commiting the new changes

Vemarthula-Microsoft · Vemarthula-Microsoft · commit 2b2598e6339c · 2025-07-31T08:36:45.000+05:30
diff --git a/infra/main.bicep b/infra/main.bicep
@@ -807,6 +807,10 @@ module avmContainerApp 'br/public:avm/res/app/container-app:0.17.0' = {
             name: 'APP_CONFIG_ENDPOINT'
             value: ''
           }
+          {
+            name: 'APP_ENV'
+            value: 'prod'
+          }
         ]
       }
     ]
@@ -851,6 +855,10 @@ module avmContainerApp_API 'br/public:avm/res/app/container-app:0.17.0' = {
             name: 'APP_CONFIG_ENDPOINT'
             value: ''
           }
+          {
+            name: 'APP_ENV'
+            value: 'prod'
+          }
         ]
         probes: [
           // Liveness Probe - Checks if the app is still running
@@ -1266,6 +1274,10 @@ module avmContainerApp_update 'br/public:avm/res/app/container-app:0.17.0' = {
             name: 'APP_CONFIG_ENDPOINT'
             value: avmAppConfig.outputs.endpoint
           }
+          {
+            name: 'APP_ENV'
+            value: 'prod'
+          }
         ]
       }
     ]
@@ -1321,6 +1333,10 @@ module avmContainerApp_API_update 'br/public:avm/res/app/container-app:0.17.0' =
             name: 'APP_CONFIG_ENDPOINT'
             value: avmAppConfig.outputs.endpoint
           }
+          {
+            name: 'APP_ENV'
+            value: 'prod'
+          }
         ]
         probes: [
           // Liveness Probe - Checks if the app is still running
diff --git a/src/ContentProcessor/src/helpers/azure_credential_utils.py b/src/ContentProcessor/src/helpers/azure_credential_utils.py
@@ -0,0 +1,44 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+
+import os
+from azure.identity import ManagedIdentityCredential, DefaultAzureCredential
+from azure.identity.aio import ManagedIdentityCredential as AioManagedIdentityCredential, DefaultAzureCredential as AioDefaultAzureCredential
+
+
+async def get_azure_credential_async(client_id=None):
+    """
+    Returns an Azure credential asynchronously based on the application environment.
+    
+    If the environment is 'dev', it uses AioDefaultAzureCredential.
+    Otherwise, it uses AioManagedIdentityCredential.
+    
+    Args:
+        client_id (str, optional): The client ID for the Managed Identity Credential.
+    
+    Returns:
+        Credential object: Either AioDefaultAzureCredential or AioManagedIdentityCredential.
+    """
+    if os.getenv("APP_ENV", "prod").lower() == 'dev':
+        return AioDefaultAzureCredential()  # CodeQL [SM05139] Okay use of DefaultAzureCredential as it is only used in development
+    else:
+        return AioManagedIdentityCredential(client_id=client_id)
+
+
+def get_azure_credential(client_id=None):
+    """
+    Returns an Azure credential based on the application environment.
+    
+    If the environment is 'dev', it uses DefaultAzureCredential.
+    Otherwise, it uses ManagedIdentityCredential.
+    
+    Args:
+        client_id (str, optional): The client ID for the Managed Identity Credential.
+    
+    Returns:
+        Credential object: Either DefaultAzureCredential or ManagedIdentityCredential.
+    """
+    if os.getenv("APP_ENV", "prod").lower() == 'dev':
+        return DefaultAzureCredential()  # CodeQL [SM05139] Okay use of DefaultAzureCredential as it is only used in development
+    else:
+        return ManagedIdentityCredential(client_id=client_id)
diff --git a/src/ContentProcessor/src/libs/application/application_context.py b/src/ContentProcessor/src/libs/application/application_context.py
@@ -1,4 +1,6 @@
-from azure.identity import DefaultAzureCredential
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+from helpers.azure_credential_utils import get_azure_credential
 
 from libs.application.application_configuration import AppConfiguration
 from libs.base.application_models import AppModelBase
@@ -11,10 +13,10 @@ class AppContext(AppModelBase):
     """
 
     configuration: AppConfiguration = None
-    credential: DefaultAzureCredential = None
+    credential: get_azure_credential = None
 
     def set_configuration(self, configuration: AppConfiguration):
         self.configuration = configuration
 
