Merge branch 'us-42666-pr565-followup' of https://github.com/microsoft/content-processing-solution-accelerator into us-42666-pr565-followup

Tejasri-Microsoft · Tejasri-Microsoft · commit cda7c4023b20 · 2026-05-22T17:37:01.000+05:30
diff --git a/infra/scripts/configure_auth.ps1 b/infra/scripts/configure_auth.ps1
@@ -64,6 +64,26 @@ function Azd-Get($key, $default = "") {
 $EnvName        = Azd-Get "AZURE_ENV_NAME" "cps"
 $ResourceGroup  = Azd-Get "AZURE_RESOURCE_GROUP"
 $SubscriptionId = Azd-Get "AZURE_SUBSCRIPTION_ID"
+
+# If already logged in, pin Azure CLI context to the azd environment subscription.
+# If not logged in, preflight check 1 will provide the auth guidance.
+if ($SubscriptionId) {
+  $currentSub = (az account show --query id -o tsv 2>$null)
+  if ($currentSub) {
+    az account set --subscription $SubscriptionId 2>$null
+    if ($LASTEXITCODE -ne 0) {
+      Write-Error "Failed to switch Azure CLI context to subscription '$SubscriptionId'. Verify access and re-run."
+      exit 1
+    }
+
+    $activeSub = (az account show --query id -o tsv 2>$null)
+    if (-not $activeSub -or $activeSub -ne $SubscriptionId) {
+      Write-Error "Azure CLI active subscription '$activeSub' does not match AZURE_SUBSCRIPTION_ID '$SubscriptionId'."
+      exit 1
+    }
+  }
+}
+
 $TenantId = (az account show --query tenantId -o tsv 2>$null)
 if (-not $TenantId) { $TenantId = Azd-Get "AZURE_TENANT_ID" "" }
 # (Preflight Check 1 will catch missing authentication with a clear error message)
diff --git a/infra/scripts/configure_auth.sh b/infra/scripts/configure_auth.sh
@@ -87,6 +87,25 @@ fi
 ENV_NAME="$(azd env get-value AZURE_ENV_NAME 2>/dev/null || echo "")"
 RESOURCE_GROUP="$(azd env get-value AZURE_RESOURCE_GROUP 2>/dev/null || true)"
 SUBSCRIPTION_ID="$(azd env get-value AZURE_SUBSCRIPTION_ID 2>/dev/null || true)"
+
+# If already logged in, pin Azure CLI context to the azd environment subscription.
+# If not logged in, preflight check 1 will provide the auth guidance.
+if [[ -n "$SUBSCRIPTION_ID" ]]; then
+  CURRENT_SUB="$(az account show --query id -o tsv 2>/dev/null || true)"
+  if [[ -n "$CURRENT_SUB" ]]; then
+    if ! az account set --subscription "$SUBSCRIPTION_ID" >/dev/null 2>&1; then
+      echo "❌ Failed to switch Azure CLI context to subscription '$SUBSCRIPTION_ID'. Verify access and re-run." >&2
+      exit 1
+    fi
+
+    ACTIVE_SUB="$(az account show --query id -o tsv 2>/dev/null || true)"
+    if [[ -z "$ACTIVE_SUB" || "$ACTIVE_SUB" != "$SUBSCRIPTION_ID" ]]; then
+      echo "❌ Azure CLI active subscription '$ACTIVE_SUB' does not match AZURE_SUBSCRIPTION_ID '$SUBSCRIPTION_ID'." >&2
+      exit 1
+    fi
+  fi
+fi
+
 TENANT_ID="$(az account show --query tenantId -o tsv 2>/dev/null || true)"
 if [[ -z "$TENANT_ID" ]]; then
   TENANT_ID="$(azd env get-value AZURE_TENANT_ID 2>/dev/null || true)"
diff --git a/infra/scripts/docker-build.ps1 b/infra/scripts/docker-build.ps1
@@ -61,12 +61,19 @@ function Ensure-AzLogin {
             exit 1
         }
 
-        # Set Azure subscription
-        az account set --subscription "$AZURE_SUBSCRIPTION_ID"
-        if ($LASTEXITCODE -ne 0) {
-            Write-Error "Failed to set Azure subscription."
-            exit 1
-        }
+    }
+
+    # Always pin the Azure CLI context to the azd environment subscription.
+    az account set --subscription "$AZURE_SUBSCRIPTION_ID"
+    if ($LASTEXITCODE -ne 0) {
+        Write-Error "Failed to set Azure subscription to '$AZURE_SUBSCRIPTION_ID'."
+        exit 1
+    }
+
+    $activeSubscriptionId = az account show --query id -o tsv --only-show-errors 2>$null
+    if (-not $activeSubscriptionId -or $activeSubscriptionId -ne $AZURE_SUBSCRIPTION_ID) {
+        Write-Error "Azure CLI active subscription '$activeSubscriptionId' does not match AZURE_SUBSCRIPTION_ID '$AZURE_SUBSCRIPTION_ID'."
+        exit 1
     }
 }
 
