diff --git a/KustoSchemaTools/Changes/DatabaseChanges.cs b/KustoSchemaTools/Changes/DatabaseChanges.cs index e21841c..ff05d12 100644 --- a/KustoSchemaTools/Changes/DatabaseChanges.cs +++ b/KustoSchemaTools/Changes/DatabaseChanges.cs @@ -48,6 +48,18 @@ public static List GenerateChanges(Database oldState, Database newState result.AddRange(GenerateDeletions(oldState, newState.Deletions, log)); + // Kusto does not expose AllowMaterializedViewsWithoutRowLevelSecurity in any query output, + // so propagate the flag from the desired state to the cluster state to avoid phantom diffs. + foreach (var table in newState.Tables) + { + if (table.Value.Policies?.AllowMaterializedViewsWithoutRowLevelSecurity == true + && oldState.Tables.ContainsKey(table.Key) + && oldState.Tables[table.Key].Policies != null) + { + oldState.Tables[table.Key].Policies.AllowMaterializedViewsWithoutRowLevelSecurity = true; + } + } + result.AddRange(GenerateScriptCompareChanges(oldState, newState, db => db.Tables, nameof(newState.Tables), log, (oldItem, newItem) => oldItem != null || newItem.Columns?.Any() == true)); var mvChanges = GenerateScriptCompareChanges(oldState, newState, db => db.MaterializedViews, nameof(newState.MaterializedViews), log); foreach(var mvChange in mvChanges) diff --git a/KustoSchemaTools/Model/Policy.cs b/KustoSchemaTools/Model/Policy.cs index 24188bb..311da75 100644 --- a/KustoSchemaTools/Model/Policy.cs +++ b/KustoSchemaTools/Model/Policy.cs @@ -10,6 +10,7 @@ public class Policy public string? HotCache { get; set; } public PartitioningPolicy? Partitioning { get; set; } public string? RowLevelSecurity { get; set; } + public bool AllowMaterializedViewsWithoutRowLevelSecurity { get; set; } = false; public List CreateScripts(string name, string entity) @@ -26,7 +27,10 @@ public List CreateScripts(string name, string entity) if (!string.IsNullOrEmpty(RowLevelSecurity)) { - scripts.Add(new DatabaseScriptContainer("RowLevelSecurity", 57, $".alter {entity} {name} policy row_level_security enable ```{RowLevelSecurity}```")); + var rlsWithClause = AllowMaterializedViewsWithoutRowLevelSecurity + ? " with (allowMaterializedViewsWithoutRowLevelSecurity=true)" + : ""; + scripts.Add(new DatabaseScriptContainer("RowLevelSecurity", 57, $".alter {entity} {name} policy row_level_security enable{rlsWithClause} ```{RowLevelSecurity}```")); } else {