feat(policy): Enforce same namespace when actions referenced downstream

service/integration/actions_test.go

@@ -202,7 +202,7 @@ func (s *ActionsSuite) Test_ListActions_FiltersCustomActionsByNamespace_Succeeds
 
 func (s *ActionsSuite) Test_ListActions_WithNamespace_DoesNotLeakStandardActionsFromOtherNamespaces() {
 	createdNamespace, err := s.db.PolicyClient.CreateNamespace(s.ctx, &namespaces.CreateNamespaceRequest{
-		Name: "list-actions-standard-scope",
+		Name: fmt.Sprintf("list-actions-standard-scope-%d", time.Now().UnixNano()),
 	})
 	s.Require().NoError(err)
 	s.Require().NotNil(createdNamespace)

service/integration/attribute_values_test.go

@@ -9,6 +9,7 @@ import (
 
 	"github.com/opentdf/platform/protocol/go/common"
 	"github.com/opentdf/platform/protocol/go/policy"
+	"github.com/opentdf/platform/protocol/go/policy/actions"
 	"github.com/opentdf/platform/protocol/go/policy/attributes"
 	"github.com/opentdf/platform/protocol/go/policy/kasregistry"
 	"github.com/opentdf/platform/protocol/go/policy/namespaces"
@@ -958,8 +959,8 @@ func (s *AttributeValuesSuite) Test_GetAttributeValue_With_Two_Obligations_Succe
 	s.obligations = append(s.obligations, obl1)
 
 	// Create first obligation value with two triggers
-	readAction := s.f.GetStandardAction("read")
-	updateAction := s.f.GetStandardAction("update")
+	readAction := s.getActionByNameInNamespace("read", ns.GetId())
+	updateAction := s.getActionByNameInNamespace("update", ns.GetId())
 
 	obl1Val1, err := s.db.PolicyClient.CreateObligationValue(s.ctx, &obligations.CreateObligationValueRequest{
 		ObligationId: obl1.GetId(),
@@ -1049,6 +1050,15 @@ func TestAttributeValuesSuite(t *testing.T) {
 	suite.Run(t, new(AttributeValuesSuite))
 }
 
+func (s *AttributeValuesSuite) getActionByNameInNamespace(name string, namespaceID string) *policy.Action {
+	action, err := s.db.PolicyClient.GetAction(s.ctx, &actions.GetActionRequest{
+		Identifier:  &actions.GetActionRequest_Name{Name: name},
+		NamespaceId: namespaceID,
+	})
+	s.Require().NoError(err)
+	return action
+}
+
 func (s *AttributeValuesSuite) assertObligations(expected, actual []*policy.Obligation) {
 	s.Require().Len(actual, len(expected), "number of obligations does not match")
 

service/integration/obligation_triggers_test.go

@@ -2,6 +2,7 @@ package integration
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"log/slog"
 	"testing"
@@ -130,16 +131,26 @@ func (s *ObligationTriggersSuite) TearDownSuite() {
 
 func (s *ObligationTriggersSuite) TearDownTest() {
 	for _, triggerID := range s.triggerIDsToClean {
+		if triggerID == "" {
+			continue
+		}
 		_, err := s.db.PolicyClient.DeleteObligationTrigger(s.ctx, &obligations.RemoveObligationTriggerRequest{
 			Id: triggerID,
 		})
-		s.Require().NoError(err)
+		if err != nil && !errors.Is(err, db.ErrNotFound) {
+			s.Require().NoError(err)
+		}
 	}
 	for _, obligationValueID := range s.obligationValueIDsToClean {
+		if obligationValueID == "" {
+			continue
+		}
 		_, err := s.db.PolicyClient.DeleteObligationValue(s.ctx, &obligations.DeleteObligationValueRequest{
 			Id: obligationValueID,
 		})
-		s.Require().NoError(err)
+		if err != nil && !errors.Is(err, db.ErrNotFound) {
+			s.Require().NoError(err)
+		}
 	}
 	s.triggerIDsToClean = nil
 	s.obligationValueIDsToClean = nil
@@ -317,7 +328,7 @@ func (s *ObligationTriggersSuite) Test_CreateObligationTrigger_AttributeValueNot
 		},
 	})
 	s.Require().Error(err)
-	s.Require().ErrorIs(err, db.ErrNotNullViolation)
+	s.Require().ErrorIs(err, db.ErrNotFound)
 	s.Nil(trigger)
 }
 
