public string GetItemExistenceCheckSql(ViewBasedAuthorizationFilterDefinition filterDefinition, AuthorizationFilterContext filterContext) { // Use literal IN clause approach var edOrgIdsList = string.Join(',', filterContext.ClaimEndpointValues); return ($"SELECT 1 FROM auth.{filterDefinition.ViewName} AS authvw WHERE authvw.{filterDefinition.ViewTargetEndpointName} = @{filterDefinition.SubjectEndpointName} AND authvw.{RelationshipAuthorizationConventions.ViewSourceColumnName} IN ({edOrgIdsList})"); }
public string GetItemExistenceCheckSql(ViewBasedAuthorizationFilterDefinition filterDefinition, AuthorizationFilterContext filterContext) { if (filterContext.ClaimEndpointValues.Length < SqlServerParameterCountThreshold) { // Use literal IN clause approach var edOrgIdsList = string.Join(',', filterContext.ClaimEndpointValues); return ($"SELECT 1 FROM auth.{filterDefinition.ViewName} AS authvw WHERE authvw.{filterDefinition.ViewTargetEndpointName} = @{filterDefinition.SubjectEndpointName} AND authvw.{RelationshipAuthorizationConventions.ViewSourceColumnName} IN ({edOrgIdsList})"); } // Use TVP approach return($"SELECT 1 FROM auth.{filterDefinition.ViewName} AS authvw INNER JOIN @{RelationshipAuthorizationConventions.ClaimsParameterName} c ON authvw.{RelationshipAuthorizationConventions.ViewSourceColumnName} = c.Id AND authvw.{filterDefinition.ViewTargetEndpointName} = @{filterDefinition.SubjectEndpointName}"); }