Order Intake -- PM demo bootstrap (self-contained, no secrets, requires AAD pull access)

order-intake-pm-demo.ps1

# Order Intake -- PM demo bootstrap (PowerShell, self-contained).
#
# One-liner (PowerShell on Windows):
#   iwr https://gist.githubusercontent.com/miadadrashid/<id>/raw/order-intake-pm-demo.ps1 | iex
#
# Requirements:
#   - Docker Desktop running
#   - Azure CLI with `az login` against the
#     TT - SupplyChainInsights-DEV-Secure subscription
#
# Ctrl+C stops the foreground containers. To clean up afterwards:
#   docker compose -f $env:TEMP\order-intake-demo.yml down

$ErrorActionPreference = 'Stop'
$Registry = if ($env:REGISTRY) { $env:REGISTRY } else { 'sciorderintakedemo.azurecr.io' }
# Strip any trailing slashes the caller may have included so we don't end up
# with `host//image` after re-appending one below (which docker rejects as
# "invalid reference format"). Bites users whose shells have $env:REGISTRY left
# over from an earlier failed run.
$Registry = $Registry.TrimEnd('/')
$RegistryName = $Registry.Split('.')[0]
# Pin the dev-secure subscription AND resource group so `az acr login`
# ignores the user's `az config defaults` (which may point at a different
# subscription or RG).
$Subscription = if ($env:SUBSCRIPTION) { $env:SUBSCRIPTION } else { '477e4fec-5e6c-4ac5-966a-d3b9669f8cad' }
$ResourceGroup = if ($env:RESOURCE_GROUP) { $env:RESOURCE_GROUP } else { 'sci-order-intake-demo-rg' }
# Also pin the AAD tenant. The demo registry lives in the
# `azuretmwsystems.onmicrosoft.com` tenant; users with primary identities
# in the regular Trimble corp tenant will have a default `az login` token
# scoped to corp and get 403 on the registry RBAC lookup. Forcing the
# subscription/tenant context here makes az re-auth into the right tenant
# before talking to the registry. Bit Dipen on 2026-04-28.
$Tenant = if ($env:TENANT) { $env:TENANT } else { '23235593-4c46-41c1-944b-32a03aab96e6' }

# ---------------------------------------------------------------------------
# Preflight
# ---------------------------------------------------------------------------
if (-not (Get-Command docker -ErrorAction SilentlyContinue)) {
    Write-Host "error: docker not found. Install Docker Desktop and try again." -ForegroundColor Red
    return
}
try { docker info 2>&1 | Out-Null } catch {
    Write-Host "error: docker daemon not reachable. Open Docker Desktop and try again." -ForegroundColor Red
    return
}
if (-not (Get-Command az -ErrorAction SilentlyContinue)) {
    Write-Host "error: Azure CLI not found. Install: https://aka.ms/InstallAzureCLI" -ForegroundColor Red
    return
}

Write-Host ""
Write-Host "==> Authenticating to $Registry (tenant $Tenant, subscription $Subscription, rg $ResourceGroup) ..." -ForegroundColor Cyan
# Make the dev-secure sub the active context. If the user's current
# `az login` token is scoped to a different tenant (typical for Trimble
# corp identities — their default tenant is corp, not azuretmwsystems
# where this registry lives), this `az account set` will fail with
# "subscription not found". Catch that and trigger a tenant-correct
# re-login. Already-correct users get a no-op set and no prompts.
az account set --subscription $Subscription 2>$null
if ($LASTEXITCODE -ne 0) {
    Write-Host "    sub not visible in current tenant; re-authenticating via $Tenant ..." -ForegroundColor Yellow
    az login --tenant $Tenant --output none
    if ($LASTEXITCODE -ne 0) {
        Write-Host "error: az login failed." -ForegroundColor Red
        return
    }
    az account set --subscription $Subscription
    if ($LASTEXITCODE -ne 0) {
        Write-Host "error: subscription $Subscription still not visible after tenant-correct login. Ask for AcrPull + Reader on sciorderintakedemo." -ForegroundColor Red
        return
    }
}
az acr login -n $RegistryName --resource-group $ResourceGroup --subscription $Subscription
if ($LASTEXITCODE -ne 0) {
    Write-Host "error: az acr login failed even after tenant fix-up. Make sure you have AcrPull + Reader on sciorderintakedemo." -ForegroundColor Red
    return
}

# ---------------------------------------------------------------------------
# Compose file (inlined)
# ---------------------------------------------------------------------------
$compose = @'
services:
  mongo:
    image: mongo:7
    container_name: order-intake-demo-mongo
    healthcheck:
      test: ["CMD", "mongosh", "--quiet", "--eval", "db.adminCommand('ping').ok"]
      interval: 5s
      timeout: 5s
      retries: 12
      start_period: 10s
  api:
    image: ${REGISTRY:-}sci-order-intake-api:demo
    container_name: order-intake-demo-api
    depends_on:
      mongo:
        condition: service_healthy
    expose: ["80"]
  ui:
    image: ${REGISTRY:-}sci-order-intake-ui:demo
    container_name: order-intake-demo-ui
    depends_on: [api]
    # Localhost-only: the demo API exposes an unauthenticated
    # token-minting endpoint behind DEMO_MODE; keep it off the LAN.
    ports: ["127.0.0.1:5173:5173"]
    environment:
      API_URL: http://api:80
'@

$ComposePath = Join-Path $env:TEMP 'order-intake-demo.yml'
[System.IO.File]::WriteAllText($ComposePath, $compose)

# ---------------------------------------------------------------------------
# Pull + boot
# ---------------------------------------------------------------------------
$env:REGISTRY = "$Registry/"   # trailing slash; consumed by the compose file

Write-Host ""
Write-Host "==> Pulling images ..." -ForegroundColor Cyan
docker compose -f $ComposePath pull

Write-Host ""
Write-Host "==> Starting stack. Open http://localhost:5173 once the API logs say" -ForegroundColor Cyan
Write-Host "    'Application startup complete.' (~10 seconds on first run)." -ForegroundColor Cyan
Write-Host "    Press Ctrl+C here to stop everything." -ForegroundColor Cyan
Write-Host ""

try {
    docker compose -f $ComposePath up
} finally {
    Write-Host ""
    Write-Host "==> Stopping stack ..." -ForegroundColor Cyan
    docker compose -f $ComposePath down
    Remove-Item $ComposePath -ErrorAction SilentlyContinue
}

order-intake-pm-demo.sh

#!/usr/bin/env bash
# Order Intake -- PM demo bootstrap (self-contained).
#
# Pulls the UI + API demo images from the Trimble dev-secure ACR, brings
# up a 3-service stack (mongo + api + ui), and prints the URL.
#
# Usage:
#   bash <(curl -fsSL https://gist.githubusercontent.com/.../raw/order-intake-pm-demo.sh)
#
#   or download this file and run:
#     bash order-intake-pm-demo.sh
#
# Requirements:
#   - Docker Desktop running.
#   - Azure CLI (az) with `az login` against the
#     "TT - SupplyChainInsights-DEV-Secure" subscription.
#   - Pull access to sciorderintakedemo.azurecr.io (Contributor or AcrPull).
#
# Ctrl+C tears the stack down cleanly.

set -euo pipefail

REGISTRY="${REGISTRY:-sciorderintakedemo.azurecr.io}"
# Strip any trailing slashes the caller may have included so we don't end up
# with `host//image` after re-appending one below (which docker rejects as
# "invalid reference format"). Bites users whose shells have $REGISTRY left
# over from an earlier failed run.
REGISTRY="${REGISTRY%/}"
while [[ "${REGISTRY}" == */ ]]; do REGISTRY="${REGISTRY%/}"; done
# Pin the dev-secure subscription AND resource group so `az acr login`
# ignores the user's `az config defaults` (which may point at a different
# subscription or RG).
SUBSCRIPTION="${SUBSCRIPTION:-477e4fec-5e6c-4ac5-966a-d3b9669f8cad}"
RESOURCE_GROUP="${RESOURCE_GROUP:-sci-order-intake-demo-rg}"
# Also pin the AAD tenant. The demo registry lives in the
# `azuretmwsystems.onmicrosoft.com` tenant; users with primary identities
# in the regular Trimble corp tenant will have a default `az login` token
# scoped to corp and get 403 on the registry RBAC lookup. Forcing --tenant
# here makes az get a fresh token in the correct tenant before talking to
# the registry. Bit Dipen on 2026-04-28.
TENANT="${TENANT:-23235593-4c46-41c1-944b-32a03aab96e6}"

# ---------------------------------------------------------------------------
# Preflight
# ---------------------------------------------------------------------------
command -v docker >/dev/null || {
  echo "error: docker not found. Install Docker Desktop and try again." >&2
  exit 1
}
docker info >/dev/null 2>&1 || {
  echo "error: docker daemon not reachable. Open Docker Desktop and try again." >&2
  exit 1
}
command -v az >/dev/null || {
  cat >&2 <<EOF
error: Azure CLI not found. Install with:
  brew install azure-cli       # macOS
  https://aka.ms/InstallAzureCLI   # Windows / Linux
Then run \`az login\` and re-run this script.
EOF
  exit 1
}

REGISTRY_NAME="${REGISTRY%%.*}"
echo "==> Authenticating to $REGISTRY (tenant $TENANT, subscription $SUBSCRIPTION, rg $RESOURCE_GROUP) ..."
# Make the dev-secure sub the active context. If the user's current
# `az login` token is scoped to a different tenant (typical for Trimble
# corp identities — their default tenant is corp, not azuretmwsystems
# where this registry lives), this `az account set` will fail with
# "subscription not found". Catch that and trigger a tenant-correct
# re-login. Already-correct users get a no-op set and no prompts.
if ! az account set --subscription "$SUBSCRIPTION" 2>/dev/null; then
  echo "    sub not visible in current tenant; re-authenticating via $TENANT ..."
  az login --tenant "$TENANT" --output none
  az account set --subscription "$SUBSCRIPTION"
fi
az acr login -n "$REGISTRY_NAME" \
  --resource-group "$RESOURCE_GROUP" \
  --subscription "$SUBSCRIPTION"

# ---------------------------------------------------------------------------
# Compose file (inlined so this script is the single thing the PM needs).
# ---------------------------------------------------------------------------
COMPOSE_FILE="$(mktemp -t order-intake-demo.XXXXXX.yml)"
cat >"$COMPOSE_FILE" <<'YAML'
# Generated by order-intake-pm-demo.sh
services:
  mongo:
    image: mongo:7
    container_name: order-intake-demo-mongo
    healthcheck:
      test: ["CMD", "mongosh", "--quiet", "--eval", "db.adminCommand('ping').ok"]
      interval: 5s
      timeout: 5s
      retries: 12
      start_period: 10s

  api:
    image: ${REGISTRY:-}sci-order-intake-api:demo
    container_name: order-intake-demo-api
    depends_on:
      mongo:
        condition: service_healthy
    expose:
      - "80"

  ui:
    image: ${REGISTRY:-}sci-order-intake-ui:demo
    container_name: order-intake-demo-ui
    depends_on:
      - api
    ports:
      # Localhost-only: the demo API exposes an unauthenticated
      # token-minting endpoint behind DEMO_MODE; we keep it off the LAN.
      - "127.0.0.1:5173:5173"
    environment:
      API_URL: http://api:80
YAML

# ---------------------------------------------------------------------------
# Pull + boot
# ---------------------------------------------------------------------------
export REGISTRY="${REGISTRY}/"   # trailing slash; consumed by the compose file

echo "==> Pulling images ..."
docker compose -f "$COMPOSE_FILE" pull

cleanup() {
  echo
  echo "==> Stopping stack ..."
  docker compose -f "$COMPOSE_FILE" down
  rm -f "$COMPOSE_FILE"
}
trap cleanup INT TERM

echo
echo "==> Starting stack. Open http://localhost:5173 once the API logs say"
echo "    'Application startup complete.' (~10 seconds on first run)."
echo "    Press Ctrl+C here to stop everything."
echo

docker compose -f "$COMPOSE_FILE" up