Insert into temp table only for include and revinclude searches (#5209)

* Insert into temp table only for include and revinclude searches

* Stop include and revinclude searches with smart v2 scopes with seach parameters

Author: apurvabhaleMS

src/Microsoft.Health.Fhir.Core/Resources.Designer.cs

@@ -251,6 +251,9 @@
   <data name="IncludeRevIncludeChainedSearchesDoNotSupportFinerGrainedResourceConstraintsUsingSearchParameters" xml:space="preserve">
     <value>Include, RevInclude and Chained searches do not support SMART V2 finer-grained resource constraints using search parameters.</value>
   </data>
+  <data name="IncludeRevIncludeSearchesDoNotSupportFinerGrainedResourceConstraintsUsingSearchParameters" xml:space="preserve">
+    <value>Include and RevInclude searches do not support SMART V2 finer-grained resource constraints using search parameters.</value>
+  </data>
   <data name="InvalidBooleanConfigSetting" xml:space="preserve">
     <value>Field '{0}' with value '{1}' is not supported.</value>
   </data>
@@ -844,4 +847,4 @@
   <data name="NotReferencedParameterWildcardType" xml:space="preserve">
     <value>Not Referenced doesn't allow for a wildcard resource type with a specific search field</value>
   </data>
-</root>
+</root>

src/Microsoft.Health.Fhir.Core/Resources.resx

@@ -760,6 +760,15 @@ private void CheckFineGrainedAccessControl(List<Expression> searchExpressions, S
             // check resource type restrictions from SMART clinical scopes
             if (_contextAccessor.RequestContext?.AccessControlContext?.ApplyFineGrainedAccessControl == true)
             {
+                // Throw 400 if chained, include or revinclude in searchParameters with ApplyFineGrainedAccessControlWithSearchParameters
+                if (_contextAccessor.RequestContext?.AccessControlContext?.ApplyFineGrainedAccessControlWithSearchParameters == true)
+                {
+                    if (searchParams.Include.Any() || searchParams.RevInclude.Any())
+                    {
+                        throw new BadRequestException(string.Format(Core.Resources.IncludeRevIncludeSearchesDoNotSupportFinerGrainedResourceConstraintsUsingSearchParameters));
+                    }
+                }
+
                 bool allowAllResourceTypes = false;
                 var clinicalScopeResources = new List<ResourceType>();
                 var finalSmartSearchExpressions = new List<Expression>();

src/Microsoft.Health.Fhir.Shared.Core/Features/Search/SearchOptionsFactory.cs

@@ -134,6 +134,7 @@ public override object VisitSqlRoot(SqlRootExpression expression, SearchOptions
                 }
 
                 StringBuilder.AppendLine(")");
+                bool hasIncludeExpressions = expression.SearchParamTableExpressions.Any(t => t.Kind == SearchParamTableExpressionKind.Include);
                 StringBuilder.AppendLine("DECLARE @FilteredDataSmartV2Union AS TABLE (T1 smallint, Sid1 bigint)");
                 StringBuilder.AppendLine(";WITH");
                 StringBuilder.AppendDelimited($"{Environment.NewLine},", expression.SearchParamTableExpressions.SortExpressionsByQueryLogic(), (sb, tableExpression) =>
@@ -144,10 +145,14 @@ public override object VisitSqlRoot(SqlRootExpression expression, SearchOptions
                         {
                             // Union expressions for smart v2 scopes with search parameters needs to be handled differently
                             AppendSmartNewSetOfUnionAllTableExpressions(context, unionExpression, tableExpression.QueryGenerator);
-                            sb.AppendLine();
-                            sb.AppendLine($"INSERT INTO @FilteredDataSmartV2Union SELECT T1, Sid1 FROM cte{_tableExpressionCounter}");
-                            AddOptionClause();
-                            sb.AppendLine($";WITH cte{_tableExpressionCounter} AS (SELECT * FROM @FilteredDataSmartV2Union)");
+                            if (hasIncludeExpressions)
+                            {
+                                sb.AppendLine();
+                                sb.AppendLine($"INSERT INTO @FilteredDataSmartV2Union SELECT T1, Sid1 FROM cte{_tableExpressionCounter}");
+                                AddOptionClause();
+                                sb.AppendLine($";WITH cte{_tableExpressionCounter} AS (SELECT * FROM @FilteredDataSmartV2Union)");
+                            }
+
                             _smartV2UnionVisited = true;
                         }
                         else