azuredeploy.json

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "subscriptionId": {
      "type": "String",
      "defaultValue": "[subscription().subscriptionId]"
    },
    "functionAppName": {
      "type": "string",
      "defaultValue": "[concat('rapp-', uniqueString(resourceGroup().id))]",
      "metadata": {
        "description": "Name of the Function App (must be globally unique)"
      }
    },
    "storageAccountName": {
      "type": "string",
      "defaultValue": "[concat('st', uniqueString(resourceGroup().id))]",
      "maxLength": 24,
      "metadata": {
        "description": "Storage Account Name (3-24 characters, lowercase and numbers only)"
      }
    },
    "storageBlobContainerName": {
      "type": "String",
      "defaultValue": "deployments"
    },
    "openAIServiceName": {
      "type": "string",
      "defaultValue": "[concat('openai-', uniqueString(resourceGroup().id))]",
      "metadata": {
        "description": "Name for the Azure OpenAI Service"
      }
    },
    "openAIModelName": {
      "type": "string",
      "defaultValue": "gpt-5.2-chat",
      "allowedValues": [
        "gpt-4o",
        "gpt-4o-mini",
        "gpt-5.2-chat",
        "o1",
        "o1-mini",
        "o3-mini"
      ],
      "metadata": {
        "description": "Azure OpenAI Model to deploy. All models use the tools API format."
      }
    },
    "openAIDeploymentName": {
      "type": "string",
      "defaultValue": "gpt-5.2-chat",
      "metadata": {
        "description": "Name for the model deployment"
      }
    },
    "openAIDeploymentCapacity": {
      "type": "int",
      "defaultValue": 10,
      "minValue": 1,
      "maxValue": 300,
      "metadata": {
        "description": "Deployment capacity in thousands of tokens per minute (TPM). Start with 10 and increase if needed based on your quota."
      }
    },
    "assistantName": {
      "type": "string",
      "defaultValue": "RAPP Agent",
      "metadata": {
        "description": "Name for the AI Assistant"
      }
    },
    "characteristicDescription": {
      "type": "string",
      "defaultValue": "Rapid Agent Prototyping Platform assistant",
      "metadata": {
        "description": "Description of the assistant's characteristics"
      }
    },
    "openAILocation": {
      "type": "string",
      "defaultValue": "eastus2",
      "allowedValues": [
        "australiaeast",
        "canadaeast",
        "eastus",
        "eastus2",
        "francecentral",
        "japaneast",
        "northcentralus",
        "norwayeast",
        "southcentralus",
        "swedencentral",
        "switzerlandnorth",
        "uksouth",
        "westeurope",
        "westus",
        "westus3"
      ],
      "metadata": {
        "description": "REQUIRED: Select region for Azure OpenAI Service. Choose a region with available quota (different from your resource group region if needed)."
      }
    },
    "pythonVersion": {
      "type": "string",
      "defaultValue": "3.11",
      "allowedValues": [
        "3.11"
      ],
      "metadata": {
        "description": "Python version to use (3.11 required for Azure Functions v4 compatibility)"
      }
    },
    "functionAppRuntime": {
      "type": "string",
      "defaultValue": "python",
      "metadata": {
        "description": "Runtime for Function App"
      }
    },
    "storageNetworkDefaultAction": {
      "type": "string",
      "defaultValue": "Allow",
      "allowedValues": [
        "Allow"
      ],
      "metadata": {
        "description": "IMPORTANT: Must be 'Allow' for Flex Consumption Function Apps. The deployment pipeline (Kudu) requires public network access to upload function packages. Security is maintained via Azure AD auth (allowSharedKeyAccess=false) and RBAC roles. Do NOT change this to 'Deny' or deployment will fail with 403 errors."
