Metadata exposes my entire internal db structure

[granthoff1107]

I'm trying to configure Odata to only expose certain entities in my context. I'm using .Net-Core. with the 7.0.0 Beta2. Package

services.AddOData();

//...

app.UseMvc(routeBuilder =>
{
    routeBuilder.MapODataServiceRoute("odata", null, GetModel());
    routeBuilder.EnableDependencyInjection();
});

public static IEdmModel GetModel()
{
    var builder = new ODataConventionModelBuilder();
    var skillSet = builder.EntitySet<Skill>(nameof(Skill));
    skillSet.EntityType.Count().Filter().OrderBy().Expand().Select();
    builder.Namespace = "ODataTest.Models";
    builder.ContainerName = "DefaultContainer";

    return builder.GetEdmModel();
}

When I navigate to the $Metadata page I can see the entity I've exposed plus all of the others in my DB context

<?xml version="1.0" encoding="utf-8"?>
<edmx:Edmx Version="4.0" xmlns:edmx="http://docs.oasis-open.org/odata/ns/edmx">
    <edmx:DataServices>
        <Schema Namespace="Entities.Models" xmlns="http://docs.oasis-open.org/odata/ns/edm">
            <EntityType Name="Skill">
                <Key>
                    <PropertyRef Name="Id" />
                </Key>
                <Property Name="Id" Type="Edm.Int32" Nullable="false" />
                <Property Name="Name" Type="Edm.String" />
                <NavigationProperty Name="RequestNegotiations" Type="Collection(Entities.Models.RequestNegotiation)" />
                <NavigationProperty Name="UserSkills" Type="Collection(Entities.Models.UserSkill)" />
            </EntityType>
            <EntityType Name="Conversation">
                <Key>
                    <PropertyRef Name="Id" />
                </Key>
                <Property Name="Id" Type="Edm.Int32" Nullable="false" />
                <Property Name="Created" Type="Edm.DateTimeOffset" Nullable="false" />
                <NavigationProperty Name="ConversationSubscriptions" Type="Collection(Entities.Models.ConversationSubscription)" />
                <NavigationProperty Name="Messages" Type="Collection(Entities.Models.Message)" />
                <NavigationProperty Name="ServiceRequests" Type="Collection(Astoot.Entities.Models.ServiceRequest)" />
            </EntityType>

This is because my Skill Entity has Navigation Properties so recursively checks all the entity navigation properties until the whole database is exposed. I don't want to have to manually hide all my navigation properties of the entities I expose. Is there a way to Ignore Navigation Properties by Default. If not can I offer that as a feature request?

[xuzhg]

What do you mean to Is there a way to Ignore Navigation Properties by Default.

Basically, you can call Ignore from model builder to ignore the unexpected properties. Please let me know your result.

[granthoff1107]

@xuzhg thanks for your quick response. I'm aware of the Ignore functionality.
However I'm wondering if there is a way to automatically Ignore all Navigation Properties.

Most third parties tools I've worked with are configured in a way which protects data.
By default OData seems to scan all of your navigation properties, which if you connect it to an entity which connects to a main entity. It pretty much exposes your entire Database.

Is there a way to I can do something like
routeBuilder.IgnoreNavigationProperties();

With this feature the user would have the choice to opt into manually exposing navigation properties.
I know I might be able to achieve this through reflection, but I thought it might be a useful feature for others who are only trying to selectively expose their data.

[xuzhg]

That's a great idea. However, we don't have such functionality so far.
My suggestion is to: Either calling Igore(), or decorating your navigation properties with [IgnoreDataMember]

[granthoff1107]

@xuzhg, Could you expose a method for Removing Properties from the Ignore().
I think I can achieve what I wanted through reflection, but the issue now would but that once I add a property to the Ignore.

I don't see a way to remove it from the _ignoredTypes collection.

Do you guys accept pull requests?
I'll gladly take on the responsibility, and provide Unit Tests if you do, seeing as it coincides with my current project.

[xuzhg]

Any contribution is warmly welcome! Thanks!

[granthoff1107]

I've created a working extension for this issue.
I'll clean up the code a bit, but I'm not sure if there is a version of this that would pass code review.

