Merge branch 'main' into copilot/fix-autoentities-in-child-configs

Author: aaronburtle

config-generators/mssql-commands.txt

@@ -18,6 +18,8 @@ add WebsiteUser_MM --config "dab-config.MsSql.json" --source website_users_mm --
 add SupportedType --config "dab-config.MsSql.json" --source type_table --permissions "anonymous:create,read,delete,update"
 add VectorType --config "dab-config.MsSql.json" --source vector_type_table --rest true --graphql false --permissions "anonymous:create,read,delete,update"
 update VectorType --config "dab-config.MsSql.json" --permissions "authenticated:create,read,delete,update"
+add Profile --config "dab-config.MsSql.json" --source profiles --rest true --graphql true --permissions "anonymous:create,read,delete,update"
+update Profile --config "dab-config.MsSql.json" --permissions "authenticated:create,read,delete,update"
 add stocks_price --config "dab-config.MsSql.json" --source stocks_price --permissions "authenticated:create,read,update,delete"
 update stocks_price --config "dab-config.MsSql.json" --permissions "anonymous:read"
 update stocks_price --config "dab-config.MsSql.json" --permissions "TestNestedFilterFieldIsNull_ColumnForbidden:read" --fields.exclude "price"
@@ -123,6 +125,9 @@ update Book --config "dab-config.MsSql.json" --permissions "test_role_with_exclu
 update Book --config "dab-config.MsSql.json" --permissions "test_role_with_excluded_fields:read" --fields.exclude "publisher_id"
 update Book --config "dab-config.MsSql.json" --permissions "test_role_with_policy_excluded_fields:create,update,delete"
 update Book --config "dab-config.MsSql.json" --permissions "test_role_with_policy_excluded_fields:read" --fields.exclude "publisher_id" --policy-database "@item.title ne 'Test'"
+update Book --config "dab-config.MsSql.json" --permissions "test_role_with_excluded_fields_on_mutation:read,delete"
+update Book --config "dab-config.MsSql.json" --permissions "test_role_with_excluded_fields_on_mutation:create" --fields.exclude "publisher_id"
+update Book --config "dab-config.MsSql.json" --permissions "test_role_with_excluded_fields_on_mutation:update" --fields.exclude "publisher_id"
 update Book --config "dab-config.MsSql.json" --permissions "role_multiple_create_policy_tester:read" --policy-database "@item.publisher_id ne 1234"
 update Book --config "dab-config.MsSql.json" --permissions "role_multiple_create_policy_tester:create" --policy-database "@item.title ne 'Test'"
 update Book --config "dab-config.MsSql.json" --permissions "role_multiple_create_policy_tester:update,delete"
@@ -142,6 +147,9 @@ update BookWebsitePlacement --config "dab-config.MsSql.json" --permissions "auth
 update BookWebsitePlacement --config "dab-config.MsSql.json" --permissions "authenticated:delete" --fields.include "*" --policy-database "@claims.userId eq @item.id"
 update Author --config "dab-config.MsSql.json"  --permissions "authenticated:create,read,update,delete" --rest true --graphql true
 update WebsiteUser --config "dab-config.MsSql.json" --permissions "authenticated:create,read,delete,update" --rest false --graphql "websiteUser:websiteUsers"
+update WebsiteUser --config "dab-config.MsSql.json" --permissions "test_role_with_excluded_fields_on_mutation:read,delete"
+update WebsiteUser --config "dab-config.MsSql.json" --permissions "test_role_with_excluded_fields_on_mutation:create" --fields.exclude "username"
+update WebsiteUser --config "dab-config.MsSql.json" --permissions "test_role_with_excluded_fields_on_mutation:update" --fields.exclude "username"
 update WebsiteUser -c "dab-config.MsSql.json" --relationship reviews --target.entity Review --cardinality many --relationship.fields "id:websiteuser_id"
 update WebsiteUser_MM --config "dab-config.MsSql.json" --source website_users_mm --permissions "authenticated:*" --relationship reviews --relationship.fields "id:websiteuser_id" --target.entity Review_MM --cardinality many
 update Revenue --config "dab-config.MsSql.json" --permissions "database_policy_tester:create" --policy-database "@item.revenue gt 1000"

global.json

@@ -1,6 +1,6 @@
 {
   "sdk": {
-    "version": "10.0.301",
+    "version": "10.0.302",
     "rollForward": "latestFeature"
   }
 }

src/Azure.DataApiBuilder.Mcp/BuiltInTools/CreateRecordTool.cs

@@ -125,6 +125,30 @@ public async Task<CallToolResult> ExecuteAsync(
                     return McpErrorHelpers.PermissionDenied(toolName, entityName, "create", authError, logger);
                 }
 
+                // Column-level authorization: ensure the caller's effective role is permitted to write
+                // every column present in the request payload (fields.include/fields.exclude enforcement).
+                IEnumerable<string> requestedColumns = dataElement.ValueKind == JsonValueKind.Object
+                    ? dataElement.EnumerateObject().Select(property => property.Name)
+                    : Enumerable.Empty<string>();
+
+                try
+                {
+                    if (!McpAuthorizationHelper.AreColumnsAuthorizedForOperation(
+                            authorizationResolver,
+                            entityName,
+                            effectiveRole!,
+                            EntityActionOperation.Create,
+                            requestedColumns,
+                            out string columnAuthError))
+                    {
+                        return McpErrorHelpers.PermissionDenied(toolName, entityName, "create", columnAuthError, logger);
+                    }
+                }
+                catch (Azure.DataApiBuilder.Service.Exceptions.DataApiBuilderException dabEx)
+                {
+                    return McpResponseBuilder.BuildErrorResult(toolName, "ValidationFailed", $"Request validation failed: {dabEx.Message}", logger);
+                }
+
                 JsonElement insertPayloadRoot = dataElement.Clone();
 
                 // Validate it's a table or view - stored procedures use execute_entity

src/Azure.DataApiBuilder.Mcp/BuiltInTools/UpdateRecordTool.cs

@@ -166,6 +166,26 @@ public async Task<CallToolResult> ExecuteAsync(
                     return McpErrorHelpers.PermissionDenied(toolName, entityName, "update", authError, logger);
                 }
 
+                // Column-level authorization: ensure the caller's effective role is permitted to write
+                // every column present in the request payload (fields.include/fields.exclude enforcement).
+                try
+                {
+                    if (!McpAuthorizationHelper.AreColumnsAuthorizedForOperation(
+                            authResolver,
+                            entityName,
+                            effectiveRole!,
+                            EntityActionOperation.Update,
+                            fields.Keys,
+                            out string columnAuthError))
+                    {
+                        return McpErrorHelpers.PermissionDenied(toolName, entityName, "update", columnAuthError, logger);
+                    }
+                }
+                catch (Azure.DataApiBuilder.Service.Exceptions.DataApiBuilderException dabEx)
+                {
+                    return McpResponseBuilder.BuildErrorResult(toolName, "ValidationFailed", $"Request validation failed: {dabEx.Message}", logger);
+                }
+
                 // 6) Build and validate Upsert (UpdateIncremental) context
                 JsonElement upsertPayloadRoot = RequestValidator.ValidateAndParseRequestBody(JsonSerializer.Serialize(fields));
                 RequestValidator requestValidator = new(metadataProviderFactory, runtimeConfigProvider);

src/Azure.DataApiBuilder.Mcp/Utils/McpAuthorizationHelper.cs

@@ -80,5 +80,40 @@ public static bool TryResolveAuthorizedRole(
             error = $"You do not have permission to perform {operation} operation for this entity.";
             return false;
         }
+
+        /// <summary>
+        /// Validates that the resolved role is authorized to write/access the specific set of columns
+        /// for the given operation. This is the column-level counterpart to
+        /// <see cref="TryResolveAuthorizedRole"/>, which only performs entity/operation-level authorization.
+        /// Mutation tools (create_record, update_record) must call this after resolving the effective role
+        /// and before forwarding the payload to the mutation engine, mirroring the column-level checks
+        /// already enforced by REST (ColumnsPermissionsRequirement) and the read-side MCP tools.
+        /// </summary>
+        public static bool AreColumnsAuthorizedForOperation(
+            IAuthorizationResolver authorizationResolver,
+            string entityName,
+            string role,
+            EntityActionOperation operation,
+            IEnumerable<string> columns,
+            out string error)
+        {
+            error = string.Empty;
+
+            List<string> requestedColumns = columns?.ToList() ?? new List<string>();
+
+            // No columns supplied means nothing is written, so there is nothing to restrict.
+            if (requestedColumns.Count == 0)
+            {
+                return true;
+            }
+
+            if (!authorizationResolver.AreColumnsAllowedForOperation(entityName, role, operation, requestedColumns))
+            {
+                error = $"You do not have permission to access one or more of the specified columns for the {operation} operation on this entity.";
+                return false;
+            }
+
+            return true;
+        }
     }
 }

src/Core/Resolvers/MsSqlQueryBuilder.cs

@@ -1,6 +1,7 @@
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT License.
 
