feat(authz): audit logs should properly handle obligations #2824

jakedoublev · 2025-10-17T21:16:17Z

Proposed Changes

audit logs report on:
- overall fulfillable obligations
- required obligations at the resource decision level
- whether or not obligations were satisfied
adds unit test that entitlements related to the decision come back from pdp call to populate audit log
update audit logs to clarify decision audit logs only contain entitlements relevant to decisioning (not all entitlements)

Single resource success log:

{
  "time": "2025-10-21T19:42:59.465451-07:00",
  "level": "AUDIT",
  "msg": "decision",
  "namespace": "authorization",
  "version": "v2",
  "audit": {
    "object": {
      "type": "entity_object",
      "id": "jwtentity-1-clientid-opentdf-read",
      "name": "decisionRequest-read",
      "attributes": { "assertions": null, "attrs": null, "permissions": null }
    },
    "action": { "type": "read", "result": "success" },
    "actor": {
      "id": "jwtentity-1-clientid-opentdf",
      "attributes": [
        {
          "entitlements_relevant_to_decision": {
            "https://example.com/attr/class/value/topsecret": [
              {
                "id": "a1bb9ff7-74a1-4c30-a5c2-7067a1d84aef",
                "Value": null,
                "name": "read"
              }
            ]
          }
        }
      ]
    },
    "eventMetaData": {
      "resource_decisions": [
        {
          "passed": true,
          "obligations_satisfied": true,
          "entitled": true,
          "resource_id": "resource-0",
          "resource_name": "https://reg_res/testing/value/secret",
          "data_rule_results": [
            {
              "passed": true,
              "resource_value_fqns": [
                "https://example.com/attr/class/value/secret"
              ],
              "attribute": {
                "id": "70e2949e-8a15-4b4d-ab2a-a1a9bfa415a9",
                "rule": 3,
                "fqn": "https://example.com/attr/class"
              },
              "entitlement_failures": null
            }
          ],
          "required_obligation_value_fqns": [
            "https://example.com/obl/drm/value/mask"
          ]
        }
      ],
      "fulfillable_obligation_value_fqns": [
        "https://example.com/obl/drm/value/mask"
      ],
      "obligations_satisfied": true
    },
    "clientInfo": {
      "userAgent": "grpc-go/1.61.0",
      "platform": "authorization.v2",
      "requestIP": "None"
    },
    "original": null,
    "updated": null,
    "requestID": "17a49c85-8a0c-4996-8804-d91d0b77e501",
    "timestamp": "2025-10-21T19:42:59-07:00"
  }
}

single resource failure log:

{
  "time": "2025-10-21T19:42:18.829716-07:00",
  "level": "AUDIT",
  "msg": "decision",
  "namespace": "authorization",
  "version": "v2",
  "audit": {
    "object": {
      "type": "entity_object",
      "id": "jwtentity-1-clientid-opentdf-read",
      "name": "decisionRequest-read",
      "attributes": { "assertions": null, "attrs": null, "permissions": null }
    },
    "action": { "type": "read", "result": "failure" },
    "actor": {
      "id": "jwtentity-1-clientid-opentdf",
      "attributes": [
        {
          "entitlements_relevant_to_decision": {
            "https://example.com/attr/class/value/topsecret": [
              {
                "id": "a1bb9ff7-74a1-4c30-a5c2-7067a1d84aef",
                "Value": null,
                "name": "read"
              }
            ]
          }
        }
      ]
    },
    "eventMetaData": {
      "resource_decisions": [
        {
          "passed": false,
          "obligations_satisfied": false,
          "entitled": true,
          "resource_id": "resource-0",
          "resource_name": "https://reg_res/testing/value/secret",
          "data_rule_results": [
            {
              "passed": true,
              "resource_value_fqns": [
                "https://example.com/attr/class/value/secret"
              ],
              "attribute": {
                "id": "70e2949e-8a15-4b4d-ab2a-a1a9bfa415a9",
                "rule": 3,
                "fqn": "https://example.com/attr/class"
              },
              "entitlement_failures": null
            }
          ],
          "required_obligation_value_fqns": [
            "https://example.com/obl/drm/value/mask"
          ]
        }
      ],
      "fulfillable_obligation_value_fqns": [],
      "obligations_satisfied": false
    },
    "clientInfo": {
      "userAgent": "grpc-go/1.61.0",
      "platform": "authorization.v2",
      "requestIP": "None"
    },
    "original": null,
    "updated": null,
    "requestID": "eb3681fc-96e5-4328-be1b-3b4da9deab19",
    "timestamp": "2025-10-21T19:42:18-07:00"
  }
}

multi-resource success log:

