RuntimeConfigValidator.cs

// Copyright (c) Microsoft Corporation.
// Licensed under the MIT License.

using System.IO.Abstractions;
using System.Net;
using System.Text.RegularExpressions;
using Azure.DataApiBuilder.Config.DatabasePrimitives;
using Azure.DataApiBuilder.Config.ObjectModel;
using Azure.DataApiBuilder.Config.ObjectModel.Embeddings;
using Azure.DataApiBuilder.Core.AuthenticationHelpers;
using Azure.DataApiBuilder.Core.Authorization;
using Azure.DataApiBuilder.Core.Models;
using Azure.DataApiBuilder.Core.Resolvers;
using Azure.DataApiBuilder.Core.Resolvers.Factories;
using Azure.DataApiBuilder.Core.Services;
using Azure.DataApiBuilder.Core.Services.MetadataProviders;
using Azure.DataApiBuilder.Service.Exceptions;
using Azure.DataApiBuilder.Service.GraphQLBuilder;
using Microsoft.Extensions.Logging;

namespace Azure.DataApiBuilder.Core.Configurations;

/// <summary>
/// This class encapsulates methods to validate the runtime config file.
/// </summary>
public class RuntimeConfigValidator : IConfigValidator
{
    private readonly RuntimeConfigProvider _runtimeConfigProvider;
    private readonly IFileSystem _fileSystem;
    private readonly ILogger<RuntimeConfigValidator> _logger;

    // Only characters from a-z,A-Z,0-9,.,_ are allowed to be present within the claimType.
    private static readonly string _invalidClaimChars = @"[^a-zA-Z0-9_\.]+";

    private bool _isValidateOnly;
    public List<Exception> ConfigValidationExceptions { get; private set; }

    // Regex to check occurrence of any character not among [a-z,A-Z,0-9,.,_] in the claimType.
    // The claimType is invalid if there is a match found.
    private static readonly Regex _invalidClaimCharsRgx = new(_invalidClaimChars, RegexOptions.Compiled);

    // Regex used to extract all claimTypes in policy. It finds all the substrings which are
    // of the form @claims.*** delimited by space character,end of the line or end of the string.
    private static readonly string _claimChars = @"@claims\.[^\s\)]*";

    // List of databases that support row level policy with create action
    private static readonly HashSet<DatabaseType> _databaseTypesSupportingCreatePolicy =
    [
        DatabaseType.MSSQL,
        DatabaseType.DWSQL,
        DatabaseType.PostgreSQL
    ];

    // Error messages for user-delegated authentication configuration.
    public const string USER_DELEGATED_AUTH_DATABASE_TYPE_ERR_MSG =
        "User-delegated authentication is only supported when data-source.database-type is 'mssql'.";

    public const string USER_DELEGATED_AUTH_MISSING_AUDIENCE_ERR_MSG =
        "data-source.user-delegated-auth.database-audience must be set when user-delegated-auth is configured.";

    public const string USER_DELEGATED_AUTH_CACHING_ERR_MSG =
        "runtime.cache.enabled must be false when user-delegated-auth is configured.";

    public const string USER_DELEGATED_AUTH_MISSING_CREDENTIALS_ERR_MSG =
        "User-delegated authentication requires DAB_OBO_CLIENT_ID, DAB_OBO_TENANT_ID, and DAB_OBO_CLIENT_SECRET environment variables.";

    // Error messages.
    public const string INVALID_CLAIMS_IN_POLICY_ERR_MSG = "One or more claim types supplied in the database policy are not supported.";

    public RuntimeConfigValidator(
        RuntimeConfigProvider runtimeConfigProvider,
        IFileSystem fileSystem,
        ILogger<RuntimeConfigValidator> logger,
        bool isValidateOnly = false)
    {
        _runtimeConfigProvider = runtimeConfigProvider;
        _fileSystem = fileSystem;
        _logger = logger;
        _isValidateOnly = isValidateOnly;
        ConfigValidationExceptions = new();
    }

    /// <summary>
    /// The driver for validation of the runtime configuration file.
    /// </summary>
    public void ValidateConfigProperties()
    {
        RuntimeConfig runtimeConfig = _runtimeConfigProvider.GetConfig();

        ValidateDataSourceInConfig(
            runtimeConfig,
            _fileSystem,
            _logger);

        ValidateAuthenticationOptions(runtimeConfig);
        ValidateGlobalEndpointRouteConfig(runtimeConfig);
        ValidateAppInsightsTelemetryConnectionString(runtimeConfig);
        ValidateLoggerFilters(runtimeConfig);
        ValidateAzureLogAnalyticsAuth(runtimeConfig);
        ValidateFileSinkPath(runtimeConfig);
        ValidateEmbeddingsOptions(runtimeConfig);
    }

    /// <summary>
    /// Throws exception if Invalid connection-string or database type
    /// is present in the config
    /// </summary>
    public void ValidateDataSourceInConfig(
        RuntimeConfig runtimeConfig,
        IFileSystem fileSystem,
        ILogger logger)
    {
        foreach (DataSource dataSource in runtimeConfig.ListAllDataSources())
        {
            // Connection string can't be null or empty
            if (string.IsNullOrWhiteSpace(dataSource.ConnectionString))
            {
                HandleOrRecordException(new DataApiBuilderException(
                    message: DataApiBuilderException.CONNECTION_STRING_ERROR_MESSAGE,
                    statusCode: HttpStatusCode.ServiceUnavailable,
                    subStatusCode: DataApiBuilderException.SubStatusCodes.ErrorInInitialization));
            }
        }

        ValidateDatabaseType(runtimeConfig, fileSystem, logger);

        ValidateUserDelegatedAuthOptions(runtimeConfig);
    }

    /// <summary>
    /// Validates configuration for user-delegated authentication (OBO).
    /// When any data source has user-delegated-auth configured, the following
    /// rules are enforced:
    /// - data-source.database-type must be "mssql".
    /// - data-source.user-delegated-auth.database-audience must be present.
    /// - runtime.cache.enabled must be false.
    /// - Environment variables DAB_OBO_CLIENT_ID, DAB_OBO_TENANT_ID, and DAB_OBO_CLIENT_SECRET must be set.
    /// </summary>
    /// <param name="runtimeConfig">Runtime configuration.</param>
    private void ValidateUserDelegatedAuthOptions(RuntimeConfig runtimeConfig)
    {
        foreach (DataSource dataSource in runtimeConfig.ListAllDataSources())
        {
            // Skip validation if user-delegated-auth is not configured or not enabled
            if (dataSource.UserDelegatedAuth is null || !dataSource.UserDelegatedAuth.Enabled)
            {
                continue;
            }

            if (dataSource.DatabaseType != DatabaseType.MSSQL)
            {
                HandleOrRecordException(new DataApiBuilderException(
                    message: USER_DELEGATED_AUTH_DATABASE_TYPE_ERR_MSG,
                    statusCode: HttpStatusCode.ServiceUnavailable,
                    subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
            }

            if (string.IsNullOrWhiteSpace(dataSource.UserDelegatedAuth.DatabaseAudience))
            {
                HandleOrRecordException(new DataApiBuilderException(
                    message: USER_DELEGATED_AUTH_MISSING_AUDIENCE_ERR_MSG,
                    statusCode: HttpStatusCode.ServiceUnavailable,
                    subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
            }

            // Validate OBO App Registration credentials are configured via environment variables.
            string? clientId = Environment.GetEnvironmentVariable(UserDelegatedAuthOptions.DAB_OBO_CLIENT_ID_ENV_VAR);
            string? tenantId = Environment.GetEnvironmentVariable(UserDelegatedAuthOptions.DAB_OBO_TENANT_ID_ENV_VAR);
            string? clientSecret = Environment.GetEnvironmentVariable(UserDelegatedAuthOptions.DAB_OBO_CLIENT_SECRET_ENV_VAR);

            if (string.IsNullOrWhiteSpace(clientId) || string.IsNullOrWhiteSpace(tenantId) || string.IsNullOrWhiteSpace(clientSecret))
            {
                HandleOrRecordException(new DataApiBuilderException(
                    message: USER_DELEGATED_AUTH_MISSING_CREDENTIALS_ERR_MSG,
                    statusCode: HttpStatusCode.ServiceUnavailable,
                    subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
            }

            // Validate caching is disabled when user-delegated-auth is enabled
            if (runtimeConfig.Runtime?.Cache?.Enabled == true)
            {
                HandleOrRecordException(new DataApiBuilderException(
                    message: USER_DELEGATED_AUTH_CACHING_ERR_MSG,
                    statusCode: HttpStatusCode.ServiceUnavailable,
                    subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
            }
        }
    }

    /// <summary>
    /// A connection string to send telemetry to Application Insights is required if telemetry is enabled.
    /// </summary>
    public void ValidateAppInsightsTelemetryConnectionString(RuntimeConfig runtimeConfig)
    {
        if (runtimeConfig.Runtime!.Telemetry is not null && runtimeConfig.Runtime.Telemetry.ApplicationInsights is not null)
        {
            ApplicationInsightsOptions applicationInsightsOptions = runtimeConfig.Runtime.Telemetry.ApplicationInsights;
            if (applicationInsightsOptions.Enabled && string.IsNullOrWhiteSpace(applicationInsightsOptions.ConnectionString))
            {
                HandleOrRecordException(new DataApiBuilderException(
                    message: "Application Insights connection string cannot be null or empty if enabled.",
                    statusCode: HttpStatusCode.ServiceUnavailable,
                    subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
            }
        }
    }

    /// <summary>
    /// Only certain classes can have different log levels, this function ensures that only those classes are used in the config file.
    /// </summary>
    public static void ValidateLoggerFilters(RuntimeConfig runtimeConfig)
    {
        if (runtimeConfig.Runtime?.Telemetry is not null && runtimeConfig.Runtime.Telemetry.LoggerLevel is not null)
        {
            Dictionary<string, LogLevel?> loggerLevelOptions = runtimeConfig.Runtime.Telemetry.LoggerLevel;

            foreach (KeyValuePair<string, LogLevel?> logger in loggerLevelOptions)
            {
                if (!IsLoggerFilterValid(logger.Key))
                {
                    throw new NotSupportedException($"Log level filter {logger.Key} needs to be of a valid log class.");
                }
            }
        }
    }

