Merge branch 'main' into copilot/fix-autoentities-in-child-configs

Author: RubenCerna2079

src/Azure.DataApiBuilder.Mcp/Core/DynamicCustomTool.cs

@@ -361,6 +361,7 @@ private JsonElement BuildInputSchema()
             }
 
             Dictionary<string, object> properties = new();
+            List<string> requiredParameters = new();
             foreach ((string paramName, ParameterDefinition paramDef) in spDefinition.Parameters)
             {
                 Dictionary<string, object> paramSchema = new()
@@ -370,6 +371,13 @@ private JsonElement BuildInputSchema()
                 };
 
                 properties[paramName] = paramSchema;
+
+                // A DB metadata parameter is required unless config marks it optional or supplies
+                // a default the engine applies when the caller omits it.
+                if (IsParameterRequired(paramDef.Required, paramDef.HasConfigDefault))
+                {
+                    requiredParameters.Add(paramName);
+                }
             }
 
             Dictionary<string, object> schema = new()
@@ -378,6 +386,11 @@ private JsonElement BuildInputSchema()
                 ["properties"] = properties
             };
 
+            if (requiredParameters.Count > 0)
+            {
+                schema["required"] = requiredParameters;
+            }
+
             return JsonSerializer.SerializeToElement(schema);
         }
 
@@ -396,6 +409,7 @@ private JsonElement BuildInputSchemaFromConfig()
             if (_entity.Source.Parameters != null && _entity.Source.Parameters.Any())
             {
                 Dictionary<string, object> properties = (Dictionary<string, object>)schema["properties"];
+                List<string> requiredParameters = new();
 
                 foreach (ParameterMetadata param in _entity.Source.Parameters)
                 {
@@ -404,12 +418,40 @@ private JsonElement BuildInputSchemaFromConfig()
                         ["type"] = new[] { "string", "number", "boolean", "null" },
                         ["description"] = param.Description ?? $"Parameter {param.Name}"
                     };
+
+                    // A parameter is required unless config marks it optional or supplies a default.
+                    if (IsParameterRequired(param.Required, param.Default is not null))
+                    {
+                        requiredParameters.Add(param.Name);
+                    }
+                }
+
+                if (requiredParameters.Count > 0)
+                {
+                    schema["required"] = requiredParameters;
                 }
             }
 
             return JsonSerializer.SerializeToElement(schema);
         }
 
+        /// <summary>
+        /// Determines whether a stored procedure parameter should be advertised as required in the
+        /// tool input schema. A parameter is required when configuration does not mark it optional
+        /// and does not provide a default value the engine can apply when the caller omits it.
+        /// </summary>
+        private static bool IsParameterRequired(bool? configuredRequired, bool hasDefault)
+        {
+            // If the engine can supply a default when the caller omits the parameter,
+            // it should not be advertised as required.
+            if (hasDefault)
+            {
+                return false;
+            }
+
+            return configuredRequired ?? true;
+        }
+
         /// <summary>
         /// Maps a .NET System.Type to the appropriate JSON Schema type string.
         /// </summary>

