feat(policy): Return Simple Kas Keys from non-Key RPCs #2387

c-r33d · 2025-06-04T20:43:18Z

Proposed Changes

1.) Return Simple Kas Key from all RPCs that are not Key routes.

Checklist

I have added or updated unit tests
I have added or updated integration tests (if appropriate)
I have added or updated documentation

Testing Instructions

gemini-code-assist

Hello @c-r33d, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

Summary of Changes

Hello team, gemini-code-assist here with a summary of this pull request. The primary goal of this PR is to standardize the representation of Key Access Server (KAS) keys returned by policy-related gRPC services. Instead of returning the full KasKey object, which includes sensitive or internal details like private key contexts or provider configurations, non-key specific RPCs will now return a simplified SimpleKasKey object. This object contains only the essential public information needed by clients: the KAS URI, KAS ID, and the public key details (algorithm, KID, and PEM). This change improves the API's clarity and reduces unnecessary data exposure.

Highlights

Simplified KAS Key Representation: Introduced SimpleKasKey and SimpleKasPublicKey message definitions in policy.objects.proto to provide a minimal representation of KAS keys for use in policy-related responses.
API Response Updates: Modified various policy service RPCs (e.g., GetAttribute, ListAttributesByFqns, GetAttributeValue, GetNamespace, ListKeyAccessServers, GetKeyAccessServer, GetBaseKey) to return lists of SimpleKasKey objects instead of KasKey objects.
Database Query Adjustments: Updated SQL queries (service/policy/db/query.sql) to fetch the necessary data and format it into the SimpleKasKey structure, including joining with the key_access_servers table to retrieve KAS URI and ID.
Integration Test Adaptations: Updated integration tests across attribute FQNs, attribute values, attributes, KAS registry keys, and KAS registry to handle the new SimpleKasKey return type. This involved fetching the full KasKey separately in some cases to perform comprehensive validation against the simplified data returned by the policy RPCs.
Internal Helper Updates: Refactored internal database helper functions (service/pkg/db/marshalHelpers.go, service/policy/db/grant_mappings.go) to correctly unmarshal and map the new SimpleKasKey structure.

