[Bug]: Stored procedures when set with authorization fail with ObjectDisposedException

[vadeveka]

What happened?

Repro steps

1. In DAB config, set up an entity for stored procedure with a role (sample config below)
2. Run DAB and execute the query/mutation
3. Observe that the query/mutation returns internal error - Cannot access a disposed object.\r\nObject name: 'JsonDocument'.

Sample config

{
  "data-source": {
    "database-type": "mssql",
    "connection-string": "<database url>"
  },
  "runtime": {
    "rest": {
      "enabled": true,
      "path": "/api",
      "request-body-strict": true
    },
    "graphql": {
      "enabled": true,
      "path": "/graphql",
      "allow-introspection": true
    },
    "host": {
      "cors": {
        "origins": ["*"],
        "allow-credentials": false
      },
      "mode": "development",
      "authentication": {
        "provider": "Simulator"
      }
    }
  },
  "entities": {
    "UseDateTime": {
      "source": {
        "object": "dbo.UseDateTime",
        "type": "stored-procedure"
      },
      "permissions": [
        {
          "role": "Default",
          "actions": [
            {
              "action": "execute"
            }           
          ]
        }        
      ]
    },
    "UseDateTimeNoRole": {
      "source": {
        "object": "dbo.UseDateTime",
        "type": "stored-procedure"
      },
      "permissions": [
        {
          "role": "anonymous",
          "actions": [
            {
              "action": "execute"
            }           
          ]
        }        
      ]
    }
  }
}

Sample response

{
  "errors": [
    {
      "message": "Cannot access a disposed object.\r\nObject name: 'JsonDocument'.",
      "locations": [
        {
          "line": 26,
          "column": 5
        }
      ],
      "path": [
        "executeUseDateTime",
        3,
        "ID"
      ],
      "extensions": {
        "message": "Cannot access a disposed object.\r\nObject name: 'JsonDocument'.",
        "stackTrace": "   at System.Text.Json.ThrowHelper.ThrowObjectDisposedException_JsonDocument()\r\n   at System.Text.Json.JsonDocument.CheckNotDisposed()\r\n   at System.Text.Json.JsonDocument.GetJsonTokenType(Int32 index)\r\n   at System.Text.Json.JsonElement.get_TokenType()\r\n   at System.Text.Json.JsonElement.get_ValueKind()\r\n   at Azure.DataApiBuilder.Service.Services.ExecutionHelper.TryGetPropertyFromParent(IResolverContext context, JsonElement& propertyValue) in Q:\\Repos\\data-api-builder\\src\\Core\\Services\\ExecutionHelper.cs:line 331\r\n   at Azure.DataApiBuilder.Service.Services.ExecutionHelper.ExecuteLeafField(IResolverContext context) in Q:\\Repos\\data-api-builder\\src\\Core\\Services\\ExecutionHelper.cs:line 182\r\n   at ResolverTypeInterceptor.<>c.<.ctor>b__8_2(IResolverContext ctx) in Q:\\Repos\\data-api-builder\\src\\Core\\Services\\ResolverTypeInterceptor.cs:line 40\r\n   at HotChocolate.Resolvers.FieldResolverDelegates.<>c__DisplayClass0_0.<.ctor>b__0(IResolverContext context)\r\n   at HotChocolate.Types.Helpers.FieldMiddlewareCompiler.<>c__DisplayClass9_0.<<CreateResolverMiddleware>b__0>d.MoveNext()\r\n--- End of stack trace from previous location ---\r\n   at HotChocolate.Authorization.AuthorizeMiddleware.InvokeAsync(IMiddlewareContext context)\r\n   at HotChocolate.Authorization.AuthorizeDirectiveType.<>c__DisplayClass3_0.<<CreateMiddleware>b__1>d.MoveNext()\r\n--- End of stack trace from previous location ---\r\n   at HotChocolate.Execution.Processing.Tasks.ResolverTask.ExecuteResolverPipelineAsync(CancellationToken cancellationToken)\r\n   at HotChocolate.Execution.Processing.Tasks.ResolverTask.TryExecuteAsync(CancellationToken cancellationToken)"
      }
    },
...
  "data": null
}

Version

576f4c5

What database are you using?

Azure SQL

What hosting model are you using?

Local (including CLI)

Which API approach are you accessing DAB through?

GraphQL

Relevant log output

Code of Conduct

• I agree to follow this project's Code of Conduct

[vadeveka]

On debugging, it looks like the jsondocuments registered for cleanup from root resolver are actually being disposed before the leaf resolver has even executed and hence the exception.
This only occurs with stored procedures and when roles other than anonymous are configured i.e. schema contains the authorize directives.

This issue does not occur on the commit before Hot Chocolate 15 Migration so the HC likely has some change relevant to this issue.

@michaelstaib : Do you know what might be the cause here?

[michaelstaib]

how are they registered? there are two cleanup.

    public void RegisterForCleanup(
        Func<ValueTask> action,
        CleanAfter cleanAfter = CleanAfter.Resolver)

default is cleanup after resolver ... that is before the children are executed.

/// <summary>
/// Specifies when the cleanup task shall be applied.
/// </summary>
public enum CleanAfter
{
    /// <summary>
    /// The cleanup task shall be applied after the resolver task is completed.
    /// </summary>
    Resolver,

    /// <summary>
    /// The cleanup task shall be applied when the query result is being disposed.
    /// </summary>
    Request
}

[vadeveka]

Yes, RegisterForCleanup was used without the cleanAfter param. Looks like this param was introduced after HC12 and I guess we missed the bug. Adding cleanAfter = CleanAfter.Request addresses this issue.

However, it is strange that this issue only manifests if the stored-proc based query or mutation was used with authorization. I guess there is a race condition/timing issue caused when authorization is involved, perhaps because the auth handler adds some delay before leaf resolver is called versus when no authorization. I'll add an integration test for authorization with stored proc.

[simonsabin]

Is there a stable version that doesn't have this issue?