Fix: Restore EntityName after processing nested filter for CosmosDB (#3072)

TomasDJo · Aniruddh25 · web-flow · commit c017efe80874 · 2026-02-04T04:46:00.000Z
## Why make this change? - Closes #3070 - When filtering on multiple different nested objects in CosmosDB (e.g., `toOwnership` and `fromOwnership`), the query fails with `AuthorizationCheckFailed` error even though the user has proper permissions. ## What is this change? When processing non-list nested object filters for CosmosDB in `GQLFilterParser.Parse()`, the `EntityName` property of `cosmosQueryStructure` is mutated to the nested type name but **not restored** after the recursive parsing completes. This causes subsequent nested filters to use the wrong entity name for authorization checks: 1. First nested filter (e.g., `toOwnership`) → `EntityName` set to "ToOwnership" 2. `DatabaseObject.Name` and `SourceAlias` are restored ✓ 3. `EntityName` is **NOT** restored ✗ (still "ToOwnership") 4. Second nested filter (e.g., `fromOwnership`) → authorization check uses wrong entity → **fails** The fix adds a single line to restore `EntityName` alongside the existing restoration of `DatabaseObject.Name` and `SourceAlias`. ## How was this tested? - [x] Manual testing against real CosmosDB with nested filter queries - [x] Integration Tests - [ ] Unit Tests ### Before fix: ```json {"errors":[{"message":"Access forbidden to a field referenced in the filter.","extensions":{"code":"AuthorizationCheckFailed"}}],"data":null} ``` ### After fix: ```json {"data":{"transactions":{"items":[{"id":"31654581"},{"id":"28285539"}]}}} ``` ## Sample Request(s) ```graphql # This query failed before the fix { transactions(filter: { toOwnership: { toOwnerType: { eq: "Privat" } }, fromOwnership: { fromOwnerType: { eq: "Privat" } } }, first: 2) { items { id } } } ``` --------- Co-authored-by: Aniruddh Munde <anmunde@microsoft.com>
diff --git a/src/Core/Models/GraphQLFilterParsers.cs b/src/Core/Models/GraphQLFilterParsers.cs
@@ -227,6 +227,7 @@ public Predicate Parse(
 
                             cosmosQueryStructure.DatabaseObject.Name = sourceName;
                             cosmosQueryStructure.SourceAlias = sourceAlias;
+                            cosmosQueryStructure.EntityName = entityName;
                         }
                     }
                 }
diff --git a/src/Service.Tests/CosmosTests/QueryFilterTests.cs b/src/Service.Tests/CosmosTests/QueryFilterTests.cs
@@ -899,6 +899,31 @@ public async Task TestFilterWithEntityNameAlias()
             await ExecuteAndValidateResult(_graphQLQueryName, gqlQuery, dbQuery);
         }
 
+        /// <summary>
+        /// Test filters on two different nested objects simultaneously
+        /// </summary>
+        [TestMethod]
+        public async Task TestFilterOnTwoDifferentNestedObjects()
+        {
+            string gqlQuery = @"{
+                planets(first: 10, " + QueryBuilder.FILTER_FIELD_NAME + @" : {
+                    character: { name: { eq: ""planet character"" } },
+                    earth: { type: { eq: ""earth4"" } }
+                })
+                {
+                    items {
+                        id
+                        name
+                    }
+                }
+            }";
+
+            string dbQuery = "SELECT c.id, c.name FROM c " +
+                "WHERE c.character.name = \"planet character\" AND c.earth.type = \"earth4\"";
+
+            await ExecuteAndValidateResult(_graphQLQueryName, gqlQuery, dbQuery);
+        }
+
         /// <summary>
         /// For "item-level-permission-role" role, DB policies are defined. This test confirms that all the DB policies are considered.
         /// For the reference, Below conditions are applied for an Entity in Db Config file.

Original file line number	Diff line number	Diff line change
`@@ -227,6 +227,7 @@ public Predicate Parse(`
`227`	`227`
`228`	`228`	`cosmosQueryStructure.DatabaseObject.Name = sourceName;`
`229`	`229`	`cosmosQueryStructure.SourceAlias = sourceAlias;`
	`230`	`+ cosmosQueryStructure.EntityName = entityName;`
`230`	`231`	`}`
`231`	`232`	`}`
`232`	`233`	`}`