feat: Restrict API to Private Access

[Priyanka-Microsoft]

Purpose

• ...
  This pull request introduces support for secure, private-only networking for the backend Function App when running in container hosting mode with WAF enabled. It ensures the Function App is only accessible via private endpoints, except during deployment, when public access is temporarily enabled to allow deployment tools to function. The changes also clarify deployment behaviors for both container and code hosting models, and add supporting scripts and documentation.

Infrastructure and Networking Enhancements:

• The Function App is now configured for private-only access (publicNetworkAccess=Disabled and private endpoint with DNS) when enablePrivateNetworking=true and AZURE_APP_SERVICE_HOSTING_MODEL=container. Public access is temporarily enabled during deployment and restored to private-only after. [1] [2] [3] [4]
• Added privatelink.azurewebsites.net DNS zone and related indexing to support the Function App’s private endpoint. [1] [2] [3] [4]

Deployment Automation:

• Added predeploy and postdeploy hooks in azure.yaml to run new scripts that toggle Function App public network access before and after deployment, ensuring deployments succeed while maintaining private-only access outside of deployment windows. [1] [2]
• Introduced cross-platform scripts (scripts/function_network_toggle.ps1 for Windows, scripts/function_network_toggle.sh for POSIX) that safely enable/disable public access only when required and only for container hosting. [1] [2]

Documentation Updates:

• Updated README.md and docs/LOCAL_DEPLOYMENT.md to explain the new WAF/private networking deployment flow, including differences between container and code hosting models, and what to expect regarding network access during deployment and at runtime. [1] [2]

These changes improve security and compliance for deployments requiring private networking, while maintaining a smooth deployment experience.

Does this introduce a breaking change?

• Yes
• No

How to Test

• Get the code

git clone [repo-address]
cd [repo-name]
git checkout [branch-name]
npm install

• Test the code

What to Check

Verify that the following are valid

• ...

Other Information