src/Core/AuthenticationHelpers/AppServiceAuthenticationInformation.cs

@@ -15,18 +15,19 @@ public static class AppServiceAuthenticationInfo
     /// Environment variable key whose value represents whether AppService EasyAuth is enabled ("true" or "false").
     /// </summary>
     public const string APPSERVICESAUTH_ENABLED_ENVVAR = "WEBSITE_AUTH_ENABLED";
-    /// <summary>
-    /// Environment variable key whose value represents Identity Provider such as "AzureActiveDirectory"
-    /// </summary>
-    public const string APPSERVICESAUTH_IDENTITYPROVIDER_ENVVAR = "WEBSITE_AUTH_DEFAULT_PROVIDER";
+
+    // ── AppService messages ──────────────────────────────────────────────────────────────────────
     /// <summary>
     /// Error message used when AppService Authentication is configured in production mode in a non AppService Environment.
     /// </summary>
-    public const string APPSERVICE_PROD_MISSING_ENV_CONFIG = "AppService environment not detected while runtime is in production mode.";
+    public const string APPSERVICE_PROD_MISSING_ENV_CONFIG =
+        "App Service: Cannot start in production: EasyAuth is configured with host.mode set to production, but the Azure App Service environment could not be detected because the WEBSITE_AUTH_ENABLED environment variable was missing or did not have the value true. DAB requires an Azure App Service EasyAuth proxy in production because it trusts the X-MS-CLIENT-PRINCIPAL header as the authenticated user identity, and without the EasyAuth proxy this header could be forged. If this is a local or non-Azure deployment, set host.mode to development. If this is intended to run in production, deploy it behind Azure App Service, enable EasyAuth, and verify that WEBSITE_AUTH_ENABLED=true is available to the application.";
     /// <summary>
     /// Warning message logged when AppService environment not detected (applicable to development mode).
     /// </summary>
-    public const string APPSERVICE_DEV_MISSING_ENV_CONFIG = "AppService environment not detected, EasyAuth authentication may not behave as expected.";
+    public const string APPSERVICE_DEV_MISSING_ENV_CONFIG =
+        "AppService environment not detected. The X-MS-CLIENT-PRINCIPAL header is not cryptographically " +
+        "validated; EasyAuth authentication may not behave as expected outside an Azure App Service environment.";
 
     /// <summary>
     /// Returns a best guess whether AppService is enabled in the environment by checking for
@@ -39,14 +40,12 @@ public static class AppServiceAuthenticationInfo
     /// </summary>
     public static bool AreExpectedAppServiceEnvVarsPresent()
     {
+        // WEBSITE_AUTH_ENABLED is the only variable that is reliably injected by the Azure platform
+        // whenever App Service Authentication (EasyAuth) is enabled, regardless of how many identity
+        // providers are configured. WEBSITE_AUTH_DEFAULT_PROVIDER is only set when a *single* provider
+        // is selected; multi-provider configurations leave it unset, so it must not be required here.
         string? appServiceEnabled = Environment.GetEnvironmentVariable(APPSERVICESAUTH_ENABLED_ENVVAR);
-        string? appServiceIdentityProvider = Environment.GetEnvironmentVariable(APPSERVICESAUTH_IDENTITYPROVIDER_ENVVAR);
-
-        if (string.IsNullOrEmpty(appServiceEnabled) || string.IsNullOrEmpty(appServiceIdentityProvider))
-        {
-            return false;
-        }
-
-        return appServiceEnabled.Equals(value: "true", comparisonType: StringComparison.OrdinalIgnoreCase);
+        return appServiceEnabled is not null &&
+               appServiceEnabled.Equals(value: "true", comparisonType: StringComparison.OrdinalIgnoreCase);
     }
 }

src/Core/AuthenticationHelpers/StaticWebAppsAuthentication.cs

@@ -33,6 +33,31 @@ public class StaticWebAppsClientPrincipal
         public IEnumerable<string>? UserRoles { get; set; }
     }
 
+    /// <summary>
+    /// Environment variable key set by the Azure platform for every App Service and Static Web Apps
+    /// hosted site. Its presence is the best-effort signal that the runtime is executing behind an
+    /// Azure-managed proxy that injects and validates the X-MS-CLIENT-PRINCIPAL header.
+    /// </summary>
+    public const string WEBSITE_SITE_NAME_ENVVAR = "WEBSITE_SITE_NAME";
+
+    // ── StaticWebApps messages ───────────────────────────────────────────────────────────────────
+    /// <summary>
+    /// Error message used when StaticWebApps Authentication is configured in production mode
+    /// without a detectable Azure-hosted environment.
+    /// </summary>
+    public const string SWA_PROD_MISSING_ENV_CONFIG =
+        "StaticWebApps environment not detected while runtime is in production mode. " +
+        "The X-MS-CLIENT-PRINCIPAL header is not cryptographically validated by DAB and can be trivially " +
+        "forged when the service is not hosted behind an Azure Static Web Apps proxy. " +
+        "Set host.mode to 'development' for local testing, or deploy behind Azure Static Web Apps.";
+
+    /// <summary>
+    /// Warning message logged when StaticWebApps environment not detected (applicable to development mode).
+    /// </summary>
+    public const string SWA_DEV_MISSING_ENV_CONFIG =
+        "StaticWebApps environment not detected. The X-MS-CLIENT-PRINCIPAL header is not cryptographically " +
+        "validated; EasyAuth authentication may not behave as expected outside an Azure Static Web Apps environment.";
+
     /// <summary>
     /// Base64 decodes and deserializes the x-ms-client-principal payload containing
     /// SWA token metadata.
@@ -98,4 +123,14 @@ error is NotSupportedException ||
 