diff --git a/infra/scripts/docker-build.sh b/infra/scripts/docker-build.sh
@@ -55,7 +55,17 @@ echo "Checking Azure login status..."
 if ! az account show --only-show-errors &>/dev/null; then
     echo "No active Azure session found. Logging in..."
     az login --only-show-errors
-    az account set --subscription "$AZURE_SUBSCRIPTION_ID"
+fi
+
+if ! az account set --subscription "$AZURE_SUBSCRIPTION_ID" >/dev/null 2>&1; then
+    echo "❌ Failed to set Azure subscription to '$AZURE_SUBSCRIPTION_ID'." >&2
+    exit 1
+fi
+
+ACTIVE_SUBSCRIPTION_ID=$(az account show --query id -o tsv --only-show-errors 2>/dev/null || true)
+if [ -z "$ACTIVE_SUBSCRIPTION_ID" ] || [ "$ACTIVE_SUBSCRIPTION_ID" != "$AZURE_SUBSCRIPTION_ID" ]; then
+    echo "❌ Azure CLI active subscription '$ACTIVE_SUBSCRIPTION_ID' does not match AZURE_SUBSCRIPTION_ID '$AZURE_SUBSCRIPTION_ID'." >&2
+    exit 1
 fi
 
 # Deploy container registry
diff --git a/infra/scripts/post_deployment.ps1 b/infra/scripts/post_deployment.ps1
@@ -16,6 +16,23 @@ $CONTAINER_WORKFLOW_APP_NAME = azd env get-value CONTAINER_WORKFLOW_APP_NAME
 $SUBSCRIPTION_ID = azd env get-value AZURE_SUBSCRIPTION_ID
 $RESOURCE_GROUP = azd env get-value AZURE_RESOURCE_GROUP
 
+# If already logged in, pin Azure CLI context to the azd environment subscription.
+# If not logged in, the az command that needs auth will surface the login guidance.
+if ($SUBSCRIPTION_ID) {
+    $CurrentSub = (az account show --query id -o tsv 2>$null)
+    if ($CurrentSub) {
+        az account set --subscription $SUBSCRIPTION_ID 2>$null
+        if ($LASTEXITCODE -ne 0) {
+            throw "Failed to switch Azure CLI context to subscription '$SUBSCRIPTION_ID'. Verify access and re-run."
+        }
+
+        $ActiveSub = (az account show --query id -o tsv 2>$null)
+        if (-not $ActiveSub -or $ActiveSub -ne $SUBSCRIPTION_ID) {
+            throw "Azure CLI active subscription '$ActiveSub' does not match AZURE_SUBSCRIPTION_ID '$SUBSCRIPTION_ID'."
+        }
+    }
+}
+
 # Construct Azure Portal URLs
 $WEB_APP_PORTAL_URL = "https://portal.azure.com/#resource/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP/providers/Microsoft.App/containerApps/$CONTAINER_WEB_APP_NAME"
 $API_APP_PORTAL_URL = "https://portal.azure.com/#resource/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP/providers/Microsoft.App/containerApps/$CONTAINER_API_APP_NAME"
@@ -412,6 +429,31 @@ if (-not $ApiReady) {
     }
 }
 
+# --- Refresh Content Understanding Cognitive Services account ---
+Write-Host ""
+Write-Host ("=" * 60)
+Write-Host "Refreshing Content Understanding Cognitive Services account..."
+Write-Host ("=" * 60)
+
+$CuAccountName = azd env get-value CONTENT_UNDERSTANDING_ACCOUNT_NAME 2>$null
+
+if (-not $CuAccountName) {
+    Write-Host "  ⚠️ CONTENT_UNDERSTANDING_ACCOUNT_NAME not found in azd env. Skipping refresh."
+} else {
+    Write-Host "  Refreshing account: $CuAccountName in resource group: $RESOURCE_GROUP"
+    az cognitiveservices account update `
+        -g $RESOURCE_GROUP `
+        -n $CuAccountName `
+        --tags refresh=true `
+        --output none
+
+    if ($LASTEXITCODE -eq 0) {
+        Write-Host "  ✅ Successfully refreshed Cognitive Services account '$CuAccountName'."
+    } else {
+        Write-Host "  ❌ Failed to refresh Cognitive Services account '$CuAccountName'."
+    }
+}
+
 Write-Host ""
 Write-Host ("=" * 60)
 Write-Host "Post-deployment data setup completed."
diff --git a/infra/scripts/post_deployment.sh b/infra/scripts/post_deployment.sh
@@ -18,6 +18,24 @@ CONTAINER_WORKFLOW_APP_NAME=$(azd env get-value CONTAINER_WORKFLOW_APP_NAME)
 SUBSCRIPTION_ID=$(azd env get-value AZURE_SUBSCRIPTION_ID)
 RESOURCE_GROUP=$(azd env get-value AZURE_RESOURCE_GROUP)
 
