Resolve conflicts

.github/CODEOWNERS

@@ -40,7 +40,7 @@
 /src/azure-cli/azure/cli/command_modules/feedback/ @fengzhou-msft @jiasli
 /src/azure-cli/azure/cli/command_modules/hdinsight/ @aim-for-better @Juliehzl @kairu-ms
 /src/azure-cli/azure/cli/command_modules/iot/ @digimaun
-/src/azure-cli/azure/cli/command_modules/keyvault/ @fengzhou-msft @yungezz @houk-ms
+/src/azure-cli/azure/cli/command_modules/keyvault/ @evelyn-ys @jiasli @houk-ms
 /src/azure-cli/azure/cli/command_modules/monitor/ @msyyc @jsntcy @kairu-ms
 /src/azure-cli/azure/cli/command_modules/natgateway/ @khannarheams @jsntcy @kairu-ms @msyyc
 /src/azure-cli/azure/cli/command_modules/network/ @jsntcy @kairu-ms @msyyc

src/azure-cli-core/azure/cli/core/profiles/_shared.py

@@ -137,7 +137,7 @@ def default_api_version(self):
     'latest': {
         ResourceType.MGMT_STORAGE: '2021-04-01',
         ResourceType.MGMT_NETWORK: '2021-02-01',
-        ResourceType.MGMT_COMPUTE: SDKProfile('2020-12-01', {
+        ResourceType.MGMT_COMPUTE: SDKProfile('2021-03-01', {
             'resource_skus': '2019-04-01',
             'disks': '2020-12-01',
             'disk_encryption_sets': '2020-12-01',
@@ -146,7 +146,7 @@ def default_api_version(self):
             'galleries': '2019-12-01',
             'gallery_images': '2020-09-30',
             'gallery_image_versions': '2020-09-30',
-            'virtual_machine_scale_sets': '2020-12-01'
+            'virtual_machine_scale_sets': '2021-03-01'
         }),
         ResourceType.MGMT_RESOURCE_FEATURES: '2015-12-01',
         ResourceType.MGMT_RESOURCE_LINKS: '2016-09-01',

src/azure-cli/azure/cli/command_modules/appconfig/_kv_helpers.py

@@ -317,7 +317,7 @@ def __read_kv_from_config_store(azconfig_client,
 
     if cli_ctx:
         from azure.cli.command_modules.keyvault._client_factory import keyvault_data_plane_factory
-        keyvault_client = keyvault_data_plane_factory(cli_ctx, None)
+        keyvault_client = keyvault_data_plane_factory(cli_ctx)
     else:
         keyvault_client = None
 

src/azure-cli/azure/cli/command_modules/appconfig/tests/latest/export_features.json

@@ -1,11 +1,11 @@
 {
   "Color": "Red",
   "Region": "West US",
-  "FeatureManagement": {
+  "feature_management": {
     "Beta": false,
     "Percentage": true,
     "Timestamp": {
-      "EnabledFor": [
+      "enabled_for": [
         {
           "Name": "Local Tests",
           "Parameters": {

src/azure-cli/azure/cli/command_modules/appconfig/tests/latest/export_features_prop.json

@@ -1,4 +1,4 @@
-#Thu May 13 10:15:19 China Standard Time 2021
+#Wed May 26 14:26:40 China Standard Time 2021
 Color=Red
 Region=West US
 feature-management.FalseFeature=false

src/azure-cli/azure/cli/command_modules/backup/tests/latest/recordings/test_backup_wl_sql_policy.yaml

@@ -15,7 +15,7 @@ interactions:
       User-Agent:
       - AZURECLI/2.22.1 azsdk-python-azure-mgmt-compute/20.0.0 Python/3.8.9 (Windows-10-10.0.19041-SP0)
     method: GET
-    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/bksql/providers/Microsoft.Compute/virtualMachines?api-version=2020-12-01
+    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/bksql/providers/Microsoft.Compute/virtualMachines?api-version=2021-03-01
   response:
     body:
       string: "{\r\n  \"value\": [\r\n    {\r\n      \"name\": \"sqlvm\",\r\n      \"id\":

src/azure-cli/azure/cli/command_modules/databoxedge/tests/latest/test_device_scenario_coverage.md

