@pagopa/dx-cli 0.18.7 → 0.18.9

package/dist/adapters/azure/__tests__/cloud-account-service.test.js

@@ -4,6 +4,12 @@ import { AzureCloudAccountService } from "../cloud-account-service.js";
 const { queryResources } = vi.hoisted(() => ({
     queryResources: vi.fn().mockRejectedValue(new Error("Not implemented")),
 }));
+const { mockProviderGet, mockProviderRegister } = vi.hoisted(() => ({
+    mockProviderGet: vi
+        .fn()
+        .mockResolvedValue({ registrationState: "Registered" }),
+    mockProviderRegister: vi.fn().mockResolvedValue({}),
+}));
 vi.mock("@azure/identity", () => ({
     DefaultAzureCredential: vi.fn(),
 }));
@@ -12,6 +18,14 @@ vi.mock("@azure/arm-resourcegraph", () => ({
         resources = queryResources;
     },
 }));
+vi.mock("@azure/arm-resources", () => ({
+    ResourceManagementClient: class {
+        providers = {
+            get: mockProviderGet,
+            register: mockProviderRegister,
+        };
+    },
+}));
 const test = baseTest.extend({
     // the empty pattern is required by vitest!!!
     // eslint-disable-next-line no-empty-pattern
@@ -94,11 +108,12 @@ describe("getTerraformBackend", () => {
     });
 });
 describe("isInitialized", () => {
-    test("returns true when both bootstrap identity and common Key Vault exist", async ({ cloudAccountService, }) => {
+    test("returns true when both bootstrap identity and common Key Vault exist and all providers are registered", async ({ cloudAccountService, }) => {
         // First call: identity query → found
         queryResources.mockResolvedValueOnce({ data: [], totalRecords: 1 });
         // Second call: key vault query → found
         queryResources.mockResolvedValueOnce({ data: [], totalRecords: 1 });
+        // Provider checks → all registered (default mock)
         const result = await cloudAccountService.isInitialized("sub-1", {
             name: "dev",
             prefix: "dx",
@@ -127,4 +142,18 @@ describe("isInitialized", () => {
         });
         expect(result).toBe(false);
     });
+    test("returns false when resources exist but a required provider is not registered", async ({ cloudAccountService, }) => {
+        // Both resources exist
+        queryResources.mockResolvedValueOnce({ data: [], totalRecords: 1 });
+        queryResources.mockResolvedValueOnce({ data: [], totalRecords: 1 });
+        // One provider is not registered
+        mockProviderGet.mockResolvedValueOnce({
+            registrationState: "NotRegistered",
+        });
+        const result = await cloudAccountService.isInitialized("sub-1", {
+            name: "dev",
+            prefix: "dx",
+        });
+        expect(result).toBe(false);
+    });
 });

