py-serverless-kit 0.1.0__py3-none-any.whl

py_serverless_kit/providers/azure.py

@@ -0,0 +1,417 @@
+"""Azure: Linux Function App (Consumption plan, Python v2 programming model).
+
+One Function App hosts every function of a service. The bundle carries a
+generated ``function_app.py`` that registers a decorated wrapper per trigger:
+
+* ``http``     -> ``@app.route`` (``host.json`` sets ``routePrefix`` to ``""`` so the
+  configured paths are served as-is, without Azure's default ``/api`` prefix);
+* ``schedule`` -> ``@app.timer_trigger`` (NCRONTAB, always UTC on Linux Consumption);
+* ``queue``    -> Storage Queue in the app's storage account;
+* ``storage``  -> Blob trigger on a container in the app's storage account (created only);
+* ``topic``    -> Service Bus topic + one subscription per function.
+
+Dependencies are installed by the remote Oryx build (``requirements.txt``).
+Workflows run on the embedded engine (an ``<name>-orchestrator`` HTTP function).
+
+``azurerm`` >= 4 requires a subscription id: set ``provider.options.subscription_id``
+or the ``ARM_SUBSCRIPTION_ID`` environment variable.
+
+Options: ``subscription_id``, ``resource_group`` (existing), ``plan_sku`` (default Y1),
+``app_insights`` (default true), ``storage_connection`` (app-setting name for
+``existing`` queues / buckets in another account), ``servicebus_namespace_id`` and
+``servicebus_connection`` (for ``existing`` topics).
+"""
+
+from __future__ import annotations
+
+import json
+import re
+from typing import Any, Dict, List, Optional
+
+from ..config.schema import ServiceConfig
+from . import schedule as sched
+from .base import HTTP, QUEUE, SCHEDULE, STORAGE, TOPIC, Issue, Provider, RenderContext, stable_suffix
+from .terraform_doc import TerraformDoc, escape, ref, tf_id
+
+APP = "azurerm_linux_function_app"
+_PER_FUNCTION_ENV = ("PSKIT_FUNCTION", "PSKIT_HANDLER")
+_STORAGE_NAME = re.compile(r"^[a-z0-9](?!.*--)[a-z0-9-]{1,61}[a-z0-9]$")
+DEFAULT_CONNECTION = "AzureWebJobsStorage"
+SERVICEBUS_SETTING = "PSKIT_SERVICEBUS"
+
+
+def py_ident(text: str) -> str:
+    ident = re.sub(r"\W", "_", text)
+    return ident if re.match(r"[A-Za-z]", ident) else "f_" + ident
+
+
+def azure_route(path: str) -> str:
+    route = path.strip("/")
+    return re.sub(r"\{(\w+)\+\}", r"{*\1}", route)
+
+
+def _hms(seconds: int) -> str:
+    return f"{seconds // 3600:02d}:{seconds % 3600 // 60:02d}:{seconds % 60:02d}"
+
+
+class AzureProvider(Provider):
+    name = "azure"
+    display_name = "Azure Functions"
+    tier = "stable"
+    terraform_source = "hashicorp/azurerm"
+    terraform_version = ">= 4.9"
+    terraform_local_name = "azurerm"
+    default_region = "eastus"
+    capabilities = frozenset({HTTP, SCHEDULE, QUEUE, STORAGE, TOPIC})
+    max_name_length = 60
+    name_pattern = r"[^a-z0-9-]"
+    runtimes = {f"python3.{v}": f"3.{v}" for v in (9, 10, 11, 12)}
+    vendor_dependencies = False
+    extra_requirements = ["azure-functions"]
+    max_timeout = 600
+    notes = "Linux Consumption Function App, Python v2 model. Workflows use the embedded engine."
