feat(policy): dynamic attribute value entitlement mappings

service/authorization/v2/authorization.go

@@ -98,7 +98,7 @@ func NewRegistration() *serviceregistry.Service[authzV2Connect.AuthorizationServ
 				}
 
 				retriever := access.NewEntitlementPolicyRetriever(as.sdk)
-				as.cache, err = NewEntitlementPolicyCache(context.Background(), l, retriever, cacheClient, refreshInterval)
+				as.cache, err = NewEntitlementPolicyCache(context.Background(), l, retriever, cacheClient, refreshInterval, authZCfg.AllowDynamicValueMappings)
 				if err != nil {
 					l.Error("failed to create entitlement policy cache", slog.Any("error", err))
 					panic(fmt.Errorf("failed to create entitlement policy cache: %w", err))
@@ -147,7 +147,7 @@ func (as *Service) GetEntitlements(ctx context.Context, req *connect.Request[aut
 	withComprehensiveHierarchy := req.Msg.GetWithComprehensiveHierarchy()
 
 	// When authorization service can consume cached policy, switch to the other PDP (process based on policy passed in)
-	pdp, err := access.NewJustInTimePDP(ctx, as.logger, as.sdk, as.cache, as.config.AllowDirectEntitlements, as.config.EnforceNamespacedEntitlements)
+	pdp, err := access.NewJustInTimePDP(ctx, as.logger, as.sdk, as.cache, as.config.AllowDirectEntitlements, as.config.AllowDynamicValueMappings, as.config.EnforceNamespacedEntitlements)
 	if err != nil {
 		return nil, statusifyError(ctx, as.logger, errors.Join(ErrFailedToGetEntitlements, ErrFailedToInitPDP, err))
 	}
@@ -174,7 +174,7 @@ func (as *Service) GetDecision(ctx context.Context, req *connect.Request[authzV2
 		return nil, err
 	}
 
-	pdp, err := access.NewJustInTimePDP(ctx, as.logger, as.sdk, as.cache, as.config.AllowDirectEntitlements, as.config.EnforceNamespacedEntitlements)
+	pdp, err := access.NewJustInTimePDP(ctx, as.logger, as.sdk, as.cache, as.config.AllowDirectEntitlements, as.config.AllowDynamicValueMappings, as.config.EnforceNamespacedEntitlements)
 	if err != nil {
 		return nil, statusifyError(ctx, as.logger, errors.Join(ErrFailedToInitPDP, err))
 	}
@@ -224,7 +224,7 @@ func (as *Service) GetDecisionMultiResource(ctx context.Context, req *connect.Re
 		return nil, err
 	}
 
-	pdp, err := access.NewJustInTimePDP(ctx, as.logger, as.sdk, as.cache, as.config.AllowDirectEntitlements, as.config.EnforceNamespacedEntitlements)
+	pdp, err := access.NewJustInTimePDP(ctx, as.logger, as.sdk, as.cache, as.config.AllowDirectEntitlements, as.config.AllowDynamicValueMappings, as.config.EnforceNamespacedEntitlements)
 	if err != nil {
 		return nil, statusifyError(ctx, as.logger, errors.Join(ErrFailedToInitPDP, err))
 	}
@@ -277,7 +277,7 @@ func (as *Service) GetDecisionBulk(ctx context.Context, req *connect.Request[aut
 		return nil, err
 	}
 
