Skip to content

fix(policy)!: Optional namespace on actions protos, NamespacedPolicy feature flag - #3155

Merged
elizabethhealy merged 10 commits into
mainfrom
dspx-2450-list-actions-shouldnt-require-namespace
Mar 16, 2026
Merged

fix(policy)!: Optional namespace on actions protos, NamespacedPolicy feature flag#3155
elizabethhealy merged 10 commits into
mainfrom
dspx-2450-list-actions-shouldnt-require-namespace

Conversation

@elizabethhealy

@elizabethhealy elizabethhealy commented Mar 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Proposed Changes

  • API Flexibility for Actions: The GetActionRequest, CreateActionRequest, and ListActionsRequest protobuf definitions have been updated to make namespace_id and namespace_fqn optional, allowing for more flexible querying of actions.
  • Cross-Namespace Listing: The ListActions API now supports retrieving actions across all namespaces when no namespace identifier (ID or FQN) is provided in the request.
  • Legacy Action Handling: When performing name-based lookups with GetActionRequest or listing actions without a specified namespace, legacy actions (those with NULL namespace IDs) are handled specifically, ensuring they are included in unscoped results but excluded from explicitly scoped requests.
  • Namespaced Policy Feature Flag: A new configuration option, NamespacedPolicy, has been introduced. When enabled, CreateAction requests will explicitly require a namespace, preventing the creation of new legacy actions.

Checklist

  • I have added or updated unit tests
  • I have added or updated integration tests (if appropriate)
  • I have added or updated documentation

Testing Instructions

@github-actions github-actions Bot added comp:db DB component comp:policy Policy Configuration ( attributes, subject mappings, resource mappings, kas registry) docs Documentation size/m labels Mar 13, 2026
@gemini-code-assist

gemini-code-assist Bot commented Mar 13, 2026

Copy link
Copy Markdown
Contributor

Summary of Changes

Hello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces a significant usability improvement to the ListActions API by making the namespace parameters optional. This change simplifies the process of retrieving actions by allowing a single call to fetch actions across all namespaces, removing the previous requirement to specify a namespace ID or FQN. The modifications span the API definition, documentation, database query logic, and include new tests to ensure the functionality works as expected.

Highlights

  • API Change: Optional Namespace for ListActions: The ListActions API endpoint no longer requires a namespace_id or namespace_fqn to be provided. If omitted, the API will now return actions across all available namespaces.
  • Database Query Logic Update: The underlying SQL query for listing actions has been modified to correctly handle requests where no namespace is specified, allowing for the retrieval of actions from all namespaces.
  • New Integration Test: A new integration test was added to verify that ListActions successfully returns actions from multiple namespaces when called without specifying a namespace.
  • Documentation and Validation Updates: The gRPC documentation for ListActionsRequest has been updated to reflect the optional nature of namespace parameters, and the API validation rules were adjusted accordingly.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Changelog
  • docs/grpc/index.html
    • Updated descriptions for namespace_id and namespace_fqn in ListActionsRequest to indicate they are now optional and describe the behavior when omitted.
  • service/integration/actions_test.go
    • Added a new integration test Test_ListActions_WithoutNamespace_ReturnsAcrossNamespaces_Succeeds to verify listing actions across namespaces when no namespace is provided.
  • service/policy/actions/actions.proto
    • Modified the ListActionsRequest message to make namespace_id and namespace_fqn optional by changing the oneof validation rule from required: true to required: false.
    • Updated comments for namespace_id and namespace_fqn to reflect their optional status and behavior.
  • service/policy/actions/actions_test.go
    • Added a validation test case for ListActionsRequest without any namespace specified, expecting it to succeed.
    • Removed the failing test case for ListActions_Fails that previously checked for a missing namespace, as this is no longer an error condition.
  • service/policy/db/actions.sql.go
    • Adjusted the listActions SQL query to use LEFT JOIN resolved_namespace and updated the WHERE clause to include actions when no namespace is provided or for standard actions.
    • Reordered the parameters passed to the q.db.Query function for listActions to match the updated SQL query.
  • service/policy/db/queries/actions.sql
    • Updated the listActions SQL query to allow listing actions across all namespaces when namespace_id and namespace_fqn are null.
    • Changed JOIN resolved_namespace to LEFT JOIN resolved_namespace to ensure all actions are considered even without a specified namespace.
    • Modified the CASE statement for namespace projection to correctly handle actions without an assigned namespace when no namespace is provided in the request.
Ignored Files
  • Ignored by pattern: docs/openapi/**/* (1)
    • docs/openapi/policy/actions/actions.openapi.yaml
  • Ignored by pattern: protocol/**/* (1)
    • protocol/go/policy/actions/actions.pb.go
Activity
  • The author elizabethhealy initiated this pull request with the title "fix(policy)!: Dont require namespace on listActions" and provided a description outlining the proposed changes and a checklist for completion.
Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

