55
66# If ACTIONS_ID_TOKEN_REQUEST_URL is set, we are in GitHub Actions - skip interception
77if [ -n " ${ACTIONS_ID_TOKEN_REQUEST_URL} " ]; then
8- source " $( dirname " $0 " ) " /resolve-shim.sh
9- AZ_EXE=" $( resolve_shim) "
10- exec " ${AZ_EXE} " " $@ "
8+ source " $( dirname " $0 " ) " /resolve-shim.sh
9+ AZ_EXE=" $( resolve_shim) "
10+ exec " ${AZ_EXE} " " $@ "
1111fi
1212
1313source " $( dirname " $0 " ) " /resolve-shim.sh
1414
1515# Well-known resource type mappings (az account get-access-token --resource-type)
1616declare -A RESOURCE_TYPE_MAP=(
17- [" arm" ]=" https://management.azure.com"
18- [" aad-graph" ]=" https://graph.windows.net"
19- [" ms-graph" ]=" https://graph.microsoft.com"
20- [" batch" ]=" https://batch.core.windows.net"
21- [" data-lake" ]=" https://datalake.azure.net"
22- [" media" ]=" https://rest.media.azure.net"
23- [" oss-rdbms" ]=" https://ossrdbms-aad.database.windows.net"
17+ [" arm" ]=" https://management.azure.com"
18+ [" aad-graph" ]=" https://graph.windows.net"
19+ [" ms-graph" ]=" https://graph.microsoft.com"
20+ [" batch" ]=" https://batch.core.windows.net"
21+ [" data-lake" ]=" https://datalake.azure.net"
22+ [" media" ]=" https://rest.media.azure.net"
23+ [" oss-rdbms" ]=" https://ossrdbms-aad.database.windows.net"
2424)
2525
2626# Check if this is a get-access-token request that we should intercept
2727if [[ " $1 " == " account" && " $2 " == " get-access-token" ]]; then
28- resource=" "
29- scope=" "
30- resource_type=" "
31- prev=" "
28+ resource=" "
29+ scope=" "
30+ resource_type=" "
31+ prev=" "
3232
33- for arg in " ${@: 3} " ; do
34- case " $arg " in
35- --resource=* ) resource=" ${arg# --resource=} " ;;
36- --scope=* ) scope=" ${arg# --scope=} " ;;
37- --resource-type=* ) resource_type=" ${arg# --resource-type=} " ;;
38- * )
39- case " $prev " in
40- --resource) resource=" $arg " ;;
41- --scope) scope=" $arg " ;;
42- --resource-type) resource_type=" $arg " ;;
43- esac
44- ;;
45- esac
46- prev=" $arg "
47- done
33+ for arg in " ${@: 3} " ; do
34+ case " $arg " in
35+ --resource=* ) resource=" ${arg# --resource=} " ;;
36+ --scope=* ) scope=" ${arg# --scope=} " ;;
37+ --resource-type=* ) resource_type=" ${arg# --resource-type=} " ;;
38+ * )
39+ case " $prev " in
40+ --resource) resource=" $arg " ;;
41+ --scope) scope=" $arg " ;;
42+ --resource-type) resource_type=" $arg " ;;
43+ esac
44+ ;;
45+ esac
46+ prev=" $arg "
47+ done
4848
49- # Resolve resource-type to resource URL if specified
50- if [[ -n " $resource_type " && -z " $resource " ]]; then
51- resource=" ${RESOURCE_TYPE_MAP[$resource_type]} "
52- fi
49+ # Resolve resource-type to resource URL if specified
50+ if [[ -n " $resource_type " && -z " $resource " ]]; then
51+ resource=" ${RESOURCE_TYPE_MAP[$resource_type]} "
52+ fi
5353
54- # Determine the scope to request
55- request_scope=" "
56- if [[ -n " $scope " ]]; then
57- request_scope=" $scope "
58- elif [[ -n " $resource " ]]; then
59- if [[ " $resource " == * " /.default" ]]; then
60- request_scope=" $resource "
61- else
62- request_scope=" ${resource} /.default"
54+ # Determine the scope to request
55+ request_scope=" "
56+ if [[ -n " $scope " ]]; then
57+ request_scope=" $scope "
58+ elif [[ -n " $resource " ]]; then
59+ if [[ " $resource " == * " /.default" ]]; then
60+ request_scope=" $resource "
