Update column validation logic for insert operations when considering request-body-strict

src/Core/Services/RequestValidator.cs

@@ -322,7 +322,6 @@ public void ValidateInsertRequestContext(InsertRequestContext insertRequestCtx)
                 if (ValidateColumn(column.Value,
                                    exposedName!,
                                    fieldsInRequestBody,
-                                   sourceDefinition.PrimaryKey,
                                    isReplacementUpdate: true,
                                    isRequestBodyStrict))
                 {
@@ -407,7 +406,7 @@ public void ValidateUpsertRequestContext(UpsertRequestContext upsertRequestCtx)
                 }
 
                 bool isReplacementUpdate = (upsertRequestCtx.OperationType == EntityActionOperation.Upsert) ? true : false;
-                if (ValidateColumn(column.Value, exposedName!, fieldsInRequestBody, sourceDefinition.PrimaryKey, isReplacementUpdate, isRequestBodyStrict))
+                if (ValidateColumn(column.Value, exposedName!, fieldsInRequestBody, isReplacementUpdate, isRequestBodyStrict))
                 {
                     unValidatedFields.Remove(exposedName!);
                 }
@@ -432,25 +431,18 @@ public void ValidateUpsertRequestContext(UpsertRequestContext upsertRequestCtx)
         /// <param name="column">The column to be verified.</param>
         /// <param name="exposedName">Exposed name of the column.</param>
         /// <param name="fieldsInRequestBody">The fields in the request body.</param>
-        /// <param name="primaryKey">The primary key of the source definition for the column.</param>
         /// <param name="isReplacementUpdate">Indicates if the column is a replacement update.</param>
         /// <param name="isRequestBodyStrict">Indicates if the runtime setting is request body strict.</param>
         /// <returns>true if the column is validated.</returns>
         private static bool ValidateColumn(ColumnDefinition column,
                                            string exposedName,
                                            IEnumerable<string> fieldsInRequestBody,
-                                           IEnumerable<string> primaryKey,
                                            bool isReplacementUpdate,
                                            bool isRequestBodyStrict)
         {
             string message;
-            // Autogenerated values should never be present in a request body, unless they are both a primary key
-            // and request-body-strict is false.
-            // TODO: Add a similar check for read-only fields.
-            if (column.IsAutoGenerated &&
-                fieldsInRequestBody.Contains(exposedName) &&
-                (!primaryKey.Contains(exposedName) ||
-                (primaryKey.Contains(exposedName) && isRequestBodyStrict)))
+            // Read-only fields should never be present in a request body, unless request-body-strict is false.
+            if (column.IsReadOnly && fieldsInRequestBody.Contains(exposedName) && isRequestBodyStrict)
             {
                 message = $"Invalid request body. Field not allowed in body: {exposedName}.";
             }

src/Service.Tests/SqlTests/RestApiTests/RestBodyNonStrictModeTests/MsSqlRestBodyNonStrictModeTests.cs

@@ -37,6 +37,12 @@ public class MsSqlRestBodyNonStrictModeTests : RestBodyNonStrictModeTests
                 $"SELECT * FROM {_integrationTableName } WHERE [id] = 5001 AND [title] = 'Foo' AND [publisher_id] = 1234 " +
                 $"FOR JSON PATH, INCLUDE_NULL_VALUES, WITHOUT_ARRAY_WRAPPER"
             },
+            {
+                "InsertOneWithAutoGeneratedFieldInRequestBody",
+                $"SELECT * FROM {_integration_AutoGenNonPK_TableName } WHERE [id] = 0 AND [title] = 'Foo' AND [volume] = 5006 " +
+                $"AND [CategoryName] = 'Bar' " +
+                $"FOR JSON PATH, INCLUDE_NULL_VALUES, WITHOUT_ARRAY_WRAPPER"
+            },
             {
                 "InsertOneWithRowversionFieldInRequestBody",
                 $"SELECT * FROM {_tableWithReadOnlyFields } WHERE [id] = 2 AND [book_name] = 'Another Awesome Book' " +
@@ -200,6 +206,33 @@ await SetupAndRunRestApiTest(
                 );
         }
 
+        /// <summary>
+        /// Test to validate auto-generated fields are allowed in request body for insert operation
+        /// when we operate non-strict mode for REST request body i.e. runtime.rest.request-body-strict = false.
+        /// </summary>
+        [TestMethod]
+        public async Task InsertOneWithAutoGeneratedFieldInRequestBody()
+        {
+            string requestBody = @"
+            {
+                ""id"": 0,
+                ""title"": ""Foo"",
+                ""volume"": 0,
+                ""categoryName"": ""Bar""
+            }";
+
+            await SetupAndRunRestApiTest(
+                    primaryKeyRoute: null,
+                    queryString: null,
+                    entityNameOrPath: _integration_AutoGenNonPK_EntityName,
+                    sqlQuery: GetQuery("InsertOneWithAutoGeneratedFieldInRequestBody"),
+                    operationType: EntityActionOperation.Insert,
+                    requestBody: requestBody,
+                    expectedStatusCode: HttpStatusCode.Created,
+                    expectedLocationHeader: string.Empty
+                );
+        }
+
         /// <summary>
         /// Test to validate that rowversion fields are allowed in request body for PATCH operation
         /// when we operate non-strict mode for REST request body i.e. runtime.rest.request-body-strict = false.