fix(kas): Fix kas panics on bad requests

[elizabethhealy]

Proposed Changes

• Added comprehensive nil checks for requests, policies, and key access objects
• Updated tdf3Rewrap and nanoTDFRewrap functions to return errors instead of silently failing
• Added validation for empty wrapped keys and unsupported key types
• Improved error handling in the Rewrap main handler

Checklist

• I have added or updated unit tests
• I have added or updated integration tests (if appropriate)
• I have added or updated documentation

Testing Instructions

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	175.592381ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	101.849407ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	372.960374ms
Throughput	268.12 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.51537425s
Average Latency	393.390479ms
Throughput	126.53 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	27.747360198s
Average Latency	276.530845ms
Throughput	180.20 requests/second

[github-actions]

X-Test Results

opentdfplatformXTRU8T.dockerbuild
cukes-report
✅ java-v0.4.34
✅ js-v0.4.34
✅ go-v0.4.34
bats-test-results
test-cases-mapping-report
✅ js-pull-2916
✅ java-pull-2916
✅ go-pull-2916

[elizabethhealy]

/gemini review

[Copilot]

Pull Request Overview

This PR adds defensive nil-checking and error handling to prevent panics in the KAS rewrap service when processing malformed requests. The changes ensure that nil requests, policies, and key access objects are handled gracefully with appropriate error responses instead of causing service crashes.

Key Changes:

• Added comprehensive nil checks for requests, policies, and key access objects
• Updated tdf3Rewrap and nanoTDFRewrap functions to return errors instead of silently failing
• Added validation for empty wrapped keys and unsupported key types
• Improved error handling in the Rewrap main handler

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
service/kas/access/rewrap.go	Added nil checks, error handling, and validation for requests, policies, and key access objects; updated function signatures to propagate errors
service/kas/access/rewrap_test.go	Added comprehensive test coverage for nil request handling in verifyRewrapRequests and verifyNanoRewrapRequests functions

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[gemini-code-assist]

Code Review

This pull request significantly improves the robustness of the Key Access Service by adding numerous checks to prevent panics on malformed requests. The changes are well-implemented and include comprehensive unit tests for the new error handling paths. My review includes a few suggestions to further refine the error handling logic for consistency and clarity, particularly regarding the return values on error paths in batch processing.

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	184.729268ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	108.279289ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	360.690666ms
Throughput	277.25 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.086285865s
Average Latency	389.403131ms
Throughput	127.92 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	27.62505459s
Average Latency	275.309793ms
Throughput	181.00 requests/second

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	138.334838ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	83.231216ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	383.372263ms
Throughput	260.84 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	42.214742866s
Average Latency	420.203103ms
Throughput	118.44 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	29.936430998s
Average Latency	298.347731ms
Throughput	167.02 requests/second

[github-actions]

X-Test Failure Report

opentdfplatform0XN6XZ.dockerbuild
✅ java-v0.4.34
cukes-report
✅ js-v0.4.34
✅ go-v0.4.34
bats-test-results
test-cases-mapping-report
✅ js-pull-2916
❌ go-pull-2916
✅ java-pull-2916

[github-actions]

X-Test Failure Report

opentdfplatformV0JFWO.dockerbuild
cukes-report
✅ js-v0.4.34
✅ java-v0.4.34
✅ go-v0.4.34
bats-test-results
test-cases-mapping-report
✅ js-pull-2916
✅ java-pull-2916
❌ go-pull-2916

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	145.315858ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	77.085075ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	370.920363ms
Throughput	269.60 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.151709055s
Average Latency	390.024447ms
Throughput	127.71 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	27.286423856s
Average Latency	271.798351ms
Throughput	183.24 requests/second

[github-actions]

X-Test Failure Report

opentdfplatformD3AO2T.dockerbuild
cukes-report
✅ js-v0.4.34
✅ java-v0.4.34
✅ go-v0.4.34
bats-test-results
test-cases-mapping-report
✅ js-pull-2916
❌ go-pull-2916
✅ java-pull-2916

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	149.194693ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	80.941669ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	382.795872ms
Throughput	261.24 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.619798351s
Average Latency	394.300427ms
Throughput	126.20 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	27.44121559s
Average Latency	273.43289ms
Throughput	182.21 requests/second

[github-actions]

X-Test Failure Report

opentdfplatformTNNZSD.dockerbuild
cukes-report
✅ java-v0.4.34
✅ js-v0.4.34
✅ go-v0.4.34
bats-test-results
test-cases-mapping-report
✅ java-pull-2916
✅ go-pull-2916

[github-actions]

X-Test Results

opentdfplatformTNNZSD.dockerbuild
cukes-report
✅ java-v0.4.34
✅ js-v0.4.34
✅ go-v0.4.34
bats-test-results
test-cases-mapping-report
✅ java-pull-2916
✅ go-pull-2916
✅ js-pull-2916