61+ else
62+ request_scope=" ${resource} /.default"
63+ fi
6364 fi
64- fi
6565
66- # If we have a scope and azure-auth-helper exists, use it
67- if [[ -n " $request_scope " && -f " ${HOME} /azure-auth-helper" ]]; then
68- token=$( " ${HOME} /azure-auth-helper" get-access-token " $request_scope " 2> /dev/null)
69- if [[ $? -eq 0 && -n " $token " ]]; then
70- # Escape token for safe JSON embedding (handle backslashes and quotes)
71- escaped_token=" ${token// \\ / \\\\ } "
72- escaped_token=" ${escaped_token// \" / \\\" } "
66+ # If we have a scope and azure-auth-helper exists, use it
67+ if [[ -n " $request_scope " && -f " ${HOME} /azure-auth-helper" ]]; then
68+ token=$( " ${HOME} /azure-auth-helper" get-access-token " $request_scope " 2> /dev/null)
69+ if [[ $? -eq 0 && -n " $token " ]]; then
70+ # Escape token for safe JSON embedding (handle backslashes and quotes)
71+ escaped_token=" ${token// \\ / \\\\ } "
72+ escaped_token=" ${escaped_token// \" / \\\" } "
7373
74- # Calculate expiry timestamps (conservative 1 hour estimate)
75- # expires_on = POSIX timestamp, expiresOn = local datetime
76- if date --version > /dev/null 2>&1 ; then
77- # GNU date (Linux)
78- expires_on=$( date -d " +1 hour" " +%s" )
79- expires_on_datetime=$( date -d " +1 hour" " +%Y-%m-%d %H:%M:%S.000000" )
80- else
81- # BSD date (macOS)
82- expires_on=$( date -v+1H " +%s" )
83- expires_on_datetime=$( date -v+1H " +%Y-%m-%d %H:%M:%S.000000" )
84- fi
74+ # Calculate expiry timestamps (conservative 1 hour estimate)
75+ # expires_on = POSIX timestamp, expiresOn = local datetime
76+ if date --version > /dev/null 2>&1 ; then
77+ # GNU date (Linux)
78+ expires_on=$( date -d " +1 hour" " +%s" )
79+ expires_on_datetime=$( date -d " +1 hour" " +%Y-%m-%d %H:%M:%S.000000" )
80+ else
81+ # BSD date (macOS)
82+ expires_on=$( date -v+1H " +%s" )
83+ expires_on_datetime=$( date -v+1H " +%Y-%m-%d %H:%M:%S.000000" )
84+ fi
8585
86- # Return in az CLI JSON format (matching real az CLI output)
87- cat << EOF
86+ # Return in az CLI JSON format (matching real az CLI output)
87+ cat << EOF
8888{
8989 "accessToken": "${escaped_token} ",
9090 "expiresOn": "${expires_on_datetime} ",
@@ -94,19 +94,19 @@ if [[ "$1" == "account" && "$2" == "get-access-token" ]]; then
9494 "tokenType": "Bearer"
9595}
9696EOF
97- exit 0
97+ exit 0
98+ fi
9899 fi
99- fi
100100fi
101101
102- # Fall through to real az CLI for all other commands.
102+ # Fall through to real az CLI for all other commands
103103AZ_EXE=" $( resolve_shim) "
104104if [[ -n " $AZ_EXE " ]]; then
105- # If AZURE_DEVOPS_EXT_PAT is not already set, try to acquire it from ado-auth-helper
106- # so that 'az devops' commands authenticate automatically.
107- AZURE_DEVOPS_EXT_PAT=" ${AZURE_DEVOPS_EXT_PAT:- $(" ${HOME} /ado-auth-helper" get-access-token 2>/ dev/ null)} " \
108- exec " ${AZ_EXE} " " $@ "
105+ # If AZURE_DEVOPS_EXT_PAT is not already set, try to acquire it from ado-auth-helper
106+ # so that 'az devops' commands authenticate automatically.
107+ AZURE_DEVOPS_EXT_PAT=" ${AZURE_DEVOPS_EXT_PAT:- $(" ${HOME} /ado-auth-helper" get-access-token 2>/ dev/ null)} " \
108+ exec " ${AZ_EXE} " " $@ "
109109else
110- echo " Error: Azure CLI not found in PATH" >&2
111- exit 1
110+ echo " Error: Azure CLI not found in PATH" >&2
111+ exit 1
112112fi
0 commit comments