Getting Access forbidden message when trying to use filter on graphql queries

[sumchans]

I have been trying out the data api builder for azure cosmos db and so far was successfully able to pull data from Azure Cosmos db. The issue I am having now is, when I use filter on the queries I get "Access forbidden to a field referenced in the filter." I believe this has something to do configuring the permissions on the dab-config.json, but I am not able to get a head start so far on this.

Here is my query -

query filteritems {
    items(filter: { userPhoneNumber: { contains: "4160000000" } }) {
        items {
            partitionKey
            userPhoneNumber
            userDisplayName
        }
    }
}

Here is the result -

{
  "errors": [
    {
      "message": "Access forbidden to a field referenced in the filter.",
      "extensions": {
        "code": "AuthorizationCheckFailed"
      }
    }
  ]
}

Also attaching my dab-config json file -

{
  "$schema": "https://github.com/Azure/data-api-builder/releases/download/v0.6.13/dab.draft.schema.json",
  "data-source": {
    "database-type": "cosmosdb_nosql",
    "options": {
      "database": "Database",
      "schema": "schema.gql"
    },
    "connection-string": "connection-string;"
  },
  "runtime": {
    "graphql": {
      "allow-introspection": true,
      "enabled": true,
      "path": "/graphql"
    },
    "host": {
      "mode": "development",
      "cors": {
        "origins": [],
        "allow-credentials": false
      },
      "authentication": {
        "provider": "StaticWebApps"
      }
    }
  },
  "entities": {
    "Item": {
      "source": "Items",
      "graphql": true,
      "permissions": [
        {
          "role": "anonymous",
          "actions": [
            "*"
          ],
          "fields": {
            "include": [
              "*"
            ]
          }
        }
      ]
    }
  }
}

[dgcaron]

i am actually running into this to right now, and it looks like it is related to some update as the code i have worked perfectly fine before. (as in last wednesday).

[sumchans]

Oh is it. Has this been created as an issue?

[seantleonard]

I'm taking a look at this. It looks like it may be how field.include.* is resolved (or lack thereof) for Cosmos.

[sumchans]

Okay thanks @seantleonard

[sumchans]

@seantleonard Any idea when I would be able to hear more about this issue? I am currently blocked on my project.

[dgcaron]

Are you using the database connection for Azure static webapps or are you hosting it in another way. Can you try running it with the previous version and not the latest?

[sumchans]

Right now I am calling the API through Postman. In the future this will connected to a mobile app. How do I run it using the previous version?

[Aniruddh25]

hi @sumchans , you can install the previous version by specifying the version number in dotnet tool install:

dotnet tool install --global Microsoft.DataApiBuilder --version 0.5.35

[sumchans]

Thanks @Aniruddh25 I just tested out with the previous version and I was able to filter items.

[Aniruddh25]

@sumchans, Please do note we still don't have field level AuthZ policy support for CosmosDB tracked by #597.
So, you can continue to use it for anonymous users, but not for authenticated users if your application requires that kind of support.

[sumchans]

Got it. Thanks @Aniruddh25

[sumchans]

Got it thanks @anirudh Get Outlook for Android<https://aka.ms/AAb9ysg>

…

________________________________ From: Aniruddh Munde ***@***.***> Sent: Tuesday, April 11, 2023 9:47:53 PM To: Azure/data-api-builder ***@***.***> Cc: Sumesh Chandran ***@***.***>; Mention ***@***.***> Subject: Re: [Azure/data-api-builder] Getting Access forbidden message when trying to use filter on graphql queries (Discussion #1423) Do note we still don't have field level AuthZ policy support for CosmosDB tracked by #597<#597>. So, you can continue to use it for anonymous users, but not for authenticated users if your application requires that kind of support. — Reply to this email directly, view it on GitHub<#1423 (reply in thread)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AH74BQ6TWUZEUWH5NNU6AZLXAYXXTANCNFSM6AAAAAAWWD7LVI>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[dgcaron]

i have promoted this discussion to an issue as there seems no way around this for cosmosdb with the latest version #1434

for people using the data-api for azure static webapps, you can still develop locally by installing the 0.35.5 version

dotnet tool install --global Microsoft.DataApiBuilder --version 0.5.35

and then run it from the swa-db-connections

dab start --config staticwebapp.database.config.json

and then use the data-api-url option of the swa cli

swa start ./dist  --data-api-devserver-url http://localhost:5000

[tarazou9]

Thank you for pointing this out and bringing this to our attention! We just had a PR merged for addressing this issue #1436. We will have this change included in the next release.

[dgcaron]

i believe a fix has been rolled out to static web apps (at least to my instance it seems)

[joeljeffery]

That is tremendous news.

[Aniruddh25]

@joeljeffery We absolutely understand the need for urgency, we were still in the process of identifying the right hot patch, apologies for the perceived delay. But rest assured, if such a scenario happens again, it will be mitigated in a reasonable timeframe.

[joeljeffery]

Thank you @Aniruddh25, I appreciate the response.

[tarazou9]

Hey Folks, sorry for the inconvenience, a couple of things that we have addressed and are addressing are as below.

• New DAB release with a mitigation for this issue has now published, this should allow the query filter works for Cosmos. This patch will includes a check to enforce that the runtime config doesn't contain field permissions. So the recommendation is not to have field permissions in the config until the fix for that is ready.
• For connections through Static Web Apps, we have rolled back to the previous version of DAB engine and it should work as how it was working earlier.
• We are actively working on getting in the changes to fix the field level auth support issues, which will be ready in couple of weeks.

For example,

"permissions": [
        {
          "role": "anonymous",
          "actions": [
            "create",
-  {
- "action": "read",
- "fields": {
- "include": [
- "*"
-  ],
- "exclude": []
- }
- },
+ "read",
            "update",
            "delete"
          ]
        }
      ]