package/dist/adapters/azure/cloud-account-service.js

@@ -33,6 +33,24 @@ const graphGroupMembershipResponseSchema = z.object({
 });
 export class AzureCloudAccountService {
     #credential;
+    #requiredResourceProviders = [
+        "Microsoft.Advisor",
+        "Microsoft.AlertsManagement",
+        "Microsoft.ApiManagement",
+        "Microsoft.App",
+        "Microsoft.Authorization",
+        "Microsoft.AzureTerraform",
+        "Microsoft.Cache",
+        "Microsoft.Cdn",
+        "Microsoft.ContainerInstance",
+        "Microsoft.CostManagement",
+        "Microsoft.DBforPostgreSQL",
+        "Microsoft.KeyVault",
+        "Microsoft.ServiceBus",
+        "Microsoft.Sql",
+        "Microsoft.Storage",
+        "Microsoft.Web",
+    ];
     #resourceGraphClient;
     constructor(credential) {
         this.#resourceGraphClient = new ResourceGraphClient(credential);
@@ -126,6 +144,8 @@ export class AzureCloudAccountService {
         assert.equal(cloudAccount.csp, "azure", "Cloud account must be Azure");
         assert.ok(isAzureLocation(cloudAccount.defaultLocation), "The default location of the cloud account is not a valid Azure location");
         const logger = getLogger(["gen", "env"]);
+        // Register required resource providers before creating any resources
+        await this.#registerProviders(cloudAccount.id);
         const resourceManagementClient = new ResourceManagementClient(this.#credential, cloudAccount.id);
         const short = {
             env: environmentShort[name],
@@ -210,7 +230,7 @@ export class AzureCloudAccountService {
              | where type == 'microsoft.keyvault/vaults'
              | where name matches regex @'${keyVaultResourceName}'
             `;
-        const [identityResult, keyVaultResult] = await Promise.all([
+        const [identityResult, keyVaultResult, areProvidersRegistered] = await Promise.all([
             this.#resourceGraphClient.resources({
                 query: identityQuery,
                 subscriptions: [cloudAccountId],
@@ -219,8 +239,11 @@ export class AzureCloudAccountService {
                 query: keyVaultQuery,
                 subscriptions: [cloudAccountId],
             }),
+            this.#areProvidersRegistered(cloudAccountId),
         ]);
-        const initialized = identityResult.totalRecords > 0 && keyVaultResult.totalRecords > 0;
+        const initialized = identityResult.totalRecords > 0 &&
+            keyVaultResult.totalRecords > 0 &&
+            areProvidersRegistered;
         const logger = getLogger(["gen", "env"]);
         logger.debug("subscription {subscriptionId} initialized: {initialized}", {
             initialized,
@@ -282,6 +305,14 @@ export class AzureCloudAccountService {
             type: "azurerm",
         });
     }
+    async #areProvidersRegistered(subscriptionId) {
+        const client = new ResourceManagementClient(this.#credential, subscriptionId);
+        const results = await Promise.all(this.#requiredResourceProviders.map(async (namespace) => {
+            const provider = await client.providers.get(namespace);
+            return provider.registrationState === "Registered";
+        }));
+        return results.every(Boolean);
+    }
     async #getCurrentPrincipalIds() {
         // Create Graph client with custom auth provider that fetches fresh tokens
         const graphClient = Client.init({
@@ -318,4 +349,14 @@ export class AzureCloudAccountService {
         const allPrincipalIds = new Set([userObjectId, ...groupIds]);
         return allPrincipalIds;
     }
+    async #registerProviders(subscriptionId) {
+        const logger = getLogger(["dx-cli", "register-providers"]);
+        const client = new ResourceManagementClient(this.#credential, subscriptionId);
+        logger.info("Registering {count} resource providers on subscription {subscriptionId}", { count: this.#requiredResourceProviders.length, subscriptionId });
+        await Promise.all(this.#requiredResourceProviders.map(async (namespace) => {
+            await client.providers.register(namespace);
+            logger.debug("Registered provider {namespace}", { namespace });
+        }));
+        logger.info("All resource providers registered on subscription {subscriptionId}", { subscriptionId });
+    }
 }

package/dist/adapters/commander/commands/__tests__/init.test.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Tests for authorizeCloudAccounts in the init command.
+ */
+export {};