+
+    # ------------------------------------------------------------------ naming
+    def app_name(self, service: str, stage: str) -> str:
+        base = self.physical_name(service, stage, "")
+        return f"{base[:51].rstrip('-')}-{stable_suffix(service, stage, 'func', length=8)}"
+
+    # ------------------------------------------------------------------ bundle
+    def shim_files(self, config: ServiceConfig) -> Dict[str, str]:
+        opts = config.provider.options
+        lines = [
+            "# Generated by py-serverless-kit. Do not edit - regenerate with `pskit package`.",
+            "import azure.functions as func",
+            "",
+            "from py_serverless_kit.runtime.adapters import azure as _pskit",
+            "",
+            "app = func.FunctionApp(http_auth_level=func.AuthLevel.ANONYMOUS)",
+            "",
+        ]
+        used: set = set()
+
+        def unique(base: str) -> str:
+            ident = py_ident(base)
+            candidate, n = ident, 1
+            while candidate.lower() in used:
+                n += 1
+                candidate = f"{ident}_{n}"
+            used.add(candidate.lower())
+            return candidate
+
+        for name, fn in sorted(config.functions.items()):
+            for i, ev in enumerate(fn.events):
+                c = ev.config
+                ident = unique(f"{name}_{ev.type}_{i}")
+                lines.append("")
+                lines.append(f'@app.function_name(name="{ident}")')
+                if ev.type == "http":
+                    auth = "FUNCTION" if c.auth == "key" else "ANONYMOUS"
+                    methods = "" if c.method == "ANY" else f", methods=[{c.method!r}]"
+                    lines.append(
+                        f"@app.route(route={azure_route(c.path)!r}{methods}, auth_level=func.AuthLevel.{auth})"
+                    )
+                    lines.append(f"def {ident}(req: func.HttpRequest) -> func.HttpResponse:")
+                    lines.append(f"    return _pskit.http(req, {name!r})")
+                elif ev.type == "schedule":
+                    lines.append(
+                        f"@app.timer_trigger(schedule={sched.ncrontab(c)!r}, arg_name='timer', run_on_startup=False)"
+                    )
+                    lines.append(f"def {ident}(timer: func.TimerRequest) -> None:")
+                    lines.append(f"    _pskit.timer(timer, {name!r}, {c.input!r})")
+                elif ev.type == "queue":
+                    conn = opts.get("storage_connection", DEFAULT_CONNECTION) if c.existing else DEFAULT_CONNECTION
+                    lines.append(f"@app.queue_trigger(arg_name='msg', queue_name={c.name!r}, connection={conn!r})")
+                    lines.append(f"def {ident}(msg: func.QueueMessage) -> None:")
+                    lines.append(f"    _pskit.queue(msg, {name!r})")
+                elif ev.type == "storage":
+                    conn = opts.get("storage_connection", DEFAULT_CONNECTION) if c.existing else DEFAULT_CONNECTION
+                    path = f"{c.bucket}/{c.prefix or ''}{{name}}{c.suffix or ''}"
+                    lines.append(f"@app.blob_trigger(arg_name='blob', path={path!r}, connection={conn!r})")
+                    lines.append(f"def {ident}(blob: func.InputStream) -> None:")
+                    lines.append(f"    _pskit.blob(blob, {name!r}, {c.bucket!r})")
+                elif ev.type == "topic":
+                    conn = opts.get("servicebus_connection", SERVICEBUS_SETTING) if c.existing else SERVICEBUS_SETTING
+                    lines.append(
+                        f"@app.service_bus_topic_trigger(arg_name='msg', topic_name={c.name!r}, "
+                        f"subscription_name={self.subscription_name(name)!r}, connection={conn!r})"
+                    )
+                    lines.append(f"def {ident}(msg: func.ServiceBusMessage) -> None:")
+                    lines.append(f"    _pskit.service_bus(msg, {name!r})")
+            if not fn.events:
+                # Invoke-only functions (workflow tasks, invoke()) get a private POST route.
+                ident = unique(f"{name}_invoke")
+                lines.append("")
+                lines.append(f'@app.function_name(name="{ident}")')
+                route = "_pskit/invoke/" + name
+                lines.append(f"@app.route(route={route!r}, methods=['POST'], auth_level=func.AuthLevel.FUNCTION)")
+                lines.append(f"def {ident}(req: func.HttpRequest) -> func.HttpResponse:")
+                lines.append(f"    return _pskit.http(req, {name!r})")
+        timeout = max([config.timeout_of(fn) for fn in config.functions.values()] or [config.provider.timeout])
+        host = {
+            "version": "2.0",
+            "extensionBundle": {"id": "Microsoft.Azure.Functions.ExtensionBundle", "version": "[4.*, 5.0.0)"},
+            "extensions": {"http": {"routePrefix": ""}},
+            "functionTimeout": _hms(min(timeout, self.max_timeout)),
+            "logging": {"logLevel": {"default": "Information"}},
+        }
+        return {"function_app.py": "\n".join(lines) + "\n", "host.json": json.dumps(host, indent=2) + "\n"}
+
+    @staticmethod
+    def subscription_name(function: str) -> str:
+        return re.sub(r"[^A-Za-z0-9_.-]", "-", function)[:50]
+
+    # ------------------------------------------------------------------ validation
+    def provider_block(self, ctx: RenderContext) -> Dict[str, Any]:
+        block: Dict[str, Any] = {"features": {}}
+        if ctx.opt("subscription_id"):
+            block["subscription_id"] = ctx.opt("subscription_id")
+        return block
+
+    def extra_validation(self, config: ServiceConfig) -> List[Issue]:
