Overhaul of config system

.gitattributes

@@ -11,3 +11,7 @@
 # Force bash scripts to always use LF line endings so that if a repo is accessed
 # in Unix via a file share from Windows, the scripts will work.
 *.sh text eol=lf
+
+*.verified.txt text eol=lf working-tree-encoding=UTF-8
+*.verified.xml text eol=lf working-tree-encoding=UTF-8
+*.verified.json text eol=lf working-tree-encoding=UTF-8

.gitignore

@@ -35,3 +35,6 @@ dab-config*.json
 
 # Local-Only files
 .env
+
+# Verify test files
+*.received.*

.pipelines/build-pipelines.yml

@@ -28,6 +28,7 @@ variables:
   patch: $[counter(format('{0}_{1}', variables['build.reason'], variables['minor']), 0)]
   isReleaseBuild: $(isNugetRelease)
   additionalProperties.version: 'https://github.com/Azure/data-api-builder/releases/download/v$(major).$(minor).$(patch)/dab.draft.schema.json'
+  SNAPSHOOTER_STRICT_MODE: true
 
 steps:
 - task: NuGetAuthenticate@1
@@ -90,6 +91,30 @@ steps:
     projects: '**/*Tests*.csproj'
     arguments: '--filter "TestCategory!=CosmosDb_NoSql&TestCategory!=MsSql&TestCategory!=PostgreSql&TestCategory!=MySql" --configuration $(buildConfiguration) --collect "XPlat Code coverage"'
 
+- task: CmdLine@2
+  displayName: 'Set flag to publish Verify *.received files when tests fail'
+  condition: failed()
+  inputs:
+    script: 'echo ##vso[task.setvariable variable=publishverify]Yes'
+
+- task: CopyFiles@2
+  condition: eq(variables['publishverify'], 'Yes')
+  displayName: 'Copy received files to Artifact Staging'
+  inputs:
+    contents: '**\*.received.*' 
+    targetFolder: '$(Build.ArtifactStagingDirectory)\Verify'
+    cleanTargetFolder: true
+    overWrite: true
+
+- task: PublishBuildArtifacts@1
+  displayName: 'Publish received files as Artifacts'
+  name: 'verifypublish'
+  condition: eq(variables['publishverify'], 'Yes')
+  inputs:
+    PathtoPublish: '$(Build.ArtifactStagingDirectory)\Verify'
+    ArtifactName: 'Verify'
+    publishLocation: 'Container'
+
 - task: [email protected]
   displayName: 'Version stamp dab.draft.schema.json'
   inputs:

.pipelines/cosmos-pipelines.yml

@@ -71,6 +71,30 @@ steps:
     arguments: '--filter "TestCategory=CosmosDb_NoSql" --no-build --configuration $(buildConfiguration) $(ADDITIONAL_TEST_ARGS)'
     projects: '**/*Tests/*.csproj'
 
+- task: CmdLine@2
+  displayName: 'Set flag to publish Verify *.received files when tests fail'
+  condition: failed()
+  inputs:
+    script: 'echo ##vso[task.setvariable variable=publishverify]Yes'
+
+- task: CopyFiles@2
+  condition: eq(variables['publishverify'], 'Yes')
+  displayName: 'Copy received files to Artifact Staging'
+  inputs:
+    contents: '**\*.received.*' 
+    targetFolder: '$(Build.ArtifactStagingDirectory)\Verify'
+    cleanTargetFolder: true
+    overWrite: true
+
+- task: PublishBuildArtifacts@1
+  displayName: 'Publish received files as Artifacts'
+  name: 'verifypublish'
+  condition: eq(variables['publishverify'], 'Yes')
+  inputs:
+    PathtoPublish: '$(Build.ArtifactStagingDirectory)\Verify'
+    ArtifactName: 'Verify'
+    publishLocation: 'Container'
+
 # '/XPlat Code coverage --results-directory /home/vsts/work/1/s/TestResults/'
 - task: PublishCodeCoverageResults@1
   displayName: 'Publish code coverage'

.pipelines/mssql-pipelines.yml

@@ -78,6 +78,30 @@ jobs:
       arguments: '--filter "TestCategory=MsSql" --no-build --configuration $(buildConfiguration) --collect "XPlat Code coverage"'
       projects: '**/*Tests/*.csproj'
 