Changelog

Click here to see the changelog

docs/grpc/index.html
- Added documentation links for policy.SimpleKasKey and policy.SimpleKasPublicKey.
- Removed documentation links for policy.kasregistry.SimpleKasKey and policy.kasregistry.SimpleKasPublicKey.
- Updated references from policy.KasKey to policy.SimpleKasKey in the documentation for Attribute, KeyAccessServer, Namespace, and Value.
service/integration/attribute_fqns_test.go
- Imported encoding/base64.
- Modified tests (TestGetAttributeByFqn_WithAttributeDefKeysAssociated, TestGetAttributeByFqn_WithAttributeValueKeysAssociated, TestGetAttributeByFqn_WithKeysAssociatedWithNamespace, TestGetAttributeByFqn_WithKeysAssociatedAttributes_MultipleAttributes, TestGetAttributeByValueFqns_KAS_Keys_Returned) to fetch the full policy.KasKey separately using GetKey before validating the SimpleKasKey returned by the policy RPCs.
- Updated assertions to check fields on the returned SimpleKasKey objects.
- Added validateSimpleKasKey helper function to validate SimpleKasKey structure.
service/integration/attribute_values_test.go
- Modified Test_AssignPublicKeyToAttributeValue_Succeeds to fetch the full policy.KasKey separately using GetKey before validating the SimpleKasKey returned.
- Updated assertions to check fields on the returned SimpleKasKey objects.
- Removed redundant KAS server lookup.
service/integration/attributes_test.go
- Modified Test_AssociatePublicKeyToAttribute_Succeeds to fetch the full policy.KasKey separately using GetKey before validating the SimpleKasKey returned.
- Updated assertions to check fields on the returned SimpleKasKey objects.
- Removed redundant KAS server lookup.
service/integration/kas_registry_key_test.go
- Updated keyCtx constant value.
- Modified Test_RotateKey_Multiple_Attributes_Values_Namespace and Test_RotateKey_Two_Attribute_Two_Namespace_0_AttributeValue_Success assertions to check SimpleKasKey fields on the rotated keys.
- Updated Test_SetBaseKey_Insert_Success assertions to check SimpleKasKey fields on the new base key.
- Updated validatePublicKeyCtx helper to accept *policy.SimpleKasKey.
- Updated validatePrivatePublicCtx helper to construct a SimpleKasKey for validation.
service/integration/kas_registry_test.go
- Modified getKasToKeysFixtureMap to fetch and return []*policy.KasKey.
- Updated validateKasRegistryKeys to use the new validateSimpleKasKey helper for validation.
service/integration/namespaces_test.go
- Modified Test_AssociatePublicKeyToNamespace_Succeeds to fetch the full policy.KasKey separately using GetKey before validating the SimpleKasKey returned.
- Updated assertions to check fields on the returned SimpleKasKey objects.
service/pkg/db/marshalHelpers.go
- Removed unused imports (encoding/base64, strconv).
- Renamed formatAlg to FormatAlg and made it exported.
- Removed old UnmarshalSimpleKasKey function.
- Added SimpleKasKeysProtoJSON function to unmarshal a JSON array of policy.SimpleKasKey.
- Added UnmarshalSimpleKasKey function to unmarshal a single policy.SimpleKasKey.
service/policy/db/attribute_values.go
- Changed the type of the keys variable to []*policy.SimpleKasKey and used db.SimpleKasKeysProtoJSON for unmarshalling.
service/policy/db/attributes.go
- Added a comment about formatting keys in attributesValuesProtojson.
- Changed the type of the keys variable to []*policy.SimpleKasKey and used db.SimpleKasKeysProtoJSON for unmarshalling in GetAttribute and ListAttributesByFqns.
service/policy/db/grant_mappings.go
- Removed unused import (encoding/base64).
- Added errKasInfoIncomplete error.
- Updated mapAlgorithmToKasPublicKeyAlg to remove the ALGORITHM_UNSPECIFIED case.
- Changed the input type of mapKasKeysToGrants to []*policy.SimpleKasKey.
- Updated mapKasKeysToGrants logic to work with SimpleKasKey fields and added checks for required fields.
service/policy/db/grant_mappings_test.go
- Removed unused import (encoding/base64).
- Updated test cases to use policy.SimpleKasKey and policy.SimpleKasPublicKey directly.
- Added test cases for incomplete KAS information in SimpleKasKey.
service/policy/db/key_access_server_registry.go
- Changed the type of the keys variable to []*policy.SimpleKasKey and used db.SimpleKasKeysProtoJSON for unmarshalling in ListKeyAccessServers and GetKeyAccessServer.
- Changed the return type of GetBaseKey to *policy.SimpleKasKey.
- Updated SetBaseKeyOnWellKnownConfig to use db.FormatAlg and explicitly set the algorithm string.
service/policy/db/models.go
- Added a comment to the SelectorValues field.
service/policy/db/query.sql
- Modified queries (list_key_access_servers, get_key_access_server, get_attribute_by_fqn, list_attributes_by_fqns, get_attribute_value, list_attribute_values_by_fqns, get_namespace, list_namespaces, get_base_key) to construct JSON objects matching the SimpleKasKey structure.
- Added INNER JOIN key_access_servers to relevant queries to fetch KAS URI and ID.
- Updated JSON construction to include kas_uri, kas_id, and a public_key object with algorithm (as integer), kid, and decoded pem.
service/policy/kasregistry/key_access_server_registry.proto
- Removed SimpleKasPublicKey and SimpleKasKey message definitions.
service/policy/objects.proto
- Added SimpleKasPublicKey and SimpleKasKey message definitions.
- Updated the kas_keys field type in Namespace, Attribute, Value, and KeyAccessServer messages to repeated SimpleKasKey.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist is currently in preview and may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments to provide feedback.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

A key, once complex and deep,
Now simplified secrets to keep.
Just URI and ID,
And public key, you see,
A lighter load, while you sleep.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request effectively refactors the KAS key representation by introducing SimpleKasKey and SimpleKasPublicKey in the policy package and updating various RPCs and database queries to use this new structure. The changes are quite extensive and appear to be well-executed, especially the SQL modifications that now handle data transformations like PEM decoding.