    /// <summary>
    /// The auth options in Azure Log Analytics are required if it is enabled.
    /// </summary>
    public void ValidateAzureLogAnalyticsAuth(RuntimeConfig runtimeConfig)
    {
        if (runtimeConfig.Runtime!.Telemetry is not null && runtimeConfig.Runtime.Telemetry.AzureLogAnalytics is not null)
        {
            AzureLogAnalyticsOptions azureLogAnalyticsOptions = runtimeConfig.Runtime.Telemetry.AzureLogAnalytics;
            AzureLogAnalyticsAuthOptions? azureLogAnalyticsAuthOptions = azureLogAnalyticsOptions.Auth;
            if (azureLogAnalyticsOptions.Enabled && (azureLogAnalyticsAuthOptions is null || string.IsNullOrWhiteSpace(azureLogAnalyticsAuthOptions.CustomTableName) ||
                string.IsNullOrWhiteSpace(azureLogAnalyticsAuthOptions.DcrImmutableId) || string.IsNullOrWhiteSpace(azureLogAnalyticsAuthOptions.DceEndpoint)))
            {
                HandleOrRecordException(new DataApiBuilderException(
                    message: "Azure Log Analytics Auth options 'custom-table-name', 'dcr-immutable-id', and 'dce-endpoint' cannot be null or empty if enabled.",
                    statusCode: HttpStatusCode.ServiceUnavailable,
                    subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
            }
        }
    }

    /// <summary>
    /// The path in File Sink is required if it is enabled.
    /// </summary>
    public void ValidateFileSinkPath(RuntimeConfig runtimeConfig)
    {
        if (runtimeConfig.Runtime!.Telemetry is not null && runtimeConfig.Runtime.Telemetry.File is not null)
        {
            FileSinkOptions fileSinkOptions = runtimeConfig.Runtime.Telemetry.File;
            if (fileSinkOptions.Enabled && string.IsNullOrWhiteSpace(fileSinkOptions.Path))
            {
                HandleOrRecordException(new DataApiBuilderException(
                    message: "File option 'path' cannot be null or empty if enabled.",
                    statusCode: HttpStatusCode.ServiceUnavailable,
                    subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
            }

            if (fileSinkOptions.Path.Length > 260)
            {
                _logger.LogWarning("File option 'path' exceeds 260 characters, it is recommended that the path does not exceed this limit.");
            }

            // Checks if path is valid by checking if there are any invalid characters and then
            // attempting to retrieve the full path, returns an exception if it is unable.
            try
            {
                string fileName = System.IO.Path.GetFileName(fileSinkOptions.Path);
                if (string.IsNullOrWhiteSpace(fileName) || fileName.IndexOfAny(System.IO.Path.GetInvalidFileNameChars()) != -1)
                {
                    HandleOrRecordException(new DataApiBuilderException(
                        message: "File option 'path' cannot have invalid characters in its directory or file name.",
                        statusCode: HttpStatusCode.ServiceUnavailable,
                        subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
                }

                string? directoryName = System.IO.Path.GetDirectoryName(fileSinkOptions.Path);
                if (directoryName is not null && directoryName.IndexOfAny(System.IO.Path.GetInvalidPathChars()) != -1)
                {
                    HandleOrRecordException(new DataApiBuilderException(
                        message: "File option 'path' cannot have invalid characters in its directory or file name.",
                        statusCode: HttpStatusCode.ServiceUnavailable,
                        subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
                }

                System.IO.Path.GetFullPath(fileSinkOptions.Path);
            }
            catch (Exception ex)
            {
                HandleOrRecordException(new DataApiBuilderException(
                    message: ex.Message,
                    statusCode: HttpStatusCode.ServiceUnavailable,
                    subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
            }
        }
    }

    /// <summary>
    /// Validates the embeddings configuration options when embeddings are configured.
    /// Checks required fields, URL format, numeric constraints, and endpoint constraints.
    /// </summary>
    public void ValidateEmbeddingsOptions(RuntimeConfig runtimeConfig)
    {
        // Skip validation if embeddings are not configured.
        if (runtimeConfig.Runtime?.Embeddings is null)
        {
            return;
        }

        EmbeddingsOptions embeddingsOptions = runtimeConfig.Runtime.Embeddings;

        // Skip further validation if embeddings are explicitly disabled.
        if (!embeddingsOptions.Enabled)
        {
            return;
        }

        // base-url is required and must be a valid URL.
        if (string.IsNullOrWhiteSpace(embeddingsOptions.BaseUrl))
        {
            HandleOrRecordException(new DataApiBuilderException(
                message: "Embeddings 'base-url' cannot be null or empty when embeddings are enabled.",
                statusCode: HttpStatusCode.ServiceUnavailable,
                subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
        }
        else if (!Uri.TryCreate(embeddingsOptions.BaseUrl, UriKind.Absolute, out Uri? baseUri) ||
                 (baseUri.Scheme != Uri.UriSchemeHttps && baseUri.Scheme != Uri.UriSchemeHttp))
        {
            HandleOrRecordException(new DataApiBuilderException(
                message: $"Embeddings 'base-url' must be a valid HTTP or HTTPS URL. Got: {embeddingsOptions.BaseUrl}",
                statusCode: HttpStatusCode.ServiceUnavailable,
                subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
        }

        // api-key is required.
        if (string.IsNullOrWhiteSpace(embeddingsOptions.ApiKey))
        {
            HandleOrRecordException(new DataApiBuilderException(
                message: "Embeddings 'api-key' cannot be null or empty when embeddings are enabled.",
                statusCode: HttpStatusCode.ServiceUnavailable,
                subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
        }

        // For Azure OpenAI provider, model (deployment name) is required.
        if (embeddingsOptions.Provider == EmbeddingProviderType.AzureOpenAI && string.IsNullOrWhiteSpace(embeddingsOptions.Model))
        {
            HandleOrRecordException(new DataApiBuilderException(
                message: "Embeddings 'model' (deployment name) is required when using the Azure OpenAI provider.",
                statusCode: HttpStatusCode.ServiceUnavailable,
                subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
        }

        // timeout-ms must be positive if provided.
        if (embeddingsOptions.TimeoutMs is not null && embeddingsOptions.TimeoutMs <= 0)
        {
            HandleOrRecordException(new DataApiBuilderException(
                message: $"Embeddings 'timeout-ms' must be a positive integer. Got: {embeddingsOptions.TimeoutMs}",
                statusCode: HttpStatusCode.ServiceUnavailable,
                subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
        }

        // dimensions must be positive if provided.
        if (embeddingsOptions.Dimensions is not null && embeddingsOptions.Dimensions <= 0)
        {
            HandleOrRecordException(new DataApiBuilderException(
                message: $"Embeddings 'dimensions' must be a positive integer. Got: {embeddingsOptions.Dimensions}",
                statusCode: HttpStatusCode.ServiceUnavailable,
                subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
        }

        // Validate endpoint configuration.
        if (embeddingsOptions.Endpoint is not null && embeddingsOptions.Endpoint.Enabled)
        {
            // In production mode, roles must be explicitly configured (cannot be null).
            if (!runtimeConfig.IsDevelopmentMode() &&
                embeddingsOptions.Endpoint.Roles is null)
            {
                HandleOrRecordException(new DataApiBuilderException(
                    message: "Embeddings endpoint 'roles' must be explicitly configured in production mode.",
                    statusCode: HttpStatusCode.ServiceUnavailable,
                    subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
            }

            // Empty roles array is not allowed (checked after production null check)
            if (embeddingsOptions.Endpoint.Roles is not null && embeddingsOptions.Endpoint.Roles.Length == 0)
            {
                HandleOrRecordException(new DataApiBuilderException(
                    message: "Embeddings endpoint 'roles' cannot be empty when endpoint is enabled.",
                    statusCode: HttpStatusCode.ServiceUnavailable,
                    subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
            }
        }

        // Validate health check configuration.
        if (embeddingsOptions.Health is not null && embeddingsOptions.Health.Enabled)
        {
            if (embeddingsOptions.Health.ThresholdMs <= 0)
            {
                HandleOrRecordException(new DataApiBuilderException(
                    message: $"Embeddings health check 'threshold-ms' must be a positive integer. Got: {embeddingsOptions.Health.ThresholdMs}",
                    statusCode: HttpStatusCode.ServiceUnavailable,
                    subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
            }

            if (string.IsNullOrWhiteSpace(embeddingsOptions.Health.TestText))
            {
                HandleOrRecordException(new DataApiBuilderException(
                    message: "Embeddings health check 'test-text' cannot be null or empty when health check is enabled.",
                    statusCode: HttpStatusCode.ServiceUnavailable,
                    subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
            }

            if (embeddingsOptions.Health.ExpectedDimensions is not null && embeddingsOptions.Health.ExpectedDimensions <= 0)
            {
                HandleOrRecordException(new DataApiBuilderException(
                    message: $"Embeddings health check 'expected-dimensions' must be a positive integer. Got: {embeddingsOptions.Health.ExpectedDimensions}",
                    statusCode: HttpStatusCode.ServiceUnavailable,
                    subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
            }
        }

        // Validate cache configuration. JSON schema enforces value ranges at parse time, but
        // configurations constructed programmatically (e.g. via the CLI or via hot-reload) can
        // bypass schema validation, so the runtime must also guard against invalid values.
        if (embeddingsOptions.Cache is not null && embeddingsOptions.IsCachingEnabled)
        {
            EmbeddingsCacheOptions cacheOptions = embeddingsOptions.Cache;

            // ttl-hours, when explicitly provided, must be a positive integer.
            if (cacheOptions.UserProvidedTtlHours && cacheOptions.TtlHours <= 0)
            {
                HandleOrRecordException(new DataApiBuilderException(
                    message: $"Embeddings cache 'ttl-hours' must be a positive integer. Got: {cacheOptions.TtlHours}",
                    statusCode: HttpStatusCode.ServiceUnavailable,
                    subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
            }

            // Level-2 cache, when enabled, requires a non-empty connection string.
            if (cacheOptions.IsLevel2Enabled
                && string.IsNullOrWhiteSpace(cacheOptions.Level2?.ConnectionString))
            {
                HandleOrRecordException(new DataApiBuilderException(
                    message: "Embeddings cache 'level-2.connection-string' cannot be null or empty when level-2 cache is enabled.",
                    statusCode: HttpStatusCode.ServiceUnavailable,
                    subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
            }
        }

