fix: Enhance CosmosDB queries to scope results by user ID for improved data security

[Dhruvkumar-Microsoft]

Purpose

This pull request updates several database query methods in cosmosdb.py to ensure that all plan-related data is properly scoped to the current user. This enhances data security and isolation, preventing users from accessing or modifying data that does not belong to them. Corresponding unit tests in test_cosmosdb.py have also been updated to reflect these changes.

Database query scoping improvements:

• All relevant queries in cosmosdb.py (get_plan_by_plan_id, get_steps_by_plan, delete_plan_by_plan_id, get_mplan, and get_agent_messages) now include a user_id filter to ensure only data belonging to the current user is accessed or modified. [1] [2] [3] [4] [5]

Test updates:

• Unit tests in test_cosmosdb.py have been updated to expect the new user_id filter in queries and parameters, ensuring that tests accurately reflect the new scoping logic. [1] [2] [3] [4]

Does this introduce a breaking change?

• Yes
• No

How to Test

• Get the code

git clone [repo-address]
cd [repo-name]
git checkout [branch-name]
npm install

• Test the code

What to Check

Verify that the following are valid

• ...

Other Information

[github-actions]

Coverage Report •

File	Stmts	Miss	Cover	Missing
common/database
cosmosdb.py	256	19	92%	338, 341–343, 427–428, 461–462, 513, 515, 520–525, 528–529, 533
TOTAL	3835	552	85%

Tests	Skipped	Failures	Errors	Time
837	0 💤	0 ❌	0 🔥	9.821s ⏱️

[Copilot]

🟡 Changes recommended

Add direct coverage for the ownership predicates in the deletion query.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This pull request scopes CosmosDB plan-related queries by user ID to improve data isolation, with corresponding test updates.

Changes:

• Added user filters to plan, step, mplan, and agent-message queries.
• Restricted plan deletion by user ID and data type.
• Updated query expectations and parameters in unit tests.

File summaries

File	Summary
src/tests/backend/common/database/test_cosmosdb.py	Updated query expectations; the deletion test needs exact query and parameter assertions, including @user_id and DataType.plan (moderate, 3 votes).
src/backend/common/database/cosmosdb.py	Added user-scoped CosmosDB predicates for reads and deletion.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.