+  - task: CmdLine@2
+    displayName: 'Set flag to publish Verify *.received files when tests fail'
+    condition: failed()
+    inputs:
+      script: 'echo ##vso[task.setvariable variable=publishverify]Yes'
+
+  - task: CopyFiles@2
+    condition: eq(variables['publishverify'], 'Yes')
+    displayName: 'Copy received files to Artifact Staging'
+    inputs:
+      contents: '**\*.received.*' 
+      targetFolder: '$(Build.ArtifactStagingDirectory)\Verify'
+      cleanTargetFolder: true
+      overWrite: true
+
+  - task: PublishBuildArtifacts@1
+    displayName: 'Publish received files as Artifacts'
+    name: 'verifypublish'
+    condition: eq(variables['publishverify'], 'Yes')
+    inputs:
+      PathtoPublish: '$(Build.ArtifactStagingDirectory)\Verify'
+      ArtifactName: 'Verify'
+      publishLocation: 'Container'
+
   - task: PublishCodeCoverageResults@1
     displayName: 'Publish code coverage'
     inputs:
@@ -101,6 +125,12 @@ jobs:
       SqlVersionCode: '15.0'
 
   steps:
+  - task: CmdLine@2
+    displayName: 'Set flag to publish received files when previous step fails'
+    condition: failed()
+    inputs:
+      script: 'echo ##vso[task.setvariable variable=publishverify]Yes'
+
   - task: NuGetAuthenticate@0
     displayName: 'NuGet Authenticate'
 
@@ -168,3 +198,21 @@ jobs:
     inputs:
       codeCoverageTool: Cobertura
       summaryFileLocation: '$(Agent.TempDirectory)/**/*cobertura.xml'
+
+  - task: CopyFiles@2
+    condition: eq(variables['publishverify'], 'Yes')
+    displayName: 'Copy received files to Artifact Staging'
+    inputs:
+      contents: '**\*.received.*' 
+      targetFolder: '$(Build.ArtifactStagingDirectory)\Verify'
+      cleanTargetFolder: true
+      overWrite: true
+
+  - task: PublishBuildArtifacts@1
+    displayName: 'Publish received files as Artifacts'
+    name: 'verifypublish'
+    condition: eq(variables['publishverify'], 'Yes')
+    inputs:
+      PathtoPublish: '$(Build.ArtifactStagingDirectory)\Verify'
+      ArtifactName: 'Verify'
+      publishLocation: 'Container'

.pipelines/mysql-pipelines.yml

@@ -77,6 +77,30 @@ jobs:
       arguments: '--filter "TestCategory=MySql" --no-build --configuration $(buildConfiguration) --collect "XPlat Code coverage"'
       projects: '**/*Tests/*.csproj'
 
+  - task: CmdLine@2
+    displayName: 'Set flag to publish Verify *.received files when tests fail'
+    condition: failed()
+    inputs:
+      script: 'echo ##vso[task.setvariable variable=publishverify]Yes'
+
+  - task: CopyFiles@2
+    condition: eq(variables['publishverify'], 'Yes')
+    displayName: 'Copy received files to Artifact Staging'
+    inputs:
+      contents: '**\*.received.*' 
+      targetFolder: '$(Build.ArtifactStagingDirectory)\Verify'
+      cleanTargetFolder: true
+      overWrite: true
+
+  - task: PublishBuildArtifacts@1
+    displayName: 'Publish received files as Artifacts'
+    name: 'verifypublish'
+    condition: eq(variables['publishverify'], 'Yes')
+    inputs:
+      PathtoPublish: '$(Build.ArtifactStagingDirectory)\Verify'
+      ArtifactName: 'Verify'
+      publishLocation: 'Container'
+
   - task: PublishCodeCoverageResults@1
     displayName: 'Publish code coverage'
     inputs:

.pipelines/pg-pipelines.yml

@@ -72,6 +72,30 @@ jobs:
       arguments: '--filter "TestCategory=PostgreSql" --no-build --configuration $(buildConfiguration) --collect "XPlat Code coverage"'
       projects: '**/*Tests/*.csproj'
 
+  - task: CmdLine@2
+    displayName: 'Set flag to publish Verify *.received files when tests fail'
+    condition: failed()
+    inputs:
+      script: 'echo ##vso[task.setvariable variable=publishverify]Yes'
+
+  - task: CopyFiles@2
+    condition: eq(variables['publishverify'], 'Yes')
+    displayName: 'Copy received files to Artifact Staging'
+    inputs:
+      contents: '**\*.received.*' 
+      targetFolder: '$(Build.ArtifactStagingDirectory)\Verify'
+      cleanTargetFolder: true
+      overWrite: true
+
+  - task: PublishBuildArtifacts@1
+    displayName: 'Publish received files as Artifacts'
+    name: 'verifypublish'
+    condition: eq(variables['publishverify'], 'Yes')
+    inputs:
+      PathtoPublish: '$(Build.ArtifactStagingDirectory)\Verify'
+      ArtifactName: 'Verify'
+      publishLocation: 'Container'
+
   - task: PublishCodeCoverageResults@1
     displayName: 'Publish code coverage'
     inputs:

