Azure / Azure/data-api-builder

[Feature] Add support for database policies with relations

Open
#2,676 7 comments 2 reactions 0 assignees View on GitHub
move-to-close
Dominant language
C#
Stars
1.5k
Forks
370
Avg merge
3d 17h
Merged PRs (30d)
8

Description

DAB currently offers support for simple Odata expressions when defining “RLS” policies for an entity as explained in the [public doc](https://learn.microsoft.com/en-us/azure/data-api-builder/reference-configuration?tabs=http#database).

```
{
"entities": {
"User": {
"source": {
"object": "dbo.Users",
"type": "table"
},
"permissions": [
{
"role": "selfReader",
"actions": [
{
"action": "read",
"policy": {
"database": "@claims.userId eq @item.Id"
}
}
]
}
]
}
}
}
```

This instructs DAB to return rows from User table only for which Id value matches with the userId claim. The expression supports filtering on columns on the same entity only.

In many cases, customers keep user details or mapping details on a separate table altogether. Consider the following database schema.

Books
-Id
-Title
-SellerId (relationship with Sellers on its id)

Sellers
-id
-email


Let’s say we want to return Book rows only if its seller email is the same as caller’s email.
To support his behavior, we would need support for enhanced Odata expressions such as
`@item.sellerId/all(s: s/email eq @claims.upn)`
OR 
`@item.sellerId/any(s: s/email eq @claims.upn)`

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.