Key changes include:

Moving SimpleKasKey and SimpleKasPublicKey definitions from policy.kasregistry to policy/objects.proto.
Updating SimpleKasKey to include kas_id and SimpleKasPublicKey to use the policy.Algorithm enum and expect raw PEM strings.
Modifying SQL queries to construct SimpleKasKey directly, including base64 decoding PEM strings and casting algorithm enums.
Updating Go code (database clients, marshalling helpers, integration tests) to align with these new structures and data formats.

Overall, the changes improve consistency and type safety. The integration tests have been adapted well to these changes. I have a few suggestions, primarily around documentation.

Summary of Findings

gRPC Documentation: Field descriptions for SimpleKasPublicKey in the generated gRPC HTML documentation are missing and should be added for clarity.
Code Comment Clarification: A new TODO style comment in service/policy/db/attributes.go regarding key formatting needs clarification, as recent SQL changes might have made it obsolete for SimpleKasKey.
Refactoring Consistency: The refactoring of KAS key representation to SimpleKasKey and the associated SQL/Go changes appear consistent and well-implemented across the codebase.

Merge Readiness

The pull request introduces significant and positive refactoring for KAS key representation. The changes are largely well-implemented. However, there are a few areas that need attention, primarily the missing field descriptions in the gRPC documentation and a clarifying question about a code comment. Addressing these points would improve the overall quality and maintainability. I am unable to approve pull requests, but I recommend addressing these medium-severity items before merging. Other reviewers should make the final decision.

docs/grpc/index.html

service/policy/db/attributes.go

service/policy/db/grant_mappings.go

github-actions · 2025-06-04T20:48:46Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	475.861272ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	301.924941ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	358.596213ms
Throughput	278.87 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	58.379002625s
Average Latency	581.042879ms
Throughput	85.65 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4949
Failed Requests	51
Concurrent Requests	50
Total Time	47.424526115s
Average Latency	468.05875ms
Throughput	104.36 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	51 occurrences

Standard Benchmark Metrics Skipped or Failed

github-actions · 2025-06-04T20:51:57Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	474.986682ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	300.732432ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	347.70239ms
Throughput	287.60 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	54.164610432s
Average Latency	539.405275ms
Throughput	92.31 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4945
Failed Requests	55
Concurrent Requests	50
Total Time	43.817880715s
Average Latency	433.01919ms
Throughput	112.85 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	55 occurrences

Standard Benchmark Metrics Skipped or Failed

github-actions · 2025-06-04T20:57:43Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	465.960672ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	298.199779ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	353.082508ms
Throughput	283.22 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	52.934261381s
Average Latency	524.481178ms
Throughput	94.46 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4948
Failed Requests	52
Concurrent Requests	50
Total Time	43.684508494s
Average Latency	430.107067ms
Throughput	113.27 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	52 occurrences

Standard Benchmark Metrics Skipped or Failed

github-actions · 2025-06-04T21:00:00Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	464.347458ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	292.208574ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	351.60536ms
Throughput	284.41 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	53.604154261s
Average Latency	533.923229ms
Throughput	93.28 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4940
Failed Requests	60
Concurrent Requests	50
Total Time	42.973829488s
Average Latency	425.071372ms
Throughput	114.95 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	60 occurrences

Standard Benchmark Metrics Skipped or Failed

github-actions · 2025-06-05T13:08:59Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	499.296726ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	319.815221ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	403.06743ms
Throughput	248.10 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	57.886055794s
Average Latency	576.180321ms
Throughput	86.38 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4979
Failed Requests	21
Concurrent Requests	50
Total Time	50.405930177s
Average Latency	500.333583ms
Throughput	98.78 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	21 occurrences

Standard Benchmark Metrics Skipped or Failed

github-actions · 2025-06-05T13:15:11Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	465.215938ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	289.279596ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	344.485971ms
Throughput	290.29 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	53.27001112s
Average Latency	530.337711ms
Throughput	93.86 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4941
Failed Requests	59
Concurrent Requests	50
Total Time	42.749356122s
Average Latency	420.761726ms
Throughput	115.58 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	59 occurrences

Standard Benchmark Metrics Skipped or Failed

github-actions · 2025-06-05T13:16:53Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	489.568028ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	319.221183ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	373.291228ms
Throughput	267.89 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	58.00070628s
Average Latency	577.060469ms
Throughput	86.21 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4947
Failed Requests	53
Concurrent Requests	50
Total Time	47.947039568s
Average Latency	474.357553ms
Throughput	103.18 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	53 occurrences

