validate.sh

#!/bin/bash

# =============================================================================
# Container Apps Guestbook - Validation Script
#
# Verifies that all Azure resources were deployed successfully and exercises
# the Container Apps surface: environment, app properties, secrets, revisions,
# replicas, the live HTTP ingress, and a revision update.
# =============================================================================

# Where curl discards a response body. Git Bash and MSYS2 shells hand a Windows curl /dev/null
# unchanged when MSYS_NO_PATHCONV=1 is set, as the README asks, and it cannot open that path, so it
# gets the NUL device instead; MSYS2's own curl, under /usr/bin, opens /dev/null as on Linux and macOS.
null_device() {
	if command -v cygpath >/dev/null 2>&1 && [[ "$(command -v curl)" != /usr/bin/* ]]; then
		echo NUL
	else
		echo /dev/null
	fi
}

# Variables (must match deploy.sh)
PREFIX="${PREFIX:-local}"
LOCATION='eastus'
RESOURCE_GROUP_NAME="${PREFIX}-aca-rg"
STORAGE_ACCOUNT_NAME="${PREFIX}acastorage"
BLOB_CONTAINER_NAME="guestbook"
ACR_NAME="${PREFIX}acaacr"
ACA_ENV_NAME="${PREFIX}-aca-env"
ACA_APP_NAME="${PREFIX}-aca-guestbook"
MANAGED_IDENTITY_TYPE="${MANAGED_IDENTITY_TYPE:-None}"
MANAGED_IDENTITY_NAME="${PREFIX}-aca-identity"
STORAGE_ROLE="Storage Blob Data Contributor"

PASS_COUNT=0
FAIL_COUNT=0

check() {
	local description="$1"
	local command="$2"

	echo -n "  Checking $description... "
	eval "$command" &>/dev/null
	if [ $? -eq 0 ]; then
		echo "OK"
		PASS_COUNT=$((PASS_COUNT + 1))
	else
		echo "FAIL"
		FAIL_COUNT=$((FAIL_COUNT + 1))
	fi
}

check_output() {
	local description="$1"
	local command="$2"
	local expected="$3"

	echo -n "  Checking $description... "
	OUTPUT=$(eval "$command" 2>/dev/null)
	if echo "$OUTPUT" | grep -q "$expected"; then
		echo "OK"
		PASS_COUNT=$((PASS_COUNT + 1))
	else
		echo "FAIL (expected '$expected')"
		FAIL_COUNT=$((FAIL_COUNT + 1))
	fi
}

echo "============================================================"
echo "Validating Container Apps Guestbook Deployment"
echo "============================================================"
echo ""

# =============================================================================
# Part 1: Infrastructure Resources
# =============================================================================
echo "--- Part 1: Infrastructure Resources ---"
echo ""

# 1. Resource Group
echo "[1/5] Resource Group"
check "resource group exists" "az group show --name $RESOURCE_GROUP_NAME"
echo ""

# 2. Storage Account
echo "[2/5] Storage Account"
check "storage account exists" "az storage account show --name $STORAGE_ACCOUNT_NAME --resource-group $RESOURCE_GROUP_NAME"
echo ""

# 3. Container Registry
echo "[3/5] Container Registry"
check "ACR exists" "az acr show --name $ACR_NAME --resource-group $RESOURCE_GROUP_NAME"
echo ""

# 4. Container Apps Environment
echo "[4/5] Container Apps Environment"
check "environment exists" "az containerapp env show --name $ACA_ENV_NAME --resource-group $RESOURCE_GROUP_NAME"
check_output "environment is provisioned" \
	"az containerapp env show --name $ACA_ENV_NAME --resource-group $RESOURCE_GROUP_NAME --query 'properties.provisioningState' --output tsv" \
	"Succeeded"
echo ""

# 5. Container App
echo "[5/5] Container App"
check "container app exists" "az containerapp show --name $ACA_APP_NAME --resource-group $RESOURCE_GROUP_NAME"
check_output "app is provisioned" \
	"az containerapp show --name $ACA_APP_NAME --resource-group $RESOURCE_GROUP_NAME --query 'properties.provisioningState' --output tsv" \
	"Succeeded"
check_output "app is running" \
	"az containerapp show --name $ACA_APP_NAME --resource-group $RESOURCE_GROUP_NAME --query 'properties.runningStatus' --output tsv" \
	"Running"
echo ""

# =============================================================================
# Part 2: Container App Configuration
# =============================================================================
echo "--- Part 2: Container App Configuration ---"
echo ""

APP_SHOW="az containerapp show --name $ACA_APP_NAME --resource-group $RESOURCE_GROUP_NAME"

# 6. Ingress
echo "[6] Ingress"
FQDN=$(eval "$APP_SHOW --query 'properties.configuration.ingress.fqdn' --output tsv" 2>/dev/null)
echo -n "  Checking ingress FQDN is set... "
if [ -n "$FQDN" ]; then
	echo "OK ($FQDN)"
	PASS_COUNT=$((PASS_COUNT + 1))
else
	echo "FAIL"
	FAIL_COUNT=$((FAIL_COUNT + 1))
fi
check_output "ingress is external" \
	"$APP_SHOW --query 'properties.configuration.ingress.external' --output tsv" \
	"true"
check_output "target port is 8080" \
	"$APP_SHOW --query 'properties.configuration.ingress.targetPort' --output tsv" \
	"8080"
echo ""

# 7. Storage access: a secret-backed connection string, or a managed identity
if [[ $MANAGED_IDENTITY_TYPE == "None" ]]; then
	echo "[7] Secrets"
	check_output "secret [storage-conn] exists" \
		"az containerapp secret list --name $ACA_APP_NAME --resource-group $RESOURCE_GROUP_NAME --query '[].name' --output tsv" \
		"storage-conn"
	check_output "secret value is readable" \
		"az containerapp secret show --name $ACA_APP_NAME --resource-group $RESOURCE_GROUP_NAME --secret-name storage-conn --query 'value' --output tsv" \
		"AccountName=${STORAGE_ACCOUNT_NAME}"
	check_output "env var is wired to the secret" \
		"$APP_SHOW --query \"properties.template.containers[0].env[?name=='AZURE_STORAGE_CONNECTION_STRING'].secretRef | [0]\" --output tsv" \
		"storage-conn"
else
	echo "[7] Managed Identity ($MANAGED_IDENTITY_TYPE)"
	check_output "identity type is $MANAGED_IDENTITY_TYPE" \
		"$APP_SHOW --query 'identity.type' --output tsv" \
		"^${MANAGED_IDENTITY_TYPE}$"
	if [[ $MANAGED_IDENTITY_TYPE == "SystemAssigned" ]]; then
		PRINCIPAL_ID=$(eval "$APP_SHOW --query 'identity.principalId' --output tsv" 2>/dev/null)
	else
		PRINCIPAL_ID=$(az identity show --name "$MANAGED_IDENTITY_NAME" --resource-group "$RESOURCE_GROUP_NAME" --query 'principalId' --output tsv 2>/dev/null)
		CLIENT_ID=$(az identity show --name "$MANAGED_IDENTITY_NAME" --resource-group "$RESOURCE_GROUP_NAME" --query 'clientId' --output tsv 2>/dev/null)
		check_output "identity [$MANAGED_IDENTITY_NAME] is attached to the app" \
			"$APP_SHOW --query 'keys(identity.userAssignedIdentities)' --output tsv" \
			"$MANAGED_IDENTITY_NAME"
		check_output "AZURE_CLIENT_ID selects the identity" \
			"$APP_SHOW --query \"properties.template.containers[0].env[?name=='AZURE_CLIENT_ID'].value | [0]\" --output tsv" \
			"^${CLIENT_ID:-missing}$"
	fi
	echo -n "  Checking principal ID is set... "
	if [ -n "$PRINCIPAL_ID" ]; then
		echo "OK ($PRINCIPAL_ID)"
		PASS_COUNT=$((PASS_COUNT + 1))
	else
		echo "FAIL"
		FAIL_COUNT=$((FAIL_COUNT + 1))
	fi
	STORAGE_ACCOUNT_ID=$(az storage account show --name $STORAGE_ACCOUNT_NAME --resource-group $RESOURCE_GROUP_NAME --query 'id' --output tsv 2>/dev/null)
	check_output "identity has [$STORAGE_ROLE] on the storage account" \
		"az role assignment list --assignee-object-id ${PRINCIPAL_ID:-missing} --scope $STORAGE_ACCOUNT_ID --query '[].roleDefinitionName' --output tsv" \
		"$STORAGE_ROLE"
	check_output "env var carries the blob endpoint" \
		"$APP_SHOW --query \"properties.template.containers[0].env[?name=='AZURE_STORAGE_ACCOUNT_URL'].value | [0]\" --output tsv" \
		"^https://"
	check_output "no storage secret is configured" \
		"az containerapp secret list --name $ACA_APP_NAME --resource-group $RESOURCE_GROUP_NAME --query \"length([?name=='storage-conn'])\" --output tsv" \
		"^0$"
fi
echo ""

