Fix context sql #2344

M4Al · 2024-08-20T20:43:28Z

Why make this change?

Fixes [Bug]: MSSQL (and related) - EXEC sp_set_session_context is executed with @read_only = 1 #2341 (partly)
- do not set the session context in SQL server with read_only = 1 as this prevents us from doing a second request on the same connection
- keep a copy of the original 'roles' from the JWT token so we can use it on the SQL Filter Predicate to accurately implement row level security

What is this change?

The changes itself are quite simple and should break nothing, see the diff :-)

How was this tested?

I have not created/adapted any tests yet. Just looking for comments before I go there.

Sample Request(s)

Sample of a JWT token (only the relevant part)

{
  "aud": "api://ddcf6b31-5d01-407d-97cf-8efefc455d32",
  "iss": "https://sts.windows.net/9215c785-95c3-49b0-bdba-2062df5aedb5/",
  "roles": [
    "user",
    "Allow_Customer_OPS025235",
    "Allow_Customer_OPS004095"
  ],
  "ver": "1.0"
}

X-MS-API-ROLE: user

before my change the extra 'roles' that do not match the X-MS-API-ROLE header would never reach the database context.
With my change you can do things like this in SQL Predicates to filter out only subsets of the data:

CREATE FUNCTION dbo.ops_fact_order_Predicate(@CustomerNo varchar(max))
RETURNS TABLE
WITH SCHEMABINDING
AS RETURN SELECT 1 AS fn_securitypredicate_result
WHERE @CustomerNo in (
		select trim(replace(replace(replace([value], '"', ''), ']', ''), 'Allow_Customer_', '')) 
		from STRING_SPLIT ( 
			CAST(SESSION_CONTEXT(N'original_roles') as varchar(max)) 
			, ',' 
			, 0) 
			where trim(replace(replace([value], '"', ''), ']', '')) like 'Allow_Customer%'
		)

CREATE SECURITY POLICY dbo.ops_fact_order_Policy
ADD FILTER PREDICATE dbo.ops_fact_order_Predicate(CustomerNo)
ON [gold_ops].[ops_fact_order];

Added a new constant `ORIGINAL_ROLE_CLAIM_TYPE` in `AuthenticationOptions.cs` to store the original roles claim type. Modified `AuthorizationResolver` to preserve the original 'roles' claim by adding it to the `resolvedClaims` dictionary under the new key. Changed `MsSqlQueryExecutor` to set session context parameters with `@read_only = 0` to allow modifications.

This reverts commit 08f741c.

…ilder into fix_context_sql

src/Core/Resolvers/MsSqlQueryExecutor.cs

Aniruddh25 · 2024-08-30T00:30:46Z

src/Core/Resolvers/MsSqlQueryExecutor.cs

                // Append statement to set read only param value - can be set only once for a connection.
-                string statementToSetReadOnlyParam = "EXEC sp_set_session_context " + $"'{claimType}', " + paramName + ", @read_only = 1;";
+                string statementToSetReadOnlyParam = "EXEC sp_set_session_context " + $"'{claimType}', " + paramName + ", @read_only = 0;";


curious, did you experience - your mutation operations being blocked because of this setting?

Yes, the SQL Endpoint did reject the second query as described in #2341

Aniruddh25

Thanks for this smart change to provide the original roles for additional filtering. Left a few nit comments and some questions, looks good to merge otherwise!

Aniruddh25 · 2024-08-30T00:32:14Z

/azp run

remove trailing space Co-authored-by: Aniruddh Munde <[email protected]>

…ilder into fix_context_sql

Updated the constant `FIRST_URL` in `RequestParser.cs` within the `Azure.DataApiBuilder.Core.Parsers` namespace to use the value `"$top"` instead of `"$first"`. This change aligns with naming conventions or standards used elsewhere in the codebase or API, ensuring consistency and improving clarity for developers.

Aniruddh25 · 2024-09-06T00:00:21Z

src/Core/Parsers/RequestParser.cs

@@ -30,7 +30,7 @@ public class RequestParser
        /// <summary>
        /// Prefix used for specifying limit in the query string of the URL.
        /// </summary>
-        public const string FIRST_URL = "$first";
+        public const string FIRST_URL = "$top";


We will provide a synonym $top soon. Lets not make this change in this PR. Thank you for your patience.

Related #2474

Aniruddh25

The original PR contained fewer changes, please restrict the changes to the purpose of the PR and lets not add additional changes in the same PR. Waiting for removing the unnecessary changes

Aniruddh25 · 2024-09-06T00:01:18Z

src/Core/Resolvers/SqlResponseHelpers.cs

@@ -51,6 +51,13 @@ public static OkObjectResult FormatFindResult(
                                                  ? DetermineExtraFieldsInResponse(findOperationResponse, context.FieldsToBeReturned)
                                                  : DetermineExtraFieldsInResponse(findOperationResponse.EnumerateArray().First(), context.FieldsToBeReturned);

+            //Remove RecordCOunt from extraFieldsInResponse if present
+            /*


If this code is not used, please remove it out completely.

