From 88bc23421fb44c7c2fd0858a845fac006a713b91 Mon Sep 17 00:00:00 2001
From: Josiel Souza <josiel.souza@nordcloud.com>
Date: Wed, 3 Jun 2026 10:44:09 +0100
Subject: [PATCH] feat: add CLOUD_API_RESOURCE env var for cloud API token
 scoping (DTOSS-13060)

Pipeline queries Azure AD for the client ID of spn-manbrs-web-api-<env> at deploy time
and writes CLOUD_API_RESOURCE into the gateway .env via deploy.ps1.
---
 .env.development                | 3 +++
 scripts/bash/deploy_arc_ring.sh | 9 +++++++++
 2 files changed, 12 insertions(+)

diff --git a/.env.development b/.env.development
index 00c8a20e..ab075acb 100644
--- a/.env.development
+++ b/.env.development
@@ -7,6 +7,9 @@ AZURE_RELAY_SHARED_ACCESS_KEY=YOUR_SHARED_ACCESS_KEY_HERE
 
 CLOUD_API_ENDPOINT=https://localhost:8000/api/v1/dicom
 CLOUD_API_TOKEN=testtoken
+# Azure AD resource (scope) for cloud API token requests — set to the client ID of spn-manbrs-web-api-<env>.
+# Leave empty locally; managed identity is used in deployed environments.
+CLOUD_API_RESOURCE=
 # MWL Server Configuration
 MWL_AET=SCREENING_MWL
 MWL_PORT=4243
diff --git a/scripts/bash/deploy_arc_ring.sh b/scripts/bash/deploy_arc_ring.sh
index 3455e527..13f46e37 100755
--- a/scripts/bash/deploy_arc_ring.sh
+++ b/scripts/bash/deploy_arc_ring.sh
@@ -25,6 +25,14 @@ echo "--- Ring: ${RING} | Environment: ${ENVIRONMENT} | Release: ${RELEASE_TAG}
 source "infrastructure/environments/${ENVIRONMENT}/variables.sh"
 CLOUD_API_ENDPOINT="https://${CLOUD_API_HOSTNAME}/api/v1/dicom"
 
+CLOUD_API_RESOURCE=$(az ad sp list \
+  --display-name "spn-manbrs-web-api-${ENVIRONMENT}" \
+  --query "[0].appId" -o tsv 2>/dev/null || echo "")
+if [[ -z "$CLOUD_API_RESOURCE" ]]; then
+  echo "##vso[task.logissue type=error]Could not resolve client ID for spn-manbrs-web-api-${ENVIRONMENT}"
+  exit 1
+fi
+
 APPLICATIONINSIGHTS_CONNECTION_STRING=$(az monitor app-insights component show \
   --app "ai-${APP_SHORT_NAME}-${ENVIRONMENT}-arc-uks" \
   --resource-group "$ARC_RG" \
@@ -65,6 +73,7 @@ while IFS= read -r MACHINE_JSON; do
   ENV_CONTENT="AZURE_RELAY_NAMESPACE=${RELAY_NAMESPACE_HOSTNAME}
 AZURE_RELAY_HYBRID_CONNECTION=hc-${MACHINE}
 CLOUD_API_ENDPOINT=${CLOUD_API_ENDPOINT}
+CLOUD_API_RESOURCE=${CLOUD_API_RESOURCE}
 APPLICATIONINSIGHTS_CONNECTION_STRING=${APPLICATIONINSIGHTS_CONNECTION_STRING}
 MWL_AET=SCREENING_MWL
 MWL_PORT=4243