@pagopa/dx-cli 0.19.1 → 0.19.3

package/dist/adapters/commander/commands/init.js

@@ -45,6 +45,8 @@ const azureAccountSchema = z.object({
 });
 const ensureAzLogin = async () => {
     const { stdout } = await tf$ `az account show`;
+    // `az account show` reads the cached CLI context, but `az group list`
+    // fails when the current session token has expired.
     await tf$ `az group list`;
     const parsed = JSON.parse(stdout);
     const { user } = azureAccountSchema.parse(parsed);
@@ -79,12 +81,13 @@ const initializeGitRepository = (repository) => {
     });
     const pushToOrigin = async () => {
         await git$ `git init`;
-        await git$ `git add README.md`;
-        await git$ `git commit --no-gpg-sign -m "Create README.md"`;
-        await git$ `git branch -M main`;
         await git$ `git remote add origin ${repository.origin}`;
-        await git$ `git push -u origin main`;
-        await git$ `git switch -c ${branchName}`;
+        await git$ `git fetch origin main`;
+        await git$ `git checkout -b ${branchName}`;
+        // Terraform creates `main` with an initial README commit.
+        // Reset to `origin/main` so this branch is based on the remote default branch,
+        // while keeping the scaffolded local files in the working tree for a clean PR diff.
+        await git$ `git reset origin/main`;
         await git$ `git add .`;
         await git$ `git commit --no-gpg-sign -m "Scaffold workspace"`;
         await git$ `git push -u origin ${branchName}`;