{
  "time": "2025-10-21T19:40:00.00347-07:00",
  "level": "AUDIT",
  "msg": "decision",
  "namespace": "authorization",
  "version": "v2",
  "audit": {
    "object": {
      "type": "entity_object",
      "id": "jwtentity-1-clientid-opentdf-read",
      "name": "decisionRequest-read",
      "attributes": { "assertions": null, "attrs": null, "permissions": null }
    },
    "action": { "type": "read", "result": "success" },
    "actor": {
      "id": "jwtentity-1-clientid-opentdf",
      "attributes": [
        {
          "entitlements_relevant_to_decision": {
            "https://example.com/attr/class/value/topsecret": [
              {
                "id": "a1bb9ff7-74a1-4c30-a5c2-7067a1d84aef",
                "Value": null,
                "name": "read"
              }
            ]
          }
        }
      ]
    },
    "eventMetaData": {
      "resource_decisions": [
        {
          "passed": true,
          "obligations_satisfied": true,
          "entitled": true,
          "resource_id": "resource-0",
          "resource_name": "https://reg_res/testing/value/secret",
          "data_rule_results": [
            {
              "passed": true,
              "resource_value_fqns": [
                "https://example.com/attr/class/value/secret"
              ],
              "attribute": {
                "id": "70e2949e-8a15-4b4d-ab2a-a1a9bfa415a9",
                "rule": 3,
                "fqn": "https://example.com/attr/class"
              },
              "entitlement_failures": null
            }
          ],
          "required_obligation_value_fqns": [
            "https://example.com/obl/drm/value/mask"
          ]
        },
        {
          "passed": true,
          "obligations_satisfied": true,
          "entitled": true,
          "resource_id": "resource-1",
          "data_rule_results": [
            {
              "passed": true,
              "resource_value_fqns": [
                "https://example.com/attr/class/value/secret"
              ],
              "attribute": {
                "id": "70e2949e-8a15-4b4d-ab2a-a1a9bfa415a9",
                "rule": 3,
                "fqn": "https://example.com/attr/class"
              },
              "entitlement_failures": null
            }
          ],
          "required_obligation_value_fqns": [
            "https://example.com/obl/drm/value/mask"
          ]
        }
      ],
      "fulfillable_obligation_value_fqns": [
        "https://example.com/obl/drm/value/mask"
      ],
      "obligations_satisfied": true
    },
    "clientInfo": {
      "userAgent": "grpc-go/1.61.0",
      "platform": "authorization.v2",
      "requestIP": "None"
    },
    "original": null,
    "updated": null,
    "requestID": "f87d7480-20b5-4e2e-b08a-0e4608e43c9e",
    "timestamp": "2025-10-21T19:40:00-07:00"
  }
}

Multi resource failure log:

{
  "time": "2025-10-21T19:40:06.710929-07:00",
  "level": "AUDIT",
  "msg": "decision",
  "namespace": "authorization",
  "version": "v2",
  "audit": {
    "object": {
      "type": "entity_object",
      "id": "jwtentity-1-clientid-opentdf-read",
      "name": "decisionRequest-read",
      "attributes": { "assertions": null, "attrs": null, "permissions": null }
    },
    "action": { "type": "read", "result": "failure" },
    "actor": {
      "id": "jwtentity-1-clientid-opentdf",
      "attributes": [
        {
          "entitlements_relevant_to_decision": {
            "https://example.com/attr/class/value/topsecret": [
              {
                "id": "a1bb9ff7-74a1-4c30-a5c2-7067a1d84aef",
                "Value": null,
                "name": "read"
              }
            ]
          }
        }
      ]
    },
    "eventMetaData": {
      "resource_decisions": [
        {
          "passed": false,
          "obligations_satisfied": false,
          "entitled": true,
          "resource_id": "resource-0",
          "resource_name": "https://reg_res/testing/value/secret",
          "data_rule_results": [
            {
              "passed": true,
              "resource_value_fqns": [
                "https://example.com/attr/class/value/secret"
              ],
              "attribute": {
                "id": "70e2949e-8a15-4b4d-ab2a-a1a9bfa415a9",
                "rule": 3,
                "fqn": "https://example.com/attr/class"
              },
              "entitlement_failures": null
            }
          ],
          "required_obligation_value_fqns": [
            "https://example.com/obl/drm/value/mask"
          ]
        },
        {
          "passed": false,
          "obligations_satisfied": false,
          "entitled": true,
          "resource_id": "resource-1",
          "data_rule_results": [
            {
              "passed": true,
              "resource_value_fqns": [
                "https://example.com/attr/class/value/secret"
              ],
              "attribute": {
                "id": "70e2949e-8a15-4b4d-ab2a-a1a9bfa415a9",
                "rule": 3,
                "fqn": "https://example.com/attr/class"
              },
              "entitlement_failures": null
            }
          ],
          "required_obligation_value_fqns": [
            "https://example.com/obl/drm/value/mask"
          ]
        }
      ],
      "fulfillable_obligation_value_fqns": [],
      "obligations_satisfied": false
    },
    "clientInfo": {
      "userAgent": "grpc-go/1.61.0",
      "platform": "authorization.v2",
      "requestIP": "None"
    },
    "original": null,
    "updated": null,
    "requestID": "6561c969-f169-4e16-84a6-f378f481b28d",
    "timestamp": "2025-10-21T19:40:06-07:00"
  }
}