+        issues: List[Issue] = []
+        opts = config.provider.options
+        env_seen: Dict[str, str] = {}
+        if config.provider.iam.statements:
+            issues.append(Issue("warning", "iam.statements are AWS-style and ignored on Azure", "provider.iam"))
+        for name, fn in config.functions.items():
+            where = f"functions.{name}"
+            for key, value in fn.environment.items():
+                if key in env_seen and env_seen[key] != value:
+                    issues.append(
+                        Issue(
+                            "warning",
+                            f"environment {key} differs between functions; Azure app "
+                            "settings are shared by the whole Function App (last one wins)",
+                            where,
+                        )
+                    )
+                env_seen[key] = value
+            for ev in fn.events_of("http"):
+                if ev.auth in ("iam", "jwt"):
+                    issues.append(
+                        Issue(
+                            "error",
+                            f"http auth {ev.auth!r} is not supported on Azure; use none or key "
+                            "(or put API Management / Easy Auth in front)",
+                            where,
+                        )
+                    )
+            for ev in fn.events_of("schedule"):
+                if ev.timezone.upper() != "UTC":
+                    issues.append(Issue("warning", "Linux Consumption timers run in UTC; timezone is ignored", where))
+            for ev in fn.events_of("queue"):
+                if not _STORAGE_NAME.match(ev.name):
+                    issues.append(
+                        Issue("error", f"queue name {ev.name!r} must be 3-63 lowercase letters, digits, dashes", where)
+                    )
+                if ev.fifo:
+                    issues.append(Issue("warning", "Storage Queues are not FIFO; queue.fifo is ignored", where))
+                if ev.dead_letter:
+                    issues.append(
+                        Issue(
+                            "warning",
+                            "Storage Queues move poison messages to '<queue>-poison'; dead_letter is ignored",
+                            where,
+                        )
+                    )
+            for ev in fn.events_of("storage"):
+                if not _STORAGE_NAME.match(ev.bucket):
+                    issues.append(
+                        Issue(
+                            "error",
+                            f"container name {ev.bucket!r} must be 3-63 lowercase letters, digits, dashes",
+                            where,
+                        )
+                    )
+                if "deleted" in ev.events:
+                    issues.append(Issue("error", "Azure blob triggers only fire on created/updated blobs", where))
+            for ev in fn.events_of("topic"):
+                if ev.existing and not (opts.get("servicebus_namespace_id") and opts.get("servicebus_connection")):
+                    issues.append(
+                        Issue(
+                            "error",
+                            "existing topics need options.servicebus_namespace_id and "
+                            "options.servicebus_connection (name of an app setting)",
+                            where,
+                        )
+                    )
+                if ev.filter:
+                    issues.append(
+                        Issue("warning", "topic.filter is not applied on Azure Service Bus subscriptions", where)
+                    )
+        return issues
+
+    # ------------------------------------------------------------------ render
+    def render_resources(self, doc: TerraformDoc, ctx: RenderContext) -> None:
+        cfg = ctx.config
+        loc = ctx.region
+        tags = ctx.tags()
+        if ctx.opt("resource_group"):
+            rg = doc.data("azurerm_resource_group", "rg", {"name": ctx.opt("resource_group")})
+        else:
+            rg = doc.resource(
+                "azurerm_resource_group", "rg", {"name": f"{ctx.prefix}-rg", "location": loc, "tags": tags}
+            )
+        rg_name = ref(rg, "name")
+
+        sa_base = re.sub(r"[^a-z0-9]", "", ctx.prefix.lower())[:16] or "pskit"
+        sa = doc.resource(
+            "azurerm_storage_account",
+            "app",
+            {
+                "name": sa_base + stable_suffix(ctx.prefix, loc, length=8),
+                "resource_group_name": rg_name,
+                "location": loc,
+                "account_tier": "Standard",
+                "account_replication_type": "LRS",
+                "min_tls_version": "TLS1_2",
+                "tags": tags,
+            },
+        )
+        plan = doc.resource(
+            "azurerm_service_plan",
+            "plan",
+            {
+                "name": f"{ctx.prefix}-plan",
+                "resource_group_name": rg_name,
+                "location": loc,
+                "os_type": "Linux",
+                "sku_name": ctx.opt("plan_sku", "Y1"),
+                "tags": tags,
+            },
+        )
+
+        site_config: Dict[str, Any] = {
+            "application_stack": {"python_version": self.runtime_id(cfg.provider.runtime)},
+        }
+        if ctx.opt("app_insights", True):
+            law = doc.resource(
+                "azurerm_log_analytics_workspace",
+                "logs",
+                {
+                    "name": f"{ctx.prefix}-logs",
+                    "resource_group_name": rg_name,
+                    "location": loc,
+                    "sku": "PerGB2018",