      }
    }
  },
  "variables": {
    "fileShareName": "[concat('azf', parameters('functionAppName'), uniqueString(resourceGroup().id))]",
    "storageAccountId": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]",
    "openAIResourceId": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('openAIServiceName'))]",
    "functionAppId": "[resourceId('Microsoft.Web/sites', parameters('functionAppName'))]",
    "appServicePlanName": "[concat('asp-', parameters('functionAppName'))]",
    "appInsightsName": "[concat('ai-', parameters('functionAppName'))]",
    "storageBlobDataOwnerRoleId": "b7e6dc6d-f1e8-4753-8033-0f276bb0955b",
    "storageBlobDataContributorRoleId": "ba92f5b4-2d11-453d-a403-e96b0029c9fe",
    "storageFileDataSmbShareContributorRoleId": "0c867c2a-1d8c-454a-a3db-ab2ea1bdc8bb",
    "storageFileDataPrivilegedContributorRoleId": "69566ab7-960f-475b-8e7c-b3118f30c6bd",
    "storageAccountContributorRoleId": "17d1049b-9a84-46fb-8f53-869881c3d3ab",
    "storageQueueDataContributorRoleId": "974c5e8b-45b9-4653-ba55-5f855dd0fb88",
    "storageTableDataContributorRoleId": "0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3",
    "cognitiveServicesOpenAIUserRoleId": "5e0bd9bd-7b93-4f28-af87-19fc36ad61bd"
  },
  "resources": [
    {
      "comments": "CRITICAL: Storage account MUST have publicNetworkAccess=Enabled for Flex Consumption deployments. The Kudu deployment pipeline requires network access to upload function packages to blob storage.",
      "type": "Microsoft.Storage/storageAccounts",
      "apiVersion": "2023-05-01",
      "name": "[parameters('storageAccountName')]",
      "location": "[resourceGroup().location]",
      "sku": {
        "name": "Standard_LRS"
      },
      "kind": "StorageV2",
      "properties": {
        "supportsHttpsTrafficOnly": true,
        "minimumTlsVersion": "TLS1_2",
        "defaultToOAuthAuthentication": true,
        "allowBlobPublicAccess": false,
        "allowSharedKeyAccess": false,
        "publicNetworkAccess": "Enabled",
        "networkAcls": {
          "bypass": "AzureServices,Logging,Metrics",
          "defaultAction": "[parameters('storageNetworkDefaultAction')]",
          "ipRules": [],
          "virtualNetworkRules": []
        }
      }
    },
    {
      "type": "Microsoft.Storage/storageAccounts/fileServices/shares",
      "apiVersion": "2022-05-01",
      "name": "[concat(parameters('storageAccountName'), '/default/', variables('fileShareName'))]",
      "dependsOn": [
        "[variables('storageAccountId')]"
      ]
    },
    {
      "type": "Microsoft.Storage/storageAccounts/blobServices/containers",
      "apiVersion": "2022-05-01",
      "name": "[concat(parameters('storageAccountName'), '/default/', parameters('storageBlobContainerName'))]",
      "dependsOn": [
        "[variables('storageAccountId')]"
      ],
      "properties": {
        "publicAccess": "None"
      }
    },
    {
      "type": "Microsoft.CognitiveServices/accounts",
      "apiVersion": "2023-05-01",
      "name": "[parameters('openAIServiceName')]",
      "location": "[parameters('openAILocation')]",
      "sku": {
        "name": "S0"
      },
      "kind": "OpenAI",
      "properties": {
        "customSubDomainName": "[parameters('openAIServiceName')]",
        "publicNetworkAccess": "Enabled",
        "disableLocalAuth": true
      }
    },
    {
      "type": "Microsoft.CognitiveServices/accounts/deployments",
      "apiVersion": "2023-05-01",
      "name": "[concat(parameters('openAIServiceName'), '/', parameters('openAIDeploymentName'))]",
      "dependsOn": [
        "[variables('openAIResourceId')]"
      ],
      "sku": {
        "name": "Standard",
        "capacity": "[parameters('openAIDeploymentCapacity')]"
      },
      "properties": {
        "model": {
          "format": "OpenAI",
          "name": "[parameters('openAIModelName')]",
          "version": "2024-08-06"
        },
        "versionUpgradeOption": "OnceNewDefaultVersionAvailable",
        "raiPolicyName": "Microsoft.Default"
      }
    },
    {
      "type": "Microsoft.Insights/components",
      "apiVersion": "2020-02-02",
      "name": "[variables('appInsightsName')]",
      "location": "[resourceGroup().location]",
      "kind": "web",
      "properties": {
