Cosmos DB: Adds Item Level Auth support using DB Policy

config-generators/cosmosdb_nosql-commands.txt

@@ -1,33 +1,48 @@
 init --config "dab-config.CosmosDb_NoSql.json" --database-type "cosmosdb_nosql" --connection-string "AccountEndpoint=https://localhost:8081/;AccountKey=C2y6yDjf5/R+ob0N8A7Cgv30VRDJIWEHLM+4QDU5DE2nQ9nDuVTqobD4b8mGGyPMbIZnqyMsEcaGQy67XIw/Jw==" --cosmosdb_nosql-database "graphqldb" --cosmosdb_nosql-container "planet" --graphql-schema "schema.gql" --host-mode Development --cors-origin "http://localhost:5000"
-add Planet --config "dab-config.CosmosDb_NoSql.json" --source "graphqldb.planet" --permissions "anonymous:create,read,update,delete" --graphql "Planet:Planets"
-update Planet --config "dab-config.CosmosDb_NoSql.json" --permissions "anonymous:read" --fields.include "*"
-update Planet --config "dab-config.CosmosDb_NoSql.json" --permissions "authenticated:create,read,update,delete"
-update Planet --config "dab-config.CosmosDb_NoSql.json" --permissions "limited-read-role:read"
+add PlanetAlias --config "dab-config.CosmosDb_NoSql.json" --source "graphqldb.planet" --permissions "anonymous:create,read,update,delete" --graphql "Planet:Planets"
+update PlanetAlias --config "dab-config.CosmosDb_NoSql.json" --permissions "anonymous:read" --fields.include "*"
+update PlanetAlias --config "dab-config.CosmosDb_NoSql.json" --permissions "authenticated:create,read,update,delete"
+update PlanetAlias --config "dab-config.CosmosDb_NoSql.json" --permissions "limited-read-role:read"
+update PlanetAlias --config "dab-config.CosmosDb_NoSql.json" --permissions "item-level-permission-role:read"
 add Character --config "dab-config.CosmosDb_NoSql.json" --source "graphqldb.planet" --permissions "anonymous:create,read,update,delete" --graphql "Character:Characters"
-add StarAlias --config "dab-config.CosmosDb_NoSql.json" --source "graphqldb.planet" --permissions "anonymous:create,read,update,delete" --graphql "Star:Stars"
-update StarAlias --config "dab-config.CosmosDb_NoSql.json" --source "graphqldb.planet" --permissions "authenticated:create,read,update,delete"
-add TagAlias --config "dab-config.CosmosDb_NoSql.json" --source "graphqldb.planet" --permissions "anonymous:create,read,update,delete" --graphql "Tag:Tags"
+update Character --config "dab-config.CosmosDb_NoSql.json" --permissions "item-level-permission-role:read"
+add Star --config "dab-config.CosmosDb_NoSql.json" --source "graphqldb.planet" --permissions "anonymous:create,read,update,delete" --graphql "Star:Stars"
+update Star --config "dab-config.CosmosDb_NoSql.json" --source "graphqldb.planet" --permissions "authenticated:create,read,update,delete"
+add Tag --config "dab-config.CosmosDb_NoSql.json" --source "graphqldb.planet" --permissions "anonymous:create,read,update,delete" --graphql "Tag:Tags"
 add Moon --config "dab-config.CosmosDb_NoSql.json" --source "graphqldb.planet" --permissions "anonymous:create,read,update,delete" --graphql true
 update Moon --config "dab-config.CosmosDb_NoSql.json" --source "graphqldb.planet" --permissions "authenticated:create,read,update,delete"
 add Earth --config "dab-config.CosmosDb_NoSql.json" --source "graphqldb.planet" --permissions "field-mutation-with-read-permission:read" --graphql "Earth:Earths"
-update Earth --config "dab-config.CosmosDb_NoSql.json" --permissions "field-mutation-with-read-permission:create" --fields.include "id" --fields.exclude "name"