github-actions · 2025-10-17T21:21:01Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	168.891762ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	98.613295ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	356.507125ms
Throughput	280.50 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.59166436s
Average Latency	383.807703ms
Throughput	129.56 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	27.149542166s
Average Latency	270.426589ms
Throughput	184.17 requests/second

github-actions · 2025-10-21T20:48:36Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	183.380368ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	108.590643ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	375.342195ms
Throughput	266.42 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.904649489s
Average Latency	387.561496ms
Throughput	128.52 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	27.63173875s
Average Latency	274.722154ms
Throughput	180.95 requests/second

github-actions · 2025-10-21T20:49:10Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	178.613733ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	109.890418ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	360.616302ms
Throughput	277.30 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.10607437s
Average Latency	389.281788ms
Throughput	127.86 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	27.411123846s
Average Latency	272.811579ms
Throughput	182.41 requests/second

github-actions · 2025-10-21T20:58:56Z

X-Test Failure Results

opentdf~~platform~~RMCVT5.dockerbuild
cukes-report
✅ js-v0.4.34
✅ java-v0.4.34
✅ go-v0.4.34
bats-test-results
test-cases-mapping-report
✅ js-98753949ba5b95711d4725bd2d4429db812588eb
✅ java-98753949ba5b95711d4725bd2d4429db812588eb
✅ go-98753949ba5b95711d4725bd2d4429db812588eb

github-actions · 2025-10-21T21:00:12Z

X-Test Failure Results

opentdf~~platform~~NYYMTP.dockerbuild
cukes-report
✅ java-v0.4.34
✅ js-v0.4.34
✅ go-v0.4.34
bats-test-results
test-cases-mapping-report
✅ js-pull-2824
✅ java-pull-2824
✅ go-pull-2824

jakedoublev · 2025-10-21T21:20:12Z

/gemini review

gemini-code-assist

Code Review

This pull request enhances audit logging to include information about obligations. The changes are generally good, introducing a dedicated struct for obligation decisions and refactoring the policy decision points to propagate entitlement information for auditing. I've identified a bug where the Access field in multi-entity decisions is not correctly updated based on obligation fulfillment, leading to inconsistent return values. I've also suggested several refactorings to reduce code duplication and simplify logic, improving maintainability. Additionally, there's an unused parameter in the audit event parameters that should be removed.

service/internal/access/v2/just_in_time_pdp.go

service/logger/audit/getDecision.go

github-actions · 2025-10-21T21:23:45Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	172.375752ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	105.954966ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	360.416871ms
Throughput	277.46 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.730064313s
Average Latency	385.378153ms
Throughput	129.10 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	27.206214433s
Average Latency	271.049509ms
Throughput	183.78 requests/second

github-actions · 2025-10-21T21:35:16Z

X-Test Failure Results

opentdf~~platform~~I00NGO.dockerbuild
✅ js-v0.4.34
cukes-report
✅ java-v0.4.34
✅ go-v0.4.34
bats-test-results
test-cases-mapping-report
✅ js-pull-2824
✅ java-pull-2824
✅ go-pull-2824

