-
Notifications
You must be signed in to change notification settings - Fork 279
Cosmos DB: Adds Item Level Auth support using DB Policy #2106
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
b1ca432
to
08b02a5
Compare
/azp run |
a8eb931
to
4cdd2e5
Compare
/azp run |
Azure Pipelines successfully started running 2 pipeline(s). |
/azp run |
Azure Pipelines successfully started running 2 pipeline(s). |
/azp run |
Azure Pipelines successfully started running 2 pipeline(s). |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Still reviewing (need another day Redmond time) but some questions that have come up so far.
/azp run |
Azure Pipelines successfully started running 2 pipeline(s). |
/azp run |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
Synced up with @sajeetharan, It is not a breaking change and it is already documented that, container level entity should be model. |
/azp run |
/azp run |
1 similar comment
/azp run |
/azp run |
Why make this change?
We need to support Item Level DB policies for cosmosdb.
How is it different from Relational DB?
In case of Relational Database like SQL, each entity indicates a separate table which can be queried independently.
But in comosdb, there is nothing like table, Here we have a container which contains data in JSON format consists of entities defined in the configuration file.
What is this change?
Context: We always run a GraphQL query against a container. Hence, we have information about container and we run only those filters which are defined in the GraphQL filter.
Item level policy should always applied (no matter if entity is a part of query or not)
e.g
Schema: We have a container (
Planet
) with 2 other sub entitiesCharacter
,Star
DB Config: In DB config, DB Policy is defined for
star
GraphQL Query: Query an entity for which policy is not defined
Generated CosmosDB Query: It should fire a query with conditions from policies along with JOIN if entity is of array type.
Code Design:
Defining Container
[Breaking Change: Need Documentation Update]_ Since, CosmosDB natively supports one entity per container, hence@model
will indicate container level entity and other entities should be defined astype
only.Process Configuration During Load
(src/Core/Services/MetadataProviders/CosmosSqlMetadataProvider.cs)
data-api-builder/src/Core/Services/MetadataProviders/CosmosSqlMetadataProvider.cs
Line 94 in 8b07ad7
data-api-builder/src/Core/Services/MetadataProviders/CosmosSqlMetadataProvider.cs
Line 101 in 8b07ad7
a) If given entity is on Array format, creating alias for the same.
data-api-builder/src/Core/Services/MetadataProviders/CosmosSqlMetadataProvider.cs
Line 177 in 8b07ad7
b) Generate JOIN statement
data-api-builder/src/Core/Services/MetadataProviders/CosmosSqlMetadataProvider.cs
Line 196 in 8b07ad7
Generate and Append conditions during query.
@claim
also).data-api-builder/src/Core/Resolvers/AuthorizationPolicyHelpers.cs
Line 85 in 8b07ad7
data-api-builder/src/Core/Resolvers/AuthorizationPolicyHelpers.cs
Line 113 in 8b07ad7
Other Changes:
data-api-builder/src/Core/Models/GraphQLFilterParsers.cs
Line 272 in 8b07ad7
@model
for all the entities(src/Service.Tests/CosmosTests/MutationTests.cs and other test files)
Clean up
Removed all the JOIN related changes
How was this tested?