Microsoft Azure Integration

using System.Net.Http.Json;
using Azure.Identity;
using Azure.Security.KeyVault.Secrets;
using Microsoft.Azure.Functions.Worker;
using Microsoft.Extensions.Logging;

namespace Certyo.Functions;

public class CertyoIngestionFunction
{
    private readonly HttpClient _http;
    private readonly ILogger<CertyoIngestionFunction> _logger;
    private string? _apiKey;

    public CertyoIngestionFunction(
        IHttpClientFactory httpClientFactory,
        ILogger<CertyoIngestionFunction> logger)
    {
        _http = httpClientFactory.CreateClient("Certyo");
        _logger = logger;
    }

    [Function("IngestRecord")]
    public async Task Run(
        [ServiceBusTrigger("certyo-ingest", Connection = "ServiceBusConnection")]
        ServiceBusReceivedMessage message,
        FunctionContext context)
    {
        var apiKey = await GetApiKeyAsync();
        var record = message.Body.ToObjectFromJson<CertyoRecord>();

        _logger.LogInformation(
            "Ingesting record {RecordId} for tenant {TenantId}",
            record.RecordId, record.TenantId);

        var request = new HttpRequestMessage(HttpMethod.Post, "/api/v1/records")
        {
            Content = JsonContent.Create(new
            {
                record.TenantId,
                record.Database,
                record.Collection,
                record.RecordId,
                record.RecordVersion,
                operationType = "upsert",
                record.RecordPayload,
                sourceTimestamp = record.SourceTimestamp ?? DateTimeOffset.UtcNow,
                idempotencyKey = $"{record.RecordId}-{record.RecordVersion}-{DateTime.UtcNow:yyyy-MM-dd}"
            })
        };
        request.Headers.Add("X-API-Key", apiKey);

        var response = await _http.SendAsync(request);

        if (!response.IsSuccessStatusCode)
        {
            var body = await response.Content.ReadAsStringAsync();
            _logger.LogError(
                "Certyo ingestion failed for {RecordId}: {Status} {Body}",
                record.RecordId, response.StatusCode, body);
            throw new InvalidOperationException(
                $"Certyo returned {response.StatusCode}");
        }

        var result = await response.Content
            .ReadFromJsonAsync<CertyoIngestionResult>();
        _logger.LogInformation(
            "Record {RecordId} accepted. Hash: {Hash}",
            record.RecordId, result?.RecordHash);
    }

    private async Task<string> GetApiKeyAsync()
    {
        if (_apiKey is not null) return _apiKey;

        var vaultUri = Environment.GetEnvironmentVariable("KEY_VAULT_URI")!;
        var client = new SecretClient(new Uri(vaultUri), new DefaultAzureCredential());
        var secret = await client.GetSecretAsync("certyo-api-key");
        _apiKey = secret.Value.Value;
        return _apiKey;
    }
}

public record CertyoRecord(
    string TenantId,
    string Database,
    string Collection,
    string RecordId,
    string RecordVersion,
    object RecordPayload,
    DateTimeOffset? SourceTimestamp);

public record CertyoIngestionResult(
    string RecordId,
    string RecordHash,
    string TenantId,
    DateTimeOffset AcceptedAt,
    bool IdempotencyReplayed);

@description('Azure region for all resources')
param location string = resourceGroup().location

@description('Certyo API base URL')
param certyoApiUrl string = 'https://www.certyos.com'

// --- Service Bus Namespace + Queue ---
resource serviceBusNamespace 'Microsoft.ServiceBus/namespaces@2022-10-01-preview' = {
  name: 'certyo-sb-${uniqueString(resourceGroup().id)}'
  location: location
  sku: {
    name: 'Standard'
    tier: 'Standard'
  }
}

resource ingestQueue 'Microsoft.ServiceBus/namespaces/queues@2022-10-01-preview' = {
  parent: serviceBusNamespace
  name: 'certyo-ingest'
  properties: {
    maxDeliveryCount: 10
    lockDuration: 'PT5M'
    defaultMessageTimeToLive: 'P14D'
    deadLetteringOnMessageExpiration: true
    enablePartitioning: false
  }
}