        "Application_Type": "web"
      }
    },
    {
      "type": "Microsoft.Web/serverfarms",
      "apiVersion": "2023-12-01",
      "name": "[variables('appServicePlanName')]",
      "location": "[resourceGroup().location]",
      "sku": {
        "tier": "FlexConsumption",
        "name": "FC1"
      },
      "kind": "functionapp",
      "properties": {
        "reserved": true
      }
    },
    {
      "type": "Microsoft.Web/sites",
      "apiVersion": "2023-12-01",
      "name": "[parameters('functionAppName')]",
      "location": "[resourceGroup().location]",
      "kind": "functionapp,linux",
      "identity": {
        "type": "SystemAssigned"
      },
      "dependsOn": [
        "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]",
        "[variables('storageAccountId')]",
        "[resourceId('Microsoft.Storage/storageAccounts/blobServices/containers', parameters('storageAccountName'), 'default', parameters('storageBlobContainerName'))]",
        "[variables('openAIResourceId')]",
        "[resourceId('Microsoft.Insights/components', variables('appInsightsName'))]"
      ],
      "tags": {
        "hidden-link: /app-insights-resource-id": "[resourceId('Microsoft.Insights/components', variables('appInsightsName'))]"
      },
      "properties": {
        "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]",
        "httpsOnly": true,
        "functionAppConfig": {
          "deployment": {
            "storage": {
              "type": "blobContainer",
              "value": "[concat('https://', parameters('storageAccountName'), '.blob.core.windows.net/', parameters('storageBlobContainerName'))]",
              "authentication": {
                "type": "SystemAssignedIdentity"
              }
            }
          },
          "scaleAndConcurrency": {
            "maximumInstanceCount": 100,
            "instanceMemoryMB": 2048
          },
          "runtime": {
            "name": "python",
            "version": "[parameters('pythonVersion')]"
          }
        },
        "siteConfig": {
          "cors": {
            "allowedOrigins": ["*"],
            "supportCredentials": false
          },
          "appSettings": [
            {
              "name": "APPLICATIONINSIGHTS_CONNECTION_STRING",
              "value": "[reference(resourceId('Microsoft.Insights/components', variables('appInsightsName'))).ConnectionString]"
            },
            {
              "name": "AzureWebJobsStorage__accountName",
              "value": "[parameters('storageAccountName')]"
            },
            {
              "name": "AZURE_OPENAI_ENDPOINT",
              "value": "[reference(variables('openAIResourceId')).endpoint]"
            },
            {
              "name": "AZURE_OPENAI_API_VERSION",
              "value": "2025-01-01-preview"
            },
            {
              "name": "AZURE_OPENAI_DEPLOYMENT_NAME",
              "value": "[parameters('openAIDeploymentName')]"
            },
            {
              "name": "AZURE_STORAGE_ACCOUNT_NAME",
              "value": "[parameters('storageAccountName')]"
            },
            {
              "name": "AZURE_FILES_SHARE_NAME",
              "value": "[variables('fileShareName')]"
            },
            {
              "name": "ASSISTANT_NAME",
              "value": "[parameters('assistantName')]"
            },
            {
              "name": "CHARACTERISTIC_DESCRIPTION",
              "value": "[parameters('characteristicDescription')]"
            }
          ]
        }
      }
    },
    {
      "comments": "CRITICAL: Storage Account Contributor - Required for Flex Consumption Function Apps to fully access storage",
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2022-04-01",
      "name": "[guid(parameters('storageAccountName'), parameters('functionAppName'), variables('storageAccountContributorRoleId'))]",
      "scope": "[concat('Microsoft.Storage/storageAccounts/', parameters('storageAccountName'))]",
      "dependsOn": [
        "[variables('functionAppId')]",
        "[variables('storageAccountId')]"
      ],
      "properties": {
        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('storageAccountContributorRoleId'))]",
        "principalId": "[reference(variables('functionAppId'), '2023-12-01', 'Full').identity.principalId]",
