Extend planning to detect object identifiers passed as query parameters (e.g. GET /orders?userId=...), not just path params, and substitute them from an identity's owns.
Files: src/engine/plan.ts, src/spec/parse.ts
Acceptance criteria
- BOLA/baseline cases are generated for query-param object refs.
- Tests cover the new substitution.
Comment /assign to claim.
Extend planning to detect object identifiers passed as query parameters (e.g.
GET /orders?userId=...), not just path params, and substitute them from an identity'sowns.Files:
src/engine/plan.ts,src/spec/parse.tsAcceptance criteria
Comment
/assignto claim.