package/dist/adapters/pagopa-technology/__tests__/authorization.test.js

@@ -19,17 +19,14 @@ const makeSampleInput = () => requestAuthorizationInputSchema.parse({
     repoName: "test-repo",
     subscriptionName: "test-subscription",
 });
+const FILE_PATH = "src/azure-subscriptions/subscriptions/test-subscription/terraform.tfvars.json";
 // eslint-disable-next-line max-lines-per-function
 describe("PagoPA AuthorizationService", () => {
     describe("happy path", () => {
         it("should create a pull request when all steps succeed", async () => {
             const { authorizationService, gitHubService } = makeEnv();
             const input = makeSampleInput();
-            const originalContent = `
-directory_readers = {
-  service_principals_name = []
-}
-`.trim();
+            const originalContent = JSON.stringify({ directory_readers: { service_principals_name: [] } }, null, 2);
             gitHubService.createBranch.mockResolvedValue(undefined);
             gitHubService.getFileContent.mockResolvedValue({
                 content: originalContent,
@@ -50,7 +47,7 @@ directory_readers = {
             });
             expect(gitHubService.getFileContent).toHaveBeenCalledWith({
                 owner: "pagopa",
-                path: "src/azure-subscriptions/subscriptions/test-subscription/terraform.tfvars",
+                path: FILE_PATH,
                 ref: "feats/add-test-repo-test-subscription-bootstrap-identity",
                 repo: "eng-azure-authorization",
             });
@@ -58,7 +55,7 @@ directory_readers = {
                 branch: "feats/add-test-repo-test-subscription-bootstrap-identity",
                 message: "Add directory reader for test-subscription",
                 owner: "pagopa",
-                path: "src/azure-subscriptions/subscriptions/test-subscription/terraform.tfvars",
+                path: FILE_PATH,
                 repo: "eng-azure-authorization",
                 sha: "original-sha-123",
             }));
@@ -71,30 +68,88 @@ directory_readers = {
                 title: "Add directory reader for test-subscription",
             });
         });
+        it("should preserve existing fields in the JSON file", async () => {
+            const { authorizationService, gitHubService } = makeEnv();
+            const input = makeSampleInput();
+            const originalContent = JSON.stringify({
+                directory_readers: {
+                    service_principals_name: ["existing-identity"],
+                    some_other_field: "keep-me",
+                },
+                entra_groups: {
+                    readers: ["reader-group"],
+                },
+                other_top_level: true,
+            }, null, 2);
+            gitHubService.createBranch.mockResolvedValue(undefined);
+            gitHubService.getFileContent.mockResolvedValue({
+                content: originalContent,
+                sha: "sha-789",
+            });
+            gitHubService.updateFile.mockResolvedValue(undefined);
+            gitHubService.createPullRequest.mockResolvedValue(new PullRequest("https://github.com/pagopa/eng-azure-authorization/pull/44"));
+            const result = await authorizationService.requestAuthorization(input);
+            expect(result.isOk()).toBe(true);
+            const updateCall = gitHubService.updateFile.mock.calls[0][0];
+            const updatedParsed = JSON.parse(updateCall.content);
+            expect(updatedParsed).toStrictEqual({
+                directory_readers: {
+                    service_principals_name: [
+                        "existing-identity",
+                        "test-bootstrap-identity-id",
+                    ],
+                    some_other_field: "keep-me",
+                },
+                entra_groups: {
+                    readers: ["reader-group"],
+                },
+                other_top_level: true,
+            });
+        });
+        it("should append identity to an existing non-empty list", async () => {
+            const { authorizationService, gitHubService } = makeEnv();
+            const input = makeSampleInput();
+            const originalContent = JSON.stringify({
+                directory_readers: {
+                    service_principals_name: ["existing-identity"],
+                },
+            }, null, 2);
+            gitHubService.createBranch.mockResolvedValue(undefined);
+            gitHubService.getFileContent.mockResolvedValue({
+                content: originalContent,
+                sha: "sha-456",
+            });
+            gitHubService.updateFile.mockResolvedValue(undefined);
+            gitHubService.createPullRequest.mockResolvedValue(new PullRequest("https://github.com/pagopa/eng-azure-authorization/pull/43"));
+            const result = await authorizationService.requestAuthorization(input);
+            expect(result.isOk()).toBe(true);
+            const updateCall = gitHubService.updateFile.mock.calls[0][0];