config-generators/mssql-commands.txt

@@ -172,4 +172,4 @@ update Stock --config "dab-config.MsSql.json" --permissions "database_policy_tes
 update series --config "dab-config.MsSql.json" --permissions "TestNestedFilterManyOne_ColumnForbidden:read" --fields.exclude "name"
 update series --config "dab-config.MsSql.json" --permissions "TestNestedFilterManyOne_EntityReadForbidden:create,update,delete"
 update series --config "dab-config.MsSql.json" --permissions "TestNestedFilterOneMany_ColumnForbidden:read"
-update series --config "dab-config.MsSql.json" --permissions "TestNestedFilterOneMany_EntityReadForbidden:read"
+update series --config "dab-config.MsSql.json" --permissions "TestNestedFilterOneMany_EntityReadForbidden:read"

src/.editorconfig

@@ -473,3 +473,12 @@ dotnet_diagnostic.CA1051.severity = suggestion
 # copyright header
 file_header_template = Copyright (c) Microsoft Corporation.\nLicensed under the MIT License.
 
+# Verify settings
+[*.{received,verified}.{txt,xml,json}]
+charset = "utf-8-bom"
+end_of_line = lf
+indent_size = unset
+indent_style = unset
+insert_final_newline = false
+tab_width = unset
+trim_trailing_whitespace = false

src/Auth/AuthorizationMetadataHelpers.cs

@@ -1,7 +1,7 @@
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT License.
 
-using Azure.DataApiBuilder.Config;
+using Azure.DataApiBuilder.Config.ObjectModel;
 
 namespace Azure.DataApiBuilder.Auth
 {
@@ -29,25 +29,19 @@ public class EntityMetadata
         ///     Create: permitted in {Role1, Role2, ..., RoleN}
         ///     Delete: permitted in {Role1, RoleN}
         /// </summary>
-        public Dictionary<string, Dictionary<Operation, List<string>>> FieldToRolesMap { get; set; } = new();
+        public Dictionary<string, Dictionary<EntityActionOperation, List<string>>> FieldToRolesMap { get; set; } = new();
 
         /// <summary>
         /// Given the key (operation) returns a collection of roles
         /// defining config permissions for the operation.
         /// i.e. Read operation is permitted in {Role1, Role2, ..., RoleN}
         /// </summary>
-        public Dictionary<Operation, List<string>> OperationToRolesMap { get; set; } = new();
+        public Dictionary<EntityActionOperation, List<string>> OperationToRolesMap { get; set; } = new();
 
         /// <summary>
         /// Set of Http verbs enabled for Stored Procedure entities that have their REST endpoint enabled.
         /// </summary>
-        public HashSet<RestMethod> StoredProcedureHttpVerbs { get; set; } = new();
-
-        /// <summary>
-        /// Defines the type of database object the entity represents.
-        /// Examples include Table, View, StoredProcedure
-        /// </summary>
-        public SourceType ObjectType { get; set; } = SourceType.Table;
+        public HashSet<SupportedHttpVerb> StoredProcedureHttpVerbs { get; set; } = new();
     }
 
     /// <summary>
@@ -60,7 +54,7 @@ public class RoleMetadata
         /// <summary>
         /// Given the key (operation) returns the associated OperationMetadata object.
         /// </summary>
-        public Dictionary<Operation, OperationMetadata> OperationToColumnMap { get; set; } = new();
+        public Dictionary<EntityActionOperation, OperationMetadata> OperationToColumnMap { get; set; } = new();
     }
 
     /// <summary>

src/Auth/IAuthorizationResolver.cs

@@ -1,7 +1,7 @@
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT License.
 
-using Azure.DataApiBuilder.Config;
+using Azure.DataApiBuilder.Config.ObjectModel;
 using Microsoft.AspNetCore.Http;
 
 namespace Azure.DataApiBuilder.Auth
@@ -29,22 +29,22 @@ public interface IAuthorizationResolver
         /// Checks if the permissions collection of the requested entity
         /// contains an entry for the role defined in the client role header.
         /// </summary>
-        /// <param name="entityName">Entity from request</param>
+        /// <param name="entityIdentifier">Entity from request. This could be the name of the entity or it could be the GraphQL type name, depending on the entry point.</param>
         /// <param name="roleName">Role defined in client role header</param>
         /// <param name="operation">Operation type: Create, Read, Update, Delete</param>
         /// <returns>True, if a matching permission entry is found.</returns>
-        public bool AreRoleAndOperationDefinedForEntity(string entityName, string roleName, Operation operation);
+        public bool AreRoleAndOperationDefinedForEntity(string entityIdentifier, string roleName, EntityActionOperation operation);
 