No namespace given, All actions now appear, Policy made clear.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

@github-actions

github-actions Bot commented Mar 13, 2026

Copy link
Copy Markdown
Contributor
Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 185.115827ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 95.10574ms

Benchmark Statistics

Name № Requests Avg Duration Min Duration Max Duration

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 378.241113ms
Throughput 264.38 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 40.97083438s
Average Latency 407.122413ms
Throughput 122.04 requests/second

gemini-code-assist[bot]
gemini-code-assist Bot reviewed Mar 13, 2026
View reviewed changes

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request makes the namespace optional when listing actions, allowing for listing actions across all namespaces. The changes to the protobuf definitions, documentation, and validation tests are correct and align with this goal. A new integration test has been added to cover the new functionality.

I've found a high-severity bug in the updated SQL query for listActions that causes incorrect pagination behavior when an invalid namespace is provided. I've also suggested adding an integration test case to cover this scenario and prevent future regressions. Please see the detailed comments for the bug and suggestions.

Comment thread service/policy/db/queries/actions.sql Outdated
Comment thread service/integration/actions_test.go
@github-actions

github-actions Bot commented Mar 13, 2026

Copy link
Copy Markdown
Contributor

X-Test Results

✅ go-pull-3155
✅ go-v0.9.0
✅ java-pull-3155
✅ java-v0.9.0
✅ js-pull-3155
✅ js-v0.9.0
test-cases-mapping-report
bats-test-results
cukes-report
opentdfplatformGFGKML.dockerbuild

@elizabethhealy
elizabethhealy marked this pull request as ready for review March 13, 2026 14:45
@elizabethhealy
elizabethhealy requested review from a team as code owners March 13, 2026 14:45
@github-actions

github-actions Bot commented Mar 13, 2026

Copy link
Copy Markdown
Contributor
Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 155.998727ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 75.031881ms

Benchmark Statistics

Name № Requests Avg Duration Min Duration Max Duration

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 389.111601ms
Throughput 257.00 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 38.580572072s
Average Latency 383.704439ms
Throughput 129.60 requests/second

@github-actions

github-actions Bot commented Mar 13, 2026

Copy link
Copy Markdown
Contributor

X-Test Results

✅ go-pull-3155
✅ go-v0.9.0
✅ java-pull-3155
✅ java-v0.9.0
✅ js-pull-3155
✅ js-v0.9.0
cukes-report
opentdfplatformDPWEMV.dockerbuild

@elizabethhealy elizabethhealy mentioned this pull request Mar 13, 2026
Merged
c-r33d
c-r33d reviewed Mar 13, 2026
View reviewed changes
Comment thread service/policy/db/queries/actions.sql Outdated
@github-actions

github-actions Bot commented Mar 13, 2026

Copy link
Copy Markdown
Contributor
Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 199.17665ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 96.471567ms

