* Support sovereign/PPE endpoint zones for connection string login
Move the hardcoded account endpoint suffixes out of Constants and into ConfigContext so connection string login works in sovereign clouds and PPE, and widen ConnectionStringParser to accept every configured zone.
Surface Portal Backend rejections in the hosted connect form: read the body off the Response that fetchEncryptedToken throws, and offer a firewall help link on a 403.
Add an E2E test covering SQL connection string login against an account with public network access disabled.
* Harden connection string DNS zone matching
Detect PPE accounts from Mongo and Cassandra connection strings, build their document endpoint from the matched zone, match the PPE suffix on a label boundary, and escape every regex metacharacter in config-supplied zones. Drop the sqlx.cosmosdb.azure.com zone, which is not a real SQL zone.
* Mock web-vitals globally in test setup
ScenarioMonitor subscribes to web-vitals when it is imported, so the onTTFB timer can throw during any suite that outlives it. Mocking it in setupTests.ts keeps that out of individual test files.
* Improve connection string login feedback
* Preserve connection restriction check order
* Flatten connection login error handling
---------
Co-authored-by: Asier Isayas <[email protected]>
* Add client-side connection-string login for SQL, Tables, and Gremlin
SQL, Tables, and Gremlin now sign data-plane requests client-side with the account key and skip the Portal Backend proxy (generatetoken/accessinputmetadata/authorizationtokens). Adds client-side host/account validation mirroring the backend ValidateHostAndAccount, plus a real CosmosClient connectivity probe that gates opening the Data Explorer. Mongo and Cassandra continue to use the encrypted-token proxy path.
* Localize connection-string login validation and connectivity messages
Move the hardcoded SQL/Tables/Gremlin connection-string login strings into en/Resources.json and reference them via the type-safe Keys object (t(Keys.connectExplorer.errors.*)).
* Drop unused mongodb:// branch from endpoint host extraction
* Remove Data Explorer references from connectivity probe comment
* Reword proxy reference in ConnectionString comment
* Fix trailing whitespace in connectivity probe comment
* Send connection string in Authorization header for Mongo/Cassandra token request
* Add E2E connection string login tests for SQL, Gremlin, and Tables
* Add wrong account key test for SQL connection string login
* Add access token to authorization header for encrypted token flow
* Wire connection string login E2E tests to dedicated connstring accounts in CI
Add TestAuthType and fold connection-string account resolution into getAccountName; seed and target the dedicated *-connstring accounts in CI while falling back to the standard per-API account locally.
* Handle connection string account types in getTestExplorerUrl switch
* Move globalThis.crypto polyfill to fx.ts so it runs for all specs
* Remove connection string validation for connection string login
- Remove validateDirectConnectionStringLogin and its helpers (extractEndpointHostFromConnectionString, extractHostToken, directLoginAllowlistedEndpointZones)
- Remove old extractMasterKeyfromConnectionString (Gremlin-specific), rename extractAccountKeyFromConnectionString to extractMasterKeyfromConnectionString
- Change validateDirectConnectionStringConnectivity to throw on error instead of returning string|undefined
- Simplify direct-login flow: submit connection string to CosmosClient as-is, no format or endpoint validation
- Keep connectivity pre-check (throws if CosmosClient cannot reach account)
- Remove 6 unused localization keys for validation errors
- Update tests to match new behavior
* Send authorization header for connection string login backend calls
* Simplify connection string login error handling
- Lift the login error state into HostedExplorer so failures from the connect form and from a postMessage login share one source of truth
- Show the message returned by the service instead of falling back to a generic unreachable message
- Move isAuthorizationError into AuthorizationUtils alongside the other shared auth helpers
- Widen getErrorMessage to accept unknown so catch variables no longer need a cast
- Show the connect screen error tooltip beside the icon and widen it so long service messages fit
- Consolidate the repeated account lookup and login steps in the SQL connection string spec
* Consolidate hosted login account metadata into a single state
Encrypted-token and direct connection-string logins now write to one accountMetadata state instead of two, which also fixes the connect form staying mounted after a successful SQL/Tables/Gremlin login. Deletes the now-unused useTokenMetadata hook and moves fetchAccessData to Platform/Hosted/Helpers/PortalAccessData.ts.
* Accept connection string logins without validating them
SQL, Tables, and Gremlin logins probed the account before signing in, so a user whose key was wrong or whose account was unreachable was blocked at the connect form. The probe is now gone: the connection string is accepted as-is and any bad key surfaces on the data-plane requests made from inside the explorer.
Removes validateDirectConnectionStringConnectivity, isAuthorizationError, and the connectExplorer.errors.connectFailed string along with their tests.
Also takes documentEndpoint straight from the AccountEndpoint in SQL and Gremlin connection strings instead of rebuilding it from the account name and a hardcoded DNS zone. Tables still derives it, since a Tables connection string only carries the table endpoint.
