feat(policy): add FQNs to obligation defs + vals #2749

alkalescent · 2025-09-19T03:38:27Z

Proposed Changes

Checklist

I have added or updated unit tests
I have added or updated integration tests (if appropriate)
I have added or updated documentation

Testing Instructions

gemini-code-assist · 2025-09-19T03:38:53Z

Summary of Changes

Hello @alkalescent, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the policy system by introducing and fully integrating Fully Qualified Names (FQNs) for obligation definitions and their values. The changes establish a clear, standardized FQN format, backed by comprehensive utilities for their creation, validation, and parsing. This robust FQN management is seamlessly integrated into the database layer, ensuring that all obligation and obligation value objects consistently carry their FQNs, which is validated through updated integration tests. This improves the clarity, traceability, and overall reliability of policy obligation identification.

Highlights

New FQN Structure for Obligations: Introduced a FullyQualifiedObligation struct to represent obligation Fully Qualified Names (FQNs), encompassing namespace, name, and value components, providing a standardized way to identify policy obligations.
Comprehensive FQN Utilities: Added a suite of utility functions to generate, parse, validate, and break down obligation FQNs and obligation value FQNs, ensuring robust handling of these identifiers.
Refactoring of FQN Helper Functions: Existing FQN-related helper functions (BreakOblFQN, BreakOblValFQN, BuildOblFQN, BuildOblValFQN) and their corresponding tests were refactored and moved into new, dedicated files (lib/identifier/obligation.go and lib/identifier/obligation_test.go) for better organization and maintainability.
Integration with Generic Policy Identifier Parsing: The generic Parse function in policyidentifier.go was updated to recognize and correctly parse FullyQualifiedObligation types, allowing for unified FQN resolution across different policy entities.
Database Layer FQN Population: The database client for policy obligations (service/policy/db/obligations.go) was enhanced to automatically populate the Fqn field for both policy.Obligation and policy.ObligationValue objects during all CRUD operations (creation, retrieval, and updates).
Integration Test Coverage for FQNs: Integration tests for obligations (service/integration/obligations_test.go) were updated to include assertions for the newly populated Fqn fields, verifying the correctness and consistency of FQN generation and storage.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

A name, so long and clear, For policy, banishing fear. Namespace, name, and value, Each part, a truth, so true. No more confusion, all is bright.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request introduces Fully Qualified Names (FQNs) for obligation definitions and values, which is a great enhancement for identifying these resources uniquely. The changes include a new robust FQN parser using regular expressions and updates to the database layer to populate the FQN fields. The code is well-structured, and the addition of comprehensive tests is appreciated. I have a few suggestions to improve maintainability and robustness by refactoring some legacy functions to use the new parser and by reducing code duplication. Overall, this is a solid contribution.

lib/identifier/obligation.go

lib/identifier/obligation_test.go

service/policy/db/obligations.go

github-actions · 2025-09-19T03:43:25Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	178.157065ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	98.936884ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	352.28794ms
Throughput	283.86 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	37.285508271s
Average Latency	370.287118ms
Throughput	134.10 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	26.136556766s
Average Latency	260.389956ms
Throughput	191.30 requests/second

github-actions · 2025-09-19T06:02:55Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	190.705519ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	101.495196ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	355.610865ms
Throughput	281.21 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	36.739010082s
Average Latency	366.108551ms
Throughput	136.10 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	25.871014263s
Average Latency	257.437045ms
Throughput	193.27 requests/second

jakedoublev · 2025-09-19T14:47:35Z

This looks good! I think we will need to split up the changes to lib/identifier to merge them first, release the lib, and stack the service changes in a follow-on PR that bumps lib/identifier within. Our CI is a little unstable with modules like this currently as I believe it passes now and works locally (due to the go.work), but the service module will actually be unreleaseable with the lib/identifier changes until they're released inside a bump because those changes aren't in the release pinned in the service go.mod. We saw this earlier in the week from both lib/identifier and protocol/go.

github-actions · 2025-09-24T17:18:03Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	180.352341ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	96.822746ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	348.513146ms
Throughput	286.93 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	36.571823052s
Average Latency	363.690419ms
Throughput	136.72 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	25.554110311s
Average Latency	254.490343ms
Throughput	195.66 requests/second

alkalescent · 2025-09-24T17:25:04Z

split up the pr
here's the second part: #2761

jakedoublev · 2025-09-29T16:17:33Z

With lib/identifier released, are we ready to put back the last couple of commits and merge this in? @alkalescent

alkalescent · 2025-09-29T17:46:22Z

@jakedoublev updated lib/identifier in service

github-actions · 2025-09-29T17:51:19Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	192.595105ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	108.826336ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	353.904878ms
Throughput	282.56 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.187169071s
Average Latency	390.074922ms
Throughput	127.59 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	26.602761571s
Average Latency	265.074076ms
Throughput	187.95 requests/second

