Repository: microsoft/onefuzz
File: src/ApiService/ApiService/Functions/InstanceConfig.cs (C#)

Code before:
            "GET" => Get(r),
            "POST" => Post(r),
            _ => throw new InvalidOperationException("Unsupported HTTP method"),
        });
    }
    public async Async.Task<HttpResponseData> Get(HttpRequestData req) {
        _log.Info($"getting instance_config");
        var config = await _context.ConfigOperations.Fetch();

        var response = req.CreateResponse(HttpStatusCode.OK);
        await response.WriteAsJsonAsync(config);
        return response;
    }

    public async Async.Task<HttpResponseData> Post(HttpRequestData req) {
        _log.Info($"attempting instance_config update");
        var request = await RequestHandling.ParseRequest<InstanceConfigUpdate>(req);

        if (!request.IsOk) {
            return await _context.RequestHandling.NotOk(
                req,
                request.ErrorV,
                context: "instance_config update");
        }
        var config = await _context.ConfigOperations.Fetch();
        var answer = await _auth.CheckRequireAdmins(req);
        if (!answer.IsOk) {
            return await _context.RequestHandling.NotOk(req, answer.ErrorV, "instance_config update");
        }
        var updateNsg = false;
        if (request.OkV.config.ProxyNsgConfig is not null && config.ProxyNsgConfig is not null) {
            var requestConfig = request.OkV.config.ProxyNsgConfig;
            var currentConfig = config.ProxyNsgConfig;
            if (!((new HashSet<string>(requestConfig.AllowedServiceTags)).SetEquals(new HashSet<string>(currentConfig.AllowedServiceTags))) || !((new HashSet<string>(requestConfig.AllowedIps)).SetEquals(new HashSet<string>(currentConfig.AllowedIps)))) {
                updateNsg = true;
            }
        }
        await _context.ConfigOperations.Save(request.OkV.config, false, false);
        if (updateNsg) {
            await foreach (var nsg in _context.NsgOperations.ListNsgs()) {
                _log.Info($"Checking if nsg: {nsg.Data.Location!} ({nsg.Data.Name}) owned by OneFuz");
                if (nsg.Data.Location! == nsg.Data.Name) {
                    var result = await _context.NsgOperations.SetAllowedSources(new Nsg(nsg.Data.Location!, nsg.Data.Location!), request.OkV.config.ProxyNsgConfig!);
                    if (!result.IsOk) {
                        return await _context.RequestHandling.NotOk(
                        req,
                        result.ErrorV,
                        context: "instance_config update");
                    }
                }
            }

Review comment (security):
You can await both to do these operations in parallel:

(also needs `using System.Threading.Tasks;` at top) 

```suggestion
        var (config, answer) = await (
            _context.ConfigOperations.Fetch(),
            _auth.CheckRequireAdmins(req));
```

Code after:
        return _auth.CallIfUser(req, r => r.Method switch {
            "GET" => Get(r),
            "POST" => Post(r),
            _ => throw new InvalidOperationException("Unsupported HTTP method"),
        });
    }
    public async Async.Task<HttpResponseData> Get(HttpRequestData req) {
        _log.Info($"getting instance_config");
        var config = await _context.ConfigOperations.Fetch();

        var response = req.CreateResponse(HttpStatusCode.OK);
        await response.WriteAsJsonAsync(config);
        return response;
    }

    public async Async.Task<HttpResponseData> Post(HttpRequestData req) {
        _log.Info($"attempting instance_config update");
        var request = await RequestHandling.ParseRequest<InstanceConfigUpdate>(req);

        if (!request.IsOk) {
            return await _context.RequestHandling.NotOk(
                req,
                request.ErrorV,
                context: "instance_config update");
        }
        var (config, answer) = await (
            _context.ConfigOperations.Fetch(),
            _auth.CheckRequireAdmins(req));
        if (!answer.IsOk) {
            return await _context.RequestHandling.NotOk(req, answer.ErrorV, "instance_config update");
        }
        var updateNsg = false;
        if (request.OkV.config.ProxyNsgConfig is NetworkSecurityGroupConfig requestConfig
            && config.ProxyNsgConfig is NetworkSecurityGroupConfig currentConfig) {
            if (!requestConfig.AllowedServiceTags.ToHashSet().SetEquals(currentConfig.AllowedServiceTags)
                || !requestConfig.AllowedIps.ToHashSet().SetEquals(currentConfig.AllowedIps)) {
                updateNsg = true;
            }
        }
        await _context.ConfigOperations.Save(request.OkV.config, false, false);
        if (updateNsg) {
            await foreach (var nsg in _context.NsgOperations.ListNsgs()) {
                _log.Info($"Checking if nsg: {nsg.Data.Location!} ({nsg.Data.Name}) owned by OneFuzz");
                if (nsg.Data.Location! == nsg.Data.Name) {
                    var result = await _context.NsgOperations.SetAllowedSources(new Nsg(nsg.Data.Location!, nsg.Data.Location!), request.OkV.config.ProxyNsgConfig!);
                    if (!result.IsOk) {
                        return await _context.RequestHandling.NotOk(
                        req,
                        result.ErrorV,
                        context: "instance_config update");
                    }