Restructure to nested policies object in database YAML

Introduce DatabasePolicies class so managed identity lives under
policies.managedIdentity in YAML, making it extensible for future
database-level policies.

- Add DatabasePolicies model with ManagedIdentity property
- Replace Database.ManagedIdentityPolicies with Database.Policies
- Update DatabaseChanges, loader, tests, and demo YAML

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: alex-slynko

KustoSchemaTools.Tests/DemoData/DemoDeployment/DemoDatabase/database.yml

@@ -13,11 +13,12 @@ admins:
 - name: SPN-ADMIN
   id: aadapp=f678ce29-8f92-4d6e-b95d-f2ed8fa7713f;7396cfeb-2920-488f-b0bb-81a584d34a24
 
-managedIdentityPolicies:
-- objectId: 12345678-1234-1234-1234-123456789abc
-  allowedUsages:
-  - NativeIngestion
-  - ExternalTable
+policies:
+  managedIdentity:
+  - objectId: 12345678-1234-1234-1234-123456789abc
+    allowedUsages:
+    - NativeIngestion
+    - ExternalTable
 
 tables:
   sourceTable:

KustoSchemaTools.Tests/Model/ManagedIdentityPolicyTests.cs

@@ -129,12 +129,15 @@ public void DatabaseChanges_WithManagedIdentityPolicies_GeneratesScript()
             var newState = new Database
             {
                 Name = "TestDb",
-                ManagedIdentityPolicies = new List<ManagedIdentityPolicy>
+                Policies = new DatabasePolicies
                 {
-                    new ManagedIdentityPolicy
+                    ManagedIdentity = new List<ManagedIdentityPolicy>
                     {
-                        ObjectId = "12345678-1234-1234-1234-123456789abc",
-                        AllowedUsages = new List<string> { "NativeIngestion" }
+                        new ManagedIdentityPolicy
+                        {
+                            ObjectId = "12345678-1234-1234-1234-123456789abc",
+                            AllowedUsages = new List<string> { "NativeIngestion" }
+                        }
                     }
                 }
             };
@@ -161,17 +164,20 @@ public void DatabaseChanges_WithMultipleManagedIdentityPolicies_GeneratesSingleS
             var newState = new Database
             {
                 Name = "TestDb",
-                ManagedIdentityPolicies = new List<ManagedIdentityPolicy>
+                Policies = new DatabasePolicies
                 {
-                    new ManagedIdentityPolicy
+                    ManagedIdentity = new List<ManagedIdentityPolicy>
                     {
-                        ObjectId = "aaaaaaaa-1111-2222-3333-444444444444",
-                        AllowedUsages = new List<string> { "NativeIngestion" }
-                    },
-                    new ManagedIdentityPolicy
-                    {
-                        ObjectId = "bbbbbbbb-1111-2222-3333-444444444444",
-                        AllowedUsages = new List<string> { "ExternalTable" }
+                        new ManagedIdentityPolicy
+                        {
+                            ObjectId = "aaaaaaaa-1111-2222-3333-444444444444",
+                            AllowedUsages = new List<string> { "NativeIngestion" }
+                        },
+                        new ManagedIdentityPolicy
+                        {
+                            ObjectId = "bbbbbbbb-1111-2222-3333-444444444444",
+                            AllowedUsages = new List<string> { "ExternalTable" }
+                        }
                     }
                 }
             };
@@ -202,17 +208,23 @@ public void DatabaseChanges_WithUnchangedManagedIdentityPolicies_GeneratesNoChan
             var oldState = new Database
             {
                 Name = "TestDb",
-                ManagedIdentityPolicies = new List<ManagedIdentityPolicy> { policy }
+                Policies = new DatabasePolicies
+                {
+                    ManagedIdentity = new List<ManagedIdentityPolicy> { policy }
+                }
             };
             var newState = new Database
             {
                 Name = "TestDb",
-                ManagedIdentityPolicies = new List<ManagedIdentityPolicy>
+                Policies = new DatabasePolicies
                 {
-                    new ManagedIdentityPolicy
+                    ManagedIdentity = new List<ManagedIdentityPolicy>
                     {
-                        ObjectId = "12345678-1234-1234-1234-123456789abc",
-                        AllowedUsages = new List<string> { "NativeIngestion" }
+                        new ManagedIdentityPolicy
+                        {
+                            ObjectId = "12345678-1234-1234-1234-123456789abc",
+                            AllowedUsages = new List<string> { "NativeIngestion" }
+                        }
                     }
                 }
             };

KustoSchemaTools.Tests/Parser/YamlDatabaseHandlerTests.cs

@@ -43,9 +43,10 @@ public async Task GetDatabase()
             Assert.Equal("120d", tt.Policies?.Retention);
 
             // Verify managed identity policies are loaded from database.yml
-            Assert.NotNull(db.ManagedIdentityPolicies);
-            Assert.Single(db.ManagedIdentityPolicies);
-            var miPolicy = db.ManagedIdentityPolicies[0];
+            Assert.NotNull(db.Policies);
+            Assert.NotNull(db.Policies.ManagedIdentity);
+            Assert.Single(db.Policies.ManagedIdentity);
+            var miPolicy = db.Policies.ManagedIdentity[0];
             Assert.Equal("12345678-1234-1234-1234-123456789abc", miPolicy.ObjectId);
             Assert.Equal(2, miPolicy.AllowedUsages.Count);
             Assert.Contains("NativeIngestion", miPolicy.AllowedUsages);

KustoSchemaTools/Changes/DatabaseChanges.cs

@@ -22,17 +22,17 @@ public static List<IChange> GenerateChanges(Database oldState, Database newState
                     otherFromScripts.AddRange(oldState.Scripts.Select(itm => new DatabaseScriptContainer(itm, "DatabaseScript")));
                 if (oldState.DefaultRetentionAndCache != null)
                     otherFromScripts.AddRange(oldState.DefaultRetentionAndCache.CreateScripts(name, "database"));
-                if (oldState.ManagedIdentityPolicies != null && oldState.ManagedIdentityPolicies.Any())
-                    otherFromScripts.Add(ManagedIdentityPolicy.CreateCombinedScript(name, oldState.ManagedIdentityPolicies));
+                if (oldState.Policies?.ManagedIdentity != null && oldState.Policies.ManagedIdentity.Any())
+                    otherFromScripts.Add(ManagedIdentityPolicy.CreateCombinedScript(name, oldState.Policies.ManagedIdentity));
             }
 
             var otherToScripts = new List<DatabaseScriptContainer>();
             if (newState.Scripts != null)
                 otherToScripts.AddRange(newState.Scripts.Select(itm => new DatabaseScriptContainer(itm, "DatabaseScript")));
             if (newState.DefaultRetentionAndCache != null)
                 otherToScripts.AddRange(newState.DefaultRetentionAndCache.CreateScripts(name, "database"));
-            if (newState.ManagedIdentityPolicies != null && newState.ManagedIdentityPolicies.Any())
-                otherToScripts.Add(ManagedIdentityPolicy.CreateCombinedScript(name, newState.ManagedIdentityPolicies));
+            if (newState.Policies?.ManagedIdentity != null && newState.Policies.ManagedIdentity.Any())
+                otherToScripts.Add(ManagedIdentityPolicy.CreateCombinedScript(name, newState.Policies.ManagedIdentity));
 
             if (otherToScripts.Count > 0)
             {

KustoSchemaTools/Model/Database.cs

@@ -37,7 +37,7 @@ public class Database
 
         public Dictionary<string, FollowerDatabase> Followers { get; set; } = new Dictionary<string, FollowerDatabase>();
 
-        public List<ManagedIdentityPolicy> ManagedIdentityPolicies { get; set; } = new List<ManagedIdentityPolicy>();
+        public DatabasePolicies Policies { get; set; } = new DatabasePolicies();
 
         public string EscapedName => Name.BracketIfIdentifier();
     }

KustoSchemaTools/Model/DatabasePolicies.cs

@@ -0,0 +1,7 @@
+namespace KustoSchemaTools.Model
+{
+    public class DatabasePolicies
+    {
+        public List<ManagedIdentityPolicy> ManagedIdentity { get; set; } = new List<ManagedIdentityPolicy>();
+    }
+}

KustoSchemaTools/Parser/KustoLoader/KustoManagedIdentityPolicyLoader.cs

@@ -17,7 +17,9 @@ public async Task Load(Database database, string databaseName, KustoClient kusto
         {
             var response = await kusto.Client.ExecuteQueryAsync(databaseName, script, new ClientRequestProperties());
             var rows = response.As<ManagedIdentityRow>();
-            database.ManagedIdentityPolicies = rows
+            if (database.Policies == null)
+                database.Policies = new DatabasePolicies();
+            database.Policies.ManagedIdentity = rows
                 .Select(r => new ManagedIdentityPolicy
                 {
                     ObjectId = r.ObjectId,