-    def set_credential(self, credential: DefaultAzureCredential):
+    def set_credential(self, credential: get_azure_credential):
         self.credential = credential
diff --git a/src/ContentProcessor/src/libs/azure_helper/app_configuration.py b/src/ContentProcessor/src/libs/azure_helper/app_configuration.py
@@ -1,16 +1,19 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+
 import os
 
 from azure.appconfiguration import AzureAppConfigurationClient
-from azure.identity import DefaultAzureCredential
+from helpers.azure_credential_utils import get_azure_credential
 
 
 class AppConfigurationHelper:
-    credential: DefaultAzureCredential = None
+    credential: get_azure_credential = None
     app_config_endpoint: str = None
     app_config_client: AzureAppConfigurationClient = None
 
     def __init__(self, app_config_endpoint: str):
-        self.credential = DefaultAzureCredential()
+        self.credential = get_azure_credential()
         self.app_config_endpoint = app_config_endpoint
         self._initialize_client()
 
diff --git a/src/ContentProcessor/src/libs/azure_helper/azure_openai.py b/src/ContentProcessor/src/libs/azure_helper/azure_openai.py
@@ -1,9 +1,13 @@
-from azure.identity import DefaultAzureCredential, get_bearer_token_provider
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+
+from azure.identity import get_bearer_token_provider
+from helpers.azure_credential_utils import get_azure_credential
 from openai import AzureOpenAI
 
 
 def get_openai_client(azure_openai_endpoint: str) -> AzureOpenAI:
-    credential = DefaultAzureCredential()
+    credential = get_azure_credential()
     token_provider = get_bearer_token_provider(
         credential, "https://cognitiveservices.azure.com/.default"
     )
diff --git a/src/ContentProcessor/src/libs/azure_helper/content_understanding.py b/src/ContentProcessor/src/libs/azure_helper/content_understanding.py
@@ -7,22 +7,22 @@
 from pathlib import Path
 
 import requests
-from azure.identity import DefaultAzureCredential
+from helpers.azure_credential_utils import get_azure_credential
 from requests.models import Response
 
 COGNITIVE_SERVICES_SCOPE = "https://cognitiveservices.azure.com/.default"
 
 
 class AzureContentUnderstandingHelper:
-    credential: DefaultAzureCredential = None
+    credential: get_azure_credential = None
 
     def __init__(
         self,
         endpoint: str,
         api_version: str = "2024-12-01-preview",
         x_ms_useragent: str = "cps-contentunderstanding/client",
     ):
-        self.credential = DefaultAzureCredential()
+        self.credential = get_azure_credential()
 
         if not api_version:
             raise ValueError("API version must be provided.")
diff --git a/src/ContentProcessor/src/libs/azure_helper/storage_blob.py b/src/ContentProcessor/src/libs/azure_helper/storage_blob.py
@@ -3,20 +3,20 @@
 
 from typing import IO, Union
 
-from azure.identity import DefaultAzureCredential
+from helpers.azure_credential_utils import get_azure_credential
 from azure.storage.blob import BlobServiceClient
 
 
 class StorageBlobHelper:
-    credential: DefaultAzureCredential = None
+    credential: get_azure_credential = None
     blob_service_client: BlobServiceClient = None
 
     @staticmethod
     def get(account_url: str, container_name: str = None):
         return StorageBlobHelper(account_url=account_url, container_name=container_name)
 
     def __init__(self, account_url: str, container_name=None):
-        self.credential = DefaultAzureCredential()
+        self.credential = get_azure_credential()
         self.blob_service_client = BlobServiceClient(
             account_url=account_url, credential=self.credential
         )
diff --git a/src/ContentProcessor/src/libs/pipeline/pipeline_queue_helper.py b/src/ContentProcessor/src/libs/pipeline/pipeline_queue_helper.py
@@ -4,7 +4,7 @@
 import logging
 