@@ -334,7 +345,7 @@ func (s *ObligationTriggersSuite) Test_CreateObligationTrigger_ActionNotFound_Fa
 		},
 	})
 	s.Require().Error(err)
-	s.Require().ErrorIs(err, db.ErrInvalidOblTriParam)
+	s.Require().ErrorIs(err, db.ErrNotFound)
 	s.Nil(trigger)
 }
 
@@ -376,7 +387,38 @@ func (s *ObligationTriggersSuite) Test_CreateObligationTrigger_AttributeValueDif
 		},
 	})
 	s.Require().Error(err)
-	s.Require().ErrorIs(err, db.ErrInvalidOblTriParam)
+	s.Require().ErrorIs(err, db.ErrNamespaceMismatch)
+	s.Nil(trigger)
+}
+
+func (s *ObligationTriggersSuite) Test_CreateObligationTrigger_ActionIDDifferentNamespace_Fails() {
+	differentNamespace, err := s.db.PolicyClient.CreateNamespace(s.ctx, &namespaces.CreateNamespaceRequest{
+		Name: "different-action-ns",
+	})
+	s.Require().NoError(err)
+	defer func() {
+		_, deleteErr := s.db.PolicyClient.UnsafeDeleteNamespace(s.ctx, differentNamespace, differentNamespace.GetFqn())
+		s.Require().NoError(deleteErr)
+	}()
+
+	differentAction, err := s.db.PolicyClient.CreateAction(s.ctx, &actions.CreateActionRequest{
+		Name:        "action-different-ns",
+		NamespaceId: differentNamespace.GetId(),
+	})
+	s.Require().NoError(err)
+
+	trigger, err := s.db.PolicyClient.CreateObligationTrigger(s.ctx, &obligations.AddObligationTriggerRequest{
+		ObligationValue: &common.IdFqnIdentifier{Id: s.obligationValue.GetId()},
+		AttributeValue:  &common.IdFqnIdentifier{Id: s.attributeValue.GetId()},
+		Action:          &common.IdNameIdentifier{Id: differentAction.GetId()},
+		Context: &policy.RequestContext{
+			Pep: &policy.PolicyEnforcementPoint{
+				ClientId: clientID,
+			},
+		},
+	})
+	s.Require().Error(err)
+	s.Require().ErrorIs(err, db.ErrNamespaceMismatch)
 	s.Nil(trigger)
 }
 
@@ -725,37 +767,45 @@ func (s *ObligationTriggersSuite) appendObligationValuesToClean(createdTriggers
 }
 
 func (s *ObligationTriggersSuite) createDifferentNamespaceWithTrigger(namespaceName string) *DifferentNamespaceEntities {
+	uniqueNamespaceName := fmt.Sprintf("%s-%d", namespaceName, time.Now().UnixNano())
+
 	// Create a different namespace
 	differentNamespace, err := s.db.PolicyClient.CreateNamespace(s.ctx, &namespaces.CreateNamespaceRequest{
-		Name: namespaceName,
+		Name: uniqueNamespaceName,
+	})
+	s.Require().NoError(err)
+
+	differentAction, err := s.db.PolicyClient.CreateAction(s.ctx, &actions.CreateActionRequest{
+		Name:        "different-action-" + uniqueNamespaceName,
+		NamespaceId: differentNamespace.GetId(),
 	})
 	s.Require().NoError(err)
 
