Database authorization policy processing currently converts referenced claim values into OData filter text before parsing. This does not provide a strict separation between policy syntax and claim data because URI processing may transform the serialized value.
Refactor policy processing so that:
- Claim references become OData parameter aliases.
- Claim values remain separate from policy text.
- Values are injected as typed AST constants before type promotion.
- Generated SQL and Cosmos DB queries use bound parameters.
- Legitimate encoded and percent-containing values are preserved exactly.
- Invalid primitive claim values fail closed.
Add regression coverage for literal apostrophes, percent-encoded values, nested/mixed encoding, legitimate percent characters, supported primitive types, and Cosmos DB parameterization.
Database authorization policy processing currently converts referenced claim values into OData filter text before parsing. This does not provide a strict separation between policy syntax and claim data because URI processing may transform the serialized value.
Refactor policy processing so that:
Add regression coverage for literal apostrophes, percent-encoded values, nested/mixed encoding, legitimate percent characters, supported primitive types, and Cosmos DB parameterization.