Add docs for Azure auth

backend/src/server/routes/v1/identity-azure-auth-router.ts

@@ -6,6 +6,7 @@ import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
 import { TIdentityTrustedIp } from "@app/services/identity/identity-types";
+import { validateAzureAuthField } from "@app/services/identity-azure-auth/identity-azure-auth-validators";
 
 export const registerIdentityAzureAuthRouter = async (server: FastifyZodProvider) => {
   server.route({
@@ -75,7 +76,7 @@ export const registerIdentityAzureAuthRouter = async (server: FastifyZodProvider
       body: z.object({
         tenantId: z.string().trim(),
         resource: z.string().trim(),
-        allowedServicePrincipalIds: z.string().trim(),
+        allowedServicePrincipalIds: validateAzureAuthField,
         accessTokenTrustedIps: z
           .object({
             ipAddress: z.string().trim()
@@ -157,7 +158,7 @@ export const registerIdentityAzureAuthRouter = async (server: FastifyZodProvider
       body: z.object({
         tenantId: z.string().trim().optional(),
         resource: z.string().trim().optional(),
-        allowedServicePrincipalIds: z.string().trim().optional(),
+        allowedServicePrincipalIds: validateAzureAuthField.optional(),
         accessTokenTrustedIps: z
           .object({
             ipAddress: z.string().trim()

backend/src/server/routes/v1/identity-gcp-auth-router.ts

@@ -160,9 +160,9 @@ export const registerIdentityGcpAuthRouter = async (server: FastifyZodProvider)
       }),
       body: z.object({
         type: z.enum(["iam", "gce"]).optional(),
-        allowedServiceAccounts: validateGcpAuthField,
-        allowedProjects: validateGcpAuthField,
-        allowedZones: validateGcpAuthField,
+        allowedServiceAccounts: validateGcpAuthField.optional(),
+        allowedProjects: validateGcpAuthField.optional(),
+        allowedZones: validateGcpAuthField.optional(),
         accessTokenTrustedIps: z
           .object({
             ipAddress: z.string().trim()

backend/src/services/identity-azure-auth/identity-azure-auth-service.ts

@@ -63,7 +63,7 @@ export const identityAzureAuthServiceFactory = ({
       const isServicePrincipalAllowed = identityAzureAuth.allowedServicePrincipalIds
         .split(",")
         .map((servicePrincipalId) => servicePrincipalId.trim())
-        .some((servicePrincipalId) => servicePrincipalId === azureIdentity.appid);
+        .some((servicePrincipalId) => servicePrincipalId === azureIdentity.oid);
 
       if (!isServicePrincipalAllowed) throw new UnauthorizedError();
     }

backend/src/services/identity-azure-auth/identity-azure-auth-types.ts

@@ -79,7 +79,7 @@ type TUserPayload = {
   xms_tcdt: number;
 };
 
-type TAppRegistrationPayload = {
+type TAppPayload = {
   aud: string;
   iss: string;
   iat: number;
@@ -90,7 +90,7 @@ type TAppRegistrationPayload = {
   appidacr: string;
   idp: string;
   idtyp: string;
-  oid: string;
+  oid: string; // service principal id
   rh: string;
   sub: string;
   tid: string;
@@ -103,7 +103,7 @@ type TAppRegistrationPayload = {
   xms_tcdt: number;
 };
 
-export type TAzureAuthJwtPayload = TUserPayload | TAppRegistrationPayload;
+export type TAzureAuthJwtPayload = TUserPayload | TAppPayload;
 
 export type TDecodedAzureAuthJwt = {
   header: {

backend/src/services/identity-azure-auth/identity-azure-auth-validators.ts

@@ -0,0 +1,14 @@
+import { z } from "zod";
+
+export const validateAzureAuthField = z
+  .string()
+  .trim()
+  .default("")
+  .transform((data) => {
+    if (data === "") return "";
+    // Trim each ID and join with ', ' to ensure formatting
+    return data
+      .split(",")
+      .map((id) => id.trim())
+      .join(", ");
+  });