…not provided

github-actions · 2025-10-21T23:40:07Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	175.945932ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	99.133514ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	360.073414ms
Throughput	277.72 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.369435998s
Average Latency	382.473956ms
Throughput	130.31 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	26.724473302s
Average Latency	266.4572ms
Throughput	187.09 requests/second

github-actions · 2025-10-21T23:43:43Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	178.843208ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	101.721768ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	359.510512ms
Throughput	278.16 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.745967792s
Average Latency	385.981055ms
Throughput	129.05 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	27.021345344s
Average Latency	269.397256ms
Throughput	185.04 requests/second

github-actions · 2025-10-21T23:51:38Z

X-Test Failure Results

opentdf~~platform~~NRB6LZ.dockerbuild
cukes-report
✅ java-v0.4.34
✅ js-v0.4.34
✅ go-v0.4.34
bats-test-results
test-cases-mapping-report
✅ js-pull-2824
✅ java-pull-2824
✅ go-pull-2824

github-actions · 2025-10-21T23:54:05Z

X-Test Failure Results

opentdf~~platform~~W02JGL.dockerbuild
cukes-report
✅ js-v0.4.34
✅ java-v0.4.34
✅ go-v0.4.34
bats-test-results
test-cases-mapping-report
✅ js-pull-2824
✅ java-pull-2824
✅ go-pull-2824

github-actions · 2025-10-22T03:38:45Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	207.039297ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	104.871724ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	371.564299ms
Throughput	269.13 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	40.41294033s
Average Latency	401.896075ms
Throughput	123.72 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	27.934341502s
Average Latency	278.478785ms
Throughput	178.99 requests/second

github-actions · 2025-10-22T03:48:56Z

X-Test Failure Results

opentdf~~platform~~T1RZCU.dockerbuild
cukes-report
✅ java-v0.4.34
✅ js-v0.4.34
✅ go-v0.4.34
bats-test-results
test-cases-mapping-report
✅ js-pull-2824
✅ java-pull-2824
✅ go-pull-2824

jakedoublev · 2025-10-22T14:18:23Z

/gemini review

gemini-code-assist

Code Review

This pull request introduces significant enhancements to the authorization service, focusing on the proper handling and auditing of obligations. Key changes include refactoring the decision logic to clearly distinguish between 'entitlement' (based on attributes) and the final 'passed' status (which now includes obligation fulfillment), and greatly improving the detail in audit logs to report on fulfillable obligations, required obligations, and their satisfaction status. The code has been restructured for better clarity and separation of concerns, such as moving audit logic into a dedicated function and using more descriptive data structures for obligation decisions. The tests have also been thoroughly updated to reflect these changes.

My review includes a couple of suggestions to further improve code clarity and adhere to idiomatic Go practices, particularly around loop efficiency and variable naming.

service/internal/access/v2/just_in_time_pdp.go

service/internal/access/v2/obligations/obligations_pdp.go

github-actions · 2025-10-22T14:23:49Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	179.417825ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	106.923893ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	361.505388ms
Throughput	276.62 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.396424275s
Average Latency	382.38617ms
Throughput	130.22 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	27.14816501s
Average Latency	270.313085ms
Throughput	184.17 requests/second

github-actions · 2025-10-22T14:34:21Z

X-Test Failure Results

opentdf~~platform~~RWC3UR.dockerbuild
✅ js-v0.4.34
✅ java-v0.4.34
cukes-report
✅ go-v0.4.34
bats-test-results
test-cases-mapping-report
✅ js-pull-2824
✅ java-pull-2824
✅ go-pull-2824

github-actions · 2025-10-22T15:26:36Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	151.28067ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	89.661094ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	376.786672ms
Throughput	265.40 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.143784448s
Average Latency	390.177086ms
Throughput	127.73 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	27.332635849s
Average Latency	272.635973ms
Throughput	182.93 requests/second

github-actions · 2025-10-22T15:38:22Z

X-Test Failure Results

opentdf~~platform~~2O68DC.dockerbuild
cukes-report
✅ java-v0.4.34
✅ js-v0.4.34
✅ go-v0.4.34
bats-test-results
test-cases-mapping-report
✅ js-pull-2824
✅ java-pull-2824
✅ go-pull-2824

github-actions · 2025-10-22T15:39:26Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	169.679037ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	92.655824ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	369.996087ms
Throughput	270.27 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.707730239s
Average Latency	385.1523ms
Throughput	129.17 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	27.298542548s
Average Latency	271.922843ms
Throughput	183.16 requests/second