-	pdp, err := access.NewJustInTimePDP(ctx, as.logger, as.sdk, as.cache, as.config.AllowDirectEntitlements, as.config.EnforceNamespacedEntitlements)
+	pdp, err := access.NewJustInTimePDP(ctx, as.logger, as.sdk, as.cache, as.config.AllowDirectEntitlements, as.config.AllowDynamicValueMappings, as.config.EnforceNamespacedEntitlements)
 	if err != nil {
 		return nil, statusifyError(ctx, as.logger, errors.Join(ErrFailedToInitPDP, err))
 	}

service/authorization/v2/cache.go

@@ -14,10 +14,11 @@ import (
 )
 
 const (
-	attributesCacheKey          = "attributes_cache_key"
-	subjectMappingsCacheKey     = "subject_mappings_cache_key"
-	registeredResourcesCacheKey = "registered_resources_cache_key"
-	obligationsCacheKey         = "obligations_cache_key"
+	attributesCacheKey           = "attributes_cache_key"
+	subjectMappingsCacheKey      = "subject_mappings_cache_key"
+	dynamicValueMappingsCacheKey = "dynamic_value_mappings_cache_key"
+	registeredResourcesCacheKey  = "registered_resources_cache_key"
+	obligationsCacheKey          = "obligations_cache_key"
 )
 
 var (
@@ -48,6 +49,10 @@ type EntitlementPolicyCache struct {
 	// SDK-connected retriever to fetch fresh data from policy services
 	retriever *access.EntitlementPolicyRetriever
 
+	// allowDynamicValueMappings gates fetching the experimental dynamic value mappings, so cache
+	// health does not depend on that endpoint when the feature is disabled.
+	allowDynamicValueMappings bool
+
 	// Refresh state
 	configuredRefreshInterval time.Duration
 	stopRefresh               chan struct{}
@@ -60,10 +65,11 @@ type EntitlementPolicyCache struct {
 // The EntitlementPolicy struct holds all the cached entitlement policy, as generics allow one
 // data type per service cache instance.
 type EntitlementPolicy struct {
-	Attributes          []*policy.Attribute
-	SubjectMappings     []*policy.SubjectMapping
-	RegisteredResources []*policy.RegisteredResource
-	Obligations         []*policy.Obligation
+	Attributes           []*policy.Attribute
+	SubjectMappings      []*policy.SubjectMapping
+	DynamicValueMappings []*policy.DynamicValueMapping
+	RegisteredResources  []*policy.RegisteredResource
+	Obligations          []*policy.Obligation
 }
 
 // NewEntitlementPolicyCache holds a platform-provided cache client and manages a periodic refresh of
@@ -74,6 +80,7 @@ func NewEntitlementPolicyCache(
 	retriever *access.EntitlementPolicyRetriever,
 	cacheClient *cache.Cache,
 	cacheRefreshInterval time.Duration,
+	allowDynamicValueMappings bool,
 ) (*EntitlementPolicyCache, error) {
 	if cacheRefreshInterval == 0 {
 		return nil, ErrCacheDisabled
@@ -86,6 +93,7 @@ func NewEntitlementPolicyCache(
 		logger:                    l,
 		cacheClient:               cacheClient,
 		retriever:                 retriever,
+		allowDynamicValueMappings: allowDynamicValueMappings,
 		configuredRefreshInterval: cacheRefreshInterval,
 		stopRefresh:               make(chan struct{}),
 		refreshCompleted:          make(chan struct{}),
@@ -178,6 +186,15 @@ func (c *EntitlementPolicyCache) Refresh(ctx context.Context) error {
 	if err != nil {
 		return err
 	}
+	// Only fetch the experimental dynamic value mappings when enabled, so cache readiness does not
+	// depend on that endpoint while the feature is off.
+	var dynamicValueMappings []*policy.DynamicValueMapping
+	if c.allowDynamicValueMappings {
+		dynamicValueMappings, err = c.retriever.ListAllDynamicValueMappings(ctx)
+		if err != nil {
+			return err
+		}
+	}
 	registeredResources, err := c.retriever.ListAllRegisteredResources(ctx)
 	if err != nil {
 		return err
@@ -200,6 +217,16 @@ func (c *EntitlementPolicyCache) Refresh(ctx context.Context) error {
 		return errors.Join(ErrFailedToSet, err)
 	}
 
