Azure / Azure/data-api-builder
Cosmos DB: Item Level auth support using DB policy
- Dominant language
- C#
- Stars
- 1.5k
- Forks
- 370
- Avg merge
- 3d 17h
- Merged PRs (30d)
- 8
Description
I am trying to restrict few records from my container using DB policy. I have referred the [Directives section](https://learn.microsoft.com/en-us/azure/data-api-builder/reference-configuration?tabs=http#directives)
and some of the examples listed around.
I have also come across the below:
1. [Cosmos DB: Adds Item Level Auth support using DB Policy](https://github.com/Azure/data-api-builder/pull/2106),
2. [[Known Issue] Azure Cosmos DB Support for Authorization Policies](https://github.com/Azure/data-api-builder/issues/597)
Going by the docs, issues listed above, I came out with a very basic configuration shown below:
`graphql schema`:
```
type Asset @model {
id: ID!
assetNumber: Int
code: String
assetType: String
}
```
`dab-config.json` looks like below:
```
{
"$schema": "https://github.com/Azure/data-api-builder/releases/download/v1.5.50/dab.draft.schema.json",
"data-source": {
"database-type": "cosmosdb_nosql",
"connection-string": "@env('COSMOS_NO_SQL_API_CONN')",
"options": {
"database": "AssetDatabase",
"schema": "schema.gql"
}
},
"runtime": {
"graphql": {
"enabled": true,
"path": "/graphql",
"allow-introspection": true
},
"host": {
"mode": "development"
}
},
"entities": {
"Asset": {
"source": "AssetContainer",
"graphql": true,
"rest": false,
"permissions": [
{
"role": "anonymous",
"actions": [
{
"action": "read",
"fields": {
"include": [
"id",
"assetNumber",
"code",
"assetType"
]
},
"policy": {
"database": "@item.assetType eq 'Machinery' "
}
}
]
}
]
}
}
}
```
Finally, when I run dab and execute graphl query I see:
```
{
"errors": [
{
"message": "Response status code does not indicate success: BadRequest (400); Substatus: 0; ActivityId: some_id; Reason: (Message: {\"errors\":[{\"severity\":\"Error\",\"location\":{\"start\":88,\"end\":89},\"code\":\"SC1001\",\"message\":\"Syntax error, incorrect syntax near '.'.\"}]}\nActivityId: some_id, Request URI: /apps/some_id/services/some_id/partitions/some_id/replicas/some_id/, RequestStats: Microsoft.Azure.Cosmos.Tracing.TraceData.ClientSideRequestStatisticsTraceDatum, SDK: Linux/24.04 cosmos-netstandard-sdk/3.32.0);",
"locations": [
{
"line": 2,
"column": 3
}
],
"path": [
"assets"
]
}
],
"data": null
}
```
Note: Some of the data in the above response is trimmed(ids).
While a simple graphql query looks like below:
```
{
assets {
items {
id
assetNumber
code
assetType
}
}
}
```
If I remove the `policy` `section` no doubt it properly queries the data.
Contributor guide
Assessment
This issue has not been assessed yet.