Benchmark Statistics

Name № Requests Avg Duration Min Duration Max Duration

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 383.110297ms
Throughput 261.02 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 39.883580555s
Average Latency 397.172815ms
Throughput 125.36 requests/second

c-r33d
c-r33d reviewed Mar 13, 2026
View reviewed changes
Comment thread service/integration/actions_test.go
@github-actions

github-actions Bot commented Mar 13, 2026

Copy link
Copy Markdown
Contributor

X-Test Results

✅ go-pull-3155
✅ go-v0.9.0
✅ java-pull-3155
✅ java-v0.9.0
✅ js-pull-3155
✅ js-v0.9.0
test-cases-mapping-report
bats-test-results
cukes-report
opentdfplatformII18X5.dockerbuild

@github-actions

github-actions Bot commented Mar 13, 2026

Copy link
Copy Markdown
Contributor
Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 191.202746ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 97.506672ms

Benchmark Statistics

Name № Requests Avg Duration Min Duration Max Duration

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 384.112797ms
Throughput 260.34 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 40.270528885s
Average Latency 401.193886ms
Throughput 124.16 requests/second

@github-actions

github-actions Bot commented Mar 13, 2026

Copy link
Copy Markdown
Contributor

X-Test Results

✅ go-pull-3155
✅ go-v0.9.0
✅ java-pull-3155
✅ java-v0.9.0
✅ js-pull-3155
✅ js-v0.9.0
test-cases-mapping-report
bats-test-results
cukes-report
opentdfplatformYUMN0A.dockerbuild

c-r33d
c-r33d reviewed Mar 16, 2026
View reviewed changes
Comment thread service/integration/actions_test.go
@github-actions

github-actions Bot commented Mar 16, 2026

Copy link
Copy Markdown
Contributor
Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 200.757983ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 96.433293ms

Benchmark Statistics

Name № Requests Avg Duration Min Duration Max Duration

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 375.138213ms
Throughput 266.57 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 39.671906816s
Average Latency 395.023382ms
Throughput 126.03 requests/second

@github-actions

github-actions Bot commented Mar 16, 2026

Copy link
Copy Markdown
Contributor

X-Test Failure Report

✅ go-pull-3155
✅ go-v0.9.0
✅ java-pull-3155
✅ java-v0.9.0
✅ js-pull-3155
✅ js-v0.9.0
test-cases-mapping-report
bats-test-results
cukes-report
opentdfplatform32DJ71.dockerbuild

@github-actions

github-actions Bot commented Mar 16, 2026

Copy link
Copy Markdown
Contributor

X-Test Results

✅ go-pull-3155
✅ java-pull-3155
✅ go-v0.9.0
✅ java-v0.9.0
✅ js-pull-3155
✅ js-v0.9.0
cukes-report
bats-test-results
opentdfplatformUHYN10.dockerbuild

@elizabethhealy

elizabethhealy commented Mar 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Member Author

Resulting Logic:
ListActions: if no namespace provided, return all actions including those where namespace=null
GetActions: if name provided and no namespace provided, lookup action name where namespace=null
CreateAction: if no namespace provided, if feature flag enabled then error, otherwise create the action with namespace=null

@github-actions

github-actions Bot commented Mar 16, 2026

Copy link
Copy Markdown
Contributor
Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 194.934331ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 94.890955ms

Benchmark Statistics

Name № Requests Avg Duration Min Duration Max Duration

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 378.510471ms
Throughput 264.19 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 39.865795086s
Average Latency 396.672989ms
Throughput 125.42 requests/second

c-r33d
c-r33d reviewed Mar 16, 2026
View reviewed changes
Comment thread service/policy/actions/actions.proto
@github-actions

github-actions Bot commented Mar 16, 2026

Copy link
Copy Markdown
Contributor

X-Test Failure Report

✅ go-pull-3155
✅ go-v0.9.0
✅ java-pull-3155
✅ java-v0.9.0
✅ js-v0.9.0
✅ js-pull-3155
cukes-report
test-cases-mapping-report
bats-test-results
opentdfplatformI6NPAP.dockerbuild

