Insufficient Permissions with resourceTokens for multiple partitions

• Package Name: @azure/cosmos
• Package Version: 3.9.3
• Operating system: Windows 10
• nodejs
  • version: v14.15.0
• browser
  • name/version: Chrome/86.0.4240.183
• typescript
  • version: 3.9.7
• Is the bug related to documentation in
  • README.md
  • source code documentation
  • SDK API docs on https://docs.microsoft.com

Describe the bug Queries against a database will fail with Error 403 Insufficient permissions provided in the authorization header for the corresponding request. when the user authenticates using a permission that grants access to multiple partition keys for a given container.

Limiting the query to the valid partition keys, either via the FeedOptions (which only allows one key and fails otherwise), or the query, does not get rid of this issue.

To Reproduce Steps to reproduce the behavior:

1. Create a user with a permission for a container including multiple partition keys
2. Try to query the data with the given permission, for example:

SELECT *
FROM c
WHERE c.partitionKey="someValue"

Expected behavior There has to be a way for a query to be limited to the allowed scope. For example via the query directly or as the partitionKey parameter within the FeedOptions

[ranrolls]

Need to know how permission token can be used to access all docs in collection

https://github.com/Azure/azure-sdk-for-js/issues/4972#issuecomment-1002887905

[zfoster]

@joeyboey unfortunately in the SDK there isn’t a way to pass all of those resource tokens. However, for querying, what you could do is create all of those permissions and make an object of them, then use tokenProvider on the client (allows you to provide the token per request via a callback function.

const tokens = {
  collectionId1: {
    partitionkey1: "token",
    partitionkey2: "token2"
  }
};
 
// Note: This is probably more complex
function getToken(collectionId, partitionkey) {
  return tokens[collectionId][partitionkey];
}
 
// Use only for queries
const queryClient = new CosmosClient({
  endpoint: "foo",
  key: "foo",
  tokenProvider: request => {
    const partitionKey = request.headers["x-ms-partitonkey"]; // comes in header form, needs to be extracted, e.g., "["partitionKey1"]"
    return getToken(request.resourceId, partitionKey);
  }
});

You would also need to extract the partition key from the header. This is somewhat cumbersome, but might work for your use case. Our resource token model isn’t great right now.