Pr-62-diberry-fix

[glaucia86]

Purpose

This Pull Request belongs to #62

This pull request introduces significant updates across multiple areas, including infrastructure configuration, application code, and environment setups. The key changes include transitioning to Key Vault for managing secrets, adding support for virtual networks, and refining the integration with Azure OpenAI services. Below is a categorized summary of the most important changes:

Infrastructure Enhancements

• Key Vault Integration: Secrets such as azure-openai-api-key, azure-openai-endpoint, azure-openai-deployment-name, and azure-openai-api-version are now stored and referenced directly from Azure Key Vault, replacing inline secret definitions. This improves security and centralizes secret management (infra/app/microblog-app.bicep, infra/main.bicep, infra/shared/keyvault-secret.bicep). [1] [2] [3]
• Virtual Network Support: Introduced a new module for virtual network (vnet) creation, including subnet configurations. This enables better network isolation and resource organization (infra/main.bicep, infra/shared/vnet.bicep). [1] [2]

Application Code Updates

• TypeScript Type Refinements: Explicitly cast formData values to string to ensure type safety in the action function (app/routes/generate.tsx).
• Azure OpenAI Service Updates: Updated the AzureOpenAIService class to use deploymentName from environment variables and adjusted the model parameter to reference the deployment directly (server/src/services/openai-service.server.ts). [1] [2]

Configuration and Validation

• Environment Variable Validation: Added a runtime check to ensure that AZURE_OPENAI_API_KEY is configured, preventing misconfigurations during deployment (server/src/config/env.ts).

Miscellaneous

• File Relocations: Moved openai-service.ts to server/src/services/openai-service.server.ts to align with server-side responsibilities (server/src/services/openai-service.server.ts).
• Gitignore Update: Added dist/ to .gitignore to exclude build artifacts from version control (server/.gitignore).

Does this introduce a breaking change?

[ ] Yes
[x] No

Pull Request Type

What kind of change does this Pull Request introduce?

[x] Bugfix
[ ] Feature
[ ] Code style update (formatting, local variables)
[x] Refactoring (no functional changes, no api changes)
[ ] Documentation content changes
[ ] Other... Please describe:

How to Test

• Get the code

git clone [repo-address]
cd [repo-name]
git checkout [branch-name]
npm install
npm run build:all
npm run dev

• Test the code

What to Check

Verify that the following are valid

• ...

Other Information

[glaucia86]

This Pull Request belongs to the #62

[glaucia86]

Why Sensitive Data in openai-service.server.ts Is Not Exposed to the Client

Context

The file openai-service.server.ts contains sensitive information, such as the Azure OpenAI API key and endpoint. It is crucial to ensure that this data is never exposed to the client-side of the application.

How Remix Handles Server-Only Code

• Remix uses file naming conventions (*.server.ts) to distinguish between server-only and client-accessible code.
• Files with the .server.ts suffix are never included in the client-side bundle. They are only executed on the server during data loading (loader), actions (action), or other server-side logic.
• When you import a .server.ts file in an action or loader, that code is executed exclusively on the server, not in the browser.

Our Implementation

• The azureOpenAIService is imported from openai-service.server.ts only inside the action function in generate.tsx.
• The action function is executed on the server when a POST request is made (e.g., when the user submits the form).
• No part of the openai-service.server.ts code or its secrets are ever sent to the client or included in the static assets.
• The only data sent to the client is the generated microblog content, never the API key or endpoint.

Security Best Practices

• Never import .server.ts files in React components or any code that runs on the client.
• Always keep secrets and sensitive logic in server-only files.
• Use environment variables or Azure Key Vault for secret management.

Summary

The openai-service.server.ts file and its secrets are only used on the server. Remix ensures that this code is never bundled or executed on the client-side, keeping our Azure OpenAI credentials secure.

[Copilot]

Pull Request Overview

This PR refactors the codebase for better secret management and network isolation, while updating the Azure OpenAI integration and TypeScript type safety. Key changes include:

• Integrating Azure Key Vault for secure secret management and validating the AZURE_OPENAI_API_KEY.
• Adding a virtual network module for improved resource isolation.
• Refactoring the Azure OpenAI service implementation with updated import types and utilizing the deploymentName from environment variables.

Reviewed Changes

Copilot reviewed 6 out of 14 changed files in this pull request and generated 1 comment.

File	Description
server/src/config/env.ts	Added runtime check for AZURE_OPENAI_API_KEY to enforce secret management.
app/services/openai-service.server.ts	Updated client configuration to use deploymentName and adjusted import types; consideration for cleanup of commented code.
app/routes/generate.tsx	Updated type casts for form data and corrected the import path for the OpenAI service.
.github/copilot-instructions.md	Added an instruction for Azure best practices to guide code generation.

Files not reviewed (8)

• Dockerfile: Language not supported
• infra/abbreviations.json: Language not supported
• infra/app/microblog-app.bicep: Language not supported
• infra/main.bicep: Language not supported
• infra/shared/cognitiveservices.bicep: Language not supported
• infra/shared/vnet.bicep: Language not supported
• server/package.json: Language not supported
• server/tsconfig.json: Language not supported

Comments suppressed due to low confidence (1)

app/services/openai-service.server.ts:3

• [nitpick] Consider removing the commented-out import block if it is no longer needed to improve code clarity and maintainability.

/*import type { ChatCompletionSystemMessageParam, ChatCompletionUserMessageParam, ChatCompletionAssistantMessageParam } from "openai/resources/index.mjs";*/

[Copilot]

The AZURE_OPENAI_DEPLOYMENT_NAME environment variable is used with a non-null assertion without prior validation. Consider adding an explicit check (similar to AZURE_OPENAI_API_KEY) to ensure it is defined.

Suggested change

	this.deploymentName = process.env.AZURE_OPENAI_DEPLOYMENT_NAME!;
	this.deploymentName = process.env.AZURE_OPENAI_DEPLOYMENT_NAME;