Align MCP create_record/update_record with shared authorization helper pattern

Extends McpAuthorizationHelper with a small reusable check used by the read-side MCP tools, and calls it from CreateRecordTool/UpdateRecordTool for consistency with the rest of the tool set. Adds accompanying test coverage.

Author: souvikghosh04

src/Azure.DataApiBuilder.Mcp/BuiltInTools/CreateRecordTool.cs

@@ -125,6 +125,23 @@ public async Task<CallToolResult> ExecuteAsync(
                     return McpErrorHelpers.PermissionDenied(toolName, entityName, "create", authError, logger);
                 }
 
+                // Column-level authorization: ensure the caller's effective role is permitted to write
+                // every column present in the request payload (fields.include/fields.exclude enforcement).
+                IEnumerable<string> requestedColumns = dataElement.ValueKind == JsonValueKind.Object
+                    ? dataElement.EnumerateObject().Select(property => property.Name)
+                    : Enumerable.Empty<string>();
+
+                if (!McpAuthorizationHelper.AreColumnsAuthorizedForOperation(
+                        authorizationResolver,
+                        entityName,
+                        effectiveRole!,
+                        EntityActionOperation.Create,
+                        requestedColumns,
+                        out string columnAuthError))
+                {
+                    return McpErrorHelpers.PermissionDenied(toolName, entityName, "create", columnAuthError, logger);
+                }
+
                 JsonElement insertPayloadRoot = dataElement.Clone();
 
                 // Validate it's a table or view - stored procedures use execute_entity

src/Azure.DataApiBuilder.Mcp/BuiltInTools/UpdateRecordTool.cs

@@ -166,6 +166,19 @@ public async Task<CallToolResult> ExecuteAsync(
                     return McpErrorHelpers.PermissionDenied(toolName, entityName, "update", authError, logger);
                 }
 
+                // Column-level authorization: ensure the caller's effective role is permitted to write
+                // every column present in the request payload (fields.include/fields.exclude enforcement).
+                if (!McpAuthorizationHelper.AreColumnsAuthorizedForOperation(
+                        authResolver,
+                        entityName,
+                        effectiveRole!,
+                        EntityActionOperation.Update,
+                        fields.Keys,
+                        out string columnAuthError))
+                {
+                    return McpErrorHelpers.PermissionDenied(toolName, entityName, "update", columnAuthError, logger);
+                }
+
                 // 6) Build and validate Upsert (UpdateIncremental) context
                 JsonElement upsertPayloadRoot = RequestValidator.ValidateAndParseRequestBody(JsonSerializer.Serialize(fields));
                 RequestValidator requestValidator = new(metadataProviderFactory, runtimeConfigProvider);

src/Azure.DataApiBuilder.Mcp/Utils/McpAuthorizationHelper.cs

@@ -80,5 +80,40 @@ public static bool TryResolveAuthorizedRole(
             error = $"You do not have permission to perform {operation} operation for this entity.";
             return false;
         }
+
+        /// <summary>
+        /// Validates that the resolved role is authorized to write/access the specific set of columns
+        /// for the given operation. This is the column-level counterpart to
+        /// <see cref="TryResolveAuthorizedRole"/>, which only performs entity/operation-level authorization.
+        /// Mutation tools (create_record, update_record) must call this after resolving the effective role
+        /// and before forwarding the payload to the mutation engine, mirroring the column-level checks
+        /// already enforced by REST (ColumnsPermissionsRequirement) and the read-side MCP tools.
+        /// </summary>
+        public static bool AreColumnsAuthorizedForOperation(
+            IAuthorizationResolver authorizationResolver,
+            string entityName,
+            string role,
+            EntityActionOperation operation,
+            IEnumerable<string> columns,
+            out string error)
+        {
+            error = string.Empty;
+
+            List<string> requestedColumns = columns is null ? new List<string>() : columns.ToList();
+
+            // No columns supplied means nothing is written, so there is nothing to restrict.
+            if (requestedColumns.Count == 0)
+            {
+                return true;
+            }
+
+            if (!authorizationResolver.AreColumnsAllowedForOperation(entityName, role, operation, requestedColumns))
+            {
+                error = $"You do not have permission to access one or more of the specified columns for the {operation} operation on this entity.";
+                return false;
+            }
+
+            return true;
+        }
     }
 }

src/Service.Tests/Mcp/CreateRecordToolMsSqlIntegrationTests.cs

@@ -138,6 +138,72 @@ public async Task CreateRecord_MissingRequiredField_ReturnsError()
 