        "principalType": "ServicePrincipal"
      }
    },
    {
      "comments": "Storage Blob Data Owner - Full control over blob data (required for deployment container access)",
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2022-04-01",
      "name": "[guid(parameters('storageAccountName'), parameters('functionAppName'), variables('storageBlobDataOwnerRoleId'))]",
      "scope": "[concat('Microsoft.Storage/storageAccounts/', parameters('storageAccountName'))]",
      "dependsOn": [
        "[variables('functionAppId')]",
        "[variables('storageAccountId')]"
      ],
      "properties": {
        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('storageBlobDataOwnerRoleId'))]",
        "principalId": "[reference(variables('functionAppId'), '2023-12-01', 'Full').identity.principalId]",
        "principalType": "ServicePrincipal"
      }
    },
    {
      "comments": "Storage Blob Data Contributor - Required for deployment pipeline to upload/download function packages",
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2022-04-01",
      "name": "[guid(parameters('storageAccountName'), parameters('functionAppName'), variables('storageBlobDataContributorRoleId'))]",
      "scope": "[concat('Microsoft.Storage/storageAccounts/', parameters('storageAccountName'))]",
      "dependsOn": [
        "[variables('functionAppId')]",
        "[variables('storageAccountId')]"
      ],
      "properties": {
        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('storageBlobDataContributorRoleId'))]",
        "principalId": "[reference(variables('functionAppId'), '2023-12-01', 'Full').identity.principalId]",
        "principalType": "ServicePrincipal"
      }
    },
    {
      "comments": "Storage File Data Privileged Contributor - Required for Azure Files token-based authentication with token_intent=backup",
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2022-04-01",
      "name": "[guid(parameters('storageAccountName'), parameters('functionAppName'), variables('storageFileDataPrivilegedContributorRoleId'))]",
      "scope": "[concat('Microsoft.Storage/storageAccounts/', parameters('storageAccountName'))]",
      "dependsOn": [
        "[variables('functionAppId')]",
        "[variables('storageAccountId')]"
      ],
      "properties": {
        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('storageFileDataPrivilegedContributorRoleId'))]",
        "principalId": "[reference(variables('functionAppId'), '2023-12-01', 'Full').identity.principalId]",
        "principalType": "ServicePrincipal"
      }
    },
    {
      "comments": "Storage File Data SMB Share Contributor - Required for file share operations",
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2022-04-01",
      "name": "[guid(parameters('storageAccountName'), parameters('functionAppName'), variables('storageFileDataSmbShareContributorRoleId'))]",
      "scope": "[concat('Microsoft.Storage/storageAccounts/', parameters('storageAccountName'))]",
      "dependsOn": [
        "[variables('functionAppId')]",
        "[variables('storageAccountId')]"
      ],
      "properties": {
        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('storageFileDataSmbShareContributorRoleId'))]",
        "principalId": "[reference(variables('functionAppId'), '2023-12-01', 'Full').identity.principalId]",
        "principalType": "ServicePrincipal"
      }
    },
    {
      "comments": "Storage Queue Data Contributor - Required for Azure Functions trigger bindings",
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2022-04-01",
      "name": "[guid(parameters('storageAccountName'), parameters('functionAppName'), variables('storageQueueDataContributorRoleId'))]",
      "scope": "[concat('Microsoft.Storage/storageAccounts/', parameters('storageAccountName'))]",
      "dependsOn": [
        "[variables('functionAppId')]",
        "[variables('storageAccountId')]"
      ],
      "properties": {
        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('storageQueueDataContributorRoleId'))]",
        "principalId": "[reference(variables('functionAppId'), '2023-12-01', 'Full').identity.principalId]",
        "principalType": "ServicePrincipal"
      }
    },
    {