github-actions · 2025-10-22T15:50:00Z

X-Test Failure Results

opentdf~~platform~~GJUGKC.dockerbuild
cukes-report
✅ js-v0.4.34
✅ java-v0.4.34
✅ go-v0.4.34
bats-test-results
✅ js-pull-2824
✅ java-pull-2824
✅ go-pull-2824

github-actions · 2025-10-22T16:06:19Z

X-Test Failure Results

opentdf~~platform~~GJUGKC.dockerbuild
cukes-report
✅ js-v0.4.34
✅ java-v0.4.34
✅ go-v0.4.34
bats-test-results
✅ js-pull-2824
✅ java-pull-2824
✅ go-pull-2824
bats-test-results
test-cases-mapping-report
✅ go-pull-2824

service/internal/access/v2/evaluate.go

github-actions · 2025-10-22T18:41:36Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	174.941399ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	101.291375ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	367.557723ms
Throughput	272.07 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.44781927s
Average Latency	382.603565ms
Throughput	130.05 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	27.00426077s
Average Latency	269.193075ms
Throughput	185.16 requests/second

github-actions · 2025-10-22T18:51:29Z

X-Test Failure Results

opentdf~~platform~~G8GC32.dockerbuild
cukes-report
✅ js-v0.4.34
✅ java-v0.4.34
✅ go-v0.4.34
bats-test-results
✅ js-pull-2824
✅ java-pull-2824
✅ go-pull-2824

🤖 I have created a release *beep* *boop* --- ## [0.11.0](service/v0.10.0...service/v0.11.0) (2025-10-22) ### Features * **authz:** add obligation fulfillment logic to obligation PDP ([#2740](#2740)) ([2f8d30d](2f8d30d)) * **authz:** audit logs should properly handle obligations ([#2824](#2824)) ([874ec7b](874ec7b)) * **authz:** defer to request auth as decision/entitlements entity ([#2789](#2789)) ([feb34d8](feb34d8)) * **authz:** obligations protos within auth service ([#2745](#2745)) ([41ee5a8](41ee5a8)) * **authz:** protovalidate tests for new authz obligations fields ([#2747](#2747)) ([73e6319](73e6319)) * **authz:** service logic to use request auth as entity identifier in PDP decisions/entitlements ([#2790](#2790)) ([6784e88](6784e88)) * **authz:** wire up obligations enforcement in auth service ([#2756](#2756)) ([11b3ea9](11b3ea9)) * **core:** propagate token clientID on configured claim via interceptor into shared context metadata ([#2760](#2760)) ([0f77246](0f77246)) * **kas:** Add required obligations to kao metadata.: ([#2806](#2806)) ([16fb26c](16fb26c)) * **policy:** add FQNs to obligation defs + vals ([#2749](#2749)) ([fa2585c](fa2585c)) * **policy:** Add obligation support to KAS ([#2786](#2786)) ([bb1bca0](bb1bca0)) * **policy:** List obligation triggers rpc ([#2823](#2823)) ([206abe3](206abe3)) * **policy:** namespace root certificates ([#2771](#2771)) ([beaff21](beaff21)) * **policy:** Proto - root certificates by namespace ([#2800](#2800)) ([0edb359](0edb359)) * **policy:** Protos List obligation triggers ([#2803](#2803)) ([b32df81](b32df81)) * **policy:** Return built obligations fqns with triggers. ([#2830](#2830)) ([e843018](e843018)) * **policy:** Return obligations from GetAttributeValue calls ([#2742](#2742)) ([aa9b393](aa9b393)) ### Bug Fixes * **core:** CORS ([#2787](#2787)) ([a030ac6](a030ac6)) * **core:** deprecate policy WithValue selector not utilized by RPC ([#2794](#2794)) ([c573595](c573595)) * **core:** deprecated stale protos and add better upgrade comments ([#2793](#2793)) ([f2678cc](f2678cc)) * **core:** Don't require known manager names ([#2792](#2792)) ([8a56a96](8a56a96)) * **core:** Fix mode negation and core mode ([#2779](#2779)) ([de9807d](de9807d)) * **core:** resolve environment loading issues ([#2827](#2827)) ([9af3184](9af3184)) * **deps:** bump github.com/opentdf/platform/lib/ocrypto from 0.6.0 to 0.7.0 in /service ([#2812](#2812)) ([a6d180d](a6d180d)) * **deps:** bump github.com/opentdf/platform/protocol/go from 0.12.0 to 0.13.0 in /service ([#2814](#2814)) ([5e9c695](5e9c695)) * **deps:** bump github.com/opentdf/platform/sdk from 0.7.0 to 0.9.0 in /service ([#2798](#2798)) ([d6bc9a8](d6bc9a8)) * **deps:** bump github.com/opentdf/platform/sdk from 0.9.0 to 0.10.0 in /service ([#2831](#2831)) ([412dfd1](412dfd1)) * ECC key loading (deprecated) ([#2757](#2757)) ([49990eb](49990eb)) * **policy:** Change to nil ([#2746](#2746)) ([a449434](a449434)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>