    }

    /// <summary>
    /// This method runs several validations against the config file such as schema validation,
    /// validation of entities metadata, validation of permissions, validation of entity configuration.
    /// This method is called by the CLI when the user runs `validate` command with `isValidateOnly=true`.
    /// </summary>
    /// <param name="configFilePath">full/relative config file path with extension</param>
    /// <param name="loggerFactory">Logger Factory</param>
    /// <returns>true if no validation failures, else false.</returns>
    public async Task<bool> TryValidateConfig(
        string configFilePath,
        ILoggerFactory loggerFactory)
    {
        RuntimeConfig? runtimeConfig;

        if (!_runtimeConfigProvider.TryGetConfig(out runtimeConfig))
        {
            _logger.LogInformation("Failed to parse the config file");
            return false;
        }

        JsonSchemaValidationResult validationResult = await ValidateConfigSchema(runtimeConfig, configFilePath, loggerFactory);
        ValidateConfigProperties();
        ValidatePermissionsInConfig(runtimeConfig);

        ValidateRelationshipConfigCorrectness(runtimeConfig);

        // This function initializes the metadata providers which in turn validates the connectivity to the
        // database and also validates all the REST and GraphQL paths as well as the permissions of the entities
        // that are created from the 'Entities' and 'Autoentities' configuration, including the relationships defined in the config against the database metadata.
        // Any exceptions caught during this process are added to the ConfigValidationExceptions list and logged at the end of this function.
        await ValidateEntitiesMetadata(runtimeConfig, loggerFactory);

        // Validate entity configuration (root vs non-root rules, entity counts) after autoentity resolution.
        // Only run when there are no connection string errors, since autoentity resolution requires DB access.
        if (!ConfigValidationExceptions.Any(x => x.Message.StartsWith(DataApiBuilderException.CONNECTION_STRING_ERROR_MESSAGE)))
        {
            // Re-read the config since autoentity resolution may have added new entities.
            if (_runtimeConfigProvider.TryGetConfig(out RuntimeConfig? updatedConfig) && updatedConfig is not null)
            {
                runtimeConfig = updatedConfig;
            }

            ValidateDataSourceAndEntityPresence(runtimeConfig);
        }

        if (validationResult.IsValid && !ConfigValidationExceptions.Any())
        {
            return true;
        }
        else
        {
            if (!validationResult.IsValid)
            {
                // log schema validation errors
                _logger.LogError(validationResult.ErrorMessage);
            }

            // log config validation errors
            LogConfigValidationExceptions();
            return false;
        }
    }

    /// <summary>
    /// This method runs schema validation against the config file.
    /// It uses runtime config object to check if the schema uri is provided in the config file
    /// </summary>
    public async Task<JsonSchemaValidationResult> ValidateConfigSchema(RuntimeConfig runtimeConfig, string configFilePath, ILoggerFactory loggerFactory)
    {
        string jsonData = runtimeConfig.ToJson();
        ILogger<JsonConfigSchemaValidator> jsonConfigValidatorLogger = loggerFactory.CreateLogger<JsonConfigSchemaValidator>();
        JsonConfigSchemaValidator jsonConfigSchemaValidator = new(jsonConfigValidatorLogger, _fileSystem);

        string? jsonSchema = await jsonConfigSchemaValidator.GetJsonSchema(runtimeConfig);

        if (string.IsNullOrWhiteSpace(jsonSchema))
        {
            _logger.LogError("Failed to get the json schema for the config.");
            return new JsonSchemaValidationResult(isValid: false, errors: null);
        }

        return jsonConfigSchemaValidator.ValidateJsonConfigWithSchema(jsonSchema, jsonData);
    }

    /// <summary>
    /// Validates the semantic correctness of an Entity's relationships in the
    /// runtime configuration without cross referencing DB metadata.
    /// Validating Cases:
    /// 1. Entities not defined in the config cannot be used in a relationship.
    /// 2. Entities with graphQL disabled cannot be used in a relationship with another entity.
    /// </summary>
    /// <exception cref="DataApiBuilderException">Throws exception whenever some validation fails.</exception>
    public void ValidateRelationshipConfigCorrectness(RuntimeConfig runtimeConfig)
    {
        // Loop through each entity in the config and verify its relationship.
        foreach ((string entityName, Entity entity) in runtimeConfig.Entities)
        {
            // Skipping relationship validation if entity has no relationship
            // or if graphQL is disabled.
            if (entity.Relationships is null || !entity.GraphQL.Enabled)
            {
                continue;
            }

            if (entity.Source.Type is not EntitySourceType.Table && entity.Relationships is not null
                && entity.Relationships.Count > 0)
            {
                HandleOrRecordException(new DataApiBuilderException(
                        message: $"Cannot define relationship for entity: {entityName}",
                        statusCode: HttpStatusCode.ServiceUnavailable,
                        subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
            }

            string databaseName = runtimeConfig.GetDataSourceNameFromEntityName(entityName);

            foreach ((string relationshipName, EntityRelationship relationship) in entity.Relationships!)
            {
                // Validate if entity referenced in relationship is defined in the config.
                if (!runtimeConfig.Entities.TryGetValue(relationship.TargetEntity, out Entity? targetEntity))
                {
                    HandleOrRecordException(new DataApiBuilderException(
                        message: $"Entity: {relationship.TargetEntity} used for relationship is not defined in the config.",
                        statusCode: HttpStatusCode.ServiceUnavailable,
                        subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
                }

                // Validation to ensure that an entity with graphQL disabled cannot be referenced in a relationship by other entities
                EntityGraphQLOptions? targetEntityGraphQLDetails = targetEntity is not null ? targetEntity.GraphQL : null;
                if (targetEntityGraphQLDetails is not null && !targetEntityGraphQLDetails.Enabled)
                {
                    HandleOrRecordException(new DataApiBuilderException(
                        message: $"Entity: {relationship.TargetEntity} is disabled for GraphQL.",
                        statusCode: HttpStatusCode.ServiceUnavailable,
                        subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
                }

                // Linking object is null and therefore we have a many-one or a one-many relationship. These relationships
                // must be validated separately from many-many relationships. In one-many and many-one relationships, the count
                // of source and target fields need to match, or if one is null the other must be as well.
                // If both of these sets of fields are null, foreign key information, inferred from the database metadata,
                // will be used to define the relationship.
                // see: https://learn.microsoft.com/en-us/azure/data-api-builder/relationships
                if (string.IsNullOrWhiteSpace(relationship.LinkingObject))
                {
                    // Validation to ensure that source and target fields are both null or both not null.
                    if (relationship.SourceFields is null ^ relationship.TargetFields is null)
                    {
                        HandleOrRecordException(new DataApiBuilderException(
                            message: $"Entity: {entityName} has a relationship: {relationshipName}, which has source and target fields " +
                                $"where one is null and the other is not.",
                            statusCode: HttpStatusCode.ServiceUnavailable,
                            subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
                    }

                    // In one-one, one-many, or many-one relationships when both source and target are non null their size must match.
                    if ((relationship.SourceFields is not null && relationship.TargetFields is not null) &&
                        relationship.SourceFields.Length != relationship.TargetFields.Length)
                    {
                        HandleOrRecordException(new DataApiBuilderException(
                            message: $"Entity: {entityName} has a relationship: {relationshipName}, which has {relationship.SourceFields.Length} source fields defined, " +
                                $"but {relationship.TargetFields.Length} target fields defined.",
                            statusCode: HttpStatusCode.ServiceUnavailable,
                            subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
                    }
                }

                // Linking object exists and we therefore have a many-many relationship. Validation here differs from one-many and many-one in that
                // the source and target fields are now only indirectly related through the linking object. Therefore, it is the source and linkingSource
                // along with the target and linkingTarget fields that must match, respectively. Source and linkingSource fields provide the relationship
                // from the source entity to the linkingObject while target and linkingTarget fields provide the relationship from the target entity to the
                // linkingObject.
                // see: https://learn.microsoft.com/en-us/azure/data-api-builder/relationships#many-to-many-relationship
                if (!string.IsNullOrWhiteSpace(relationship.LinkingObject))
                {
                    ValidateFieldsAndAssociatedLinkingFields(
                        fields: relationship.SourceFields,
                        linkingFields: relationship.LinkingSourceFields,
                        fieldType: "source",
                        entityName: entityName,
                        relationshipName: relationshipName);
                    ValidateFieldsAndAssociatedLinkingFields(
                        fields: relationship.TargetFields,
                        linkingFields: relationship.LinkingTargetFields,
                        fieldType: "target",
                        entityName: entityName,
                        relationshipName: relationshipName);
                }
            }
        }
    }

    /// <summary>
    /// This method validates the entities relationships against the database objects using
    /// metadata from the backend DB generated by this function.
    /// </summary>
    /// NOTE: This function should not be used in the regular flow of DAB as we already initialize the metadata providers during startup,
    /// doing it again will cause the application to fail as it will try to add data that is already present.
    public async Task ValidateEntitiesMetadata(RuntimeConfig runtimeConfig, ILoggerFactory loggerFactory)
    {
        // Only used for validation so we don't need the handler which is for hot reload scenarios.
        QueryManagerFactory queryManagerFactory = new(
            runtimeConfigProvider: _runtimeConfigProvider,
            logger: loggerFactory.CreateLogger<IQueryExecutor>(),
            contextAccessor: null!,
            handler: null);

        // create metadata provider factory to validate metadata against the database
        // Only used for validation so we don't need the handler which is for hot reload scenarios.
        MetadataProviderFactory metadataProviderFactory = new(
            runtimeConfigProvider: _runtimeConfigProvider,
            runtimeConfigValidator: this,
            queryManagerFactory: queryManagerFactory,
            logger: loggerFactory.CreateLogger<ISqlMetadataProvider>(),
            fileSystem: _fileSystem,
            isValidateOnly: _isValidateOnly,
            handler: null);
        await metadataProviderFactory.InitializeAsync();

        ConfigValidationExceptions.AddRange(metadataProviderFactory.GetAllMetadataExceptions());

        // Validation below relies on metadata being populated from backend, only execute when there were no connection errors
        if (!ConfigValidationExceptions.Any(x => x.Message.StartsWith(DataApiBuilderException.CONNECTION_STRING_ERROR_MESSAGE)))
        {
            ValidateRelationships(runtimeConfig, metadataProviderFactory);
        }
    }