# 8. Scale
echo "[8] Scale"
check_output "min replicas is 1" \
	"$APP_SHOW --query 'properties.template.scale.minReplicas' --output tsv" \
	"1"
check_output "max replicas is 3" \
	"$APP_SHOW --query 'properties.template.scale.maxReplicas' --output tsv" \
	"3"
check_output "http scale rule is set" \
	"$APP_SHOW --query 'properties.template.scale.rules[0].name' --output tsv" \
	"http-scale"
echo ""

# =============================================================================
# Part 3: Revisions and Replicas
# =============================================================================
echo "--- Part 3: Revisions and Replicas ---"
echo ""

# 9. Revisions
echo "[9] Revisions"
check_output "revision v1 exists" \
	"az containerapp revision list --name $ACA_APP_NAME --resource-group $RESOURCE_GROUP_NAME --query '[].name' --output tsv" \
	"${ACA_APP_NAME}--v1"
LATEST_REVISION=$(eval "$APP_SHOW --query 'properties.latestRevisionName' --output tsv" 2>/dev/null)
echo "  Latest revision: $LATEST_REVISION"
echo ""

# 10. Replicas
echo "[10] Replicas"
echo -n "  Checking a replica is running... "
REPLICA_NAME=""
for i in $(seq 1 20); do
	REPLICA_NAME=$(az containerapp replica list \
		--name "$ACA_APP_NAME" \
		--resource-group "$RESOURCE_GROUP_NAME" \
		--revision "$LATEST_REVISION" \
		--query "[0].name" --output tsv 2>/dev/null)
	if [ -n "$REPLICA_NAME" ]; then
		break
	fi
	sleep 3
done
if [ -n "$REPLICA_NAME" ]; then
	echo "OK ($REPLICA_NAME)"
	PASS_COUNT=$((PASS_COUNT + 1))
else
	echo "FAIL"
	FAIL_COUNT=$((FAIL_COUNT + 1))
fi
echo ""

# =============================================================================
# Part 4: HTTP Ingress (live app)
# =============================================================================
echo "--- Part 4: HTTP Ingress ---"
echo ""

# On LocalStack the FQDN resolves to 127.0.0.1 and the ingress listens on the
# gateway port; on real Azure the app is served on 443.
if [[ "$FQDN" == *"localhost.localstack.cloud" ]]; then
	APP_URL="http://${FQDN}:4566"
else
	APP_URL="https://${FQDN}"
fi
echo "App URL: $APP_URL"

# 11. Health endpoint (wait for the app to come up; the image may still be pulling)
echo "[11] Health Endpoint"
echo -n "  Waiting for /health to answer... "
HEALTH=""
for i in $(seq 1 30); do
	HEALTH=$(curl -s --max-time 5 "$APP_URL/health" 2>/dev/null)
	if echo "$HEALTH" | grep -q "healthy"; then
		break
	fi
	sleep 3
done
if echo "$HEALTH" | grep -q "healthy"; then
	echo "OK"
	PASS_COUNT=$((PASS_COUNT + 1))
else
	echo "FAIL (no healthy response from $APP_URL/health)"
	FAIL_COUNT=$((FAIL_COUNT + 1))
fi
check_output "storage is configured in the app" \
	"curl -s --max-time 5 $APP_URL/health" \
	'"storage_configured": *true'
if [[ $MANAGED_IDENTITY_TYPE == "None" ]]; then
	EXPECTED_AUTH_MODE="connection_string"
else
	EXPECTED_AUTH_MODE="managed_identity"
fi
check_output "app authenticates with $EXPECTED_AUTH_MODE" \
	"curl -s --max-time 5 $APP_URL/health" \
	"\"auth_mode\": *\"$EXPECTED_AUTH_MODE\""
echo ""

