fix: Teams citation issue and add user to postgresdb

.github/workflows/ci.yml

@@ -25,6 +25,9 @@ jobs:
       AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
       AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
       AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
+      AZURE_PRINCIPAL_ID: ${{ secrets.AZURE_PRINCIPAL_ID }}
+      AZURE_PRINCIPAL_NAME: ${{ secrets.AZURE_PRINCIPAL_NAME }}
+      AZURE_PRINCIPAL_TYPE: 'ServicePrincipal'
 
     outputs:
       imageTag: ${{ steps.set-image-tag.outputs.imageTag }}
@@ -203,6 +206,9 @@ jobs:
                               DISABLE_AUTHENTICATION=true
                               NO_AUTH=true
                               SKIP_AUTH=true
+                              AZURE_PRINCIPAL_ID
+                              AZURE_PRINCIPAL_NAME
+                              AZURE_PRINCIPAL_TYPE
 
       - name: Extract URLs from deployment
         id: extract-urls
@@ -299,8 +305,6 @@ jobs:
 
                 echo "=== PostgreSQL Configuration Summary ==="
                 echo "Host Endpoint: $PG_HOST_DESTINATION"
-                echo "Username: admintest (hardcoded)"
-                echo "Password: Initial_0524 (hardcoded)"
                 echo "Database: postgres (hardcoded)"
                 echo "Port: 5432 (hardcoded)"
 
@@ -311,19 +315,28 @@ jobs:
 
       - name: Install Python dependencies
         run: |
-                pip install psycopg2-binary python-dotenv
-
+                pip install psycopg2-binary python-dotenv azure-identity
 
       - name: Populate PostgreSQL Database
         run: |
           python - <<EOF
           import os
           import psycopg2
+          from azure.identity import ClientSecretCredential
+
+          tenant_id = os.environ["AZURE_TENANT_ID"]
+          client_id = os.environ["AZURE_CLIENT_ID"]
+          client_secret = os.environ["AZURE_CLIENT_SECRET"]
+          pg_host = os.environ.get("PG_HOST_DESTINATION", "localhost")
+
+          # Acquire Azure AD access token for PostgreSQL
+          credential = ClientSecretCredential(tenant_id, client_id, client_secret)
+          token = credential.get_token("https://ossrdbms-aad.database.windows.net/.default").token
 
           db_params = {
-              "user": "admintest",
-              "password": "Initial_0524",
-              "host": os.environ.get("PG_HOST_DESTINATION", "localhost"),
+              "user": client_id,   # Use service principal clientId
+              "password": token,   # Use AAD token instead of password
+              "host": pg_host,
               "port": "5432",
               "dbname": "postgres",
               "sslmode": "require"
@@ -343,8 +356,10 @@ jobs:
           except Exception as e:
               print(f"❌ Error during import: {e}")
           EOF
-
-
+        env:
+          AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
+          AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
+          AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
 
       - name: Final Status Check
         id: final-status

docs/LOCAL_DEPLOYMENT.md

@@ -280,7 +280,7 @@ Execute the above [shell command](#L81) to run the function locally. You may nee
 |AZURE_SEARCH_TITLE_COLUMN||Field from your Azure AI Search index that gives a relevant title or header for your data content to display in the UI.|
 |AZURE_SEARCH_TOP_K|5|The number of documents to retrieve from Azure AI Search.|
 |AZURE_SEARCH_URL_COLUMN||Field from your Azure AI Search index that contains a URL for the document, e.g. an Azure Blob Storage URI. This value is not currently used.|
-|AZURE_SEARCH_USE_INTEGRATED_VECTORIZATION ||Whether to use [Integrated Vectorization](https://learn.microsoft.com/en-us/azure/search/vector-search-integrated-vectorization)|
+|AZURE_SEARCH_USE_INTEGRATED_VECTORIZATION ||Whether to use [Integrated Vectorization](https://learn.microsoft.com/en-us/azure/search/vector-search-integrated-vectorization). If the database type is PostgreSQL, set this to false.|
 |AZURE_SEARCH_USE_SEMANTIC_SEARCH|False|Whether or not to use semantic search|
 |AZURE_SPEECH_RECOGNIZER_LANGUAGES | en-US,fr-FR,de-DE,it-IT | Comma-separated list of languages to recognize from speech input|
 |AZURE_SPEECH_REGION_ENDPOINT | | The regional endpoint of the Azure Speech service|
@@ -299,7 +299,7 @@ Execute the above [shell command](#L81) to run the function locally. You may nee
 |OPEN_AI_FUNCTIONS_SYSTEM_PROMPT | | System prompt for OpenAI functions orchestration|
 |ORCHESTRATION_STRATEGY | openai_function | Orchestration strategy. Use Azure OpenAI Functions (openai_function), Semantic Kernel (semantic_kernel),  LangChain (langchain) or Prompt Flow (prompt_flow) for messages orchestration. If you are using a new model version 0613 select any strategy, if you are using a 0314 model version select "langchain". Note that both `openai_function` and `semantic_kernel` use OpenAI function calling. Prompt Flow option is still in development and does not support RBAC or integrated vectorization as of yet.|
 |SEMANTIC_KERNEL_SYSTEM_PROMPT | | System prompt used by the Semantic Kernel orchestration|
-|USE_ADVANCED_IMAGE_PROCESSING | false | Whether to enable the use of a vision LLM and Computer Vision for embedding images|
+|USE_ADVANCED_IMAGE_PROCESSING | false | Whether to enable the use of a vision LLM and Computer Vision for embedding images. If the database type is PostgreSQL, set this to false.|
 |USE_KEY_VAULT | true | Whether to use Azure Key Vault for storing secrets|
 