    /// <summary>
    /// Validates entity and data source configuration based on whether the config is a root or not.
    ///
    /// Root config (top-level with children via data-source-files):
    ///   - Does not need a data source (children provide their own)
    ///   - Must NOT have entities if it has no data source (entities need a data source)
    ///   - If it HAS a data source, normal entity rules apply (must have at least 1 entity)
    ///   - Each child is validated independently
    ///
    /// Non-root config (standalone or child):
    ///   - Must have a data source
    ///   - Must have at least 1 real entity (manual or resolved from autoentities)
    ///   - If autoentities property exists but discovers no entities, warn
    ///   - If autoentities discovers no entities but manual entities exist, warn (not error)
    ///   - If neither manual entities nor autoentity discoveries produce any entities, error
    ///
    /// This method should be called after autoentity resolution so that resolved entity counts are available.
    /// It should be gated on no database connection errors.
    /// </summary>
    public void ValidateDataSourceAndEntityPresence(RuntimeConfig runtimeConfig)
    {
        if (runtimeConfig.IsRootConfig)
        {
            ValidateRootConfig(runtimeConfig);
        }
        else
        {
            ValidateNonRootConfig(runtimeConfig, configName: null);
        }
    }

    /// <summary>
    /// Validates a root config (top-level with children).
    /// If the root has a data source, it must have entities (same as non-root).
    /// If the root has no data source, it must NOT have entities or autoentities (they'd have no data source).
    /// Each child config is validated independently.
    /// </summary>
    private void ValidateRootConfig(RuntimeConfig runtimeConfig)
    {
        bool hasDataSource = runtimeConfig.DataSource is not null;
        bool hasEntities = runtimeConfig.Entities.Entities.Count > 0;
        bool hasAutoentities = runtimeConfig.Autoentities.Autoentities.Count > 0;

        if (hasDataSource)
        {
            // Root with its own data source follows normal entity rules.
            ValidateEntityPresence(runtimeConfig, configName: null);
        }
        else if (hasEntities || hasAutoentities)
        {
            // Root without a data source but with entities/autoentities — invalid.
            HandleOrRecordException(new DataApiBuilderException(
                message: "Entities or autoentities are defined in the root config but no data source is configured. " +
                    "A root config without a data source must not define entities or autoentities.",
                statusCode: HttpStatusCode.ServiceUnavailable,
                subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
        }

        // Validate each child config independently.
        foreach ((string fileName, RuntimeConfig childConfig) in runtimeConfig.ChildConfigs)
        {
            ValidateNonRootConfig(childConfig, configName: fileName);
        }
    }

    /// <summary>
    /// Validates a non-root config (standalone or child).
    /// Must have a data source. Must have at least 1 real entity.
    /// </summary>
    /// <param name="config">The config to validate.</param>
    /// <param name="configName">Filename for error context (null for top-level standalone).</param>
    private void ValidateNonRootConfig(RuntimeConfig config, string? configName)
    {
        string prefix = configName is not null ? $"Config '{configName}': " : string.Empty;

        if (config.DataSource is null)
        {
            HandleOrRecordException(new DataApiBuilderException(
                message: $"{prefix}A data source is required.",
                statusCode: HttpStatusCode.ServiceUnavailable,
                subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
            return;
        }

        ValidateEntityPresence(config, configName);
    }

    /// <summary>
    /// Validates that a config with a data source has at least 1 real entity.
    ///
    /// Rules:
    /// - If the autoentities property exists (even if empty/no definitions) and no entities
    ///   were discovered through it, warn.
    /// - If total real entities (manual + discovered) is 0, error.
    /// - If manual entities exist but autoentities discovered nothing, warn (not error).
    /// </summary>
    /// <param name="config">The config to validate (must have a data source).</param>
    /// <param name="configName">Filename for error context (null for top-level).</param>
    private void ValidateEntityPresence(RuntimeConfig config, string? configName)
    {
        string prefix = configName is not null ? $"Config '{configName}': " : string.Empty;

        // Check autoentities: if the property exists, report on discovery results.
        bool autoentitiesPropertyExists = config.Autoentities.Autoentities.Count > 0;
        int resolvedAutoentityCount = 0;

        if (autoentitiesPropertyExists)
        {
            foreach (KeyValuePair<string, Autoentity> autoentityDef in config.Autoentities)
            {
                if (config.AutoentityResolutionCounts.TryGetValue(autoentityDef.Key, out int resolvedCount))
                {
                    resolvedAutoentityCount += resolvedCount;
                }
            }
        }

        // Count total real entities: manual entities + resolved autoentities.
        int totalEntityCount = config.Entities.Entities.Count + resolvedAutoentityCount;

        if (totalEntityCount == 0)
        {
            // Error — nothing to serve. Don't also warn about autoentities; the error covers it.
            HandleOrRecordException(new DataApiBuilderException(
                message: $"{prefix}No entities found. At least one entity must be defined or discovered " +
                    "from autoentities when a data source is configured.",
                statusCode: HttpStatusCode.ServiceUnavailable,
                subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
        }
        else if (autoentitiesPropertyExists && resolvedAutoentityCount == 0)
        {
            // Manual entities exist so we're not erroring, but autoentities discovered nothing — warn.
            _logger.LogWarning("{prefix}Autoentities are configured but no entities were discovered. " +
                "Verify that autoentity patterns match database objects.", prefix);
        }
    }

    /// <summary>
    /// Helper method to log exceptions occured during validation of the config file.
    /// </summary>
    private void LogConfigValidationExceptions()
    {
        foreach (Exception exception in ConfigValidationExceptions)
        {
            _logger.LogError(exception.Message);
        }
    }

    /// <summary>
    /// Throws exception if database type is incorrectly configured
    /// in the config.
    /// </summary>
    public void ValidateDatabaseType(
        RuntimeConfig runtimeConfig,
        IFileSystem fileSystem,
        ILogger logger)
    {
        // Schema file should be present in the directory if not specified in the config
        // when using CosmosDB_NoSQL database.
        foreach (DataSource dataSource in runtimeConfig.ListAllDataSources())
        {
            if (dataSource.DatabaseType is DatabaseType.CosmosDB_NoSQL)
            {
                try
                {
                    CosmosDbNoSQLDataSourceOptions? cosmosDbNoSql =
                        dataSource.GetTypedOptions<CosmosDbNoSQLDataSourceOptions>() ??
                        throw new DataApiBuilderException(
                            "CosmosDB_NoSql is specified but no CosmosDB_NoSql configuration information has been provided.",
                            HttpStatusCode.ServiceUnavailable,
                            DataApiBuilderException.SubStatusCodes.ErrorInInitialization);

                    // The schema is provided through GraphQLSchema and not the Schema file when the configuration
                    // is received after startup.
                    if (string.IsNullOrEmpty(cosmosDbNoSql.GraphQLSchema))
                    {
                        if (string.IsNullOrEmpty(cosmosDbNoSql.Schema))
                        {
                            throw new DataApiBuilderException(
                                "No GraphQL schema file has been provided for CosmosDB_NoSql. Ensure you provide a GraphQL schema containing the GraphQL object types to expose.",
                                HttpStatusCode.ServiceUnavailable,
                                DataApiBuilderException.SubStatusCodes.ErrorInInitialization);
                        }

                        if (!fileSystem.File.Exists(cosmosDbNoSql.Schema))
                        {
                            throw new FileNotFoundException($"The GraphQL schema file at '{cosmosDbNoSql.Schema}' could not be found. Ensure that it is a path relative to the runtime.");
                        }
                    }
                }
                catch (Exception e)
                {
                    HandleOrRecordException(e);
                }
            }
        }
    }

    /// <summary>
    /// Validate that the entities that have graphQL exposed do not generate queries with the
    /// same name.
    /// For example: Consider the entity definitions
    /// "Book": {
    ///   "graphql": true
    /// }
    ///
    /// "book": {
    ///     "graphql": true
    /// }
    /// "Notebook": {
    ///     "graphql": {
    ///         "type": {
    ///             "singular": "book",
    ///             "plural": "books"
    ///         }
    ///     }
    /// }
    /// All these entities will create queries with the following field names
    /// pk query name: book_by_pk
    /// List query name: books
    /// create mutation name: createBook
    /// update mutation name: updateBook
    /// delete mutation name: deleteBook
    /// patch mutation name: patchBook
    /// </summary>
    /// <param name="entityCollection">Entity definitions</param>
    /// <exception cref="DataApiBuilderException"></exception>
    public void ValidateEntitiesDoNotGenerateDuplicateQueriesOrMutation(DatabaseType databaseType, RuntimeEntities entityCollection)
    {
        HashSet<string> graphQLOperationNames = new();

        foreach ((string entityName, Entity entity) in entityCollection)
        {
            if (!entity.GraphQL.Enabled)
            {
                continue;
            }

            bool containsDuplicateOperationNames = false;
            if (entity.Source.Type is EntitySourceType.StoredProcedure)
            {
                // For Stored Procedures a single query/mutation is generated.
                string storedProcedureQueryName = GraphQLNaming.GenerateStoredProcedureGraphQLFieldName(entityName, entity);

                if (!graphQLOperationNames.Add(storedProcedureQueryName))
                {
                    containsDuplicateOperationNames = true;
                }
            }
            else
            {
                // For entities (table/view) that have graphQL exposed, two queries, three mutations for Relational databases (e.g. MYSQL, MSSQL etc.)
                // and four mutations for CosmosDb_NoSQL would be generated.
                // Primary Key Query: For fetching an item using its primary key.
                // List Query: To fetch a paginated list of items.
                // Query names for both these queries are determined.
                string pkQueryName = GraphQLNaming.GenerateByPKQueryName(entityName, entity);
                string listQueryName = GraphQLNaming.GenerateListQueryName(entityName, entity);

                // Mutations names for the exposed entities are determined.
                string createMutationName = $"create{GraphQLNaming.GetDefinedSingularName(entityName, entity)}";
                string updateMutationName = $"update{GraphQLNaming.GetDefinedSingularName(entityName, entity)}";
                string deleteMutationName = $"delete{GraphQLNaming.GetDefinedSingularName(entityName, entity)}";
                string patchMutationName = $"patch{GraphQLNaming.GetDefinedSingularName(entityName, entity)}";

                if (!graphQLOperationNames.Add(pkQueryName)
                    || !graphQLOperationNames.Add(listQueryName)
                    || !graphQLOperationNames.Add(createMutationName)
                    || !graphQLOperationNames.Add(updateMutationName)
                    || !graphQLOperationNames.Add(deleteMutationName)
                    || ((databaseType is DatabaseType.CosmosDB_NoSQL) && !graphQLOperationNames.Add(patchMutationName)))
                {
                    containsDuplicateOperationNames = true;
                }
            }

            if (containsDuplicateOperationNames)
            {
                HandleOrRecordException(new DataApiBuilderException(
                    message: $"Entity {entityName} generates queries/mutation that already exist",
                    statusCode: HttpStatusCode.ServiceUnavailable,
                    subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
            }
        }
    }

