Merge branch 'main' into dev/aaronburtle/tool-registry-hot-reload

Author: aaronburtle

config-generators/cosmosdb_nosql-commands.txt

@@ -4,6 +4,7 @@ update PlanetAlias --config "dab-config.CosmosDb_NoSql.json" --permissions "anon
 update PlanetAlias --config "dab-config.CosmosDb_NoSql.json" --permissions "authenticated:create,read,update,delete"
 update PlanetAlias --config "dab-config.CosmosDb_NoSql.json" --permissions "limited-read-role:read"
 update PlanetAlias --config "dab-config.CosmosDb_NoSql.json" --permissions "item-level-permission-role:read"
+update PlanetAlias --config "dab-config.CosmosDb_NoSql.json" --permissions "claim_policy_tester:read" --policy-database "@item.name eq @claims.userId"
 add Character --config "dab-config.CosmosDb_NoSql.json" --source "graphqldb.planet" --permissions "anonymous:create,read,update,delete" --graphql "Character:Characters"
 update Character --config "dab-config.CosmosDb_NoSql.json" --permissions "item-level-permission-role:read"
 add Star --config "dab-config.CosmosDb_NoSql.json" --source "graphqldb.planet" --permissions "anonymous:create,read,update,delete" --graphql "Star:Stars"

config-generators/dwsql-commands.txt

@@ -101,6 +101,7 @@ update Book --config "dab-config.DwSql.json" --permissions "policy_tester_08:cre
 update Book --config "dab-config.DwSql.json" --permissions "policy_tester_08:update" --fields.include "*" --policy-database "@item.id eq 9"
 update Book --config "dab-config.DwSql.json" --permissions "policy_tester_08:delete" --fields.include "*" --policy-database "@item.id eq 9"
 update Book --config "dab-config.DwSql.json" --permissions "policy_tester_08:read" --fields.include "*"
+update Book --config "dab-config.DwSql.json" --permissions "claim_policy_tester:read" --fields.include "*" --policy-database "@item.title eq @claims.userId"
 update Book --config "dab-config.DwSql.json" --permissions "test_role_with_noread:create,update,delete"
 update Book --config "dab-config.DwSql.json" --permissions "test_role_with_excluded_fields:create,update,delete"
 update Book --config "dab-config.DwSql.json" --permissions "test_role_with_excluded_fields:read" --fields.exclude "publisher_id"

config-generators/mssql-commands.txt

@@ -124,6 +124,7 @@ update Book --config "dab-config.MsSql.json" --permissions "policy_tester_08:cre
 update Book --config "dab-config.MsSql.json" --permissions "policy_tester_08:update" --fields.include "*" --policy-database "@item.id eq 9"
 update Book --config "dab-config.MsSql.json" --permissions "policy_tester_08:delete" --fields.include "*" --policy-database "@item.id eq 9"
 update Book --config "dab-config.MsSql.json" --permissions "policy_tester_08:read" --fields.include "*"
+update Book --config "dab-config.MsSql.json" --permissions "claim_policy_tester:read" --fields.include "*" --policy-database "@item.title eq @claims.userId"
 update Book --config "dab-config.MsSql.json" --permissions "test_role_with_noread:create,update,delete"
 update Book --config "dab-config.MsSql.json" --permissions "test_role_with_excluded_fields:create,update,delete"
 update Book --config "dab-config.MsSql.json" --permissions "test_role_with_excluded_fields:read" --fields.exclude "publisher_id"

config-generators/mysql-commands.txt

@@ -96,6 +96,7 @@ update Book --config "dab-config.MySql.json" --permissions "policy_tester_08:cre
 update Book --config "dab-config.MySql.json" --permissions "policy_tester_08:update" --fields.include "*" --policy-database "@item.id eq 9"
 update Book --config "dab-config.MySql.json" --permissions "policy_tester_08:delete" --fields.include "*" --policy-database "@item.id eq 9"
 update Book --config "dab-config.MySql.json" --permissions "policy_tester_08:read" --fields.include "*"
+update Book --config "dab-config.MySql.json" --permissions "claim_policy_tester:read" --fields.include "*" --policy-database "@item.title eq @claims.userId"
 update Book --config "dab-config.MySql.json" --permissions "test_role_with_noread:create,update,delete"
 update Book --config "dab-config.MySql.json" --permissions "test_role_with_excluded_fields:create,update,delete"
 update Book --config "dab-config.MySql.json" --permissions "test_role_with_excluded_fields:read" --fields.exclude "publisher_id"