 from azure.core.exceptions import ResourceNotFoundError
-from azure.identity import DefaultAzureCredential
+from helpers.azure_credential_utils import get_azure_credential
 from azure.storage.queue import QueueClient, QueueMessage
 
 from libs.pipeline import pipeline_step_helper
@@ -28,7 +28,7 @@ def invalidate_queue(queue_client: QueueClient):
 
 
 def create_or_get_queue_client(
-    queue_name: str, accouont_url: str, credential: DefaultAzureCredential
+    queue_name: str, accouont_url: str, credential: get_azure_credential
 ) -> QueueClient:
     queue_client = QueueClient(
         account_url=accouont_url, queue_name=queue_name, credential=credential
@@ -55,7 +55,7 @@ def has_messages(queue_client: QueueClient) -> bool:
 
 
 def pass_data_pipeline_to_next_step(
-    data_pipeline: DataPipeline, account_url: str, credential: DefaultAzureCredential
+    data_pipeline: DataPipeline, account_url: str, credential: get_azure_credential
 ):
     next_step_name = pipeline_step_helper.get_next_step_name(
         data_pipeline.pipeline_status, data_pipeline.pipeline_status.active_step
@@ -70,7 +70,7 @@ def pass_data_pipeline_to_next_step(
 
 
 def _create_queue_client(
-    account_url: str, queue_name: str, credential: DefaultAzureCredential
+    account_url: str, queue_name: str, credential: get_azure_credential
 ) -> QueueClient:
     queue_client = QueueClient(
         account_url=account_url, queue_name=queue_name, credential=credential
diff --git a/src/ContentProcessor/src/libs/utils/remote_module_loader.py b/src/ContentProcessor/src/libs/utils/remote_module_loader.py
@@ -4,7 +4,7 @@
 import importlib.util
 import sys
 
-from azure.identity import DefaultAzureCredential
+from helpers.azure_credential_utils import get_azure_credential
 from azure.storage.blob import BlobServiceClient
 
 
@@ -27,7 +27,7 @@ def load_schema_from_blob(
 
 def _download_blob_content(container_name, blob_name, account_url):
     # Create the BlobServiceClient object which will be used to create a container client
-    credential = DefaultAzureCredential()
+    credential = get_azure_credential()
     blob_service_client = BlobServiceClient(
         account_url=account_url, credential=credential
     )
diff --git a/src/ContentProcessor/src/main.py b/src/ContentProcessor/src/main.py
@@ -5,7 +5,7 @@
 import os
 import sys
 
-from azure.identity import DefaultAzureCredential
+from helpers.azure_credential_utils import get_azure_credential
 
 from libs.base.application_main import AppMainBase
 from libs.process_host import handler_type_loader
@@ -29,7 +29,7 @@ def __init__(self, **data):
 
     def _initialize_application(self):
         # Add Azure Credential
-        self.application_context.set_credential(DefaultAzureCredential())
+        self.application_context.set_credential(get_azure_credential())
 