* Keep the connect form login error local to ConnectExplorer
The error state was lifted into HostedExplorer so a postMessage login could report failures, which meant the connect screen needed a second copy of the error markup for the AAD view. That copy fell outside the connectExplorerContent selector the tooltip styles are scoped to, so it rendered the message as unstyled inline text.
Move the state back into ConnectExplorer and let connectWithConnectionString log the failure as it did before. A failed postMessage login still leaves the user on the connect screen either way.
* Move Portal Backend calls into a PortalBackendClient helper
fetchEncryptedToken and isAccountRestrictedForConnectionStringLogin lived in ConnectExplorer.tsx, so HostedExplorer imported a network call from a React component. Merge them with fetchAccessData into src/Platform/Hosted/Helpers/PortalBackendClient.ts along with the PortalBackendError type, leaving ConnectExplorer as UI only.
* Leave the encrypted token login path as it is on master
The direct connection string login work does not change how Mongo and Cassandra logins fail, so drop the 401/403 handling this branch added around fetchEncryptedToken along with the now unused isAuthorizationError helper.
* Move the Portal Backend connection string calls out of Helpers
Helpers holds pure string utilities, and every other *Client in the repo sits at its domain root, so name the module for the endpoints it wraps and place it beside HostedUtils. Also drop the branch's ConnectScreen.less tooltip restyle, which was unrelated to connection string login.
* Move the Portal Backend client to Common
The module is a plain service client with no dependency on the hosted platform, and CosmosClient and MetricEvents already hand roll their own Portal Backend calls, so Common is where a shared client belongs.
* Add an E2E test that SQL connection string login skips the Portal Backend
Nothing asserted the defining behavior of the direct login path, so reverting the short-circuit in connectWithConnectionString would have gone unnoticed. The listener filters on the connectionstring route so it covers both generatetoken and accessinputmetadata, and leaves the account restriction check alone since that still runs for every API.
* Refer to the Table API as Table in comments
The comments added by this branch alternated between Table and Tables when naming the API alongside SQL and Gremlin. TablesDB is left alone since that is the literal database name, as is the plural noun where it refers to actual tables.
---------
Co-authored-by: Asier Isayas <[email protected]>
* Address exposed connection string in Data Explorer code
* Address exposed connection string in Data Explorer code
---------
Co-authored-by: Asier Isayas <[email protected]>
* Security hardening for Try Cosmos DB connection string flow
- Validate connection string format via parseConnectionString before accepting postMessage
- Restrict localhost:12900 in allowedHostedExplorerEndpoints to development builds only
- Export App component for testability with null-check on render target
- Add 12 unit tests covering origin validation, format validation, and message handling
* Fix HostedExplorer test mock types for compile
---------
Co-authored-by: Asier Isayas <[email protected]>
* default throughput bucket
* nit
* show inactive buckets
* add e2e tests for default throughput bucket
* for test sql containers, use throughput of 4000
* remove container throughput on creation
* added offer throughput
* add default throughput bucket info link
* add text localization
* upgrade playwright
* Fix flaky permissionsScreen test by using unrouteAll with ignoreErrors
* fix: move container creation to beforeAll to reduce CI shard timeout
* remove comment
---------
Co-authored-by: Asier Isayas <[email protected]>
* Fix cleanupDBs.js: use async iteration for Azure SDK paged results
* update node version
* fix cleanup script to use new Cosmos SDK APIs correctly
* get rid of global crypto
* fix flakiness
* revert DE pipeline to use Node 18
* nit
---------
Co-authored-by: Asier Isayas <[email protected]>
* Handle partition key path with white space
* add whitespace test case for pkey
* remove trailing whitespace
---------
Co-authored-by: Asier Isayas <[email protected]>
* dont refresh tree when opening scale & settings
* disable offline/online migration tests
* delete db after each test
* DEBUG: expand console for mongo testing
* find first execute button for stored procedure
* DEBUG: wait for editor to process changes
* increase wait time to 5s
* verify document text was set
* keep document spec as original
* debug new document and save document count
* when loading a document, wait for document text to appear then click new document
* wait for document to be loaded
* remove debug statement
* wait for results to attach
* do forced wait instead
* cleanup tests
* uncomment container copy tests
* run test account cleanup every 12 hours
* change cleanup frequency to once a day
---------
Co-authored-by: Asier Isayas <[email protected]>
* Temporarily re-enable key based auth for Mongo and Cassandra tests.
* Increase number of shards for playwright tests.
* Another small bump to test shard count.