@@ -1,8 +1,8 @@
 |Scenario|Result|ErrorMessage|ErrorStack|ErrorNormalized|StartDt|EndDt|
-|step_device_create|successed||||2021-05-13 02:17:36.714248|2021-05-13 02:17:37.126769|
-|step_device_show|successed||||2021-05-13 02:17:37.477771|2021-05-13 02:17:37.555771|
-|step_device_list|successed||||2021-05-13 02:17:37.629771|2021-05-13 02:17:37.737773|
-|step_device_list2|successed||||2021-05-13 02:17:37.310771|2021-05-13 02:17:37.394771|
-|step_device_update|successed||||2021-05-13 02:17:37.395770|2021-05-13 02:17:37.476771|
-|step_device_delete|successed||||2021-05-13 02:17:37.555771|2021-05-13 02:17:37.628772|
+|step_device_create|successed||||2021-05-25 09:13:53.735533|2021-05-25 09:13:54.440534|
+|step_device_show|successed||||2021-05-25 09:13:56.610075|2021-05-25 09:13:57.128075|
+|step_device_list|successed||||2021-05-25 09:13:57.591075|2021-05-25 09:13:58.087074|
+|step_device_list2|successed||||2021-05-25 09:13:55.608049|2021-05-25 09:13:56.130048|
+|step_device_update|successed||||2021-05-25 09:13:56.130048|2021-05-25 09:13:56.609075|
+|step_device_delete|successed||||2021-05-25 09:13:57.128075|2021-05-25 09:13:57.590076|
 Coverage: 6/6

src/azure-cli/azure/cli/command_modules/databoxedge/tests/latest/test_general_scenario_coverage.md

@@ -1,9 +1,9 @@
 |Scenario|Result|ErrorMessage|ErrorStack|ErrorNormalized|StartDt|EndDt|
-|step_device_create|successed||||2021-05-13 02:17:36.714248|2021-05-13 02:17:37.126769|
-|step_device_show|successed||||2021-05-13 02:17:37.477771|2021-05-13 02:17:37.555771|
-|step_device_list|successed||||2021-05-13 02:17:37.629771|2021-05-13 02:17:37.737773|
-|step_device_list2|successed||||2021-05-13 02:17:37.310771|2021-05-13 02:17:37.394771|
-|step_device_update|successed||||2021-05-13 02:17:37.395770|2021-05-13 02:17:37.476771|
-|step_device_delete|successed||||2021-05-13 02:17:37.555771|2021-05-13 02:17:37.628772|
-|step_list_sku|successed||||2021-05-13 02:17:37.872774|2021-05-13 02:17:37.962774|
+|step_device_create|successed||||2021-05-25 09:13:53.735533|2021-05-25 09:13:54.440534|
+|step_device_show|successed||||2021-05-25 09:13:56.610075|2021-05-25 09:13:57.128075|
+|step_device_list|successed||||2021-05-25 09:13:57.591075|2021-05-25 09:13:58.087074|
+|step_device_list2|successed||||2021-05-25 09:13:55.608049|2021-05-25 09:13:56.130048|
+|step_device_update|successed||||2021-05-25 09:13:56.130048|2021-05-25 09:13:56.609075|
+|step_device_delete|successed||||2021-05-25 09:13:57.128075|2021-05-25 09:13:57.590076|
+|step_list_sku|successed||||2021-05-25 09:13:58.574073|2021-05-25 09:13:59.107076|
 Coverage: 7/7

src/azure-cli/azure/cli/command_modules/databoxedge/tests/latest/test_order_scenario_coverage.md