-update Earth --config "dab-config.CosmosDb_NoSql.json" --permissions "field-mutation-with-read-permission:delete" --fields.include "id,type" --fields.exclude "name"
-update Earth --config "dab-config.CosmosDb_NoSql.json" --permissions "field-mutation-with-read-permission:update" --fields.include "id,type" --fields.exclude "name"
+update Earth --config "dab-config.CosmosDb_NoSql.json" --permissions "anonymous:create,update,delete"
+update Earth --config "dab-config.CosmosDb_NoSql.json" --permissions "anonymous:read" --fields.include "*" --fields.exclude "*"
 update Earth --config "dab-config.CosmosDb_NoSql.json" --permissions "authenticated:create,read,update,delete"
 update Earth --config "dab-config.CosmosDb_NoSql.json" --permissions "limited-read-role:read" --fields.include "id,type" --fields.exclude "name"
-update Earth --config "dab-config.CosmosDb_NoSql.json" --permissions "wildcard-exclude-fields-role:create" --fields.exclude "*"
-update Earth --config "dab-config.CosmosDb_NoSql.json" --permissions "wildcard-exclude-fields-role:update" --fields.exclude "*"
-update Earth --config "dab-config.CosmosDb_NoSql.json" --permissions "wildcard-exclude-fields-role:delete" --fields.exclude "*"
-update Earth --config "dab-config.CosmosDb_NoSql.json" --permissions "wildcard-exclude-fields-role:read" --fields.exclude "*"
-update Earth --config "dab-config.CosmosDb_NoSql.json" --permissions "only-create-role:create"
-update Earth --config "dab-config.CosmosDb_NoSql.json" --permissions "only-update-role:update"
-update Earth --config "dab-config.CosmosDb_NoSql.json" --permissions "only-delete-role:delete"
+update Earth --config "dab-config.CosmosDb_NoSql.json" --permissions "item-level-permission-role:read"  --policy-database "@item.type eq 'earth0'"
 add Sun --config "dab-config.CosmosDb_NoSql.json" --source "graphqldb.planet" --permissions "anonymous:create,update,delete" --graphql true
 update Sun --config "dab-config.CosmosDb_NoSql.json" --permissions "anonymous:read" --fields.include "*" --fields.exclude "name"
 add AdditionalAttribute --config "dab-config.CosmosDb_NoSql.json" --source "graphqldb.planet" --permissions "anonymous:*" --graphql "AdditionalAttribute:AdditionalAttributes"
+update AdditionalAttribute --config "dab-config.CosmosDb_NoSql.json" --permissions "item-level-permission-role:read"  --policy-database "@item.name eq 'volcano0'"
 add MoonAdditionalAttribute --config "dab-config.CosmosDb_NoSql.json" --source "graphqldb.planet" --permissions "anonymous:*" --graphql "MoonAdditionalAttribute:MoonAdditionalAttributes"
-add MoreAttrAlias --config "dab-config.CosmosDb_NoSql.json" --source "graphqldb.planet" --permissions "anonymous:delete" --graphql "MoreAttribute:MoreAttributes"
-update MoreAttrAlias --config "dab-config.CosmosDb_NoSql.json" --permissions "anonymous:create" --fields.include "id" --fields.exclude "name"
-update MoreAttrAlias --config "dab-config.CosmosDb_NoSql.json" --permissions "anonymous:read" --fields.include "id" --fields.exclude "name"
-update MoreAttrAlias --config "dab-config.CosmosDb_NoSql.json" --permissions "anonymous:update" --fields.exclude "*"
-update MoreAttrAlias --config "dab-config.CosmosDb_NoSql.json" --permissions "authenticated:create,read,update,delete"
