feat(ui): onboard Azure subscriptions from a Management Group (#12386)

Author: pfe-nazaries

ui/__tests__/msw/handlers/organizations.fixtures.ts

@@ -347,7 +347,11 @@ export const handlersForOrganizations = (
         orgType: String(attrs.org_type ?? "aws"),
         name: String(attrs.name ?? ""),
         externalId: String(attrs.external_id ?? ""),
-        rootExternalId: null,
+        // Writable on POST for Azure (the target Management Group); AWS and GCP
+        // leave it to discovery and send nothing.
+        rootExternalId: attrs.root_external_id
+          ? String(attrs.root_external_id)
+          : null,
         providerIds: [],
         nodeIds: [],
         secretId: null,
@@ -503,6 +507,8 @@ export const handlersForOrganizations = (
               result:
                 fx.discovery.status === "succeeded" ? fx.discovery.result : {},
               error: fx.discovery.error,
+              // Machine code and human message are separate fields on the wire.
+              error_message: fx.discovery.errorMessage ?? null,
               inserted_at: TS,
               updated_at: TS,
             },

ui/__tests__/msw/handlers/organizations.ts

@@ -5,6 +5,8 @@ import {
   ApplyDiscoveryPayload,
   AwsDiscoveryResult,
   AwsOrgHierarchy,
+  AzureDiscoveryResult,
+  AzureOrgHierarchy,
   GcpDiscoveryResult,
   GcpOrgHierarchy,
   NODE_KIND,
@@ -84,6 +86,43 @@ export function mapGcpDiscovery(result: GcpDiscoveryResult): GcpOrgHierarchy {
   };
 }
 
+/**
+ * Ingestion mapper: Azure discovery wire result → normalized hierarchy model.
+ *
+ * A management group's identity is its canonical resource ID
+ * (`/providers/Microsoft.Management/managementGroups/{name}`), which is exactly
+ * what its children carry as `parent_id`, so nesting matches on that ref. The
+ * selected root group is collapsed away — it is absent from the node set, so
+ * groups and subscriptions parented by it rebuild as top-level.
+ */
+export function mapAzureDiscovery(
+  result: AzureDiscoveryResult,
+): AzureOrgHierarchy {
+  return {
+    orgType: ORGANIZATION_TYPE.AZURE,
+    organization: {
+      // Tenant id: what the user typed and what the organization stores as
+      // `external_id`.
+      uid: result.root_management_group.tenant_id,
+      name:
+        result.root_management_group.display_name ||
+        result.root_management_group.name,
+    },
+    nodes: result.management_groups.map((group) => ({
+      id: group.id,
+      kind: NODE_KIND.MANAGEMENT_GROUP,
+      name: group.display_name || group.name,
+      parentId: group.parent_id,
+    })),
+    candidates: result.subscriptions.map((subscription) => ({
+      uid: subscription.subscription_id,
+      label: subscription.display_name || subscription.subscription_id,
+      parentId: subscription.parent_id,
+      registration: subscription.registration,
+    })),
+  };
+}
+
 /**
  * Transforms the normalized hierarchy into hierarchical TreeDataItem[] for
  * TreeView. Container nodes (OUs / folders) nest candidates (accounts /
@@ -338,6 +377,14 @@ export function buildApplyPayload(
           selectedCandidateIds,
         ).map((id) => ({ id })),
       };
+    case ORGANIZATION_TYPE.AZURE:
+      return {
+        orgType: ORGANIZATION_TYPE.AZURE,
+        subscriptions: selectedCandidateIds.map((id) => ({
+          subscription_id: id,
+          ...aliasOf(id),
+        })),
+      };
     case ORGANIZATION_TYPE.GCP:
       return {
         orgType: ORGANIZATION_TYPE.GCP,

ui/actions/organizations/organizations.adapter.ts

@@ -51,6 +51,7 @@ describe("organizations actions", () => {
   it("rejects invalid organization secret identifiers", async () => {
     // When
     const result = await updateOrganizationSecret("../secret-id", {
+      orgType: ORGANIZATION_TYPE.AWS,
       secretType: ORG_SECRET_TYPE.ROLE,
       secret: {
         role_arn: "arn:aws:iam::123456789012:role/ProwlerOrgRole",
@@ -85,13 +86,13 @@ describe("organizations actions", () => {
   });
 
   it("rejects an organization type with no onboarding flow instead of coercing it", async () => {
-    // Given a form asking for a type this build cannot onboard. `azure` is a
-    // real OrganizationType — display supports it, onboarding does not — so it
-    // is the exact boundary a blind cast would let through.
+    // Given a type this build cannot onboard. `oraclecloud` is real — display
+    // supports it, onboarding does not — the exact boundary a blind cast lets
+    // through.
     const formData = new FormData();
-    formData.set("name", "Contoso");
-    formData.set("externalId", "o-abc123def4");
-    formData.set("orgType", ORGANIZATION_TYPE.AZURE);
+    formData.set("name", "Tenancy");
+    formData.set("externalId", "ocid1.tenancy.oc1..aaaa1111");
+    formData.set("orgType", "oraclecloud");
 
     // When
     const result = await createOrganization(formData);

ui/actions/organizations/organizations.test.ts

@@ -489,11 +489,34 @@ export const getDiscovery = async (
   }
 };
 
+/**
+ * JSON:API attributes for an apply request. The `default` arm is the
+ * exhaustiveness guard — `noImplicitReturns` is off.
+ */
+function buildApplyAttributes(payload: ApplyDiscoveryPayload) {
+  switch (payload.orgType) {
+    case ORGANIZATION_TYPE.AWS:
+      return {
+        accounts: payload.accounts,
+        organizational_units: payload.organizationalUnits,
+      };
+    case ORGANIZATION_TYPE.AZURE:
+      return { subscriptions: payload.subscriptions };
+    case ORGANIZATION_TYPE.GCP:
+      return { projects: payload.projects };
+    default: {
+      const exhaustivePayload: never = payload;
+      return exhaustivePayload;
+    }
+  }
+}
+
 /**
  * Applies discovery results — creates providers, links to org/nodes,
  * auto-generates secrets. The payload is discriminated by organization type:
  * AWS sends `accounts` + client-side-derived `organizational_units`; GCP sends
- * `projects` only (folder ancestors are derived server-side).
+ * `projects` and Azure `subscriptions` only (folder / Management Group ancestors
+ * are derived server-side).
  * POST /api/v1/organizations/{orgId}/discoveries/{discoveryId}/apply
  */
 export const applyDiscovery = async (
@@ -525,13 +548,7 @@ export const applyDiscovery = async (
   // whole request. The created providers' uids are read afterwards instead, with
   // `getProviderUidsByIds`.
 
-  const attributes =
-    payload.orgType === ORGANIZATION_TYPE.AWS
-      ? {
-          accounts: payload.accounts,
-          organizational_units: payload.organizationalUnits,
-        }
-      : { projects: payload.projects };
+  const attributes = buildApplyAttributes(payload);
 
   try {
     const response = await fetch(url.toString(), {