@@ -1,13 +1,8 @@
 |Scenario|Result|ErrorMessage|ErrorStack|ErrorNormalized|StartDt|EndDt|
-|step_device_create|successed||||2021-05-13 02:17:42.463610|2021-05-13 02:17:42.529610|
-|step_device_show|successed||||2021-05-13 02:17:37.477771|2021-05-13 02:17:37.555771|
-|step_device_list|successed||||2021-05-13 02:17:37.629771|2021-05-13 02:17:37.737773|
-|step_device_list2|successed||||2021-05-13 02:17:37.310771|2021-05-13 02:17:37.394771|
-|step_device_update|successed||||2021-05-13 02:17:37.395770|2021-05-13 02:17:37.476771|
-|step_device_delete|successed||||2021-05-13 02:17:44.199678|2021-05-13 02:17:44.256679|
-|step_list_sku|successed||||2021-05-13 02:17:37.872774|2021-05-13 02:17:37.962774|
-|step_order_create|successed||||2021-05-13 02:17:42.529610|2021-05-13 02:17:43.378128|
-|step_order_show|successed||||2021-05-13 02:17:43.379128|2021-05-13 02:17:43.431130|
-|step_order_list|successed||||2021-05-13 02:17:44.130678|2021-05-13 02:17:44.199678|
-|step_order_delete|successed||||2021-05-13 02:17:43.508129|2021-05-13 02:17:44.130678|
-Coverage: 11/11
+|step_device_create|successed||||2021-05-26 06:10:57.246011|2021-05-26 06:10:57.798005|
+|step_order_create|successed||||2021-05-26 06:10:57.798005|2021-05-26 06:11:19.435373|
+|step_order_show|successed||||2021-05-26 06:11:19.435373|2021-05-26 06:11:20.084877|
+|step_order_list|successed||||2021-05-26 06:11:28.830307|2021-05-26 06:11:29.249301|
+|step_order_delete|successed||||2021-05-26 06:11:20.574868|2021-05-26 06:11:28.829307|
+|step_device_delete|successed||||2021-05-26 06:11:29.250300|2021-05-26 06:11:29.638294|
+Coverage: 6/6

src/azure-cli/azure/cli/command_modules/iot/custom.py

@@ -711,16 +711,18 @@ def iot_hub_identity_remove(cmd, client, hub_name, system_identity=None, user_id
             if not hub_identity.user_assigned_identities[identity]:
                 raise ArgumentUsageError('Hub {0} is not currently using a user-assigned identity with id: {1}'.format(hub_name, identity))
             del hub_identity.user_assigned_identities[identity]
+        if not hub_identity.user_assigned_identities:
+            del hub_identity.user_assigned_identities
     elif isinstance(user_identities, list):
         del hub_identity.user_assigned_identities
 
     if hub_identity.type in [
             IdentityType.system_assigned.value,
             IdentityType.system_assigned_user_assigned.value
     ]:
-        hub_identity.type = IdentityType.system_assigned_user_assigned.value if hub_identity.user_assigned_identities else IdentityType.system_assigned.value
+        hub_identity.type = IdentityType.system_assigned_user_assigned.value if getattr(hub_identity, 'user_assigned_identities', None) else IdentityType.system_assigned.value
     else:
-        hub_identity.type = IdentityType.user_assigned.value if hasattr(hub_identity, 'user_assigned_identities') else IdentityType.none.value
+        hub_identity.type = IdentityType.user_assigned.value if getattr(hub_identity, 'user_assigned_identities', None) else IdentityType.none.value
 
     hub.identity = hub_identity
     if not getattr(hub.identity, 'user_assigned_identities', None):

src/azure-cli/azure/cli/command_modules/iot/tests/latest/test_iot_commands.py

@@ -626,8 +626,15 @@ def test_identity_hub(self, resource_group, resource_group_location, storage_acc
                      self.check('length(userAssignedIdentities)', 2),
                      self.check('type', IdentityType.system_assigned_user_assigned.value)])
 
-        # remove (--user-assigned, --system-assigned) remove all remaining identities
-        self.cmd('iot hub identity remove -n {0} -g {1} --user-assigned --system-assigned'
+        # remove (--user-assigned)
+        self.cmd('iot hub identity remove -n {0} -g {1} --user-assigned'
+                 .format(identity_hub, rg),
+                 checks=[
+                     self.check('userAssignedIdentities', None),
+                     self.check('type', IdentityType.system_assigned.value)])
+
+        # remove (--system)
+        self.cmd('iot hub identity remove -n {0} -g {1} --system'
                  .format(identity_hub, rg),
                  checks=[
                      self.check('userAssignedIdentities', None),

src/azure-cli/azure/cli/command_modules/keyvault/_client_factory.py

@@ -125,7 +125,7 @@ def _keyvault_mgmt_client_factory(cli_ctx, _):
     return _keyvault_mgmt_client_factory
 
 
-def keyvault_data_plane_factory(cli_ctx, _):
+def keyvault_data_plane_factory(cli_ctx, *_):
     from azure.keyvault import KeyVaultAuthentication, KeyVaultClient
     from azure.cli.core.util import should_disable_connection_verify
 
