1#!/usr/bin/env bash
2# resolve-project-id.sh
3# Resolves a Foundry project ARM resource ID from a Foundry project endpoint.
4# The endpoint is used only for Azure lookup keys; the printed ID is the `id`
5# returned by Azure CLI, not a locally constructed ARM resource ID.
6#
7# Usage:
8#   ./resolve-project-id.sh --endpoint "https://my-account.services.ai.azure.com/api/projects/my-project"
9#   ./resolve-project-id.sh --endpoint "https://my-account.services.ai.azure.com/api/projects/my-project" --output json
10 
11set -uo pipefail
12 
13ENDPOINT=""
14SUBSCRIPTION=""
15RESOURCE_GROUP=""
16ACCOUNT_NAME=""
17PROJECT_NAME=""
18OUTPUT="id"
19TEMP_FILES=()
20 
21cleanup() {
22  if [ "${#TEMP_FILES[@]}" -gt 0 ]; then
23    rm -f "${TEMP_FILES[@]}"
24  fi
25}
26trap cleanup EXIT
27 
28usage() {
29  cat <<'EOF'
30Usage: resolve-project-id.sh --endpoint <foundry-project-endpoint> [options]
31 
32Options:
33  -e, --endpoint <url>          Foundry project endpoint. Required.
34      --subscription <id>       Azure subscription ID or name.
35  -g, --resource-group <name>   Resource group for the Foundry account.
36  -n, --account-name <name>     Foundry account name.
37      --project-name <name>     Foundry project name.
38  -o, --output <id|json>        Output format. Default: id.
39  -h, --help                    Show this help.
40EOF
41}
42 
43fatal() {
44  echo "[ERROR] $1" >&2
45  exit 1
46}
47 
48while [ "$#" -gt 0 ]; do
49  case "$1" in
50    -e|--endpoint)
51      [ "$#" -ge 2 ] || fatal "$1 requires a value."
52      ENDPOINT="$2"
53      shift 2
54      ;;
55    --subscription)
56      [ "$#" -ge 2 ] || fatal "$1 requires a value."
57      SUBSCRIPTION="$2"
58      shift 2
59      ;;
60    -g|--resource-group)
61      [ "$#" -ge 2 ] || fatal "$1 requires a value."
62      RESOURCE_GROUP="$2"
63      shift 2
64      ;;
65    -n|--account-name)
66      [ "$#" -ge 2 ] || fatal "$1 requires a value."
67      ACCOUNT_NAME="$2"
68      shift 2
69      ;;
70    --project-name)
71      [ "$#" -ge 2 ] || fatal "$1 requires a value."
72      PROJECT_NAME="$2"
73      shift 2
74      ;;
75    -o|--output)
76      [ "$#" -ge 2 ] || fatal "$1 requires a value."
77      OUTPUT="$2"
78      shift 2
79      ;;
80    -h|--help)
81      usage
82      exit 0
83      ;;
84    *)
85      fatal "Unknown argument: $1"
86      ;;
87  esac
88done
89 
90[ -n "$ENDPOINT" ] || fatal "--endpoint is required."
91[ "$OUTPUT" = "id" ] || [ "$OUTPUT" = "json" ] || fatal "--output must be 'id' or 'json'."
92 
93command -v az >/dev/null 2>&1 || fatal "Azure CLI 'az' was not found on PATH."
94command -v python3 >/dev/null 2>&1 || fatal "python3 was not found on PATH."
95 
96PARSED_ENDPOINT="$(
97  python3 - "$ENDPOINT" "$ACCOUNT_NAME" "$PROJECT_NAME" <<'PY'
98import json
99import sys
100from urllib.parse import unquote, urlparse
101 
102endpoint = (sys.argv[1] or "").strip().rstrip("/")
103account_name = sys.argv[2] or ""
104project_name = sys.argv[3] or ""
105 
106parsed = urlparse(endpoint)
107if parsed.scheme not in ("http", "https") or not parsed.netloc:
108    print("Endpoint must be an http or https URI.", file=sys.stderr)
109    raise SystemExit(1)
110 
111if not project_name:
112    parts = [unquote(p) for p in parsed.path.strip("/").split("/") if p]
113    for index, part in enumerate(parts):
114        if part.lower() == "projects" and index + 1 < len(parts):
115            project_name = parts[index + 1]
116            break
117 
118if not account_name:
119    host = parsed.hostname or ""
120    suffix = ".services.ai.azure.com"
121    if host.lower().endswith(suffix):
122        account_name = host[:-len(suffix)]
123 
124print(json.dumps({
125    "endpoint": endpoint,
126    "accountName": account_name,
127    "projectName": project_name,
128}))
129PY
130)" || fatal "Could not parse Foundry project endpoint."