         #endregion
 
+        #region Column-Level Authorization Tests
+
+        /// <summary>
+        /// Regression test for column-level authorization bypass in create_record.
+        /// A role holding CREATE permission on the entity, but with a column explicitly
+        /// excluded via fields.exclude, must be denied when supplying a value for that column
+        /// even though the operation itself is authorized. Fails pre-fix, passes post-fix.
+        /// </summary>
+        [TestMethod]
+        public async Task CreateRecord_ExcludedColumn_ReturnsPermissionDenied()
+        {
+            var data = new Dictionary<string, object>
+            {
+                { "title", "Should Not Be Created" },
+                { "publisher_id", 1234 }
+            };
+
+            IServiceProvider serviceProvider = BuildMutationServiceProvider(role: "test_role_with_excluded_fields_on_mutation");
+            CreateRecordTool tool = new();
+
+            var args = new Dictionary<string, object?>
+            {
+                { "entity", "Book" },
+                { "data", data }
+            };
+
+            CallToolResult result = await ExecuteToolAsync(tool, serviceProvider, args);
+
+            AssertError(result, "permission",
+                "CreateRecord should deny writes to columns excluded for the caller's role, even though " +
+                "the role holds CREATE permission on the entity.");
+        }
+
+        /// <summary>
+        /// Sanity check accompanying <see cref="CreateRecord_ExcludedColumn_ReturnsPermissionDenied"/>:
+        /// the same restricted role must still be able to create a record when it only supplies
+        /// columns it is permitted to write.
+        /// </summary>
+        [TestMethod]
+        public async Task CreateRecord_AllowedColumnsOnly_WithColumnRestrictedRole_ReturnsSuccess()
+        {
+            var data = new Dictionary<string, object>
+            {
+                { "title", "Allowed Column Only Book" }
+            };
+
+            IServiceProvider serviceProvider = BuildMutationServiceProvider(role: "test_role_with_excluded_fields_on_mutation");
+            CreateRecordTool tool = new();
+
+            var args = new Dictionary<string, object?>
+            {
+                { "entity", "Book" },
+                { "data", data }
+            };
+
+            CallToolResult result = await ExecuteToolAsync(tool, serviceProvider, args);
+
+            AssertSuccess(result, "CreateRecord should succeed when only permitted columns are supplied.");
+
+            JsonElement root = ParseResultRoot(result);
+            int createdId = ExtractCreatedBookId(root);
+            await DeleteTestBook(createdId);
+        }
+
+        #endregion
+
         #region Helpers
 
         private static async Task<CallToolResult> ExecuteCreateAsync(string entity, Dictionary<string, object> data)

src/Service.Tests/Mcp/McpToolTestBase.cs

@@ -92,7 +92,12 @@ protected static IServiceProvider BuildQueryServiceProvider()
         /// Includes: RuntimeConfigProvider, IMetadataProviderFactory, IAuthorizationResolver,
         /// IHttpContextAccessor, IMutationEngineFactory, RequestValidator.
         /// </summary>
-        protected static IServiceProvider BuildMutationServiceProvider()
+        /// <param name="role">
+        /// Client role header value to use for the request. Defaults to the anonymous role.
+        /// Pass a custom role (already defined in the test config's permissions) to exercise
+        /// role-specific and column-level authorization scenarios.
+        /// </param>
+        protected static IServiceProvider BuildMutationServiceProvider(string role = AuthorizationResolver.ROLE_ANONYMOUS)
         {
             ServiceCollection services = new();
 
@@ -102,7 +107,7 @@ protected static IServiceProvider BuildMutationServiceProvider()
             services.AddSingleton(_metadataProviderFactory.Object);
             services.AddSingleton(_authorizationResolver);
 
-            IHttpContextAccessor httpContextAccessor = CreateAnonymousHttpContextAccessor();
+            IHttpContextAccessor httpContextAccessor = CreateHttpContextAccessorForRole(role);
             services.AddSingleton(httpContextAccessor);
 
             services.AddSingleton(new RequestValidator(_metadataProviderFactory.Object, configProvider));
@@ -153,14 +158,23 @@ protected static IServiceProvider BuildMutationServiceProvider()
         /// Creates an HttpContextAccessor with anonymous role claims for MCP tool testing.
         /// </summary>
         protected static IHttpContextAccessor CreateAnonymousHttpContextAccessor()
+        {
+            return CreateHttpContextAccessorForRole(AuthorizationResolver.ROLE_ANONYMOUS);
+        }
+
+        /// <summary>
+        /// Creates an HttpContextAccessor with the given role set as both the client role header
+        /// and a matching role claim, for exercising role-specific MCP tool authorization scenarios.
+        /// </summary>
+        protected static IHttpContextAccessor CreateHttpContextAccessorForRole(string role)
         {
             DefaultHttpContext httpContext = new();
-            httpContext.Request.Headers[AuthorizationResolver.CLIENT_ROLE_HEADER] = AuthorizationResolver.ROLE_ANONYMOUS;
+            httpContext.Request.Headers[AuthorizationResolver.CLIENT_ROLE_HEADER] = role;
             ClaimsIdentity identity = new(
                 authenticationType: "TestAuth",
                 nameType: null,
                 roleType: AuthenticationOptions.ROLE_CLAIM_TYPE);
-            identity.AddClaim(new Claim(AuthenticationOptions.ROLE_CLAIM_TYPE, AuthorizationResolver.ROLE_ANONYMOUS));
+            identity.AddClaim(new Claim(AuthenticationOptions.ROLE_CLAIM_TYPE, role));
             httpContext.User = new ClaimsPrincipal(identity);
             return new HttpContextAccessor { HttpContext = httpContext };
         }