         return identity;
     }
+
+    /// <summary>
+    /// Returns a best-effort indication that the runtime is executing inside an Azure Static Web Apps
+    /// environment by checking for the presence of <see cref="WEBSITE_SITE_NAME_ENVVAR"/>, which is
+    /// injected by the Azure platform for every SWA-hosted application.
+    /// </summary>
+    public static bool AreExpectedSWAEnvVarsPresent()
+    {
+        return !string.IsNullOrEmpty(Environment.GetEnvironmentVariable(WEBSITE_SITE_NAME_ENVVAR));
+    }
 }

src/Core/Resolvers/DWSqlQueryBuilder.cs

@@ -452,12 +452,17 @@ public string Build(SqlUpsertQueryStructure structure)
             // Final query to be executed for the given PUT/PATCH operation.
             StringBuilder upsertQuery = new(prefixQuery);
 
+            // Predicates to scope the UPDATE to the record(s) identified by the PK
+            // combined with any database policy defined for the update operation.
+            string updatePredicates = JoinPredicateStrings(pkPredicates, structure.GetDbPolicyForOperation(EntityActionOperation.Update));
+
             // Query to update record (if there exists one for given PK).
             StringBuilder updateQuery = new(
                 $"IF @ROWS_TO_UPDATE = 1 " +
                 $"BEGIN " +
                 $"UPDATE {tableName} " +
-                $"SET {updateOperations} ");
+                $"SET {updateOperations} " +
+                $"WHERE {updatePredicates} ");
 
             // End the IF block.
             updateQuery.Append("END ");

src/Core/Resolvers/MsSqlQueryExecutor.cs

@@ -516,6 +516,7 @@ public override string GetSessionParamsQuery(HttpContext? httpContext, IDictiona
 
             // Counter to generate different param name for each of the sessionParam.
             IncrementingInteger counter = new();
+            const string SESSION_KEY_NAME = $"{BaseQueryStructure.PARAM_NAME_PREFIX}session_key";
             const string SESSION_PARAM_NAME = $"{BaseQueryStructure.PARAM_NAME_PREFIX}session_param";
             StringBuilder sessionMapQuery = new();
 
@@ -528,10 +529,14 @@ public override string GetSessionParamsQuery(HttpContext? httpContext, IDictiona
 
                 foreach ((string claimType, string claimValue) in sessionParams)
                 {
+                    string keyName = $"{SESSION_KEY_NAME}{counter.Current()}";
+                    parameters.Add(keyName, new(claimType));
+
                     string paramName = $"{SESSION_PARAM_NAME}{counter.Next()}";
                     parameters.Add(paramName, new(claimValue));
+
                     // Append statement to set read only param value - can be set only once for a connection.
-                    string statementToSetReadOnlyParam = "EXEC sp_set_session_context " + $"'{claimType}', " + paramName + ", @read_only = 0;";
+                    string statementToSetReadOnlyParam = "EXEC sp_set_session_context " + keyName + ", " + paramName + ", @read_only = 0;";
                     sessionMapQuery = sessionMapQuery.Append(statementToSetReadOnlyParam);
                 }
             }

src/Service.Tests/Authentication/EasyAuthAuthenticationUnitTests.cs

@@ -325,7 +325,6 @@ public async Task TestValidStaticWebAppsEasyAuthTokenWithAnonymousRoleOnly()
             DisplayName = "Anonymous role - X-MS-API-ROLE is not honored")]
         [DataRow(true, "author",
             DisplayName = "Authenticated role - existing X-MS-API-ROLE is honored")]
-        [TestMethod]
         public async Task TestClientRoleHeaderPresence(bool addAuthenticated, string clientRoleHeader)
         {
             string generatedToken = AuthTestHelper.CreateStaticWebAppsEasyAuthToken(addAuthenticated);

src/Service.Tests/Caching/HealthEndpointCachingTests.cs

@@ -22,6 +22,12 @@ public class HealthEndpointCachingTests
 {
     private const string CUSTOM_CONFIG_FILENAME = "custom-config.json";
 