 ## Bicep

docs/advanced_image_processing.md

@@ -46,3 +46,5 @@ azd env set ADVANCED_IMAGE_PROCESSING_MAX_IMAGES 2
 ```
 
 Advanced image processing is only used in the `custom` conversation flow and not the `byod` flow, as Azure OpenAI On Your Data only supports Ada embeddings. It is currently not possible to use advanced image processing when integrated vectorization is enabled.
+
+Advanced image processing is not supported when deploying with PostgreSQL as the database type.

docs/integrated_vectorization.md

@@ -49,3 +49,5 @@ If you have a deployment with Integrated Vectorization enabled, and you want to
 ![Delete Search Index](images/delete-search-datasource.png)
 1. Run the command `azd env set AZURE_SEARCH_USE_INTEGRATED_VECTORIZATION false`
 1. Run `azd up`
+
+**NOTE**: Integrated vectorization is not supported when deploying with PostgreSQL as the database type.

docs/teams_extension.md

@@ -32,11 +32,11 @@ This extension enables users to experience Chat with your data within Teams, wit
 
 ![ENV](images/teams-1.png)
 
-4. Locate the environment variable _AZURE_FUNCTION_URL_.
-5. Replace the `<FUNCTION_APP_NAME>` and `<FUNCTION_KEY>` with your actual Function App name and function key
+4. Locate the environment variables _AZURE_FUNCTION_URL_ and _AZURE_APP_API_BASE_URL_.
+5. Replace the `<FUNCTION_APP_NAME>` and `<FUNCTION_KEY>` with your actual Function App name and function key, and replace `<APP-NAME>` with your actual App Service name
     ```env
     AZURE_FUNCTION_URL=https://<FUNCTION_APP_NAME>.azurewebsites.net/api/GetConversationResponse?code=<FUNCTION_KEY>
-
+    AZURE_APP_API_BASE_URL=https://<APP-NAME>.azurewebsites.net/
     ```
     ![Env](images/teams-deploy-env.png)
 6. Save the file.

extensions/teams/cards/cardBuilder.ts

@@ -1,11 +1,12 @@
 import { Attachment, CardFactory } from "botbuilder";
 import { Citation, CardType } from "../model";
+import config from "../config";
 
 export function actionBuilder(citation: Citation, docId: number): any {
 
-    const urlParts = citation.url.split("]");
-    let url = urlParts[urlParts.length - 1].replaceAll("(", "").replaceAll(")", "");
     let title = citation.title.replaceAll("/documents/", "");
+    const filename = title;
+    let fileApiUrl = `${config.getFileEndpoint}/${filename}`;
     let content = citation.content.replaceAll(citation.title, "").replaceAll("url", "");
     content = content.replaceAll(/(<([^>]+)>)/ig, "\n").replaceAll("<>", "");
     let citationCardAction = {
@@ -37,7 +38,7 @@ export function actionBuilder(citation: Citation, docId: number): any {
                 {
                     type: CardType.OpenUrl,
                     title: "Go to the source",
-                    url: decodeURI(url),
+                    url: decodeURI(fileApiUrl),
                 }
             ]
         }

extensions/teams/config.ts

@@ -2,7 +2,11 @@ const config = {
   botId: process.env.BOT_ID,
   botPassword: process.env.BOT_PASSWORD,
   azureFunctionUrl: process.env.AZURE_FUNCTION_URL,
+  azureAppApiBaseUrl: process.env.AZURE_APP_API_BASE_URL,
   tenantId: process.env.TEAMS_APP_TENANT_ID,
+  getFileEndpoint: process.env.AZURE_APP_API_BASE_URL ?
+    `${process.env.AZURE_APP_API_BASE_URL}api/files` :
+    null,
 };
 
 export default config;

extensions/teams/env/.env.dev

@@ -14,4 +14,5 @@ BOT_ID=
 TEAMS_APP_ID=
 BOT_AZURE_APP_SERVICE_RESOURCE_ID=
 BOT_DOMAIN=
-AZURE_FUNCTION_URL=https://backend-<RESOURCE_TOKEN>.azurewebsites.net/api/GetConversationResponse?code=<FUNCTION_APP_CLIENT_KEY>&clientId=clientKey
+AZURE_FUNCTION_URL=https://<FUNCTION_APP_NAME>.azurewebsites.net/api/GetConversationResponse?code=<FUNCTION_KEY>