+# If already logged in, pin Azure CLI context to the azd environment subscription.
+# If not logged in, the az command that needs auth will surface the login guidance.
+if [ -n "$SUBSCRIPTION_ID" ]; then
+  CURRENT_SUB=$(az account show --query id -o tsv 2>/dev/null || true)
+  if [ -n "$CURRENT_SUB" ]; then
+    if ! az account set --subscription "$SUBSCRIPTION_ID" >/dev/null 2>&1; then
+      echo "❌ Failed to switch Azure CLI context to subscription '$SUBSCRIPTION_ID'. Verify access and re-run." >&2
+      exit 1
+    fi
+
+    ACTIVE_SUB=$(az account show --query id -o tsv 2>/dev/null || true)
+    if [ -z "$ACTIVE_SUB" ] || [ "$ACTIVE_SUB" != "$SUBSCRIPTION_ID" ]; then
+      echo "❌ Azure CLI active subscription '$ACTIVE_SUB' does not match AZURE_SUBSCRIPTION_ID '$SUBSCRIPTION_ID'." >&2
+      exit 1
+    fi
+  fi
+fi
+
 # Construct Azure Portal URLs
 WEB_APP_PORTAL_URL="https://portal.azure.com/#resource/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP/providers/Microsoft.App/containerApps/$CONTAINER_WEB_APP_NAME"
 API_APP_PORTAL_URL="https://portal.azure.com/#resource/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP/providers/Microsoft.App/containerApps/$CONTAINER_API_APP_NAME"
@@ -32,7 +50,7 @@ echo "  🔗 Web App Portal URL: $WEB_APP_PORTAL_URL"
 echo "  🔗 API App Portal URL: $API_APP_PORTAL_URL"
 
 # Get the directory where this script is located
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SCRIPT_DIR="${ORIGINAL_SCRIPT_DIR:-$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)}"
 
 # Go from infra/scripts → root → src
 DATA_SCRIPT_PATH="$SCRIPT_DIR/../../src/ContentProcessorAPI/samples/schemas"
diff --git a/infra/scripts/register_schemas.sh b/infra/scripts/register_schemas.sh
@@ -1,7 +1,15 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SCRIPT_DIR="${ORIGINAL_SCRIPT_DIR:-$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)}"
+tmp_file=""
+cleanup() {
+  if [[ -n "$tmp_file" ]]; then
+    rm -f "$tmp_file" || true
+  fi
+}
+trap cleanup EXIT
+
 if ! tmp_file="$(mktemp "${TMPDIR:-/tmp}/cpsa-schema.XXXXXX" 2>/dev/null)"; then
   tmp_file="$(mktemp -t cpsa-schema.XXXXXX 2>/dev/null)" || {
     echo "Failed to create temp file" >&2
@@ -13,7 +21,5 @@ if ! tr -d '\r' < "$SCRIPT_DIR/post_deployment.sh" > "$tmp_file"; then
   echo "Failed to normalize line endings for: $SCRIPT_DIR/post_deployment.sh" >&2
   exit 1
 fi
-mv "$tmp_file" "$SCRIPT_DIR/post_deployment.sh"
-chmod +x "$SCRIPT_DIR/post_deployment.sh"
-
-POST_DEPLOYMENT_MODE=schema bash "$SCRIPT_DIR/post_deployment.sh"
+chmod +x "$tmp_file"
+ORIGINAL_SCRIPT_DIR="$SCRIPT_DIR" POST_DEPLOYMENT_MODE=schema bash "$tmp_file"
diff --git a/infra/scripts/run_post_deployment.sh b/infra/scripts/run_post_deployment.sh
@@ -64,7 +64,8 @@ normalize_line_endings() {
     echo "  ❌ Failed to normalize line endings for: $script_file" >&2
     exit 1
   fi
-  mv "$tmp_file" "$script_file"
+  chmod +x "$tmp_file"
+  echo "$tmp_file"
 }
 
 print_banner
@@ -101,11 +102,11 @@ else
     exit 1
   fi
 
-  normalize_line_endings "$STEP1_SCRIPT"
-  chmod +x "$STEP1_SCRIPT"
+  STEP1_RUNNER="$(normalize_line_endings "$STEP1_SCRIPT")"
 
