Azure / Azure/data-api-builder

Cosmos DB: Item Level auth support using DB policy

Abierto
#2,741 1 comentario 0 reacciones 2 asignados Reclamado por @sourabh1007 Ver en GitHub
Lenguaje dominante
C#
Estrellas
1.5k
Forks
370
Merge medio
3 d 22 h
PR fusionados (30 d)
9

Descripción

I am trying to restrict few records from my container using DB policy. I have referred the [Directives section](https://learn.microsoft.com/en-us/azure/data-api-builder/reference-configuration?tabs=http#directives)
and some of the examples listed around.

I have also come across the below:
1. [Cosmos DB: Adds Item Level Auth support using DB Policy](https://github.com/Azure/data-api-builder/pull/2106),
2. [[Known Issue] Azure Cosmos DB Support for Authorization Policies](https://github.com/Azure/data-api-builder/issues/597)

Going by the docs, issues listed above, I came out with a very basic configuration shown below:
`graphql schema`:

```
type Asset @model {
id: ID!
assetNumber: Int
code: String
assetType: String
}
```

`dab-config.json` looks like below:

```
{
"$schema": "https://github.com/Azure/data-api-builder/releases/download/v1.5.50/dab.draft.schema.json",
"data-source": {
"database-type": "cosmosdb_nosql",
"connection-string": "@env('COSMOS_NO_SQL_API_CONN')",
"options": {
"database": "AssetDatabase",
"schema": "schema.gql"
}
},
"runtime": {
"graphql": {
"enabled": true,
"path": "/graphql",
"allow-introspection": true
},
"host": {
"mode": "development"
}
},
"entities": {
"Asset": {
"source": "AssetContainer",
"graphql": true,
"rest": false,
"permissions": [
{
"role": "anonymous",
"actions": [
{
"action": "read",
"fields": {
"include": [
"id",
"assetNumber",
"code",
"assetType"
]
},
"policy": {
"database": "@item.assetType eq 'Machinery' "
}
}
]
}
]
}
}
}

```
Finally, when I run dab and execute graphl query I see:

```
{
"errors": [
{
"message": "Response status code does not indicate success: BadRequest (400); Substatus: 0; ActivityId: some_id; Reason: (Message: {\"errors\":[{\"severity\":\"Error\",\"location\":{\"start\":88,\"end\":89},\"code\":\"SC1001\",\"message\":\"Syntax error, incorrect syntax near '.'.\"}]}\nActivityId: some_id, Request URI: /apps/some_id/services/some_id/partitions/some_id/replicas/some_id/, RequestStats: Microsoft.Azure.Cosmos.Tracing.TraceData.ClientSideRequestStatisticsTraceDatum, SDK: Linux/24.04 cosmos-netstandard-sdk/3.32.0);",
"locations": [
{
"line": 2,
"column": 3
}
],
"path": [
"assets"
]
}
],
"data": null
}
```

Note: Some of the data in the above response is trimmed(ids).

While a simple graphql query looks like below:

```
{
assets {
items {
id
assetNumber
code
assetType
}
}
}
```

If I remove the `policy` `section` no doubt it properly queries the data.

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.