chore: Dev to Main

[Vamshi-Microsoft]

Purpose

This pull request introduces a fully automated script for configuring Microsoft Entra ID (Easy Auth) authentication for the deployed API and Web container apps. The documentation has been updated to recommend this script as the primary method for authentication setup, replacing the manual portal steps. The script ensures secure post-deployment configuration, minimizes manual error, and improves reproducibility. It is designed to be idempotent and supports both new and existing app registrations.

The most important changes are:

Authentication Automation

• Added infra/scripts/configure_app_authentication.ps1, a comprehensive PowerShell script that automates all steps required to configure authentication for API and Web container apps, including app registrations, scope exposure, permission grants, Easy Auth setup, and environment variable updates. The script is idempotent and can reuse existing registrations if client IDs are provided.

Documentation Updates

• Updated docs/ConfigureAppAuthentication.md to recommend and document the new automated script, including usage instructions, options for reusing app registrations, and notes on required permissions and admin consent. The manual portal steps are now fallback guidance.
• Updated docs/DeploymentGuide.md to clarify the deployment flow: the schema registration script should be run before authentication is configured, and the new script should be run immediately after as a required manual step. Instructions for both PowerShell and Bash are provided, and the authentication step is now clearly marked as mandatory. [1] [2]

Security Improvements

• The script configures the API to return HTTP 401 for unauthenticated callers (fail closed), closing the window where the API is externally accessible without authentication after deployment.

Idempotency and Reusability

• Both the script and documentation support reusing existing app registrations by passing client IDs, making repeated deployments safer and more flexible. [1] [2]

These changes significantly streamline and secure the authentication configuration process for Azure deployments.

Does this introduce a breaking change?

• Yes
• No

Golden Path Validation

• I have tested the primary workflows (the "golden path") to ensure they function correctly without errors.

Deployment Validation

• I have validated the deployment process successfully and all services are running as expected with this change.

What to Check

Verify that the following are valid

• ...

Other Information

[Copilot]

Copilot review overview

🟡 Changes recommended

Authentication allowlisting, readiness checks, reused-registration handling, and PowerShell error propagation contain blocking reliability issues.

Review effort: Balanced
Findings: 5

Open (5)

• Native Azure CLI failures are not checked in PowerShell · New
• Identifier URI update removes existing registration URIs · New
• Identifier URI update removes existing registration URIs · New
• Startup probe omits Schemas and Cosmos DB readiness checks · New
• Startup probe omits Schemas and Cosmos DB readiness checks · New

What changed in this PR

Automates post-deployment Entra ID authentication and updates authenticated tooling and dependencies.

Changes:

• Adds Bash and PowerShell Easy Auth configuration scripts.
• Adds bearer-token support to deployment and upload scripts.
• Updates deployment documentation and web dependency overrides.

File	Description
infra/​scripts/​configure_app_authentication.sh	Adds Bash authentication automation.
infra/​scripts/​configure_app_authentication.ps1	Adds PowerShell authentication automation.
infra/​scripts/​post_deployment.sh	Authenticates schema registration requests.
infra/​scripts/​post_deployment.ps1	Authenticates schema registration requests.
src/​ContentProcessorAPI/​samples/​upload_files.sh	Supports bearer-token uploads.
src/​ContentProcessorAPI/​samples/​upload_files.ps1	Supports bearer-token uploads.
docs/​ConfigureAppAuthentication.md	Documents automated configuration.
docs/​DeploymentGuide.md	Adds mandatory authentication step.
src/​ContentProcessorWeb/​package.json	Updates dependency overrides.
src/​ContentProcessorWeb/​pnpm-lock.yaml	Synchronizes resolved dependencies.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.