+    [TestInitialize]
+    public void SetupAuthProviderEnvironmentVariables()
+    {
+        TestHelper.SetAppServiceEnvironmentVariable();
+    }
+
     [TestCleanup]
     public void CleanupAfterEachTest()
     {

src/Service.Tests/Configuration/ConfigurationTests.cs

@@ -735,6 +735,13 @@ public void CleanupAfterEachTest()
             TestHelper.UnsetAllDABEnvironmentVariables();
         }
 
+        [TestInitialize]
+        public void SetupAuthProviderEnvironmentVariables()
+        {
+            TestHelper.SetAppServiceEnvironmentVariable();
+            TestHelper.SetStaticWebAppsEnvironmentVariable();
+        }
+
         /// <summary>
         /// When updating config during runtime is possible, then For invalid config the Application continues to
         /// accept request with status code of 503.
@@ -3934,23 +3941,24 @@ type Planet @model(name:""PlanetAlias"") {
         /// </summary>
         /// <param name="hostMode">HostMode in Runtime config - Development or Production.</param>
         /// <param name="authType">EasyAuth auth type - AppService or StaticWebApps.</param>
-        /// <param name="setEnvVars">Whether to set the AppService host environment variables.</param>
+        /// <param name="setAppServiceEnvVars">Whether to set the AppService host environment variables.</param>
+        /// <param name="setStaticWebAppsEnvVar">Whether to set the Static Web Apps host environment variable.</param>
         /// <param name="expectError">Whether an error is expected.</param>
         [DataTestMethod]
         [TestCategory(TestCategory.MSSQL)]
-        [DataRow(HostMode.Development, EasyAuthType.AppService, false, false, DisplayName = "AppService Dev - No EnvVars - No Error")]
-        [DataRow(HostMode.Development, EasyAuthType.AppService, true, false, DisplayName = "AppService Dev - EnvVars - No Error")]
-        [DataRow(HostMode.Production, EasyAuthType.AppService, false, false, DisplayName = "AppService Prod - No EnvVars - Error")]
-        [DataRow(HostMode.Production, EasyAuthType.AppService, true, false, DisplayName = "AppService Prod - EnvVars - Error")]
-        [DataRow(HostMode.Development, EasyAuthType.StaticWebApps, false, false, DisplayName = "SWA Dev - No EnvVars - No Error")]
-        [DataRow(HostMode.Development, EasyAuthType.StaticWebApps, true, false, DisplayName = "SWA Dev - EnvVars - No Error")]
-        [DataRow(HostMode.Production, EasyAuthType.StaticWebApps, false, false, DisplayName = "SWA Prod - No EnvVars - No Error")]
-        [DataRow(HostMode.Production, EasyAuthType.StaticWebApps, true, false, DisplayName = "SWA Prod - EnvVars - No Error")]
-        public void TestProductionModeAppServiceEnvironmentCheck(HostMode hostMode, EasyAuthType authType, bool setEnvVars, bool expectError)
+        [DataRow(HostMode.Development, EasyAuthType.AppService, false, false, false, DisplayName = "AppService Dev - No EnvVars - No Error")]
+        [DataRow(HostMode.Development, EasyAuthType.AppService, true, false, false, DisplayName = "AppService Dev - EnvVars - No Error")]
+        [DataRow(HostMode.Production, EasyAuthType.AppService, false, false, true, DisplayName = "AppService Prod - No EnvVars - Error")]
+        [DataRow(HostMode.Production, EasyAuthType.AppService, true, false, false, DisplayName = "AppService Prod - EnvVars - No Error")]
+        [DataRow(HostMode.Development, EasyAuthType.StaticWebApps, false, false, false, DisplayName = "SWA Dev - No EnvVars - No Error")]
+        [DataRow(HostMode.Development, EasyAuthType.StaticWebApps, false, true, false, DisplayName = "SWA Dev - EnvVars - No Error")]
+        [DataRow(HostMode.Production, EasyAuthType.StaticWebApps, false, false, true, DisplayName = "SWA Prod - No EnvVars - Error")]
+        [DataRow(HostMode.Production, EasyAuthType.StaticWebApps, false, true, false, DisplayName = "SWA Prod - EnvVars - No Error")]
+        public void TestProductionModeAppServiceEnvironmentCheck(HostMode hostMode, EasyAuthType authType, bool setAppServiceEnvVars, bool setStaticWebAppsEnvVar, bool expectError)
         {
             // Clears or sets App Service Environment Variables based on test input.
-            Environment.SetEnvironmentVariable(AppServiceAuthenticationInfo.APPSERVICESAUTH_ENABLED_ENVVAR, setEnvVars ? "true" : null);
-            Environment.SetEnvironmentVariable(AppServiceAuthenticationInfo.APPSERVICESAUTH_IDENTITYPROVIDER_ENVVAR, setEnvVars ? "AzureActiveDirectory" : null);
+            Environment.SetEnvironmentVariable(AppServiceAuthenticationInfo.APPSERVICESAUTH_ENABLED_ENVVAR, setAppServiceEnvVars ? "true" : null);
+            Environment.SetEnvironmentVariable(StaticWebAppsAuthentication.WEBSITE_SITE_NAME_ENVVAR, setStaticWebAppsEnvVar ? "test-site-name" : null);
             TestHelper.SetupDatabaseEnvironment(TestCategory.MSSQL);
 