feat(authz): audit logs should properly handle obligations

5b5b234

github-actions bot added the size/m label Oct 17, 2025

jakedoublev added 4 commits October 21, 2025 11:18

Merge remote-tracking branch 'origin' into feat/DSPX-1735-audit

2278200

improve obligation decision result and audit logic

4ac327f

cleanup

9875394

Merge remote-tracking branch 'origin' into feat/DSPX-1735-audit

7e2472b

isolated unit test that entitlements come back for audit

12d153d

jakedoublev marked this pull request as ready for review October 21, 2025 21:19

jakedoublev requested a review from a team as a code owner October 21, 2025 21:19

gemini-code-assist bot reviewed Oct 21, 2025

View reviewed changes

jakedoublev added 5 commits October 21, 2025 14:39

gemini suggestion unused param

061b9fb

improve tests

c46dec2

audit log should have empty fulfillable obligations and not nil when …

46d1c44

…not provided

improved logs and resource-level decisioning in response

ea87577

cleanup

3088d71

jakedoublev added 3 commits October 21, 2025 19:34

fix multiresource obligations decisioning

dca8546

cleanup

e814ddf

cleanup

e92f6f7

fix to handle no obligations pass cases

f5651d6

improve debug log

eacfa41

gemini-code-assist bot reviewed Oct 22, 2025

View reviewed changes

service/internal/access/v2/just_in_time_pdp.go Show resolved Hide resolved

service/internal/access/v2/obligations/obligations_pdp.go Show resolved Hide resolved

improve audit event metadata type

ee15d20

jakedoublev added 2 commits October 22, 2025 08:27

var improvement

b4d6af1

pointer to slice struct instead of copy

befb269

jakedoublev enabled auto-merge October 22, 2025 17:12

strantalis reviewed Oct 22, 2025

View reviewed changes

service/internal/access/v2/evaluate.go Show resolved Hide resolved

rename pdp decision field for clarity

1d6f054

strantalis approved these changes Oct 22, 2025

View reviewed changes

jakedoublev added this pull request to the merge queue Oct 22, 2025

github-merge-queue bot removed this pull request from the merge queue due to failed status checks Oct 22, 2025

jakedoublev added this pull request to the merge queue Oct 22, 2025

Merged via the queue into main with commit 874ec7b Oct 22, 2025
62 of 64 checks passed

jakedoublev deleted the feat/DSPX-1735-audit branch October 22, 2025 21:45

opentdf-automation bot mentioned this pull request Oct 22, 2025

chore(main): release service 0.11.0 #2744

Merged

feat(authz): audit logs should properly handle obligations #2824

feat(authz): audit logs should properly handle obligations #2824

Uh oh!

Conversation

jakedoublev commented Oct 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed Changes

Uh oh!

github-actions bot commented Oct 17, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Uh oh!

github-actions bot commented Oct 21, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Uh oh!

github-actions bot commented Oct 21, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Uh oh!

github-actions bot commented Oct 21, 2025

X-Test Failure Results

Uh oh!

github-actions bot commented Oct 21, 2025

X-Test Failure Results

Uh oh!

jakedoublev commented Oct 21, 2025

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Oct 21, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Uh oh!

github-actions bot commented Oct 21, 2025

X-Test Failure Results

Uh oh!

github-actions bot commented Oct 21, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Uh oh!

github-actions bot commented Oct 21, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Uh oh!

github-actions bot commented Oct 21, 2025

X-Test Failure Results

Uh oh!

github-actions bot commented Oct 21, 2025

X-Test Failure Results

jakedoublev commented Oct 17, 2025 •

edited

Loading