@elizabethhealy

elizabethhealy commented Mar 16, 2026

Copy link
Copy Markdown
Member Author

/gemini summary

@gemini-code-assist

gemini-code-assist Bot commented Mar 16, 2026

Copy link
Copy Markdown
Contributor

Summary of Changes

This pull request significantly enhances the flexibility and control over action management within the policy service. It introduces optional namespace parameters for GetActionRequest and ListActionsRequest, allowing for broader queries across namespaces and more nuanced handling of legacy, un-namespaced actions. Additionally, a new NamespacedPolicy feature flag provides a mechanism to enforce namespace requirements during action creation, moving towards a more structured and controlled policy environment.

Highlights

  • API Flexibility for Actions: The GetActionRequest and ListActionsRequest protobuf definitions have been updated to make namespace_id and namespace_fqn optional, allowing for more flexible querying of actions.
  • Cross-Namespace Listing: The ListActions API now supports retrieving actions across all namespaces when no namespace identifier (ID or FQN) is provided in the request.
  • Legacy Action Handling: When performing name-based lookups with GetActionRequest or listing actions without a specified namespace, legacy actions (those with NULL namespace IDs) are handled specifically, ensuring they are included in unscoped results but excluded from explicitly scoped requests.
  • Namespaced Policy Feature Flag: A new configuration option, NamespacedPolicy, has been introduced. When enabled, CreateAction requests will explicitly require a namespace, preventing the creation of new legacy actions.
  • Database Query Enhancements: The underlying SQL queries for getAction and listActions were refactored to correctly implement the new optional namespace logic, including the use of window functions for total counts and refined WHERE clauses.
  • Updated Documentation and Validation: gRPC documentation and API validation rules were adjusted to reflect the optional nature of namespace parameters and their behavior.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Changelog
  • docs/grpc/index.html
    • Updated descriptions for namespace_id and namespace_fqn in GetActionRequest and ListActionsRequest to reflect their optional status and behavior with legacy actions.
  • service/integration/actions_test.go
    • Refactored Test_ListActions_NoPagination_Succeeds to use dynamically created actions instead of fixtures.
    • Renamed and updated Test_ListActions_LegacyCustomAction_NamespaceProjection_Succeeds to Test_ListActions_LegacyCustomAction_ScopedExcluded_UnscopedIncluded_Succeeds to test scoped exclusion and unscoped inclusion of legacy actions.
    • Added Test_ListActions_WithoutNamespace_ReturnsAcrossNamespaces_Succeeds for verifying cross-namespace listing when no namespace is specified.
    • Modified Test_GetAction_Name_Succeeds to dynamically create a test action for name-based retrieval.
    • Renamed and refactored Test_GetAction_Name_LegacyCustomAction_Succeeds to Test_GetAction_Name_LegacyCustomAction_UnscopedSucceeds_ScopedFails to test unscoped success and scoped failure for legacy action retrieval.
    • Added Test_CreateAction_MissingNamespace_SucceedsInLegacyMode to confirm that creating an action without a namespace succeeds when NamespacedPolicy is not enforced.
  • service/integration/registered_resources_test.go
    • Removed Test_CreateRegisteredResourceValue_WithNamespacedCustomActionName_Succeeds test case.
  • service/policy/actions/actions.go
    • Imported the errors package.
    • Added a conditional check in CreateAction to enforce namespace provision (namespace_id or namespace_fqn) if the NamespacedPolicy feature flag is enabled.
  • service/policy/actions/actions.proto
