Azure / Azure/data-api-builder

[Bug]: GraphQL response issue with Role based Authentication

Open
#2,623 2 comments 0 reactions 1 assignee Claimed by @aaronburtle View on GitHub
bug cri graphql security triage
Dominant language
C#
Stars
1.5k
Forks
370
Avg merge
3d 17h
Merged PRs (30d)
8

Description

### What happened?

When I create a schema like in the given file
[sql scripts.txt](https://github.com/user-attachments/files/19333346/sql.scripts.txt)

And create a dab-config file like this
[config.json](https://github.com/user-attachments/files/19333347/config.json)

And I use graphql,

1) when I query like this with authentication provider as Simulator and role for all the entities as anonymous, it works perfectly well.

```graphql
query Contacts {
contacts(filter: { num: { eq: "1234567890" } }) {
items {
contactParty {
items {
fname
mname
lname
partyContact {
items {
num
}
}
partyCoverage {
items {
type
coveragePolicy {
policyNum
}
}
}
}
}
}
}
}
```

2) Now change the role to read.contact for entities and pass the header while requesting the above request will give error like

```json
{
"errors": [
{
"message": "The given key 'coveragePolicy' was not present in the dictionary.",
"locations": [
{
"line": 17,
"column": 29
}
],
"path": [
"contacts",
"items",
0,
"contactParty",
"items",
0,
"partyCoverage",
"items",
0,
"coveragePolicy"
]
}
],
"data": {
"contacts": {
"items": [
{
"contactParty": {
"items": [
{
"fname": "John",
"mname": "A",
"lname": "Doe",
"partyContact": {
"items": [
{
"num": "1234567890"
}
]
},
"partyCoverage": {
"items": [
{
"type": "TypeA",
"coveragePolicy": null
}
]
}
}
]
}
}
]
}
}
}
```

3) Now change the request as the below, calling partyCoverage before. Then this works perfectly well.

```graphql
query Contacts {
contacts(filter: { num: { eq: "1234567890" } }) {
items {
contactParty {
items {
fname
mname
lname
partyCoverage {
items {
type
coveragePolicy {
policyNum
}
}
}
partyContact {
items {
num
}
}
}
}
}
}
}
```

I'm scared when this scenario happens for two of this requesting with similar structure things will break.

Do let me know, if you need more information.

### Version

Microsoft.DataApiBuilder 1.4.26+647f344af9fe5c1079b27c00d0e3d3d0f44cb777

### What database are you using?

Azure SQL

### What hosting model are you using?

Local (including CLI)

### Which API approach are you accessing DAB through?

GraphQL

### Relevant log output

```Text
Azure.DataApiBuilder.Service.Startup[0]
A GraphQL request execution error occurred.
System.Collections.Generic.KeyNotFoundException: The given key 'coveragePolicy' was not present in the dictionary.
at System.Collections.Generic.Dictionary`2.get_Item(TKey key)
at Azure.DataApiBuilder.Core.Resolvers.SqlQueryEngine.ResolveObject(JsonElement element, IObjectField fieldSchema, IMetadata& metadata) in /_/src/Core/Resolvers/SqlQueryEngine.cs:line 221
at Azure.DataApiBuilder.Service.Services.ExecutionHelper.ExecuteObjectField(IPureResolverContext context) in /_/src/Core/Services/ExecutionHelper.cs:line 203
at ResolverTypeInterceptor.<>c__DisplayClass5_0.<.ctor>b__3(IPureResolverContext ctx) in /_/src/Core/Services/ResolverTypeInterceptor.cs:line 36
at HotChocolate.Resolvers.FieldResolverDelegates.<>c__DisplayClass0_0.<.ctor>b__0(IResolverContext context)
at HotChocolate.Types.Helpers.FieldMiddlewareCompiler.<>c__DisplayClass9_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at HotChocolate.AspNetCore.Authorization.AuthorizeMiddleware.InvokeAsync(IDirectiveContext context)
at HotChocolate.Utilities.MiddlewareCompiler`1.ExpressionHelper.AwaitTaskHelper(Task task)
at HotChocolate.Execution.Processing.Tasks.ResolverTask.ExecuteResolverPipelineAsync(CancellationToken cancellationToken)
at HotChocolate.Execution.Processing.Tasks.ResolverTask.TryExecuteAsync(CancellationToken cancellationToken)
```

### Code of Conduct

- [x] I agree to follow this project's Code of Conduct

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.