feat: add CosmosDB read-only query endpoint to the admin API - #6168
feat: add CosmosDB read-only query endpoint to the admin API#6168bennerv wants to merge 1 commit into
Conversation
Add a MISE-gated admin API endpoint for direct CosmosDB read access in production environments where the data dumper controller doesn't cover all troubleshooting scenarios. - POST /admin/v1/cosmos/query: accepts a container name, SQL query, optional partition key, and max items limit - Validates queries don't contain mutating keywords (UPDATE, DELETE, INSERT, CREATE, etc.) using word-boundary regex after stripping string literals to avoid false positives - Returns results as raw JSON documents Includes unit tests for keyword validation and E2E tests that verify queries against the Resources and Fleet containers. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
Skipping CI for Draft Pull Request. |
|
This PR was mostly AI-authored. I'll take it out of draft once I've fully reviewed it. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: bennerv The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
| var mutatingKeywordPattern *regexp.Regexp | ||
|
|
||
| func init() { | ||
| keywords := []string{ |
There was a problem hiding this comment.
todo: figure out if the query client we use actually allows mutating records. if it doesn't no need to filter out key words here.
| Count: len(results), | ||
| } | ||
|
|
||
| _, err = arm.WriteJSONResponse(w, http.StatusOK, resp) |
There was a problem hiding this comment.
todo: we should stream the result instead of limiting max items so we can see the full response from the client side?
1 participant
Summary
POST /admin/v1/cosmos/queryendpoint to the admin API for direct CosmosDB read access in production environmentsTest plan
🤖 Generated with Claude Code