package/dist/adapters/commander/commands/__tests__/init.test.js

@@ -0,0 +1,159 @@
+/**
+ * Tests for authorizeCloudAccounts in the init command.
+ */
+import { errAsync, okAsync } from "neverthrow";
+import { describe, expect, it } from "vitest";
+import { mock } from "vitest-mock-extended";
+import { AuthorizationError, AuthorizationResult, IdentityAlreadyExistsError, } from "../../../../domain/authorization.js";
+import { authorizeCloudAccounts } from "../init.js";
+const makeEnvPayload = (overrides = {}) => ({
+    env: {
+        cloudAccounts: [
+            {
+                csp: "azure",
+                defaultLocation: "italynorth",
+                displayName: "DEV-FooBar",
+                id: "sub-123",
+            },
+        ],
+        name: "dev",
+        prefix: "dx",
+    },
+    github: { owner: "pagopa", repo: "test-repo" },
+    tags: { BusinessUnit: "BU", CostCenter: "TS000", ManagementTeam: "MT" },
+    workspace: { domain: "" },
+    ...overrides,
+});
+describe("authorizeCloudAccounts", () => {
+    it("returns empty array when init is undefined (env already initialized)", async () => {
+        const authService = mock();
+        const envPayload = makeEnvPayload({ init: undefined });
+        const result = await authorizeCloudAccounts(authService)(envPayload);
+        expect(result.isOk()).toBe(true);
+        expect(result._unsafeUnwrap()).toEqual([]);
+        expect(authService.requestAuthorization).not.toHaveBeenCalled();
+    });
+    it("returns empty array when cloudAccountsToInitialize is empty", async () => {
+        const authService = mock();
+        const envPayload = makeEnvPayload({
+            init: { cloudAccountsToInitialize: [] },
+        });
+        const result = await authorizeCloudAccounts(authService)(envPayload);
+        expect(result.isOk()).toBe(true);
+        expect(result._unsafeUnwrap()).toEqual([]);
+    });
+    it("requests authorization for each initialized account", async () => {
+        const authService = mock();
+        const expectedPr = new AuthorizationResult("https://github.com/pagopa/eng-azure-authorization/pull/42");
+        authService.requestAuthorization.mockReturnValue(okAsync(expectedPr));
+        const account = {
+            csp: "azure",
+            defaultLocation: "italynorth",
+            displayName: "DEV-FooBar",
+            id: "sub-123",
+        };
+        const envPayload = makeEnvPayload({
+            env: {
+                cloudAccounts: [account],
+                name: "dev",
+                prefix: "dx",
+            },
+            init: { cloudAccountsToInitialize: [account] },
+        });
+        const result = await authorizeCloudAccounts(authService)(envPayload);
+        expect(result.isOk()).toBe(true);
+        expect(result._unsafeUnwrap()).toEqual([expectedPr]);
+        expect(authService.requestAuthorization).toHaveBeenCalledWith(expect.objectContaining({
+            bootstrapIdentityId: "dx-d-itn-bootstrap-id-01",
+            subscriptionName: "DEV-FooBar",
+        }));
+    });
+    it("computes correct identity for westeurope location", async () => {
+        const authService = mock();
+        authService.requestAuthorization.mockReturnValue(okAsync(new AuthorizationResult("https://example.com/pr/1")));
+        const account = {
+            csp: "azure",
+            defaultLocation: "westeurope",
+            displayName: "PROD-Bar",
+            id: "sub-456",
+        };
+        const envPayload = makeEnvPayload({
+            env: {
+                cloudAccounts: [account],
+                name: "prod",
+                prefix: "io",
+            },
+            init: { cloudAccountsToInitialize: [account] },
+        });
+        const result = await authorizeCloudAccounts(authService)(envPayload);
+        expect(result.isOk()).toBe(true);
+        expect(authService.requestAuthorization).toHaveBeenCalledWith(expect.objectContaining({
+            bootstrapIdentityId: "io-p-weu-bootstrap-id-01",
+            subscriptionName: "PROD-Bar",
+        }));
+    });
+    it("skips accounts with unsupported locations", async () => {
+        const authService = mock();
+        const account = {
+            csp: "azure",
+            defaultLocation: "eastus",
+            displayName: "DEV-Unsupported",
+            id: "sub-789",
+        };
+        const envPayload = makeEnvPayload({
+            init: { cloudAccountsToInitialize: [account] },
+        });
+        const result = await authorizeCloudAccounts(authService)(envPayload);
+        expect(result.isOk()).toBe(true);
+        expect(result._unsafeUnwrap()).toEqual([]);
+        expect(authService.requestAuthorization).not.toHaveBeenCalled();
+    });
+    it("continues when authorization fails for one account", async () => {
+        const authService = mock();
+        const account1 = {
+            csp: "azure",
+            defaultLocation: "italynorth",
+            displayName: "DEV-First",
+            id: "sub-1",
+        };
+        const account2 = {
+            csp: "azure",
+            defaultLocation: "italynorth",
+            displayName: "DEV-Second",
+            id: "sub-2",
+        };
+        const expectedPr = new AuthorizationResult("https://example.com/pr/2");
+        authService.requestAuthorization
+            .mockReturnValueOnce(errAsync(new AuthorizationError("Branch already exists")))
+            .mockReturnValueOnce(okAsync(expectedPr));
+        const envPayload = makeEnvPayload({
+            env: {
+                cloudAccounts: [account1, account2],
+                name: "dev",
+                prefix: "dx",
+            },
+            init: { cloudAccountsToInitialize: [account1, account2] },
+        });
+        const result = await authorizeCloudAccounts(authService)(envPayload);
+        expect(result.isOk()).toBe(true);
+        const prs = result._unsafeUnwrap();
+        expect(prs).toHaveLength(1);
+        expect(prs[0]).toEqual(expectedPr);
+    });
+    it("handles IdentityAlreadyExistsError gracefully", async () => {
+        const authService = mock();
+        const account = {
+            csp: "azure",
+            defaultLocation: "italynorth",
+            displayName: "DEV-Existing",
+            id: "sub-exists",
+        };
+        authService.requestAuthorization.mockReturnValue(errAsync(new IdentityAlreadyExistsError("dx-d-itn-bootstrap-id-01")));
+        const envPayload = makeEnvPayload({
+            init: { cloudAccountsToInitialize: [account] },
+        });
+        const result = await authorizeCloudAccounts(authService)(envPayload);
+        expect(result.isOk()).toBe(true);
+        expect(result._unsafeUnwrap()).toEqual([]);
+    });
+});

