random-mirrors/cosmos-explorer
1
0
Fork 0
mirror of https://github.com/Azure/cosmos-explorer.git synced 2026-09-01 03:08:41 +01:00
Code Issues Packages Projects Releases Wiki Activity

Support Sovereign/PPE endpoint zones for connection string login + E2E test for SQL account with public network access disabled (#2568)

Browse Source 
* Support sovereign/PPE endpoint zones for connection string login

Move the hardcoded account endpoint suffixes out of Constants and into ConfigContext so connection string login works in sovereign clouds and PPE, and widen ConnectionStringParser to accept every configured zone.

Surface Portal Backend rejections in the hosted connect form: read the body off the Response that fetchEncryptedToken throws, and offer a firewall help link on a 403.

Add an E2E test covering SQL connection string login against an account with public network access disabled.

* Harden connection string DNS zone matching

Detect PPE accounts from Mongo and Cassandra connection strings, build their document endpoint from the matched zone, match the PPE suffix on a label boundary, and escape every regex metacharacter in config-supplied zones. Drop the sqlx.cosmosdb.azure.com zone, which is not a real SQL zone.

* Mock web-vitals globally in test setup

ScenarioMonitor subscribes to web-vitals when it is imported, so the onTTFB timer can throw during any suite that outlives it. Mocking it in setupTests.ts keeps that out of individual test files.

* Improve connection string login feedback

* Preserve connection restriction check order

* Flatten connection login error handling

---------

Co-authored-by: Asier Isayas <aisayas@microsoft.com>
This commit is contained in:
asier-isayas
2026-08-31 10:35:54 -04:00
committed by GitHub
parent 49a2ad491a
commit a825a7ddc5
11 changed files with 671 additions and 143 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/sql/connectionStringLogin.spec.ts
+28
View File
@@ -115,4 +115,32 @@ test.describe("SQL account using connection string login", () => {
await expect(page.locator("#connectExplorer")).toHaveCount(0);
await expect(page.locator(".errorDetails")).toHaveCount(0);
});
test("opens Data Explorer but loads no databases when the account rejects the client IP", async ({ page }) => {
// An account that refuses this client's IP.
const armClient = new CosmosDBManagementClient(getAzureCLICredentials(), subscriptionId);
const blockedAccountName = getAccountName(TestAccount.SQLConnectionStringPublicNetworkAccessDisabled);
const blockedAccount = await armClient.databaseAccounts.get(resourceGroupName, blockedAccountName);
const blockedKeys = await armClient.databaseAccounts.listKeys(resourceGroupName, blockedAccountName);
await loginWithConnectionString(
page,
`AccountEndpoint=${blockedAccount.documentEndpoint!};AccountKey=${blockedKeys.primaryMasterKey};`,
);
const explorer = await DataExplorer.waitForExplorer(page);
// Login is a client-side parse of the connection string, so nothing checks whether the account will
// accept requests from this IP before letting the user in.
await expect(page.locator("#connectExplorer")).toHaveCount(0);
await expect(page.locator(".errorDetails")).toHaveCount(0);
// The rejection surfaces once the tree tries to read the data plane, and only in the console.
const consoleMessages = await explorer.getNotificationConsoleMessages();
await expect(consoleMessages).toContainText("Error while refreshing databases", { timeout: ONE_MINUTE_MS });
// The tree is left with the static Home node and no database or container beneath it.
await expect(explorer.treeNode("Home").element).toBeAttached();
await expect(explorer.frame.locator("[data-test^='TreeNode:']")).toHaveCount(1);
});
});