add tests, note req permissions

R/az_resgroup.R

@@ -15,7 +15,7 @@
 #' - `delete_resource(..., confirm=TRUE, wait=FALSE)`: Delete an existing resource. Optionally wait for the delete to finish.
 #' - `resource_exists(...)`: Check if a resource exists.
 #' - `list_resources()`: Return a list of resource group objects for this subscription.
-#' - `create_lock(name, level)`: Create a management lock on this resource group (which will propagate to all resources within it). The `level` argument can be either "cannotdelete" or "readonly".
+#' - `create_lock(name, level)`: Create a management lock on this resource group (which will propagate to all resources within it). The `level` argument can be either "cannotdelete" or "readonly". Note if you logged in via a custom service principal, it must have "Owner" or "User Access Administrator" access to manage locks.
 #' - `get_lock(name`): Returns a management lock object.
 #' - `delete_lock(name)`: Deletes a management lock object.
 #'

R/az_resource.R

@@ -11,7 +11,7 @@
 #' - `set_api_version(api_version, stable_only=TRUE)`: Set the API version to use when interacting with the host. If `api_version` is not supplied, use the latest version available, either the latest stable version (if `stable_only=TRUE`) or the latest preview version (if `stable_only=FALSE`).
 #' - `get_api_version()`: Get the current API version.
 #' - `do_operation(...)` Carry out an operation. See 'Operations' for more details.
-#' - `create_lock(name, level)`: Create a management lock on this resource. The `level` argument can be either "cannotdelete" or "readonly".
+#' - `create_lock(name, level)`: Create a management lock on this resource. The `level` argument can be either "cannotdelete" or "readonly". Note if you logged in via a custom service principal, it must have "Owner" or "User Access Administrator" access to manage locks.
 #' - `get_lock(name`): Returns a management lock object.
 #' - `delete_lock(name)`: Deletes a management lock object.
 #'

R/az_subscription.R

@@ -14,7 +14,7 @@
 #' - `resource_group_exists(name)`: Check if a resource group exists.
 #' - `list_resources()`: List all resources deployed under this subscription.
 #' - `list_locations()`: List locations available.
-#' - `create_lock(name, level)`: Create a management lock on this subscription (which will propagate to all resources within it). The `level` argument can be either "cannotdelete" or "readonly".
+#' - `create_lock(name, level)`: Create a management lock on this subscription (which will propagate to all resources within it). The `level` argument can be either "cannotdelete" or "readonly". Note if you logged in via a custom service principal, it must have "Owner" or "User Access Administrator" access to manage locks.
 #' - `get_lock(name`): Returns a management lock object.
 #' - `delete_lock(name)`: Deletes a management lock object.
 #' - `get_provider_api_version(provider, type)`: Get the current API version for the given resource provider and type. If no resource type is supplied, returns a vector of API versions, one for each resource type for the given provider. If neither provider nor type is supplied, returns the API versions for all resources and providers.

man/az_resource.Rd

@@ -21,7 +21,7 @@ Class representing a generic Azure resource.
 \item \code{set_api_version(api_version, stable_only=TRUE)}: Set the API version to use when interacting with the host. If \code{api_version} is not supplied, use the latest version available, either the latest stable version (if \code{stable_only=TRUE}) or the latest preview version (if \code{stable_only=FALSE}).
 \item \code{get_api_version()}: Get the current API version.
 \item \code{do_operation(...)} Carry out an operation. See 'Operations' for more details.
-\item \code{create_lock(name, level)}: Create a management lock on this resource. The \code{level} argument can be either "cannotdelete" or "readonly".
+\item \code{create_lock(name, level)}: Create a management lock on this resource. The \code{level} argument can be either "cannotdelete" or "readonly". Note if you logged in via a custom service principal, it must have "Owner" or "User Access Administrator" access to manage locks.
 \item \code{get_lock(name}): Returns a management lock object.
 \item \code{delete_lock(name)}: Deletes a management lock object.
 }

man/az_resource_group.Rd

@@ -25,7 +25,7 @@ Class representing an Azure resource group.
 \item \code{delete_resource(..., confirm=TRUE, wait=FALSE)}: Delete an existing resource. Optionally wait for the delete to finish.
 \item \code{resource_exists(...)}: Check if a resource exists.
 \item \code{list_resources()}: Return a list of resource group objects for this subscription.
-\item \code{create_lock(name, level)}: Create a management lock on this resource group (which will propagate to all resources within it). The \code{level} argument can be either "cannotdelete" or "readonly".
+\item \code{create_lock(name, level)}: Create a management lock on this resource group (which will propagate to all resources within it). The \code{level} argument can be either "cannotdelete" or "readonly". Note if you logged in via a custom service principal, it must have "Owner" or "User Access Administrator" access to manage locks.
 \item \code{get_lock(name}): Returns a management lock object.
 \item \code{delete_lock(name)}: Deletes a management lock object.
 }

man/az_subscription.Rd

@@ -22,7 +22,7 @@ Class representing an Azure subscription.
 \item \code{resource_group_exists(name)}: Check if a resource group exists.
 \item \code{list_resources()}: List all resources deployed under this subscription.
 \item \code{list_locations()}: List locations available.
-\item \code{create_lock(name, level)}: Create a management lock on this subscription (which will propagate to all resources within it). The \code{level} argument can be either "cannotdelete" or "readonly".
+\item \code{create_lock(name, level)}: Create a management lock on this subscription (which will propagate to all resources within it). The \code{level} argument can be either "cannotdelete" or "readonly". Note if you logged in via a custom service principal, it must have "Owner" or "User Access Administrator" access to manage locks.
 \item \code{get_lock(name}): Returns a management lock object.
 \item \code{delete_lock(name)}: Deletes a management lock object.
 \item \code{get_provider_api_version(provider, type)}: Get the current API version for the given resource provider and type. If no resource type is supplied, returns a vector of API versions, one for each resource type for the given provider. If neither provider nor type is supplied, returns the API versions for all resources and providers.

tests/testthat/test03_rg.R

@@ -26,5 +26,11 @@ test_that("Resource group methods work",
     expect_is(rgnew2, "az_resource_group")
     expect_equal(rgnew2$name, rgname)
 
+    # locking
+    expect_is(rgnew$create_lock("newlock_rg", level="cannotdelete"), "az_resource")
+    expect_is(rgnew$get_lock("newlock_rg"), "az_resource")
+    expect_null(rgnew$delete_lock("newlock_rg"))
+    expect_error(rgnew$get_lock("newlock_rg"))
+
     rgnew$delete(confirm=FALSE)
 })

tests/testthat/test04_resource.R

@@ -47,6 +47,12 @@ test_that("Resource methods work",
     res$set_tags(tag1="value1")
     expect_true(!is.null(res$tags))
 
+    # locking
+    expect_is(res$create_lock("newlock_res", level="cannotdelete"), "az_resource")
+    expect_is(res$get_lock("newlock_res"), "az_resource")
+    expect_null(res$delete_lock("newlock_res"))
+    expect_error(res$get_lock("newlock_res"))
+
     # deletion
     expect_null(rg$delete_resource(type=restype, name=resname, confirm=FALSE, wait=TRUE))
     expect_false(rg$resource_exists(type=restype, name=resname))