# 12. Guestbook round trip (POST an entry, read it back). The app answers the
# POST with a redirect even when the write fails, so with a managed identity the
# entry is posted again until it is served back: on Azure a role granted to the
# identity can take up to 10 minutes to take effect.
echo "[12] Guestbook Round Trip"
ENTRY_AUTHOR="validate-sh"
ENTRY_MESSAGE="Hello from validate.sh at $(date +%s)"
echo -n "  Posting a guestbook entry... "
HTTP_CODE=$(curl -s -o "$(null_device)" -w "%{http_code}" --max-time 10 \
	-X POST "$APP_URL/" \
	--data-urlencode "author=$ENTRY_AUTHOR" \
	--data-urlencode "message=$ENTRY_MESSAGE" 2>/dev/null)
if [[ "$HTTP_CODE" == "302" || "$HTTP_CODE" == "200" ]]; then
	echo "OK (HTTP $HTTP_CODE)"
	PASS_COUNT=$((PASS_COUNT + 1))
else
	echo "FAIL (HTTP $HTTP_CODE)"
	FAIL_COUNT=$((FAIL_COUNT + 1))
fi
echo -n "  Checking entry is served back from Blob Storage... "
if [[ $MANAGED_IDENTITY_TYPE != "None" ]]; then
	for i in $(seq 1 60); do
		if curl -s --max-time 10 "$APP_URL/" 2>/dev/null | grep -q "$ENTRY_MESSAGE"; then
			break
		fi
		sleep 10
		curl -s -o /dev/null --max-time 10 -X POST "$APP_URL/" \
			--data-urlencode "author=$ENTRY_AUTHOR" \
			--data-urlencode "message=$ENTRY_MESSAGE" 2>/dev/null
	done
fi
if curl -s --max-time 10 "$APP_URL/" 2>/dev/null | grep -q "$ENTRY_MESSAGE"; then
	echo "OK"
	PASS_COUNT=$((PASS_COUNT + 1))
else
	echo "FAIL"
	FAIL_COUNT=$((FAIL_COUNT + 1))
fi
echo ""

# =============================================================================
# Part 5: Revision Update
# =============================================================================
echo "--- Part 5: Revision Update ---"
echo ""

# 13. Roll out a new revision (v2) with an updated APP_REVISION env var.
# The secretref is re-stated alongside the changed var so the update payload
# carries the secret wiring explicitly rather than relying on the CLI's
# read-modify-write merge of the env list. A managed-identity app has no secret
# to re-state.
echo "[13] Revision Update"
echo -n "  Rolling out revision v2... "
if [[ $MANAGED_IDENTITY_TYPE == "None" ]]; then
	REVISION_ENV_VARS=(APP_REVISION=v2 AZURE_STORAGE_CONNECTION_STRING=secretref:storage-conn)
else
	REVISION_ENV_VARS=(APP_REVISION=v2)
fi
az containerapp update \
	--name "$ACA_APP_NAME" \
	--resource-group "$RESOURCE_GROUP_NAME" \
	--revision-suffix v2 \
	--set-env-vars "${REVISION_ENV_VARS[@]}" \
	--only-show-errors 1>/dev/null 2>&1

if [ $? -eq 0 ]; then
	echo "OK"
	PASS_COUNT=$((PASS_COUNT + 1))
else
	echo "FAIL"
	FAIL_COUNT=$((FAIL_COUNT + 1))
fi

check_output "revision v2 exists" \
	"az containerapp revision list --name $ACA_APP_NAME --resource-group $RESOURCE_GROUP_NAME --query '[].name' --output tsv" \
	"${ACA_APP_NAME}--v2"
check_output "latest revision is v2" \
	"$APP_SHOW --query 'properties.latestRevisionName' --output tsv" \
	"${ACA_APP_NAME}--v2"

# The ingress routes to the latest revision; wait for v2 replicas to serve.
echo -n "  Waiting for revision v2 to serve traffic... "
SERVED_REVISION=""
for i in $(seq 1 30); do
	SERVED_REVISION=$(curl -s --max-time 5 "$APP_URL/health" 2>/dev/null | grep -o '"revision": *"[^"]*"')
	if echo "$SERVED_REVISION" | grep -q "v2"; then
		break
	fi
	sleep 3
done
if echo "$SERVED_REVISION" | grep -q "v2"; then
	echo "OK"
	PASS_COUNT=$((PASS_COUNT + 1))
else
	echo "FAIL (still serving: ${SERVED_REVISION:-no response})"
	FAIL_COUNT=$((FAIL_COUNT + 1))
fi

check_output "entries survive the revision switch" \
	"curl -s --max-time 10 $APP_URL/" \
	"$ENTRY_MESSAGE"
echo ""

# =============================================================================
# Summary
# =============================================================================
echo "============================================================"
echo "Validation Results: $PASS_COUNT passed, $FAIL_COUNT failed"
echo "============================================================"
echo ""
echo "--- App Access ---"
echo "App URL:  $APP_URL"
echo ""

if [ $FAIL_COUNT -eq 0 ]; then
	echo "PASS: All checks passed. Guestbook is running on Azure Container Apps."
	exit 0
else
	echo "FAIL: Some checks failed. Review the output above."
	exit 1
fi