Repository: microsoft/onefuzz
File: src/ApiService/ApiService/Functions/InstanceConfig.cs (C#)

Code before:
        return response;
    }

    public async Async.Task<HttpResponseData> Post(HttpRequestData req) {
        _log.Info($"attempting instance_config update");
        var request = await RequestHandling.ParseRequest<InstanceConfigUpdate>(req);

        if (!request.IsOk) {
            return await _context.RequestHandling.NotOk(
                req,
                request.ErrorV,
                context: "instance_config update");
        }
        var config = await _context.ConfigOperations.Fetch();
        var answer = await _auth.CheckRequireAdmins(req);
        if (!answer.IsOk) {
            return await _context.RequestHandling.NotOk(req, answer.ErrorV, "instance_config update");
        }
        var updateNsg = false;
        if (request.OkV.config.ProxyNsgConfig is not null && config.ProxyNsgConfig is not null) {
            var requestConfig = request.OkV.config.ProxyNsgConfig;
            var currentConfig = config.ProxyNsgConfig;
            if (!((new HashSet<string>(requestConfig.AllowedServiceTags)).SetEquals(new HashSet<string>(currentConfig.AllowedServiceTags))) || !((new HashSet<string>(requestConfig.AllowedIps)).SetEquals(new HashSet<string>(currentConfig.AllowedIps)))) {
                updateNsg = true;
            }
        }
        await _context.ConfigOperations.Save(request.OkV.config, false, false);
        if (updateNsg) {
            await foreach (var nsg in _context.NsgOperations.ListNsgs()) {
                _log.Info($"Checking if nsg: {nsg.Data.Location!} ({nsg.Data.Name}) owned by OneFuz");
                if (nsg.Data.Location! == nsg.Data.Name) {
                    var result = await _context.NsgOperations.SetAllowedSources(new Nsg(nsg.Data.Location!, nsg.Data.Location!), request.OkV.config.ProxyNsgConfig!);
                    if (!result.IsOk) {
                        return await _context.RequestHandling.NotOk(
                        req,
                        result.ErrorV,
                        context: "instance_config update");
                    }
                }
            }
        }
        var instanceConfigResponse = req.CreateResponse(HttpStatusCode.OK);
        await instanceConfigResponse.WriteAsJsonAsync(request.OkV.config);
        return instanceConfigResponse;
    }
}


Review comment (security):
Suggest pattern-matching into some variables, and the comparison can be simplified a little:

```suggestion
        if (request.OkV.config.ProxyNsgConfig is NetworkSecurityGroupConfig requestConfig
            && config.ProxyNsgConfig is NetworkSecurityGroupConfig currentConfig) {
            if (!requestConfig.AllowedServiceTags.ToHashSet().SetEquals(currentConfig.AllowedServiceTags)
                || !requestConfig.AllowedIps.ToHashSet().SetEquals(currentConfig.AllowedIps)) {
                updateNsg = true;
            }
        }
```

Code after:
        await response.WriteAsJsonAsync(config);
        return response;
    }

    public async Async.Task<HttpResponseData> Post(HttpRequestData req) {
        _log.Info($"attempting instance_config update");
        var request = await RequestHandling.ParseRequest<InstanceConfigUpdate>(req);

        if (!request.IsOk) {
            return await _context.RequestHandling.NotOk(
                req,
                request.ErrorV,
                context: "instance_config update");
        }
        var (config, answer) = await (
            _context.ConfigOperations.Fetch(),
            _auth.CheckRequireAdmins(req));
        if (!answer.IsOk) {
            return await _context.RequestHandling.NotOk(req, answer.ErrorV, "instance_config update");
        }
        var updateNsg = false;
        if (request.OkV.config.ProxyNsgConfig is NetworkSecurityGroupConfig requestConfig
            && config.ProxyNsgConfig is NetworkSecurityGroupConfig currentConfig) {
            if (!requestConfig.AllowedServiceTags.ToHashSet().SetEquals(currentConfig.AllowedServiceTags)
                || !requestConfig.AllowedIps.ToHashSet().SetEquals(currentConfig.AllowedIps)) {
                updateNsg = true;
            }
        }
        await _context.ConfigOperations.Save(request.OkV.config, false, false);
        if (updateNsg) {
            await foreach (var nsg in _context.NsgOperations.ListNsgs()) {
                _log.Info($"Checking if nsg: {nsg.Data.Location!} ({nsg.Data.Name}) owned by OneFuzz");
                if (nsg.Data.Location! == nsg.Data.Name) {
                    var result = await _context.NsgOperations.SetAllowedSources(new Nsg(nsg.Data.Location!, nsg.Data.Location!), request.OkV.config.ProxyNsgConfig!);
                    if (!result.IsOk) {
                        return await _context.RequestHandling.NotOk(
                        req,
                        result.ErrorV,
                        context: "instance_config update");
                    }
                }
            }
        }
        var instanceConfigResponse = req.CreateResponse(HttpStatusCode.OK);
        await instanceConfigResponse.WriteAsJsonAsync(request.OkV.config);
        return instanceConfigResponse;
    }
}