+	// Only cache dynamic value mappings when the feature is enabled, so a disabled feature does not
+	// store an empty slice (the fetch above is gated the same way).
+	if c.allowDynamicValueMappings {
+		err = c.cacheClient.Set(ctx, dynamicValueMappingsCacheKey, dynamicValueMappings, authzCacheTags)
+		if err != nil {
+			c.isCacheFilled = false
+			return errors.Join(ErrFailedToSet, err)
+		}
+	}
+
 	err = c.cacheClient.Set(ctx, registeredResourcesCacheKey, registeredResources, authzCacheTags)
 	if err != nil {
 		c.isCacheFilled = false
@@ -270,6 +297,28 @@ func (c *EntitlementPolicyCache) ListAllSubjectMappings(ctx context.Context) ([]
 	return subjectMappings, nil
 }
 
+// ListAllDynamicValueMappings returns the cached dynamic value entitlement mappings, or none on a cache miss
+func (c *EntitlementPolicyCache) ListAllDynamicValueMappings(ctx context.Context) ([]*policy.DynamicValueMapping, error) {
+	var (
+		mappings []*policy.DynamicValueMapping
+		ok       bool
+	)
+
+	cached, err := c.cacheClient.Get(ctx, dynamicValueMappingsCacheKey)
+	if err != nil {
+		if errors.Is(err, cache.ErrCacheMiss) {
+			return mappings, nil
+		}
+		return nil, fmt.Errorf("%w, dynamic value mappings: %w", ErrFailedToGet, err)
+	}
+
+	mappings, ok = cached.([]*policy.DynamicValueMapping)
+	if !ok {
+		return nil, fmt.Errorf("%w: %T", ErrCachedTypeNotExpected, cached)
+	}
+	return mappings, nil
+}
+
 // ListAllRegisteredResources returns the cached registered resources, or none in the event of a cache miss
 func (c *EntitlementPolicyCache) ListAllRegisteredResources(ctx context.Context) ([]*policy.RegisteredResource, error) {
 	var (

service/authorization/v2/cache_test.go

@@ -21,7 +21,7 @@ func Test_NewEntitlementPolicyCache(t *testing.T) {
 	refreshInterval := 10 * time.Second
 	mockCache, _ := cache.TestCacheClient(mockCacheExpiry)
 
-	c, err := NewEntitlementPolicyCache(ctx, l, nil, mockCache, refreshInterval)
+	c, err := NewEntitlementPolicyCache(ctx, l, nil, mockCache, refreshInterval, false)
 	require.NoError(t, err)
 	assert.NotNil(t, c)
 	assert.Equal(t, refreshInterval, c.configuredRefreshInterval)
@@ -33,11 +33,11 @@ func Test_EntitlementPolicyCache_RefreshInterval(t *testing.T) {
 	ctx := t.Context()
 	mockCache, _ := cache.TestCacheClient(mockCacheExpiry)
 
-	_, err := NewEntitlementPolicyCache(ctx, l, nil, mockCache, refreshInterval)
+	_, err := NewEntitlementPolicyCache(ctx, l, nil, mockCache, refreshInterval, false)
 	require.ErrorIs(t, err, ErrCacheDisabled)
 
 	refreshInterval = 10 * time.Second
-	c, err := NewEntitlementPolicyCache(ctx, l, nil, mockCache, refreshInterval)
+	c, err := NewEntitlementPolicyCache(ctx, l, nil, mockCache, refreshInterval, false)
 	require.NoError(t, err)
 	assert.NotNil(t, c)
 }
@@ -53,7 +53,7 @@ func Test_EntitlementPolicyCache_Enabled(t *testing.T) {
 	assert.False(t, c.IsEnabled())
 	assert.False(t, c.IsReady(ctx))
 