+update MoonAdditionalAttribute --config "dab-config.CosmosDb_NoSql.json" --permissions "item-level-permission-role:read"  --policy-database "@item.name eq 'moonattr0'"
+add MoreAttribute --config "dab-config.CosmosDb_NoSql.json" --source "graphqldb.planet" --permissions "anonymous:delete" --graphql "MoreAttribute:MoreAttributes"
+update MoreAttribute --config "dab-config.CosmosDb_NoSql.json" --permissions "anonymous:create" --fields.include "id" --fields.exclude "name"
+update MoreAttribute --config "dab-config.CosmosDb_NoSql.json" --permissions "anonymous:read" --fields.include "id" --fields.exclude "name"
+update MoreAttribute --config "dab-config.CosmosDb_NoSql.json" --permissions "anonymous:update" --fields.exclude "*"
+update MoreAttribute --config "dab-config.CosmosDb_NoSql.json" --permissions "authenticated:create,read,update,delete"
+add PlanetAgain --config "dab-config.CosmosDb_NoSql.json" --source "graphqldb.newcontainer" --permissions "field-mutation-with-read-permission:read" --graphql "PlanetAgain:PlanetAgains"
+update PlanetAgain --config "dab-config.CosmosDb_NoSql.json" --permissions "field-mutation-with-read-permission:create" --fields.include "id" --fields.exclude "name"
+update PlanetAgain --config "dab-config.CosmosDb_NoSql.json" --permissions "field-mutation-with-read-permission:delete" --fields.include "id,type" --fields.exclude "name"
+update PlanetAgain --config "dab-config.CosmosDb_NoSql.json" --permissions "field-mutation-with-read-permission:update" --fields.include "id,type" --fields.exclude "name"
+update PlanetAgain --config "dab-config.CosmosDb_NoSql.json" --permissions "authenticated:create,read,update,delete"
+update PlanetAgain --config "dab-config.CosmosDb_NoSql.json" --permissions "limited-read-role:read" --fields.include "id,type" --fields.exclude "name"
+update PlanetAgain --config "dab-config.CosmosDb_NoSql.json" --permissions "wildcard-exclude-fields-role:create" --fields.exclude "*"
+update PlanetAgain --config "dab-config.CosmosDb_NoSql.json" --permissions "wildcard-exclude-fields-role:update" --fields.exclude "*"
+update PlanetAgain --config "dab-config.CosmosDb_NoSql.json" --permissions "wildcard-exclude-fields-role:delete" --fields.exclude "*"
+update PlanetAgain --config "dab-config.CosmosDb_NoSql.json" --permissions "wildcard-exclude-fields-role:read" --fields.exclude "*"
+update PlanetAgain --config "dab-config.CosmosDb_NoSql.json" --permissions "only-create-role:create"
+update PlanetAgain --config "dab-config.CosmosDb_NoSql.json" --permissions "only-update-role:update"
+update PlanetAgain --config "dab-config.CosmosDb_NoSql.json" --permissions "only-delete-role:delete"
+add InvalidAuthModel --config "dab-config.CosmosDb_NoSql.json" --source "graphqldb.invalidAuthModelContainer" --permissions "anonymous:delete" --graphql "InvalidAuthModel:InvalidAuthModels"
+update InvalidAuthModel --config "dab-config.CosmosDb_NoSql.json" --permissions "anonymous:create" --fields.include "id" --fields.exclude "name"
+update InvalidAuthModel --config "dab-config.CosmosDb_NoSql.json" --permissions "anonymous:read" --fields.include "id" --fields.exclude "name"
+update InvalidAuthModel --config "dab-config.CosmosDb_NoSql.json" --permissions "anonymous:update" --fields.exclude "*"
+update InvalidAuthModel --config "dab-config.CosmosDb_NoSql.json" --permissions "authenticated:create,read,update,delete"