    /// <summary>
    /// Check whether the entity configuration defined in runtime config only contains characters allowed for GraphQL names
    /// and other validations related to rest path and methods configured for the entity.
    /// The GraphQL validation is not performed for entities which do not
    /// have GraphQL configuration: when entity.GraphQL == false or null.
    /// </summary>
    /// <seealso cref="https://spec.graphql.org/October2021/#Name"/>
    /// <param name="runtimeConfig">The runtime configuration.</param>
    public void ValidateEntityConfiguration(RuntimeConfig runtimeConfig)
    {
        // Stores the unique rest paths configured for different entities present in the config.
        HashSet<string> restPathsForEntities = new();

        foreach ((string entityName, Entity entity) in runtimeConfig.Entities)
        {
            if (runtimeConfig.IsRestEnabled && entity.Rest is not null && entity.Rest.Enabled)
            {
                // If no custom rest path is defined for the entity, we default it to the entityName.
                string pathForEntity = entity.Rest.Path is not null ? entity.Rest.Path.TrimStart('/') : entityName;
                try
                {
                    ValidateRestPathSettingsForEntity(entityName, pathForEntity);
                    if (!restPathsForEntities.Add(pathForEntity))
                    {
                        // Presence of multiple entities having the same rest path configured causes conflict.
                        throw new DataApiBuilderException(
                            message: $"The rest path: {pathForEntity} specified for entity: {entityName} is already used by another entity.",
                            statusCode: HttpStatusCode.ServiceUnavailable,
                            subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError
                            );
                    }
                }
                catch (DataApiBuilderException e)
                {
                    HandleOrRecordException(e);
                }

                ValidateRestMethods(entity, entityName);
            }

            // If GraphQL endpoint is enabled globally and at entity level, then only we perform the validations related to it.
            if (runtimeConfig.IsGraphQLEnabled && entity.GraphQL is not null && entity.GraphQL.Enabled)
            {
                ValidateNameRequirements(entity.GraphQL.Singular);
                ValidateNameRequirements(entity.GraphQL.Plural);
            }
        }
    }

    /// <summary>
    /// Helper method to validate and let users know whether insignificant properties are present in the REST field.
    /// Currently, it checks for the presence of Methods property when the entity type is table/view and logs a warning.
    /// Methods property plays a role only in case of stored procedures.
    /// </summary>
    /// <param name="entity">Entity object for which validation is performed</param>
    /// <param name="entityName">Name of the entity</param>
    private void ValidateRestMethods(Entity entity, string entityName)
    {
        if (entity.Source.Type is not EntitySourceType.StoredProcedure && entity.Rest.Methods is not null && entity.Rest.Methods.Length > 0)
        {
            _logger.LogWarning("Entity {entityName} has rest methods configured but is not a stored procedure. Values configured will be ignored and all 5 HTTP actions will be enabled.", entityName);
        }
    }

    /// <summary>
    /// Helper method to validate that the rest path property for the entity is correctly configured.
    /// The rest path should not be null/empty and should not contain any reserved characters.
    /// Allows sub-directories (forward slashes) in the path.
    /// </summary>
    /// <param name="entityName">Name of the entity.</param>
    /// <param name="pathForEntity">The rest path for the entity.</param>
    /// <exception cref="DataApiBuilderException">Throws exception when rest path contains an unexpected value.</exception>
    private static void ValidateRestPathSettingsForEntity(string entityName, string pathForEntity)
    {
        if (string.IsNullOrEmpty(pathForEntity))
        {
            // The rest 'path' cannot be empty.
            throw new DataApiBuilderException(
                message: $"The rest path for entity: {entityName} cannot be empty.",
                statusCode: HttpStatusCode.ServiceUnavailable,
                subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError
                );
        }

        if (!RuntimeConfigValidatorUtil.TryValidateEntityRestPath(pathForEntity, out string? errorMessage))
        {
            throw new DataApiBuilderException(
                message: $"The rest path: {pathForEntity} for entity: {entityName} {errorMessage ?? "contains invalid characters."}",
                statusCode: HttpStatusCode.ServiceUnavailable,
                subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError
                );
        }
    }

    private void ValidateNameRequirements(string entityName)
    {
        if (GraphQLNaming.ViolatesNamePrefixRequirements(entityName) ||
            GraphQLNaming.ViolatesNameRequirements(entityName))
        {
            HandleOrRecordException(new DataApiBuilderException(
                message: $"Entity {entityName} contains characters disallowed by GraphQL.",
                statusCode: HttpStatusCode.ServiceUnavailable,
                subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError)
            );
        }
    }

    /// <summary>
    /// Ensure the global REST and GraphQL endpoints do not conflict if both
    /// are enabled.
    /// </summary>
    /// <param name="runtimeConfig">The config that will be validated.</param>
    public void ValidateGlobalEndpointRouteConfig(RuntimeConfig runtimeConfig)
    {
        // REST, GraphQL and MCP endpoints cannot be disabled at the same time.
        if (!runtimeConfig.IsRestEnabled && !runtimeConfig.IsGraphQLEnabled && !runtimeConfig.IsMcpEnabled)
        {
            HandleOrRecordException(new DataApiBuilderException(
                message: $"GraphQL, REST, and MCP endpoints are disabled.",
                statusCode: HttpStatusCode.ServiceUnavailable,
                subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
        }

        string? runtimeBaseRoute = runtimeConfig.Runtime?.BaseRoute;

        // Ensure that the runtime base-route is only configured when authentication provider is StaticWebApps.
        if (runtimeBaseRoute is not null)
        {
            if (!runtimeConfig.IsStaticWebAppsIdentityProvider)
            {
                HandleOrRecordException(new DataApiBuilderException(
                    message: "Runtime base-route can only be used when the authentication provider is Static Web Apps.",
                    statusCode: HttpStatusCode.ServiceUnavailable,
                    subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
            }

            if (!RuntimeConfigValidatorUtil.TryValidateUriComponent(runtimeBaseRoute, out string exceptionMsgSuffix))
            {
                HandleOrRecordException(new DataApiBuilderException(
                    message: $"Runtime base-route {exceptionMsgSuffix}",
                    statusCode: HttpStatusCode.ServiceUnavailable,
                    subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
            }
        }

        ValidateRestURI(runtimeConfig);
        ValidateGraphQLURI(runtimeConfig);
        ValidateMcpUri(runtimeConfig);
        // Do not check for conflicts if two of the endpoints are disabled between GraphQL, REST, and MCP.
        if ((!runtimeConfig.IsRestEnabled && !runtimeConfig.IsGraphQLEnabled) ||
            (!runtimeConfig.IsRestEnabled && !runtimeConfig.IsMcpEnabled) ||
            (!runtimeConfig.IsGraphQLEnabled && !runtimeConfig.IsMcpEnabled))
        {
            return;
        }

        if (string.Equals(
                a: runtimeConfig.RestPath,
                b: runtimeConfig.GraphQLPath,
                comparisonType: StringComparison.OrdinalIgnoreCase) ||
            string.Equals(
                a: runtimeConfig.RestPath,
                b: runtimeConfig.McpPath,
                comparisonType: StringComparison.OrdinalIgnoreCase) ||
            string.Equals(
                a: runtimeConfig.McpPath,
                b: runtimeConfig.GraphQLPath,
                comparisonType: StringComparison.OrdinalIgnoreCase))
        {
            HandleOrRecordException(new DataApiBuilderException(
                message: $"Conflicting path configuration between GraphQL, REST, and MCP.",
                statusCode: HttpStatusCode.ServiceUnavailable,
                subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
        }
    }

    /// <summary>
    /// Method to validate that the REST URI (REST path prefix, REST base route).
    /// Skips validation for cosmosDB since it doesn't support REST.
    /// </summary>
    /// <param name="runtimeConfig"></param>
    public void ValidateRestURI(RuntimeConfig runtimeConfig)
    {
        if (runtimeConfig.ListAllDataSources().All(x => x.DatabaseType is DatabaseType.CosmosDB_NoSQL))
        {
            // if all dbs are cosmos no rest support.
            return;
        }

        // validate the rest path.
        string restPath = runtimeConfig.RestPath;
        if (!RuntimeConfigValidatorUtil.TryValidateUriComponent(restPath, out string exceptionMsgSuffix))
        {
            HandleOrRecordException(new DataApiBuilderException(
                message: $"{ApiType.REST} path {exceptionMsgSuffix}",
                statusCode: HttpStatusCode.ServiceUnavailable,
                subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
        }

    }

    /// <summary>
    /// Method to validate that the GraphQL URI (GraphQL path prefix).
    /// </summary>
    /// <param name="runtimeConfig"></param>
    public void ValidateGraphQLURI(RuntimeConfig runtimeConfig)
    {
        string graphqlPath = runtimeConfig.GraphQLPath;
        if (!RuntimeConfigValidatorUtil.TryValidateUriComponent(graphqlPath, out string exceptionMsgSuffix))
        {
            HandleOrRecordException(new DataApiBuilderException(
                message: $"{ApiType.GraphQL} path {exceptionMsgSuffix}",
                statusCode: HttpStatusCode.ServiceUnavailable,
                subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
        }
    }

    /// <summary>
    /// Method to validate that the MCP URI (MCP path prefix).
    /// </summary>
    /// <param name="runtimeConfig"></param>
    public void ValidateMcpUri(RuntimeConfig runtimeConfig)
    {
        // Skip validation if MCP is not configured
        if (runtimeConfig.Runtime?.Mcp is null)
        {
            return;
        }

        // Get the MCP path from the configuration
        string? mcpPath = runtimeConfig.Runtime.Mcp.Path;

        // Validate that the path is not null or empty when MCP is configured
        if (string.IsNullOrWhiteSpace(mcpPath))
        {
            HandleOrRecordException(new DataApiBuilderException(
                message: "MCP path cannot be null or empty when MCP is configured.",
                statusCode: HttpStatusCode.ServiceUnavailable,
                subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
            return;
        }

        // Validate the MCP path using the same validation as REST and GraphQL
        if (!RuntimeConfigValidatorUtil.TryValidateUriComponent(mcpPath, out string exceptionMsgSuffix))
        {
            HandleOrRecordException(new DataApiBuilderException(
                message: $"MCP path {exceptionMsgSuffix}",
                statusCode: HttpStatusCode.ServiceUnavailable,
                subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
        }

