alien_core/resources/
azure_storage_account.rs

1use crate::error::{ErrorData, Result};
2use crate::resource::{ResourceDefinition, ResourceOutputsDefinition, ResourceRef, ResourceType};
3use crate::{LifecycleRule, ResourceLifecycle, Stack, Storage};
4use alien_error::AlienError;
5use bon::Builder;
6use serde::{Deserialize, Serialize};
7use sha2::{Digest, Sha256};
8use std::any::Any;
9use std::collections::{BTreeMap, BTreeSet};
10use std::fmt::Debug;
11
12/// Represents an Azure Storage Account for blob, file, table, and queue storage.
13#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, Builder)]
14#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
15#[serde(rename_all = "camelCase", deny_unknown_fields)]
16#[builder(start_fn = new)]
17pub struct AzureStorageAccount {
18    /// Identifier for the storage account. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]).
19    /// Maximum 64 characters.
20    #[builder(start_fn)]
21    pub id: String,
22}
23
24impl AzureStorageAccount {
25    /// The resource type identifier for Azure Storage Accounts
26    pub const RESOURCE_TYPE: ResourceType = ResourceType::from_static("azure_storage_account");
27
28    /// Fingerprint shared settings derived from all container declarations.
29    /// Setup authorization must include Live contributors to this Frozen parent.
30    /// An empty projection preserves digests from installations without settings.
31    pub fn setup_settings_digest(stack: &Stack) -> Option<String> {
32        let settings = azure_storage_settings(stack);
33        (settings != AzureStorageSettings::default()).then(|| {
34            let encoded = serde_json::to_vec(&settings)
35                .expect("Azure storage settings contain only serializable values");
36            format!("{:x}", Sha256::digest(encoded))
37        })
38    }
39
40    /// Returns the storage account's unique identifier.
41    pub fn id(&self) -> &str {
42        &self.id
43    }
44}
45
46/// Outputs generated by a successfully provisioned Azure Storage Account.
47#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
48#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
49#[serde(rename_all = "camelCase")]
50pub struct AzureStorageAccountOutputs {
51    /// The name of the storage account.
52    pub account_name: String,
53    /// The resource ID of the storage account.
54    pub resource_id: String,
55    /// The primary endpoint for blob storage.
56    pub primary_blob_endpoint: String,
57    /// The primary endpoint for file storage.
58    pub primary_file_endpoint: String,
59    /// The primary endpoint for queue storage.
60    pub primary_queue_endpoint: String,
61    /// The primary endpoint for table storage.
62    pub primary_table_endpoint: String,
63}
64
65impl ResourceOutputsDefinition for AzureStorageAccountOutputs {
66    fn get_resource_type(&self) -> ResourceType {
67        AzureStorageAccount::RESOURCE_TYPE.clone()
68    }
69
70    fn as_any(&self) -> &dyn Any {
71        self
72    }
73
74    fn box_clone(&self) -> Box<dyn ResourceOutputsDefinition> {
75        Box::new(self.clone())
76    }
77
78    fn outputs_eq(&self, other: &dyn ResourceOutputsDefinition) -> bool {
79        other.as_any().downcast_ref::<AzureStorageAccountOutputs>() == Some(self)
80    }
81
82    fn to_json_value(&self) -> serde_json::Result<serde_json::Value> {
83        serde_json::to_value(self)
84    }
85}
86
87// Implementation of ResourceDefinition trait for AzureStorageAccount
88impl ResourceDefinition for AzureStorageAccount {
89    fn get_resource_type(&self) -> ResourceType {
90        Self::RESOURCE_TYPE
91    }
92
93    fn id(&self) -> &str {
94        &self.id
95    }
96
97    fn replace_after_failed_create_is_safe(&self) -> bool {
98        // Deleting it destroys the blobs, tables and queues in the account.
99        false
100    }
101
102    fn get_dependencies(&self) -> Vec<ResourceRef> {
103        Vec::new()
104    }
105
106    fn validate_update(&self, _new_config: &dyn ResourceDefinition) -> Result<()> {
107        Err(AlienError::new(ErrorData::InvalidResourceUpdate {
108            resource_id: self.id.clone(),
109            reason: "Azure storage accounts cannot be updated once created".to_string(),
110        }))
111    }
112
113    fn as_any(&self) -> &dyn Any {
114        self
115    }
116
117    fn as_any_mut(&mut self) -> &mut dyn Any {
118        self
119    }
120
121    fn box_clone(&self) -> Box<dyn ResourceDefinition> {
122        Box::new(self.clone())
123    }
124
125    fn resource_eq(&self, other: &dyn ResourceDefinition) -> bool {
126        other.as_any().downcast_ref::<AzureStorageAccount>() == Some(self)
127    }
128
129    fn to_json_value(&self) -> serde_json::Result<serde_json::Value> {
130        serde_json::to_value(self)
131    }
132}
133
134/// Settings written by setup to the shared account, including Live contributors.
135/// Compare the derived settings so ordinary Live updates cannot bypass setup.
136#[derive(Default, PartialEq, Serialize)]
137#[serde(rename_all = "camelCase")]
138struct AzureStorageSettings {
139    public: BTreeSet<Option<String>>,
140    versioning: BTreeSet<Option<String>>,
141    cors: BTreeMap<String, BTreeSet<Option<String>>>,
142    expiry: BTreeMap<String, (ResourceLifecycle, Option<String>, Vec<LifecycleRule>)>,
143}
144
145fn azure_storage_settings(stack: &Stack) -> AzureStorageSettings {
146    let mut settings = AzureStorageSettings::default();
147    for (id, entry) in stack.resources() {
148        let Some(storage) = entry.config.downcast_ref::<Storage>() else {
149            continue;
150        };
151        if storage.public_read {
152            settings.public.insert(entry.enabled_when.clone());
153        }
154        if storage.versioning {
155            settings.versioning.insert(entry.enabled_when.clone());
156        }
157        for origin in &storage.cors_allowed_origins {
158            settings
159                .cors
160                .entry(origin.clone())
161                .or_default()
162                .insert(entry.enabled_when.clone());
163        }
164        if !storage.lifecycle_rules.is_empty() {
165            settings.expiry.insert(
166                id.clone(),
167                (
168                    entry.lifecycle,
169                    entry.enabled_when.clone(),
170                    storage.lifecycle_rules.clone(),
171                ),
172            );
173        }
174    }
175    // One unconditional contributor makes conditional contributors irrelevant.
176    for gates in [&mut settings.public, &mut settings.versioning]
177        .into_iter()
178        .chain(settings.cors.values_mut())
179    {
180        if gates.contains(&None) {
181            gates.clear();
182            gates.insert(None);
183        }
184    }
185    settings
186}
alien_core/resources/azure_storage_account.rs

alien_core/resources/
azure_storage_account.rs
