Skip to content

Conversation

@TomasDJo
Copy link

Why make this change?

What is this change?

When processing non-list nested object filters for CosmosDB in GQLFilterParser.Parse(), the EntityName property of cosmosQueryStructure is mutated to the nested type name but not restored after the recursive parsing completes.

This causes subsequent nested filters to use the wrong entity name for authorization checks:

  1. First nested filter (e.g., toOwnership) → EntityName set to "ToOwnership"
  2. DatabaseObject.Name and SourceAlias are restored ✓
  3. EntityName is NOT restored ✗ (still "ToOwnership")
  4. Second nested filter (e.g., fromOwnership) → authorization check uses wrong entity → fails

The fix adds a single line to restore EntityName alongside the existing restoration of DatabaseObject.Name and SourceAlias.

How was this tested?

  • Manual testing against real CosmosDB with nested filter queries
  • Integration Tests (CosmosDB emulator not available locally)
  • Unit Tests

Before fix:

{"errors":[{"message":"Access forbidden to a field referenced in the filter.","extensions":{"code":"AuthorizationCheckFailed"}}],"data":null}

After fix:

{"data":{"transactions":{"items":[{"id":"31654581"},{"id":"28285539"}]}}}

Sample Request(s)

# This query failed before the fix
{
  transactions(filter: {
    toOwnership: { toOwnerType: { eq: "Privat" } },
    fromOwnership: { fromOwnerType: { eq: "Privat" } }
  }, first: 2) {
    items { id }
  }
}

…tyName was mutated but not restored after recursive parsing.

This caused subsequent nested filters to use the wrong entity name for authorization checks, resulting in AuthorizationCheckFailed errors.

The fix adds a single line to restore EntityName alongside the existing restoration of DatabaseObject.Name and SourceAlias.

Closes Azure#3070
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR fixes a bug in CosmosDB nested filter processing where the EntityName property was not being restored after processing non-list nested object filters, causing authorization failures when filtering on multiple different nested objects.

Changes:

  • Added restoration of EntityName property in GQLFilterParser.Parse() method after recursive parsing of non-list nested filters for CosmosDB

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@JerryNixon
Copy link
Contributor

@copilot evaluate the efficacy of this PR to resolve the issue at hand.

@RubenCerna2079 RubenCerna2079 self-assigned this Jan 22, 2026
@RubenCerna2079
Copy link
Contributor

@TomasDJo would you be able to add some unit tests on this PR to verify that the change you made works as intended?
If you have any problems with this let me know and I should be able to help you.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: Filtering on multiple different nested objects returns AuthorizationCheckFailed (CosmosDB, GraphQL)

3 participants