Merge branch 'master' into users/archie/embedding-configuration

test/fx.ts

@@ -49,6 +49,7 @@ export enum TestAccount {
   SQLReadOnly = "SQLReadOnly",
   SQLContainerCopyOnly = "SQLContainerCopyOnly",
   SQLConnectionString = "SQLConnectionString",
+  SQLConnectionStringPublicNetworkAccessDisabled = "SQLConnectionStringPublicNetworkAccessDisabled",
   TableConnectionString = "TableConnectionString",
   GremlinConnectionString = "GremlinConnectionString",
 }
@@ -83,6 +84,8 @@ export function getDefaultAccountName(accountType: TestAccount): string {
       return `${accountNamePrefix}-de-test-sql-containercopy`;
     case TestAccount.SQLConnectionString:
       return `${accountNamePrefix}-de-test-sql-connstring-1`;
+    case TestAccount.SQLConnectionStringPublicNetworkAccessDisabled:
+      return `${accountNamePrefix}-de-test-sql-connstring-nopublic-1`;
     case TestAccount.TableConnectionString:
       return `${accountNamePrefix}-de-test-table-connstring-1`;
     case TestAccount.GremlinConnectionString:
@@ -258,6 +261,7 @@ export async function getTestExplorerUrl(accountType: TestAccount, options?: Tes
       break;
 
     case TestAccount.SQLConnectionString:
+    case TestAccount.SQLConnectionStringPublicNetworkAccessDisabled:
     case TestAccount.TableConnectionString:
     case TestAccount.GremlinConnectionString:
       // Connection string (account key) login navigates directly to hostedExplorer.html and doesn't

test/sql/connectionStringLogin.spec.ts

@@ -115,4 +115,32 @@ test.describe("SQL account using connection string login", () => {
     await expect(page.locator("#connectExplorer")).toHaveCount(0);
     await expect(page.locator(".errorDetails")).toHaveCount(0);
   });
+
+  test("opens Data Explorer but loads no databases when the account rejects the client IP", async ({ page }) => {
+    // An account that refuses this client's IP.
+    const armClient = new CosmosDBManagementClient(getAzureCLICredentials(), subscriptionId);
+    const blockedAccountName = getAccountName(TestAccount.SQLConnectionStringPublicNetworkAccessDisabled);
+    const blockedAccount = await armClient.databaseAccounts.get(resourceGroupName, blockedAccountName);
+    const blockedKeys = await armClient.databaseAccounts.listKeys(resourceGroupName, blockedAccountName);
+
+    await loginWithConnectionString(
+      page,
+      `AccountEndpoint=${blockedAccount.documentEndpoint!};AccountKey=${blockedKeys.primaryMasterKey};`,
+    );
+
+    const explorer = await DataExplorer.waitForExplorer(page);
+
+    // Login is a client-side parse of the connection string, so nothing checks whether the account will
+    // accept requests from this IP before letting the user in.
+    await expect(page.locator("#connectExplorer")).toHaveCount(0);
+    await expect(page.locator(".errorDetails")).toHaveCount(0);
+
+    // The rejection surfaces once the tree tries to read the data plane, and only in the console.
+    const consoleMessages = await explorer.getNotificationConsoleMessages();
+    await expect(consoleMessages).toContainText("Error while refreshing databases", { timeout: ONE_MINUTE_MS });
+
+    // The tree is left with the static Home node and no database or container beneath it.
+    await expect(explorer.treeNode("Home").element).toBeAttached();
+    await expect(explorer.frame.locator("[data-test^='TreeNode:']")).toHaveCount(1);
+  });
 });

test/sql/indexAdvisor.spec.ts

@@ -38,9 +38,9 @@ async function setupIndexAdvisorTab(page: Page, customQuery?: string) {
   const queryEditor = queryTab.editor();
   await queryEditor.locator.waitFor({ timeout: 30 * 1000 });
   await queryTab.executeCTA.waitFor();
+  await queryEditor.locator.click();
 
   if (customQuery) {
-    await queryEditor.locator.click();
     await queryEditor.setText(customQuery);
   }