+            const updatedParsed = JSON.parse(updateCall.content);
+            expect(updatedParsed.directory_readers.service_principals_name).toContain("test-bootstrap-identity-id");
+            expect(updatedParsed.directory_readers.service_principals_name).toContain("existing-identity");
+        });
     });
     describe("error handling", () => {
         it("should return error when file is not found", async () => {
             const { authorizationService, gitHubService } = makeEnv();
             const input = makeSampleInput();
             gitHubService.createBranch.mockResolvedValue(undefined);
-            gitHubService.getFileContent.mockRejectedValue(new FileNotFoundError("src/azure-subscriptions/subscriptions/test-subscription/terraform.tfvars"));
+            gitHubService.getFileContent.mockRejectedValue(new FileNotFoundError(FILE_PATH));
             const result = await authorizationService.requestAuthorization(input);
             expect(result.isErr()).toBe(true);
             const error = result._unsafeUnwrapErr();
             expect(error.message).toContain("Unable to get");
-            expect(error.message).toContain("test-subscription/terraform.tfvars");
+            expect(error.message).toContain("terraform.tfvars.json");
             expect(gitHubService.updateFile).not.toHaveBeenCalled();
         });
         it("should return error when identity already exists", async () => {
             const { authorizationService, gitHubService } = makeEnv();
             const input = makeSampleInput();
-            const content = `
-directory_readers = {
-  service_principals_name = [
-    "test-bootstrap-identity-id"
-  ]
-}
-`.trim();
+            const content = JSON.stringify({
+                directory_readers: {
+                    service_principals_name: ["test-bootstrap-identity-id"],
+                },
+            }, null, 2);
             gitHubService.createBranch.mockResolvedValue(undefined);
             gitHubService.getFileContent.mockResolvedValue({
                 content,
@@ -105,13 +160,25 @@ directory_readers = {
             expect(result._unsafeUnwrapErr()).toBeInstanceOf(IdentityAlreadyExistsError);
             expect(gitHubService.updateFile).not.toHaveBeenCalled();
         });
-        it("should return error when tfvars format is invalid", async () => {
+        it("should return error when file content is not valid JSON", async () => {
+            const { authorizationService, gitHubService } = makeEnv();
+            const input = makeSampleInput();
+            gitHubService.createBranch.mockResolvedValue(undefined);
+            gitHubService.getFileContent.mockResolvedValue({
+                content: "not valid json {{",
+                sha: "sha-123",
+            });
+            const result = await authorizationService.requestAuthorization(input);
+            expect(result.isErr()).toBe(true);
+            expect(result._unsafeUnwrapErr()).toBeInstanceOf(InvalidAuthorizationFileFormatError);
+            expect(gitHubService.updateFile).not.toHaveBeenCalled();
+        });
+        it("should return error when JSON is missing expected keys", async () => {
             const { authorizationService, gitHubService } = makeEnv();
             const input = makeSampleInput();
-            const invalidContent = "invalid content without directory_readers";
             gitHubService.createBranch.mockResolvedValue(undefined);
             gitHubService.getFileContent.mockResolvedValue({
-                content: invalidContent,
+                content: JSON.stringify({ unexpected_key: {} }),
                 sha: "sha-123",
             });
             const result = await authorizationService.requestAuthorization(input);
@@ -132,11 +199,7 @@ directory_readers = {
         it("should return error when file update fails", async () => {
             const { authorizationService, gitHubService } = makeEnv();
             const input = makeSampleInput();
-            const content = `
-directory_readers = {
-  service_principals_name = []
-}
-`.trim();
+            const content = JSON.stringify({ directory_readers: { service_principals_name: [] } }, null, 2);
             gitHubService.createBranch.mockResolvedValue(undefined);
             gitHubService.getFileContent.mockResolvedValue({
                 content,
@@ -151,11 +214,7 @@ directory_readers = {
         it("should return error when PR creation fails", async () => {
             const { authorizationService, gitHubService } = makeEnv();
             const input = makeSampleInput();
-            const content = `
-directory_readers = {
-  service_principals_name = []
-}
-`.trim();
+            const content = JSON.stringify({ directory_readers: { service_principals_name: [] } }, null, 2);
             gitHubService.createBranch.mockResolvedValue(undefined);
             gitHubService.getFileContent.mockResolvedValue({
                 content,