@@ -134,7 +134,8 @@ def keyvault_data_plane_factory(cli_ctx, _):
     def get_token(server, resource, scope):  # pylint: disable=unused-argument
         import adal
         try:
-            return Profile(cli_ctx=cli_ctx).get_raw_token(resource)[0]
+            return Profile(cli_ctx=cli_ctx).get_raw_token(resource=resource,
+                                                          subscription=cli_ctx.data.get('subscription_id'))[0]
         except adal.AdalError as err:
             # pylint: disable=no-member
             if (hasattr(err, 'error_response') and
@@ -170,7 +171,8 @@ def keyvault_private_data_plane_factory_v7_2_preview(cli_ctx, _):
     def get_token(server, resource, scope):  # pylint: disable=unused-argument
         import adal
         try:
-            return Profile(cli_ctx=cli_ctx).get_raw_token(resource)[0]
+            return Profile(cli_ctx=cli_ctx).get_raw_token(resource=resource,
+                                                          subscription=cli_ctx.data.get('subscription_id'))[0]
         except adal.AdalError as err:
             # pylint: disable=no-member
             if (hasattr(err, 'error_response') and

src/azure-cli/azure/cli/command_modules/keyvault/_command_type.py

@@ -97,7 +97,7 @@ def keyvault_command_handler(command_args):
 
             client_arg_name = resolve_client_arg_name(operations_tmpl.format(method_name), kwargs)
             if client_arg_name in op_args:
-                client = client_factory(self.command_loader.cli_ctx, command_args)
+                client = client_factory(command_args['cmd'].cli_ctx, command_args)
                 command_args[client_arg_name] = client
             if 'cmd' not in op_args:
                 command_args.pop('cmd')

src/azure-cli/azure/cli/command_modules/keyvault/_params.py

@@ -221,11 +221,13 @@ class CLISecurityDomainOperation(str, Enum):
         c.argument('hsm_name', deleted_hsm_name_type)
         c.argument('location', help='Location of the deleted Vault or HSM', required=False)
 
-    with self.argument_context('keyvault delete-policy') as c:
-        c.argument('object_id', validator=validate_principal)
+    for item in ['set-policy', 'delete-policy']:
+        with self.argument_context('keyvault {}'.format(item)) as c:
+            c.argument('object_id', validator=validate_principal)
+            c.argument('application_id', help='Application ID of the client making request on behalf of a principal. '
+                                              'Exposed for compound identity using on-behalf-of authentication flow.')
 
     with self.argument_context('keyvault set-policy', arg_group='Permission') as c:
-        c.argument('object_id', validator=validate_principal)
         c.argument('key_permissions', arg_type=get_enum_type(KeyPermissions), metavar='PERM', nargs='*',
                    help='Space-separated list of key permissions to assign.', validator=validate_policy_permissions)
         c.argument('secret_permissions', arg_type=get_enum_type(SecretPermissions), metavar='PERM', nargs='*',

src/azure-cli/azure/cli/command_modules/keyvault/_validators.py

@@ -16,7 +16,7 @@
 
 from azure.cli.core.commands.client_factory import get_mgmt_service_client
 from azure.cli.core.commands.validators import validate_tags
-from azure.cli.core.azclierror import InvalidArgumentValueError, RequiredArgumentMissingError
+from azure.cli.core.azclierror import RequiredArgumentMissingError
 
 
 secret_text_encoding_values = ['utf-8', 'utf-16le', 'utf-16be', 'ascii']
@@ -289,9 +289,6 @@ def validate_deleted_vault_or_hsm_name(cmd, ns):
     vault_name = getattr(ns, 'vault_name', None)
     hsm_name = getattr(ns, 'hsm_name', None)
 
-    if hsm_name and 'keyvault recover' in cmd.name:
-        raise InvalidArgumentValueError('Operation "recover" has not been supported for HSM.')
-
     if not vault_name and not hsm_name:
         raise CLIError('Please specify --vault-name or --hsm-name.')
 
