First batch of updated tests

Author: simonkurtz-MSFT

tests/python/test_apimtypes.py

@@ -822,6 +822,194 @@ def testget_project_root_functionality():
     assert isinstance(root, Path)
     assert root.exists()
 
+    def test_output_class_basic():
+        """Test Output class initialization and properties."""
+        # Test successful output with JSON
+        output = Output(True, '{"key": "value"}')
+        assert output.success is True
+        assert output.text == '{"key": "value"}'
+        assert output.json_data == {"key": "value"}
+        assert output.is_json is True
+
+    def test_output_class_non_json():
+        """Test Output class with non-JSON text."""
+        output = Output(True, 'some plain text')
+        assert output.success is True
+        assert output.text == 'some plain text'
+        assert output.json_data is None
+        assert output.is_json is False
+
+    def test_output_get_with_properties_structure():
+        """Test Output.get() with deployment output structure."""
+        json_text = json.dumps({
+            'properties': {
+                'outputs': {
+                    'apimName': {'value': 'my-apim'}
+                }
+            }
+        })
+        output = Output(True, json_text)
+        result = output.get('apimName', suppress_logging=True)
+        assert result == 'my-apim'
+
+    def test_output_get_missing_key():
+        """Test Output.get() with missing key."""
+        json_text = json.dumps({
+            'properties': {
+                'outputs': {
+                    'apimName': {'value': 'my-apim'}
+                }
+            }
+        })
+        output = Output(True, json_text)
+        result = output.get('nonExistent', suppress_logging=True)
+        assert result is None
+
+    def test_output_get_non_dict_json():
+        """Test Output.get() when json_data is not a dict."""
+        output = Output(True, '[1, 2, 3]')
+        result = output.get('key', suppress_logging=True)
+        assert result is None
+
+    def test_output_get_missing_properties():
+        """Test Output.get() when 'properties' key is missing."""
+        json_text = json.dumps({
+            'data': {
+                'outputs': {
+                    'apimName': {'value': 'my-apim'}
+                }
+            }
+        })
+        output = Output(True, json_text)
+        # Should look for key at root level
+        result = output.get('apimName', suppress_logging=True)
+        assert result is None
+
+    def test_output_getJson_with_nested_structure():
+        """Test Output.getJson() returns parsed JSON from nested value."""
+        nested_json = '{"nested": "data"}'
+        json_text = json.dumps({
+            'properties': {
+                'outputs': {
+                    'config': {'value': nested_json}
+                }
+            }
+        })
+        output = Output(True, json_text)
+        result = output.getJson('config', suppress_logging=True)
+        assert result == {"nested": "data"}
+
+    def test_output_getJson_with_dict_value():
+        """Test Output.getJson() with dict value."""
+        json_text = json.dumps({
+            'properties': {
+                'outputs': {
+                    'config': {'value': {"nested": "dict"}}
+                }
+            }
+        })
+        output = Output(True, json_text)
+        result = output.getJson('config', suppress_logging=True)
+        assert result == {"nested": "dict"}
+
+    def test_output_getJson_with_missing_key():
+        """Test Output.getJson() with missing key."""
+        json_text = json.dumps({
+            'properties': {
+                'outputs': {
+                    'apimName': {'value': 'my-apim'}
+                }
+            }
+        })
+        output = Output(True, json_text)
+        result = output.getJson('nonExistent', suppress_logging=True)
+        assert result is None
+
+        def test_output_get_with_direct_key():
+            """Test Output.get() when output key is at root level."""
+            json_text = json.dumps({
+                'apimName': {'value': 'my-apim'},
+                'location': {'value': 'eastus'}
+            })
+            output = Output(True, json_text)
+            result = output.get('apimName', suppress_logging=True)
+            assert result == 'my-apim'
+
+        def test_output_get_with_label_and_secure():
+            """Test Output.get() with label and secure masking."""
+            json_text = json.dumps({
+                'properties': {
+                    'outputs': {
+                        'secretKey': {'value': 'very-secret-key-12345'}
+                    }
+                }
+            })
+            output = Output(True, json_text)
+            # Should not raise even with label; we suppress logging in test
+            result = output.get('secretKey', label='Secret', secure=True, suppress_logging=True)
+            assert result == 'very-secret-key-12345'
+
+        def test_output_getJson_with_list_value():
+            """Test Output.getJson() with array value."""
+            json_text = json.dumps({
+                'properties': {
+                    'outputs': {
+                        'items': {'value': [1, 2, 3, 4, 5]}
+                    }
+                }
+            })
+            output = Output(True, json_text)
+            result = output.getJson('items', suppress_logging=True)
+            assert result == [1, 2, 3, 4, 5]
+
+        def test_output_getJson_with_string_json_value():
+            """Test Output.getJson() when value is JSON-formatted string."""
+            nested_json = '{"nested": "object"}'
+            json_text = json.dumps({
+                'properties': {
+                    'outputs': {
+                        'config': {'value': nested_json}
+                    }
+                }
+            })
+            output = Output(True, json_text)
+            result = output.getJson('config', suppress_logging=True)
+            assert result == {"nested": "object"}
+
+        def test_output_get_empty_string_value():
+            """Test Output.get() with empty string value."""
+            json_text = json.dumps({
+                'properties': {
+                    'outputs': {
+                        'empty': {'value': ''}
+                    }
+                }
+            })
+            output = Output(True, json_text)
+            result = output.get('empty', suppress_logging=True)
+            assert result == ''
+
+        def test_output_getJson_empty_object():
+            """Test Output.getJson() with empty JSON object."""
+            json_text = json.dumps({
+                'properties': {
+                    'outputs': {
+                        'emptyObj': {'value': {}}
+                    }
+                }
+            })
+            output = Output(True, json_text)
+            result = output.getJson('emptyObj', suppress_logging=True)
+            assert result == {}
+
+        def test_output_parse_error_handling():
+            """Test Output class handles JSON parse errors gracefully."""
+            # JSON that doesn't parse but has structure
+            output = Output(True, '{invalid json here}')
+            # Should still initialize without crashing
+            assert output.text == '{invalid json here}'
+            assert output.success is True
+
 
 def test_api_edge_cases():
     """Test API class with edge cases and full coverage."""

