Post-Provision.ps1

[CmdletBinding()]
param(
    [Parameter(Mandatory = $false)]
    [string]$ResourceGroupName,

    [Parameter(Mandatory = $false)]
    [string]$TaskAppName,

    [Parameter(Mandatory = $false)]
    [string]$ApiClientId,

    [Parameter(Mandatory = $false)]
    [string]$SqlServerFqdn,

    [Parameter(Mandatory = $false)]
    [string]$DatabaseName,

    [Parameter(Mandatory = $false)]
    [string]$SqlAdminLogin,

    [Parameter(Mandatory = $false)]
    [string]$SqlAdminPassword,

    [Parameter(Mandatory = $false)]
    [string]$ScriptsPath,

    [Parameter(Mandatory = $false)]
    [string]$SubscriptionId,

    [Parameter(Mandatory = $false)]
    [string]$EnvironmentName,

    [Parameter(Mandatory = $false)]
    [string]$AvdHostGroupId,

    [Parameter(Mandatory = $false)]
    [string]$LinuxHostGroupId
)

$ErrorActionPreference = 'Stop'

if ([string]::IsNullOrWhiteSpace($EnvironmentName)) {
    $EnvironmentName = if (-not [string]::IsNullOrWhiteSpace($env:AZURE_ENV_NAME)) {
        $env:AZURE_ENV_NAME
    }
    elseif (-not [string]::IsNullOrWhiteSpace($env:AZURE_ENVIRONMENT_NAME)) {
        $env:AZURE_ENVIRONMENT_NAME
    }
    else {
        throw 'EnvironmentName was not provided and AZURE_ENV_NAME is not set.'
    }
}

function Get-AzdEnvValue {
    param([Parameter(Mandatory = $true)][string]$Key)

    $value = azd env get-value $Key --environment $EnvironmentName 2>$null
    if ($LASTEXITCODE -ne 0) {
        return ''
    }

    return ($value | Out-String).Trim()
}

if ([string]::IsNullOrWhiteSpace($ResourceGroupName)) {
    $ResourceGroupName = Get-AzdEnvValue -Key 'resourceGroupName'
}

if ([string]::IsNullOrWhiteSpace($SubscriptionId)) {
    $SubscriptionId = Get-AzdEnvValue -Key 'AZURE_SUBSCRIPTION_ID'
}

if ([string]::IsNullOrWhiteSpace($SubscriptionId)) {
    $SubscriptionId = $env:AZURE_SUBSCRIPTION_ID
}

if ([string]::IsNullOrWhiteSpace($TaskAppName)) {
    $TaskAppName = Get-AzdEnvValue -Key 'taskAppName'
}

if ([string]::IsNullOrWhiteSpace($ApiClientId)) {
    $ApiClientId = Get-AzdEnvValue -Key 'apiClientId'
}

if ([string]::IsNullOrWhiteSpace($AvdHostGroupId)) {
    $AvdHostGroupId = Get-AzdEnvValue -Key 'avdHostGroupId'
}

if ([string]::IsNullOrWhiteSpace($LinuxHostGroupId)) {
    $LinuxHostGroupId = Get-AzdEnvValue -Key 'linuxHostGroupId'
}

if ([string]::IsNullOrWhiteSpace($DatabaseName)) {
    $DatabaseName = (Get-AzdEnvValue -Key 'sqlDatabaseName')
    if ([string]::IsNullOrWhiteSpace($DatabaseName)) {
        $DatabaseName = Get-AzdEnvValue -Key 'sqlDatabaseName'
    }
}

if ([string]::IsNullOrWhiteSpace($SqlAdminLogin)) {
    $SqlAdminLogin = Get-AzdEnvValue -Key 'sqlAdminLogin'
}

if ([string]::IsNullOrWhiteSpace($SqlAdminPassword)) {
    $SqlAdminPassword = Get-AzdEnvValue -Key 'sqlAdminPassword'
}

if ([string]::IsNullOrWhiteSpace($ScriptsPath)) {
    $ScriptsPath = Join-Path (Split-Path -Parent $PSScriptRoot) 'sql_queries'
}

if (-not [string]::IsNullOrWhiteSpace($SubscriptionId)) {
    az account set --subscription $SubscriptionId | Out-Null
}

if ([string]::IsNullOrWhiteSpace($SqlServerFqdn)) {
    $sqlServerName = Get-AzdEnvValue -Key 'sqlServerName'
    if (-not [string]::IsNullOrWhiteSpace($sqlServerName) -and -not [string]::IsNullOrWhiteSpace($ResourceGroupName)) {
        $SqlServerFqdn = az sql server show --name $sqlServerName --resource-group $ResourceGroupName --query fullyQualifiedDomainName --output tsv
    }
}

if ([string]::IsNullOrWhiteSpace($ResourceGroupName) -or [string]::IsNullOrWhiteSpace($TaskAppName) -or [string]::IsNullOrWhiteSpace($ApiClientId) -or [string]::IsNullOrWhiteSpace($SqlServerFqdn) -or [string]::IsNullOrWhiteSpace($DatabaseName) -or [string]::IsNullOrWhiteSpace($SqlAdminLogin) -or [string]::IsNullOrWhiteSpace($SqlAdminPassword)) {
    throw 'Post-provision inputs could not be fully resolved from parameters or azd environment values.'
}

# The role must exist before the task image first starts. The function app asks for an API
# token as soon as it runs, and the managed identity service caches that token for up to
# 24 hours, so a token issued before the assignment would be rejected until it expires.
& "$PSScriptRoot/Assign-FunctionAppApiRole.ps1" `
    -ResourceGroupName $ResourceGroupName `
    -TaskAppName $TaskAppName `
    -ApiClientId $ApiClientId `
    -GraphEndpoint (Get-AzdEnvValue -Key 'graphEndpoint')

# The schema goes first so new images never start against procedures they cannot call. The
# scripts are additive and keep every existing parameter and result column, so the images
# still running meanwhile keep working.
& "$PSScriptRoot/Initialize-Database.ps1" `
    -SqlServerFqdn $SqlServerFqdn `
    -DatabaseName $DatabaseName `
    -SqlAdminLogin $SqlAdminLogin `
    -SqlAdminPassword $SqlAdminPassword `
    -ScriptsPath $ScriptsPath

& "$PSScriptRoot/Build-ContainerImages.ps1" `
    -EnvironmentName $EnvironmentName

& "$PSScriptRoot/Assign-VmApiRoles.ps1" `
    -ResourceGroupName $ResourceGroupName `
    -AvdHostGroupId $AvdHostGroupId `
    -LinuxHostGroupId $LinuxHostGroupId `
    -EnvironmentName $EnvironmentName

& "$PSScriptRoot/Register-LinuxHostSqlRecords.ps1" `
    -ResourceGroupName $ResourceGroupName `
    -SqlServerFqdn $SqlServerFqdn `
    -DatabaseName $DatabaseName `
    -SqlAdminLogin $SqlAdminLogin `
    -SqlAdminPassword $SqlAdminPassword

# The deployment cannot install the Azure Monitor agent, because Azure refuses extensions on VMs
# that scaling has powered off, so the hosts are connected to the host monitoring here. The rest
# of the deployment is in place by now, so a host that cannot be set up is a warning, which names
# the hosts to run the script again for.
try {
    & "$PSScriptRoot/Enable-HostMonitoring.ps1" `
        -ResourceGroupName $ResourceGroupName `
        -SubscriptionId $SubscriptionId `
        -EnvironmentName $EnvironmentName
}
catch {
    Write-Warning "The deployment is in place, but the host monitoring is not fully set up. $($_.Exception.Message)"
}