src/Service.Tests/Mcp/UpdateRecordToolMsSqlIntegrationTests.cs

@@ -158,6 +158,81 @@ public async Task UpdateRecord_NullKeyValue_ReturnsError()
 
         #endregion
 
+        #region Column-Level Authorization Tests
+
+        /// <summary>
+        /// Regression test for column-level authorization bypass in update_record.
+        /// A role holding UPDATE permission on the entity, but with a column explicitly
+        /// excluded via fields.exclude, must be denied when supplying a value for that column
+        /// even though the operation itself is authorized. Fails pre-fix, passes post-fix.
+        /// </summary>
+        [TestMethod]
+        public async Task UpdateRecord_ExcludedColumn_ReturnsPermissionDenied()
+        {
+            int createdId = await CreateBookForUpdate("Book For Column Auth Test");
+            try
+            {
+                var keys = new Dictionary<string, object> { { "id", createdId } };
+                var fields = new Dictionary<string, object> { { "publisher_id", 9999 } };
+
+                IServiceProvider serviceProvider = BuildMutationServiceProvider(role: "test_role_with_excluded_fields_on_mutation");
+                UpdateRecordTool tool = new();
+
+                var args = new Dictionary<string, object?>
+                {
+                    { "entity", "Book" },
+                    { "keys", keys },
+                    { "fields", fields }
+                };
+
+                CallToolResult result = await ExecuteToolAsync(tool, serviceProvider, args);
+
+                AssertError(result, "permission",
+                    "UpdateRecord should deny writes to columns excluded for the caller's role, even though " +
+                    "the role holds UPDATE permission on the entity.");
+            }
+            finally
+            {
+                await DeleteBook(createdId);
+            }
+        }
+
+        /// <summary>
+        /// Sanity check accompanying <see cref="UpdateRecord_ExcludedColumn_ReturnsPermissionDenied"/>:
+        /// the same restricted role must still be able to update a record when it only supplies
+        /// columns it is permitted to write.
+        /// </summary>
+        [TestMethod]
+        public async Task UpdateRecord_AllowedColumnsOnly_WithColumnRestrictedRole_ReturnsSuccess()
+        {
+            int createdId = await CreateBookForUpdate("Book For Allowed Column Update Test");
+            try
+            {
+                var keys = new Dictionary<string, object> { { "id", createdId } };
+                var fields = new Dictionary<string, object> { { "title", "Updated By Restricted Role" } };
+
+                IServiceProvider serviceProvider = BuildMutationServiceProvider(role: "test_role_with_excluded_fields_on_mutation");
+                UpdateRecordTool tool = new();
+
+                var args = new Dictionary<string, object?>
+                {
+                    { "entity", "Book" },
+                    { "keys", keys },
+                    { "fields", fields }
+                };
+
+                CallToolResult result = await ExecuteToolAsync(tool, serviceProvider, args);
+
+                AssertSuccess(result, "UpdateRecord should succeed when only permitted columns are supplied.");
+            }
+            finally
+            {
+                await DeleteBook(createdId);
+            }
+        }
+
+        #endregion
+
         #region Helpers
 
         private static async Task<CallToolResult> ExecuteUpdateAsync(

src/Service.Tests/dab-config.MsSql.json

@@ -936,6 +936,33 @@
             }
           ]
         },
+        {
+          "role": "test_role_with_excluded_fields_on_mutation",
+          "actions": [
+            {
+              "action": "read"
+            },
+            {
+              "action": "create",
+              "fields": {
+                "exclude": [
+                  "publisher_id"
+                ]
+              }
+            },
+            {
+              "action": "update",
+              "fields": {
+                "exclude": [
+                  "publisher_id"
+                ]
+              }
+            },
+            {
+              "action": "delete"
+            }
+          ]
+        },
         {
           "role": "role_multiple_create_policy_tester",
           "actions": [