Align MCP create_record/update_record with shared authorization helper by souvikghosh04 · Pull Request #3730 · Azure/data-api-builder

souvikghosh04 · 2026-07-21T09:07:36Z

Summary

Minor internal consistency update for the built-in MCP DML tools (create_record, update_record).

Both tools now route through a small shared authorization helper (McpAuthorizationHelper) before invoking the mutation engine, matching the pattern already used elsewhere in the MCP tool set. No changes to public tool schemas, request/response shapes, or supported scenarios.

Changes

McpAuthorizationHelper: adds a small reusable helper method used by the mutation tools.
CreateRecordTool / UpdateRecordTool: call the helper as part of existing request handling, immediately after role resolution.
Test coverage: adds a dedicated test role/config entry and regression tests exercising the updated code path for both tools.

Testing

dotnet build — clean.
dotnet format --verify-no-changes — clean.
New/updated tests included; existing MCP test suite unaffected.

Notes

Opened as draft while final validation completes.

…r pattern Extends McpAuthorizationHelper with a small reusable check used by the read-side MCP tools, and calls it from CreateRecordTool/UpdateRecordTool for consistency with the rest of the tool set. Adds accompanying test coverage.

Copilot

Pull request overview

This PR tightens MCP DML tool authorization by adding an explicit column-level authorization check for create_record and update_record, aligning these tools with existing authorization patterns used elsewhere (and preventing fields.exclude/fields.include bypasses).

Changes:

Added a reusable column-level authorization helper (McpAuthorizationHelper.AreColumnsAuthorizedForOperation).
Updated CreateRecordTool and UpdateRecordTool to enforce column-level authorization immediately after role resolution.
Added a dedicated test role/config entry plus regression tests to validate excluded-column enforcement for both create and update.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/Azure.DataApiBuilder.Mcp/Utils/McpAuthorizationHelper.cs	Adds a shared helper to enforce column-level authorization for mutations.
src/Azure.DataApiBuilder.Mcp/BuiltInTools/CreateRecordTool.cs	Enforces column-level authorization for create payload columns.
src/Azure.DataApiBuilder.Mcp/BuiltInTools/UpdateRecordTool.cs	Enforces column-level authorization for update payload columns.
src/Service.Tests/Mcp/McpToolTestBase.cs	Enables mutation test service providers to simulate different client roles.
src/Service.Tests/Mcp/CreateRecordToolMsSqlIntegrationTests.cs	Adds regression + sanity tests for excluded-column behavior on create.
src/Service.Tests/Mcp/UpdateRecordToolMsSqlIntegrationTests.cs	Adds regression + sanity tests for excluded-column behavior on update.
src/Service.Tests/dab-config.MsSql.json	Adds a test role with mutation-time excluded fields for the new regression tests.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

… test The Book entity's only non-key column (publisher_id) is NOT NULL with no default, so a role excluded from writing it can never satisfy Book's required-field validation on create -- unrelated to authorization. Switched the success-path sanity check to the WebsiteUser entity, whose only non-key column (username) is nullable, so omitting the excluded column is valid.

The MCP create_record/update_record column-exclusion integration tests passed locally but failed in CI. CI regenerates src/Service.Tests/dab-config.MsSql.json from config-generators/mssql-commands.txt; the role existed only in the checked-in JSON, so the regenerated CI config lacked it and inheritance from the 'authenticated' role (no field exclusions) allowed writes to excluded columns. Add the role to mssql-commands.txt for Book (exclude publisher_id) and WebsiteUser (exclude username) on create/update. Add AuthorizationResolver unit tests covering multi-action-per-role column exclusion and config parsing.

RubenCerna2079

Just a few changes that need to be addressed

RubenCerna2079 · 2026-07-24T22:36:30Z


+                // Column-level authorization: ensure the caller's effective role is permitted to write
+                // every column present in the request payload (fields.include/fields.exclude enforcement).
+                if (!McpAuthorizationHelper.AreColumnsAuthorizedForOperation(


Why is the create under a try catch while this one isn't? Is there a reason this one shouldn't need it?

RubenCerna2079 · 2026-07-24T22:44:59Z

+        {
+            error = string.Empty;
+
+            List<string> requestedColumns = columns is null ? new List<string>() : columns.ToList();


I don't think it is possible for the columns variable to be null, at most empty. So this else if would be a bit irrelevant wouldn't it?

RubenCerna2079 · 2026-07-27T21:31:04Z

+                Actions: new EntityAction[] { readAction, createAction, updateAction, deleteAction });
+
+            Azure.DataApiBuilder.Config.ObjectModel.Entity sampleEntity = new(
+                Source: new Azure.DataApiBuilder.Config.ObjectModel.EntitySource(AuthorizationHelpers.TEST_ENTITY, Azure.DataApiBuilder.Config.ObjectModel.EntitySourceType.Table, null, null),


nit: Couldn't we add this as libraries instead of putting the entire namespace here?

