TEMP DIAGNOSTIC: log resolver Included/Excluded sets and backing column resolution (to be reverted)

Author: souvikghosh04

src/Core/Authorization/AuthorizationResolver.cs

@@ -167,12 +167,15 @@ public bool AreColumnsAllowedForOperation(string entityName, string roleName, En
         if (roleMetadata.OperationToColumnMap.TryGetValue(operation, out OperationMetadata? operationToColumnMap) && operationToColumnMap is not null)
         {
             _runtimeConfigProvider.TryGetConfig(out RuntimeConfig? runtimeConfig);
+            Console.WriteLine($"[DIAG resolver] entity={entityName} role={roleName} op={operation} Included=[{string.Join(",", operationToColumnMap.Included)}] Excluded=[{string.Join(",", operationToColumnMap.Excluded)}]");
             // Each column present in the request is an "exposedColumn".
             // Authorization permissions reference "backingColumns"
             // Resolve backingColumn name to check authorization.
             // Failure indicates that request contain invalid exposedColumn for entity.
             foreach (string exposedColumn in columns)
             {
+                bool resolvedBacking = metadataProvider.TryGetBackingColumn(entityName, field: exposedColumn, out string? backingColumnDiag);
+                Console.WriteLine($"[DIAG resolver]   exposed={exposedColumn} resolvedBacking={resolvedBacking} backing={backingColumnDiag} inExcluded={(backingColumnDiag != null && operationToColumnMap.Excluded.Contains(backingColumnDiag))} inIncluded={(backingColumnDiag != null && operationToColumnMap.Included.Contains(backingColumnDiag))}");
                 if (metadataProvider.TryGetBackingColumn(entityName, field: exposedColumn, out string? backingColumn))
                 {
                     // backingColumn will not be null when TryGetBackingColumn() is true.

src/Service.Tests/Authorization/AuthorizationResolverUnitTests.cs

@@ -905,6 +905,98 @@ public void WildcardColumnInclusionWithExplicitExclusion()
                 excludedColumns));
         }
 
+        /// <summary>
+        /// Reproduces the real-world Book entity scenario: a single role with MULTIPLE actions
+        /// (read with no field restriction, create/update excluding a column, delete with no
+        /// field restriction) all defined in one EntityPermission.Actions array - unlike
+        /// AuthorizationHelpers.InitRuntimeConfig which only ever builds a single action per role.
+        /// </summary>
+        [TestMethod("Multiple actions per role - column exclusion on create/update only")]
+        public void MultipleActionsPerRole_ColumnExclusionOnCreateAndUpdate()
+        {
+            EntityActionFields readFields = new(Exclude: new());
+            EntityActionFields createUpdateFields = new(Exclude: new() { "col3" });
+            EntityActionFields deleteFields = new(Exclude: new());
+
+            EntityAction readAction = new(Action: EntityActionOperation.Read, Fields: null, Policy: new(null, null));
+            EntityAction createAction = new(Action: EntityActionOperation.Create, Fields: createUpdateFields, Policy: new(null, null));
+            EntityAction updateAction = new(Action: EntityActionOperation.Update, Fields: createUpdateFields, Policy: new(null, null));
+            EntityAction deleteAction = new(Action: EntityActionOperation.Delete, Fields: null, Policy: new(null, null));
+
+            Azure.DataApiBuilder.Config.ObjectModel.EntityPermission permissionForEntity = new(
+                Role: AuthorizationHelpers.TEST_ROLE,
+                Actions: new EntityAction[] { readAction, createAction, updateAction, deleteAction });
+
+            Azure.DataApiBuilder.Config.ObjectModel.Entity sampleEntity = new(
+                Source: new Azure.DataApiBuilder.Config.ObjectModel.EntitySource(AuthorizationHelpers.TEST_ENTITY, Azure.DataApiBuilder.Config.ObjectModel.EntitySourceType.Table, null, null),
+                Fields: null,
+                Rest: new(Array.Empty<SupportedHttpVerb>()),
+                GraphQL: new(AuthorizationHelpers.TEST_ENTITY, AuthorizationHelpers.TEST_ENTITY),
+                Permissions: new Azure.DataApiBuilder.Config.ObjectModel.EntityPermission[] { permissionForEntity },
+                Relationships: null,
+                Mappings: null);
+
+            Azure.DataApiBuilder.Config.ObjectModel.RuntimeConfig runtimeConfig = new(
+                Schema: "UnitTestSchema",
+                DataSource: new Azure.DataApiBuilder.Config.ObjectModel.DataSource(Azure.DataApiBuilder.Config.ObjectModel.DatabaseType.MSSQL, "", new()),
+                Runtime: new(
+                    Rest: new(),
+                    GraphQL: new(),
+                    Mcp: new(),
+                    Host: new(
+                        Cors: null,
+                        Authentication: new("AppService", null))),
+                Entities: new(new Dictionary<string, Azure.DataApiBuilder.Config.ObjectModel.Entity> { { AuthorizationHelpers.TEST_ENTITY, sampleEntity } }));
+
+            AuthorizationResolver authZResolver = AuthorizationHelpers.InitAuthorizationResolver(runtimeConfig);
+
+            // Read should allow all columns (no exclusion for read).
+            Assert.IsTrue(authZResolver.AreColumnsAllowedForOperation(
+                AuthorizationHelpers.TEST_ENTITY,
+                AuthorizationHelpers.TEST_ROLE,
+                operation: EntityActionOperation.Read,
+                new List<string> { "col1", "col3" }));
+
+            // Create should DENY col3 since it is excluded for create.
+            Assert.IsFalse(authZResolver.AreColumnsAllowedForOperation(
+                AuthorizationHelpers.TEST_ENTITY,
+                AuthorizationHelpers.TEST_ROLE,
+                operation: EntityActionOperation.Create,
+                new List<string> { "col1", "col3" }));
+
+            // Update should DENY col3 since it is excluded for update.
+            Assert.IsFalse(authZResolver.AreColumnsAllowedForOperation(
+                AuthorizationHelpers.TEST_ENTITY,
+                AuthorizationHelpers.TEST_ROLE,
+                operation: EntityActionOperation.Update,
+                new List<string> { "col1", "col3" }));
+
+            // Round-trip the config through JSON serialization/deserialization (as happens when DAB
+            // loads a real config file from disk) to rule out any bug specific to the JSON converters
+            // (e.g. shared/aliased Fields.Exclude HashSet instances across sibling actions).
+            string json = runtimeConfig.ToJson();
+            Assert.IsTrue(Azure.DataApiBuilder.Config.RuntimeConfigLoader.TryParseConfig(json, out Azure.DataApiBuilder.Config.ObjectModel.RuntimeConfig? roundTrippedConfig));
+            AuthorizationResolver roundTrippedResolver = AuthorizationHelpers.InitAuthorizationResolver(roundTrippedConfig!);
+
+            Assert.IsTrue(roundTrippedResolver.AreColumnsAllowedForOperation(
+                AuthorizationHelpers.TEST_ENTITY,
+                AuthorizationHelpers.TEST_ROLE,
+                operation: EntityActionOperation.Read,
+                new List<string> { "col1", "col3" }));
+
+            Assert.IsFalse(roundTrippedResolver.AreColumnsAllowedForOperation(
+                AuthorizationHelpers.TEST_ENTITY,
+                AuthorizationHelpers.TEST_ROLE,
+                operation: EntityActionOperation.Create,
+                new List<string> { "col1", "col3" }));
+
+            Assert.IsFalse(roundTrippedResolver.AreColumnsAllowedForOperation(
+                AuthorizationHelpers.TEST_ENTITY,
+                AuthorizationHelpers.TEST_ROLE,
+                operation: EntityActionOperation.Update,
+                new List<string> { "col1", "col3" }));
+        }
+
         /// <summary>
         /// Test that all columns should be excluded if the exclusion contains wildcard character.
         /// </summary>