fix(cosmos): enforce partition isolation for point reads and deletes

[thomhurst]

Point reads and deletes can return or delete a same-ID document from another partition after an exact storage-key miss. The storage key also stringifies partition values, so null and an empty string, or numbers and strings, can cross-match even on an exact-key hit.

Make explicit partition headers authoritative by validating candidate documents with the existing logical partition predicate. Keep the exact-key fast path, and constrain any fallback to matching partition values. Equivalent numeric representations such as 42 and 42.0 continue to match. Headerless requests retain their existing unscoped behavior.

Validation:

• Original nine Java regression cases failed before the initial fix.
• Three review regressions failed before their fixes: typed-key cross-matches, equivalent numeric representations, and suffix-only matches when IDs contain the storage delimiter.
• All 145 Cosmos Java tests pass, with zero failures/errors/skips.
• Extended .NET Cosmos SDK test passes against the packaged JVM server, including null versus empty-string isolation.
• Full Java run before the final ID guard: 1,076 tests, one failure in unchanged SqlProvisioningServiceTest.boundsRetainedTerminalOperations, 14 existing skips. Its retention logic sorts ConcurrentHashMap values only by endTime, so equal timestamps make the test's expected first eviction unspecified. The earlier full suite on this PR passed. No SQL files were changed.
• Full diff reviewed and simplified; git diff --check passes.

The pre-existing string-based storage key encoding still needs separate work to support creating the same ID simultaneously under colliding typed partition values. This PR protects point-operation scope without redesigning persisted keys.

[greptile-apps]

Greptile Summary

This PR makes explicit Cosmos DB partition headers authoritative for point reads and deletes.

• Validates exact-key and fallback candidates against the logical partition predicate.
• Prevents fallback suffix matches from selecting a different document ID.
• Preserves headerless legacy lookup behavior and equivalent numeric partition matching.
• Adds Java regression coverage and an end-to-end .NET Cosmos SDK compatibility test.

Confidence Score: 5/5

The PR appears safe to merge; the scoped lookup now enforces both partition and complete document identity without changing headerless behavior.

No actionable new defects or outstanding repository-rule violations remain in the reviewed changes.

Important Files Changed

Filename	Overview
src/main/java/io/floci/az/services/cosmos/CosmosHandler.java	Constrains partition-scoped point lookups to documents matching both the requested logical partition and complete document ID.
src/test/java/io/floci/az/services/cosmos/CosmosPointPartitionTest.java	Adds focused regressions for cross-partition access, typed partition values, numeric equivalence, and delimiter-related ID suffixes.
compatibility-tests/sdk-test-dotnet/CosmosPointPartitionCompatibilityTests.cs	Verifies partition-isolated reads and deletes through the real .NET Cosmos SDK.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    A[Point read or delete] --> B{Partition header present?}
    B -- No --> C[Legacy unscoped lookup]
    B -- Yes --> D[Parse logical partition]
    D --> E[Exact storage-key lookup]
    E --> F{ID and logical partition match?}
    F -- Yes --> G[Return or delete document]
    F -- No --> H[Scan container candidates]
    H --> I{Whole ID and partition match?}
    I -- Yes --> G
    I -- No --> J[Return 404]

Loading

_{Reviews (3): Last reviewed commit: "fix(cosmos): require complete document I..." | Re-trigger Greptile}