[GraphQL] Updates to Stored Procedure support for Engine

Summary

Add a new execute permission to make it easier to publish stored procedures

Motivation

Supporting Stored Procedure execution via methods other than POST for REST and Queries for GraphQL creates some confusion on how permissions are defined and also it leads to a potential break of best practices regarding the idempotency of non-POST methods.

Functional Specification

To best support Stored Procedure in Data API Builder, we may want to introduce a new action, named execute that

• can be used only if the published object is a stored procedure
• must be the only action defined in a role
• REST: will be mapped to the POST method by default
• GraphQL: will generate a Mutation by default

Users will be able to decide if they want to use another method other than POST and generating a Query instead of a Mutation by defining their preference using the rest or graphql objects that are optionally available withing the entity object. For example:

"GetCowrittenBooksByAuthor": {      
  "source": {
	"type": "stored-procedure",
	"object": "dbo.stp_get_all_cowritten_books_by_author",
	"parameters": {
	  "author": "?",
	  "searchType": "c"
	}
  }, 
  "graphql":{
	"operation": "mutation" 
  },
  "rest": {
	"method": ["GET"]
  },           
  "permissions": [
	{
	  "role": "anonymous",
	  "actions": [ "execute" ]
	}
  ]
}

With this approach we can provide developers the best behaviour by default, but let them decide what is best for them if they need to depart from the best practices for any reasons.

References

[GraphQL] Stored Procedure support for Engine [REST] Update/Create is breaking with Single Permission Support stored procedure Behavior of Update Action for Stored-Procedures in CLI

[Aniruddh25]

"rest": {
	"method": "GET"
  }
"

Shouldn’t method here be an array? To enable multiple methods for the same stored procedure if the developer so chooses?

[Aniruddh25]

Do we want to have the following restrictions for the operations defined for an Stored Procedures REST/GraphQL operations?

Key:

• Columns = GraphQL
• Rows = REST

Query Mutation GET X POST X PUT X PATCH X DELETE X e.g. If GraphQL operation is mutation, REST operation cannot be GET.

If the developer is explicitly configuring REST method to be GET, and specifies nothing for GraphQL, they will end up in a situation where default is picked for GraphQL which is mutation. If we restrict this, the developer has to modify the config file, to override the default operation for GraphQL to be query, which seems additional overhead if I am only using REST. I dont think we should restrict if they configure incompatible REST/GraphQL operations - the fact that they override the defaults means they understand what they are doing so we rely on what they have specified.