src/Config/ObjectModel/EntityDbPolicyCosmosModel.cs

@@ -0,0 +1,53 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+namespace Azure.DataApiBuilder.Config.ObjectModel
+{
+    /// <summary>
+    /// It contains Entity information along with Pre-Generated JOIN statements for all the entities using configured DB policy.
+    /// So that, it can be used for generating CosmosDB SQL queries.
+    /// </summary>
+    public record EntityDbPolicyCosmosModel
+    {
+        /// <summary>
+        /// Path to the given entity with "." delimiter, it will be used as prefix while generating conditions for CosmosDB SQL queries.
+        /// e.g. c.stars, c.earth.type
+        /// </summary>
+        public string Path { get; }
+
+        /// <summary>
+        /// Column name representation of the entity
+        /// </summary>
+        public string? ColumnName { get; }
+
+        /// <summary>
+        /// If entity is of array type then we would have a generated alias of the entity
+        /// e.g table0, table1 etc
+        /// </summary>
+        public string? Alias { get; }
+
+        /// <summary>
+        /// Entity Name
+        /// </summary>
+        public string? EntityName { get; }
+
+        /// <summary>
+        /// Pre-generated (If define DB policies are available and entity type is array) JOIN statement for the entity
+        /// </summary>
+        public string? JoinStatement { get; set; }
+
+        public EntityDbPolicyCosmosModel(string Path, string? EntityName, string? ColumnName = null, string? Alias = null)
+        {
+            this.Path = Path;
+            this.ColumnName = ColumnName;
+            this.Alias = Alias;
+            this.EntityName = EntityName;
+
+            // Generate JOIN statement only when Alias is there
+            if (!string.IsNullOrEmpty(Alias))
+            {
+                this.JoinStatement = $" {Alias} IN {Path}.{ColumnName}";
+            }
+        }
+    }
+}

src/Core/Models/GraphQLFilterParsers.cs

@@ -16,7 +16,6 @@
 using HotChocolate.Resolvers;
 using Microsoft.AspNetCore.Http;
 using static Azure.DataApiBuilder.Core.Authorization.AuthorizationResolver;
-using static Azure.DataApiBuilder.Core.Resolvers.CosmosQueryStructure;
 
 namespace Azure.DataApiBuilder.Core.Models;
 
@@ -272,20 +271,22 @@ public Predicate Parse(
     }
 
     /// <summary>
-    /// For CosmosDB, a nested filter represents a join between
-    /// the parent entity being filtered and the related entity representing the
-    /// non-scalar filter input. This function:
-    /// 1. Recursively parses any more(possibly nested) filters.
-    /// 2. Adds join predicates between the related entities.
-    /// 3. Adds the subquery to the existing list of predicates.
+    /// For CosmosDB, a nested filter represents an EXISTS clause with a subquery.
+    /// This function:
+    /// 1. Defines the Exists Query structure
+    /// 2. Recursively parses any more(possibly nested) filters on the Exists sub query.
+    /// 3. Adds join predicates between the related entities to the Exists sub query.
+    /// 4. Adds the Exists subquery to the existing list of predicates.
     /// </summary>
     /// <param name="ctx">The middleware context.</param>
     /// <param name="filterField">The nested filter field.</param>
     /// <param name="subfields">The subfields of the nested filter.</param>
     /// <param name="columnName">Current Column Name</param>
     /// <param name="entityType">Current Entity Type</param>
     /// <param name="predicates">The predicates parsed so far.</param>
-    /// <param name="queryStructure">The query structure of the entity being filtered.</param>
+    /// <param name="queryStructure">The query structure of the entity being filtered, it would be modified to contain EXIST predicates</param>
+    /// <param name="metadataProvider"> Cosmos Metadata Provider, to get metadata information for a given entity </param>
+    /// <exception cref="DataApiBuilderException">
     private void HandleNestedFilterForCosmos(
         IMiddlewareContext ctx,
         IInputField filterField,
@@ -296,28 +297,9 @@ private void HandleNestedFilterForCosmos(
         CosmosQueryStructure queryStructure,
         ISqlMetadataProvider metadataProvider)
     {
-        string entityName = metadataProvider.GetEntityName(entityType);
-
-        HashSet<CosmosJoinStructure>? jstruct = queryStructure.Joins?.ToHashSet();
-
-        string? tableAlias = null;
-        foreach (CosmosJoinStructure join in jstruct ?? new HashSet<CosmosJoinStructure>())
-        {
-            if (join.DbObject.Name == columnName)
-            {
-                tableAlias = join.TableAlias;
-                break;
-            }
-        }
-
-        if (string.IsNullOrEmpty(tableAlias))
-        {
-            tableAlias = $"table{_tableCounter?.Next()}";
-        }
-
         // Validate that the field referenced in the nested input filter can be accessed.
         bool entityAccessPermitted = queryStructure.AuthorizationResolver.AreRoleAndOperationDefinedForEntity(
-            entityIdentifier: entityName,
+            entityIdentifier: entityType,
             roleName: GetHttpContextFromMiddlewareContext(ctx).Request.Headers[CLIENT_ROLE_HEADER],
             operation: EntityActionOperation.Read);
 
