Azure / Azure/data-api-builder

Cosmos DB: Item Level auth support using DB policy

Open
#2,741 1 comment 0 reactions 2 assignees Claimed by @sourabh1007 View on GitHub
Dominant language
C#
Stars
1.5k
Forks
370
Avg merge
3d 17h
Merged PRs (30d)
8

Description

I am trying to restrict few records from my container using DB policy. I have referred the [Directives section](https://learn.microsoft.com/en-us/azure/data-api-builder/reference-configuration?tabs=http#directives)
and some of the examples listed around.

I have also come across the below:
1. [Cosmos DB: Adds Item Level Auth support using DB Policy](https://github.com/Azure/data-api-builder/pull/2106),
2. [[Known Issue] Azure Cosmos DB Support for Authorization Policies](https://github.com/Azure/data-api-builder/issues/597)

Going by the docs, issues listed above, I came out with a very basic configuration shown below:
`graphql schema`:

```
type Asset @model {
id: ID!
assetNumber: Int
code: String
assetType: String
}
```

`dab-config.json` looks like below:

```
{
"$schema": "https://github.com/Azure/data-api-builder/releases/download/v1.5.50/dab.draft.schema.json",
"data-source": {
"database-type": "cosmosdb_nosql",
"connection-string": "@env('COSMOS_NO_SQL_API_CONN')",
"options": {
"database": "AssetDatabase",
"schema": "schema.gql"
}
},
"runtime": {
"graphql": {
"enabled": true,
"path": "/graphql",
"allow-introspection": true
},
"host": {
"mode": "development"
}
},
"entities": {
"Asset": {
"source": "AssetContainer",
"graphql": true,
"rest": false,
"permissions": [
{
"role": "anonymous",
"actions": [
{
"action": "read",
"fields": {
"include": [
"id",
"assetNumber",
"code",
"assetType"
]
},
"policy": {
"database": "@item.assetType eq 'Machinery' "
}
}
]
}
]
}
}
}

```
Finally, when I run dab and execute graphl query I see:

```
{
"errors": [
{
"message": "Response status code does not indicate success: BadRequest (400); Substatus: 0; ActivityId: some_id; Reason: (Message: {\"errors\":[{\"severity\":\"Error\",\"location\":{\"start\":88,\"end\":89},\"code\":\"SC1001\",\"message\":\"Syntax error, incorrect syntax near '.'.\"}]}\nActivityId: some_id, Request URI: /apps/some_id/services/some_id/partitions/some_id/replicas/some_id/, RequestStats: Microsoft.Azure.Cosmos.Tracing.TraceData.ClientSideRequestStatisticsTraceDatum, SDK: Linux/24.04 cosmos-netstandard-sdk/3.32.0);",
"locations": [
{
"line": 2,
"column": 3
}
],
"path": [
"assets"
]
}
],
"data": null
}
```

Note: Some of the data in the above response is trimmed(ids).

While a simple graphql query looks like below:

```
{
assets {
items {
id
assetNumber
code
assetType
}
}
}
```

If I remove the `policy` `section` no doubt it properly queries the data.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.