Support allowMaterializedViewsWithoutRowLevelSecurity on RLS policies (#147)

Author: ashleyvansp

KustoSchemaTools/Changes/DatabaseChanges.cs

@@ -48,6 +48,18 @@ public static List<IChange> GenerateChanges(Database oldState, Database newState
 
             result.AddRange(GenerateDeletions(oldState, newState.Deletions, log));
 
+            // Kusto does not expose AllowMaterializedViewsWithoutRowLevelSecurity in any query output,
+            // so propagate the flag from the desired state to the cluster state to avoid phantom diffs.
+            foreach (var table in newState.Tables)
+            {
+                if (table.Value.Policies?.AllowMaterializedViewsWithoutRowLevelSecurity == true
+                    && oldState.Tables.ContainsKey(table.Key)
+                    && oldState.Tables[table.Key].Policies != null)
+                {
+                    oldState.Tables[table.Key].Policies.AllowMaterializedViewsWithoutRowLevelSecurity = true;
+                }
+            }
+
             result.AddRange(GenerateScriptCompareChanges(oldState, newState, db => db.Tables, nameof(newState.Tables), log, (oldItem, newItem) => oldItem != null || newItem.Columns?.Any() == true));
             var mvChanges = GenerateScriptCompareChanges(oldState, newState, db => db.MaterializedViews, nameof(newState.MaterializedViews), log);
             foreach(var mvChange in mvChanges)

KustoSchemaTools/Model/Policy.cs

@@ -10,6 +10,7 @@ public class Policy
         public string? HotCache { get; set; }
         public PartitioningPolicy? Partitioning { get; set; }
         public string? RowLevelSecurity { get; set; }
+        public bool AllowMaterializedViewsWithoutRowLevelSecurity { get; set; } = false;
 
 
         public List<DatabaseScriptContainer> CreateScripts(string name, string entity)
@@ -26,7 +27,10 @@ public List<DatabaseScriptContainer> CreateScripts(string name, string entity)
 
             if (!string.IsNullOrEmpty(RowLevelSecurity))
             {
-                scripts.Add(new DatabaseScriptContainer("RowLevelSecurity", 57, $".alter {entity} {name} policy row_level_security enable ```{RowLevelSecurity}```"));
+                var rlsWithClause = AllowMaterializedViewsWithoutRowLevelSecurity
+                    ? " with (allowMaterializedViewsWithoutRowLevelSecurity=true)"
+                    : "";
+                scripts.Add(new DatabaseScriptContainer("RowLevelSecurity", 57, $".alter {entity} {name} policy row_level_security enable{rlsWithClause} ```{RowLevelSecurity}```"));
             }
             else
             {