     async def run(self, test_mode: bool = False):
         # Get Process lists from the configuration - ex. ["extract", "transform", "evaluate", "save", "custom1", "custom2"....]
diff --git a/src/ContentProcessor/src/tests/helpers/test_azure_credential_utils.py b/src/ContentProcessor/src/tests/helpers/test_azure_credential_utils.py
@@ -0,0 +1,81 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+
+import pytest
+import sys
+import os
+from unittest.mock import patch, MagicMock
+
+# Ensure src directory is on the Python path for imports
+sys.path.insert(0, os.path.abspath(os.path.join(os.path.dirname(__file__), '..', '..')))
+
+import helpers.azure_credential_utils as azure_credential_utils
+
+# Synchronous tests
+
+@patch("helpers.azure_credential_utils.os.getenv")
+@patch("helpers.azure_credential_utils.DefaultAzureCredential")
+@patch("helpers.azure_credential_utils.ManagedIdentityCredential")
+def test_get_azure_credential_dev_env(mock_managed_identity_credential, mock_default_azure_credential, mock_getenv):
+    """Test get_azure_credential in dev environment."""
+    mock_getenv.return_value = "dev"
+    mock_default_credential = MagicMock()
+    mock_default_azure_credential.return_value = mock_default_credential
+
+    credential = azure_credential_utils.get_azure_credential()
+
+    mock_getenv.assert_called_once_with("APP_ENV", "prod")
+    mock_default_azure_credential.assert_called_once()
+    mock_managed_identity_credential.assert_not_called()
+    assert credential == mock_default_credential
+
+@patch("helpers.azure_credential_utils.os.getenv")
+@patch("helpers.azure_credential_utils.DefaultAzureCredential")
+@patch("helpers.azure_credential_utils.ManagedIdentityCredential")
+def test_get_azure_credential_non_dev_env(mock_managed_identity_credential, mock_default_azure_credential, mock_getenv):
+    """Test get_azure_credential in non-dev environment."""
+    mock_getenv.return_value = "prod"
+    mock_managed_credential = MagicMock()
+    mock_managed_identity_credential.return_value = mock_managed_credential
+    credential = azure_credential_utils.get_azure_credential(client_id="test-client-id")
+
+    mock_getenv.assert_called_once_with("APP_ENV", "prod")
+    mock_managed_identity_credential.assert_called_once_with(client_id="test-client-id")
+    mock_default_azure_credential.assert_not_called()
+    assert credential == mock_managed_credential
+
+# Asynchronous tests
+
+@pytest.mark.asyncio
+@patch("helpers.azure_credential_utils.os.getenv")
+@patch("helpers.azure_credential_utils.AioDefaultAzureCredential")
+@patch("helpers.azure_credential_utils.AioManagedIdentityCredential")
+async def test_get_azure_credential_async_dev_env(mock_aio_managed_identity_credential, mock_aio_default_azure_credential, mock_getenv):
+    """Test get_azure_credential_async in dev environment."""
+    mock_getenv.return_value = "dev"
+    mock_aio_default_credential = MagicMock()
+    mock_aio_default_azure_credential.return_value = mock_aio_default_credential
+
+    credential = await azure_credential_utils.get_azure_credential_async()
+
+    mock_getenv.assert_called_once_with("APP_ENV", "prod")
+    mock_aio_default_azure_credential.assert_called_once()
+    mock_aio_managed_identity_credential.assert_not_called()
+    assert credential == mock_aio_default_credential
+
+@pytest.mark.asyncio
+@patch("helpers.azure_credential_utils.os.getenv")
+@patch("helpers.azure_credential_utils.AioDefaultAzureCredential")
+@patch("helpers.azure_credential_utils.AioManagedIdentityCredential")
+async def test_get_azure_credential_async_non_dev_env(mock_aio_managed_identity_credential, mock_aio_default_azure_credential, mock_getenv):
+    """Test get_azure_credential_async in non-dev environment."""
+    mock_getenv.return_value = "prod"
+    mock_aio_managed_credential = MagicMock()
+    mock_aio_managed_identity_credential.return_value = mock_aio_managed_credential
+
+    credential = await azure_credential_utils.get_azure_credential_async(client_id="test-client-id")
+
+    mock_getenv.assert_called_once_with("APP_ENV", "prod")
+    mock_aio_managed_identity_credential.assert_called_once_with(client_id="test-client-id")
+    mock_aio_default_azure_credential.assert_not_called()
+    assert credential == mock_aio_managed_credential
diff --git a/src/ContentProcessorAPI/app/.env.dev b/src/ContentProcessorAPI/app/.env.dev
@@ -0,0 +1,9 @@
+# Development Environment Configuration
+# Set to 'dev' to use DefaultAzureCredential for local development
+# Set to 'prod' to use ManagedIdentityCredential for production deployment
+APP_ENV=dev
+
+# Add other API development configuration here as needed
+# AZURE_STORAGE_ACCOUNT_URL=
+# AZURE_APP_CONFIG_ENDPOINT=
+# API_PORT=8000
diff --git a/src/ContentProcessorAPI/app/libs/app_configuration/helper.py b/src/ContentProcessorAPI/app/libs/app_configuration/helper.py
@@ -4,16 +4,16 @@
 import os
 
 from azure.appconfiguration import AzureAppConfigurationClient
-from azure.identity import DefaultAzureCredential
+from helpers.azure_credential_utils import get_azure_credential
 
 
 class AppConfigurationHelper:
-    credential: DefaultAzureCredential = None
+    credential: get_azure_credential = None
     app_config_endpoint: str = None
     app_config_client: AzureAppConfigurationClient = None
 
     def __init__(self, app_config_endpoint: str):
-        self.credential = DefaultAzureCredential()
+        self.credential = get_azure_credential()
         self.app_config_endpoint = app_config_endpoint
         self._initialize_client()
 
diff --git a/src/ContentProcessorAPI/app/libs/storage_blob/helper.py b/src/ContentProcessorAPI/app/libs/storage_blob/helper.py
@@ -1,13 +1,13 @@
 # Copyright (c) Microsoft Corporation.
 # Licensed under the MIT License.
 
-from azure.identity import DefaultAzureCredential
+from helpers.azure_credential_utils import get_azure_credential
 from azure.storage.blob import BlobServiceClient
 
 
 class StorageBlobHelper:
     def __init__(self, account_url, container_name=None):
-        credential = DefaultAzureCredential()
+        credential = get_azure_credential()
         self.blob_service_client = BlobServiceClient(
             account_url=account_url, credential=credential
         )
diff --git a/src/ContentProcessorAPI/app/libs/storage_queue/helper.py b/src/ContentProcessorAPI/app/libs/storage_queue/helper.py
diff --git a/src/ContentProcessorAPI/helpers/azure_credential_utils.py b/src/ContentProcessorAPI/helpers/azure_credential_utils.py
diff --git a/src/ContentProcessorAPI/tests/helpers/test_azure_credential_utils.py b/src/ContentProcessorAPI/tests/helpers/test_azure_credential_utils.py

Original file line number	Diff line number	Diff line change
`@@ -807,6 +807,10 @@ module avmContainerApp 'br/public:avm/res/app/container-app:0.17.0' = {`
`807`	`807`	`name: 'APP_CONFIG_ENDPOINT'`
`808`	`808`	`value: ''`
`809`	`809`	`}`
	`810`	`+ {`
	`811`	`+ name: 'APP_ENV'`
	`812`	`+ value: 'prod'`
	`813`	`+ }`
`810`	`814`	`]`
`811`	`815`	`}`
`812`	`816`	`]`
`@@ -851,6 +855,10 @@ module avmContainerApp_API 'br/public:avm/res/app/container-app:0.17.0' = {`
`851`	`855`	`name: 'APP_CONFIG_ENDPOINT'`
`852`	`856`	`value: ''`
`853`	`857`	`}`
	`858`	`+ {`
	`859`	`+ name: 'APP_ENV'`
	`860`	`+ value: 'prod'`
	`861`	`+ }`
`854`	`862`	`]`
`855`	`863`	`probes: [`
`856`	`864`	`// Liveness Probe - Checks if the app is still running`
`@@ -1266,6 +1274,10 @@ module avmContainerApp_update 'br/public:avm/res/app/container-app:0.17.0' = {`
`1266`	`1274`	`name: 'APP_CONFIG_ENDPOINT'`
`1267`	`1275`	`value: avmAppConfig.outputs.endpoint`
`1268`	`1276`	`}`
	`1277`	`+ {`
	`1278`	`+ name: 'APP_ENV'`
	`1279`	`+ value: 'prod'`
	`1280`	`+ }`
`1269`	`1281`	`]`
`1270`	`1282`	`}`
`1271`	`1283`	`]`
`@@ -1321,6 +1333,10 @@ module avmContainerApp_API_update 'br/public:avm/res/app/container-app:0.17.0' =`
`1321`	`1333`	`name: 'APP_CONFIG_ENDPOINT'`
`1322`	`1334`	`value: avmAppConfig.outputs.endpoint`
`1323`	`1335`	`}`
	`1336`	`+ {`
	`1337`	`+ name: 'APP_ENV'`
	`1338`	`+ value: 'prod'`
	`1339`	`+ }`
`1324`	`1340`	`]`
`1325`	`1341`	`probes: [`
`1326`	`1342`	`// Liveness Probe - Checks if the app is still running`