feat(cli): add dynamic value mapping CRUD commands and e2e tests

[alkalescent]

Proposed Changes

• Add a policy dynamic-value-mappings command group to otdfctl (aliases dvm, dynamic-value-mapping) with create, get, list, update, and delete, mirroring the subject-mappings pattern. Wraps the DynamicValueMapping SDK client with a new handler, cobra commands, and man docs.
• Validate the resolver operator client-side (only IN / IN_CONTAINS; reject NOT_IN and unspecified), require exactly one of --attribute-definition-id / --attribute-definition-fqn, and require --selector and --operator together on update.
• Add an end-to-end bats suite (otdfctl/e2e/dynamic-value-mapping.bats) covering CRUD (table + --json), static-gate create, namespace id/fqn, sort/filter, and error/rejection cases (NOT_IN, missing operator/definition/action, HIERARCHY definition, value-subject-mapping coexistence).

Checklist

• I have added or updated unit tests
• I have added or updated integration tests (if appropriate)
• I have added or updated documentation

Testing Instructions

• cd otdfctl && golangci-lint run ./... && go test ./...
• Start and provision a local platform, then run the e2e suite:
  cd otdfctl && make test-bats (or bats ./e2e/dynamic-value-mapping.bats).
  Verified locally: all 13 tests pass against a live platform.

Summary by CodeRabbit

• New Features
  • Added CLI support to create, retrieve, list, update, and delete dynamic value mappings.
  • Added filtering, pagination, sorting, metadata labels, resolver configuration, actions, and optional subject-condition gates.
  • Added validation for supported operators and required option combinations.
• Documentation
  • Added command reference pages with usage, flags, constraints, and examples.
• Tests
  • Added end-to-end coverage for lifecycle operations, validation, filtering, sorting, and JSON/table output.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[coderabbitai]

Warning

Review limit reached

@alkalescent, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 24 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 70145b91-b2b1-4fc2-b9c3-031ae535ac5f

📥 Commits

Reviewing files that changed from the base of the PR and between e520761 and 1b8b2f9.

📒 Files selected for processing (3)

• otdfctl/cmd/policy/dynamicValueMappings.go
• otdfctl/docs/man/policy/dynamic-value-mappings/create.md
• otdfctl/e2e/dynamic-value-mapping.bats

📝 Walkthrough

Walkthrough

Adds SDK-backed handlers and a Cobra command group for creating, retrieving, listing, updating, and deleting dynamic value mappings, with documentation and end-to-end coverage for validation and lifecycle behavior.

Changes

Dynamic Value Mapping CLI

Layer / File(s)	Summary
SDK handler operations otdfctl/pkg/handlers/dynamicvaluemappings.go	Adds handler methods for dynamic value mapping CRUD operations, filtering, pagination, sorting, namespace resolution, and metadata updates.
CLI command flow otdfctl/cmd/policy/dynamicValueMappings.go, otdfctl/cmd/policy/policy.go	Registers the command group and implements flag validation, action/operator parsing, CRUD handlers, table output, pagination, confirmation, and metadata handling.
Command documentation otdfctl/docs/man/policy/dynamic-value-mappings/*	Documents dynamic value mapping semantics, supported operators, constraints, examples, and CRUD command flags.
End-to-end lifecycle coverage otdfctl/e2e/dynamic-value-mapping.bats	Tests creation, validation failures, filtering, sorting, retrieval, updates, and deletion using provisioned policy fixtures.

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
  participant User
  participant CobraCommands
  participant Handler
  participant DynamicValueMappingSDK
  User->>CobraCommands: invoke dynamic value mapping command
  CobraCommands->>Handler: validate inputs and call operation
  Handler->>DynamicValueMappingSDK: send CRUD request
  DynamicValueMappingSDK-->>Handler: return mapping response
  Handler-->>CobraCommands: return mapping data
  CobraCommands-->>User: render table or JSON

Loading

Suggested labels: comp:policy, comp:sdk, docs, size/m

Poem

A rabbit typed commands with a hop and a cheer,
Mappings CRUD danced from far to near.
Selectors matched and actions took flight,
Tests checked each burrow from morning to night.
“IN” and “IN_CONTAINS” made the garden glow!

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: new dynamic value mapping CLI CRUD commands plus e2e tests.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch DSPX-4096-otdfctl-dynamic-value-mappings

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	212.845281ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	110.61771ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	425.439964ms
Throughput	235.05 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	49.481285138s
Average Latency	491.846415ms
Throughput	101.05 requests/second

[coderabbitai]

Actionable comments posted: 6

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@otdfctl/cmd/policy/dynamicValueMappings.go`:
- Around line 145-166: Update the validation block in the command handler to
reject requests when both existingSCSID and newScsJSON are provided, using the
same mutual-exclusivity pattern and cli.ExitWithError as the
attribute-definition checks. Preserve requests where either value is provided
alone or both are omitted.

In `@otdfctl/docs/man/policy/dynamic-value-mappings/create.md`:
- Around line 59-60: Insert a blank line immediately before each of the three
opening fenced code examples in the dynamic value mappings documentation,
including the examples near the referenced sections, to satisfy Markdownlint
MD031.
- Around line 24-25: Update the --action option description in the create
dynamic value mapping documentation to state that at least one action is
required. Keep the existing action examples and align the wording with the
validation enforced by policyCreateDynamicValueMapping.

In `@otdfctl/e2e/dynamic-value-mapping.bats`:
- Line 128: Update the dynamic value mapping create invocation in the affected
test to use the singular dynamic-value-mapping command alias instead of dvm,
while preserving all existing arguments and assertions so the advertised alias
is exercised.
- Around line 223-229: Extend the “Delete dynamic value mapping” test after the
existing successful delete assertions by calling run_otdfctl_dvm get --id
"$to_delete" and asserting failure. Keep the current deletion-success and ID
checks, and verify the deleted mapping is no longer retrievable.
- Around line 11-19: Update every fixture-provisioning command in the test,
including the namespace and dynamic-value mapping setup sites, to run the
otdfctl command separately from jq. Use run and assert_success before parsing
output, then extract the returned ID and validate it is non-empty before
continuing, so failed CLI commands cannot be masked by jq or produce misleading
assertions.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 3caca32b-e590-45b2-9832-44215199dd47

📥 Commits

Reviewing files that changed from the base of the PR and between 5bae1eb and e520761.

📒 Files selected for processing (10)

• otdfctl/cmd/policy/dynamicValueMappings.go
• otdfctl/cmd/policy/policy.go
• otdfctl/docs/man/policy/dynamic-value-mappings/_index.md
• otdfctl/docs/man/policy/dynamic-value-mappings/create.md
• otdfctl/docs/man/policy/dynamic-value-mappings/delete.md
• otdfctl/docs/man/policy/dynamic-value-mappings/get.md
• otdfctl/docs/man/policy/dynamic-value-mappings/list.md
• otdfctl/docs/man/policy/dynamic-value-mappings/update.md
• otdfctl/e2e/dynamic-value-mapping.bats
• otdfctl/pkg/handlers/dynamicvaluemappings.go

[github-actions]

X-Test Results

✅ go@pull-3768-pull-3768
✅ go@pull-3768-main
✅ go@main-main
✅ go@main-pull-3768
✅ java@main-pull-3768
✅ go@pull-3768-v0.9.0
✅ java@main-main
✅ js@main-pull-3768
✅ go@main-v0.9.0
✅ java@main-v0.9.0
✅ js@main-v0.9.0
✅ js@main-main
cukes-report
opentdfplatformG2U90M.dockerbuild
govulncheck-failure-8
govulncheck-failure-3
govulncheck-failure-2
govulncheck-failure-0
govulncheck-failure-1
govulncheck-failure-5

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	170.043092ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	92.058048ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	361.529967ms
Throughput	276.60 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	44.647006614s
Average Latency	445.088847ms
Throughput	111.99 requests/second

[github-actions]

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

• examples
• otdfctl
• sdk
• service
• lib/fixtures
• tests-bdd

See the workflow run for details.

[github-actions]

X-Test Results

✅ go@pull-3768-main
✅ go@main-main
✅ go@main-pull-3768
✅ go@pull-3768-v0.9.0
✅ go@main-v0.9.0
✅ go@pull-3768-pull-3768
✅ java@main-pull-3768
✅ java@main-main
✅ js@main-main
✅ js@main-pull-3768
cukes-report
✅ js@main-v0.9.0
✅ java@main-v0.9.0
opentdfplatformL5P5LS.dockerbuild
govulncheck-failure-0
govulncheck-failure-8
govulncheck-failure-3
govulncheck-failure-2
govulncheck-failure-1
govulncheck-failure-5