* click global new... button then collection in playwright tests
* get new table button
* create and delete container for every individual scale test
* for scale and settings, dont create sample data in container
* run scale tests serially
* refactor scale setup and tear down to be within each test
* record network traces
* record network calls on all retries
* when disposing of database during playwright test, refresh tree to remove deleted database
* refresh tree before opening scale and settings
* When opening scale and settings, refresh databases
* reload all databases before loading offers
* increase time for change partition key request
* increase time for change partition key request
* refresh databases in test instead of product code
* when refreshing containers, open console window to check for status completion
* close notification console window after seeing desired log
* create and delete a container for each individual test
* dont delete database after every test. leave it to the CI
* Don't refresh databases when opening Scale+Settings and only delete database if running locally
* only open scale and settings at the beginning of each test suite
* get it back to working
* change settings.spect.ts from serial to parallel
* don't delete database after each test
* update container creation throughpout to be 5000
* run tests with no throughput limit on the account
* adjust scale test to reflect no throughput limit on account
* remove test container throughput
* don't refresh collections when clicking settings in product code
* refactor and run cleanup during pr check
* copy cleanup accounts
* run cleanup after playwright tests
* run cleanup every three hours
* revert ci.yml
* update cpk test
* remove cpk
* remove cleanup accounts and add cpk
* add cpk
* remove cpk changes
* revert ci.yml
* run cleanup every two hours
---------
Co-authored-by: Jade Welton <[email protected]>
Co-authored-by: Asier Isayas <[email protected]>
* adding sessionId to UserContext
* add session id
* add session id to settings pane and fix npm run compile
* Add conditional for Portal
* set default session id on userContext init
* fix tests
---------
Co-authored-by: Asier Isayas <[email protected]>
* Add multiple languages for Full Text Search Policy
* fix tests
* show multiple languages for multi language support enabled accounts
* addressed comments
---------
Co-authored-by: Asier Isayas <[email protected]>
* Add vector index shard key
* npm run format
* rename shard key to vector index shard key
* add tooltip for quantization byte size
* change text for GSI and container in VectorEmbedding Policy
---------
Co-authored-by: Asier Isayas <[email protected]>
* remove old portal backend endpoints
* format
* fix tests
* remove Materialized Views from createResourceTokenTreeNodes
* add portal FE back to defaultAllowedBackendEndpoints
---------
Co-authored-by: Asier Isayas <[email protected]>
* assign default throughput based on workload type
* combined common logic
* fix unit tests
* add tests
* update tests
* npm run format
* Set default RU throughput for Production workload accounts to be 10k
* remove unused method
* refactor
---------
Co-authored-by: Asier Isayas <[email protected]>
* assign default throughput based on workload type
* combined common logic
* fix unit tests
* add tests
* update tests
* npm run format
* Update ci.yml
---------
Co-authored-by: Asier Isayas <[email protected]>
* activate mongo proxy in mpac
* activate mongo proxy in mpac
* activate mongo proxy in prod
* fixed parition key unit test
* remove three part partition key value test
---------
Co-authored-by: Asier Isayas <[email protected]>
* LMS Mongo Proxy support
* change stirng to url for get mongo shell url
* fix tests
* enable feature flag
* fixed unit test
* add mongoshell to path
* remove LMS feature flag
---------
Co-authored-by: Asier Isayas <[email protected]>
* LMS Mongo Proxy support
* change stirng to url for get mongo shell url
* fix tests
* enable feature flag
* fixed unit test
* add mongoshell to path
---------
Co-authored-by: Asier Isayas <[email protected]>
* LMS Mongo Proxy support
* change stirng to url for get mongo shell url
* fix tests
* enable feature flag
* fixed unit test
---------
Co-authored-by: Asier Isayas <[email protected]>
* Fix API endpoint for CassandraProxy query API
* activated mongo proxy
* added mpac
* Activate CassandraProxy API endpoints for MPAC
* Run npm format
* Set CASSANDRA_PROXY_OUTBOUND_IPS_ALLOWLISTED when we detect new
Cassandra Proxy endpoints in IP rules.
* query documents API fix
* simplify ip check
---------
Co-authored-by: Senthamil Sindhu <[email protected]>
Co-authored-by: Asier Isayas <[email protected]>
Co-authored-by: Jade Welton <[email protected]>
* Mongo Proxy backend API
* merge main into current
* allow mongo proxy endpoints to be constants
* allow mongo proxy endpoints to be constants
* fix test
* show ip address warning for Mongo and Cassandra accounts
* show ip address warning for Mongo and Cassandra accounts
* removed string from prod
* make mongo proxy endpoint mandatory
* added MongoProxyEndpointsV2
* added MongoProxyEndpointsV2
* moved mongo and cassandra endpoints to Constants
* moved mongo and cassandra endpoints to Constants
* moved mongo and cassandra endpoints to Constants
---------
Co-authored-by: Asier Isayas <[email protected]>
* Mongo Proxy backend API
* merge main into current
* allow mongo proxy endpoints to be constants
* allow mongo proxy endpoints to be constants
* fix test
* check for allowed mongo proxy endpoint
* check for allowed mongo proxy endpoint
---------
Co-authored-by: Asier Isayas <[email protected]>
* cancel query option
* query timeout
* run prettier
* removed comments
* fixed npm run compile errors
* fixed tests
* fixed unit test errors
* fixed unit test errors
* fixed unit test errors
* fixed unit test errors
* fixed unit test errors
* increased min timeout
* added automatican cancel query option
* added react string format
* npm run format
* added unless automatic cancellation has been enabled
---------
Co-authored-by: Asier Isayas <[email protected]>