// --- Key Vault for API Key ---
resource keyVault 'Microsoft.KeyVault/vaults@2023-07-01' = {
  name: 'certyo-kv-${uniqueString(resourceGroup().id)}'
  location: location
  properties: {
    sku: { family: 'A', name: 'standard' }
    tenantId: subscription().tenantId
    enableRbacAuthorization: true
    enableSoftDelete: true
    softDeleteRetentionInDays: 90
  }
}

// --- Storage Account for Function App ---
resource storageAccount 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  name: 'certyofn${uniqueString(resourceGroup().id)}'
  location: location
  sku: { name: 'Standard_LRS' }
  kind: 'StorageV2'
}

// --- App Service Plan (Consumption) ---
resource hostingPlan 'Microsoft.Web/serverfarms@2023-01-01' = {
  name: 'certyo-plan'
  location: location
  sku: {
    name: 'Y1'
    tier: 'Dynamic'
  }
  properties: {
    reserved: true
  }
}

// --- Function App ---
resource functionApp 'Microsoft.Web/sites@2023-01-01' = {
  name: 'certyo-fn-${uniqueString(resourceGroup().id)}'
  location: location
  kind: 'functionapp,linux'
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    serverFarmId: hostingPlan.id
    siteConfig: {
      linuxFxVersion: 'DOTNET-ISOLATED|8.0'
      appSettings: [
        { name: 'AzureWebJobsStorage', value: 'DefaultEndpointsProtocol=https;AccountName=${storageAccount.name};AccountKey=${storageAccount.listKeys().keys[0].value}' }
        { name: 'FUNCTIONS_EXTENSION_VERSION', value: '~4' }
        { name: 'FUNCTIONS_WORKER_RUNTIME', value: 'dotnet-isolated' }
        { name: 'ServiceBusConnection', value: serviceBusNamespace.listKeys(serviceBusNamespace::authRule.id, '2022-10-01-preview').primaryConnectionString }
        { name: 'KEY_VAULT_URI', value: keyVault.properties.vaultUri }
        { name: 'CERTYO_API_URL', value: certyoApiUrl }
      ]
    }
  }
}

resource authRule 'Microsoft.ServiceBus/namespaces/AuthorizationRules@2022-10-01-preview' existing = {
  parent: serviceBusNamespace
  name: 'RootManageSharedAccessKey'
}

// --- Key Vault access for Function App's Managed Identity ---
resource kvRoleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(keyVault.id, functionApp.id, '4633458b-17de-408a-b874-0445c86b69e6')
  scope: keyVault
  properties: {
    principalId: functionApp.identity.principalId
    roleDefinitionId: subscriptionResourceId(
      'Microsoft.Authorization/roleDefinitions',
      '4633458b-17de-408a-b874-0445c86b69e6' // Key Vault Secrets User
    )
    principalType: 'ServicePrincipal'
  }
}

output functionAppName string = functionApp.name
output serviceBusNamespace string = serviceBusNamespace.name
output keyVaultUri string = keyVault.properties.vaultUri

# Variables
RG="certyo-rg"
LOCATION="eastus"
APIM_NAME="certyo-apim"
KV_NAME="certyo-kv"

# Create resource group
az group create --name $RG --location $LOCATION

# Store Certyo API key in Key Vault
az keyvault secret set \
  --vault-name $KV_NAME \
  --name certyo-api-key \
  --value "certyo_sk_live_your_key_here"

# Create APIM Named Value backed by Key Vault
az apim nv create \
  --resource-group $RG \
  --service-name $APIM_NAME \
  --named-value-id certyo-api-key \
  --display-name "Certyo API Key" \
  --secret true \
  --value "{{certyo-api-key}}"

# Create a Product for internal consumers
az apim product create \
  --resource-group $RG \
  --service-name $APIM_NAME \
  --product-id certyo-internal \
  --title "Certyo Internal" \
  --description "Internal access to Certyo Records API" \
  --subscription-required true \
  --approval-required false \
  --state published

# Add the Certyo API to the product
az apim product api add \
  --resource-group $RG \
  --service-name $APIM_NAME \
  --product-id certyo-internal \
  --api-id certyo-records

