Skip to content

fix(authz): if entity identifier results in multiple representations, treat with AND in resource decision results [backport to release/service/v0.11] #2887

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
jakedoublev merged 2 commits into from
Nov 7, 2025
Merged

fix(authz): if entity identifier results in multiple representations, treat with AND in resource decision results [backport to release/service/v0.11] #2887

jakedoublev merged 2 commits into from
Nov 7, 2025

Conversation

@opentdf-automation
Copy link
Contributor

@opentdf-automation opentdf-automation bot commented Nov 6, 2025

Description

Backport of #2860 to release/service/v0.11.

@opentdf-automation opentdf-automation bot requested review from a team as code owners November 6, 2025 22:09
@opentdf-automation opentdf-automation bot mentioned this pull request Nov 6, 2025
Merged
3 tasks
@opentdf-automation
fix(authz): if entity identifier results in multiple representations,…
1f5c818 
… treat with AND in resource decision results (#2860)

### Proposed Changes

* Make sure an entity identifier that breaks out into multiple entity
representations when back from the ERS response results in AND logic
across the representations on each individual resource
* Audit should log for each entity representation for clarity (possible
to provide an entity chain with dozens of email addresses in a single
identifier, so there should be a log to audit for each representation of
an entity from the chained email address entities)

### Checklist

- [ ] I have added or updated unit tests
- [ ] I have added or updated integration tests (if appropriate)
- [ ] I have added or updated documentation

### Testing Instructions

(cherry picked from commit e869b35)
@opentdf-automation opentdf-automation bot force-pushed the backport-2860-to-release/service/v0.11 branch from 95682b5 to 1f5c818 Compare November 6, 2025 22:09
@github-actions
Copy link
Contributor

github-actions bot commented Nov 6, 2025

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 178.79015ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 105.445304ms

Benchmark Statistics

Name № Requests Avg Duration Min Duration Max Duration

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 362.672367ms
Throughput 275.73 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 39.566794048s
Average Latency 393.658544ms
Throughput 126.37 requests/second

NANOTDF Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 27.676293031s
Average Latency 276.019949ms
Throughput 180.66 requests/second

@github-actions
Copy link
Contributor

github-actions bot commented Nov 6, 2025

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 177.07554ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 107.765105ms

Benchmark Statistics

Name № Requests Avg Duration Min Duration Max Duration

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 357.251934ms
Throughput 279.91 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 38.639368921s
Average Latency 384.919134ms
Throughput 129.40 requests/second

NANOTDF Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 27.782595996s
Average Latency 276.613106ms
Throughput 179.97 requests/second

@github-actions
Copy link
Contributor

github-actions bot commented Nov 6, 2025

X-Test Results

opentdfplatformX8DVPU.dockerbuild
✅ java-v0.4.34
cukes-report
✅ js-v0.4.34
✅ go-v0.4.34
bats-test-results
test-cases-mapping-report
✅ js-pull-2887
✅ java-pull-2887
✅ go-pull-2887

@github-actions
Copy link
Contributor

github-actions bot commented Nov 6, 2025

X-Test Results

opentdfplatformX1593I.dockerbuild
cukes-report
✅ js-v0.4.34
✅ java-v0.4.34
✅ go-v0.4.34
bats-test-results
✅ js-95682b5ed27bc772683f5c8dee3449d9d44eba1c
✅ java-95682b5ed27bc772683f5c8dee3449d9d44eba1c
✅ go-95682b5ed27bc772683f5c8dee3449d9d44eba1c

jakedoublev
jakedoublev previously approved these changes Nov 6, 2025
View reviewed changes
jakedoublev
jakedoublev previously approved these changes Nov 6, 2025
View reviewed changes
@policy-bot-opentdf policy-bot-opentdf bot dismissed stale reviews from jakedoublev and jakedoublev November 7, 2025 16:31

Invalidated by push of 15e46fc

@github-actions
Copy link
Contributor

github-actions bot commented Nov 7, 2025

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 197.210651ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 117.254048ms

Benchmark Statistics

Name № Requests Avg Duration Min Duration Max Duration

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 367.632864ms
Throughput 272.01 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 39.745885999s
Average Latency 395.339809ms
Throughput 125.80 requests/second

NANOTDF Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 27.35030058s
Average Latency 272.676759ms
Throughput 182.81 requests/second

@github-actions
Copy link
Contributor

github-actions bot commented Nov 7, 2025

X-Test Results

opentdfplatformU8SJPC.dockerbuild
cukes-report
✅ js-v0.4.34
✅ java-v0.4.34
✅ go-v0.4.34
bats-test-results
test-cases-mapping-report
✅ js-pull-2887
✅ java-pull-2887
✅ go-pull-2887

@jakedoublev jakedoublev merged commit f772064 into release/service/v0.11 Nov 7, 2025
33 of 34 checks passed
@jakedoublev jakedoublev deleted the backport-2860-to-release/service/v0.11 branch November 7, 2025 16:48
@opentdf-automation opentdf-automation bot mentioned this pull request Nov 7, 2025
Merged
jakedoublev pushed a commit that referenced this pull request Nov 7, 2025
@opentdf-automation
chore(release): release service 0.11.3 (#2868)
e5c0a5e 
🤖 I have created a release *beep* *boop*
---


##
[0.11.3](service/v0.11.2...service/v0.11.3)
(2025-11-07)


### Features

* **kas:** Add nano policy binding to rewrap audit. [backport to
release/service/v0.11]
([#2880](#2880))
([d8558f3](d8558f3))


### Bug Fixes

* **authz:** if entity identifier results in multiple representations,
treat with AND in resource decision results [backport to
release/service/v0.11]
([#2887](#2887))
([f772064](f772064))
* **kas:** populate rewrap audit log [backport to release/service/v0.11]
([#2867](#2867))
([f460972](f460972))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jakedoublev jakedoublev jakedoublev approved these changes

Assignees

No one assigned

Labels

comp:authorization comp:ci Github Actions Work size/m

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@jakedoublev