      "comments": "Storage Table Data Contributor - Required for Azure Functions durable functions and state management",
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2022-04-01",
      "name": "[guid(parameters('storageAccountName'), parameters('functionAppName'), variables('storageTableDataContributorRoleId'))]",
      "scope": "[concat('Microsoft.Storage/storageAccounts/', parameters('storageAccountName'))]",
      "dependsOn": [
        "[variables('functionAppId')]",
        "[variables('storageAccountId')]"
      ],
      "properties": {
        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('storageTableDataContributorRoleId'))]",
        "principalId": "[reference(variables('functionAppId'), '2023-12-01', 'Full').identity.principalId]",
        "principalType": "ServicePrincipal"
      }
    },
    {
      "comments": "Cognitive Services OpenAI User - Required for Azure OpenAI API access via Managed Identity (Entra ID authentication)",
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2022-04-01",
      "name": "[guid(parameters('openAIServiceName'), parameters('functionAppName'), variables('cognitiveServicesOpenAIUserRoleId'))]",
      "scope": "[concat('Microsoft.CognitiveServices/accounts/', parameters('openAIServiceName'))]",
      "dependsOn": [
        "[variables('functionAppId')]",
        "[variables('openAIResourceId')]"
      ],
      "properties": {
        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('cognitiveServicesOpenAIUserRoleId'))]",
        "principalId": "[reference(variables('functionAppId'), '2023-12-01', 'Full').identity.principalId]",
        "principalType": "ServicePrincipal"
      }
    }
  ],
  "outputs": {
    "functionAppName": {
      "type": "string",
      "value": "[parameters('functionAppName')]"
    },
    "functionAppUrl": {
      "type": "string",
      "value": "[concat('https://', reference(variables('functionAppId')).defaultHostName)]"
    },
    "functionEndpoint": {
      "type": "string",
      "value": "[concat('https://', reference(variables('functionAppId')).defaultHostName, '/api/businessinsightbot_function')]"
    },
    "openAIEndpoint": {
      "type": "string",
      "value": "[reference(variables('openAIResourceId')).endpoint]"
    },
    "storageAccountName": {
      "type": "string",
      "value": "[parameters('storageAccountName')]"
    },
    "fileShareName": {
      "type": "string",
      "value": "[variables('fileShareName')]"
    },
    "resourceGroupName": {
      "type": "string",
      "value": "[resourceGroup().name]"
    },
    "deployCommand": {
      "type": "string",
      "value": "[concat('func azure functionapp publish ', parameters('functionAppName'), ' --build remote')]"
    },
    "managedIdentityPrincipalId": {
      "type": "string",
      "value": "[reference(variables('functionAppId'), '2023-12-01', 'Full').identity.principalId]"
    },
    "localSettingsJson": {
      "type": "string",
      "value": "[concat('{\n  \"IsEncrypted\": false,\n  \"Values\": {\n    \"FUNCTIONS_WORKER_RUNTIME\": \"python\",\n    \"AzureWebJobsStorage__accountName\": \"', parameters('storageAccountName'), '\",\n    \"AZURE_OPENAI_ENDPOINT\": \"', reference(variables('openAIResourceId')).endpoint, '\",\n    \"AZURE_OPENAI_API_VERSION\": \"2025-01-01-preview\",\n    \"AZURE_OPENAI_DEPLOYMENT_NAME\": \"', parameters('openAIDeploymentName'), '\",\n    \"AZURE_STORAGE_ACCOUNT_NAME\": \"', parameters('storageAccountName'), '\",\n    \"AZURE_FILES_SHARE_NAME\": \"', variables('fileShareName'), '\",\n    \"ASSISTANT_NAME\": \"', parameters('assistantName'), '\",\n    \"CHARACTERISTIC_DESCRIPTION\": \"', parameters('characteristicDescription'), '\"\n  }\n}')]"
    },
    "getFunctionKeyInstructions": {
      "type": "string",
      "value": "[concat('To get your Function Key:\n1. Go to Azure Portal\n2. Navigate to Function App: ', parameters('functionAppName'), '\n3. Click \"App keys\" in left menu\n4. Copy the \"default\" key under \"Host keys\"\n\nOr use Azure CLI:\naz functionapp keys list --name ', parameters('functionAppName'), ' --resource-group ', resourceGroup().name, ' --query \"functionKeys.default\" -o tsv')]"
    },
    "windowsSetupScript": {
      "type": "string",
