Previously, broken base64 policies in the ARM template or YAML caused the tool to exit unconditionally, even when generating a new policy without diff mode.

Now:

• In non-diff mode, the process continues and no longer exits when encountering invalid base64 data. The error is logged as a warning, and policy generation proceeds.
• In diff mode, broken base64 policies raise an error, and the tool exits with a clear message, as expected.

Explored a few approaches, but after talking with Seth, landed on this one:

• Chosen Approach: raising exceptions and handling at a higher level
  • raise exceptions for base64 errors in low-level utility functions (base64_to_str) and handle them at a higher level (e.g., load_policy_from_arm_template_str and load_policy_from_virtual_node_yaml_str)
  • keeps utility functions focused on their tasks (decoding base64, decomposing policy) without needing to know about diff_mode. high-level functions decide how to handle the error (e.g., ignore in non-diff mode, exit in diff mode).

Other explored ideas:

• Old: Bubbling diff_mode down to utility functions
  • Involves passing the diff_mode flag down to functions like decompose_confidential_properties and base64_to_str to handle errors differently based on the mode.
  • easy fix, but utility functions shouldn’t depend on high-level logic like mode.
• Old: Modifying decompose_confidential_properties and extract_confidential_properties
  • handle base64 errors directly inside these functions and adjust behavior based on the mode.
  • works but more complex. embeds diff mode logic into functions that should only focus on data extraction/decomposition

Tested manually and with azdev test confcom and azdev style confcom