From ad4fdfe278375b89a4fe7592b2dad2255b0b33b2 Mon Sep 17 00:00:00 2001 From: Mary Dickson Date: Tue, 21 Apr 2026 10:21:42 -0700 Subject: [PATCH] fix(sdk): require at least one FQN in ForAttributeValues Add a panic guard for zero-argument calls to ForAttributeValues, aligning with the Java SDK's IllegalArgumentException and the proto's 1-20 FQN constraint. Callers passing zero FQNs now get a clear error instead of a silently invalid Resource. Co-Authored-By: Claude Opus 4.6 (1M context) Signed-off-by: Mary Dickson --- protocol/go/authorization/v2/resource.gen.go | 4 ++++ .../go/internal/authorization/v2/resource.go | 4 ++++ .../internal/authorization/v2/resource_test.go | 18 +++++++----------- 3 files changed, 15 insertions(+), 11 deletions(-) diff --git a/protocol/go/authorization/v2/resource.gen.go b/protocol/go/authorization/v2/resource.gen.go index cf7db3ed07..14402eb7d4 100644 --- a/protocol/go/authorization/v2/resource.gen.go +++ b/protocol/go/authorization/v2/resource.gen.go @@ -5,7 +5,11 @@ package authorizationv2 // ForAttributeValues returns a Resource containing the given attribute value FQNs. // This is the most common Resource variant, used when authorizing against // attribute values attached to data (e.g. those on a TDF). +// At least one FQN is required; calling with zero arguments panics. func ForAttributeValues(fqns ...string) *Resource { + if len(fqns) == 0 { + panic("ForAttributeValues requires at least one FQN") + } return &Resource{ Resource: &Resource_AttributeValues_{ AttributeValues: &Resource_AttributeValues{ diff --git a/protocol/go/internal/authorization/v2/resource.go b/protocol/go/internal/authorization/v2/resource.go index 294b8219c4..c4fd04b663 100644 --- a/protocol/go/internal/authorization/v2/resource.go +++ b/protocol/go/internal/authorization/v2/resource.go @@ -7,7 +7,11 @@ import ( // ForAttributeValues returns a Resource containing the given attribute value FQNs. // This is the most common Resource variant, used when authorizing against // attribute values attached to data (e.g. those on a TDF). +// At least one FQN is required; calling with zero arguments panics. func ForAttributeValues(fqns ...string) *authorizationv2.Resource { + if len(fqns) == 0 { + panic("ForAttributeValues requires at least one FQN") + } return &authorizationv2.Resource{ Resource: &authorizationv2.Resource_AttributeValues_{ AttributeValues: &authorizationv2.Resource_AttributeValues{ diff --git a/protocol/go/internal/authorization/v2/resource_test.go b/protocol/go/internal/authorization/v2/resource_test.go index 9918252a3c..06ed296b96 100644 --- a/protocol/go/internal/authorization/v2/resource_test.go +++ b/protocol/go/internal/authorization/v2/resource_test.go @@ -45,17 +45,13 @@ func TestForAttributeValues_Single(t *testing.T) { } } -func TestForAttributeValues_ZeroArgs(t *testing.T) { - r := ForAttributeValues() - - av, ok := r.GetResource().(*authorizationv2proto.Resource_AttributeValues_) - if !ok { - t.Fatal("expected AttributeValues resource") - } - got := av.AttributeValues.GetFqns() - if len(got) != 0 { - t.Fatalf("fqns len = %d, want 0", len(got)) - } +func TestForAttributeValues_ZeroArgs_Panics(t *testing.T) { + defer func() { + if r := recover(); r == nil { + t.Fatal("expected panic for zero FQNs, but did not panic") + } + }() + ForAttributeValues() } func TestForRegisteredResourceValueFqn(t *testing.T) {