@@ -312,19 +309,18 @@ def validate_deleted_vault_or_hsm_name(cmd, ns):
         if vault_name:
             id_comps = parse_resource_id(resource.properties.vault_id)
         else:
-            id_comps = parse_resource_id(resource.id)
+            id_comps = parse_resource_id(resource.properties.mhsm_id)
 
     # otherwise, iterate through deleted vaults to find one with a matching name
     else:
         for v in client.list_deleted():
             if vault_name:
                 id_comps = parse_resource_id(v.properties.vault_id)
             else:
-                id_comps = parse_resource_id(v.id)
+                id_comps = parse_resource_id(v.properties.mhsm_id)
             if id_comps['name'].lower() == resource_name.lower():
                 resource = v
-                ns.location = resource.properties.location if vault_name \
-                    else resource.additional_properties.get('location')
+                ns.location = resource.properties.location
                 break
 
     # if the vault was not found, throw an error

src/azure-cli/azure/cli/command_modules/keyvault/custom.py

@@ -405,16 +405,17 @@ def recover_hsm(cmd, client, hsm_name, resource_group_name, location, no_wait=Fa
 
     ManagedHsm = cmd.get_models('ManagedHsm', resource_type=ResourceType.MGMT_KEYVAULT)
     ManagedHsmSku = cmd.get_models('ManagedHsmSku', resource_type=ResourceType.MGMT_KEYVAULT)
-    CreateMode = cmd.get_models('CreateMode', resource_type=ResourceType.MGMT_KEYVAULT)
 
     # tenantId and sku shouldn't be required
     profile = Profile(cli_ctx=cmd.cli_ctx)
     _, _, tenant_id = profile.get_login_credentials(
         resource=cmd.cli_ctx.cloud.endpoints.active_directory_graph_resource_id)
 
+    # Use 'Recover' as 'create_mode' temporarily since it's a bug from service side making 'create_mode' case-sensitive
+    # Will change it back to CreateMode.recover.value('recover') from SDK definition after service fix
     parameters = ManagedHsm(location=location,
                             sku=ManagedHsmSku(name='Standard_B1', family='B'),
-                            properties={'tenant_id': tenant_id, 'create_mode': CreateMode.recover.value})
+                            properties={'tenant_id': tenant_id, 'create_mode': 'Recover'})
 
     return sdk_no_wait(
         no_wait, client.begin_create_or_update,
@@ -885,7 +886,7 @@ def _permissions_distinct(permissions):
 
 
 def set_policy(cmd, client, resource_group_name, vault_name,
-               object_id=None, spn=None, upn=None, key_permissions=None, secret_permissions=None,
+               object_id=None, application_id=None, spn=None, upn=None, key_permissions=None, secret_permissions=None,
                certificate_permissions=None, storage_permissions=None, no_wait=False):
     """ Update security policy settings for a Key Vault. """
 
@@ -913,12 +914,14 @@ def set_policy(cmd, client, resource_group_name, vault_name,
     # Find the existing policy to set
     policy = next((p for p in vault.properties.access_policies
                    if object_id.lower() == p.object_id.lower() and
+                   (application_id or '').lower() == (p.application_id or '').lower() and
                    vault.properties.tenant_id.lower() == p.tenant_id.lower()), None)
     if not policy:
         # Add new policy as none found
         vault.properties.access_policies.append(AccessPolicyEntry(
             tenant_id=vault.properties.tenant_id,
             object_id=object_id,
+            application_id=application_id,
             permissions=Permissions(keys=key_permissions,
                                     secrets=secret_permissions,
                                     certificates=certificate_permissions,
@@ -1043,7 +1046,8 @@ def list_network_rules(cmd, client, resource_group_name, vault_name):  # pylint:
     return vault.properties.network_acls
 
 
-def delete_policy(cmd, client, resource_group_name, vault_name, object_id=None, spn=None, upn=None, no_wait=False):
+def delete_policy(cmd, client, resource_group_name, vault_name,
+                  object_id=None, application_id=None, spn=None, upn=None, no_wait=False):
     """ Delete security policy settings for a Key Vault. """
     VaultCreateOrUpdateParameters = cmd.get_models('VaultCreateOrUpdateParameters',
                                                    resource_type=ResourceType.MGMT_KEYVAULT)
@@ -1062,7 +1066,8 @@ def delete_policy(cmd, client, resource_group_name, vault_name, object_id=None,
     prev_policies_len = len(vault.properties.access_policies)
     vault.properties.access_policies = [p for p in vault.properties.access_policies if
                                         vault.properties.tenant_id.lower() != p.tenant_id.lower() or
-                                        object_id.lower() != p.object_id.lower()]
+                                        object_id.lower() != p.object_id.lower() or
+                                        (application_id or '').lower() != (p.application_id or '').lower()]
     if len(vault.properties.access_policies) == prev_policies_len:
         raise CLIError('No matching policies found')