azure-pipelines-tasks-azurermdeploycommon 3.219.0 → 3.221.0

package/operations/AzureAppServiceUtility.ts

@@ -118,14 +118,36 @@ export class AzureAppServiceUtility {
         }
     }
 
-    public async getKuduService(): Promise<Kudu> {
-        var publishingCredentials = await this._appService.getPublishingCredentials();
-        if(publishingCredentials.properties["scmUri"]) {
-            tl.setVariable(`AZURE_APP_SERVICE_KUDU_${this._appService.getSlot()}_PASSWORD`, publishingCredentials.properties["publishingPassword"], true);
-            return new Kudu(publishingCredentials.properties["scmUri"], publishingCredentials.properties["publishingUserName"], publishingCredentials.properties["publishingPassword"]);
+    public async getKuduService(): Promise<Kudu> {     
+
+        const publishingCredentials = await this._appService.getPublishingCredentials();
+        const scmUri = publishingCredentials.properties["scmUri"];
+
+        if (!scmUri) {
+            throw Error(tl.loc('KuduSCMDetailsAreEmpty'));
+        }
+
+        const authHeader = await this.getKuduAuthHeader(publishingCredentials);
+        return new Kudu(publishingCredentials.properties["scmUri"], authHeader);        
+    }
+
+    private async getKuduAuthHeader(publishingCredentials: any): Promise<string> {
+        const scmPolicyCheck = await this.isSitePublishingCredentialsEnabled(); 
+
+        if (!scmPolicyCheck) {
+            const accessToken = await this._appService._client.getCredentials().getToken();
+            tl.debug("Kudu: using bearer token.");
+            return "Bearer " + accessToken;
         }
 
-        throw Error(tl.loc('KuduSCMDetailsAreEmpty'));
+        const password = publishingCredentials.properties["publishingPassword"];
+        const userName = publishingCredentials.properties["publishingUserName"];
+
+        tl.setVariable(`AZURE_APP_SERVICE_KUDU_${this._appService.getSlot()}_PASSWORD`, password, true);
+        tl.debug("Kudu: using basic auth.");
+
+        const auth = (new Buffer(userName + ':' + password).toString('base64'));
+        return "Basic " + auth;
     }
 
     public async getPhysicalPath(virtualApplication: string): Promise<string> {
@@ -273,6 +295,25 @@ export class AzureAppServiceUtility {
         }
     }
 
+    public async isSitePublishingCredentialsEnabled(): Promise<boolean>{
+        try{
+            let scmAuthPolicy: any = await this._appService.getSitePublishingCredentialPolicies();
+            tl.debug(`Site Publishing Policy check: ${JSON.stringify(scmAuthPolicy)}`);
+            if(scmAuthPolicy && scmAuthPolicy.properties.allow) {
+                tl.debug("Function App does allow SCM access");
+                return true;
+            }
+            else {
+                tl.debug("Function App does not allow SCM Access");
+                return false;
+            }
+        }
+        catch(error){
+            tl.debug(`Skipping SCM Policy check: ${error}`);
+            return null;
+        }
+    }
+    
     private async _getPhysicalToVirtualPathMap(virtualApplication: string): Promise<any> {
         // construct URL depending on virtualApplication or root of webapplication 
         var physicalPath = null;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "azure-pipelines-tasks-azurermdeploycommon",
-    "version": "3.219.0",
+    "version": "3.221.0",
     "description": "Common Lib for Azure ARM REST apis",
     "repository": {
         "type": "git",