             FileSystem fileSystem = new();
@@ -3987,7 +3995,16 @@ public void TestProductionModeAppServiceEnvironmentCheck(HostMode hostMode, Easy
             catch (DataApiBuilderException ex)
             {
                 Assert.IsTrue(expectError, message: ex.Message);
-                Assert.AreEqual(AppServiceAuthenticationInfo.APPSERVICE_PROD_MISSING_ENV_CONFIG, ex.Message);
+                Assert.AreEqual(
+                    expected: authType == EasyAuthType.AppService
+                        ? AppServiceAuthenticationInfo.APPSERVICE_PROD_MISSING_ENV_CONFIG
+                        : StaticWebAppsAuthentication.SWA_PROD_MISSING_ENV_CONFIG,
+                    actual: ex.Message);
+            }
+            finally
+            {
+                Environment.SetEnvironmentVariable(AppServiceAuthenticationInfo.APPSERVICESAUTH_ENABLED_ENVVAR, null);
+                Environment.SetEnvironmentVariable(StaticWebAppsAuthentication.WEBSITE_SITE_NAME_ENVVAR, null);
             }
         }
 

src/Service.Tests/Configuration/HealthEndpointRolesTests.cs

@@ -22,6 +22,12 @@ public class HealthEndpointRolesTests
 
         private const string CUSTOM_CONFIG_FILENAME = "custom-config.json";
 
+        [TestInitialize]
+        public void SetupAuthProviderEnvironmentVariables()
+        {
+            TestHelper.SetAppServiceEnvironmentVariable();
+        }
+
         [TestCleanup]
         public void CleanupAfterEachTest()
         {

src/Service.Tests/Configuration/HealthEndpointTests.cs

@@ -36,6 +36,12 @@ public class HealthEndpointTests
         private const string CUSTOM_CONFIG_FILENAME = "custom_config.json";
         private const string BASE_DAB_URL = "http://localhost:5000";
 
+        [TestInitialize]
+        public void SetupAuthProviderEnvironmentVariables()
+        {
+            TestHelper.SetAppServiceEnvironmentVariable();
+        }
+
         [TestCleanup]
         public void CleanupAfterEachTest()
         {