 	// Create obligation in different namespace
 	differentObligation, err := s.db.PolicyClient.CreateObligation(s.ctx, &obligations.CreateObligationRequest{
-		Name:        "different-obligation-" + namespaceName,
+		Name:        "different-obligation-" + uniqueNamespaceName,
 		NamespaceId: differentNamespace.GetId(),
 	})
 	s.Require().NoError(err)
 
 	// Create obligation value in different namespace
 	differentObligationValue, err := s.db.PolicyClient.CreateObligationValue(s.ctx, &obligations.CreateObligationValueRequest{
 		ObligationId: differentObligation.GetId(),
-		Value:        "different-obligation-value-" + namespaceName,
+		Value:        "different-obligation-value-" + uniqueNamespaceName,
 	})
 	s.Require().NoError(err)
 
 	// Create attribute in different namespace
 	differentAttribute, err := s.db.PolicyClient.CreateAttribute(s.ctx, &attributes.CreateAttributeRequest{
-		Name:        "different-attribute-" + namespaceName,
+		Name:        "different-attribute-" + uniqueNamespaceName,
 		NamespaceId: differentNamespace.GetId(),
 		Rule:        policy.AttributeRuleTypeEnum_ATTRIBUTE_RULE_TYPE_ENUM_ALL_OF,
 	})
 	s.Require().NoError(err)
 
 	// Create attribute value in different namespace
 	differentAttributeValue, err := s.db.PolicyClient.CreateAttributeValue(s.ctx, differentAttribute.GetId(), &attributes.CreateAttributeValueRequest{
-		Value:       "different-value-" + namespaceName,
+		Value:       "different-value-" + uniqueNamespaceName,
 		AttributeId: differentAttribute.GetId(),
 	})
 	s.Require().NoError(err)
@@ -764,7 +814,7 @@ func (s *ObligationTriggersSuite) createDifferentNamespaceWithTrigger(namespaceN
 	differentTrigger, err := s.db.PolicyClient.CreateObligationTrigger(s.ctx, &obligations.AddObligationTriggerRequest{
 		ObligationValue: &common.IdFqnIdentifier{Id: differentObligationValue.GetId()},
 		AttributeValue:  &common.IdFqnIdentifier{Id: differentAttributeValue.GetId()},
-		Action:          &common.IdNameIdentifier{Id: s.action.GetId()},
+		Action:          &common.IdNameIdentifier{Id: differentAction.GetId()},
 		Context: &policy.RequestContext{
 			Pep: &policy.PolicyEnforcementPoint{
 				ClientId: clientID,

service/integration/obligations_test.go

@@ -11,6 +11,7 @@ import (
 	"github.com/opentdf/platform/lib/identifier"
 	"github.com/opentdf/platform/protocol/go/common"
 	"github.com/opentdf/platform/protocol/go/policy"
+	"github.com/opentdf/platform/protocol/go/policy/actions"
 	"github.com/opentdf/platform/protocol/go/policy/obligations"
 	"github.com/opentdf/platform/service/internal/fixtures"
 	"github.com/opentdf/platform/service/pkg/db"
@@ -1527,10 +1528,15 @@ func (s *ObligationsSuite) Test_UpdateObligationValue_WithTriggers_Succeeds() {
 	})
 	s.Require().NoError(err)
 	s.NotNil(updatedOblValue)
+	readAction, err := s.db.PolicyClient.GetAction(s.ctx, &actions.GetActionRequest{
+		Identifier:  &actions.GetActionRequest_Name{Name: "read"},
+		NamespaceId: triggerSetup.namespace.ID,
+	})
+	s.Require().NoError(err)
 	s.assertObligationValueBasics(updatedOblValue, oblValPrefix+"test-1-updated", triggerSetup.namespace.ID, triggerSetup.namespace.Name, httpsPrefix+triggerSetup.namespace.Name)
 	s.assertTriggers(updatedOblValue, []*TriggerAssertion{
 		{
-			expectedAction:            triggerSetup.action,
+			expectedAction:            readAction,
 			expectedObligation:        triggerSetup.createdObl,
 			expectedAttributeValue:    triggerSetup.attributeValues[1],
 			expectedAttributeValueFQN: "https://example.com/attr/attr1/value/value2",
@@ -1766,7 +1772,11 @@ func (s *ObligationsSuite) assertObligationValueBasics(oblValue *policy.Obligati
 func (s *ObligationsSuite) setupTriggerTests() *TriggerSetup {
 	namespaceID, _, namespace := s.getNamespaceData(nsExampleCom)
 	createdObl := s.createObligation(namespaceID, oblName, nil)
-	triggerAction := s.f.GetStandardAction("read")
+	triggerAction, err := s.db.PolicyClient.CreateAction(s.ctx, &actions.CreateActionRequest{
+		Name:        fmt.Sprintf("trigger-action-%d", time.Now().UnixNano()),
+		NamespaceId: namespaceID,
+	})
+	s.Require().NoError(err)
 	triggerAttributeValue := s.f.GetAttributeValueKey("example.com/attr/attr1/value/value1")
 	triggerAttributeValue2 := s.f.GetAttributeValueKey("example.com/attr/attr1/value/value2")
 