   STEP1_EXIT=0
-  bash "$STEP1_SCRIPT" || STEP1_EXIT=$?
+  ORIGINAL_SCRIPT_DIR="$SCRIPT_DIR" bash "$STEP1_RUNNER" || STEP1_EXIT=$?
+  rm -f "$STEP1_RUNNER"
 
   if [[ $STEP1_EXIT -eq 0 ]]; then
     step_ok 1
@@ -132,11 +133,11 @@ else
     exit 1
   fi
 
-  normalize_line_endings "$STEP2_SCRIPT"
-  chmod +x "$STEP2_SCRIPT"
+  STEP2_RUNNER="$(normalize_line_endings "$STEP2_SCRIPT")"
 
   STEP2_EXIT=0
-  bash "$STEP2_SCRIPT" || STEP2_EXIT=$?
+  ORIGINAL_SCRIPT_DIR="$SCRIPT_DIR" bash "$STEP2_RUNNER" || STEP2_EXIT=$?
+  rm -f "$STEP2_RUNNER"
 
   if [[ $STEP2_EXIT -eq 0 ]]; then
     step_ok 2
@@ -179,11 +180,11 @@ else
     exit 1
   fi
 
-  normalize_line_endings "$STEP3_SCRIPT"
-  chmod +x "$STEP3_SCRIPT"
+  STEP3_RUNNER="$(normalize_line_endings "$STEP3_SCRIPT")"
 
   STEP3_EXIT=0
-  bash "$STEP3_SCRIPT" || STEP3_EXIT=$?
+  ORIGINAL_SCRIPT_DIR="$SCRIPT_DIR" bash "$STEP3_RUNNER" || STEP3_EXIT=$?
+  rm -f "$STEP3_RUNNER"
 
   if [[ $STEP3_EXIT -eq 0 ]]; then
     step_ok 3
diff --git a/infra/scripts/setup_auth.sh b/infra/scripts/setup_auth.sh
@@ -1,7 +1,15 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SCRIPT_DIR="${ORIGINAL_SCRIPT_DIR:-$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)}"
+tmp_file=""
+cleanup() {
+  if [[ -n "$tmp_file" ]]; then
+    rm -f "$tmp_file" || true
+  fi
+}
+trap cleanup EXIT
+
 if ! tmp_file="$(mktemp "${TMPDIR:-/tmp}/cpsa-auth.XXXXXX" 2>/dev/null)"; then
   tmp_file="$(mktemp -t cpsa-auth.XXXXXX 2>/dev/null)" || {
     echo "Failed to create temp file" >&2
@@ -13,7 +21,5 @@ if ! tr -d '\r' < "$SCRIPT_DIR/configure_auth.sh" > "$tmp_file"; then
   echo "Failed to normalize line endings for: $SCRIPT_DIR/configure_auth.sh" >&2
   exit 1
 fi
-mv "$tmp_file" "$SCRIPT_DIR/configure_auth.sh"
-chmod +x "$SCRIPT_DIR/configure_auth.sh"
-
-bash "$SCRIPT_DIR/configure_auth.sh" "$@"
+chmod +x "$tmp_file"
+ORIGINAL_SCRIPT_DIR="$SCRIPT_DIR" bash "$tmp_file" "$@"
diff --git a/infra/scripts/upload_sample_data.sh b/infra/scripts/upload_sample_data.sh
@@ -1,7 +1,15 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SCRIPT_DIR="${ORIGINAL_SCRIPT_DIR:-$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)}"
+tmp_file=""
+cleanup() {
+  if [[ -n "$tmp_file" ]]; then
+    rm -f "$tmp_file" || true
+  fi
+}
+trap cleanup EXIT
+
 if ! tmp_file="$(mktemp "${TMPDIR:-/tmp}/cpsa-sample.XXXXXX" 2>/dev/null)"; then
   tmp_file="$(mktemp -t cpsa-sample.XXXXXX 2>/dev/null)" || {
     echo "Failed to create temp file" >&2
@@ -13,7 +21,5 @@ if ! tr -d '\r' < "$SCRIPT_DIR/post_deployment.sh" > "$tmp_file"; then
   echo "Failed to normalize line endings for: $SCRIPT_DIR/post_deployment.sh" >&2
   exit 1
 fi
-mv "$tmp_file" "$SCRIPT_DIR/post_deployment.sh"
-chmod +x "$SCRIPT_DIR/post_deployment.sh"
-
-POST_DEPLOYMENT_MODE=sample-data bash "$SCRIPT_DIR/post_deployment.sh"
+chmod +x "$tmp_file"
+ORIGINAL_SCRIPT_DIR="$SCRIPT_DIR" POST_DEPLOYMENT_MODE=sample-data bash "$tmp_file"