config-generators/postgresql-commands.txt

@@ -98,6 +98,7 @@ update Book --config "dab-config.PostgreSql.json" --permissions "policy_tester_0
 update Book --config "dab-config.PostgreSql.json" --permissions "policy_tester_08:update" --fields.include "*" --policy-database "@item.id eq 9"
 update Book --config "dab-config.PostgreSql.json" --permissions "policy_tester_08:delete" --fields.include "*" --policy-database "@item.id eq 9"
 update Book --config "dab-config.PostgreSql.json" --permissions "policy_tester_08:read" --fields.include "*"
+update Book --config "dab-config.PostgreSql.json" --permissions "claim_policy_tester:read" --fields.include "*" --policy-database "@item.title eq @claims.userId"
 update Book --config "dab-config.PostgreSql.json" --permissions "test_role_with_noread:create,update,delete"
 update Book --config "dab-config.PostgreSql.json" --permissions "test_role_with_excluded_fields:create,update,delete"
 update Book --config "dab-config.PostgreSql.json" --permissions "test_role_with_excluded_fields:read" --fields.exclude "publisher_id"
@@ -178,3 +179,4 @@ add dbo_DimAccount --config "dab-config.PostgreSql.json" --source "dimaccount" -
 update dbo_DimAccount --config "dab-config.PostgreSql.json" --map "parentaccountkey:ParentAccountKey,accountkey:AccountKey" 
 update dbo_DimAccount --config "dab-config.PostgreSql.json" --relationship parent_account --target.entity dbo_DimAccount --cardinality one --relationship.fields "parentaccountkey:accountkey"
 update dbo_DimAccount --config "dab-config.PostgreSql.json" --relationship child_accounts --target.entity dbo_DimAccount --cardinality many --relationship.fields "accountkey:parentaccountkey"
+add DateOnlyTable --config "dab-config.PostgreSql.json" --source "date_only_table" --permissions "anonymous:*" --rest true --graphql true --source.key-fields "event_date"

nuget/nuget_mcp/README.md

@@ -0,0 +1,35 @@
+# Data API builder MCP Library
+
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](https://opensource.org/licenses/MIT)
+
+## About
+
+**Microsoft.DataApiBuilder.Mcp** provides Model Context Protocol (MCP) integration for [Data API builder](https://learn.microsoft.com/azure/data-api-builder/) (DAB).
+
+This package is intended for teams that want to host DAB MCP tools in their own .NET applications.
+
+## Key capabilities
+
+- Registers DAB MCP services in dependency injection
+- Maps DAB MCP endpoints for HTTP hosting
+- Uses Data API builder Core capabilities for entity and tool execution
+
+## Installation
+
+```bash
+dotnet add package Microsoft.DataApiBuilder.Mcp
+```
+
+## Usage
+
+This package is designed for ASP.NET Core applications that expose MCP endpoints.
+
+Use it to register DAB MCP services in dependency injection and map DAB MCP endpoints in your app's hosting pipeline.
+
+Current distribution scope is internal Azure Artifacts feeds.
+
+## Resources
+
+- [Official Documentation](https://learn.microsoft.com/azure/data-api-builder/)
+- [GitHub Repository](https://github.com/Azure/data-api-builder)
+- [Samples](https://aka.ms/dab/samples)

scripts/notice-generation.ps1

@@ -9,7 +9,7 @@ param (
 
 # Download and save the ChilliCream License 1.0 from ChilliCream/graphql-platform GitHub repo
 $chiliCreamLicenseSavePath = "$BuildArtifactStagingDir/chillicreamlicense.txt"
-$chiliCreamLicenseMetadataURL = "https://raw.githubusercontent.com/ChilliCream/graphql-platform/main/website/src/basic/licensing/chillicream-license.md"
+$chiliCreamLicenseMetadataURL = "https://raw.githubusercontent.com/ChilliCream/graphql-platform/main/website/content/licensing/chillicream-license.md"
 Invoke-WebRequest $chiliCreamLicenseMetadataURL -UseBasicParsing |
  Select-Object -ExpandProperty Content |
  Out-File $chiliCreamLicenseSavePath

src/Auth/IAuthorizationResolver.cs

@@ -72,16 +72,15 @@ public interface IAuthorizationResolver
     public string GetDBPolicyForRequest(string entityName, string roleName, EntityActionOperation operation);
 
     /// <summary>
-    /// Retrieves the policy of an operation within an entity's role entry
-    /// within the permissions section of the runtime config, and tries to process
-    /// the policy.
+    /// Resolves claim references in a database policy to parameter aliases and
+    /// returns their typed values separately from the policy text.
     /// </summary>
     /// <param name="entityName">Entity from request.</param>
     /// <param name="roleName">Role defined in client role header.</param>
     /// <param name="operation">Operation type: Create, Read, Update, Delete.</param>
     /// <param name="httpContext">Contains token claims of the authenticated user used in policy evaluation.</param>
-    /// <returns>Returns the parsed policy, if successfully processed, or an exception otherwise.</returns>
-    public string ProcessDBPolicy(string entityName, string roleName, EntityActionOperation operation, HttpContext httpContext);
+    /// <returns>The policy text and typed claim values to bind to it.</returns>
+    public ResolvedDatabasePolicy ResolveDBPolicy(string entityName, string roleName, EntityActionOperation operation, HttpContext httpContext);
 
