Skip unsupported column data types during schema discovery

config-generators/mssql-commands.txt

@@ -22,6 +22,8 @@ add VectorType --config "dab-config.MsSql.json" --source vector_type_table --res
 update VectorType --config "dab-config.MsSql.json" --permissions "authenticated:create,read,delete,update"
 update VectorOwner --config "dab-config.MsSql.json" --relationship vectors --target.entity VectorType --cardinality many --relationship.fields "id:owner_id"
 update VectorType --config "dab-config.MsSql.json" --relationship owner --target.entity VectorOwner --cardinality one --relationship.fields "owner_id:id"
+add GeometryType --config "dab-config.MsSql.json" --source geometry_type_table --rest true --graphql true --permissions "anonymous:read"
+add TemporalGeometryType --config "dab-config.MsSql.json" --source temporal_geometry_type_table --rest true --graphql true --permissions "anonymous:create,read,update"
 add Profile --config "dab-config.MsSql.json" --source profiles --rest true --graphql true --permissions "anonymous:create,read,delete,update"
 update Profile --config "dab-config.MsSql.json" --permissions "authenticated:create,read,delete,update"
 add XmlProfile --config "dab-config.MsSql.json" --source xml_profiles --rest true --graphql true --permissions "anonymous:create,read,delete,update"

src/Core/Authorization/AuthorizationResolver.cs

@@ -810,6 +810,62 @@ private static ResolvedDatabasePolicy GetPolicyWithClaimValues(string policy, Di
         return new ResolvedDatabasePolicy(processedPolicy, claimValues);
     }
 
+    /// <summary>
+    /// Returns the field names a database policy references through "@item.", skipping single-quoted
+    /// literals, in which a doubled quote is an escaped quote.
+    /// </summary>
+    internal static IEnumerable<string> GetFieldReferencesInDatabasePolicy(string? policy)
+    {
+        if (string.IsNullOrEmpty(policy))
+        {
+            yield break;
+        }
+
+        int index = 0;
+        while (index < policy.Length)
+        {
+            if (policy[index] == '\'')
+            {
+                index++;
+                while (index < policy.Length)
+                {
+                    if (policy[index++] != '\'')
+                    {
+                        continue;
+                    }
+
+                    if (index < policy.Length && policy[index] == '\'')
+                    {
+                        index++;
+                        continue;
+                    }
+
+                    break;
+                }
+
+                continue;
+            }
+
+            if (string.CompareOrdinal(policy, index, FIELD_PREFIX, 0, FIELD_PREFIX.Length) != 0)
+            {
+                index++;
+                continue;
+            }
+
+            int fieldStart = index + FIELD_PREFIX.Length;
+            index = fieldStart;
+            while (index < policy.Length && (char.IsAsciiLetterOrDigit(policy[index]) || policy[index] == '_'))
+            {
+                index++;
+            }
+
+            if (index > fieldStart)
+            {
+                yield return policy[fieldStart..index];
+            }
+        }
+    }
+
     /// <summary>
     /// Emits a structured audit signal when a configured (non-empty) database authorization
     /// policy resolves to an empty predicate, which silently removes the intended row/column

src/Core/Resolvers/MsSqlQueryBuilder.cs

@@ -686,6 +686,30 @@ END AS is_system_object
                     FROM all_tables AS o
                     JOIN sys.objects AS so
                         ON so.object_id = o.object_id
+                ),
+                tables_with_invalid_types AS
+                (
+                    SELECT c.object_id
+                    FROM sys.columns AS c
+                    JOIN sys.types AS ty
+                        ON c.user_type_id = ty.user_type_id
+                    WHERE ty.name IN (N'sql_variant', N'rowversion')
+                        -- Columns of CLR types such as geometry are skipped, which only fails when they are in the primary key.
+                        OR
+                        (
+                            ty.is_assembly_type = 1
+                            AND EXISTS
+                            (
+                                SELECT 1
+                                FROM sys.index_columns AS ic
+                                JOIN sys.indexes AS i
+                                    ON i.object_id = ic.object_id
+                                    AND i.index_id = ic.index_id
+                                WHERE ic.object_id = c.object_id
+                                    AND ic.column_id = c.column_id
+                                    AND i.is_primary_key = 1
+                            )
+                        )
                 )
                 SELECT
                     a.schema_name AS [schema],
@@ -698,22 +722,7 @@ ELSE REPLACE(
                                 )
                     END AS entity_name,
                     CASE
-                        WHEN EXISTS
-                        (
-                            SELECT 1
-                            FROM sys.columns AS c
-                            JOIN sys.types AS ty
-                                ON c.user_type_id = ty.user_type_id
-                            WHERE c.object_id = a.object_id
-                                AND ty.name IN
-                                (
-                                    N'geography',
-                                    N'geometry',
-                                    N'hierarchyid',
-                                    N'sql_variant',
-                                    N'rowversion'
-                                )
-                        ) THEN 1
+                        WHEN a.object_id IN (SELECT object_id FROM tables_with_invalid_types) THEN 1
                         ELSE 0
                     END AS contains_invalid_types
                 FROM eligible_tables AS a
@@ -742,22 +751,7 @@ WHERE a.full_name LIKE ip.pattern COLLATE DATABASE_DEFAULT ESCAPE '\'
                     AND
                     (
                         @exclude_invalid_types = 0
-                        OR NOT EXISTS
-                        (
-                            SELECT 1
-                            FROM sys.columns AS c
-                            JOIN sys.types AS ty
-                                ON c.user_type_id = ty.user_type_id
-                            WHERE c.object_id = a.object_id
-                                AND ty.name IN
-                                (
-                                    N'geography',
-                                    N'geometry',
-                                    N'hierarchyid',
-                                    N'sql_variant',
-                                    N'rowversion'
-                                )
-                        )
+                        OR a.object_id NOT IN (SELECT object_id FROM tables_with_invalid_types)
                     )
                 ORDER BY
                     a.schema_name,