+AZURE_APP_API_BASE_URL=https://<APP-NAME>.azurewebsites.net/

extensions/teams/env/.env.test

@@ -14,6 +14,7 @@ BOT_ID=
 TEAMS_APP_ID=
 BOT_AZURE_APP_SERVICE_RESOURCE_ID=
 BOT_DOMAIN=
-AZURE_FUNCTION_URL=https://backend-<RESOURCE_TOKEN>.azurewebsites.net/api/GetConversationResponse?code=<FUNCTION_APP_CLIENT_KEY>&clientId=clientKey
+AZURE_FUNCTION_URL=https://<FUNCTION_APP_NAME>.azurewebsites.net/api/GetConversationResponse?code=<FUNCTION_KEY>
+AZURE_APP_API_BASE_URL=https://<APP-NAME>.azurewebsites.net/
 TEAMS_APP_TENANT_ID=
 TEAMS_APP_PUBLISHED_APP_ID=

extensions/teams/env/.env.testtool

@@ -6,4 +6,5 @@ TEAMSFX_ENV=testtool
 # Environment variables used by test tool
 TEAMSAPPTESTER_PORT=56150
 TEAMSFX_NOTIFICATION_STORE_FILENAME=.notification.testtoolstore.json
-AZURE_FUNCTION_URL=https://backend-<RESOURCE_TOKEN>.azurewebsites.net/api/GetConversationResponse?code=<FUNCTION_APP_CLIENT_KEY>&clientId=clientKey
+AZURE_FUNCTION_URL=https://<FUNCTION_APP_NAME>.azurewebsites.net/api/GetConversationResponse?code=<FUNCTION_KEY>
+AZURE_APP_API_BASE_URL=https://<APP-NAME>.azurewebsites.net/

extensions/teams/index.ts

@@ -19,7 +19,7 @@ import config from "./config";
 const credentialsFactory = new ConfigurationServiceClientCredentialFactory({
   MicrosoftAppId: config.botId,
   MicrosoftAppPassword: config.botPassword,
-  MicrosoftAppType: "SingleTenant",
+  MicrosoftAppType: "SingleTenant", // Enable multitenant mode for local development
   MicrosoftAppTenantId: config.tenantId
 });
 

extensions/teams/infra/azure.bicep

@@ -17,6 +17,9 @@ param botAadAppClientSecret string
 @description('Required by Bot Framework azureFunctionURL')
 param azureFunctionURL string
 
+@description('Base URL for the Azure Web App API endpoints used for file access')
+param azureAppApiBaseUrl string
+
 param webAppSKU string
 
 @maxLength(42)
@@ -72,6 +75,10 @@ resource webApp 'Microsoft.Web/sites@2021-02-01' = {
           name: 'AZURE_FUNCTION_URL'
           value: azureFunctionURL
         }
+        {
+          name: 'AZURE_APP_API_BASE_URL'
+          value: azureAppApiBaseUrl
+        }
         {
           name: 'TEAMS_APP_TENANT_ID'
           value: botAadAppTenantId

extensions/teams/infra/azure.parameters.json

@@ -17,11 +17,14 @@
     "azureFunctionURL": {
       "value": "${{AZURE_FUNCTION_URL}}"
     },
+    "azureAppApiBaseUrl": {
+      "value": "${{AZURE_APP_API_BASE_URL}}"
+    },
     "webAppSKU": {
       "value": "B1"
     },
     "botDisplayName": {
       "value": "teams-bot-toolkit"
     }
   }
-}
+}

extensions/teams/teamsapp.local.yml

@@ -25,6 +25,14 @@ provision:
       # The Microsoft Entra application's client secret created for bot.
       botPassword: SECRET_BOT_PASSWORD
 
+  # Create service principal for the Microsoft Entra application
+  - uses: cli/runNpmCommand
+    name: Enable Service Principal
+    with:
+      args: run enable-sp
+    env:
+      BOT_ID: ${{BOT_ID}}
+
   # Create or update the bot registration on dev.botframework.com
   - uses: botFramework/create
     with:
@@ -76,4 +84,6 @@ deploy:
       envs:
         BOT_ID: ${{BOT_ID}}
         BOT_PASSWORD: ${{SECRET_BOT_PASSWORD}}
+        TEAMS_APP_TENANT_ID: ${{TEAMS_APP_TENANT_ID}}
         AZURE_FUNCTION_URL: ${{AZURE_FUNCTION_URL}}
+        AZURE_APP_API_BASE_URL: ${{AZURE_APP_API_BASE_URL}}

extensions/teams/teamsapp.testtool.yml

@@ -22,4 +22,5 @@ deploy:
       target: ./.localConfigs.testTool
       envs:
         TEAMSFX_NOTIFICATION_STORE_FILENAME: ${{TEAMSFX_NOTIFICATION_STORE_FILENAME}}
-        AZURE_FUNCTION_URL: ${{AZURE_FUNCTION_URL}}
+        AZURE_FUNCTION_URL: ${{AZURE_FUNCTION_URL}}
+        AZURE_APP_API_BASE_URL: ${{AZURE_APP_API_BASE_URL}}