Standard Benchmark Metrics Skipped or Failed

github-actions · 2025-06-05T13:25:19Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	470.365297ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	298.209476ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	369.974647ms
Throughput	270.29 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	56.995076102s
Average Latency	567.006676ms
Throughput	87.73 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4941
Failed Requests	59
Concurrent Requests	50
Total Time	45.739488065s
Average Latency	452.220257ms
Throughput	108.02 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	59 occurrences

Standard Benchmark Metrics Skipped or Failed

github-actions · 2025-06-05T14:00:50Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	486.060396ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	300.121052ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	354.213187ms
Throughput	282.32 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	53.245951112s
Average Latency	529.561151ms
Throughput	93.90 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4931
Failed Requests	69
Concurrent Requests	50
Total Time	43.935545648s
Average Latency	435.205013ms
Throughput	112.23 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	69 occurrences

Standard Benchmark Metrics Skipped or Failed

github-actions · 2025-06-05T15:17:10Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	457.868329ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	303.847698ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	347.988496ms
Throughput	287.37 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	52.545896778s
Average Latency	521.15481ms
Throughput	95.15 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4963
Failed Requests	37
Concurrent Requests	50
Total Time	42.764693028s
Average Latency	423.997349ms
Throughput	116.05 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	37 occurrences

Standard Benchmark Metrics Skipped or Failed

🤖 I have created a release *beep* *boop* --- ## [0.4.0](protocol/go/v0.3.6...protocol/go/v0.4.0) (2025-06-05) ### Features * **authz:** improve v2 request proto validation ([#2357](#2357)) ([f927b99](f927b99)) * **policy:** cache SubjectConditionSet selectors in dedicated column maintained via trigger ([#2320](#2320)) ([215791f](215791f)) * **policy:** Return Simple Kas Keys from non-Key RPCs ([#2387](#2387)) ([5113e0e](5113e0e)) * **policy:** Update simple kas key ([#2378](#2378)) ([09d8239](09d8239)) ### Bug Fixes * **policy:** protovalidate deprecated action types and removal of gRPC gateway in subject mappings svc ([#2377](#2377)) ([54a6de0](54a6de0)) * **policy:** remove gRPC gateway in policy except where needed ([#2382](#2382)) ([1937acb](1937acb)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>

🤖 I have created a release *beep* *boop* --- ## [0.6.0](service/v0.5.5...service/v0.6.0) (2025-06-06) ### Features * **authz:** DSPX-894 auth svc registered resource GetEntitlement support ([#2358](#2358)) ([a199aa7](a199aa7)) * **authz:** improve v2 request proto validation ([#2357](#2357)) ([f927b99](f927b99)) * **core:** DSPX-608 - Deprecate public_client_id ([#2185](#2185)) ([0f58efa](0f58efa)) * **policy:** Return Simple Kas Keys from non-Key RPCs ([#2387](#2387)) ([5113e0e](5113e0e)) * **policy:** Unique name for the key provider. ([#2391](#2391)) ([bb58b78](bb58b78)) * **policy:** Update simple kas key ([#2378](#2378)) ([09d8239](09d8239)) ### Bug Fixes * **deps:** bump github.com/opentdf/platform/protocol/go from 0.3.6 to 0.4.0 in /service ([#2399](#2399)) ([1c6fa75](1c6fa75)) * **deps:** bump the external group across 1 directory with 21 updates ([#2401](#2401)) ([3d0d4d1](3d0d4d1)) * **policy:** move action sub queries to CTE in sm list and match sql ([#2369](#2369)) ([0fd6feb](0fd6feb)) * **policy:** protovalidate deprecated action types and removal of gRPC gateway in subject mappings svc ([#2377](#2377)) ([54a6de0](54a6de0)) * **policy:** remove gRPC gateway in policy except where needed ([#2382](#2382)) ([1937acb](1937acb)) * **policy:** remove support for creation/updation of SubjectMappings with deprecated proto actions ([#2373](#2373)) ([3660200](3660200)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>