package/dist/adapters/pagopa-technology/authorization.d.ts

@@ -3,7 +3,7 @@
  *
  * Implements the AuthorizationService interface for the PagoPA Azure
  * authorization workflow. Encapsulates all platform-specific details:
- * the target GitHub repository, file paths, branch naming, HCL file
+ * the target GitHub repository, file paths, branch naming, JSON file
  * parsing, and pull request creation.
  */
 import { AuthorizationService } from "../../domain/authorization.js";

package/dist/adapters/pagopa-technology/authorization.js

@@ -3,29 +3,49 @@
  *
  * Implements the AuthorizationService interface for the PagoPA Azure
  * authorization workflow. Encapsulates all platform-specific details:
- * the target GitHub repository, file paths, branch naming, HCL file
+ * the target GitHub repository, file paths, branch naming, JSON file
  * parsing, and pull request creation.
  */
 import { getLogger } from "@logtape/logtape";
 import { err, errAsync, ok, okAsync, ResultAsync } from "neverthrow";
+import { z } from "zod";
 import { AuthorizationError, AuthorizationResult, IdentityAlreadyExistsError, InvalidAuthorizationFileFormatError, } from "../../domain/authorization.js";
-// Matches the service_principals_name list inside the directory_readers block.
-const DIRECTORY_READERS_REGEX = /(directory_readers\s*=\s*\{[\s\S]*?service_principals_name\s*=\s*\[)([\s\S]*?)(][\s\S]*?})/;
+const authorizationFileSchema = z
+    .object({
+    directory_readers: z
+        .object({
+        service_principals_name: z.array(z.string()),
+    })
+        .loose(),
+})
+    .loose();
 const addIdentity = (content, identityId) => {
-    const match = content.match(DIRECTORY_READERS_REGEX);
-    if (!match) {
+    let parsed;
+    try {
+        parsed = JSON.parse(content);
+    }
+    catch {
+        return err(new InvalidAuthorizationFileFormatError("File content is not valid JSON"));
+    }
+    const result = authorizationFileSchema.safeParse(parsed);
+    if (!result.success) {
         return err(new InvalidAuthorizationFileFormatError("Could not find directory_readers.service_principals_name list"));
     }
-    const [, prefix, existingItems, suffix] = match;
-    if (existingItems.includes(`"${identityId}"`)) {
+    const jsonContent = result.data;
+    if (jsonContent.directory_readers.service_principals_name.includes(identityId)) {
         return err(new IdentityAlreadyExistsError(identityId));
     }
-    // Build the new list content following HCL formatting rules:
-    // - Items are indented with 4 spaces; the LAST item must NOT have a trailing comma
-    const newListContent = existingItems.trim().length > 0
-        ? `${existingItems.replace(/,?\s*$/, "")},\n    "${identityId}"\n  `
-        : `\n    "${identityId}"\n  `;
-    return ok(content.replace(DIRECTORY_READERS_REGEX, `${prefix}${newListContent}${suffix}`));
+    const updated = {
+        ...jsonContent,
+        directory_readers: {
+            ...jsonContent.directory_readers,
+            service_principals_name: [
+                ...jsonContent.directory_readers.service_principals_name,
+                identityId,
+            ],
+        },
+    };
+    return ok(JSON.stringify(updated, null, 2));
 };
 const REPO_OWNER = "pagopa";
 const REPO_NAME = "eng-azure-authorization";
@@ -34,7 +54,7 @@ export const makeAuthorizationService = (gitHubService) => ({
     requestAuthorization(input) {
         const logger = getLogger(["dx-cli", "pagopa-authorization"]);
         const { bootstrapIdentityId, repoName, subscriptionName } = input;
-        const filePath = `src/azure-subscriptions/subscriptions/${subscriptionName}/terraform.tfvars`;
+        const filePath = `src/azure-subscriptions/subscriptions/${subscriptionName}/terraform.tfvars.json`;
         const branchName = `feats/add-${repoName}-${subscriptionName}-bootstrap-identity`;
         return (
         // Step 1: Create branch first to avoid race condition with main branch updates