Aniruddh25 · 2024-09-06T00:02:03Z

src/Directory.Packages.props

@@ -20,7 +20,7 @@
    <PackageVersion Include="Microsoft.AspNetCore.Http" Version="2.2.2" />
    <PackageVersion Include="Microsoft.Azure.Cosmos" Version="3.38.1" />
    <!--When updating Microsoft.Data.SqlClient, update license URL in scripts/notice-generation.ps1-->
-    <PackageVersion Include="Microsoft.Data.SqlClient" Version="5.2.0" />
+    <PackageVersion Include="Microsoft.Data.SqlClient" Version="5.1.4" />


Please retain the updated 5.2.0 version

Aniruddh25 · 2024-09-09T19:17:53Z

Dockerfile

@@ -1,13 +1,13 @@
 # Version values referenced from https://hub.docker.com/_/microsoft-dotnet-aspnet

-FROM mcr.microsoft.com/dotnet/sdk:6.0-cbl-mariner2.0. AS build
+FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build


we will soon update this to 8.0. Please refrain from doing so right now.

abhishekkumams · 2024-12-03T05:24:11Z

@M4Al , let us know if you would be able to address the comments...

Mu4all and others added 5 commits August 16, 2024 11:41

pp

08f741c

Merge branch 'main' into fix_context_sql

2ed72b4

Revert "pp"

132a46e

This reverts commit 08f741c.

Merge branch 'fix_context_sql' of https://github.com/M4Al/data-api-bu…

b0bc518

…ilder into fix_context_sql

M4Al requested review from Aniruddh25, seantleonard, aaronburtle, abhishekkumams, RubenCerna2079, ravishetye, rohkhann, neeraj-sharma2592 and sourabh1007 as code owners August 20, 2024 20:43

Adjust the relevant tests

19e9dbc

Aniruddh25 reviewed Aug 30, 2024

View reviewed changes

src/Core/Resolvers/MsSqlQueryExecutor.cs Outdated Show resolved Hide resolved

Aniruddh25 reviewed Aug 30, 2024

View reviewed changes

Aniruddh25 approved these changes Aug 30, 2024

View reviewed changes

M4Al and others added 6 commits August 30, 2024 09:50

Update src/Core/Resolvers/MsSqlQueryExecutor.cs

d10be7a

remove trailing space Co-authored-by: Aniruddh Munde <[email protected]>

Add recordcount

4c5a5b8

Merge branch 'fix_context_sql' of https://github.com/M4Al/data-api-bu…

20f4b6b

…ilder into fix_context_sql

Update dockerfile to .net8

b560b20

Downgrade SqlClient

3567785

Aniruddh25 reviewed Sep 6, 2024

View reviewed changes

Aniruddh25 requested changes Sep 6, 2024

View reviewed changes

Aniruddh25 reviewed Sep 9, 2024

View reviewed changes

JerryNixon mentioned this pull request Nov 25, 2024

[Enhancement]: Provide $top as a synonym for $first in REST #2474

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix context sql #2344

Fix context sql #2344

M4Al commented Aug 20, 2024

Aniruddh25 Aug 30, 2024

M4Al Aug 30, 2024

Aniruddh25 left a comment

Aniruddh25 commented Aug 30, 2024

Aniruddh25 Sep 6, 2024

JerryNixon Nov 25, 2024

Aniruddh25 left a comment

Aniruddh25 Sep 6, 2024

Aniruddh25 Sep 6, 2024

Aniruddh25 Sep 9, 2024

abhishekkumams commented Dec 3, 2024

Fix context sql #2344

Are you sure you want to change the base?

Fix context sql #2344

Conversation

M4Al commented Aug 20, 2024

Why make this change?

What is this change?

How was this tested?

Sample Request(s)

Aniruddh25 Aug 30, 2024

Choose a reason for hiding this comment

M4Al Aug 30, 2024

Choose a reason for hiding this comment

Aniruddh25 left a comment

Choose a reason for hiding this comment

Aniruddh25 commented Aug 30, 2024

Aniruddh25 Sep 6, 2024

Choose a reason for hiding this comment

JerryNixon Nov 25, 2024

Choose a reason for hiding this comment

Aniruddh25 left a comment

Choose a reason for hiding this comment

Aniruddh25 Sep 6, 2024

Choose a reason for hiding this comment

Aniruddh25 Sep 6, 2024

Choose a reason for hiding this comment

Aniruddh25 Sep 9, 2024

Choose a reason for hiding this comment

abhishekkumams commented Dec 3, 2024