addressing comments, deep copy

Author: aaronburtle

src/Auth/AuthorizationMetadataHelpers.cs

@@ -55,6 +55,23 @@ public class RoleMetadata
     /// Given the key (operation) returns the associated OperationMetadata object.
     /// </summary>
     public Dictionary<EntityActionOperation, OperationMetadata> OperationToColumnMap { get; set; } = new();
+
+    /// <summary>
+    /// Creates a deep clone of this RoleMetadata instance so that mutations
+    /// to the clone do not affect the original (and vice versa).
+    /// This is critical when copying permissions from one role to another
+    /// (e.g., anonymous → authenticated) to prevent shared mutable state.
+    /// </summary>
+    public RoleMetadata DeepClone()
+    {
+        RoleMetadata clone = new();
+        foreach ((EntityActionOperation operation, OperationMetadata metadata) in OperationToColumnMap)
+        {
+            clone.OperationToColumnMap[operation] = metadata.DeepClone();
+        }
+
+        return clone;
+    }
 }
 
 /// <summary>
@@ -68,4 +85,19 @@ public class OperationMetadata
     public HashSet<string> Included { get; set; } = new();
     public HashSet<string> Excluded { get; set; } = new();
     public HashSet<string> AllowedExposedColumns { get; set; } = new();
+
+    /// <summary>
+    /// Creates a deep clone of this OperationMetadata instance so that
+    /// mutations to the clone do not affect the original (and vice versa).
+    /// </summary>
+    public OperationMetadata DeepClone()
+    {
+        return new OperationMetadata
+        {
+            DatabasePolicy = DatabasePolicy,
+            Included = new HashSet<string>(Included),
+            Excluded = new HashSet<string>(Excluded),
+            AllowedExposedColumns = new HashSet<string>(AllowedExposedColumns)
+        };
+    }
 }

src/Core/Authorization/AuthorizationResolver.cs

@@ -395,6 +395,8 @@ private void SetEntityPermissionMap(RuntimeConfig runtimeConfig)
     /// <summary>
     /// Helper method to copy over permissions from anonymous role to authenticated role in the case
     /// when anonymous role is defined for an entity in the config but authenticated role is not.
+    /// Uses deep cloning to ensure the authenticated role's RoleMetadata is a separate instance
+    /// from anonymous, preventing shared mutable state between the two roles.
     /// </summary>
     /// <param name="entityToRoleMap">The EntityMetadata for the entity for which we want to copy permissions
     /// from anonymous to authenticated role.</param>
@@ -403,9 +405,10 @@ private static void CopyOverPermissionsFromAnonymousToAuthenticatedRole(
         EntityMetadata entityToRoleMap,
         HashSet<string> allowedColumnsForAnonymousRole)
     {
-        // Using assignment operator overrides the existing value for the key /
-        // adds a new entry for (key,value) pair if absent, to the map.
-        entityToRoleMap.RoleToOperationMap[ROLE_AUTHENTICATED] = entityToRoleMap.RoleToOperationMap[ROLE_ANONYMOUS];
+        // Deep clone the RoleMetadata so that anonymous and authenticated roles
+        // do not share mutable OperationMetadata instances. Without deep cloning,
+        // any future mutation of one role's permissions would silently affect the other.
+        entityToRoleMap.RoleToOperationMap[ROLE_AUTHENTICATED] = entityToRoleMap.RoleToOperationMap[ROLE_ANONYMOUS].DeepClone();
 
         // Copy over OperationToRolesMap for authenticated role from anonymous role.
         Dictionary<EntityActionOperation, OperationMetadata> allowedOperationMap =

src/Service.Tests/UnitTests/RequestParserUnitTests.cs

@@ -1,6 +1,8 @@
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT License.
 
+#nullable enable
+
 using Azure.DataApiBuilder.Core.Parsers;
 using Microsoft.VisualStudio.TestTools.UnitTesting;
 
@@ -52,7 +54,7 @@ public void ExtractRawQueryParameter_PreservesEncoding(string queryString, strin
         public void ExtractRawQueryParameter_ReturnsNull_WhenParameterNotFound(string? queryString, string parameterName)
         {
             // Call the internal method directly (no reflection needed)
-            string? result = RequestParser.ExtractRawQueryParameter(queryString, parameterName);
+            string? result = RequestParser.ExtractRawQueryParameter(queryString!, parameterName);
 
             Assert.IsNull(result,
                 $"Expected null but got '{result}' for parameter '{parameterName}' in query '{queryString}'");