Skip to content

fix(authz): handle individual resource edge cases in decisions #2835

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 3 commits into from
Oct 29, 2025
Merged

fix(authz): handle individual resource edge cases in decisions #2835

merged 3 commits into from
Oct 29, 2025
+87 −98

Conversation

@jakedoublev
Copy link
Contributor

@jakedoublev jakedoublev commented Oct 23, 2025 •
edited
Loading

Proposed Changes

Individual resources should be denied for these cases, instead of an overall error response

  • attribute value FQN not found
  • registered resource value FQN not found
  • registered resource missing action attribute values altogether
  • registered resource missing action attribute values that relate to request action (i.e. read -> https://example.com/attr/attr1/value/value1 but request was for delete action)

Checklist

  • I have added or updated unit tests
  • I have added or updated integration tests (if appropriate)
  • I have added or updated documentation

Testing Instructions

@github-actions
Copy link
Contributor

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 197.906772ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 102.403229ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 358.642777ms
Throughput 278.83 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 39.064886826s
Average Latency 388.803737ms
Throughput 127.99 requests/second

NANOTDF Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 27.411716534s
Average Latency 273.250633ms
Throughput 182.40 requests/second

@github-actions
Copy link
Contributor

X-Test Failure Results

opentdfplatformRW5FHJ.dockerbuild
✅ js-v0.4.34
✅ java-v0.4.34
✅ go-v0.4.34
cukes-report
bats-test-results
test-cases-mapping-report
✅ js-pull-2835
✅ java-pull-2835
✅ go-pull-2835

@jakedoublev jakedoublev marked this pull request as ready for review October 28, 2025 13:53
@jakedoublev jakedoublev requested a review from a team as a code owner October 28, 2025 13:53
@github-actions
Copy link
Contributor

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 181.000086ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 114.302175ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 367.417021ms
Throughput 272.17 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 39.426244938s
Average Latency 391.954086ms
Throughput 126.82 requests/second

NANOTDF Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 27.863462203s
Average Latency 277.67562ms
Throughput 179.45 requests/second

@github-actions
Copy link
Contributor

X-Test Results

opentdfplatformEJ2L75.dockerbuild
cukes-report
✅ java-v0.4.34
✅ js-v0.4.34
✅ go-v0.4.34
bats-test-results
test-cases-mapping-report
✅ js-pull-2835
✅ java-pull-2835
✅ go-pull-2835

@jakedoublev jakedoublev added this pull request to the merge queue Oct 29, 2025
Merged via the queue into main with commit fad4437 Oct 29, 2025
38 checks passed
@jakedoublev jakedoublev deleted the fix/DSPX-1770 branch October 29, 2025 16:25
@opentdf-automation opentdf-automation bot mentioned this pull request Oct 29, 2025
Open
@jakedoublev
Copy link
Contributor Author

/backport

opentdf-automation bot pushed a commit that referenced this pull request Oct 29, 2025
@jakedoublev @github-actions
fix(authz): handle individual resource edge cases in decisions (#2835)
84f71ed 
### Proposed Changes

Individual resources should be denied for these cases, instead of an
overall error response
* attribute value FQN not found
* registered resource value FQN not found
* registered resource missing action attribute values altogether
* registered resource missing action attribute values that relate to
request action (i.e. `read ->
https://example.com/attr/attr1/value/value1` but request was for
`delete` action)

### Checklist

- [ ] I have added or updated unit tests
- [ ] I have added or updated integration tests (if appropriate)
- [ ] I have added or updated documentation

### Testing Instructions

(cherry picked from commit fad4437)
@opentdf-automation
Copy link
Contributor

Successfully created backport PR for release/service/v0.11:

@opentdf-automation opentdf-automation bot mentioned this pull request Oct 29, 2025
Merged
opentdf-automation bot added a commit that referenced this pull request Oct 29, 2025
@opentdf-automation
fix(authz): handle individual resource edge cases in decisions (#2835)
e730547 
### Proposed Changes

Individual resources should be denied for these cases, instead of an
overall error response
* attribute value FQN not found
* registered resource value FQN not found
* registered resource missing action attribute values altogether
* registered resource missing action attribute values that relate to
request action (i.e. `read ->
https://example.com/attr/attr1/value/value1` but request was for
`delete` action)

### Checklist

- [ ] I have added or updated unit tests
- [ ] I have added or updated integration tests (if appropriate)
- [ ] I have added or updated documentation

### Testing Instructions

(cherry picked from commit fad4437)
jakedoublev pushed a commit that referenced this pull request Oct 29, 2025
@opentdf-automation
fix(authz): handle individual resource edge cases in decisions [backp…
a4ad9dd 
…ort to release/service/v0.11] (#2846)

# Description
Backport of #2835 to `release/service/v0.11`.

Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@alkalescent alkalescent alkalescent approved these changes

Assignees

No one assigned

Labels

backport release/service/v0.11 size/s

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@jakedoublev @alkalescent