Skip to content

fix(authz): deny resources granularly when attribute value FQNs not found #2896

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
jakedoublev merged 6 commits into from
Nov 12, 2025
Merged

fix(authz): deny resources granularly when attribute value FQNs not found #2896

jakedoublev merged 6 commits into from
Nov 12, 2025
+531 −65

Conversation

@jakedoublev
Copy link
Contributor

@jakedoublev jakedoublev commented Nov 10, 2025 •
edited
Loading

Proposed Changes

  • If attribute value FQNs not found, deny access to the resource containing the FQN instead of returning error to request

Checklist

  • I have added or updated unit tests
  • I have added or updated integration tests (if appropriate)
  • I have added or updated documentation

Testing Instructions

@github-actions
Copy link
Contributor

github-actions bot commented Nov 10, 2025

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 200.687535ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 102.531703ms

Benchmark Statistics

Name № Requests Avg Duration Min Duration Max Duration

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 435.168153ms
Throughput 229.80 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 40.640615628s
Average Latency 404.292358ms
Throughput 123.03 requests/second

NANOTDF Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 28.281805839s
Average Latency 281.979583ms
Throughput 176.79 requests/second

@github-actions
Copy link
Contributor

github-actions bot commented Nov 10, 2025

X-Test Results

opentdfplatform2U5G9S.dockerbuild
cukes-report
✅ js-v0.4.34
✅ java-v0.4.34
✅ go-v0.4.34
bats-test-results
test-cases-mapping-report
✅ js-pull-2896
✅ java-pull-2896
✅ go-pull-2896

@github-actions
Copy link
Contributor

github-actions bot commented Nov 10, 2025

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 173.608188ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 94.929555ms

Benchmark Statistics

Name № Requests Avg Duration Min Duration Max Duration

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 372.091129ms
Throughput 268.75 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 39.495804933s
Average Latency 393.190053ms
Throughput 126.60 requests/second

NANOTDF Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 27.779976709s
Average Latency 276.672005ms
Throughput 179.99 requests/second

@jakedoublev jakedoublev marked this pull request as ready for review November 10, 2025 23:12
@jakedoublev jakedoublev requested a review from a team as a code owner November 10, 2025 23:12
jakedoublev
jakedoublev commented Nov 10, 2025
View reviewed changes
@github-actions
Copy link
Contributor

github-actions bot commented Nov 10, 2025

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 178.429038ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 96.003065ms

Benchmark Statistics

Name № Requests Avg Duration Min Duration Max Duration

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 377.437652ms
Throughput 264.94 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 39.55192426s
Average Latency 393.796609ms
Throughput 126.42 requests/second

NANOTDF Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 28.038021392s
Average Latency 279.336056ms
Throughput 178.33 requests/second

@github-actions
Copy link
Contributor

github-actions bot commented Nov 10, 2025

X-Test Results

opentdfplatform95Z68I.dockerbuild
cukes-report
✅ js-v0.4.34
✅ java-v0.4.34
✅ go-v0.4.34
bats-test-results
test-cases-mapping-report
✅ js-pull-2896
✅ java-pull-2896
✅ go-pull-2896

@github-actions
Copy link
Contributor

github-actions bot commented Nov 10, 2025

X-Test Results

opentdfplatformP0SBWK.dockerbuild
cukes-report
✅ js-v0.4.34
✅ java-v0.4.34
✅ go-v0.4.34
bats-test-results
test-cases-mapping-report
✅ js-pull-2896
✅ java-pull-2896
✅ go-pull-2896

@github-actions
Copy link
Contributor

github-actions bot commented Nov 11, 2025

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 188.037931ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 104.257127ms

Benchmark Statistics

Name № Requests Avg Duration Min Duration Max Duration

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 361.29469ms
Throughput 276.78 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 39.535324901s
Average Latency 393.432241ms
Throughput 126.47 requests/second

NANOTDF Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 28.012241378s
Average Latency 279.166301ms
Throughput 178.49 requests/second

@github-actions
Copy link
Contributor

github-actions bot commented Nov 11, 2025

X-Test Results

opentdfplatformMRAG4N.dockerbuild
cukes-report
✅ js-v0.4.34
✅ java-v0.4.34
bats-test-results
test-cases-mapping-report
✅ go-v0.4.34
✅ js-pull-2896
✅ java-pull-2896
✅ go-pull-2896

@jakedoublev jakedoublev added this pull request to the merge queue Nov 12, 2025
Merged via the queue into main with commit 802db02 Nov 12, 2025
38 checks passed
@jakedoublev jakedoublev deleted the fix/DSPX-1083 branch November 12, 2025 15:31
@opentdf-automation
Copy link
Contributor

opentdf-automation bot commented Nov 12, 2025

Successfully created backport PR for release/service/v0.11:

opentdf-automation bot pushed a commit that referenced this pull request Nov 12, 2025
@jakedoublev @github-actions
fix(authz): deny resources granularly when attribute value FQNs not f…
ea9c43a 
…ound (#2896)

### Proposed Changes

* If attribute value FQNs not found, deny access to the resource
containing the FQN instead of returning error to request

### Checklist

- [X] I have added or updated unit tests
- [ ] I have added or updated integration tests (if appropriate)
- [ ] I have added or updated documentation

### Testing Instructions

(cherry picked from commit 802db02)
@opentdf-automation opentdf-automation bot mentioned this pull request Nov 12, 2025
Merged
opentdf-automation bot added a commit that referenced this pull request Nov 12, 2025
@opentdf-automation
fix(authz): deny resources granularly when attribute value FQNs not f…
d8ec7bd 
…ound (#2896)

### Proposed Changes

* If attribute value FQNs not found, deny access to the resource
containing the FQN instead of returning error to request

### Checklist

- [X] I have added or updated unit tests
- [ ] I have added or updated integration tests (if appropriate)
- [ ] I have added or updated documentation

### Testing Instructions

(cherry picked from commit 802db02)
jakedoublev pushed a commit that referenced this pull request Nov 12, 2025
@opentdf-automation
fix(authz): deny resources granularly when attribute value FQNs not f…
225627d 
…ound [backport to release/service/v0.11] (#2897)

# Description
Backport of #2896 to `release/service/v0.11`.

Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>
@opentdf-automation opentdf-automation bot mentioned this pull request Nov 7, 2025
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jentfoo jentfoo jentfoo approved these changes

@dmihalcik-virtru dmihalcik-virtru dmihalcik-virtru approved these changes

Assignees

No one assigned

Labels

backport release/service/v0.11 size/s

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@jakedoublev @jentfoo @dmihalcik-virtru