[Bug]: Cannot filter with custom role (access forbidden...) about data-api-builder HOT 3 OPEN

When you are adding a filter to your GraphQL request, you will be subject to the permissions set for the given entity. Your example role, role-A, must be defined on the entity you are querying against.

Note that DAB does not perform role inheritance. The entity definition in the dab-config.json must include a permission which defines the role role-A and the associated permissions. Based on that requirement, I'm classifying this as a feature request for now.

To help us best understand your ask: please add a minimum reproducible example with:

1. Applicable dab-config.json (specifically, the configuration for your target entity)
2. Database schema (specific table/sample data)
3. Applicable GraphQL request (You already noted a x-ms-api-role header value)

from data-api-builder.

Hi, the actual behavior is not consistent.

if you have entity-a that only define one permission: anonymous read access. Why can you query that entity with role-a even if that role is not defined at the entity level? If you have access to the fields of that entity from role-a, why can't you filter on the fields you have access to?

I'm not opposed to define role-a for all entities in our environment but everything is automated with dab cli and the cli doesn't permits to define multiple permissions by entity. Do you have any advise about how to handle this?

from data-api-builder.

Here is an example. The attributes entity below only defines the anonymous role.
Why can I query the attributes entity and read the values of all fields when the query is executing under the role-a but I can't filter on the same fields? The engine should have a consistent behavior in term of access permission. If I have access to the fields I should be able to filter on them.

    "Attributes": {
      "source": {
        "object": "xxx",
        "type": "table",
        "key-fields": [
          "id"
        ]
      },
...
      "permissions": [
        {
          "role": "anonymous",
          "actions": [
            {
              "action": "read",
            }
          ]
        }

this kind of query works under role-a even if attributes doesn't define any access for role-a. Is it the expected behavior?

query
{
  attributes
  {
    items
    {
      id
    }
  }
}

my X-MS-CLIENT-PRINCIPAL looks like this:

{
  "userId": "xxx",
  "userRoles": [
    "anonymous",
    "authenticated",
    "role-a"
  ],
  "identityProvider": "xxx"
}

and X-MS-API-ROLE = role-a.

from data-api-builder.