    • Modified GetActionRequest, ListActionsRequest, and CreateActionRequest to make namespace_id and namespace_fqn optional by changing oneof validation to required: false.
    • Updated comments for namespace_id and namespace_fqn in GetActionRequest and ListActionsRequest to reflect their optional status and behavior when omitted.
  • service/policy/actions/actions_test.go
    • Removed errMessageOneof and errMessageNamespaceByName constants.
    • Removed validation test cases that previously failed for missing namespaces in CreateActionRequest and GetActionRequest.
    • Added a validation success test case for ListActionsRequest without any namespace specified.
  • service/policy/config/config.go
    • Added a new boolean field NamespacedPolicy to the Config struct, defaulting to false, to control namespace enforcement.
  • service/policy/db/actions.go
    • Introduced a namespaceFQN variable to capture the FQN from the request in CreateAction.
    • Ensured that CreateAction correctly uses the provided namespaceFQN when creating a custom action.
  • service/policy/db/actions.sql.go
    • Modified createCustomAction SQL query to include a condition (ns.id IS NULL AND ns.fqn IS NULL) in the WHERE clause for resolved_namespace.
    • Adjusted getAction SQL query by removing a specific CASE for namespace projection and reordered the parameters passed to q.db.QueryRow.
    • Refactored listActions SQL query to remove the counted CTE, replace it with COUNT(*) OVER() for total count, change JOIN resolved_namespace to LEFT JOIN resolved_namespace, and update the WHERE clause for optional namespace filtering.
    • Reordered the parameters passed to the q.db.Query function for listActions to align with the updated SQL query.
  • service/policy/db/queries/actions.sql
    • Updated listActions query to remove the counted CTE, use COUNT(*) OVER() for total, change JOIN resolved_namespace to LEFT JOIN resolved_namespace, and modify the WHERE clause for optional namespace filtering.
    • Updated getAction query to remove a specific CASE for namespace projection and adjusted the WHERE clause for name-based lookups.
    • Modified createCustomAction query to include (ns.id IS NULL AND ns.fqn IS NULL) in the WHERE clause for resolved_namespace.
Ignored Files
  • Ignored by pattern: docs/openapi/**/* (1)
    • docs/openapi/policy/actions/actions.openapi.yaml
  • Ignored by pattern: protocol/**/* (1)
    • protocol/go/policy/actions/actions.pb.go
Activity
  • The pull request was opened by elizabethhealy with the title "fix(policy)!: Optional namespace on actions protos, NamespacedPolicy feature flag" and a description outlining the proposed changes.
  • gemini-code-assist[bot] provided an initial summary and suggested improvements to the listActions SQL query, recommending a window function for total count and adding a test case for invalid namespaces.
  • c-r33d raised questions about the intended behavior of actions with NULL namespace_id when a namespace filter is applied, particularly regarding their projection.
  • elizabethhealy clarified that legacy/global actions should be included for backward compatibility but agreed that projecting the requested namespace onto them could be confusing and would be removed.
  • c-r33d sought further clarification on the use-case for returning un-namespaced actions with a namespace filter and suggested asserting that scoped actions are found in tests when no namespace filter is applied.
  • github-actions[bot] posted several benchmark and X-Test results throughout the review process.
  • c-r33d noted that CreateActionRequest still appeared to require a namespace and asked for an update.
  • elizabethhealy provided a summary of the resulting logic for ListActions, GetActions, and CreateAction regarding namespace handling.
  • elizabethhealy requested new summaries and reviews from gemini-code-assist[bot].