        // Validate aggregate-records query-timeout if provided
        if (runtimeConfig.Runtime.Mcp.DmlTools?.AggregateRecordsQueryTimeout is not null &&
            (runtimeConfig.Runtime.Mcp.DmlTools.AggregateRecordsQueryTimeout < 1 || runtimeConfig.Runtime.Mcp.DmlTools.AggregateRecordsQueryTimeout > DmlToolsConfig.MAX_QUERY_TIMEOUT_SECONDS))
        {
            HandleOrRecordException(new DataApiBuilderException(
                message: $"Aggregate-records query-timeout must be between 1 and {DmlToolsConfig.MAX_QUERY_TIMEOUT_SECONDS} seconds. " +
                         $"Provided value: {runtimeConfig.Runtime.Mcp.DmlTools.AggregateRecordsQueryTimeout}.",
                statusCode: HttpStatusCode.ServiceUnavailable,
                subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
        }
    }

    private void ValidateAuthenticationOptions(RuntimeConfig runtimeConfig)
    {
        // Bypass validation of auth if there is no auth provided
        if (runtimeConfig.Runtime?.Host?.Authentication is null)
        {
            return;
        }

        // Warn if the configured EasyAuth provider is StaticWebApps (deprecated)
        if (!string.IsNullOrWhiteSpace(runtimeConfig.Runtime.Host.Authentication.Provider) &&
            Enum.TryParse<EasyAuthType>(runtimeConfig.Runtime.Host.Authentication.Provider, ignoreCase: true, out EasyAuthType provider) &&
            provider == EasyAuthType.StaticWebApps)
        {
            _logger.LogWarning("The 'StaticWebApps' authentication provider is deprecated.");
        }

        bool isAudienceSet = !string.IsNullOrEmpty(runtimeConfig.Runtime.Host.Authentication.Jwt?.Audience);
        bool isIssuerSet = !string.IsNullOrEmpty(runtimeConfig.Runtime.Host.Authentication.Jwt?.Issuer);

        try
        {
            if (runtimeConfig.Runtime.Host.Authentication.IsJwtConfiguredIdentityProvider() &&
                (!isAudienceSet || !isIssuerSet))
            {
                throw new NotSupportedException("Audience and Issuer must be set when using a JWT identity Provider.");
            }

            if ((!runtimeConfig.Runtime.Host.Authentication.IsJwtConfiguredIdentityProvider()) &&
                (isAudienceSet || isIssuerSet))
            {
                throw new NotSupportedException("Audience and Issuer can not be set when a JWT identity provider is not configured.");
            }
        }
        catch (NotSupportedException e)
        {
            HandleOrRecordException(e);
        }
    }

    /// <summary>
    /// Validates the semantic correctness of the permissions defined for each entity within runtime configuration.
    /// </summary>
    /// <exception cref="DataApiBuilderException">Throws exception when permission validation fails.</exception>
    public void ValidatePermissionsInConfig(RuntimeConfig runtimeConfig)
    {
        foreach ((string entityName, Entity entity) in runtimeConfig.Entities)
        {
            HashSet<EntityActionOperation> totalSupportedOperationsFromAllRoles = new();
            foreach (EntityPermission permissionSetting in entity.Permissions)
            {
                string roleName = permissionSetting.Role;
                EntityAction[] actions = permissionSetting.Actions;
                List<EntityActionOperation> operationsList = new();
                foreach (EntityAction action in actions)
                {
                    try
                    {
                        if (action is null)
                        {
                            throw GetInvalidActionException(entityName, roleName, actionName: "null");
                        }

                        // Evaluate actionOp as the current operation to be validated.
                        EntityActionOperation actionOp = action.Action;

                        // If we have reached this point, it means that we don't have any invalid
                        // data type in actions. However we need to ensure that the actionOp is valid.
                        if (!IsValidPermissionAction(actionOp, entity, entityName))
                        {
                            throw GetInvalidActionException(entityName, roleName, actionOp.ToString());
                        }

                        if (action.Fields is not null)
                        {
                            // Check if the IncludeSet/ExcludeSet contain wildcard. If they contain wildcard, we make sure that they
                            // don't contain any other field. If they do, we HandleOrRecordException(an appropriate exception.
                            if (action.Fields.Include is not null && action.Fields.Include.Contains(AuthorizationResolver.WILDCARD)
                                && action.Fields.Include.Count > 1 ||
                                action.Fields.Exclude.Contains(AuthorizationResolver.WILDCARD) && action.Fields.Exclude.Count > 1)
                            {
                                // See if included or excluded columns contain wildcard and another field.
                                // If that's the case with both of them, we specify 'included' in error.
                                string misconfiguredColumnSet = action.Fields.Exclude.Contains(AuthorizationResolver.WILDCARD)
                                    && action.Fields.Exclude.Count > 1 ? "excluded" : "included";
                                string actionName = actionOp is EntityActionOperation.All ? "*" : actionOp.ToString();

                                HandleOrRecordException(new DataApiBuilderException(
                                        message: $"No other field can be present with wildcard in the {misconfiguredColumnSet} set for:" +
                                        $" entity:{entityName}, role:{permissionSetting.Role}, action:{actionName}",
                                        statusCode: HttpStatusCode.ServiceUnavailable,
                                        subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
                            }

                            if (action.Policy is not null && action.Policy.Database is not null)
                            {
                                // validate that all the fields mentioned in database policy are accessible to user.
                                AreFieldsAccessible(action.Policy.Database,
                                    action.Fields.Include, action.Fields.Exclude);

                                // validate that all the claimTypes in the policy are well formed.
                                ValidateClaimsInPolicy(action.Policy.Database, runtimeConfig);
                            }
                        }

                        DataSource entityDataSource = runtimeConfig.GetDataSourceFromEntityName(entityName);

                        // Create operation does not support defining a database policy for certain database types.
                        if (!_databaseTypesSupportingCreatePolicy.Contains(entityDataSource.DatabaseType) && !IsValidDatabasePolicyForAction(action))
                        {
                            throw new DataApiBuilderException(
                                message: $"The Create action does not support defining a database policy." +
                                $" entity:{entityName}, role:{permissionSetting.Role}, action:{action.Action}",
                                statusCode: HttpStatusCode.ServiceUnavailable,
                                subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError);
                        }

                        operationsList.Add(actionOp);
                        totalSupportedOperationsFromAllRoles.Add(actionOp);
                    }
                    catch (Exception e)
                    {
                        HandleOrRecordException(e);
                    }
                }

                // Stored procedures only support the "execute" operation.
                if (entity.Source.Type is EntitySourceType.StoredProcedure)
                {
                    if ((operationsList.Count > 1)
                        || (operationsList.Count is 1 && !IsValidPermissionAction(operationsList[0], entity, entityName)))
                    {
                        HandleOrRecordException(new DataApiBuilderException(
                            message: $"Invalid Operations for Entity: {entityName}. " +
                                $"Stored procedures can only be configured with the 'execute' operation.",
                            statusCode: HttpStatusCode.ServiceUnavailable,
                            subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
                    }
                }
            }
        }
    }

    /// <summary>
    /// A database policy can only be defined for a PermissionOperation when
    /// the operation type is read, update, delete.
    /// A create operation (database record insert) does not support query predicates
    /// such as "WHERE name = 'xyz'"
    /// </summary>
    /// <param name="permission"></param>
    /// <returns>True/False</returns>
    public static bool IsValidDatabasePolicyForAction(EntityAction permission)
    {
        if (permission.Action is EntityActionOperation.Create)
        {
            return string.IsNullOrWhiteSpace(permission.Policy?.Database);
        }

        return true;
    }

    /// <summary>
    /// Validates the semantic correctness of an Entity's relationships in the
    /// runtime configuration against the metadata collected from the backend DB
    /// that is provided to this function via use of the MetadataProviderFactory.
    /// Validating Cases using DB metadata:
    /// 1. If the LinkingSourceFields or sourceFields and LinkingTargetFields or targetFields are not
    /// specified in the config for the given linkingObject, then the underlying database should
    /// contain a foreign key relationship between the source and target entity.
    /// 2. If linkingObject is null, and either of SourceFields or targetFields is null, then foreignKey pair
    /// between source and target entity must be defined in the DB.
    /// </summary>
    /// <exception cref="DataApiBuilderException">Throws exception whenever some validation fails.</exception>
    public void ValidateRelationships(RuntimeConfig runtimeConfig, IMetadataProviderFactory sqlMetadataProviderFactory)
    {
        // To avoid creating many lists of invalid columns we instantiate before looping through entities.
        // List.Clear() is O(1) so clearing the list, for re-use, inside of the loops is fine.
        List<string> invalidColumns = new();

        // Loop through each entity in the config and verify its relationship.
        foreach ((string entityName, Entity entity) in runtimeConfig.Entities)
        {
            // Skipping relationship validation if entity has no relationship
            // or if graphQL is disabled.
            if (entity.Relationships is null || !entity.GraphQL.Enabled)
            {
                continue;
            }

            string databaseName = runtimeConfig.GetDataSourceNameFromEntityName(entityName);
            ISqlMetadataProvider sqlMetadataProvider = sqlMetadataProviderFactory.GetMetadataProvider(databaseName);

            foreach ((string relationshipName, EntityRelationship relationship) in entity.Relationships!)
            {
                ValidateSourceAndTargetFieldsAsBackingColumns(
                    entityName: entityName,
                    relationshipName: relationshipName,
                    relationship: relationship,
                    sqlMetadataProvider: sqlMetadataProvider,
                    invalidColumns: invalidColumns);

                // Validation to ensure DatabaseObject is correctly inferred from the entity name.
                DatabaseObject? sourceObject, targetObject;
                if (!sqlMetadataProvider.EntityToDatabaseObject.TryGetValue(entityName, out sourceObject))
                {
                    sourceObject = null;
                    HandleOrRecordException(new DataApiBuilderException(
                        message: $"Could not infer database object for source entity: {entityName} in relationship: {relationshipName}." +
                            $" Check if the entity: {entityName} is correctly defined in the config.",
                        statusCode: HttpStatusCode.ServiceUnavailable,
                        subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
                }

                if (!sqlMetadataProvider.EntityToDatabaseObject.TryGetValue(relationship.TargetEntity, out targetObject))
                {
                    targetObject = null;
                    HandleOrRecordException(new DataApiBuilderException(
                        message: $"Could not infer database object for target entity: {relationship.TargetEntity} in relationship: {relationshipName}." +
                            $" Check if the entity: {relationship.TargetEntity} is correctly defined in the config.",
                        statusCode: HttpStatusCode.ServiceUnavailable,
                        subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
                }

                if (sourceObject is null || targetObject is null)
                {
                    continue;
                }

