Remove Unused code path in SqlQueryStructure
See original GitHub issueIssue
Tests like those in ODataASTVisitorUnitTests fail because the integration test fixture does not take authorization into consideration. These tests need to be updated.
Background
SqlQueryStructure handling REST requests checks if Columns.Count == 0
here:
https://github.com/Azure/hawaii-gql/blob/38588fc1496f82299dfa067744db5fcc2c5d062e/DataGateway.Service/Resolvers/Sql Query Structures/SqlQueryStructure.cs#L134-L141
And proceeds to add all columns from the table definition as “FieldsToBeReturned” in the results. This code path will not be reached in production code with Authorization mechanics in place. The behavior with authorization is that, for Find Requests, the results will only contain fields that the request is allowed to access.
For example, consider the following permissions config:
{
"Book": {
"source": "books",
"permissions": [
{
"role": "Author",
"actions": [
{
"action": "read",
"fields": {
"include": [ "*" ],
"exclude": [ "publisher_id" ]
}
}
]
}
],
"relationships": {
}
}
}
and REST Request: http://localhost:5001/rest/book/id/8
the expected result does not include the publisher_id
field:
{
"value": [
{
"id": 8,
"title": "Time to Eat"
}
]
}
Issue Analytics
- State:
- Created a year ago
- Comments:10 (10 by maintainers)
Top GitHub Comments
@ayush3797, can you reevaluate now that REST API test refactor is merged?
Yes, that was a bug. However, in the PR https://github.com/Azure/data-api-builder/pull/953, the code block is removed so the bug and the code block is no more relevant.