package/dist/adapters/plop/generators/environment/actions.js

@@ -2,14 +2,14 @@ import { getLogger } from "@logtape/logtape";
 import * as path from "node:path";
 import { formatTerraformCode } from "../../../terraform/fmt.js";
 import { payloadSchema } from "./prompts.js";
-const addModule = (env, templatesPath) => {
+const addModule = (env, templatesPath, init = false) => {
     const cloudAccountsByCsp = Object.groupBy(env.cloudAccounts, (account) => account.csp);
     const includesProdIO = env.cloudAccounts.some((account) => account.displayName === "PROD-IO");
     const cwd = process.cwd();
     return (name, terraformBackendKey) => [
         {
             base: templatesPath,
-            data: { cloudAccountsByCsp, includesProdIO },
+            data: { cloudAccountsByCsp, includesProdIO, init },
             destination: path.join(cwd, "infra"),
             force: true,
             templateFiles: path.join(templatesPath, name),
@@ -19,7 +19,7 @@ const addModule = (env, templatesPath) => {
         },
         {
             base: path.join(templatesPath, "shared"),
-            data: { cloudAccountsByCsp, terraformBackendKey },
+            data: { cloudAccountsByCsp, init, terraformBackendKey },
             destination: path.join(cwd, "infra", name, "{{env.name}}"),
             force: true,
             templateFiles: path.join(templatesPath, "shared"),
@@ -34,7 +34,7 @@ export default function getActions(templatesPath) {
         const logger = getLogger(["gen", "env"]);
         logger.debug("payload {payload}", { payload });
         const { env, github, init } = payloadSchema.parse(payload);
-        const addEnvironmentModule = addModule(env, templatesPath);
+        const addEnvironmentModule = addModule(env, templatesPath, !!init);
         const actions = [
             {
                 type: "getTerraformBackend",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pagopa/dx-cli",
-  "version": "0.19.1",
+  "version": "0.19.3",
   "type": "module",
   "description": "A CLI useful to manage DX tools.",
   "repository": {
@@ -28,14 +28,14 @@
     "@azure/arm-resources": "^7.0.0",
     "@azure/arm-resources-subscriptions": "^2.1.0",
     "@azure/arm-storage": "^19.1.0",
-    "@azure/identity": "^4.13.0",
-    "@azure/keyvault-secrets": "^4.9.0",
-    "@azure/storage-blob": "^12.29.1",
+    "@azure/identity": "^4.13.1",
+    "@azure/keyvault-secrets": "^4.11.1",
+    "@azure/storage-blob": "^12.31.0",
     "@logtape/logtape": "^1.3.7",
     "@microsoft/microsoft-graph-client": "^3.0.7",
     "chalk": "^5.6.2",
     "commander": "^14.0.3",
-    "core-js": "^3.48.0",
+    "core-js": "^3.49.0",
     "execa": "^9.6.1",
     "glob": "^11.1.0",
     "inquirer": "^9.3.8",
@@ -45,24 +45,24 @@
     "ora": "^9.3.0",
     "replace-in-file": "^8.4.0",
     "semver": "^7.7.4",
-    "yaml": "^2.8.2",
+    "yaml": "^2.8.3",
     "zod": "^4.3.6",
-    "@pagopa/dx-savemoney": "^0.2.3"
+    "@pagopa/dx-savemoney": "^0.2.4"
   },
   "devDependencies": {
     "@tsconfig/node24": "24.0.4",
     "@types/inquirer": "^9.0.9",
-    "@types/node": "^22.19.15",
+    "@types/node": "^22.19.17",
     "@types/semver": "^7.7.1",
     "@vitest/coverage-v8": "^3.2.4",
-    "eslint": "^10.1.0",
-    "memfs": "^4.51.1",
+    "eslint": "^10.2.0",
+    "memfs": "^4.57.1",
     "plop": "^4.0.5",
-    "prettier": "3.8.1",
+    "prettier": "3.8.3",
     "typescript": "~5.9.3",
     "vitest": "^3.2.4",
-    "vitest-mock-extended": "^3.1.0",
-    "@pagopa/eslint-config": "^6.0.2"
+    "vitest-mock-extended": "^3.1.1",
+    "@pagopa/eslint-config": "^6.0.3"
   },
   "engines": {
     "node": ">=22.0.0"

package/templates/environment/bootstrapper/{{env.name}}/main.tf.hbs

@@ -120,6 +120,32 @@ module "azure-{{displayName}}_bootstrap" {
 
   tags = local.bootstrapper_tags
 }
+
+{{#if @root.init}}
+resource "azurerm_role_assignment" "infra_cd_user_access_admin_common_rg_{{displayName}}" {
+  provider = azurerm.{{displayName}}
+
+  scope                = module.azure-{{displayName}}_core_values.common_resource_group_id
+  role_definition_name = "User Access Administrator"
+  principal_id         = module.azure-{{displayName}}_bootstrap.identities.infra.cd.principal_id
+}
+
+resource "azurerm_role_assignment" "infra_cd_kv_secrets_officer_common_{{displayName}}" {
+  provider = azurerm.{{displayName}}
+
+  scope                = module.azure-{{displayName}}_core_values.common_key_vault.id
+  role_definition_name = "Key Vault Secrets Officer"
+  principal_id         = module.azure-{{displayName}}_bootstrap.identities.infra.cd.principal_id
+}
+
+resource "azurerm_role_assignment" "infra_ci_kv_secrets_user_common_{{displayName}}" {
+  provider = azurerm.{{displayName}}
+
+  scope                = module.azure-{{displayName}}_core_values.common_key_vault.id
+  role_definition_name = "Key Vault Secrets User"
+  principal_id         = module.azure-{{displayName}}_bootstrap.identities.infra.ci.principal_id
+}
+{{/if}}
 {{/if}}
 {{/each}}