fix: route post-deploy API calls through frontend proxy in WAF mode

When Container App ingress is internal (WAF/private networking), the
post-deployment scripts cannot reach the backend API directly from the
developer's machine. Detect internal ingress by checking the Container
App's external property, and route API calls through the frontend App
Service proxy (which is public and forwards /api/* to the backend over
the VNet).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: Prajwal-Microsoft

infra/scripts/Selecting-Team-Config-And-Data.ps1

@@ -445,6 +445,23 @@ do {
     }
 } while (-not $useCaseValid)
 
+# WAF/Private Networking: If the Container App ingress is internal, the backendUrl
+# is not reachable from the developer's machine. Route through the frontend App Service
+# proxy instead, which is public and forwards /api/* to the private backend over VNet.
+$solutionSuffix = az group show --name $ResourceGroup --query "tags.SolutionSuffix" -o tsv 2>$null
+if ($solutionSuffix) {
+    $containerAppName = "ca-$solutionSuffix"
+    $isInternal = az containerapp show --name $containerAppName --resource-group $ResourceGroup `
+        --query "properties.configuration.ingress.external" -o tsv 2>$null
+    if ($isInternal -eq "false") {
+        $frontendHostname = "app-$solutionSuffix"
+        $frontendUrl = "https://${frontendHostname}.azurewebsites.net"
+        Write-Host "Private networking detected: Container App ingress is internal."
+        Write-Host "Routing API calls through frontend App Service: $frontendUrl"
+        $script:backendUrl = $frontendUrl
+    }
+}
+
 Write-Host ""
 Write-Host "==============================================="
 Write-Host "Values to be used:"

infra/scripts/selecting_team_config_and_data.sh

@@ -453,6 +453,23 @@ while [[ "$useCaseValid" != true ]]; do
     fi
 done
 
+# WAF/Private Networking: If the Container App ingress is internal, the backendUrl
+# is not reachable from the developer's machine. Route through the frontend App Service
+# proxy instead, which is public and forwards /api/* to the private backend over VNet.
+solutionSuffix=$(az group show --name "$ResourceGroup" --query "tags.SolutionSuffix" -o tsv 2>/dev/null)
+if [[ -n "$solutionSuffix" ]]; then
+    containerAppName="ca-${solutionSuffix}"
+    isExternal=$(az containerapp show --name "$containerAppName" --resource-group "$ResourceGroup" \
+        --query "properties.configuration.ingress.external" -o tsv 2>/dev/null)
+    if [[ "$isExternal" == "false" ]]; then
+        frontendHostname="app-${solutionSuffix}"
+        frontendUrl="https://${frontendHostname}.azurewebsites.net"
+        echo "Private networking detected: Container App ingress is internal."
+        echo "Routing API calls through frontend App Service: $frontendUrl"
+        backendUrl="$frontendUrl"
+    fi
+fi
+
 echo ""
 echo "==============================================="
 echo "Values to be used:"