🤖 I have created a release *beep* *boop* --- ## [0.11.0](service/v0.10.0...service/v0.11.0) (2025-10-22) ### Features * **authz:** add obligation fulfillment logic to obligation PDP ([#2740](#2740)) ([2f8d30d](2f8d30d)) * **authz:** audit logs should properly handle obligations ([#2824](#2824)) ([874ec7b](874ec7b)) * **authz:** defer to request auth as decision/entitlements entity ([#2789](#2789)) ([feb34d8](feb34d8)) * **authz:** obligations protos within auth service ([#2745](#2745)) ([41ee5a8](41ee5a8)) * **authz:** protovalidate tests for new authz obligations fields ([#2747](#2747)) ([73e6319](73e6319)) * **authz:** service logic to use request auth as entity identifier in PDP decisions/entitlements ([#2790](#2790)) ([6784e88](6784e88)) * **authz:** wire up obligations enforcement in auth service ([#2756](#2756)) ([11b3ea9](11b3ea9)) * **core:** propagate token clientID on configured claim via interceptor into shared context metadata ([#2760](#2760)) ([0f77246](0f77246)) * **kas:** Add required obligations to kao metadata.: ([#2806](#2806)) ([16fb26c](16fb26c)) * **policy:** add FQNs to obligation defs + vals ([#2749](#2749)) ([fa2585c](fa2585c)) * **policy:** Add obligation support to KAS ([#2786](#2786)) ([bb1bca0](bb1bca0)) * **policy:** List obligation triggers rpc ([#2823](#2823)) ([206abe3](206abe3)) * **policy:** namespace root certificates ([#2771](#2771)) ([beaff21](beaff21)) * **policy:** Proto - root certificates by namespace ([#2800](#2800)) ([0edb359](0edb359)) * **policy:** Protos List obligation triggers ([#2803](#2803)) ([b32df81](b32df81)) * **policy:** Return built obligations fqns with triggers. ([#2830](#2830)) ([e843018](e843018)) * **policy:** Return obligations from GetAttributeValue calls ([#2742](#2742)) ([aa9b393](aa9b393)) ### Bug Fixes * **core:** CORS ([#2787](#2787)) ([a030ac6](a030ac6)) * **core:** deprecate policy WithValue selector not utilized by RPC ([#2794](#2794)) ([c573595](c573595)) * **core:** deprecated stale protos and add better upgrade comments ([#2793](#2793)) ([f2678cc](f2678cc)) * **core:** Don't require known manager names ([#2792](#2792)) ([8a56a96](8a56a96)) * **core:** Fix mode negation and core mode ([#2779](#2779)) ([de9807d](de9807d)) * **core:** resolve environment loading issues ([#2827](#2827)) ([9af3184](9af3184)) * **deps:** bump github.com/opentdf/platform/lib/ocrypto from 0.6.0 to 0.7.0 in /service ([#2812](#2812)) ([a6d180d](a6d180d)) * **deps:** bump github.com/opentdf/platform/protocol/go from 0.12.0 to 0.13.0 in /service ([#2814](#2814)) ([5e9c695](5e9c695)) * **deps:** bump github.com/opentdf/platform/sdk from 0.7.0 to 0.9.0 in /service ([#2798](#2798)) ([d6bc9a8](d6bc9a8)) * **deps:** bump github.com/opentdf/platform/sdk from 0.9.0 to 0.10.0 in /service ([#2831](#2831)) ([412dfd1](412dfd1)) * ECC key loading (deprecated) ([#2757](#2757)) ([49990eb](49990eb)) * **policy:** Change to nil ([#2746](#2746)) ([a449434](a449434)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>

alkalescent added 8 commits September 16, 2025 22:24

obligation fqn impl

cf7a4f7

tests

b540d19

Merge branch 'main' of github.com:opentdf/platform into DSPX-1661-fqn

e34f9e1

add fqns to create and get obl defs

fc6ac38

add fqns to get obls by fqn

06ba0b2

more

98ada79

done w fxs

6d5a4bb

assert fqns in integration tests

eb5f9d1

alkalescent requested review from a team as code owners September 19, 2025 03:38

github-actions bot added comp:db DB component comp:policy Policy Configuration ( attributes, subject mappings, resource mappings, kas registry) size/m labels Sep 19, 2025

gemini-code-assist bot reviewed Sep 19, 2025

View reviewed changes

helper fx

6cf3a23

alkalescent added 4 commits September 22, 2025 20:36

Merge branch 'main' of github.com:opentdf/platform into DSPX-1661-fqn

597625c

Merge branch 'main' of github.com:opentdf/platform into DSPX-1661-fqn

8cbad0f

remove lib identifier changes

9a10e5d

revert more

a984ab2

alkalescent added 3 commits September 29, 2025 13:42

Merge branch 'main' of github.com:opentdf/platform into DSPX-1661-fqn

4797c36

update lib/identifier

997afc4

go mod tidy

c299cd3

alkalescent requested a review from a team as a code owner September 29, 2025 17:45

jakedoublev approved these changes Sep 29, 2025

View reviewed changes

jakedoublev enabled auto-merge September 29, 2025 18:03

c-r33d approved these changes Sep 29, 2025

View reviewed changes

jakedoublev added this pull request to the merge queue Sep 29, 2025

Merged via the queue into main with commit fa2585c Sep 29, 2025
32 checks passed

jakedoublev deleted the DSPX-1661-fqn branch September 29, 2025 18:48

opentdf-automation bot mentioned this pull request Sep 29, 2025

chore(main): release service 0.11.0 #2744

Merged

feat(policy): add FQNs to obligation defs + vals #2749

feat(policy): add FQNs to obligation defs + vals #2749

Uh oh!

Conversation

alkalescent commented Sep 19, 2025

Proposed Changes

Checklist

Testing Instructions

Uh oh!

gemini-code-assist bot commented Sep 19, 2025

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Sep 19, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Uh oh!

github-actions bot commented Sep 19, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Uh oh!

jakedoublev commented Sep 19, 2025

Uh oh!

github-actions bot commented Sep 24, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Uh oh!

alkalescent commented Sep 24, 2025

Uh oh!

jakedoublev commented Sep 29, 2025

Uh oh!

alkalescent commented Sep 29, 2025

Uh oh!

github-actions bot commented Sep 29, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants