Fix Azure Functions Role Assignments to Host Storage

[eerhardt]

Description

With #8127, a mistake was made in that WithRoleAssignments only works if the app is using ACA infrastructure. If the app isn't using our ACA infrastructure, WithRoleAssignments throws an exception at startup.

To make Azure Functions work correctly both with and without ACA infrastructure we use the internal WithDefaultRoleAssignments method to set the default role assignments on the Host Storage, which will be respected for both.

Checklist

• Is this feature complete?
  • Yes. Ready to ship.
• Are you including unit tests for the changes and scenario tests if relevant?
  • Yes
• Did you add public API?
  • No
• Does the change make any security assumptions or guarantees?
  • No
• Does the change require an update in our Aspire docs?
  • No

[Copilot]

Pull Request Overview

This PR fixes the role assignment issue for Azure Functions host storage so that default role assignments are applied when not using ACA infrastructure. The changes adjust how storage resources are created and update tests to reflect the correct built-in role assignments.

• Updated storage resource creation to use WithDefaultRoleAssignments when the storage resource is null.
• Removed the block that removed role assignments for explicit storage resources.
• Updated test resources to match the expected built-in role IDs and resource names.

Reviewed Changes

Copilot reviewed 2 out of 4 changed files in this pull request and generated no comments.

File	Description
src/Aspire.Hosting.Azure.Functions/AzureFunctionsProjectResourceExtensions.cs	Change storage creation logic to conditionally add default role assignments without removing explicit role assignments.
tests/Aspire.Hosting.Azure.Tests/AzureFunctionsTests.cs	Swapped test resource names and role definition IDs to match updated role assignments.

Files not reviewed (2)

• playground/AzureFunctionsEndToEnd/AzureFunctionsEndToEnd.AppHost/aspire-manifest.json: Language not supported
• src/Aspire.Hosting.Azure.Functions/Aspire.Hosting.Azure.Functions.csproj: Language not supported

Comments suppressed due to low confidence (2)

src/Aspire.Hosting.Azure.Functions/AzureFunctionsProjectResourceExtensions.cs:49

• The new conditional block applies default role assignments only when storage is implicitly created. Please verify that this change does not lead to unintended role conflicts when an explicit storage resource is provided.

if (storage is null)

tests/Aspire.Hosting.Azure.Tests/AzureFunctionsTests.cs:315

• The role assignment resource names and roleDefinition IDs have been swapped relative to previous tests. Ensure that the intended built-in role (StorageTableDataContributor vs StorageQueueDataContributor) is consistently referenced between the code and tests.

resource funcstorage634f8_StorageTableDataContributor 'Microsoft.Authorization/roleAssignments@2022-04-01' = {

[captainsafia]

Thanks for adding the test!