@github-actions

github-actions Bot commented Mar 16, 2026

Copy link
Copy Markdown
Contributor
Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 193.004259ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 96.292664ms

Benchmark Statistics

Name № Requests Avg Duration Min Duration Max Duration

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 399.856057ms
Throughput 250.09 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 41.169887546s
Average Latency 409.603047ms
Throughput 121.45 requests/second

c-r33d
c-r33d previously approved these changes Mar 16, 2026
View reviewed changes
@github-actions

github-actions Bot commented Mar 16, 2026

Copy link
Copy Markdown
Contributor

X-Test Failure Report

test-cases-mapping-report
bats-test-results
opentdfplatformVCA8B1.dockerbuild

@elizabethhealy
elizabethhealy requested a review from c-r33d March 16, 2026 17:44
@github-actions

github-actions Bot commented Mar 16, 2026

Copy link
Copy Markdown
Contributor
Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 189.26662ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 97.617834ms

Benchmark Statistics

Name № Requests Avg Duration Min Duration Max Duration

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 387.060553ms
Throughput 258.36 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 40.495561312s
Average Latency 402.692617ms
Throughput 123.47 requests/second

@github-actions

github-actions Bot commented Mar 16, 2026

Copy link
Copy Markdown
Contributor

X-Test Results

✅ go-pull-3155
✅ go-v0.9.0
✅ java-pull-3155
✅ js-pull-3155
✅ java-v0.9.0
✅ js-v0.9.0
cukes-report
test-cases-mapping-report
bats-test-results
opentdfplatformSMNRZM.dockerbuild

@elizabethhealy
elizabethhealy added this pull request to the merge queue Mar 16, 2026
Merged via the queue into main with commit c20f039 Mar 16, 2026
36 checks passed
@elizabethhealy
elizabethhealy deleted the dspx-2450-list-actions-shouldnt-require-namespace branch March 16, 2026 19:45
This was referenced Mar 16, 2026
Merged
Merged
github-merge-queue Bot pushed a commit that referenced this pull request Mar 19, 2026
@opentdf-automation
chore(main): release protocol/go 0.20.0 (#3163)
d06dbdc 
🤖 I have created a release *beep* *boop*
---


##
[0.20.0](protocol/go/v0.19.0...protocol/go/v0.20.0)
(2026-03-18)


### ⚠ BREAKING CHANGES

* **policy:** Namespace subject mappings and subject condition sets.
([#3143](#3143))
* **policy:** Optional namespace on actions protos, NamespacedPolicy
feature flag ([#3155](#3155))

### Features

* **policy:** Namespace subject mappings and subject condition sets.
([#3143](#3143))
([3006780](3006780))


### Bug Fixes

* **policy:** Optional namespace on actions protos, NamespacedPolicy
feature flag ([#3155](#3155))
([c20f039](c20f039))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>
This was referenced Mar 20, 2026
Merged
Closed
JBCongdon pushed a commit to JBCongdon/platform that referenced this pull request May 24, 2026
@opentdf-automation
chore(main): release service 0.14.0 (opentdf#3093)
ac0b5df 
🤖 I have created a release *beep* *boop*
---


##
[0.14.0](opentdf/platform@service/v0.13.0...service/v0.14.0)
(2026-04-21)


### ⚠ BREAKING CHANGES

* **sdk:** reclassify KAS 400 errors — distinguish tamper from
misconfiguration
([opentdf#3166](opentdf#3166))
* **policy:** optional namespace for RRs
([opentdf#3165](opentdf#3165))
* **policy:** Namespace subject mappings and subject condition sets.
([opentdf#3143](opentdf#3143))
* **policy:** Optional namespace on actions protos, NamespacedPolicy
feature flag ([opentdf#3155](opentdf#3155))
* **policy:** add namespaced actions schema and namespace-aware action
queries ([opentdf#3154](opentdf#3154))
* **policy:** only require namespace on GetAction if no id provided
([opentdf#3144](opentdf#3144))
* **policy:** add namespace field to Actions proto
([opentdf#3130](opentdf#3130))
* **policy:** namespace Registered Resources
([opentdf#3111](opentdf#3111))
* **policy:** add namespace field to RegisteredResource proto
([opentdf#3110](opentdf#3110))