+using System.Data;
 using System.Data.Common;
 using System.Text;
 using System.Text.RegularExpressions;
@@ -456,10 +457,36 @@ private string WrappedColumns(SqlQueryStructure structure)
                 structure.Columns.Select(
                     c => structure.IsSubqueryColumn(c) ?
                         WrapSubqueryColumn(c, structure.JoinQueries[c.TableAlias!]) + $" AS {QuoteIdentifier(c.Label)}" :
-                        Build(c)
+                        BuildResultColumn(c, structure)
             ));
         }
 
+        /// <summary>
+        /// Builds a top-level (non-subquery) result column.
+        /// A SQL Server native <c>json</c> column is cast to NVARCHAR(MAX) so that the trailing
+        /// FOR JSON PATH clause emits it as an escaped JSON string instead of inlining it as a nested
+        /// JSON value. DAB treats a json column as a normal string, so its raw JSON text must
+        /// round-trip as a string at the REST/GraphQL boundary.
+        /// </summary>
+        private string BuildResultColumn(LabelledColumn column, SqlQueryStructure structure)
+        {
+            if (IsJsonColumn(column, structure))
+            {
+                return $"CAST({Build(column as Column)} AS NVARCHAR(MAX)) AS {QuoteIdentifier(column.Label)}";
+            }
+
+            return Build(column);
+        }
+
+        /// <summary>
+        /// Returns true when the given column is backed by a SQL Server native <c>json</c> column.
+        /// </summary>
+        private static bool IsJsonColumn(LabelledColumn column, SqlQueryStructure structure)
+        {
+            return structure.GetUnderlyingSourceDefinition().Columns.TryGetValue(column.ColumnName, out ColumnDefinition? columnDefinition)
+                && columnDefinition.SqlDbType == SqlDbType.Json;
+        }
+
         /// <summary>
         /// Builds the parameter list for the stored procedure execute call
         /// paramKeys are the user-generated procedure parameter names

src/Core/Resolvers/Sql Query Structures/BaseSqlQueryStructure.cs

@@ -85,6 +85,32 @@ public BaseSqlQueryStructure(
             }
         }
 
+        /// <inheritdoc />
+        public override string MakeDbConnectionParam(object? value, string? paramName = null, bool lengthOverride = false)
+        {
+            if (MetadataProvider.GetDatabaseType() is DatabaseType.PostgreSQL &&
+                !string.IsNullOrEmpty(paramName) &&
+                value is string stringValue &&
+                GetUnderlyingSourceDefinition().Columns.TryGetValue(paramName, out ColumnDefinition? columnDefinition))
+            {
+                Type columnSystemType = columnDefinition.SystemType;
+                if (columnSystemType != typeof(string))
+                {
+                    value = GetParamAsSystemType(stringValue, paramName, columnSystemType);
+                }
+
+                // Npgsql requires DateTime with Kind=Unspecified for 'timestamp without time zone' columns.
+                // ParseParamAsSystemType returns Kind=Utc (via .UtcDateTime), which causes PostgreSQL to
+                // apply a UTC-to-local offset during comparison, producing incorrect filter results.
+                if (value is DateTime dtValue && dtValue.Kind == DateTimeKind.Utc && columnSystemType == typeof(DateTime))
+                {
+                    value = DateTime.SpecifyKind(dtValue, DateTimeKind.Unspecified);
+                }
+            }
+
+            return base.MakeDbConnectionParam(value, paramName, lengthOverride);
+        }
+
         /// <summary>
         /// For UPDATE (OVERWRITE) operation
         /// Adds result of (SourceDefinition.Columns minus MutationFields) to UpdateOperations with null values
@@ -422,9 +448,9 @@ protected List<LabelledColumn> GenerateOutputColumns()
         /// Tries to parse the string parameter to the given system type
         /// Useful for inferring parameter types for columns or procedure parameters
         /// </summary>
-        /// <param name="param"></param>
-        /// <param name="systemType"></param>
-        /// <returns></returns>
+        /// <param name="param">The string value to parse.</param>
+        /// <param name="systemType">The target system type for the parsed value.</param>
+        /// <returns>The parameter parsed as the requested system type.</returns>
         /// <exception cref="NotSupportedException"></exception>
         protected static object ParseParamAsSystemType(string param, Type systemType)
         {