@@ -329,43 +311,39 @@ private void HandleNestedFilterForCosmos(
                 subStatusCode: DataApiBuilderException.SubStatusCodes.AuthorizationCheckFailed);
         }
 
-        IDictionary<string, object?> subParameters = new Dictionary<string, object?>();
-        CosmosQueryStructure comosQueryStructure =
-            new(
-                context: ctx,
-                parameters: subParameters,
-                metadataProvider: metadataProvider,
-                authorizationResolver: queryStructure.AuthorizationResolver,
-                gQLFilterParser: this,
-                counter: queryStructure.Counter);
-
-        comosQueryStructure.DatabaseObject.SchemaName = queryStructure.SourceAlias;
-        comosQueryStructure.DatabaseObject.Name = tableAlias;
-        comosQueryStructure.SourceAlias = tableAlias;
-        comosQueryStructure.EntityName = entityName;
-
-        PredicateOperand joinpredicate = new(
-            Parse(
-                ctx: ctx,
-                filterArgumentSchema: filterField,
-                fields: subfields,
-                queryStructure: comosQueryStructure));
-        predicates.Push(joinpredicate);
-
-        queryStructure.Joins ??= new Stack<CosmosJoinStructure>();
-        if (comosQueryStructure.Joins is not null and { Count: > 0 })
-        {
-            queryStructure.Joins = comosQueryStructure.Joins;
-        }
+        List<Predicate> predicatesForExistsQuery = new();
+        CosmosExistsQueryStructure existsQuery = new(
+            ctx,
+            new Dictionary<string, object?>(),
+            metadataProvider,
+            queryStructure.AuthorizationResolver,
+            this,
+            queryStructure.Counter,
+            predicatesForExistsQuery);
 
-        queryStructure
-            .Joins
-            .Push(new CosmosJoinStructure(
-                        DbObject: new DatabaseTable(schemaName: queryStructure.SourceAlias, tableName: columnName),
-                        TableAlias: tableAlias));
+        existsQuery.DatabaseObject.SchemaName = $"{queryStructure.SourceAlias}.{columnName}";
+        existsQuery.DatabaseObject.Name = existsQuery.SourceAlias;
+        existsQuery.EntityName = metadataProvider.GetEntityName(entityType);
+
+        // Recursively parse and obtain the predicates for the Exists clause subquery
+        Predicate existsQueryFilterPredicate = Parse(ctx,
+                filterField,
+                subfields,
+                existsQuery);
+
+        predicatesForExistsQuery.Push(existsQueryFilterPredicate);
+
+        // The right operand is the SqlExistsQueryStructure.
+        PredicateOperand right = new(existsQuery);
+
+        // Create a new unary Exists Predicate
+        Predicate existsPredicate = new(left: null, PredicateOperation.EXISTS, right);
+
+        // Add it to the rest of the existing predicates.
+        predicates.Push(new PredicateOperand(existsPredicate));
 
         // Add all parameters from the exists subquery to the main queryStructure.
-        foreach ((string key, DbConnectionParam value) in comosQueryStructure.Parameters)
+        foreach ((string key, DbConnectionParam value) in existsQuery.Parameters)
         {
             queryStructure.Parameters.Add(key, value);
         }
@@ -541,7 +519,7 @@ private Predicate ParseAndOr(
         BaseQueryStructure baseQuery,
         PredicateOperation op)
     {
-        if (fields.Count == 0 && (baseQuery is CosmosQueryStructure cosmosQueryStructure && cosmosQueryStructure.Joins?.Count == 0))
+        if (fields.Count == 0)
         {
             return Predicate.MakeFalsePredicate();
         }