Added SDK calls for assignSpRole function

cmd/setup-gh.go

@@ -7,6 +7,7 @@ import (
 
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/cloud"
 	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
+	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/authorization/armauthorization"
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/subscription/armsubscription"
 	"github.com/Azure/draft/pkg/cred"
 	"github.com/manifoldco/promptui"
@@ -50,6 +51,13 @@ application and service principle, and will configure that application to trust
 
 			sc.AzClient.GraphClient = graphClient
 
+			roleAssignmentClient, err := createRoleAssignmentClient(azCred, sc.SubscriptionID)
+			if err != nil {
+				return fmt.Errorf("getting role assignment client: %w", err)
+			}
+
+			sc.AzClient.RoleAssignClient = roleAssignmentClient
+
 			fillSetUpConfig(sc)
 
 			s := spinner.CreateSpinner("--> Setting up Github OIDC...")
@@ -84,6 +92,14 @@ func createGraphClient(azCred *azidentity.DefaultAzureCredential) (providers.Gra
 	return &providers.GraphServiceClient{Client: client}, nil
 }
 
+func createRoleAssignmentClient(azCred *azidentity.DefaultAzureCredential, subscriptionId string) (providers.RoleAssignClient, error) {
+	client, err := armauthorization.NewRoleAssignmentsClient(subscriptionId, azCred, nil)
+	if err != nil {
+		return nil, fmt.Errorf("creating role assignment client: %w", err)
+	}
+	return client, nil
+}
+
 func fillSetUpConfig(sc *providers.SetUpCmd) {
 	if sc.AppName == "" {
 		sc.AppName = getAppName()

go.mod

@@ -5,6 +5,7 @@ go 1.22.0
 require (
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.11.1
 	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.5.2
+	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/authorization/armauthorization v1.0.0
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/subscription/armsubscription v1.2.0
 	github.com/briandowns/spinner v1.23.0
 	github.com/cenkalti/backoff/v4 v4.3.0

go.sum

@@ -17,6 +17,8 @@ github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.5.2 h1:FDif4R1+UUR+00q6wquyX
 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.5.2/go.mod h1:aiYBYui4BJ/BJCAIKs92XiPyQfTaBWqvHujDwKb6CBU=
 github.com/Azure/azure-sdk-for-go/sdk/internal v1.5.2 h1:LqbJ/WzJUwBf8UiaSzgX7aMclParm9/5Vgp+TY51uBQ=
 github.com/Azure/azure-sdk-for-go/sdk/internal v1.5.2/go.mod h1:yInRyqWXAuaPrgI7p70+lDDgh3mlBohis29jGMISnmc=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/authorization/armauthorization v1.0.0 h1:qtRcg5Y7jNJ4jEzPq4GpWLfTspHdNe2ZK6LjwGcjgmU=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/authorization/armauthorization v1.0.0/go.mod h1:lPneRe3TwsoDRKY4O6YDLXHhEWrD+TIRa8XrV/3/fqw=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/subscription/armsubscription v1.2.0 h1:UrGzkHueDwAWDdjQxC+QaXHd4tVCkISYE9j7fSSXF8k=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/subscription/armsubscription v1.2.0/go.mod h1:qskvSQeW+cxEE2bcKYyKimB1/KiQ9xpJ99bcHY0BX6c=
 github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 h1:UQHMgLO+TxOElx5B5HZ4hJQsoJ/PvUvKRhJHDQXO8P8=

pkg/providers/az-client.go

@@ -5,13 +5,15 @@ import (
 	"errors"
 	"fmt"
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime"
+	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/authorization/armauthorization"
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/subscription/armsubscription"
 	msgraph "github.com/microsoftgraph/msgraph-sdk-go"
 )
 
 type AzClient struct {
-	AzTenantClient azTenantClient
-	GraphClient    GraphClient
+	AzTenantClient   azTenantClient
+	GraphClient      GraphClient
+	RoleAssignClient RoleAssignClient
 }
 
 //go:generate mockgen -source=./az-client.go -destination=./mock/az-client.go .
@@ -43,3 +45,9 @@ func (g *GraphServiceClient) GetApplicationObjectId(ctx context.Context, appId s
 	}
 	return *appObjectId, nil
 }
+
+type RoleAssignClient interface {
+	CreateByID(ctx context.Context, roleAssignmentID string, parameters armauthorization.RoleAssignmentCreateParameters, options *armauthorization.RoleAssignmentsClientCreateByIDOptions) (armauthorization.RoleAssignmentsClientCreateByIDResponse, error)
+}
+
+var _ RoleAssignClient = &armauthorization.RoleAssignmentsClient{}

pkg/providers/azure.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/authorization/armauthorization"
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/subscription/armsubscription"
 	"os/exec"
 	"time"
@@ -61,7 +62,7 @@ func InitiateAzureOIDCFlow(ctx context.Context, sc *SetUpCmd, s spinner.Spinner)
 		return err
 	}
 
-	if err := sc.assignSpRole(); err != nil {
+	if err := sc.assignSpRole(ctx); err != nil {
 		return err
 	}
 
@@ -165,14 +166,44 @@ func (sc *SetUpCmd) CreateServicePrincipal() error {
 	return nil
 }
 
-func (sc *SetUpCmd) assignSpRole() error {
+//func (sc *SetUpCmd) assignSpRole(ctx context.Context) error {
+//	log.Debug("Assigning contributor role to service principal...")
+//	scope := fmt.Sprintf("/subscriptions/%s/resourceGroups/%s", sc.SubscriptionID, sc.ResourceGroupName)
+//
+//	// Create role assignment parameters
+//	objectID := sc.spObjectId
+//	roleID := "contributor"      // Assuming "contributor" role
+//	raUid := uuid.New().String() // Using UUID to serve as raUid
+//
+//	roleAssignmentClient := sc.AzClient.RoleAssignClient
+//
+//	err := roleAssignmentClient.CreateRoleAssignment(ctx, objectID, roleID, scope, raUid)
+//	if err != nil {
+//		return fmt.Errorf("creating role assignment: %w", err)
+//	}
+//
+//	log.Debug("Role assigned successfully!")
+//	return nil
+//}
+
+func (sc *SetUpCmd) assignSpRole(ctx context.Context) error {
 	log.Debug("Assigning contributor role to service principal...")
-	scope := fmt.Sprintf("/subscriptions/%s/resourceGroups/%s", sc.SubscriptionID, sc.ResourceGroupName)
-	assignSpRoleCmd := exec.Command("az", "role", "assignment", "create", "--role", "contributor", "--subscription", sc.SubscriptionID, "--assignee-object-id", sc.spObjectId, "--assignee-principal-type", "ServicePrincipal", "--scope", scope, "--only-show-errors")
-	out, err := assignSpRoleCmd.CombinedOutput()
+
+	objectID := sc.spObjectId
+	roleID := "contributor"
+
+	parameters := armauthorization.RoleAssignmentCreateParameters{
+		Properties: &armauthorization.RoleAssignmentProperties{
+			PrincipalID:      &objectID,
+			RoleDefinitionID: nil,
+		},
+	}
+
+	options := &armauthorization.RoleAssignmentsClientCreateByIDOptions{}
+
+	_, err := sc.AzClient.RoleAssignClient.CreateByID(ctx, roleID, parameters, options)
 	if err != nil {
-		log.Printf("%s\n", out)
-		return err
+		return fmt.Errorf("creating role assignment: %w", err)
 	}
 
 	log.Debug("Role assigned successfully!")

pkg/providers/azure_test.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime"
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/tracing"
+	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/authorization/armauthorization"
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/subscription/armsubscription"
 	mock_providers "github.com/Azure/draft/pkg/providers/mock"
 	"go.uber.org/mock/gomock"
@@ -243,3 +244,70 @@ func TestGetAppObjectId_EmptyAppIdFromGraphClient(t *testing.T) {
 		t.Errorf("Expected error '%v', got '%v'", expectedError, err)
 	}
 }
+
+func TestAssignSpRole(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	mockRoleAssignClient := mock_providers.NewMockRoleAssignClient(ctrl)
+
+	mockRoleAssignClient.EXPECT().CreateByID(gomock.Any(), "contributor", gomock.Any(), gomock.Any()).Return(armauthorization.RoleAssignmentsClientCreateByIDResponse{}, nil)
+
+	sc := &SetUpCmd{
+		AzClient: AzClient{
+			RoleAssignClient: mockRoleAssignClient,
+		},
+		spObjectId: "testObjectId",
+	}
+
+	err := sc.assignSpRole(context.Background())
+	if err != nil {
+		t.Errorf("Expected no error, got: %v", err)
+	}
+}
+
+func TestAssignSpRole_Error(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	mockRoleAssignClient := mock_providers.NewMockRoleAssignClient(ctrl)
+
+	roleAssignID := "contributor"
+	expectedError := errors.New("error")
+	mockRoleAssignClient.EXPECT().CreateByID(gomock.Any(), roleAssignID, gomock.Any(), gomock.Any()).Return(armauthorization.RoleAssignmentsClientCreateByIDResponse{}, expectedError)
+
+	sc := &SetUpCmd{
+		AzClient: AzClient{
+			RoleAssignClient: mockRoleAssignClient,
+		},
+		spObjectId: "testObjectId",
+	}
+
+	err := sc.assignSpRole(context.Background())
+	if err == nil {
+		t.Errorf("Expected an error, got nil")
+	}
+}
+
+func TestAssignSpRole_ErrorDuringRoleAssignment(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	mockRoleAssignClient := mock_providers.NewMockRoleAssignClient(ctrl)
+
+	roleAssignID := "contributor"
+	expectedError := errors.New("error during role assignment")
+	mockRoleAssignClient.EXPECT().CreateByID(gomock.Any(), roleAssignID, gomock.Any(), gomock.Any()).Return(armauthorization.RoleAssignmentsClientCreateByIDResponse{}, expectedError)
+
+	sc := &SetUpCmd{
+		AzClient: AzClient{
+			RoleAssignClient: mockRoleAssignClient,
+		},
+		spObjectId: "testObjectId",
+	}
+
+	err := sc.assignSpRole(context.Background())
+	if err == nil {
+		t.Errorf("Expected an error, but got nil")
+	}
+}