### Features

* **authz:** Namespaced policy in decisioning
([opentdf#3226](opentdf#3226))
([0355934](opentdf@0355934))
* **cli:** migrate otdfctl into platform monorepo
([opentdf#3205](opentdf#3205))
([5177bec](opentdf@5177bec))
* fix tracing ([opentdf#3242](opentdf#3242))
([57e5680](opentdf@57e5680))
* **policy:** add GetObligationTrigger RPC
([opentdf#3318](opentdf#3318))
([d68e39d](opentdf@d68e39d))
* **policy:** add namespace field to Actions proto
([opentdf#3130](opentdf#3130))
([bedc9b3](opentdf@bedc9b3))
* **policy:** add namespace field to RegisteredResource proto
([opentdf#3110](opentdf#3110))
([04fd85d](opentdf@04fd85d))
* **policy:** add namespaced actions schema and namespace-aware action
queries ([opentdf#3154](opentdf#3154))
([c0443f1](opentdf@c0443f1))
* **policy:** add sort ListSubjectMappings API
([opentdf#3255](opentdf#3255))
([9d5d757](opentdf@9d5d757))
* **policy:** Add sort support listregisteredresources api
([opentdf#3312](opentdf#3312))
([91a3ff3](opentdf@91a3ff3))
* **policy:** add sort support to ListAttributes API
([opentdf#3223](opentdf#3223))
([ec3312f](opentdf@ec3312f))
* **policy:** add sort support to ListKeyAccessServer
([opentdf#3287](opentdf#3287))
([7fae2d7](opentdf@7fae2d7))
* **policy:** Add sort support to ListNamespaces API
([opentdf#3192](opentdf#3192))
([aac86cd](opentdf@aac86cd))
* **policy:** add sort support to listobligations api
([opentdf#3300](opentdf#3300))
([9221cac](opentdf@9221cac))
* **policy:** add sort support to ListSubjectConditionSets API
([opentdf#3272](opentdf#3272))
([9010f12](opentdf@9010f12))
* **policy:** add SortField proto and update PageRequest for sort
support ([opentdf#3187](opentdf#3187))
([6cf1862](opentdf@6cf1862))
* **policy:** Enforce same namespace when actions referenced downstream
([opentdf#3206](opentdf#3206))
([4b5463a](opentdf@4b5463a))
* **policy:** namespace Registered Resources
([opentdf#3111](opentdf#3111))
([6db1883](opentdf@6db1883))
* **policy:** Namespace subject mappings and condition sets
([opentdf#3172](opentdf#3172))
([6deed50](opentdf@6deed50))
* **policy:** Namespace subject mappings and subject condition sets.
([opentdf#3143](opentdf#3143))
([3006780](opentdf@3006780))
* **policy:** optional namespace for RRs
([opentdf#3165](opentdf#3165))
([8948018](opentdf@8948018))
* **policy:** rollback migration strategy for namespaced actions
([opentdf#3235](opentdf#3235))
([f7e5e01](opentdf@f7e5e01))
* **policy:** Seed existing namespaces with standard actions
([opentdf#3228](opentdf#3228))
([12136b0](opentdf@12136b0))
* **policy:** Seed namespaces with standard actions on creation +
namespaced actions for obligation triggers
([opentdf#3161](opentdf#3161))
([984d76b](opentdf@984d76b))