     /// <summary>
     /// Get list of roles defined for entity within runtime configuration.. This is applicable for GraphQL when creating authorization

src/Auth/ResolvedDatabasePolicy.cs

@@ -0,0 +1,46 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+using System.Collections.ObjectModel;
+
+namespace Azure.DataApiBuilder.Auth;
+
+/// <summary>
+/// A database authorization policy whose claim references have been replaced by
+/// OData parameter aliases. Claim values remain separate from the policy text so
+/// they can be injected into the parsed OData AST as typed constants.
+/// </summary>
+public sealed record ResolvedDatabasePolicy
+{
+    /// <summary>
+    /// Policy text containing OData parameter aliases.
+    /// </summary>
+    public string Policy { get; }
+
+    /// <summary>
+    /// Immutable snapshot of typed claim values keyed by parameter alias.
+    /// </summary>
+    public IReadOnlyDictionary<string, object?> ClaimValues { get; }
+
+    /// <summary>
+    /// Represents an operation without a database authorization policy.
+    /// </summary>
+    public static ResolvedDatabasePolicy Empty { get; } = new(
+        string.Empty,
+        new ReadOnlyDictionary<string, object?>(new Dictionary<string, object?>()));
+
+    /// <summary>
+    /// Initializes a resolved database policy and takes an immutable snapshot of its claim values.
+    /// </summary>
+    /// <param name="policy">Policy text containing OData parameter aliases.</param>
+    /// <param name="claimValues">Typed claim values keyed by their parameter alias.</param>
+    public ResolvedDatabasePolicy(string policy, IReadOnlyDictionary<string, object?> claimValues)
+    {
+        ArgumentNullException.ThrowIfNull(policy);
+        ArgumentNullException.ThrowIfNull(claimValues);
+
+        Policy = policy;
+        ClaimValues = new ReadOnlyDictionary<string, object?>(
+            new Dictionary<string, object?>(claimValues, StringComparer.Ordinal));
+    }
+}

src/Azure.DataApiBuilder.Mcp/Azure.DataApiBuilder.Mcp.csproj

@@ -4,10 +4,29 @@
     <TargetFramework>net10.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
+    <PackageOutputPath>./nupkg</PackageOutputPath>
+    <PackageId>Microsoft.DataApiBuilder.Mcp</PackageId>
+    <Title>Microsoft.DataApiBuilder.Mcp</Title>
+    <Authors>Microsoft</Authors>
+    <Copyright>© Microsoft Corporation. All rights reserved.</Copyright>
+    <PackageLicenseFile>LICENSE.txt</PackageLicenseFile>
+    <RepositoryType>git</RepositoryType>
+    <PackageProjectUrl>https://go.microsoft.com/fwlink/?linkid=2224253</PackageProjectUrl>
+    <PackageTags>microsoft mcp model-context-protocol dab dataApiBuilder azure sql graphql rest sdk internal</PackageTags>
+    <AssemblyName>Microsoft.DataApiBuilder.Mcp</AssemblyName>
+    <Description>MCP integration library for Data API builder with services and endpoint mapping for exposing DAB tools through Model Context Protocol.</Description>
+    <PackageIcon>nuget_icon.png</PackageIcon>
+    <PackageReadmeFile>README.md</PackageReadmeFile>
+    <EmbedUntrackedSources>true</EmbedUntrackedSources>
+    <PublishRepositoryUrl>true</PublishRepositoryUrl>
     <!-- Suppress transitive dependency version mismatch warnings from MCP SDK -->
     <NoWarn>$(NoWarn);NU1603</NoWarn>
   </PropertyGroup>
 
+  <PropertyGroup Condition="'$(TF_BUILD)' == 'true'">
+    <ContinuousIntegrationBuild>true</ContinuousIntegrationBuild>
+  </PropertyGroup>
+
   <ItemGroup>
     <InternalsVisibleTo Include="Azure.DataApiBuilder.Service.Tests" />
   </ItemGroup>
@@ -21,6 +40,13 @@
     <ProjectReference Include="..\Core\Azure.DataApiBuilder.Core.csproj" />
   </ItemGroup>
 
+  <ItemGroup>
+    <None Include="..\..\nuget\nuget_mcp\README.md" Pack="true" PackagePath="\" />
+    <None Include="..\..\nuget\nuget_icon.png" Pack="true" PackagePath="\" />
+    <None Include="..\..\LICENSE.txt" Pack="true" PackagePath="\" />
+    <None Include="..\..\nuget_mcp\NOTICE.txt" Pack="true" PackagePath="\" Condition="Exists('..\..\nuget_mcp\NOTICE.txt')" />
+  </ItemGroup>
+
   <ItemGroup>
     <Folder Include="CustomTools\" />
   </ItemGroup>