      "value": "[concat('# CommunityRAPP - Windows Setup Script\n# Generated from ARM deployment\n# Run this script in PowerShell to configure your local environment\n# Uses Azure AD (Entra ID) authentication - no API keys required\n\n$ErrorActionPreference = \"Stop\"\n\nWrite-Host \"========================================\" -ForegroundColor Cyan\nWrite-Host \"CommunityRAPP - Local Setup\" -ForegroundColor Cyan\nWrite-Host \"(Azure AD Authentication)\" -ForegroundColor Cyan\nWrite-Host \"========================================\" -ForegroundColor Cyan\n\n# Configuration from deployment\n$FUNCTION_APP_NAME = \"', parameters('functionAppName'), '\"\n$RESOURCE_GROUP = \"', resourceGroup().name, '\"\n$SUBSCRIPTION_ID = \"', subscription().subscriptionId, '\"\n$OPENAI_SERVICE_NAME = \"', parameters('openAIServiceName'), '\"\n$OPENAI_ENDPOINT = \"', reference(variables('openAIResourceId')).endpoint, '\"\n$OPENAI_DEPLOYMENT = \"', parameters('openAIDeploymentName'), '\"\n$STORAGE_ACCOUNT = \"', parameters('storageAccountName'), '\"\n$FILE_SHARE = \"', variables('fileShareName'), '\"\n$ASSISTANT_NAME = \"', parameters('assistantName'), '\"\n$CHARACTERISTIC_DESC = \"', parameters('characteristicDescription'), '\"\n$FUNCTION_URL = \"https://', reference(variables('functionAppId')).defaultHostName, '/api/businessinsightbot_function\"\n$REPO_URL = \"https://github.com/kody-w/CommunityRAPP.git\"\n\nfunction Find-Python311 {\n    $commands = @(\"python3.11\", \"python311\")\n    foreach ($cmd in $commands) {\n        $fullPath = Get-Command $cmd -ErrorAction SilentlyContinue\n        if ($fullPath) {\n            $ver = & $fullPath.Source --version 2>&1\n            if ($ver -match \"Python 3\\.11\") { return $fullPath.Source }\n        }\n    }\n    try {\n        $ver = & py -3.11 --version 2>&1\n        if ($ver -match \"Python 3\\.11\") { return \"py -3.11\" }\n    } catch {}\n    $paths = @(\"$env:LOCALAPPDATA\\Programs\\Python\\Python311\\python.exe\", \"C:\\Python311\\python.exe\")\n    foreach ($p in $paths) {\n        if (Test-Path $p) {\n            $ver = & $p --version 2>&1\n            if ($ver -match \"Python 3\\.11\") { return $p }\n        }\n    }\n    return $null\n}\n\nWrite-Host \"\"\nWrite-Host \"Checking prerequisites...\" -ForegroundColor Yellow\n\nif (-not (Get-Command git -ErrorAction SilentlyContinue)) {\n    Write-Host \"[!] Git not found - installing...\" -ForegroundColor Yellow\n    winget install Git.Git --accept-source-agreements --accept-package-agreements\n    $env:Path = [System.Environment]::GetEnvironmentVariable(\"Path\",\"Machine\") + \";\" + [System.Environment]::GetEnvironmentVariable(\"Path\",\"User\")\n}\nWrite-Host \"[OK] Git installed\" -ForegroundColor Green\n\n$PYTHON_CMD = Find-Python311\nif (-not $PYTHON_CMD) {\n    Write-Host \"[!] Python 3.11 not found - installing...\" -ForegroundColor Yellow\n    winget install Python.Python.3.11 --accept-source-agreements --accept-package-agreements\n    $env:Path = [System.Environment]::GetEnvironmentVariable(\"Path\",\"Machine\") + \";\" + [System.Environment]::GetEnvironmentVariable(\"Path\",\"User\")\n    Start-Sleep -Seconds 2\n    $PYTHON_CMD = Find-Python311\n    if (-not $PYTHON_CMD) {\n        Write-Host \"[X] Failed to install Python 3.11. Please restart terminal and try again.\" -ForegroundColor Red\n        exit 1\n    }\n}\nWrite-Host \"[OK] Python 3.11 found: $PYTHON_CMD\" -ForegroundColor Green\n\nif (-not (Get-Command func -ErrorAction SilentlyContinue)) {\n    Write-Host \"[!] Azure Functions Core Tools not found - installing...\" -ForegroundColor Yellow\n    winget install Microsoft.Azure.FunctionsCoreTools --accept-source-agreements --accept-package-agreements\n    $env:Path = [System.Environment]::GetEnvironmentVariable(\"Path\",\"Machine\") + \";\" + [System.Environment]::GetEnvironmentVariable(\"Path\",\"User\")\n}\nWrite-Host \"[OK] Azure Functions Core Tools installed\" -ForegroundColor Green\n\nif (-not (Get-Command az -ErrorAction SilentlyContinue)) {\n    Write-Host \"[!] Azure CLI not found - installing...\" -ForegroundColor Yellow\n    winget install Microsoft.AzureCLI --accept-source-agreements --accept-package-agreements\n    $env:Path = [System.Environment]::GetEnvironmentVariable(\"Path\",\"Machine\") + \";\" + [System.Environment]::GetEnvironmentVariable(\"Path\",\"User\")\n}\nWrite-Host \"[OK] Azure CLI installed\" -ForegroundColor Green\n\nWrite-Host \"\"\nWrite-Host \"Checking Azure CLI login...