🤖 I have created a release *beep* *boop* --- ## [0.7.0](protocol/go/v0.6.2...protocol/go/v0.7.0) (2025-08-08) ### ⚠ BREAKING CHANGES * **policy:** disable kas grants in favor of key mappings ([#2220](#2220)) * **core:** Require go 1.23+ ([#1979](#1979)) ### Features * add ability to retrieve policy resources by id or name ([#1901](#1901)) ([deb4455](deb4455)) * **authz:** authz v2, ers v2 protos and gencode for ABAC with actions & registered resource ([#2124](#2124)) ([ea7992a](ea7992a)) * **authz:** improve v2 request proto validation ([#2357](#2357)) ([f927b99](f927b99)) * **authz:** sensible request limit upper bounds ([#2526](#2526)) ([b3093cc](b3093cc)) * **core:** adds bulk rewrap to sdk and service ([#1835](#1835)) ([11698ae](11698ae)) * **core:** EXPERIMENTAL: EC-wrapped key support ([#1902](#1902)) ([652266f](652266f)) * **core:** Require go 1.23+ ([#1979](#1979)) ([164c922](164c922)) * **core:** v2 ERS with proto updates ([#2210](#2210)) ([a161ef8](a161ef8)) * **policy:** add enhanced standard/custom actions protos ([#2020](#2020)) ([bbac53f](bbac53f)) * **policy:** Add legacy keys. ([#2613](#2613)) ([57370b0](57370b0)) * **policy:** Add list key mappings rpc. ([#2533](#2533)) ([fbc2724](fbc2724)) * **policy:** add obligation protos ([#2579](#2579)) ([50882e1](50882e1)) * **policy:** Add validation to delete keys ([#2576](#2576)) ([cc169d9](cc169d9)) * **policy:** add values to CreateObligationRequest ([#2614](#2614)) ([94535cc](94535cc)) * **policy:** adds new public keys table ([#1836](#1836)) ([cad5048](cad5048)) * **policy:** Allow the deletion of a key. ([#2575](#2575)) ([82b96f0](82b96f0)) * **policy:** cache SubjectConditionSet selectors in dedicated column maintained via trigger ([#2320](#2320)) ([215791f](215791f)) * **policy:** Change return type for delete key proto. ([#2566](#2566)) ([c1ae924](c1ae924)) * **policy:** Default Platform Keys ([#2254](#2254)) ([d7447fe](d7447fe)) * **policy:** disable kas grants in favor of key mappings ([#2220](#2220)) ([30f8cf5](30f8cf5)) * **policy:** DSPX-1018 NDR retrieval by FQN support ([#2131](#2131)) ([0001041](0001041)) * **policy:** DSPX-1057 registered resource action attribute values (protos only) ([#2217](#2217)) ([6375596](6375596)) * **policy:** DSPX-893 NDR define crud protos ([#2056](#2056)) ([55a5c27](55a5c27)) * **policy:** DSPX-902 NDR service crud protos only (1/2) ([#2092](#2092)) ([24b6cb5](24b6cb5)) * **policy:** Finish resource mapping groups ([#2224](#2224)) ([5ff754e](5ff754e)) * **policy:** key management crud ([#2110](#2110)) ([4c3d53d](4c3d53d)) * **policy:** Key management proto ([#2115](#2115)) ([561f853](561f853)) * **policy:** Modify get request to search for keys by kasid with keyid. ([#2147](#2147)) ([780d2e4](780d2e4)) * **policy:** Return KAS Key structure ([#2172](#2172)) ([7f97b99](7f97b99)) * **policy:** Return Simple Kas Keys from non-Key RPCs ([#2387](#2387)) ([5113e0e](5113e0e)) * **policy:** rotate keys rpc ([#2180](#2180)) ([0d00743](0d00743)) * **policy:** Update key status's and UpdateKey rpc. ([#2315](#2315)) ([7908db9](7908db9)) * **policy:** Update simple kas key ([#2378](#2378)) ([09d8239](09d8239)) ### Bug Fixes * add pagination to list public key mappings response ([#1889](#1889)) ([9898fbd](9898fbd)) * **core:** Allow 521 curve to be used ([#2485](#2485)) ([aaf43dc](aaf43dc)) * **core:** Fixes protoJSON parse bug on ec rewrap ([#1943](#1943)) ([9bebfd0](9bebfd0)) * **core:** Update fixtures and flattening in sdk and service ([#1827](#1827)) ([d6d6a7a](d6d6a7a)) * **deps:** bump toolchain in /lib/fixtures and /examples to resolve CVE GO-2025-3563 ([#2061](#2061)) ([9c16843](9c16843)) * **policy:** protovalidate deprecated action types and removal of gRPC gateway in subject mappings svc ([#2377](#2377)) ([54a6de0](54a6de0)) * **policy:** remove gRPC gateway in policy except where needed ([#2382](#2382)) ([1937acb](1937acb)) * **policy:** remove new public keys rpc's ([#1962](#1962)) ([5049bab](5049bab)) * **policy:** remove predefined rules in actions protos ([#2069](#2069)) ([060f059](060f059)) * **policy:** return kas uri on keys for definition, namespace and values ([#2186](#2186)) ([6c55fb8](6c55fb8)) * **sdk:** Fix compatibility between bulk and non-bulk rewrap ([#1914](#1914)) ([74abbb6](74abbb6)) * update key_mode to provide more context ([#2226](#2226)) ([44d0805](44d0805)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com> Co-authored-by: Krish Suchak <[email protected]>