package/dist/adapters/commander/commands/init.d.ts

@@ -1,5 +1,7 @@
 import { Command } from "commander";
 import { ResultAsync } from "neverthrow";
+import type { Payload as EnvironmentPayload } from "../../plop/generators/environment/index.js";
+import { AuthorizationResult, AuthorizationService } from "../../../domain/authorization.js";
 import { GitHubService } from "../../../domain/github.js";
 export declare const checkPreconditions: () => ResultAsync<import("execa").Result<{
     environment: {
@@ -9,8 +11,13 @@ export declare const checkPreconditions: () => ResultAsync<import("execa").Resul
     };
     shell: true;
 }>, Error>;
+/**
+ * Authorize a Cloud Account (Azure Subscription, AWS Account, ...), creating a Pull Request for each account that requires authorization.
+ */
+export declare const authorizeCloudAccounts: (authorizationService: AuthorizationService) => (envPayload: EnvironmentPayload) => ResultAsync<AuthorizationResult[], never>;
 type InitCommandDependencies = {
+    authorizationService: AuthorizationService;
     gitHubService: GitHubService;
 };
-export declare const makeInitCommand: ({ gitHubService, }: InitCommandDependencies) => Command;
+export declare const makeInitCommand: ({ authorizationService, gitHubService, }: InitCommandDependencies) => Command;
 export {};