### Bug Fixes

* **ci:** Upgrade toolchain version to 1.25.8
([opentdf#3116](opentdf#3116))
([e1b7882](opentdf@e1b7882))
* **core:** do not concat slashes directly in url/file paths
([opentdf#3290](opentdf#3290))
([114c2a7](opentdf@114c2a7))
* **deps:** bump github.com/jackc/pgx/v5 from 5.7.5 to 5.9.0 in /service
([opentdf#3316](opentdf#3316))
([017362e](opentdf@017362e))
* **deps:** bump github.com/opentdf/platform/lib/identifier from 0.2.0
to 0.3.0 in /service
([opentdf#3162](opentdf#3162))
([8bc5dcd](opentdf@8bc5dcd))
* **deps:** bump github.com/opentdf/platform/protocol/go from 0.16.0 to
0.17.0 in /service
([opentdf#3125](opentdf#3125))
([29fec61](opentdf@29fec61))
* **deps:** bump github.com/opentdf/platform/protocol/go from 0.17.0 to
0.21.0 in /service
([opentdf#3220](opentdf#3220))
([e63add2](opentdf@e63add2))
* **deps:** bump github.com/opentdf/platform/protocol/go from 0.21.0 to
0.22.0 in /service
([opentdf#3248](opentdf#3248))
([1ebce73](opentdf@1ebce73))
* **deps:** bump github.com/opentdf/platform/protocol/go from 0.22.0 to
0.23.0 in /service
([opentdf#3271](opentdf#3271))
([3338b8e](opentdf@3338b8e))
* **deps:** bump github.com/opentdf/platform/protocol/go from 0.23.0 to
0.24.0 in /service
([opentdf#3321](opentdf#3321))
([78e6022](opentdf@78e6022))
* **deps:** bump github.com/opentdf/platform/protocol/go from 0.24.0 to
0.25.0 in /service
([opentdf#3333](opentdf#3333))
([3940bf8](opentdf@3940bf8))
* **deps:** bump github.com/opentdf/platform/sdk from 0.13.0 to 0.16.0
in /service ([opentdf#3356](opentdf#3356))
([5617077](opentdf@5617077))
* **deps:** bump
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from
1.42.0 to 1.43.0 in /service
([opentdf#3282](opentdf#3282))
([046374a](opentdf@046374a))
* **deps:** bump go.opentelemetry.io/otel/sdk from 1.42.0 to 1.43.0 in
/service ([opentdf#3281](opentdf#3281))
([56b33f2](opentdf@56b33f2))
* **deps:** bump google.golang.org/grpc from 1.77.0 to 1.79.3 in
/service ([opentdf#3176](opentdf#3176))
([3289502](opentdf@3289502))
* **deps:** remove direct github.com/docker/docker dependency
([opentdf#3229](opentdf#3229))
([2becb27](opentdf@2becb27))
* **deps:** upgrade testcontainers-go to resolve vulns
([opentdf#3299](opentdf#3299))
([72c6f9b](opentdf@72c6f9b))
* **ers:** include standard JWT claims in claims mode entity resolution
([opentdf#3196](opentdf#3196))
([6d50da1](opentdf@6d50da1))
* **ers:** ldap multi-strategy ers
([opentdf#3117](opentdf#3117))
([d3aaf1a](opentdf@d3aaf1a))
* **policy:** deprecate ListAttributeValues in favor of existing
GetAttribute ([opentdf#3108](opentdf#3108))
([7e17c2d](opentdf@7e17c2d))
* **policy:** make obligation trigger uniqueness client-aware
([opentdf#3114](opentdf#3114))
([9265bc3](opentdf@9265bc3))
* **policy:** omit empty attribute values from create responses
([opentdf#3193](opentdf#3193))
([d298378](opentdf@d298378))
* **policy:** only require namespace on GetAction if no id provided
([opentdf#3144](opentdf#3144))
([10d0c0f](opentdf@10d0c0f))
* **policy:** Optional namespace on actions protos, NamespacedPolicy
feature flag ([opentdf#3155](opentdf#3155))
([c20f039](opentdf@c20f039))
* **policy:** order List* results by created_at
([opentdf#3088](opentdf#3088))
([ea90ac2](opentdf@ea90ac2))
* **sdk:** normalize issuer URL before OIDC discovery
([opentdf#3261](opentdf#3261))
([61f98c9](opentdf@61f98c9))
* **sdk:** reclassify KAS 400 errors — distinguish tamper from
misconfiguration
([opentdf#3166](opentdf#3166))
([f04a385](opentdf@f04a385))
* **sdk:** remove testcontainers from consumer dependency graph
([opentdf#3129](opentdf#3129))
([f17dcdd](opentdf@f17dcdd))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@marythought marythought marythought approved these changes
@alkalescent alkalescent alkalescent approved these changes
@c-r33d c-r33d Awaiting requested review from c-r33d
+1 more reviewer
@gemini-code-assist gemini-code-assist[bot] gemini-code-assist[bot] left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

comp:db DB component comp:policy Policy Configuration ( attributes, subject mappings, resource mappings, kas registry) docs Documentation size/m

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@elizabethhealy @marythought @alkalescent @c-r33d