Getting Access forbidden message when trying to use filter on graphql queries

Discussed in https://github.com/Azure/data-api-builder/discussions/1423

<div type='discussions-op-text'>

^{Originally posted by sumchans April 7, 2023} I have been trying out the data api builder for azure cosmos db and so far was successfully able to pull data from Azure Cosmos db. The issue I am having now is, when I use filter on the queries I get “Access forbidden to a field referenced in the filter.” I believe this has something to do configuring the permissions on the dab-config.json, but I am not able to get a head start so far on this.

Here is my query -

query filteritems {
    items(filter: { userPhoneNumber: { contains: "4160000000" } }) {
        items {
            partitionKey
            userPhoneNumber
            userDisplayName
        }
    }
}

Here is the result -

{
  "errors": [
    {
      "message": "Access forbidden to a field referenced in the filter.",
      "extensions": {
        "code": "AuthorizationCheckFailed"
      }
    }
  ]
}

Also attaching my dab-config json file -

{
  "$schema": "https://github.com/Azure/data-api-builder/releases/download/v0.6.13/dab.draft.schema.json",
  "data-source": {
    "database-type": "cosmosdb_nosql",
    "options": {
      "database": "Database",
      "schema": "schema.gql"
    },
    "connection-string": "connection-string;"
  },
  "runtime": {
    "graphql": {
      "allow-introspection": true,
      "enabled": true,
      "path": "/graphql"
    },
    "host": {
      "mode": "development",
      "cors": {
        "origins": [],
        "allow-credentials": false
      },
      "authentication": {
        "provider": "StaticWebApps"
      }
    }
  },
  "entities": {
    "Item": {
      "source": "Items",
      "graphql": true,
      "permissions": [
        {
          "role": "anonymous",
          "actions": [
            "*"
          ],
          "fields": {
            "include": [
              "*"
            ]
          }
        }
      ]
    }
  }
}

</div>

i have tried changing the configation and types of permissions but it looks like something broken between the current build (0.6.13) and the previous (0.35.5).

the stacktrace shows

[dataApi] info: Microsoft.AspNetCore.Hosting.Diagnostics[1]
[dataApi]       Request starting HTTP/1.1 POST http://localhost:4280/graphql application/json 247
[dataApi] info: Microsoft.AspNetCore.Routing.EndpointMiddleware[0]
[dataApi]       Executing endpoint 'Hot Chocolate GraphQL Pipeline'
[dataApi] fail: Azure.DataApiBuilder.Service.Startup[0]
[dataApi]       Access forbidden to a field referenced in the filter.
[dataApi] fail: Azure.DataApiBuilder.Service.Startup[0]
[dataApi]          at Azure.DataApiBuilder.Service.Models.GQLFilterParser.Parse(IMiddlewareContext ctx, IInputField filterArgumentSchema, List`1 fields, BaseQueryStructure queryStructure) in /_/src/Service/Models/GraphQLFilterParsers.cs:line 159   
[dataApi]          at Azure.DataApiBuilder.Service.Resolvers.CosmosQueryStructure.Init(IDictionary`2 queryParams) in /_/src/Service/Resolvers/CosmosQueryStructure.cs:line 160
[dataApi]          at Azure.DataApiBuilder.Service.Resolvers.CosmosQueryEngine.ExecuteAsync(IMiddlewareContext context, IDictionary`2 parameters) in /_/src/Service/Resolvers/CosmosQueryEngine.cs:line 64
[dataApi]          at Azure.DataApiBuilder.Service.Services.ResolverMiddleware.InvokeAsync(IMiddlewareContext context) in /_/src/Service/Services/ResolverMiddleware.cs:line 95
[dataApi]          at HotChocolate.Utilities.MiddlewareCompiler`1.ExpressionHelper.AwaitTaskHelper(Task task)
[dataApi]          at HotChocolate.Execution.Processing.Tasks.ResolverTask.ExecuteResolverPipelineAsync(CancellationToken cancellationToken)
[dataApi]          at HotChocolate.Execution.Processing.Tasks.ResolverTask.TryExecuteAsync(CancellationToken cancellationToken)
[dataApi] info: Microsoft.AspNetCore.Routing.EndpointMiddleware[1]
[dataApi]       Executed endpoint 'Hot Chocolate GraphQL Pipeline'
[dataApi] info: Microsoft.AspNetCore.Hosting.Diagnostics[2]
[dataApi]       Request finished HTTP/1.1 POST http://localhost:4280/graphql application/json 247 - 500 - application/json;+charset=utf-8 864.3125ms

the code is not picking up any of the permissions (not explicit, not * and not if left empty) always returning false from this line

https://github.com/Azure/data-api-builder/blob/893f5039432087ab382deef81ff83bf4380df393/src/Service/Models/GraphQLFilterParsers.cs#L151

if i revert to previous version, the exact same definition works fine.

[dgcaron]

this looks fine to me, with my current configuration

[Aniruddh25]

Thanks @dgcaron and @ksdaniel for reporting the issue! Really appreciate it.

0.7.5 is now marked our pre-release version for the upcoming new features. SWA CLI/Azure SWA database connections feature should still continue to work. They will not be updated unless we have the next stable dab version.