 'value', parameters('licenseJwt')), createObject('name', 'LICENSE_EDITION', 'value', parameters('licenseEdition')), createObject('name', 'ONBOARDING_MODE', 'value', parameters('onboardingMode'))), variables('registryCredentialAppSettings'))]",
+                  "appSettings": "[concat(createArray(createObject('name', 'WEBSITES_ENABLE_APP_SERVICE_STORAGE', 'value', 'false'), createObject('name', 'WEBSITES_CONTAINER_START_TIME_LIMIT', 'value', '1800'), createObject('name', 'DATABASE_URL', 'value', variables('databaseUrlAppSettingValue')), createObject('name', 'JWT_SECRET', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-secrets-jwtKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'NODE_ENV', 'value', 'production'), createObject('name', 'LOCATION', 'value', parameters('location')), createObject('name', 'PORT', 'value', '3000'), createObject('name', 'ALLOWED_ORIGINS', 'value', format('http://localhost:*,http://127.0.0.1:*,https://{0}.azurewebsites.net', parameters('name'))), createObject('name', 'WEBSITE_VNET_ROUTE_ALL', 'value', if(parameters('enablePostgresPublicAccess'), '0', '1')), createObject('name', 'WEBSITE_DNS_SERVER', 'value', '168.63.129.16'), createObject('name', 'DATABASELOG_URL', 'value', variables('databaseLogUrlAppSettingValue')), createObject('name', 'KEY_VAULT_ENABLED', 'value', 'true'), createObject('name', 'SECURITY_STORAGE_MODE', 'value', 'keyvault'), createObject('name', 'KEY_VAULT_URL', 'value', format('https://{0}.vault.azure.net/', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'ENCRYPTION_KEY', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-encryption-keyKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'AUTO_CREATE_TABLES', 'value', if(parameters('autoCreateTables'), 'true', 'false')), createObject('name', 'KEYCLOAK_REALM', 'value', parameters('keycloakRealm')), createObject('name', 'KEYCLOAK_CLIENT_ID', 'value', parameters('keycloakClientId')), createObject('name', 'KEYCLOAK_ADMIN_USERNAME', 'value', parameters('keycloakAdminUsername')), createObject('name', 'KEYCLOAK_ADMIN_PASSWORD', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-keycloak-admin-password)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'ONBOARDING_ADMIN_PASSWORD', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-onboarding-admin-password)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'KEYCLOAK_SERVER_URL', 'value', variables('keycloakPublicUrl')), createObject('name', 'KEYCLOAK_INTERNAL_SERVER_URL', 'value', variables('keycloakInternalUrl')), createObject('name', 'KEYCLOAK_TOKEN_TIMEOUT', 'value', '5000'), createObject('name', 'KEYCLOAK_VERIFY_AUDIENCE', 'value', if(parameters('keycloakVerifyAudience'), 'true', 'false')), createObject('name', 'DISABLE_RATE_LIMIT', 'value', variables('shouldDisableRateLimit')), createObject('name', 'SKIP_DB_REDEPLOY', 'value', 'true'), createObject('name', 'MISO_WEB_SERVER_URL', 'value', variables('misoPublicUrl')), createObject('name', 'MISO_CONTROLLER_URL', 'value', variables('misoInternalUrl')), createObject('name', 'MISO_RELATIVE_PATH', 'value', variables('misoVdirValue')), createObject('name', 'CONTROLLER_BASE_URL', 'value', if(not(empty(parameters('misoControllerUrl'))), parameters('misoControllerUrl'), format('https://{0}.azurewebsites.net', parameters('name')))), createObject('name', 'AZURE_SUBSCRIPTION_ID', 'value', subscription().subscriptionId), createObject('name', 'TENANT_ID', 'value', subscription().tenantId), createObject('name', 'DEPLOYMENT', 'value', 'azure'), createObject('name', 'AZURE_RESOURCE_GROUP_NAME', 'value', parameters('resourceGroupName')), createObject('name', 'INFRASTRUCTURE_NAME', 'value', parameters('prefix')), createObject('name', 'ENTRA_ID_TENANT_ID', 'value', parameters('entraIdTenantId')), createObject('name', 'MISO_CLIENTID', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-miso-clientIdKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'MISO_CLIENTSECRET', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=miso-controller-client-secretKeyVault)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'MORI_BASE_URL', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=mori-base-urlKeyVault)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'MORI_LICENSE_PUBLIC_KEY', 'value', if(empty(parameters('moriLicensePublicKey')), '', format('@Microsoft.KeyVault(VaultName={0};SecretName=mori-license-public-keyKeyVault)', last(split(parameters('keyVaultId'), '/'))))), createObject('name', 'MORI_LICENSE_ISSUER', 'value', parameters('moriLicenseIssuer')), createObject('name', 'ENTRA_GRAPH_DELEGATED_REDIRECT_URI', 'value', variables('moriEntraGraphDelegatedRedirectUri')), createObject('name', 'ENTRA_ID_CENTRAL_CALLBACK_URI', 'value', variables('moriEntraCentralCallbackUri')), createObject('name', 'DOCKER_ENABLE_CI', 'value', 'true'), createObject('name', 'DOCKER_REGISTRY_SERVER_URL', 'value', if(not(empty(parameters('acrLoginServer'))), format('https://{0}', parameters('acrLoginServer')), '')), createObject('name', 'ONBOARDING_CREATE_PIPELINE_CREDENTIALS', 'value', 'true'), createObject('name', 'BOOTSTRAP_APPKEYS', 'value', parameters('bootstrapAppKeys')), createObject('name', 'LICENSE_JWT', 'value', parameters('licenseJwt')), createObject('name', 'LICENSE_EDITION', 'value', parameters('licenseEdition')), createObject('name', 'ONBOARDING_MODE', 'value', parameters('onboardingMode')), createObject('name', 'INSTALLATION_CAPACITY_PROFILE', 'value', parameters('capacityProfile'))), variables('registryCredentialAppSettings'))]",