                DatabaseTable sourceDatabaseObject = (DatabaseTable)sourceObject;
                DatabaseTable targetDatabaseObject = (DatabaseTable)targetObject;
                if (relationship.LinkingObject is not null)
                {
                    (string linkingTableSchema, string linkingTableName) = sqlMetadataProvider.ParseSchemaAndDbTableName(relationship.LinkingObject)!;
                    DatabaseTable linkingDatabaseObject = new(linkingTableSchema, linkingTableName);

                    if (relationship.LinkingSourceFields is null || relationship.SourceFields is null)
                    {
                        if (!sqlMetadataProvider.VerifyForeignKeyExistsInDB(linkingDatabaseObject, sourceDatabaseObject))
                        {
                            HandleOrRecordException(new DataApiBuilderException(
                            message: $"Could not find relationship between Linking Object: {relationship.LinkingObject}" +
                                $" and entity: {entityName}.",
                            statusCode: HttpStatusCode.ServiceUnavailable,
                            subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
                        }
                    }

                    if (relationship.LinkingTargetFields is null || relationship.TargetFields is null)
                    {
                        if (!sqlMetadataProvider.VerifyForeignKeyExistsInDB(linkingDatabaseObject, targetDatabaseObject))
                        {
                            HandleOrRecordException(new DataApiBuilderException(
                            message: $"Could not find relationship between Linking Object: {relationship.LinkingObject}" +
                                $" and entity: {relationship.TargetEntity}.",
                            statusCode: HttpStatusCode.ServiceUnavailable,
                            subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
                        }
                    }

                    if (!_runtimeConfigProvider.IsLateConfigured)
                    {
                        string sourceDBOName = sqlMetadataProvider.EntityToDatabaseObject[entityName].FullName;
                        string targetDBOName = sqlMetadataProvider.EntityToDatabaseObject[relationship.TargetEntity].FullName;
                        string cardinality = relationship.Cardinality.ToString().ToLower();
                        RelationShipPair linkedSourceRelationshipPair = new(linkingDatabaseObject, sourceDatabaseObject);
                        RelationShipPair linkedTargetRelationshipPair = new(linkingDatabaseObject, targetDatabaseObject);
                        ForeignKeyDefinition? fKDef;
                        string referencedSourceColumns = relationship.SourceFields is not null ? string.Join(",", relationship.SourceFields) :
                            sqlMetadataProvider.PairToFkDefinition!.TryGetValue(linkedSourceRelationshipPair, out fKDef) ?
                            string.Join(",", fKDef.ReferencedColumns) : string.Empty;
                        string referencingSourceColumns = relationship.LinkingSourceFields is not null ? string.Join(",", relationship.LinkingSourceFields) :
                            sqlMetadataProvider.PairToFkDefinition!.TryGetValue(linkedSourceRelationshipPair, out fKDef) ?
                            string.Join(",", fKDef.ReferencingColumns) : string.Empty;
                        string referencedTargetColumns = relationship.TargetFields is not null ? string.Join(",", relationship.TargetFields) :
                            sqlMetadataProvider.PairToFkDefinition!.TryGetValue(linkedTargetRelationshipPair, out fKDef) ?
                            string.Join(",", fKDef.ReferencedColumns) : string.Empty;
                        string referencingTargetColumns = relationship.LinkingTargetFields is not null ? string.Join(",", relationship.LinkingTargetFields) :
                            sqlMetadataProvider.PairToFkDefinition!.TryGetValue(linkedTargetRelationshipPair, out fKDef) ?
                            string.Join(",", fKDef.ReferencingColumns) : string.Empty;

                        _logger.LogDebug(
                            message: "{entityName}: {sourceDBOName}({referencedSourceColumns}) is related to {cardinality} " +
                            "{relationship.TargetEntity}: {targetDBOName}({referencedTargetColumns}) by " +
                            "{relationship.LinkingObject}(linking.source.fields: {referencingSourceColumns}), (linking.target.fields: {referencingTargetColumns})",
                            entityName,
                            sourceDBOName,
                            referencedSourceColumns,
                            cardinality,
                            relationship.TargetEntity,
                            targetDBOName,
                            referencedTargetColumns,
                            relationship.LinkingObject,
                            referencingSourceColumns,
                            referencingTargetColumns);
                    }
                }

                if (relationship.LinkingObject is null
                    && (relationship.SourceFields is null || relationship.TargetFields is null))
                {
                    if (!sqlMetadataProvider.VerifyForeignKeyExistsInDB(sourceDatabaseObject, targetDatabaseObject))
                    {
                        HandleOrRecordException(new DataApiBuilderException(
                            message: $"Could not find relationship between entities: {entityName} and {relationship.TargetEntity}.",
                            statusCode: HttpStatusCode.ServiceUnavailable,
                            subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
                    }
                }

                if (relationship.LinkingObject is null && !_runtimeConfigProvider.IsLateConfigured)
                {
                    RelationShipPair sourceTargetRelationshipPair = new(sourceDatabaseObject, targetDatabaseObject);
                    RelationShipPair targetSourceRelationshipPair = new(targetDatabaseObject, sourceDatabaseObject);
                    string sourceDBOName = sqlMetadataProvider.EntityToDatabaseObject[entityName].FullName;
                    string targetDBOName = sqlMetadataProvider.EntityToDatabaseObject[relationship.TargetEntity].FullName;
                    string cardinality = relationship.Cardinality.ToString().ToLower();
                    ForeignKeyDefinition? fKDef;
                    string sourceColumns = relationship.SourceFields is not null ? string.Join(",", relationship.SourceFields) :
                        sqlMetadataProvider.PairToFkDefinition!.TryGetValue(sourceTargetRelationshipPair, out fKDef) ?
                        string.Join(",", fKDef.ReferencingColumns) :
                        sqlMetadataProvider.PairToFkDefinition!.TryGetValue(targetSourceRelationshipPair, out fKDef) ?
                        string.Join(",", fKDef.ReferencedColumns) : string.Empty;
                    string targetColumns = relationship.TargetFields is not null ? string.Join(",", relationship.TargetFields) :
                        sqlMetadataProvider.PairToFkDefinition!.TryGetValue(sourceTargetRelationshipPair, out fKDef) ?
                        string.Join(",", fKDef.ReferencedColumns) :
                        sqlMetadataProvider.PairToFkDefinition!.TryGetValue(targetSourceRelationshipPair, out fKDef) ?
                        string.Join(",", fKDef.ReferencingColumns) : string.Empty;

                    _logger.LogDebug(
                        message: "{entityName}: {sourceDBOName}({sourceColumns}) is related to {cardinality} {relationshipTargetEntity}: {targetDBOName}({targetColumns}).",
                        entityName,
                        sourceDBOName,
                        sourceColumns,
                        cardinality,
                        relationship.TargetEntity,
                        targetDBOName,
                        targetColumns
                        );
                }
            }
        }
    }

    /// <summary>
    /// Handles the validation of source and target fields as valid backing columns in the DB.
    /// </summary>
    /// <param name="relationshipName">Name of the relationship.</param>
    /// <param name="entityName">The name of the entity that we check for backing columns.</param>
    /// <param name="relationship">The relationship that holds the fields to validate.</param>
    /// <param name="sqlMetadataProvider">The sqlMetadataProvider used to lookup if the backing fields are valid columns in DB.</param>
    /// <param name="invalidColumns">List in which invalid fields are aggregated, this list may be modified by this function.</param>
    private void ValidateSourceAndTargetFieldsAsBackingColumns(
        string entityName,
        string relationshipName,
        EntityRelationship relationship,
        ISqlMetadataProvider sqlMetadataProvider,
        List<string> invalidColumns)
    {
        // In all kinds of relationships, if sourceFields are included they must be valid columns in the backend.
        if (relationship.SourceFields is not null)
        {
            GetFieldsNotBackedByColumnsInDB(
                invalidColumns: invalidColumns,
                fields: relationship.SourceFields,
                entityName: entityName,
                sqlMetadataProvider: sqlMetadataProvider);

            if (invalidColumns.Count > 0)
            {
                HandleOrRecordException(new DataApiBuilderException(
                    message: $"Entity: {entityName} has a relationship: {relationshipName} with source fields: {string.Join(",", invalidColumns)} that " +
                        $"do not exist as columns in entity: {entityName}.",
                    statusCode: HttpStatusCode.ServiceUnavailable,
                    subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
            }
        }

        // In all kinds of relationships, if targetFields are included they must be valid columns in the backend.
        if (relationship.TargetFields is not null)
        {
            GetFieldsNotBackedByColumnsInDB(
                invalidColumns: invalidColumns,
                fields: relationship.TargetFields,
                entityName: relationship.TargetEntity,
                sqlMetadataProvider: sqlMetadataProvider);

            if (invalidColumns.Count > 0)
            {
                HandleOrRecordException(new DataApiBuilderException(
                    message: $"Entity: {entityName} has a relationship: {relationshipName} with target fields: {string.Join(",", invalidColumns)} that " +
                        $"do not exist as columns in entity: {relationship.TargetEntity}.",
                    statusCode: HttpStatusCode.ServiceUnavailable,
                    subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
            }
        }
    }

    /// <summary>
    /// This helper function checks if the elements of fields exist as valid backing columns
    /// in the DB associated with the provided entity name. Those fields that do not exist
    /// as valid backing columns are added to the provided list of string invalidColumns. This
    /// works because C# is pass by reference for referenced class types.
    /// </summary>
    /// <param name="invalidColumns">List in which to aggregate the invalid fields.</param>
    /// <param name="fields">List of the backing fields to check for existence in backing DB.</param>
    /// <param name="entityName">The name of the entity that we check for backing columns.</param>
    /// <param name="sqlMetadataProvider">The sqlMetadataProvider used to lookup if the backing fields are valid columns in DB.</param>
    private static void GetFieldsNotBackedByColumnsInDB(
        List<string> invalidColumns,
        string[] fields,
        string entityName,
        ISqlMetadataProvider sqlMetadataProvider)
    {
        invalidColumns.Clear();
        foreach (string field in fields)
        {
            // We call this function because the keyset are the backing columns
            // which is what want to validate.
            if (!sqlMetadataProvider.TryGetExposedColumnName(entityName, field, out _))
            {
                invalidColumns.Add(field);
            }
        }
    }

