feat(azure/ri-exchange): find compatible offerings and execute exchange (closes #596)

internal/api/handler.go

@@ -79,9 +79,11 @@ type Handler struct {
 	targetOfferingsEC2Factory func(aws.Config) targetOfferingsEC2Client
 
 	// Optional Azure exchange client factory injected by tests. When nil
-	// (the production default), buildAzureExchangeClient uses
-	// azidentity.NewDefaultAzureCredential to construct a real
-	// armreservations-backed client.
+	// (the production default), buildAzureExchangeClient resolves the
+	// registered CloudAccount's per-subscription credentials and constructs
+	// a real armreservations-backed client. The azureExchangeClient
+	// interface covers listing exchangeable reservations plus pricing
+	// (CalculateExchange) and committing (ExecuteExchange) an exchange.
 	azureExchangeFactory func(subscriptionID string) azureExchangeClient
 
 	// Optional marketplace EC2 client factory injected by tests. When nil
@@ -460,6 +462,15 @@ func (h *Handler) authorizeAPIKeyAny(ctx context.Context, apiKey string, verbs [
 // AccountIDs constraint still matches via the empty-permission-side rule.
 const unattributedAccountConstraint = "unattributed"
 
+// requirePermissionConstraintsAction is the action every current caller of
+// requirePermissionConstraints checks (execute:purchases, execute:ri-exchange
+// for both AWS and Azure). Every constraint-gated operation today is an
+// irreversible execute; hardcoded rather than threaded as a parameter since
+// a parameter with only one real value across all call sites is dead
+// flexibility (a genuinely new action should add a real parameter back,
+// not resurrect an unused one).
+const requirePermissionConstraintsAction = "execute"
+
 // requirePermissionConstraints re-checks an already-authenticated session
 // against request-derived permission constraint sets, so the Constraints
 // (MaxPurchaseAmount, Providers, Services, Regions, AccountIDs) configured on
@@ -477,7 +488,7 @@ const unattributedAccountConstraint = "unattributed"
 // prevents a CI key with MaxPurchaseAmount=$100 from spending up to the
 // owning user's full group limit by inheriting the broader group permissions
 // (adversarial-review F2).
-func (h *Handler) requirePermissionConstraints(ctx context.Context, session *Session, action, resource string, constraintSets []auth.PermissionConstraints) error {
+func (h *Handler) requirePermissionConstraints(ctx context.Context, session *Session, resource string, constraintSets []auth.PermissionConstraints) error {
 	if session == nil {
 		return fmt.Errorf("internal error: nil session passed to requirePermissionConstraints")
 	}
@@ -490,21 +501,21 @@ func (h *Handler) requirePermissionConstraints(ctx context.Context, session *Ses
 	// User API key: evaluate constraints against the key's effective permissions,
 	// not the owning user's full group permissions.
 	if session.UserAPIKeyID != "" {
-		has, err := h.auth.HasAPIKeyPermissionForConstraintsAPI(ctx, session.UserAPIKeyID, session.UserID, action, resource, constraintSets)
+		has, err := h.auth.HasAPIKeyPermissionForConstraintsAPI(ctx, session.UserAPIKeyID, session.UserID, requirePermissionConstraintsAction, resource, constraintSets)
 		if err != nil {
 			return fmt.Errorf("permission constraint check failed: %w", err)
 		}
 		if !has {
-			return NewClientError(403, fmt.Sprintf("permission denied: this request exceeds the constraints configured on your %s permission for %s", action, resource))
+			return NewClientError(403, fmt.Sprintf("permission denied: this request exceeds the constraints configured on your %s permission for %s", requirePermissionConstraintsAction, resource))
 		}
 		return nil
 	}
-	has, err := h.auth.HasPermissionForConstraintsAPI(ctx, session.UserID, action, resource, constraintSets)
+	has, err := h.auth.HasPermissionForConstraintsAPI(ctx, session.UserID, requirePermissionConstraintsAction, resource, constraintSets)
 	if err != nil {
 		return fmt.Errorf("permission constraint check failed: %w", err)
 	}
 	if !has {
-		return NewClientError(403, fmt.Sprintf("permission denied: this request exceeds the constraints configured on your %s permission for %s", action, resource))
+		return NewClientError(403, fmt.Sprintf("permission denied: this request exceeds the constraints configured on your %s permission for %s", requirePermissionConstraintsAction, resource))
 	}
 	return nil
 }

internal/api/handler_purchases.go

@@ -2098,7 +2098,7 @@ func (h *Handler) enforcePurchaseConstraints(ctx context.Context, session *Sessi
 	if err := requireNonZeroCommitment(constraintSets); err != nil {
 		return err
 	}
-	return h.requirePermissionConstraints(ctx, session, "execute", "purchases", constraintSets)
+	return h.requirePermissionConstraints(ctx, session, "purchases", constraintSets)
 }
 
 // purchaseConstraintSets builds one auth.PermissionConstraints per