tests/python/test_azure_resources.py

@@ -152,6 +152,122 @@ def test_get_account_info_no_json():
 
         assert 'Failed to retrieve account information' in str(exc_info.value)
 
+# ------------------------------
+#    JWT SIGNING KEY CLEANUP TESTS
+# ------------------------------
+
+def test_cleanup_old_jwt_signing_keys_success(monkeypatch):
+    """Test successful cleanup of old JWT signing keys."""
+
+    run_calls: list[str] = []
+
+    def fake_run(cmd: str, *args, **kwargs):
+        run_calls.append(cmd)
+
+        if 'nv list' in cmd:
+            return Output(True, 'JwtSigningKey-sample-123\nJwtSigningKey-sample-456\n')
+
+        if 'nv delete' in cmd:
+            # Only the non-current key should be deleted
+            return Output(True, '')
+
+        return Output(False, 'unexpected command')
+
+    monkeypatch.setattr(az, 'run', fake_run)
+    monkeypatch.setattr(az, 'print_message', lambda *a, **k: None)
+    monkeypatch.setattr(az, 'print_info', lambda *a, **k: None)
+    monkeypatch.setattr(az, 'print_ok', lambda *a, **k: None)
+    monkeypatch.setattr(az, 'print_error', lambda *a, **k: None)
+
+    result = az.cleanup_old_jwt_signing_keys('apim', 'rg', 'JwtSigningKey-sample-456')
+
+    assert result is True
+    assert any('nv list' in c for c in run_calls)
+    delete_calls = [c for c in run_calls if 'nv delete' in c]
+    assert len(delete_calls) == 1
+    assert 'JwtSigningKey-sample-123' in delete_calls[0]
+
+
+def test_cleanup_old_jwt_signing_keys_invalid_pattern(monkeypatch):
+    """Test cleanup when current key name does not match expected pattern."""
+
+    monkeypatch.setattr(az, 'run', lambda *a, **k: pytest.fail('run should not be called'))
+    monkeypatch.setattr(az, 'print_message', lambda *a, **k: None)
+    monkeypatch.setattr(az, 'print_info', lambda *a, **k: None)
+    monkeypatch.setattr(az, 'print_ok', lambda *a, **k: None)
+
+    result = az.cleanup_old_jwt_signing_keys('apim', 'rg', 'invalid-key-name')
+
+    assert result is False
+
+
+# ------------------------------
+#    APIM BLOB PERMISSIONS TESTS
+# ------------------------------
+
+def test_check_apim_blob_permissions_success(monkeypatch):
+    """Test blob permission check succeeds when role assignment and access test succeed."""
+
+    monkeypatch.setattr(az, 'get_azure_role_guid', lambda *_: 'role-guid')
+    monkeypatch.setattr(az, 'print_info', lambda *a, **k: None)
+    monkeypatch.setattr(az, 'print_ok', lambda *a, **k: None)
+    monkeypatch.setattr(az, 'print_warning', lambda *a, **k: None)
+    monkeypatch.setattr(az, 'print_error', lambda *a, **k: None)
+
+    run_calls: list[str] = []
+
+    def fake_run(cmd: str, *args, **kwargs):
+        run_calls.append(cmd)
+
+        if 'apim show' in cmd:
+            return Output(True, 'principal-id\n')
+
+        if 'storage account show' in cmd:
+            return Output(True, 'notice\n/subscriptions/123/resourceGroups/rg/providers/Microsoft.Storage/storageAccounts/storage\n')
+
+        if 'role assignment list' in cmd:
+            return Output(True, 'assignment-id\n')
+
+        if 'storage blob list' in cmd:
+            return Output(True, 'blob-name\n')
+
+        return Output(False, 'unexpected command')
+
+    monkeypatch.setattr(az, 'run', fake_run)
+    monkeypatch.setattr(az.time, 'sleep', lambda *a, **k: None)
+
+    result = az.check_apim_blob_permissions('apim', 'storage', 'rg', max_wait_minutes = 1)
+
+    assert result is True
+    assert any('role assignment list' in c for c in run_calls)
+    assert any('storage blob list' in c for c in run_calls)
+
+
+def test_check_apim_blob_permissions_missing_resource_id(monkeypatch):
+    """Test blob permission check fails when storage account ID cannot be parsed."""
+
+    monkeypatch.setattr(az, 'get_azure_role_guid', lambda *_: 'role-guid')
+    monkeypatch.setattr(az, 'print_info', lambda *a, **k: None)
+    monkeypatch.setattr(az, 'print_ok', lambda *a, **k: None)
+    monkeypatch.setattr(az, 'print_warning', lambda *a, **k: None)
+    monkeypatch.setattr(az, 'print_error', lambda *a, **k: None)
+
+    def fake_run(cmd: str, *args, **kwargs):
+        if 'apim show' in cmd:
+            return Output(True, 'principal-id\n')
+
+        if 'storage account show' in cmd:
+            return Output(True, 'no matching id here')
+
+        return Output(False, 'unexpected command')
+
+    monkeypatch.setattr(az, 'run', fake_run)
+
+    result = az.check_apim_blob_permissions('apim', 'storage', 'rg')
+
+    assert result is False
+
+
 # ------------------------------
 #    DEPLOYMENT NAME TESTS
 # ------------------------------