package/dist/adapters/commander/commands/init.js

@@ -6,7 +6,10 @@ import { okAsync, ResultAsync } from "neverthrow";
 import * as path from "node:path";
 import { oraPromise } from "ora";
 import { z } from "zod";
+import { requestAuthorizationInputSchema, } from "../../../domain/authorization.js";
+import { environmentShort } from "../../../domain/environment.js";
 import { Repository, } from "../../../domain/github.js";
+import { isAzureLocation, locationShort } from "../../azure/locations.js";
 import { tf$ } from "../../execa/terraform.js";
 import { getPlopInstance, runDeploymentEnvironmentGenerator, runMonorepoGenerator, } from "../../plop/index.js";
 import { exitWithError } from "../index.js";
@@ -16,7 +19,7 @@ const withSpinner = (text, successText, failText, promise) => ResultAsync.fromPr
     text,
 }), (cause) => new Error(failText, { cause }));
 const displaySummary = (initResult) => {
-    const { pr, repository } = initResult;
+    const { authorizationPrs, pr, repository } = initResult;
     console.log(chalk.green.bold("\nWorkspace created successfully!"));
     if (repository) {
         console.log(`- Name: ${chalk.cyan(repository.name)}`);
@@ -26,9 +29,16 @@ const displaySummary = (initResult) => {
         console.log(chalk.yellow(`\n⚠️ GitHub repository may not have been created automatically.`));
     }
     if (pr) {
+        let step = 1;
         console.log(chalk.green.bold("\nNext Steps:"));
-        console.log(`1. Review the Pull Request in the GitHub repository: ${chalk.underline(pr.url)}`);
-        console.log(`2. Visit ${chalk.underline("https://dx.pagopa.it/getting-started")} to deploy your first project\n`);
+        console.log(`${step++}. Review the Pull Request in the GitHub repository: ${chalk.underline(pr.url)}`);
+        if (authorizationPrs.length > 0) {
+            console.log(`${step++}. Review the Azure authorization Pull Request(s):`);
+            for (const authPr of authorizationPrs) {
+                console.log(`   - ${chalk.underline(authPr.url)}`);
+            }
+        }
+        console.log(`${step}. Visit ${chalk.underline("https://dx.pagopa.it/getting-started")} to deploy your first project\n`);
     }
     else {
         console.log(chalk.yellow(`\n⚠️ There was an error during Pull Request creation.`));
@@ -113,7 +123,46 @@ const handleGeneratorError = (err) => {
     }
     return new Error("Failed to run the generator");
 };
-export const makeInitCommand = ({ gitHubService, }) => new Command()
+/**
+ * Authorize a Cloud Account (Azure Subscription, AWS Account, ...), creating a Pull Request for each account that requires authorization.
+ */
+export const authorizeCloudAccounts = (authorizationService) => (envPayload) => {
+    const accountsToInitialize = envPayload.init?.cloudAccountsToInitialize ?? [];
+    if (accountsToInitialize.length === 0) {
+        return okAsync([]);
+    }
+    const logger = getLogger(["dx-cli", "init"]);
+    const { name, prefix } = envPayload.env;
+    const envShort = environmentShort[name];
+    const requestAll = async () => {
+        const results = [];
+        for (const account of accountsToInitialize) {
+            if (!isAzureLocation(account.defaultLocation)) {
+                logger.warn("Skipping authorization for {account}: unsupported location", { account: account.displayName });
+                continue;
+            }
+            const locShort = locationShort[account.defaultLocation];
+            const input = requestAuthorizationInputSchema.safeParse({
+                bootstrapIdentityId: `${prefix}-${envShort}-${locShort}-bootstrap-id-01`,
+                subscriptionName: account.displayName,
+            });
+            if (!input.success) {
+                logger.warn("Skipping authorization for {account}: invalid input", {
+                    account: account.displayName,
+                });
+                continue;
+            }
+            const result = await authorizationService.requestAuthorization(input.data);
+            result.match((authResult) => results.push(authResult), (error) => logger.warn("Authorization request failed for {account}: {error}", {
+                account: account.displayName,
+                error: error.message,
+            }));
+        }
+        return results;
+    };
+    return ResultAsync.fromPromise(requestAll(), () => []).orElse(() => okAsync([]));
+};
+export const makeInitCommand = ({ authorizationService, gitHubService, }) => new Command()
     .name("init")
     .description("Initialize a new DX workspace")
     .action(async function () {
@@ -127,11 +176,11 @@ export const makeInitCommand = ({ gitHubService, }) => new Command()
         process.chdir(payload.repoName);
         console.log(chalk.blue.bold("\nCloud Environment"));
     })
-        .andThen((payload) => ResultAsync.fromPromise(runDeploymentEnvironmentGenerator(plop, {
-        owner: payload.repoOwner,
-        repo: payload.repoName,
-    }), handleGeneratorError).map(() => payload)))
+        .andThen((monorepoPayload) => ResultAsync.fromPromise(runDeploymentEnvironmentGenerator(plop, {
+        owner: monorepoPayload.repoOwner,
+        repo: monorepoPayload.repoName,
+    }), handleGeneratorError).map((envPayload) => ({ envPayload, monorepoPayload }))))
         .andTee(() => console.log()) // Print a new line before the gh repo creation logs
-        .andThen((payload) => handleNewGitHubRepository(gitHubService)(payload))
+        .andThen(({ envPayload, monorepoPayload }) => handleNewGitHubRepository(gitHubService)(monorepoPayload).andThen((repoPr) => authorizeCloudAccounts(authorizationService)(envPayload).map((authorizationPrs) => ({ ...repoPr, authorizationPrs }))))
         .match(displaySummary, exitWithError(this));
 });

