feat(policy)!: optional namespace for RRs

[alkalescent]

Proposed Changes

• We made namespacing required for RRs. That decision caused breaking changes. This PR makes namespacing optional for RRs and introduces an enforcement flag for the namespaced policy objects change.

Checklist

• I have added or updated unit tests
• I have added or updated integration tests (if appropriate)
• I have added or updated documentation

Testing Instructions

Summary by CodeRabbit

• New Features

  • Registered resources can be created without specifying a namespace.
  • Action lookup is namespace-aware with a fallback to non-namespaced actions.
  • Non-namespaced and namespaced resources may coexist with the same name.

• Behavior Change

  • When namespaced policy mode is enabled, creation requires a namespace; otherwise namespace is optional.
  • Ambiguous name lookups deterministically prefer non-namespaced matches.

• Tests

  • Expanded integration tests covering namespace-optional flows, duplicates, lookup semantics, and listing.

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses a previous breaking change by making namespaces optional for Registered Resources (RRs) during creation. It introduces a configurable flag, EnforceNamespace, allowing administrators to control whether a namespace is required. This change provides greater flexibility in resource management while offering a mechanism to enforce stricter policy object creation when desired.

Highlights

• Optional Namespaces for Registered Resources (RRs): The requirement for a namespace when creating Registered Resources has been made optional, reverting a previous breaking change.
• Configurable Namespace Enforcement: A new configuration flag, EnforceNamespace, has been introduced. When set to true, it will re-enable the requirement for namespaces on policy object creation, providing a controlled transition.
• Database and Service Logic Updates: The underlying database queries and Go service logic have been updated to correctly handle and persist Registered Resources that are created without an explicit namespace.
• Protobuf Validation Relaxed: The Protobuf validation rules for CreateRegisteredResourceRequest have been adjusted to reflect that namespace_id or namespace_fqn are no longer strictly required by default.
• Comprehensive Test Coverage: New integration and unit tests have been added to verify the successful creation, retrieval, and listing of Registered Resources when no namespace is provided.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Changelog

• service/integration/registered_resources_test.go
  • Added new integration tests for creating registered resources without a namespace.
  • Added tests for retrieving registered resources by ID and name when no namespace is provided.
  • Added a test to ensure duplicate names without namespaces fail.
  • Added a test to verify that registered resources without namespaces are included in the general list.
• service/policy/config/config.go
  • Added EnforceNamespace boolean field to the Config struct, defaulting to false.
• service/policy/db/queries/registered_resources.sql
  • Modified the createRegisteredResource SQL query to allow namespace_id and namespace_fqn to be null during insertion.
  • Updated the SELECT clause to conditionally build the namespace JSON object, returning NULL if no namespace is associated.
  • Changed JOIN attribute_namespaces to LEFT JOIN attribute_namespaces.
• service/policy/db/registered_resources.go
  • Updated CreateRegisteredResource to use hydrateNamespaceFromInterface which can handle a nil namespace.
• service/policy/db/registered_resources.sql.go
  • Updated the generated createRegisteredResource SQL query to match the changes in registered_resources.sql.
  • Changed the Namespace field type in createRegisteredResourceRow from []byte to interface{} to accommodate NULL values.
• service/policy/registeredresources/registered_resources.go
  • Added conditional logic in CreateRegisteredResource to check the EnforceNamespace config flag and return an InvalidArgument error if a namespace is missing when enforcement is enabled.
  • Imported the errors package.
• service/policy/registeredresources/registered_resources.proto
  • Modified the CreateRegisteredResourceRequest message to make the namespace_id or namespace_fqn fields optional by setting required: false in the buf.validate.message option.
• service/policy/registeredresources/registered_resources_test.go
  • Added a test case to TestCreateRegisteredResource_Valid_Succeeds for creating a resource without a namespace.
  • Removed the 'Missing Namespace' test case from TestCreateRegisteredResource_Invalid_Fails as it is no longer an invalid scenario by default.

Ignored Files

• Ignored by pattern: protocol/**/* (1)
  • protocol/go/policy/registeredresources/registered_resources.pb.go

Activity

• No human activity (comments, reviews, or progress updates) has been recorded on this pull request yet.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

---

Namespace once firm, Now optional, a new path, Flexibility.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request correctly makes namespaces optional for Registered Resources by introducing an enforce_namespace feature flag. The changes are consistently applied across the database layer, service logic, and API definitions, and are accompanied by a good set of tests. I've identified a potential ambiguity issue when retrieving resources by name where duplicates exist across namespaces and have suggested a new test case to highlight this. I've also suggested an additional test for completeness to ensure uniqueness constraints are handled correctly in mixed-namespace scenarios.

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	214.552173ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	112.093212ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	385.234898ms
Throughput	259.58 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	40.702277669s
Average Latency	405.309382ms
Throughput	122.84 requests/second

[github-actions]

X-Test Results

✅ go-pull-3165
✅ java-pull-3165
✅ go-v0.9.0
✅ js-pull-3165
✅ java-v0.9.0
✅ js-v0.9.0
test-cases-mapping-report
bats-test-results
cukes-report
opentdfplatformQ8E42O.dockerbuild

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	192.611492ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	98.203703ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	387.332505ms
Throughput	258.18 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	40.068316787s
Average Latency	399.30112ms
Throughput	124.79 requests/second

[github-actions]

X-Test Results

✅ go-pull-3165
✅ go-v0.9.0
✅ java-pull-3165
✅ java-v0.9.0
✅ js-pull-3165
✅ js-v0.9.0
test-cases-mapping-report
bats-test-results
cukes-report
opentdfplatformZS5YKU.dockerbuild

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	197.515964ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	92.844367ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	367.235891ms
Throughput	272.30 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.268139609s
Average Latency	390.297076ms
Throughput	127.33 requests/second

[github-actions]

X-Test Results

✅ go-pull-3165
✅ go-v0.9.0
✅ java-pull-3165
✅ js-pull-3165
✅ java-v0.9.0
✅ js-v0.9.0
cukes-report
test-cases-mapping-report
bats-test-results
opentdfplatform9D509P.dockerbuild

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	167.997504ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	85.704458ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	406.577308ms
Throughput	245.96 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.807196653s
Average Latency	386.277433ms
Throughput	128.84 requests/second

[github-actions]

X-Test Results

✅ go-pull-3165
✅ go-v0.9.0
✅ java-pull-3165
✅ java-v0.9.0
✅ js-v0.9.0
✅ js-pull-3165
test-cases-mapping-report
bats-test-results
cukes-report
opentdfplatformI40Q5T.dockerbuild

[strantalis]

@CodeRabbit review

[coderabbitai]

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Namespace support for registered resources was made optional across layers: proto validation relaxed, handler enforces namespace only when NamespacedPolicy is enabled, DB/SQL and generated Go accept NULL namespaces and prefer non‑namespaced results, action lookup became namespace‑aware with a non‑namespaced fallback, and tests were extended.

Changes

Cohort / File(s)	Summary
Database SQL & Generated Go service/policy/db/queries/registered_resources.sql, service/policy/db/registered_resources.sql.go	createRegisteredResource WHERE allows NULL namespace; attribute_namespaces JOIN → LEFT JOIN; namespace returned conditionally (JSON or NULL); getRegisteredResource uses ORDER BY r.namespace_id NULLS FIRST LIMIT 1 to prefer non‑namespaced rows; generated row type Namespace []byte → interface{}.
Database Go Logic service/policy/db/registered_resources.go	Handle NULL namespace via hydrateNamespaceFromInterface; action lookup now passes NamespaceID and falls back to non‑namespaced lookup on db.ErrNotFound; added errors and pgtype imports.
API Layer: Proto & Handler service/policy/registeredresources/registered_resources.proto, service/policy/registeredresources/registered_resources.go	Proto oneof validation for namespace_id/namespace_fqn changed from required → optional. Handler enforces namespace presence only when NamespacedPolicy is enabled and returns InvalidArgument if missing.
Integration & Unit Tests service/integration/registered_resources_test.go, service/policy/registeredresources/registered_resources_test.go	Added numerous integration tests covering namespace‑optional creation, non‑namespaced values, duplicate‑name constraint, same‑name coexistence, deterministic name lookup; unit test updated to accept creation without namespace.