c-r33d added 4 commits June 4, 2025 12:03

feat(policy): Simple kas key algorithm should be enum.

f859fd2

refactor.

5cd07e7

refactor.

aacf38b

feat(policy): Return simple kas keys from attributes.

ebbd00a

c-r33d requested review from a team as code owners June 4, 2025 20:43

github-actions bot added comp:db DB component comp:policy Policy Configuration ( attributes, subject mappings, resource mappings, kas registry) docs Documentation external-contributor External Org Member size/l labels Jun 4, 2025

gemini-code-assist bot reviewed Jun 4, 2025

View reviewed changes

merge conflicts.

31e3a9c

gemini-code-assist bot suggested changes Jun 4, 2025

View reviewed changes

docs/grpc/index.html Show resolved Hide resolved

service/policy/db/attributes.go Outdated Show resolved Hide resolved

service/policy/db/grant_mappings.go Show resolved Hide resolved

gen open api.

8ac4998

c-r33d added 2 commits June 4, 2025 15:54

unremove changelog.

5ad7d7b

refactor.

bf08ebb

merge conflicts.

60438df

c-r33d added 2 commits June 5, 2025 08:11

linting.

eb16781

add changelog.

e359f7b

fix tests.

3486761

strantalis approved these changes Jun 5, 2025

View reviewed changes

strantalis merged commit 5113e0e into main Jun 5, 2025
81 of 96 checks passed

strantalis deleted the feat/DSPX-1198-simple-keys branch June 5, 2025 15:50

This was referenced Jun 5, 2025

chore(main): release protocol/go 0.4.0 #2341

Merged

chore(main): release service 0.6.0 #2367

Merged

opentdf-automation bot mentioned this pull request Jun 5, 2025

chore(release/protocol/go/v0.4): release service 0.5.6 #2394

Closed

opentdf-automation bot mentioned this pull request Jul 25, 2025

chore(main): release protocol/go 0.7.0 #2567

Merged

feat(policy): Return Simple Kas Keys from non-Key RPCs #2387

feat(policy): Return Simple Kas Keys from non-Key RPCs #2387

Uh oh!

Conversation

c-r33d commented Jun 4, 2025

Proposed Changes

Checklist

Testing Instructions

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Summary of Changes

Highlights

Changelog

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Summary of Findings

Merge Readiness

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Jun 4, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Error Summary:

Standard Benchmark Metrics Skipped or Failed

Uh oh!

github-actions bot commented Jun 4, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Error Summary:

Standard Benchmark Metrics Skipped or Failed

Uh oh!

github-actions bot commented Jun 4, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Error Summary:

Standard Benchmark Metrics Skipped or Failed

Uh oh!

github-actions bot commented Jun 4, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Error Summary:

Standard Benchmark Metrics Skipped or Failed

Uh oh!

github-actions bot commented Jun 5, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Error Summary:

Standard Benchmark Metrics Skipped or Failed

Uh oh!

github-actions bot commented Jun 5, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Error Summary:

Standard Benchmark Metrics Skipped or Failed

Uh oh!

github-actions bot commented Jun 5, 2025