@@ -36,7 +36,7 @@ public static void TestFixtureSetup(TestContext context)
3636 OverrideEntityContainer ( "Planet" , _containerName ) ;
3737 OverrideEntityContainer ( "Earth" , _containerName ) ;
3838 OverrideEntityContainer ( "StarAlias" , _containerName ) ;
39- OverrideEntityContainer ( "TagAlias " , _containerName ) ;
39+ OverrideEntityContainer ( "Sun " , _containerName ) ;
4040 }
4141
4242 /// <summary>
@@ -834,6 +834,61 @@ public async Task TestQueryFieldAuthConflictingWithFilterFieldAuth_Unauthorized(
834834 string errorMessage = response . ToString ( ) ;
835835 Assert . IsTrue ( errorMessage . Contains ( "The current user is not authorized to access this resource." ) ) ;
836836 }
837+
838+ /// <summary>
839+ /// Tests that the field level query filter succeeds requests
840+ /// when GraphQL is set to true without setting singular type in runtime config and
841+ /// when include fields are WILDCARD,
842+ /// all the columns are able to be retrieved for authorization validation.
843+ /// </summary>
844+ [ TestMethod ]
845+ public async Task TestQueryFilterFieldAuthWithoutSingularType ( )
846+ {
847+ string gqlQuery = @"{
848+ suns(first: 1, " + QueryBuilder . FILTER_FIELD_NAME + @" : {id : {eq : """ + _idList [ 0 ] + @"""}})
849+ {
850+ items {
851+ id
852+ name
853+ }
854+ }
855+ }" ;
856+
857+ string dbQuery = $ "SELECT top 1 c.id, c.name FROM c where c.id = \" { _idList [ 0 ] } \" ";
858+ await ExecuteAndValidateResult ( "suns" , gqlQuery , dbQuery ) ;
859+ }
860+
861+ /// <summary>
862+ /// Tests that the field level query filter failed authorization validation
863+ /// when include fields are WILDCARD and exclude fields specifies fields,
864+ /// exclude fields takes precedence over include fields.
865+ /// </summary>
866+ [ TestMethod ]
867+ public async Task TestQueryFilterFieldAuth_ExcludeTakesPredecence ( )
868+ {
869+ string gqlQuery = @"{
870+ suns(first: 1, " + QueryBuilder . FILTER_FIELD_NAME + @" : {name : {eq : ""test name""}})
871+ {
872+ items {
873+ id
874+ name
875+ }
876+ }
877+ }" ;
878+
879+ string clientRoleHeader = AuthorizationType . Anonymous . ToString ( ) ;
880+ JsonElement response = await ExecuteGraphQLRequestAsync (
881+ queryName : "suns" ,
882+ query : gqlQuery ,
883+ variables : new ( ) { { "name" , "test name" } } ,
884+ authToken : AuthTestHelper . CreateStaticWebAppsEasyAuthToken ( specificRole : clientRoleHeader ) ,
885+ clientRoleHeader : clientRoleHeader ) ;
886+
887+ // Validate the result contains the GraphQL authorization error code.
888+ string errorMessage = response . ToString ( ) ;
889+ Assert . IsTrue ( errorMessage . Contains ( DataApiBuilderException . GRAPHQL_FILTER_FIELD_AUTHZ_FAILURE ) ) ;
890+
891+ }
837892 #endregion
838893
839894 [ ClassCleanup ]
0 commit comments