\" -ForegroundColor Yellow\n$azAccount = az account show 2>$null | ConvertFrom-Json\nif (-not $azAccount) {\n    Write-Host \"Running: az login\" -ForegroundColor Yellow\n    az login\n    $azAccount = az account show | ConvertFrom-Json\n}\nWrite-Host \"[OK] Logged in as: $($azAccount.user.name)\" -ForegroundColor Green\n$USER_OBJECT_ID = (az ad signed-in-user show --query id -o tsv)\n\nWrite-Host \"\"\nWrite-Host \"Assigning roles for local development...\" -ForegroundColor Yellow\ntry { az role assignment create --assignee $USER_OBJECT_ID --role \"Storage File Data Privileged Contributor\" --scope \"/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP/providers/Microsoft.Storage/storageAccounts/$STORAGE_ACCOUNT\" 2>$null } catch {}\ntry { az role assignment create --assignee $USER_OBJECT_ID --role \"Cognitive Services OpenAI User\" --scope \"/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP/providers/Microsoft.CognitiveServices/accounts/$OPENAI_SERVICE_NAME\" 2>$null } catch {}\nWrite-Host \"[OK] Roles assigned\" -ForegroundColor Green\n\nWrite-Host \"\"\nWrite-Host \"Cloning repository...\" -ForegroundColor Yellow\nif (Test-Path \"CommunityRAPP\") { Set-Location CommunityRAPP; git pull } else { git clone $REPO_URL; Set-Location CommunityRAPP }\n\nWrite-Host \"Creating Python 3.11 virtual environment...\" -ForegroundColor Yellow\nif (Test-Path \".venv\") { Remove-Item -Recurse -Force .venv }\nif ($PYTHON_CMD -eq \"py -3.11\") { & py -3.11 -m venv .venv } else { & $PYTHON_CMD -m venv .venv }\n.venv\\Scripts\\Activate.ps1\npip install --upgrade pip -q\npip install -r requirements.txt -q\n\nWrite-Host \"Creating local.settings.json...\" -ForegroundColor Yellow\n$localSettings = @{ IsEncrypted = $false; Values = @{ FUNCTIONS_WORKER_RUNTIME = \"python\"; \"AzureWebJobsStorage__accountName\" = $STORAGE_ACCOUNT; AZURE_OPENAI_ENDPOINT = $OPENAI_ENDPOINT; AZURE_OPENAI_API_VERSION = \"2025-01-01-preview\"; AZURE_OPENAI_DEPLOYMENT_NAME = $OPENAI_DEPLOYMENT; AZURE_STORAGE_ACCOUNT_NAME = $STORAGE_ACCOUNT; AZURE_FILES_SHARE_NAME = $FILE_SHARE; ASSISTANT_NAME = $ASSISTANT_NAME; CHARACTERISTIC_DESCRIPTION = $CHARACTERISTIC_DESC } }\n$localSettings | ConvertTo-Json -Depth 10 | Set-Content -Path \"local.settings.json\" -Encoding UTF8\n\nfunc azure functionapp publish $FUNCTION_APP_NAME --build remote\n\nWrite-Host \"\"\nWrite-Host \"========================================\" -ForegroundColor Green\nWrite-Host \"Setup Complete!\" -ForegroundColor Green\nWrite-Host \"========================================\" -ForegroundColor Green\nWrite-Host \"Function URL: $FUNCTION_URL\" -ForegroundColor White\nWrite-Host \"To run locally: .\\\\run.ps1\" -ForegroundColor Yellow\n')]"
    },
    "macLinuxSetupScript": {
      "type": "string",
      "value": "[concat('#!/bin/bash\n# CommunityRAPP - Mac/Linux Setup Script\n# Generated from ARM deployment\n# Uses Azure AD (Entra ID) authentication - no API keys required\n\nset -e\nRED=\"\\033[0;31m\" GREEN=\"\\033[0;32m\" YELLOW=\"\\033[1;33m\" BLUE=\"\\033[0;34m\" NC=\"\\033[0m\"\n\necho -e \"${BLUE}========================================${NC}\"\necho -e \"${BLUE}CommunityRAPP - Local Setup${NC}\"\necho -e \"${BLUE}========================================${NC}\"\n\nFUNCTION_APP_NAME=\"', parameters('functionAppName'), '\"\nRESOURCE_GROUP=\"', resourceGroup().name, '\"\nSUBSCRIPTION_ID=\"', subscription().subscriptionId, '\"\nOPENAI_SERVICE_NAME=\"', parameters('openAIServiceName'), '\"\nOPENAI_ENDPOINT=\"', reference(variables('openAIResourceId')).endpoint, '\"\nOPENAI_DEPLOYMENT=\"', parameters('openAIDeploymentName'), '\"\nSTORAGE_ACCOUNT=\"', parameters('storageAccountName'), '\"\nFILE_SHARE=\"', variables('fileShareName'), '\"\nASSISTANT_NAME=\"', parameters('assistantName'), '\"\nCHARACTERISTIC_DESC=\"', parameters('characteristicDescription'), '\"\nFUNCTION_URL=\"https://', reference(variables('functionAppId')).defaultHostName, '/api/businessinsightbot_function\"\nREPO_URL=\"https://github.com/kody-w/CommunityRAPP.git\"\n\nif [[ \"$OSTYPE\" == \"darwin\"* ]]; then OS_TYPE=\"macos\"; else OS_TYPE=\"linux\"; fi\n\nfind_python311() {\n    for cmd in python3.11 python311; do\n        if command -v $cmd &>/dev/null; then\n            ver=$($cmd --version 2>&1)\n            [[ $ver == *\"3.11\"* ]] && echo $cmd && return 0\n        fi\n    done\n    if [[ \"$OS_TYPE\" == \"macos\" ]]; then\n        for p in /opt/homebrew/bin/python3.11 /usr/local/bin/python3.11; do\n            [[ -x $p ]] && echo $p && return 0\n        done\n    fi\n    return 1\n}\n\necho -e \"${YELLOW}Checking prerequisites...