Sequence Diagram(s)

sequenceDiagram
  participant Client as Client
  participant API as Policy API
  participant DB as Database
  participant Action as Action Resolver

  Client->>API: CreateRegisteredResource(req with/without namespace)
  API->>API: validate request (proto oneof optional)
  alt NamespacedPolicy enabled and no namespace provided
    API-->>Client: InvalidArgument (namespace required)
  else proceed
    API->>DB: INSERT registered_resource (namespace may be NULL)
    DB-->>API: inserted row (namespace JSON or NULL)
    API->>Action: Resolve action by name (+ NamespaceID if present)
    alt namespaced lookup fails and NamespaceID was provided
      API->>Action: Resolve action by name (no NamespaceID fallback)
    end
    API-->>Client: return created resource (nullable namespace)
  end

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~40 minutes

Poem

🐰 I hopped through SQL, tidy and spry,
Namespaces optional — I gave it a try.
Lookups first local, then leap to the free,
NULLs and names now live calm with me.
One rabbit, two names — both sit happily.

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'feat(policy)!: optional namespace for RRs' clearly and specifically describes the main change: making namespace optional for registered resources.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch DSPX-2496-ns-optional

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	189.42843ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	95.510054ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	379.913673ms
Throughput	263.22 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	40.210528899s
Average Latency	399.618148ms
Throughput	124.35 requests/second

[github-actions]

X-Test Results

✅ go-pull-3165
✅ go-v0.9.0
✅ java-pull-3165
✅ java-v0.9.0
✅ js-pull-3165
✅ js-v0.9.0
test-cases-mapping-report
cukes-report
bats-test-results
opentdfplatformEH44SF.dockerbuild

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	187.414217ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	94.046674ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	387.47458ms
Throughput	258.08 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.838305982s
Average Latency	396.799859ms
Throughput	125.51 requests/second

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@service/policy/db/registered_resources.go`:
- Around line 595-601: The fallback branch that calls c.queries.getAction when
nsUUID.Valid and errors.Is(err, db.ErrNotFound) currently returns the raw query
error; update it to apply the same error normalization used for the initial
getAction call so driver/query errors are mapped to the repository sentinel
errors before returning. Specifically, after assigning a, err =
c.queries.getAction(ctx, actionParams) in the fallback, run the same
normalization logic that the first getAction call uses (the mapping that
converts driver/query errors into repo sentinel errors) and return that
normalized error instead of the raw err; ensure this uses the existing
error-mapping routine so behavior for nsUUID, actionParams, c.queries.getAction
and db.ErrNotFound is consistent.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 11faf3da-3662-4218-8279-14761c6b279d

📥 Commits

Reviewing files that changed from the base of the PR and between 1cd5cef and e447539.

📒 Files selected for processing (1)

• service/policy/db/registered_resources.go

[github-actions]

X-Test Results

✅ go-pull-3165
✅ go-v0.9.0
✅ java-pull-3165
✅ js-pull-3165
✅ java-v0.9.0
✅ js-v0.9.0
cukes-report
test-cases-mapping-report
bats-test-results
opentdfplatformAGICQJ.dockerbuild

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	208.009505ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	104.852323ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	382.084189ms
Throughput	261.72 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	40.06224794s
Average Latency	398.913506ms
Throughput	124.81 requests/second

[github-actions]

X-Test Results

✅ go-pull-3165
✅ go-v0.9.0
✅ java-pull-3165
✅ java-v0.9.0
✅ js-pull-3165
✅ js-v0.9.0
cukes-report
test-cases-mapping-report
bats-test-results
opentdfplatformUA7JYY.dockerbuild

[c-r33d]

Can you change the title so this isn't marked as a breaking change

[alkalescent]

@c-r33d RIP, I enabled auto-merge before you commented