package/dist/adapters/plop/index.d.ts

@@ -1,6 +1,7 @@
 import type { NodePlopAPI } from "plop";
 import { GitHubRepo } from "../../domain/github-repo.js";
 import { GitHubService } from "../../domain/github.js";
+import { Payload as EnvironmentPayload } from "../plop/generators/environment/index.js";
 import { Payload as MonorepoPayload } from "../plop/generators/monorepo/index.js";
 export declare const setMonorepoGenerator: (plop: NodePlopAPI) => void;
 export declare const getPlopInstance: () => Promise<NodePlopAPI>;
@@ -13,7 +14,7 @@ export declare const runMonorepoGenerator: (plop: NodePlopAPI, githubService: Gi
  *                 uses the explicitly passed repository. When omitted (by add command),
  *                 the generator infers it from the local git context.
  */
-export declare const runDeploymentEnvironmentGenerator: (plop: NodePlopAPI, github?: GitHubRepo) => Promise<void>;
+export declare const runDeploymentEnvironmentGenerator: (plop: NodePlopAPI, github?: GitHubRepo) => Promise<EnvironmentPayload>;
 /**
  * Configure the deployment environment generator
  *

package/dist/adapters/plop/index.js

@@ -7,7 +7,7 @@ import { oraPromise } from "ora";
 import { RepositoryNotFoundError } from "../../domain/github.js";
 import { AzureSubscriptionRepository } from "../azure/cloud-account-repository.js";
 import { AzureCloudAccountService } from "../azure/cloud-account-service.js";
-import createDeploymentEnvironmentGenerator, { PLOP_ENVIRONMENT_GENERATOR_NAME, } from "../plop/generators/environment/index.js";
+import createDeploymentEnvironmentGenerator, { payloadSchema as environmentPayloadSchema, PLOP_ENVIRONMENT_GENERATOR_NAME, } from "../plop/generators/environment/index.js";
 import createMonorepoGenerator, { payloadSchema as monorepoPayloadSchema, PLOP_MONOREPO_GENERATOR_NAME, } from "../plop/generators/monorepo/index.js";
 export const setMonorepoGenerator = (plop) => {
     const octokit = new Octokit({ auth: process.env.GITHUB_TOKEN });
@@ -65,12 +65,14 @@ export const runMonorepoGenerator = async (plop, githubService) => {
 export const runDeploymentEnvironmentGenerator = async (plop, github) => {
     setDeploymentEnvironmentGenerator(plop, github);
     const generator = plop.getGenerator(PLOP_ENVIRONMENT_GENERATOR_NAME);
-    const payload = await generator.runPrompts();
+    const answers = await generator.runPrompts();
+    const payload = environmentPayloadSchema.parse(answers);
     await oraPromise(runActions(generator, payload), {
         failText: "Failed to create deployment environment",
         successText: "Environment created successfully!",
         text: "Creating environment...",
     });
+    return payload;
 };
 /**
  * Configure the deployment environment generator

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pagopa/dx-cli",
-  "version": "0.18.7",
+  "version": "0.18.9",
   "type": "module",
   "description": "A CLI useful to manage DX tools.",
   "repository": {

package/templates/environment/bootstrapper/{{env.name}}/main.tf.hbs

@@ -103,6 +103,7 @@ module "azure-{{displayName}}_bootstrap" {
     key_vault = {
       name                = module.azure-{{displayName}}_core_values.common_key_vault.name
       resource_group_name = module.azure-{{displayName}}_core_values.common_key_vault.resource_group_name
+      use_rbac            = true
     }
     use_github_app = true
   }

package/templates/monorepo/.pre-commit-config.yaml.hbs

@@ -7,7 +7,7 @@ repos:
         exclude: ^.*/(_modules|modules|\.terraform)(/.*)?$
         files: infra/(resources/prod|repository)
   - repo: https://github.com/antonbabenko/pre-commit-terraform
-    rev: "{{ preCommitTerraformVersion }}"
+    rev: v{{ preCommitTerraformVersion }}
     hooks:
       - id: terraform_tflint
         args: