Data API custom roles not honored
- Dominant language
- No language data
- Stars
- 346
- Forks
- 67
- PR merge metrics
- No merged PRs in 30d
Description
**Describe the bug**
When using the Data API and custom authentication roles with Entra (AAD), the roles are not allowed, resulting in 403.
**To Reproduce**
1. Enable Data API in application, connect up to database.
2. Have a custom role of `admin` setup and in `userRoles`
3. Have an entity defined as:
```json
"MyTable": {
"source": "dbo.MyTable",
"permissions": [
{
"actions": ["read"],
"role": "authenticated"
},
{
"actions": ["create", "read", "update", "delete"],
"role": "admin"
}
],
```
4. Try and call the update API REST endpoint, which results in 403.
**Expected behavior**
Having the `admin` role in roles should allow this operation.
When updating the `role` back to `authenticated`, it allows the update operation.
**Additional context**
Not sure if this is a bug, but recently the custom authentication stopped putting roles in the `userRoles` section of the .auth/me, but now in a `roles` claim, which may be the issue.
Why did this change?
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.