         /// <summary>
         /// Any columns referenced in a request's headers, URL(filter/orderby/routes), and/or body
-        /// are compared against the inclued/excluded column permission defined for the entityName->roleName->operation
+        /// are compared against the include/excluded column permission defined for the entityName->roleName->operation
         /// </summary>
-        /// <param name="entityName">Entity from request</param>
+        /// <param name="entityIdentifier">Entity from request</param>
         /// <param name="roleName">Role defined in client role header</param>
         /// <param name="operation">Operation type: Create, Read, Update, Delete</param>
         /// <param name="columns">Compiled list of any column referenced in a request</param>
         /// <returns></returns>
-        public bool AreColumnsAllowedForOperation(string entityName, string roleName, Operation operation, IEnumerable<string> columns);
+        public bool AreColumnsAllowedForOperation(string entityIdentifier, string roleName, EntityActionOperation operation, IEnumerable<string> columns);
 
         /// <summary>
         /// Method to return the list of exposed columns for the given combination of
@@ -54,7 +54,7 @@ public interface IAuthorizationResolver
         /// <param name="roleName">Role defined in client role header</param>
         /// <param name="operation">Operation type: Create, Read, Update, Delete</param>
         /// <returns></returns>
-        public IEnumerable<string> GetAllowedExposedColumns(string entityName, string roleName, Operation operation);
+        public IEnumerable<string> GetAllowedExposedColumns(string entityName, string roleName, EntityActionOperation operation);
 
         /// <summary>
         /// Retrieves the policy of an operation within an entity's role entry
@@ -66,7 +66,7 @@ public interface IAuthorizationResolver
         /// <param name="operation">Operation type: Create, Read, Update, Delete.</param>
         /// <param name="httpContext">Contains token claims of the authenticated user used in policy evaluation.</param>
         /// <returns>Returns the parsed policy, if successfully processed, or an exception otherwise.</returns>
-        public string ProcessDBPolicy(string entityName, string roleName, Operation operation, HttpContext httpContext);
+        public string ProcessDBPolicy(string entityName, string roleName, EntityActionOperation operation, HttpContext httpContext);
 
         /// <summary>
         /// Get list of roles defined for entity within runtime configuration.. This is applicable for GraphQL when creating authorization
@@ -83,9 +83,8 @@ public interface IAuthorizationResolver
         /// <param name="entityName">EntityName whose operationMetadata will be searched.</param>
         /// <param name="field">Field to lookup operation permissions</param>
         /// <param name="operation">Specific operation to get collection of roles</param>
-        /// <returns>Collection of role names allowed to perform operation on Entity's field. Empty list when zero roles
-        /// have permission to perform the {operation} on the provided field.</returns>
-        public IEnumerable<string> GetRolesForField(string entityName, string field, Operation operation);
+        /// <returns>Collection of role names allowed to perform operation on Entity's field.</returns>
+        public IEnumerable<string> GetRolesForField(string entityName, string field, EntityActionOperation operation);
 
         /// <summary>
         /// Returns whether the httpVerb (GET, POST, PUT, PATCH, DELETE) is allowed to be performed
@@ -95,7 +94,7 @@ public interface IAuthorizationResolver
         /// <param name="roleName"></param>
         /// <param name="httpVerb"></param>
         /// <returns>True if the execution of the stored procedure is permitted. Otherwise, false.</returns>
-        public bool IsStoredProcedureExecutionPermitted(string entityName, string roleName, RestMethod httpVerb);
+        public bool IsStoredProcedureExecutionPermitted(string entityName, string roleName, SupportedHttpVerb httpVerb);
 
         /// <summary>
         /// Returns a list of roles which define permissions for the provided operation.
@@ -106,12 +105,12 @@ public interface IAuthorizationResolver
         /// <returns>Collection of roles. Empty list if entityPermissionsMap is null.</returns>
         public static IEnumerable<string> GetRolesForOperation(
             string entityName,
-            Operation operation,
+            EntityActionOperation operation,
             Dictionary<string, EntityMetadata>? entityPermissionsMap)
         {
             if (entityName is null)
             {
-                throw new ArgumentNullException(paramName: "entityName");
+                throw new ArgumentNullException(paramName: nameof(entityName));
             }
 
             if (entityPermissionsMap is not null &&

src/Azure.DataApiBuilder.sln

@@ -8,6 +8,7 @@ Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Azure.DataApiBuilder.Servic
 EndProject
 Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Configs", "Configs", "{EFA9C661-D8FD-469A-9372-284387C4BEFC}"
 	ProjectSection(SolutionItems) = preProject
+		..\schemas\dab.draft.schema.json = ..\schemas\dab.draft.schema.json
 		Service.Tests\schema.gql = Service.Tests\schema.gql
 	EndProjectSection
 EndProject