v0.236.007

[paullizer]

Pull Request Title

Improve user search UX, fix Cognitive Services scope for MAG/custom clouds, and add private networking deployment automation plus file upload user agreement

Summary

This PR delivers three main improvements:

1. User search UX: Updates searchUsers() to use inline status messaging and toast notifications (errors only) instead of blocking alert() popups, per prior PR feedback.
2. Bugfix for MAG/custom clouds: Removes hardcoded Commercial Cognitive Services scope references in chat_stream_api and smart_http_plugin, replacing them with the configured value from config.py, resolving streaming chat failures in MAG.
3. Deployment and security: Enhances AZD/Bicep deployment automation and documentation to support Private Networking, adds more robust hook logging and error handling, introduces a postup hook to disable public access when private networking is enabled, improves docs (including USGov guidance), and adds new app roles.
4. Compliance and governance: Adds an admin-configurable User Agreement for File Uploads, with modal UX, daily acceptance option, and activity logging.

Related Links

• Prior PR discussion (search UX): Bug fix - fixed group member management errors with selecting new users, removing them, and updating the roles #608 (comment)
• Related issue (Cognitive Services scope): Bug - Streaming is broken in MAG & Custom Clouds due to hardcoded commercial scope #616 (comment)

Changes Included

1) User Search UX: Inline and toast messaging (no more alerts)

• Updated searchUsers() so search feedback is primarily inline.

• Toasts are shown only for errors, in addition to the inline message.

• Screenshot examples provided:

  • Empty search message (inline)
  • No users found message (inline)
  • One or more users found message (inline)

2) Bugfix: Remove hardcoded Commercial Cognitive Services scope

• Removed hardcoded Commercial Cognitive Services scope in:

  • chat_stream_api
  • smart_http_plugin

• Replaced with a variable sourced from config.py so this works correctly in MAG and custom clouds.

• Result:

  • Streaming chat error in MAG before the change (see screenshot)
  • Working properly in MAG after the change (see screenshot)

3) Private Networking focus: Deployment automation, hook hardening, and docs

Deployment Automation and Error Handling

• Refactored deployment hooks in deployers/azure.yaml with:

  • stepwise logging
  • explicit error handling
  • clearer output for each phase (postprovision, predeploy, postup)

• Added new postup hook:

  • automates disabling public network access for resources when private networking is enabled

Documentation Enhancements

• Expanded deployers/bicep/README.md with:

  • comprehensive prerequisites
  • corrected/improved table of contents
  • Azure Government (USGov) considerations (service limitations, model overrides, regional notes)
  • clearer post-deployment validation steps and known issues/workarounds

• Fixed Azure deployment button links in OneClickDeploy.md to point to the correct branch for both Commercial and Government clouds

Access Control Improvements

• Added new app roles in appRegistrationRoles.json:

  • Control Center Admin (full admin access)
  • Control Center Dashboard Reader (read-only dashboard access)

4) User Agreement for File Uploads (admin-configurable)

Feature

• Global admin-configurable agreement required before uploading files to workspaces.

Configuration

• Enable/disable toggle
• Workspace types selection (Personal, Group, Public, Chat)
• Markdown-formatted agreement text (200-word limit)
• Optional daily acceptance mode

User Experience

• Modal shown before file uploads with:

  • agreement text
  • Accept & Upload and Cancel

• Daily acceptance tracking to reduce repeat prompts (when enabled)

Activity Logging

• Logs all acceptances for compliance tracking:

  • timestamp
  • user
  • workspace type
  • action context

Admin UX

• Admin Settings → Workspaces tab → User Agreement section
• Sidebar navigation link

Files Added

• user-agreement.js (frontend module)
• route_backend_user_agreement.py (API endpoints)

Files Modified

• admin_settings.html
• route_frontend_admin_settings.py
• base.html
• _sidebar_nav.html
• functions_activity_logging.py
• workspace-documents.js
• group_workspaces.html
• public_workspace.js
• chat-input-actions.js

Testing Notes

• Verified searchUsers() behaviors:

  • empty query shows inline message
  • no matches shows inline message
  • matches show inline message
  • error shows inline message + toast

• Verified MAG/custom cloud streaming chat:

  • no longer fails due to Commercial scope mismatch

• Deployment validation:

  • AZD up and/or Bicep flows follow new hook logging
  • private networking path triggers postup public access disablement (when enabled)

• File upload agreement:

  • modal gating works across configured workspace types
  • daily acceptance behaves as expected (when enabled)
  • activity logs record acceptance events

Screenshots

User Search UX

• Empty search message

• No users found message

• One or more users found message

MAG Streaming Fix

• Error in MAG before change

• Working properly in MAG after change