    /// <summary>
    /// Helper function for validating the fields and associated linking fields in a many-many relationship.
    /// Validates that if one exists, the other exists as well, and that if both exist that their sizes are
    /// the same.
    /// </summary>
    /// <param name="fields">Either source of target fields.</param>
    /// <param name="linkingFields">Associated linking fields.</param>
    /// <param name="fieldType">The type of fields, either source or target.</param>
    /// <param name="entityName">Name of the entity that holds the relationship.</param>
    /// <param name="relationshipName">Name of the relationship.</param>
    private void ValidateFieldsAndAssociatedLinkingFields(string[]? fields, string[]? linkingFields, string fieldType, string entityName, string relationshipName)
    {
        // Validation to ensure that fields and linkingFields are either both null or both non null.
        if (fields is null ^ linkingFields is null)
        {
            HandleOrRecordException(new DataApiBuilderException(
                message: $"Entity: {entityName} has a many-many relationship: {relationshipName}, which has {fieldType} and associated linking fields " +
                    $"where one is null and the other is not.",
                statusCode: HttpStatusCode.ServiceUnavailable,
                subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
        }

        // When both fields and linkingTarget fields exist for a many-many relationship their size must match.
        if (fields is not null && linkingFields is not null && fields.Length != linkingFields.Length)
        {
            HandleOrRecordException(new DataApiBuilderException(
                message: $"Entity: {entityName} has a many-many relationship: {relationshipName} with {fields.Length} " +
                    $"{fieldType} fields defined, but {linkingFields.Length} linking {fieldType} fields defined.",
                statusCode: HttpStatusCode.ServiceUnavailable,
                subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
        }
    }

    /// <summary>
    /// Method to do different validations on claims in the policy.
    /// </summary>
    /// <param name="policy">The policy to be validated and processed.</param>
    /// <returns>Processed policy</returns>
    /// <exception cref="DataApiBuilderException">Throws exception when one or the other validations fail.</exception>
    private void ValidateClaimsInPolicy(string policy, RuntimeConfig runtimeConfig)
    {
        // Find all the claimTypes from the policy
        MatchCollection claimTypes = GetClaimTypesInPolicy(policy);
        bool isStaticWebAppsAuthConfigured = runtimeConfig.IsStaticWebAppsIdentityProvider;

        foreach (Match claimType in claimTypes)
        {
            try
            {
                // Remove the prefix @claims. from the claimType
                string typeOfClaim = claimType.Value.Substring(AuthorizationResolver.CLAIM_PREFIX.Length);

                if (string.IsNullOrWhiteSpace(typeOfClaim))
                {
                    // Empty claimType is not allowed
                    throw new DataApiBuilderException(
                        message: $"ClaimType cannot be empty.",
                        statusCode: HttpStatusCode.ServiceUnavailable,
                        subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError
                        );
                }

                if (_invalidClaimCharsRgx.IsMatch(typeOfClaim))
                {
                    // Not a valid claimType containing allowed characters
                    throw new DataApiBuilderException(
                        message: $"Invalid format for claim type {typeOfClaim} supplied in policy.",
                        statusCode: HttpStatusCode.ServiceUnavailable,
                        subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError
                        );
                }

                if (isStaticWebAppsAuthConfigured &&
                    !(typeOfClaim.Equals(StaticWebAppsAuthentication.USER_ID_CLAIM) ||
                    typeOfClaim.Equals(StaticWebAppsAuthentication.USER_DETAILS_CLAIM)))
                {
                    // Not a valid claimType containing allowed characters
                    throw new DataApiBuilderException(
                        message: INVALID_CLAIMS_IN_POLICY_ERR_MSG,
                        statusCode: HttpStatusCode.ServiceUnavailable,
                        subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError
                        );
                }
            }
            catch (Exception e)
            {
                HandleOrRecordException(e);
            }
        } // MatchType claimType
    }

    /// <summary>
    /// Helper method which takes in the policy string and checks whether all fields referenced
    /// within the policy are accessible to the user.
    /// </summary>
    /// <param name="policy">Database policy</param>
    /// <param name="include">Array of fields which are accessible to the user.</param>
    /// <param name="exclude">Array of fields which are not accessible to the user.</param>
    private void AreFieldsAccessible(string policy, HashSet<string>? includedFields, HashSet<string> excludedFields)
    {
        // Pattern of field references in the policy
        string fieldCharsRgx = @"@item\.[a-zA-Z0-9_]*";
        MatchCollection fieldNameMatches = Regex.Matches(policy, fieldCharsRgx);

        foreach (Match fieldNameMatch in fieldNameMatches)
        {
            if (!IsFieldAccessible(fieldNameMatch, includedFields, excludedFields))
            {
                HandleOrRecordException(new DataApiBuilderException(
                    message: $"Not all the columns required by policy are accessible.",
                    statusCode: HttpStatusCode.ServiceUnavailable,
                    subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError)
                );
            }
        }
    }

    /// <summary>
    /// Helper method which takes in field prefixed with @item. directive and check if its
    /// accessible based on include/exclude fields.
    /// </summary>
    /// <param name="columnNameMatch"></param>
    /// <param name="included">Set of fields which are accessible to the user.</param>
    /// <param name="excluded">Set of fields which are not accessible to the user.</param>
    /// <returns>Boolean value indicating whether the field is accessible or not.</returns>
    /// <exception cref="DataApiBuilderException">Throws exception if the field is not accessible.</exception>
    private static bool IsFieldAccessible(Match columnNameMatch, HashSet<string>? includedFields, HashSet<string> excludedFields)
    {
        string columnName = columnNameMatch.Value.Substring(AuthorizationResolver.FIELD_PREFIX.Length);
        if (excludedFields.Contains(columnName!) || excludedFields.Contains(AuthorizationResolver.WILDCARD) ||
            (includedFields is not null && !includedFields.Contains(AuthorizationResolver.WILDCARD) && !includedFields.Contains(columnName)))
        {
            // If column is present in excluded OR excluded='*'
            // If column is absent from included and included!=*
            // In this case, the column is not accessible to the user
            return false;
        }

        return true;
    }

    /// <summary>
    /// Helper method to get all the claimTypes from the policy.
    /// </summary>
    /// <param name="policy">Policy from which the claimTypes are to be looked</param>
    /// <returns>Collection of all matches i.e. claimTypes.</returns>
    private static MatchCollection GetClaimTypesInPolicy(string policy)
    {
        return Regex.Matches(policy, _claimChars);
    }

    /// <summary>
    /// Helper function to create a DataApiBuilderException object.
    /// Called when the actionName is not valid.
    /// </summary>
    /// <param name="entityName">Name of entity for which invalid action is supplied.</param>
    /// <param name="roleName">Name of role for which invalid action is supplied.</param>
    /// <param name="actionName">Name of invalid action.</param>
    /// <returns></returns>
    private static DataApiBuilderException GetInvalidActionException(string entityName, string roleName, string actionName)
    {
        return new DataApiBuilderException(
            message: $"action:{actionName} specified for entity:{entityName}, role:{roleName} is not valid.",
            statusCode: HttpStatusCode.ServiceUnavailable,
            subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError);
    }

    private void HandleOrRecordException(Exception ex)
    {
        if (_isValidateOnly)
        {
            ConfigValidationExceptions.Add(ex);
        }
        else
        {
            throw ex;
        }
    }

    /// <summary>
    /// Returns whether the action is a valid
    /// Valid non stored procedure actions:
    /// - Create, Read, Update, Delete (CRUD)
    /// - All (*)
    /// Valid stored procedure  actions:
    /// - Execute
    /// </summary>
    /// <param name="action">Compared against valid actions to determine validity.</param>
    /// <param name="entity">Used to identify entity's representative object type.</param>
    /// <param name="entityName">Used to supplement error messages.</param>
    /// <returns>Boolean value indicating whether the action is valid or not.</returns>
    private bool IsValidPermissionAction(EntityActionOperation action, Entity entity, string entityName)
    {
        if (entity.Source.Type is EntitySourceType.StoredProcedure)
        {
            if (action is not EntityActionOperation.All && !EntityAction.ValidStoredProcedurePermissionOperations.Contains(action))
            {
                HandleOrRecordException(new DataApiBuilderException(
                    message: $"Invalid operation for Entity: {entityName}. Stored procedures can only be configured with the 'execute' operation.",
                    statusCode: HttpStatusCode.ServiceUnavailable,
                    subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
            }

            return true;
        }
        else
        {
            if (action is EntityActionOperation.Execute)
            {
                HandleOrRecordException(new DataApiBuilderException(
                    message: $"Invalid operation for Entity: {entityName}. The 'execute' operation can only be configured for entities backed by stored procedures.",
                    statusCode: HttpStatusCode.ServiceUnavailable,
                    subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError));
            }

            return action is EntityActionOperation.All || EntityAction.ValidPermissionOperations.Contains(action);
        }
    }

    /// <summary>
    /// Returns whether the log-level keyword is valid or not.
    /// It does this by checking each section of the name of the class,
    /// in order to ensure that the last section is complete.
    /// E.g. Azure.DataApiBuilder is valid. While Azure.DataA is invalid.
    /// </summary>
    /// <param name="loggerFilter">String keyword that comes from log-level in config file</param>
    private static bool IsLoggerFilterValid(string loggerFilter)
    {
        string[] loggerSub = loggerFilter.Split('.');
        for (int i = 0; i < LoggerFilters.validFilters.Count; i++)
        {
            bool isValid = true;
            string[] validFiltersSub = LoggerFilters.validFilters[i].Split('.');

            if (loggerSub.Length <= validFiltersSub.Length)
            {
                for (int j = 0; j < loggerSub.Length; j++)
                {
                    if (!loggerSub[j].Equals(validFiltersSub[j], StringComparison.OrdinalIgnoreCase))
                    {
                        isValid = false;
                        break;
                    }
                }

                if (isValid)
                {
                    return true;
                }
            }
        }

        return false;
    }

    /// <summary>
    /// Checks that all of the entities created with the Entities and Autoentities properties
    /// are valid by having unique paths for both REST and GraphQL, that there are no duplicate
    /// Queries or Mutation entities, and ensure the semantic correctness of all the entities.
    /// </summary>
    /// <param name="runtimeConfig">The runtime configuration.</param>
    public void ValidateEntityAndAutoentityConfigurations(RuntimeConfig runtimeConfig)
    {
        if (runtimeConfig.IsDevelopmentMode())
        {
            ValidateEntityConfiguration(runtimeConfig);

            if (runtimeConfig.IsGraphQLEnabled && runtimeConfig.DataSource is not null)
            {
                ValidateEntitiesDoNotGenerateDuplicateQueriesOrMutation(runtimeConfig.DataSource.DatabaseType, runtimeConfig.Entities);
            }

            // Running only in developer mode to ensure fast and smooth startup in production.
            ValidatePermissionsInConfig(runtimeConfig);
        }
    }
}