@@ -1851,7 +1861,14 @@ func (s *ObligationsSuite) createObligationValueWithTriggers(obligationID string
 		triggers = customTriggers
 	} else {
 		// Default triggers for backward compatibility
-		triggerAction := s.f.GetStandardAction("read")
+		obl, err := s.db.PolicyClient.GetObligation(s.ctx, &obligations.GetObligationRequest{Id: obligationID})
+		s.Require().NoError(err)
+
+		triggerAction, err := s.db.PolicyClient.CreateAction(s.ctx, &actions.CreateActionRequest{
+			Name:        fmt.Sprintf("trigger-action-%d", time.Now().UnixNano()),
+			NamespaceId: obl.GetNamespace().GetId(),
+		})
+		s.Require().NoError(err)
 		triggerAttributeValue := s.f.GetAttributeValueKey("example.com/attr/attr1/value/value1")
 		triggerAttributeValue2 := s.f.GetAttributeValueKey("example.com/attr/attr1/value/value2")
 

service/integration/registered_resources_test.go

@@ -820,21 +820,7 @@ func (s *RegisteredResourcesSuite) Test_CreateRegisteredResourceValue_WithInvali
 					},
 				},
 			},
-			err: db.ErrForeignKeyViolation,
-		},
-		{
-			name: "Invalid Action Name",
-			actionAttrValues: []*registeredresources.ActionAttributeValue{
-				{
-					ActionIdentifier: &registeredresources.ActionAttributeValue_ActionName{
-						ActionName: "invalid_action_name",
-					},
-					AttributeValueIdentifier: &registeredresources.ActionAttributeValue_AttributeValueFqn{
-						AttributeValueFqn: "https://example.com/attr/attr1/value/value1",
-					},
-				},
-			},
-			err: db.ErrNotFound,
+			err: db.ErrMissingValue,
 		},
 		{
 			name: "Invalid Attribute Value ID",
@@ -848,7 +834,7 @@ func (s *RegisteredResourcesSuite) Test_CreateRegisteredResourceValue_WithInvali
 					},
 				},
 			},
-			err: db.ErrForeignKeyViolation,
+			err: db.ErrNotFound,
 		},
 		{
 			name: "Invalid Attribute Value FQN",
@@ -1891,7 +1877,7 @@ func (s *RegisteredResourcesSuite) Test_SameNamespaceEnforcement_DifferentNamesp
 		},
 	})
 	s.Require().Error(err)
-	s.Require().ErrorIs(err, db.ErrForeignKeyViolation)
+	s.Require().ErrorIs(err, db.ErrNamespaceMismatch)
 }
 
 func (s *RegisteredResourcesSuite) Test_SameNamespaceEnforcement_SameNamespace_Succeeds() {
@@ -1939,6 +1925,69 @@ func (s *RegisteredResourcesSuite) Test_SameNamespaceEnforcement_SameNamespace_S
 	s.Require().Len(resVal.GetActionAttributeValues(), 1)
 }
 
