// Escape a value for embedding in an OData string literal ('...'). // iDempiere's OData parser uses doubled single quotes as the escape — an // unescaped apostrophe in a scanned/typed value breaks the whole $filter // (and allows sub-filter injection within the role's visibility). // Use this for EVERY user/body-supplied value interpolated into a filter. // Note: string.urlEncode (alga-js) is encodeURI and does NOT protect // literals — it leaves ', &, + and # raw. export const odataQuote = (value: any): string => String(value ?? '').replace(/'/g, "''") export default odataQuote