@xuzhg I'm not totally familiar with the coding standard of Microsoft, I wanted your opinion on the matter whether It would be possible to pass code review with the issues listed below.

the few issues I have with this code.

1. I'm not sure of an easy way to get the return type of the Expression with out using the Dynamic Keyword.

2. I assume that anything that is an IEnumerable (except for string) or that resides in the same namespace is a Navigation Property (which should be the case 99% of the time).

3. Everything needs to be refactored into it's own extensions ETC. but I won't bother with that unless I know first It's possible to pass code review

    public static class ODataBuilderExtensions
    {
        //TODO: This method should Ideally take in a List of Expression<Func<TEntityType, object>> to figure out the property infos
        public static void IgnoreAllNavigationProperties<TEntityType>(this EntityTypeConfiguration<TEntityType> entityTypeConfiguration, params string[] excludedPropertyNames)
            where TEntityType : class
        {
            var navigationProperties = GetNavigationProperties<TEntityType>(excludedPropertyNames);

            var ignoreRawGenericMethodInfo = entityTypeConfiguration.GetIgnoreMethodInfo();

            foreach (var navigationProperty in navigationProperties)
            {
                object unboundNavigationPropertyExpression = navigationProperty.StripConvert();
                var returnPropertyType = unboundNavigationPropertyExpression.GetType()
                    .GetGenericArguments()[0].GetGenericArguments()[1];                
                var ignoreMethod = ignoreRawGenericMethodInfo.MakeGenericMethod(returnPropertyType);
                ignoreMethod.Invoke(entityTypeConfiguration, new object[] { unboundNavigationPropertyExpression });
            }
        }

        private static MethodInfo GetIgnoreMethodInfo<TEntityType>(this EntityTypeConfiguration<TEntityType> entityTypeConfiguration)
            where TEntityType : class
        {

            var ignoreMethodName = nameof(EntityTypeConfiguration<TEntityType>.Ignore);
            var ignoreMethodInfos = entityTypeConfiguration.GetType().GetMethods()
                            .Where(methodInfo => methodInfo.ContainsGenericParameters &&
                                    methodInfo.Name == ignoreMethodName)
                            .Where(x => x.GetParameters().Length == 1);

            foreach(var ignoreMethodInfo in ignoreMethodInfos)
            {
                var parameterType = ignoreMethodInfo.GetParameters()[0].ParameterType;
                if(parameterType.IsGenericType && parameterType.GetGenericTypeDefinition() == typeof(Expression<>))
                {
                    return ignoreMethodInfo;
                }
            }

            throw new Exception($"Could not find suitable method '{ignoreMethodName}'");
        }

        private static List<Expression<Func<TEntityType, object>>> GetNavigationProperties<TEntityType>(string[] excludedPropertyNames)
        {
            excludedPropertyNames = excludedPropertyNames ?? new string[0];

            var entityType = typeof(TEntityType);
            var navigationProperties = entityType.GetProperties()
                             .Where(x => false == excludedPropertyNames.Contains(x.Name))
                             .Where(p => (typeof(IEnumerable).IsAssignableFrom(p.PropertyType) && p.PropertyType != typeof(string))
                                                || p.PropertyType.Namespace == entityType.Namespace);

            return navigationProperties.Select(propertyInfo => ToObjectExpression<TEntityType>(propertyInfo)).ToList();
        }

        static Expression<Func<TEntity, object>> ToObjectExpression<TEntity>(PropertyInfo propertyInfo)
        {
            if (typeof(TEntity) != propertyInfo.DeclaringType)
            {
                throw new ArgumentException("the type of TEntity should be the same as the DeclaringType in the propertyInfo");
            }

            var parameter = Expression.Parameter(propertyInfo.DeclaringType);
            var property = Expression.Property(parameter, propertyInfo);

            return property.ToObjectExpression<TEntity>(new[] { parameter });
        }

        public static LambdaExpression StripConvert(this LambdaExpression expression)
        {
            if (ExpressionType.Convert == expression.Body.NodeType)
            {
                return Expression.Lambda(((UnaryExpression)expression.Body).Operand, expression.Parameters);
            }

            return expression;
        }
    }