Implementing ApprovalAccessControlProvider throws Error

[hannibub]

Hi,

I am working on a .NET MAUI application that features Azure AD B2C for authentication and uses the DataSync library for data synchronization handled by a backend API (hosted on Azure) and a Azure SQL database. I followed the tutorial on Microsoft Docs and on your personal page for implementing the ApprovalAccessControlProvider so that a logged-in User only sees his own data. Now I am facing two challenges/errors I failed to solve myself.

1. The DataService was working just fine before implementing the ApprovalAccessControlProvider. I strictly followed your tutorial but when I want to push new items, an exception is thrown:

{Microsoft.Datasync.Client.Offline.PushFailedException: Push operation has failed. See the PushResult for details.

Inspecting the PushResult reveals the following:

{"errors":{"userId":["The UserId field is required."]},"type":"https://tools.ietf.org/html/rfc7231#section-6.5.1","title":"One or more validation errors occurred.","status":400,"traceId":"00-0834f5beb2dc3addc039848899684b46-ece7f3682c472112-00"}

2. When using the Dataservice without the ApprovalAccessControlProvider, synchronization worked fine when starting both the local and sql database anew. However, I noticed that after pushing some items to the remote database and reinstalling the client app to simulate accessing data from another device, the remote data would not be fetched from Azure Sql on calling _table.PullItemsAsync (even though postman calls returned all items for testing). I suppose I basically want to pull all items (not just the updated ones) and synchronize them with my offline store.

Any idea how to solve these two issues?

[adrianhall]

1. Your problem is in the model you are using. You have set the UserId field to "required". however, your client is not submitting the user id. Remove the [Required] attribute from the UserId field.
2. There is a SQLite database in the background. I'm guessing that when you uninstall the client app, you didn't remove the backing data. That would cause the problem you are seeing.

[hannibub]

Thanks for your fast reply!

1. I understand but the thing is, I've never set the [Required] attribute to the UserId field. This is my current model on the client side :

public class ClinicalActivity : DatasyncClientData, IEquatable<ClinicalActivity>, IUserId
    {
        public string UserId { get; set; }
        public string Name { get; set; }
        public Category Category { get; set; }
        public DateTime Date { get; set; }

        public bool Equals(ClinicalActivity? other)
        => other != null && other.Id == Id;
    }

and on the backend side:

public class ClinicalActivity : EntityTableData, IUserId
    {
        [JsonIgnore]        
        public string UserId { get; set; }
        public string Name { get; set; }
        public Category Category { get; set; }
        public DateTime Date { get; set; }        
    }

But I just saw, that my DbContextSnapshot says the following even though I don't know why it is declared as required and how to change that.

 b.Property<string>("UserId")
                        .IsRequired()
                        .HasColumnType("nvarchar(max)");

2. Alright, I'll try to use a different path for the offline store and then fetch all data (since I've not only uninstalled but also deleted all app data on the phone) I guess that should be the same as deleting the backing data.

Thanks!

[adrianhall]

For #1 - I suspect you are not setting the UserId in the pre commit hook - can you post that code?
For #2 - There is a field in the SQLite database for the delta-token, which is on a per-query basis. If you delete the app data (including the SQLite database), that gets wiped out, so the app has no clue as to what the delta-token is. If you are not seeing it start over, then something else is goign on. I'd personally suggest using two different emulators instead of installing / uninstalling.

[hannibub]

for #1 - here is the code of my AccessControlProvider class. I just needed to modify the { get } UserId property to retrieve the actual Id value from the logged-in user. That part is working since calling a GET via postman with a valid bearer token returns only the items of the corresponding user.

internal class PrivateAccessControlProvider<T> : IAccessControlProvider<T>
    where T : ITableData, IUserId
    {
        private readonly IHttpContextAccessor _accessor;
        private readonly string IdClaimValue = "http://schemas.microsoft.com/identity/claims/objectidentifier";

        public PrivateAccessControlProvider(IHttpContextAccessor accessor)
        {
            _accessor = accessor;
        }

        private string UserId { get => _accessor.HttpContext.User?.Claims?.Where(c => c.Type == IdClaimValue).First().Value; }

      
        public Expression<Func<T, bool>> GetDataView()
        {
            return (UserId == null)
              ? _ => false
              : model => model.UserId == UserId;
        }

        public Task<bool> IsAuthorizedAsync(TableOperation op, T entity, CancellationToken token = default)
        {
            if (op == TableOperation.Create || op == TableOperation.Query)
            {
                return Task.FromResult(true);
            }
            else
            {
                return Task.FromResult(entity?.UserId != null && entity?.UserId == UserId);
            }
        }

        public virtual Task PreCommitHookAsync(TableOperation operation, T entity, CancellationToken token = default)
        {
            entity.UserId = UserId;
            return Task.CompletedTask;
        }
    }

for #2 - Alright, I'll keep that in mind!

[adrianhall]

You have a case (obviously) where UserId is null - it's definitely possible since UserId has nullables which are propagated and no default value.

That is almost certainly WHY you are getting the error. As to the root cause of why your accessor is not being given an identity - that is an investigation that will need to be done.

[hannibub]

I just managed to solve the issue. I made UserId nullable (public string? UserId) which apparently overrides the default EF Core behavior of marking string properties as required. Also I re-installed the app which got rid of the somehow persistent errors in the PushResult. I'm still testing but I believe everything is working just fine now.

Thank you so much for pointing me in the right direction!