                   "vnetRouteAllEnabled": "[not(parameters('enablePostgresPublicAccess'))]"
                 },
                 "vnetRouteAllEnabled": "[not(parameters('enablePostgresPublicAccess'))]"
@@ -3365,9 +3236,7 @@
                   "enabled": true
                 }
               },
-              "dependsOn": [
-                "[resourceId('Microsoft.Web/sites', parameters('name'))]"
-              ]
+              "dependsOn": ["[resourceId('Microsoft.Web/sites', parameters('name'))]"]
             },
             {
               "type": "Microsoft.Web/sites/config",
@@ -3382,9 +3251,7 @@
                   "mountPath": "/data"
                 }
               },
-              "dependsOn": [
-                "[resourceId('Microsoft.Web/sites', parameters('name'))]"
-              ]
+              "dependsOn": ["[resourceId('Microsoft.Web/sites', parameters('name'))]"]
             }
           ],
           "outputs": {
@@ -3445,7 +3312,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.47.16.16243",
-              "templateHash": "1560535279661158869"
+              "templateHash": "7505559434659026911"
             }
           },
           "parameters": {
@@ -3463,8 +3330,28 @@
               "metadata": {
                 "description": "Object IDs (principalId) of web apps that use Key Vault references"
               }
+            },
+            "grantWorkloadVaultAccess": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Grant workload web apps direct Key Vault access. Default false: workloads fetch parameters through Miso. Set true only to restore the pre-227.6 behaviour for an installation that needs it."
+              }
+            },
+            "platformPrincipalIds": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "defaultValue": [],
+              "metadata": {
+                "description": "Object IDs of platform principals (Miso, Keycloak) that always retain vault access"
+              }
             }
           },
+          "variables": {
+            "effectivePrincipalIds": "[if(parameters('grantWorkloadVaultAccess'), union(parameters('webAppPrincipalIds'), parameters('platformPrincipalIds')), parameters('platformPrincipalIds'))]"
+          },
           "resources": {
             "kv": {
               "existing": true,
@@ -3480,16 +3367,12 @@
                 "copy": [
                   {
                     "name": "accessPolicies",
-                    "count": "[length(parameters('webAppPrincipalIds'))]",
+                    "count": "[length(variables('effectivePrincipalIds'))]",
                     "input": {
                       "tenantId": "[subscription().tenantId]",
-                      "objectId": "[parameters('webAppPrincipalIds')[copyIndex('accessPolicies')]]",
+                      "objectId": "[variables('effectivePrincipalIds')[copyIndex('accessPolicies')]]",
                       "permissions": {
-                        "secrets": [
-                          "get",
-                          "list",
-                          "set"
-                        ],
+                        "secrets": ["get", "list", "set"],
                         "keys": [],
                         "certificates": [],
                         "storage": []
@@ -3719,9 +3602,6 @@
           "encryptionKey": {
             "value": "[reference(resourceId('Microsoft.Resources/deployments', 'bootstrapSecrets'), '2025-04-01').outputs.encryptionKey.value]"
           },
-          "entraCallbackStateSecret": {
-            "value": "[parameters('entraCallbackStateSecret')]"
-          },
           "entraIdClientSecret": {
             "value": "[parameters('entraIdClientSecret')]"
           }
@@ -3733,7 +3613,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.47.16.16243",
-              "templateHash": "9634353332764264230"
+              "templateHash": "445562478593270876"
             }
           },
           "parameters": {
@@ -3802,13 +3682,6 @@
                 "description": "MISO Client Secret (auto-generated if not provided)"
               }
             },
-            "entraCallbackStateSecret": {
-              "type": "securestring",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Shared HMAC secret for Entra consent OAuth state (ENTRA_CALLBACK_STATE_SECRET). Generated when empty."
-              }
-            },
             "entraIdClientSecret": {
               "type": "securestring",
               "defaultValue": "",
@@ -3829,17 +3702,9 @@
               "metadata": {
                 "description": "Mori base URL, stored so App Service can reference it instead of holding a literal."
               }
-            },
-            "moriCallbackApiKey": {
-              "type": "securestring",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Mori callback API key, shared by the Miso Controller and Mori."
-              }
             }
           },
           "variables": {
-            "resolvedEntraCallbackStateSecret": "[if(not(empty(parameters('entraCallbackStateSecret'))), parameters('entraCallbackStateSecret'), format('ecs_{0}{1}', uniqueString(resourceGroup().id, parameters('prefix'), 'entra-callback-state-v1'), uniqueString(parameters('prefix'), 'entra-cb-b')))]",
             "resolvedEntraIdClientSecret": "[if(not(empty(parameters('entraIdClientSecret'))), parameters('entraIdClientSecret'), format('PLACEHOLDER_ENTRA_CLIENT_SECRET_MUST_BE_REPLACED_{0}', uniqueString(resourceGroup().id, parameters('prefix'))))]",
             "misoWebAppOrigin": "[if(endsWith(parameters('misoWebAppUrl'), '/'), substring(parameters('misoWebAppUrl'), 0, max(0, sub(length(parameters('misoWebAppUrl')), 1))), parameters('misoWebAppUrl'))]",
             "misoVdirSegment": "[if(or(equals(parameters('misoVdirPublic'), ''), equals(parameters('misoVdirPublic'), '/')), '', if(startsWith(parameters('misoVdirPublic'), '/'), parameters('misoVdirPublic'), format('/{0}', parameters('misoVdirPublic'))))]",
@@ -3931,14 +3796,6 @@
                 "value": "[if(not(empty(parameters('misoClientSecret'))), parameters('misoClientSecret'), format('PLACEHOLDER_CLIENT_SECRET_MUST_BE_REPLACED_{0}', uniqueString(resourceGroup().id, parameters('prefix'))))]"
               }
             },
-            {
-              "type": "Microsoft.KeyVault/vaults/secrets",
-              "apiVersion": "2023-07-01",
-              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'entra-callback-state-secret')]",
-              "properties": {
-                "value": "[variables('resolvedEntraCallbackStateSecret')]"
-              }
-            },
             {
               "type": "Microsoft.KeyVault/vaults/secrets",
               "apiVersion": "2023-07-01",
@@ -3964,15 +3821,6 @@
               "properties": {
                 "value": "[parameters('moriBaseUrl')]"
               }
-            },
-            {
-              "condition": "[not(empty(parameters('moriCallbackApiKey')))]",
-              "type": "Microsoft.KeyVault/vaults/secrets",
-              "apiVersion": "2023-07-01",
-              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'mori-callback-api-keyKeyVault')]",
-              "properties": {
-                "value": "[parameters('moriCallbackApiKey')]"
-              }
             }
           ]
         }
@@ -4442,4 +4290,4 @@
       "value": "[if(variables('createAzureOpenAI'), '', if(parameters('enableAzureOpenAI'), format('Azure OpenAI is not offered in {0}, and it is not relocated to another region automatically. The installation is complete without it: create the account in a supported region yourself, or supply an existing endpoint as an external provider.', variables('deploymentLocation')), 'Azure OpenAI creation was disabled for this installation (enableAzureOpenAI=false).'))]"
     }
   }
-}
+}