${NC}\"\n\ncommand -v git &>/dev/null || { if [[ \"$OS_TYPE\" == \"macos\" ]]; then brew install git; else sudo apt-get update && sudo apt-get install -y git; fi; }\necho -e \"${GREEN}[OK] Git${NC}\"\n\nPYTHON_CMD=$(find_python311) || {\n    echo -e \"${YELLOW}Installing Python 3.11...${NC}\"\n    if [[ \"$OS_TYPE\" == \"macos\" ]]; then brew install python@3.11; else sudo apt-get update && sudo apt-get install -y python3.11 python3.11-venv; fi\n    PYTHON_CMD=$(find_python311) || { echo -e \"${RED}Failed to install Python 3.11${NC}\"; exit 1; }\n}\necho -e \"${GREEN}[OK] Python 3.11: $PYTHON_CMD${NC}\"\n\ncommand -v func &>/dev/null || { if [[ \"$OS_TYPE\" == \"macos\" ]]; then brew tap azure/functions && brew install azure-functions-core-tools@4; else npm install -g azure-functions-core-tools@4; fi; }\necho -e \"${GREEN}[OK] Azure Functions Core Tools${NC}\"\n\ncommand -v az &>/dev/null || { if [[ \"$OS_TYPE\" == \"macos\" ]]; then brew install azure-cli; else curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash; fi; }\necho -e \"${GREEN}[OK] Azure CLI${NC}\"\n\naz account show &>/dev/null || az login\nUSER_OBJECT_ID=$(az ad signed-in-user show --query id -o tsv)\necho -e \"${GREEN}[OK] Logged in${NC}\"\n\necho -e \"${YELLOW}Assigning roles...${NC}\"\naz role assignment create --assignee \"$USER_OBJECT_ID\" --role \"Storage File Data Privileged Contributor\" --scope \"/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP/providers/Microsoft.Storage/storageAccounts/$STORAGE_ACCOUNT\" 2>/dev/null || true\naz role assignment create --assignee \"$USER_OBJECT_ID\" --role \"Cognitive Services OpenAI User\" --scope \"/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP/providers/Microsoft.CognitiveServices/accounts/$OPENAI_SERVICE_NAME\" 2>/dev/null || true\necho -e \"${GREEN}[OK] Roles assigned${NC}\"\n\nif [ -d \"CommunityRAPP\" ]; then cd CommunityRAPP && git pull; else git clone $REPO_URL && cd CommunityRAPP; fi\n\n[ -d \".venv\" ] && rm -rf .venv\n$PYTHON_CMD -m venv .venv\nsource .venv/bin/activate\npip install --upgrade pip -q && pip install -r requirements.txt -q\n\ncat > local.settings.json << SETTINGS\n{\n  \"IsEncrypted\": false,\n  \"Values\": {\n    \"FUNCTIONS_WORKER_RUNTIME\": \"python\",\n    \"AzureWebJobsStorage__accountName\": \"$STORAGE_ACCOUNT\",\n    \"AZURE_OPENAI_ENDPOINT\": \"$OPENAI_ENDPOINT\",\n    \"AZURE_OPENAI_API_VERSION\": \"2025-01-01-preview\",\n    \"AZURE_OPENAI_DEPLOYMENT_NAME\": \"$OPENAI_DEPLOYMENT\",\n    \"AZURE_STORAGE_ACCOUNT_NAME\": \"$STORAGE_ACCOUNT\",\n    \"AZURE_FILES_SHARE_NAME\": \"$FILE_SHARE\",\n    \"ASSISTANT_NAME\": \"$ASSISTANT_NAME\",\n    \"CHARACTERISTIC_DESCRIPTION\": \"$CHARACTERISTIC_DESC\"\n  }\n}\nSETTINGS\n\nfunc azure functionapp publish $FUNCTION_APP_NAME --build remote\n\necho -e \"${GREEN}========================================${NC}\"\necho -e \"${GREEN}Setup Complete!${NC}\"\necho -e \"${GREEN}========================================${NC}\"\necho \"Function URL: $FUNCTION_URL\"\necho \"To run locally: ./run.sh\"\n')]"
    },
    "storageVerificationCommand": {
      "type": "string",
      "value": "[concat('az storage account show --name ', parameters('storageAccountName'), ' --query \"{publicNetworkAccess:publicNetworkAccess, allowSharedKeyAccess:allowSharedKeyAccess}\" -o json')]"
    },
    "troubleshootingGuide": {
      "type": "string",
      "value": "[concat('# Troubleshooting\\n\\n## 403 Storage Error:\\naz storage account update --name ', parameters('storageAccountName'), ' --public-network-access Enabled\\n\\n## Retry deployment:\\nfunc azure functionapp publish ', parameters('functionAppName'), ' --build remote\\n\\n## Check functions:\\naz functionapp function list --name ', parameters('functionAppName'), ' --resource-group ', resourceGroup().name, ' -o table')]"
    }
  }
}