-	c, err = NewEntitlementPolicyCache(ctx, l, nil, mockCache, refreshInterval)
+	c, err = NewEntitlementPolicyCache(ctx, l, nil, mockCache, refreshInterval, false)
 	require.NoError(t, err)
 	assert.NotNil(t, c)
 	assert.True(t, c.IsEnabled())
@@ -65,7 +65,7 @@ func Test_EntitlementPolicyCache_CacheMiss(t *testing.T) {
 	ctx := t.Context()
 	mockCache, _ := cache.TestCacheClient(mockCacheExpiry)
 
-	c, err := NewEntitlementPolicyCache(ctx, l, nil, mockCache, 1*time.Hour)
+	c, err := NewEntitlementPolicyCache(ctx, l, nil, mockCache, 1*time.Hour, false)
 	require.NoError(t, err)
 
 	// No errors, but empty lists on cache misses
@@ -93,7 +93,7 @@ func Test_EntitlementPolicyCache_CacheHits(t *testing.T) {
 	_ = mockCache.Set(ctx, subjectMappingsCacheKey, subjMappingsList, nil)
 	_ = mockCache.Set(ctx, registeredResourcesCacheKey, resourcesList, nil)
 
-	c, err := NewEntitlementPolicyCache(ctx, l, nil, mockCache, 1*time.Hour)
+	c, err := NewEntitlementPolicyCache(ctx, l, nil, mockCache, 1*time.Hour, false)
 	require.NoError(t, err)
 
 	// Allow for some concurrency overhead in cache library to prevent flakiness in tests
@@ -114,3 +114,29 @@ func Test_EntitlementPolicyCache_CacheHits(t *testing.T) {
 	assert.Len(t, registeredResources, 1)
 	assert.Equal(t, "res1", registeredResources[0].GetName())
 }
+
+func Test_EntitlementPolicyCache_DynamicValueMappings(t *testing.T) {
+	ctx := t.Context()
+	mockCache, _ := cache.TestCacheClient(mockCacheExpiry)
+
+	c, err := NewEntitlementPolicyCache(ctx, l, nil, mockCache, 1*time.Hour, true)
+	require.NoError(t, err)
+	assert.True(t, c.allowDynamicValueMappings)
+
+	// Cache miss: empty result, no error
+	mappings, err := c.ListAllDynamicValueMappings(ctx)
+	require.NoError(t, err)
+	assert.Empty(t, mappings)
+
+	// Cache hit: returns what was set
+	dvmList := []*policy.DynamicValueMapping{{Id: "dvm-1"}}
+	_ = mockCache.Set(ctx, dynamicValueMappingsCacheKey, dvmList, nil)
+
+	// Allow for some concurrency overhead in cache library to prevent flakiness in tests
+	time.Sleep(10 * time.Millisecond)
+
+	mappings, err = c.ListAllDynamicValueMappings(ctx)
+	require.NoError(t, err)
+	assert.Len(t, mappings, 1)
+	assert.Equal(t, "dvm-1", mappings[0].GetId())
+}

service/authorization/v2/config.go

@@ -56,6 +56,9 @@ type Config struct {
 	// enable entity direct entitlements that do not require subject mappings
 	AllowDirectEntitlements bool `mapstructure:"allow_direct_entitlements" json:"allow_direct_entitlements" default:"false"`
 
+	// enable definition-level dynamic value mappings in access decisioning
+	AllowDynamicValueMappings bool `mapstructure:"allow_dynamic_value_mappings" json:"allow_dynamic_value_mappings" default:"false"`
+
 	// enforce strict namespaced entitlement evaluation behavior in access decisioning
 	EnforceNamespacedEntitlements bool `mapstructure:"enforce_namespaced_entitlements" json:"enforce_namespaced_entitlements" default:"false"`
 }
@@ -107,6 +110,7 @@ func (c *Config) LogValue() slog.Value {
 			),
 		),
 		slog.Bool("allow_direct_entitlements", c.AllowDirectEntitlements),
+		slog.Bool("allow_dynamic_value_mappings", c.AllowDynamicValueMappings),
 		slog.Bool("enforce_namespaced_entitlements", c.EnforceNamespacedEntitlements),
 	)
 }