# Create a subscription for a team
az apim subscription create \
  --resource-group $RG \
  --service-name $APIM_NAME \
  --product-id certyo-internal \
  --subscription-id "team-orders" \
  --display-name "Orders Team"

using System.Net.Http.Json;
using Azure.Identity;
using Azure.Messaging.EventGrid;
using Azure.Security.KeyVault.Secrets;
using Microsoft.Azure.Functions.Worker;
using Microsoft.Extensions.Logging;

namespace Certyo.Functions;

public class CertyoVerificationPoller
{
    private readonly HttpClient _http;
    private readonly ILogger<CertyoVerificationPoller> _logger;
    private string? _apiKey;

    public CertyoVerificationPoller(
        IHttpClientFactory httpClientFactory,
        ILogger<CertyoVerificationPoller> logger)
    {
        _http = httpClientFactory.CreateClient("Certyo");
        _logger = logger;
    }

    /// <summary>
    /// Runs every 2 minutes. Queries Certyo for recently ingested records
    /// that have not yet been verified, then publishes anchoring events
    /// to Event Grid for downstream subscribers.
    /// </summary>
    [Function("VerificationPoller")]
    public async Task Run(
        [TimerTrigger("0 */2 * * * *")] TimerInfo timer,
        FunctionContext context)
    {
        var apiKey = await GetApiKeyAsync();
        var tenantId = Environment.GetEnvironmentVariable("CERTYO_TENANT_ID")!;

        // Query pending snapshots from the last 10 minutes
        var since = DateTimeOffset.UtcNow.AddMinutes(-10).ToString("o");
        var request = new HttpRequestMessage(HttpMethod.Get,
            $"/api/v1/snapshots?tenantId={tenantId}&status=PendingAnchor&since={since}");
        request.Headers.Add("X-API-Key", apiKey);

        var response = await _http.SendAsync(request);
        response.EnsureSuccessStatusCode();

        var snapshots = await response.Content
            .ReadFromJsonAsync<SnapshotQueryResult>();

        if (snapshots?.Items is null || snapshots.Items.Length == 0)
        {
            _logger.LogInformation("No pending snapshots found.");
            return;
        }

        var eventGridEndpoint = Environment.GetEnvironmentVariable("EVENT_GRID_ENDPOINT")!;
        var eventGridClient = new EventGridPublisherClient(
            new Uri(eventGridEndpoint), new DefaultAzureCredential());

        foreach (var snapshot in snapshots.Items)
        {
            if (snapshot.Status == "Anchored" && snapshot.OnChainConfirmed)
            {
                _logger.LogInformation(
                    "Snapshot {SnapshotId} anchored on Polygon. Publishing event.",
                    snapshot.SnapshotId);

                await eventGridClient.SendEventAsync(new EventGridEvent(
                    subject: $"/certyo/records/{tenantId}/{snapshot.SnapshotId}",
                    eventType: "Certyo.Record.Anchored",
                    dataVersion: "1.0",
                    data: new
                    {
                        snapshot.SnapshotId,
                        snapshot.Status,
                        snapshot.OnChainConfirmed,
                        snapshot.MerkleRoot,
                        snapshot.AnchoredAt,
                        TenantId = tenantId
                    }));
            }
        }

        _logger.LogInformation(
            "Processed {Count} snapshots.", snapshots.Items.Length);
    }

    private async Task<string> GetApiKeyAsync()
    {
        if (_apiKey is not null) return _apiKey;

        var vaultUri = Environment.GetEnvironmentVariable("KEY_VAULT_URI")!;
        var client = new SecretClient(new Uri(vaultUri), new DefaultAzureCredential());
        var secret = await client.GetSecretAsync("certyo-api-key");
        _apiKey = secret.Value.Value;
        return _apiKey;
    }
}

public record SnapshotQueryResult(SnapshotItem[] Items);

public record SnapshotItem(
    string SnapshotId,
    string Status,
    bool OnChainConfirmed,
    string? MerkleRoot,
    DateTimeOffset? AnchoredAt);