131 
132NORMALIZED_ENDPOINT="$(python3 -c 'import json,sys; print(json.loads(sys.stdin.read())["endpoint"])' <<<"$PARSED_ENDPOINT")"
133if [ -z "$ACCOUNT_NAME" ]; then
134  ACCOUNT_NAME="$(python3 -c 'import json,sys; print(json.loads(sys.stdin.read())["accountName"])' <<<"$PARSED_ENDPOINT")"
135fi
136if [ -z "$PROJECT_NAME" ]; then
137  PROJECT_NAME="$(python3 -c 'import json,sys; print(json.loads(sys.stdin.read())["projectName"])' <<<"$PARSED_ENDPOINT")"
138fi
139 
140[ -n "$ACCOUNT_NAME" ] || fatal "Could not read the account name from the endpoint host. Re-run with --account-name."
141[ -n "$PROJECT_NAME" ] || fatal "Could not read the project name from the endpoint path. Re-run with --project-name."
142 
143add_subscription_arg() {
144  if [ -n "$SUBSCRIPTION" ]; then
145    printf '%s\n' "--subscription" "$SUBSCRIPTION"
146  fi
147}
148 
149run_az_json() {
150  local stderr_file
151  stderr_file="$(mktemp)"
152  local output
153  if output="$(az "$@" 2>"$stderr_file")"; then
154    rm -f "$stderr_file"
155    printf '%s' "$output"
156    return 0
157  fi
158  local error_text
159  error_text="$(cat "$stderr_file")"
160  rm -f "$stderr_file"
161  echo "$error_text" >&2
162  return 1
163}
164 
165if [ -z "$RESOURCE_GROUP" ]; then
166  AZ_ARGS=(cognitiveservices account list -o json)
167  while IFS= read -r arg; do
168    [ -n "$arg" ] && AZ_ARGS+=("$arg")
169  done < <(add_subscription_arg)
170 
171  ACCOUNTS_JSON="$(run_az_json "${AZ_ARGS[@]}")" || fatal "Failed to list Cognitive Services accounts."
172  ACCOUNTS_FILE="$(mktemp)"
173  TEMP_FILES+=("$ACCOUNTS_FILE")
174  printf '%s' "$ACCOUNTS_JSON" >"$ACCOUNTS_FILE"
175  MATCHED_ACCOUNT="$(
176    ACCOUNT_NAME="$ACCOUNT_NAME" python3 - "$ACCOUNTS_FILE" <<'PY'
177import json
178import os
179import sys
180 
181target = os.environ["ACCOUNT_NAME"].lower()
182with open(sys.argv[1], encoding="utf-8") as handle:
183    accounts = json.load(handle)
184matches = []
185for account in accounts:
186    name = (account.get("name") or "")
187    custom = ((account.get("properties") or {}).get("customSubDomainName") or "")
188    if name.lower() == target or custom.lower() == target:
189        matches.append(account)
190 
191if not matches:
192    print(f"Could not find a Cognitive Services account matching '{os.environ['ACCOUNT_NAME']}'.", file=sys.stderr)
193    raise SystemExit(1)
194if len(matches) > 1:
195    choices = ", ".join(f"{m.get('resourceGroup')}/{m.get('name')}" for m in matches)
196    print(f"Multiple accounts matched '{os.environ['ACCOUNT_NAME']}': {choices}. Re-run with --resource-group.", file=sys.stderr)
197    raise SystemExit(1)
198 
199print(json.dumps({
200    "resourceGroup": matches[0].get("resourceGroup") or "",
201    "accountName": matches[0].get("name") or "",
202}))
203PY
204  )" || fatal "Failed to resolve the Foundry account resource group."