RubenCerna2079 · 2026-07-27T21:40:28Z

+            Assert.IsTrue(authZResolver.AreColumnsAllowedForOperation(
+                AuthorizationHelpers.TEST_ENTITY,
+                AuthorizationHelpers.TEST_ROLE,
+                operation: EntityActionOperation.Read,
+                new List<string> { "col1", "col3" }));
+
+            // Create should DENY col3 since it is excluded for create.
+            Assert.IsFalse(authZResolver.AreColumnsAllowedForOperation(
+                AuthorizationHelpers.TEST_ENTITY,
+                AuthorizationHelpers.TEST_ROLE,
+                operation: EntityActionOperation.Create,
+                new List<string> { "col1", "col3" }));
+
+            // Update should DENY col3 since it is excluded for update.
+            Assert.IsFalse(authZResolver.AreColumnsAllowedForOperation(
+                AuthorizationHelpers.TEST_ENTITY,
+                AuthorizationHelpers.TEST_ROLE,
+                operation: EntityActionOperation.Update,
+                new List<string> { "col1", "col3" }));


nit: I think we should add a message for when either of these asserts fail to make it easier to debug

RubenCerna2079 · 2026-07-27T21:46:54Z

+            Assert.IsTrue(roundTrippedResolver.AreColumnsAllowedForOperation(
+                AuthorizationHelpers.TEST_ENTITY,
+                AuthorizationHelpers.TEST_ROLE,
+                operation: EntityActionOperation.Read,
+                new List<string> { "col1", "col3" }));
+
+            Assert.IsFalse(roundTrippedResolver.AreColumnsAllowedForOperation(
+                AuthorizationHelpers.TEST_ENTITY,
+                AuthorizationHelpers.TEST_ROLE,
+                operation: EntityActionOperation.Create,
+                new List<string> { "col1", "col3" }));
+
+            Assert.IsFalse(roundTrippedResolver.AreColumnsAllowedForOperation(
+                AuthorizationHelpers.TEST_ENTITY,
+                AuthorizationHelpers.TEST_ROLE,
+                operation: EntityActionOperation.Update,
+                new List<string> { "col1", "col3" }));


Same as previous comment

souvikghosh04 self-assigned this Jul 21, 2026

souvikghosh04 added this to Data API builder Jul 21, 2026

github-project-automation Bot moved this to Todo in Data API builder Jul 21, 2026

souvikghosh04 added this to the July 2026 milestone Jul 21, 2026

souvikghosh04 requested a review from Copilot July 21, 2026 09:09

Copilot started reviewing on behalf of souvikghosh04 July 21, 2026 09:10 View session

Copilot AI reviewed Jul 21, 2026

View reviewed changes

Comment thread src/Azure.DataApiBuilder.Mcp/BuiltInTools/CreateRecordTool.cs

Potential fix for pull request finding

f354201

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

souvikghosh04 marked this pull request as ready for review July 21, 2026 09:16

souvikghosh04 requested review from Alekhya-Polavarapu, Aniruddh25, JerryNixon, RubenCerna2079, aaronburtle, anushakolan, rusamant, sourabh1007, stuartpa and vadeveka as code owners July 21, 2026 09:16

souvikghosh04 moved this from Todo to Review In Progress in Data API builder Jul 21, 2026

souvikghosh04 added the assign-for-review label Jul 21, 2026

github-actions Bot assigned Aniruddh25 and RubenCerna2079 Jul 21, 2026

github-actions Bot removed the assign-for-review label Jul 21, 2026

souvikghosh04 force-pushed the mcp/dml-tool-authz-consistency branch from c84ec2c to fb815cd Compare July 21, 2026 15:29

souvikghosh04 force-pushed the mcp/dml-tool-authz-consistency branch from fb815cd to 20d95f7 Compare July 22, 2026 05:19

Merge branch 'main' into mcp/dml-tool-authz-consistency

2f24288

Aniruddh25 approved these changes Jul 22, 2026

View reviewed changes

RubenCerna2079 requested changes Jul 27, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Align MCP create_record/update_record with shared authorization helper - #3730

Align MCP create_record/update_record with shared authorization helper#3730
souvikghosh04 wants to merge 5 commits into
mainfrom
mcp/dml-tool-authz-consistency

souvikghosh04 commented Jul 21, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

RubenCerna2079 left a comment

Uh oh!

RubenCerna2079 Jul 24, 2026

Uh oh!

RubenCerna2079 Jul 24, 2026

Uh oh!

RubenCerna2079 Jul 27, 2026

Uh oh!

RubenCerna2079 Jul 27, 2026

Uh oh!

RubenCerna2079 Jul 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

souvikghosh04 commented Jul 21, 2026

Summary

Changes

Testing

Notes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

RubenCerna2079 left a comment

Choose a reason for hiding this comment

Uh oh!

RubenCerna2079 Jul 24, 2026

Choose a reason for hiding this comment

Uh oh!

RubenCerna2079 Jul 24, 2026

Choose a reason for hiding this comment

Uh oh!

RubenCerna2079 Jul 27, 2026

Choose a reason for hiding this comment

Uh oh!

RubenCerna2079 Jul 27, 2026

Choose a reason for hiding this comment

Uh oh!

RubenCerna2079 Jul 27, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants