chore(policy): tests for namespaced policy config flag enforcement

service/policy/actions/actions_test.go

@@ -5,9 +5,12 @@ import (
 	"testing"
 
 	"buf.build/go/protovalidate"
+	"connectrpc.com/connect"
 	"github.com/opentdf/platform/protocol/go/common"
 	"github.com/opentdf/platform/protocol/go/policy"
 	"github.com/opentdf/platform/protocol/go/policy/actions"
+	"github.com/opentdf/platform/service/logger"
+	policyconfig "github.com/opentdf/platform/service/policy/config"
 	"github.com/stretchr/testify/suite"
 )
 
@@ -58,6 +61,21 @@ func TestActionServiceProtos(t *testing.T) {
 	suite.Run(t, new(ActionSuite))
 }
 
+func (s *ActionSuite) Test_CreateAction_NamespacedPolicyRequiresNamespace() {
+	service := &ActionService{
+		logger: logger.CreateTestLogger(),
+		config: &policyconfig.Config{NamespacedPolicy: true},
+	}
+
+	_, err := service.CreateAction(s.T().Context(), connect.NewRequest(&actions.CreateActionRequest{
+		Name: "valid_name",
+	}))
+
+	s.Require().Error(err)
+	s.Require().Equal(connect.CodeInvalidArgument, connect.CodeOf(err))
+	s.Require().Contains(err.Error(), "either namespace_id or namespace_fqn must be provided")
+}
+
 func (s *ActionSuite) Test_CreateActionRequest_Fails() {
 	for _, name := range actionNamesInvalidFormat {
 		s.Run(name, func() {

service/policy/registeredresources/registered_resources_test.go

@@ -5,8 +5,11 @@ import (
 	"testing"
 
 	"buf.build/go/protovalidate"
+	"connectrpc.com/connect"
 	"github.com/opentdf/platform/protocol/go/policy"
 	"github.com/opentdf/platform/protocol/go/policy/registeredresources"
+	"github.com/opentdf/platform/service/logger"
+	policyconfig "github.com/opentdf/platform/service/policy/config"
 	"github.com/stretchr/testify/suite"
 )
 
@@ -27,6 +30,21 @@ func TestRegisteredResourcesServiceProtos(t *testing.T) {
 	suite.Run(t, new(RegisteredResourcesSuite))
 }
 
+func (s *RegisteredResourcesSuite) TestCreateRegisteredResource_NamespacedPolicyRequiresNamespace() {
+	service := &RegisteredResourcesService{
+		logger: logger.CreateTestLogger(),
+		config: &policyconfig.Config{NamespacedPolicy: true},
+	}
+
+	_, err := service.CreateRegisteredResource(s.T().Context(), connect.NewRequest(&registeredresources.CreateRegisteredResourceRequest{
+		Name: validName,
+	}))
+
+	s.Require().Error(err)
+	s.Require().Equal(connect.CodeInvalidArgument, connect.CodeOf(err))
+	s.Require().Contains(err.Error(), "namespace is required: provide either namespace_id or namespace_fqn")
+}
+
 const (
 	validName  = "name"
 	validValue = "value"

service/policy/resourcemapping/resource_mapping_test.go

@@ -4,7 +4,10 @@ import (
 	"testing"
 
 	"buf.build/go/protovalidate"
+	"connectrpc.com/connect"
 	"github.com/opentdf/platform/protocol/go/policy/resourcemapping"
+	"github.com/opentdf/platform/service/logger"
+	policyconfig "github.com/opentdf/platform/service/policy/config"
 	"github.com/stretchr/testify/require"
 )
 
@@ -60,6 +63,22 @@ func getValidator() protovalidate.Validator {
 	return v
 }
 
+func Test_CreateResourceMapping_NamespacedPolicyRequiresNamespace(t *testing.T) {
+	service := ResourceMappingService{
+		logger: logger.CreateTestLogger(),
+		config: &policyconfig.Config{NamespacedPolicy: true},
+	}
+
+	_, err := service.CreateResourceMapping(t.Context(), connect.NewRequest(&resourcemapping.CreateResourceMappingRequest{
+		AttributeValueId: validUUID,
+		Terms:            []string{"term1"},
+	}))
+
+	require.Error(t, err)
+	require.Equal(t, connect.CodeInvalidArgument, connect.CodeOf(err))
+	require.Contains(t, err.Error(), "namespace is required: provide either namespace_id, namespace_fqn, or group_id")
+}
+
 func getMaxTerms() []string {
 	maxTerms := make([]string, 1000)
 	for i := range maxTerms {

service/policy/subjectmapping/subject_mapping_test.go

@@ -4,8 +4,11 @@ import (
 	"testing"
 
 	"buf.build/go/protovalidate"
+	"connectrpc.com/connect"
 	"github.com/opentdf/platform/protocol/go/policy"
 	"github.com/opentdf/platform/protocol/go/policy/subjectmapping"
+	"github.com/opentdf/platform/service/logger"
+	policyconfig "github.com/opentdf/platform/service/policy/config"
 	"github.com/stretchr/testify/require"
 )
 
@@ -37,6 +40,62 @@ var validActions = []*policy.Action{
 	},
 }
 
+func newNamespacedSubjectMappingService() SubjectMappingService {
+	return SubjectMappingService{
+		logger: logger.CreateTestLogger(),
+		config: &policyconfig.Config{
+			NamespacedPolicy: true,
+		},
+	}
+}
+
+func validSubjectConditionSetCreate() *subjectmapping.SubjectConditionSetCreate {
+	return &subjectmapping.SubjectConditionSetCreate{
+		SubjectSets: []*policy.SubjectSet{
+			{
+				ConditionGroups: []*policy.ConditionGroup{
+					{
+						Conditions: []*policy.Condition{
+							{
+								Operator:                     policy.SubjectMappingOperatorEnum_SUBJECT_MAPPING_OPERATOR_ENUM_IN,
+								SubjectExternalSelectorValue: ".some_field",
+								SubjectExternalValues:        []string{"some_value"},
+							},
+						},
+						BooleanOperator: policy.ConditionBooleanTypeEnum_CONDITION_BOOLEAN_TYPE_ENUM_OR,
+					},
+				},
+			},
+		},
+	}
+}
+
+func Test_CreateSubjectMapping_NamespacedPolicyRequiresNamespace(t *testing.T) {
+	service := newNamespacedSubjectMappingService()
+
+	_, err := service.CreateSubjectMapping(t.Context(), connect.NewRequest(&subjectmapping.CreateSubjectMappingRequest{
+		AttributeValueId:       fakeID,
+		Actions:                validActions,
+		NewSubjectConditionSet: validSubjectConditionSetCreate(),
+	}))
+
+	require.Error(t, err)
+	require.Equal(t, connect.CodeInvalidArgument, connect.CodeOf(err))
+	require.Contains(t, err.Error(), "either namespace_id or namespace_fqn must be provided")
+}
+
+func Test_CreateSubjectConditionSet_NamespacedPolicyRequiresNamespace(t *testing.T) {
+	service := newNamespacedSubjectMappingService()
+
+	_, err := service.CreateSubjectConditionSet(t.Context(), connect.NewRequest(&subjectmapping.CreateSubjectConditionSetRequest{
+		SubjectConditionSet: validSubjectConditionSetCreate(),
+	}))
+
+	require.Error(t, err)
+	require.Equal(t, connect.CodeInvalidArgument, connect.CodeOf(err))
+	require.Contains(t, err.Error(), "either namespace_id or namespace_fqn must be provided")
+}
+
 func Test_CreateSubjectMappingRequest_InvalidSubjectConditionSet_Fails(t *testing.T) {
 	testCases := []struct {
 		name           string