+                    "retention_in_days": max(30, cfg.provider.log_retention_days or 30),
+                    "tags": tags,
+                },
+            )
+            ai = doc.resource(
+                "azurerm_application_insights",
+                "ai",
+                {
+                    "name": f"{ctx.prefix}-ai",
+                    "resource_group_name": rg_name,
+                    "location": loc,
+                    "workspace_id": ref(law, "id"),
+                    "application_type": "web",
+                    "tags": tags,
+                },
+            )
+            site_config["application_insights_connection_string"] = ref(ai, "connection_string")
+        cors = [ev.cors_config for fn in cfg.functions.values() for ev in fn.events_of("http") if ev.cors_config]
+        if cors:
+            site_config["cors"] = {
+                "allowed_origins": sorted({o for c in cors for o in c.origins}),
+                "support_credentials": any(c.allow_credentials for c in cors),
+            }
+
+        settings: Dict[str, str] = {
+            "SCM_DO_BUILD_DURING_DEPLOYMENT": "true",
+            "ENABLE_ORYX_BUILD": "true",
+            "AzureWebJobsFeatureFlags": "EnableWorkerIndexing",
+        }
+        for name, fn in ctx.function_items():
+            for key, value in ctx.environment(name, fn).items():
+                if key not in _PER_FUNCTION_ENV:
+                    settings[key] = escape(value)
+
+        # queues / containers / service bus
+        for _name, fn in ctx.function_items():
+            for ev in fn.events_of("queue"):
+                if not ev.existing and not doc.has_resource("azurerm_storage_queue", f"q-{ev.name}"):
+                    doc.resource(
+                        "azurerm_storage_queue", f"q-{ev.name}", {"name": ev.name, "storage_account_id": ref(sa, "id")}
+                    )
+            for ev in fn.events_of("storage"):
+                if not ev.existing and not doc.has_resource("azurerm_storage_container", f"b-{ev.bucket}"):
+                    doc.resource(
+                        "azurerm_storage_container",
+                        f"b-{ev.bucket}",
+                        {"name": ev.bucket, "storage_account_id": ref(sa, "id"), "container_access_type": "private"},
+                    )
+        ns: Optional[str] = None
+        for name, fn in ctx.function_items():
+            for ev in fn.events_of("topic"):
+                label = f"t-{ev.name}"
+                if ev.existing:
+                    topic = doc.data(
+                        "azurerm_servicebus_topic",
+                        label,
+                        {"name": ev.name, "namespace_id": ctx.opt("servicebus_namespace_id")},
+                    )
+                else:
+                    if ns is None:
+                        ns = doc.resource(
+                            "azurerm_servicebus_namespace",
+                            "bus",
+                            {
+                                "name": f"{ctx.prefix[:40].rstrip('-')}-{stable_suffix(ctx.prefix, 'bus', length=6)}",
+                                "resource_group_name": rg_name,
+                                "location": loc,
+                                "sku": "Standard",
+                                "tags": tags,
+                            },
+                        )
+                        settings[SERVICEBUS_SETTING] = ref(ns, "default_primary_connection_string")
+                    if not doc.has_resource("azurerm_servicebus_topic", label):
+                        doc.resource(
+                            "azurerm_servicebus_topic", label, {"name": ev.name, "namespace_id": ref(ns, "id")}
+                        )
+                    topic = f"azurerm_servicebus_topic.{tf_id(label)}"
+                doc.resource(
+                    "azurerm_servicebus_subscription",
+                    f"{name}-{ev.name}",
+                    {"name": self.subscription_name(name), "topic_id": ref(topic, "id"), "max_delivery_count": 10},
+                )
+
+        app_name = self.app_name(ctx.service, ctx.stage)
+        body: Dict[str, Any] = {
+            "name": app_name,
+            "resource_group_name": rg_name,
+            "location": loc,
+            "service_plan_id": ref(plan, "id"),
+            "storage_account_name": ref(sa, "name"),
+            "storage_account_access_key": ref(sa, "primary_access_key"),
+            "functions_extension_version": "~4",
+            "https_only": True,
+            "zip_deploy_file": "${path.module}/artifact.zip",
+            "app_settings": settings,
+            "site_config": site_config,
+            "tags": tags,
+        }
+        app = doc.resource(APP, "app", body)
+        host = "https://" + ref(app, "default_hostname")
+
+        fn_out: Dict[str, Dict[str, Any]] = {}
+        for name, fn in ctx.function_items():
+            out: Dict[str, Any] = {
+                "id": f"{app_name}/{name}",
+                "console": "https://portal.azure.com/#resource" + ref(app, "id") + "/functions",
+            }
+            http_events = fn.events_of("http")
+            if http_events:
+                out["base_url"] = host
+                out["url"] = host + "/" + azure_route(http_events[0].path)
+            fn_out[name] = out
+        wf_out = {
+            name: {"id": f"{app_name}/{name}-orchestrator", "url": host + f"/workflows/{name}"}
+            for name in sorted(cfg.workflows)
+        }
+        doc.output(
+            "pskit",
+            {"functions": fn_out, "workflows": wf_out, "endpoint": host},
+            description="py-serverless-kit deployment summary",
+        )