+func (s *RegisteredResourcesSuite) Test_SameNamespaceEnforcement_ActionIDDifferentNamespace_Fails() {
+	comNsID := s.getNamespaceID("example.com")
+	netNsID := s.getNamespaceID("example.net")
+
+	res, err := s.db.PolicyClient.CreateRegisteredResource(s.ctx, &registeredresources.CreateRegisteredResourceRequest{
+		NamespaceId: comNsID,
+		Name:        fmt.Sprintf("test_rr_action_id_ns_mismatch_%d", time.Now().UnixNano()),
+	})
+	s.Require().NoError(err)
+	s.NotNil(res)
+
+	wrongAction, err := s.db.PolicyClient.CreateAction(s.ctx, &pbActions.CreateActionRequest{
+		Name:        fmt.Sprintf("rr_wrong_action_id_%d", time.Now().UnixNano()),
+		NamespaceId: netNsID,
+	})
+	s.Require().NoError(err)
+
+	_, err = s.db.PolicyClient.CreateRegisteredResourceValue(s.ctx, &registeredresources.CreateRegisteredResourceValueRequest{
+		ResourceId: res.GetId(),
+		Value:      fmt.Sprintf("rr_val_action_id_mismatch_%d", time.Now().UnixNano()),
+		ActionAttributeValues: []*registeredresources.ActionAttributeValue{
+			{
+				ActionIdentifier: &registeredresources.ActionAttributeValue_ActionId{ActionId: wrongAction.GetId()},
+				AttributeValueIdentifier: &registeredresources.ActionAttributeValue_AttributeValueFqn{
+					AttributeValueFqn: "https://example.com/attr/attr1/value/value1",
+				},
+			},
+		},
+	})
+	s.Require().Error(err)
+	s.Require().ErrorIs(err, db.ErrNamespaceMismatch)
+}
+
+func (s *RegisteredResourcesSuite) Test_UnnamespacedResource_NamespacedActionID_Fails() {
+	res, err := s.db.PolicyClient.CreateRegisteredResource(s.ctx, &registeredresources.CreateRegisteredResourceRequest{
+		Name: fmt.Sprintf("test_rr_unnamespaced_%d", time.Now().UnixNano()),
+	})
+	s.Require().NoError(err)
+	s.NotNil(res)
+	s.Nil(res.GetNamespace())
+
+	namespacedAction, err := s.db.PolicyClient.CreateAction(s.ctx, &pbActions.CreateActionRequest{
+		Name:        fmt.Sprintf("rr_namespaced_action_%d", time.Now().UnixNano()),
+		NamespaceId: s.getNamespaceID("example.com"),
+	})
+	s.Require().NoError(err)
+
+	_, err = s.db.PolicyClient.CreateRegisteredResourceValue(s.ctx, &registeredresources.CreateRegisteredResourceValueRequest{
+		ResourceId: res.GetId(),
+		Value:      fmt.Sprintf("rr_val_unnamespaced_%d", time.Now().UnixNano()),
+		ActionAttributeValues: []*registeredresources.ActionAttributeValue{
+			{
+				ActionIdentifier: &registeredresources.ActionAttributeValue_ActionId{ActionId: namespacedAction.GetId()},
+				AttributeValueIdentifier: &registeredresources.ActionAttributeValue_AttributeValueFqn{
+					AttributeValueFqn: "https://example.com/attr/attr1/value/value1",
+				},
+			},
+		},
+	})
+	s.Require().Error(err)
+	s.Require().ErrorIs(err, db.ErrNamespaceMismatch)
+}
+
 func (s *RegisteredResourcesSuite) Test_CreateRegisteredResourceValue_WithNamespacedCustomActionName_Succeeds() {
 	nsID := s.getNamespaceID("example.com")