src/Core/Services/GraphQLSchemaCreator.cs

@@ -295,9 +295,9 @@ private DocumentNode GenerateSqlGraphQLObjects(RuntimeEntities entities, Diction
                     Dictionary<string, IEnumerable<string>> rolesAllowedForFields = new();
                     SourceDefinition sourceDefinition = sqlMetadataProvider.GetSourceDefinition(entityName);
                     bool isStoredProcedure = entity.Source.Type is EntitySourceType.StoredProcedure;
+                    EntityActionOperation operation = isStoredProcedure ? EntityActionOperation.Execute : EntityActionOperation.Read;
                     foreach (string column in sourceDefinition.Columns.Keys)
                     {
-                        EntityActionOperation operation = isStoredProcedure ? EntityActionOperation.Execute : EntityActionOperation.Read;
                         IEnumerable<string> roles = _authorizationResolver.GetRolesForField(entityName, field: column, operation: operation);
                         if (!rolesAllowedForFields.TryAdd(key: column, value: roles))
                         {
@@ -309,7 +309,6 @@ private DocumentNode GenerateSqlGraphQLObjects(RuntimeEntities entities, Diction
                         }
                     }
 
-                    // The roles allowed for Fields are the roles allowed to READ the fields, so any role that has a read definition for the field.
                     // Only add objectTypeDefinition for GraphQL if it has a role definition defined for access.
                     if (rolesAllowedForEntity.Any())
                     {
@@ -397,23 +396,18 @@ private DocumentNode GenerateSqlGraphQLObjects(RuntimeEntities entities, Diction
                 GenerateSourceTargetLinkingObjectDefinitions(objectTypes, linkingObjectTypes);
             }
 
-            // Return a list of all the object types to be exposed in the schema.
-            Dictionary<string, FieldDefinitionNode> fields = new();
-
-            // Add the DBOperationResult type to the schema
             NameNode nameNode = new(value: GraphQLUtils.DB_OPERATION_RESULT_TYPE);
-            FieldDefinitionNode field = GetDbOperationResultField();
-
-            fields.TryAdd(GraphQLUtils.DB_OPERATION_RESULT_FIELD_NAME, field);
 
+            // Add the DBOperationResult type to the schema
             objectTypes.Add(GraphQLUtils.DB_OPERATION_RESULT_TYPE, new ObjectTypeDefinitionNode(
                 location: null,
                 name: nameNode,
                 description: null,
                 new List<DirectiveNode>(),
                 new List<NamedTypeNode>(),
-                fields.Values.ToImmutableList()));
+                ImmutableList.Create(GetDbOperationResultField())));
 
+            // Return a list of all the object types to be exposed in the schema.
             List<IDefinitionNode> nodes = new(objectTypes.Values);
             nodes.AddRange(enumTypes.Values);
             return new DocumentNode(nodes);
@@ -748,7 +742,7 @@ private static FieldDefinitionNode GetDbOperationResultField()
             DocumentNode cosmosResult = GenerateCosmosGraphQLObjects(cosmosDataSourceNames, inputObjects);
             DocumentNode sqlResult = GenerateSqlGraphQLObjects(sql, inputObjects);
             // Create Root node with definitions from both cosmos and sql.
-            DocumentNode root = new(cosmosResult.Definitions.Concat(sqlResult.Definitions).ToImmutableList());
+            DocumentNode root = cosmosResult.WithDefinitions(cosmosResult.Definitions.Concat(sqlResult.Definitions).ToImmutableList());
 
             // Merge the inputobjectType definitions from cosmos and sql onto the root.
             return (root.WithDefinitions(root.Definitions.Concat(inputObjects.Values).ToImmutableList()), inputObjects);