Merge pull request #1260 from ninjarobot/issue445

Add Service Bus topic authorization rules

Author: ninjarobot

RELEASE_NOTES.md

@@ -2,6 +2,7 @@ Release Notes
 =============
 ## 1.9.31
 * Communication Services: Update `Microsoft.Communication/communicationServices` to the stable `2020-08-20` ARM API version instead of the retired preview API.
+* Service Bus: Add topic-level authorization rules with `add_authorization_rule` on the `topic` builder.
 
 ## 1.9.29
 * Container Apps: Add support for setting Dapr protocol.

docs/content/api-overview/resources/service-bus.md

@@ -47,6 +47,7 @@ The Service Bus builder creates service bus namespaces and their associated queu
 | Topic | max_message_size | The maximum size of the message payload that can be accepted by the topic in Kilobytes e.g `1024<Kb>`. **Requires Premium SKU.** |
 | Topic | max_topic_size | Maximum size for the topic in Megabytes e.g. `1024<Mb>`. |
 | Topic | message_ttl | Time To Live (TTL) value for messages expressed as a TimeSpan or a TimeSpan string, such as '01:30:00' 1 hour, 30 minutes, or as an integer days e.g. `4<Days>`. |
+| Topic | add_authorization_rule | Adds an authorization rule to the topic. |
 | Topic | link_to_unmanaged_namespace | Instead of creating or modifying a namespace, configure this topic to point to another unmanaged namespace instance. |
 | Namespace | sku | The ServiceBusNamespaceSku e.g. Standard |
 | Namespace | namespace_name | The name of the namespace that holds the queue. |

src/Farmer/Arm/ServiceBus.fs

@@ -22,6 +22,9 @@ let namespaces =
 let queueAuthorizationRules =
     ResourceType("Microsoft.ServiceBus/namespaces/queues/authorizationRules", "2022-01-01-preview")
 
+let topicAuthorizationRules =
+    ResourceType("Microsoft.ServiceBus/namespaces/topics/authorizationRules", "2022-01-01-preview")
+
 let namespaceAuthorizationRules =
     ResourceType("Microsoft.ServiceBus/namespaces/AuthorizationRules", "2022-01-01-preview")
 
@@ -153,6 +156,23 @@ module Namespaces =
                     |}
             |}
 
+    type TopicAuthorizationRule = {
+        Name: ResourceName
+        Location: Location
+        Dependencies: ResourceId list
+        Rights: AuthorizationRuleRight Set
+    } with
+
+        interface IArmResource with
+            member this.ResourceId = topicAuthorizationRules.resourceId this.Name
+
+            member this.JsonModel = {|
+                topicAuthorizationRules.Create(this.Name, this.Location, this.Dependencies) with
+                    properties = {|
+                        rights = this.Rights |> Set.map string |> Set.toList
+                    |}
+            |}
+
     type NamespaceAuthorizationRule = {
         Name: ResourceName
         Location: Location

src/Farmer/Builders/Builders.ServiceBus.fs

@@ -325,6 +325,7 @@ type ServiceBusTopicConfig = {
     MaxMessageSizeInKilobytes: int<Kb> option
     MaxSizeInMegabytes: int<Mb> option
     Subscriptions: Map<ResourceName, ServiceBusSubscriptionConfig>
+    AuthorizationRules: Map<ResourceName, AuthorizationRuleRight Set>
 } with
 
     member this.ResourceId = topics.resourceId (this.Namespace.Name, this.Name)
@@ -352,6 +353,17 @@ type ServiceBusTopicConfig = {
                 MaxMessageSizeInKilobytes = this.MaxMessageSizeInKilobytes
                 MaxSizeInMegabytes = this.MaxSizeInMegabytes
             }
+            for rule in this.AuthorizationRules do
+                {
+                    TopicAuthorizationRule.Name =
+                        rule.Key.Map(fun name -> $"{this.Namespace.Name.Value}/{this.Name.Value}/%s{name}")
+                    Location = location
+                    Dependencies = [
+                        namespaces.resourceId this.Namespace.Name
+                        topics.resourceId (this.Namespace.Name, this.Name)
+                    ]
+                    Rights = rule.Value
+                }
             for subscription in this.Subscriptions do
                 let subscription =
                     {
@@ -373,6 +385,7 @@ type ServiceBusTopicBuilder() =
         MaxMessageSizeInKilobytes = None
         MaxSizeInMegabytes = None
         Subscriptions = Map.empty
+        AuthorizationRules = Map.empty
     }
 
     /// The name of the queue.
@@ -446,6 +459,13 @@ type ServiceBusTopicBuilder() =
                     state.Add(subscription.Name, subscription))
     }
 
+    /// Add authorization rule on the topic.
+    [<CustomOperation "add_authorization_rule">]
+    member _.AddAuthorizationRule(state: ServiceBusTopicConfig, name, rights) = {
+        state with
+            AuthorizationRules = state.AuthorizationRules.Add(ResourceName name, Set rights)
+    }
+
     /// Instead of creating or modifying a namespace, configure this topic to point to another unmanaged namespace instance.
     [<CustomOperation "link_to_unmanaged_namespace">]
     member this.LinkToUnmanagedNamespace(state: ServiceBusTopicConfig, namespaceName: ResourceName) = {

src/Tests/ServiceBus.fs

@@ -579,6 +579,47 @@ let tests =
                 Expect.equal topic.Name "my-bus/my-topic" "Name not set"
                 Expect.equal topic.MaxSizeInMegabytes (Nullable 10240) "Max size not set"
             }
+            test "Topic authorization rule should not be present by default" {
+                let sbAuthorizationRules =
+                    arm {
+                        add_resource (
+                            serviceBus {
+                                name "serviceBus"
+                                sku Standard
+                                add_topics [ topic { name "my-topic" } ]
+                            }
+                        )
+                    }
+                    |> findAzureResources<SBAuthorizationRule> dummyClient.SerializationSettings
+                    |> List.filter (fun x -> (=) x.Type topicAuthorizationRules.Type)
+
+                Expect.equal sbAuthorizationRules.Length 0 "Topic authorization rule should not be present"
+            }
+            test "Topic authorization rule should write correct ARM template" {
+                let sbAuthorizationRule =
+                    arm {
+                        add_resource (
+                            serviceBus {
+                                name "serviceBus"
+                                sku Standard
+
+                                add_topics [
+                                    topic {
+                                        name "my-topic"
+                                        add_authorization_rule "my-rule" [ Manage ]
+                                    }
+                                ]
+                            }
+                        )
+                    }
+                    |> findAzureResources<SBAuthorizationRule> dummyClient.SerializationSettings
+                    |> List.filter (fun x -> (=) x.Type topicAuthorizationRules.Type)
+                    |> List.head
+
+                Expect.equal sbAuthorizationRule.Name "serviceBus/my-topic/my-rule" "Name is wrong"
+                Expect.equal sbAuthorizationRule.Rights.Count 1 "Wrong number of rights"
+                Expect.equal sbAuthorizationRule.Rights.[0] AccessRights.Manage "Wrong rights"
+            }
             test "Can create a basic subscription" {
                 let sub: SBSubscription =
                     serviceBus {