No server-side connector to Fabric data sources

Problem statement

A Rayfin app has a managed backend, but that backend is only reachable for the app's own entities. Business data living in a Fabric Warehouse, SQL database, or Lakehouse can only be reached from the browser, which restricts every app to whatever the Fabric API for GraphQL exposes. See Why GraphQL is the only write path for the full reasoning.

Evidence. iCollect calls the GraphQL endpoint directly from the SPA with the user's delegated token, in src/services/fabricGraphql.ts. Everything the GraphQL layer cannot do, the app cannot do: no transactions, no server-enforced uniqueness, no set-based updates, no Lakehouse writes, and no access to tables the GraphQL item has not been configured to expose.

Impact. Rayfin markets itself as the way to build data apps on Fabric, but the data those apps most want to write is only reachable through a surface Rayfin does not own or wrap. Each app re-implements token acquisition, schema introspection, and query construction against that surface. iCollect has roughly 600 lines doing exactly this.

Proposed solution

A first-class Fabric data source binding, declared alongside the existing entity definitions, that runs in the app backend and connects over TDS using the signed-in user's identity through on-behalf-of flow. That single change would remove the browser's protocol limitation, restore transactions and server-enforced constraints, and let Rayfin present one data API for both app-owned and Fabric-owned data.

A smaller intermediate step: ship a supported client for the Fabric API for GraphQL, with introspection, typed queries, and mutation building, so every app stops writing its own.

Alternatives considered

No response

Additional context

No response

Start by reviewing iCollect’s src/services/fabricGraphql.ts and the linked “Why GraphQL is the only write path” rationale. The issue presents two possible directions—a Fabric TDS binding using on-behalf-of flow or a supported GraphQL client—so first establish which scope the project wants. Done requires an agreed implementation path and acceptance criteria; no Rayfin files or tests are named.