205 
206  RESOURCE_GROUP="$(python3 -c 'import json,sys; print(json.loads(sys.stdin.read())["resourceGroup"])' <<<"$MATCHED_ACCOUNT")"
207  ACCOUNT_NAME="$(python3 -c 'import json,sys; print(json.loads(sys.stdin.read())["accountName"])' <<<"$MATCHED_ACCOUNT")"
208fi
209 
210PROJECT_JSON=""
211AZ_SHOW_ARGS=(
212  cognitiveservices account project show
213  -g "$RESOURCE_GROUP"
214  -n "$ACCOUNT_NAME"
215  --project-name "$PROJECT_NAME"
216  -o json
217)
218while IFS= read -r arg; do
219  [ -n "$arg" ] && AZ_SHOW_ARGS+=("$arg")
220done < <(add_subscription_arg)
221 
222if ! PROJECT_JSON="$(run_az_json "${AZ_SHOW_ARGS[@]}")"; then
223  AZ_LIST_ARGS=(
224    cognitiveservices account project list
225    -g "$RESOURCE_GROUP"
226    -n "$ACCOUNT_NAME"
227    -o json
228  )
229  while IFS= read -r arg; do
230    [ -n "$arg" ] && AZ_LIST_ARGS+=("$arg")
231  done < <(add_subscription_arg)
232 
233  PROJECTS_JSON="$(run_az_json "${AZ_LIST_ARGS[@]}")" || fatal "Failed to list Foundry projects."
234  PROJECTS_FILE="$(mktemp)"
235  TEMP_FILES+=("$PROJECTS_FILE")
236  printf '%s' "$PROJECTS_JSON" >"$PROJECTS_FILE"
237  PROJECT_JSON="$(
238    NORMALIZED_ENDPOINT="$NORMALIZED_ENDPOINT" python3 - "$PROJECTS_FILE" <<'PY'
239import json
240import os
241import sys
242 
243expected = os.environ["NORMALIZED_ENDPOINT"].rstrip("/")
244with open(sys.argv[1], encoding="utf-8") as handle:
245    projects = json.load(handle)
246 
247def endpoints(project):
248    values = ((project.get("properties") or {}).get("endpoints") or {}).values()
249    return [value.rstrip("/") for value in values if isinstance(value, str) and value]
250 
251for project in projects:
252    if expected in endpoints(project):
253        print(json.dumps(project))
254        break
255else:
256    print(f"Could not find a Foundry project matching endpoint '{expected}'.", file=sys.stderr)
257    raise SystemExit(1)
258PY
259  )" || fatal "Failed to resolve the Foundry project from endpoint metadata."
260fi
261 
262PROJECT_JSON="$PROJECT_JSON" \
263NORMALIZED_ENDPOINT="$NORMALIZED_ENDPOINT" \
264RESOURCE_GROUP="$RESOURCE_GROUP" \
265ACCOUNT_NAME="$ACCOUNT_NAME" \
266PROJECT_NAME="$PROJECT_NAME" \
267OUTPUT="$OUTPUT" \
268python3 - <<'PY'
269import json
270import os
271 
272project = json.loads(os.environ["PROJECT_JSON"])
273expected = os.environ["NORMALIZED_ENDPOINT"].rstrip("/")
274endpoint_values = ((project.get("properties") or {}).get("endpoints") or {}).values()
275endpoints = [value.rstrip("/") for value in endpoint_values if isinstance(value, str) and value]
276 
277if endpoints and expected not in endpoints:
278    print(f"[ERROR] Resolved project endpoint metadata did not match '{expected}'.", file=__import__("sys").stderr)
279    raise SystemExit(1)
280 
281resource_id = project.get("id")
282if not resource_id:
283    print("[ERROR] Azure returned a project object without an id.", file=__import__("sys").stderr)
284    raise SystemExit(1)
285 
286if os.environ["OUTPUT"] == "json":
287    print(json.dumps({
288        "id": resource_id,
289        "endpoint": endpoints[0] if endpoints else expected,
290        "resourceGroup": os.environ["RESOURCE_GROUP"],
291        "accountName": os.environ["ACCOUNT_NAME"],
292        "projectName": os.environ["PROJECT_NAME"],
293    }, indent=2))
294else:
295    print(resource_id)
296PY
297