feat(policy): Seed existing namespaces with standard actions

[elizabethhealy]

Proposed Changes

• Database Migration: Added a new migration to retroactively seed standard CRUD actions into all existing namespaces.
• Idempotency: Implemented the migration using ON CONFLICT DO NOTHING to ensure it can be safely run multiple times.

Checklist

• I have added or updated unit tests
• I have added or updated integration tests (if appropriate)
• I have added or updated documentation

Testing Instructions

Summary by CodeRabbit

• Chores
  • Seeded standard CRUD actions (create, read, update, delete) for all existing namespaces via a new migration.
• Bug Fixes
  • Corrected fixture loading to only include namespace-scoped standard actions where appropriate.
• Documentation
  • Added an ADR defining a backup-first rollback posture and guidance for safe database migrations.

[coderabbitai]

📝 Walkthrough

Walkthrough

A migration seeds namespace-scoped standard CRUD actions for every existing namespace; the fixture loader now only reads global standard actions (where namespace_id IS NULL), and a new ADR formalizes backup-first rollback posture for database migrations.

Changes

Cohort / File(s)	Summary
Fixture Query Update service/internal/fixtures/fixtures.go	Change in loadMigratedStandardActions SQL filter to WHERE is_standard = TRUE AND namespace_id IS NULL, so only global (unnamespaced) standard actions are loaded.
Namespace-Scoped Actions Migration service/policy/db/migrations/20260331000000_seed_standard_actions_for_existing_namespaces.md, service/policy/db/migrations/20260331000000_seed_standard_actions_for_existing_namespaces.sql	New Goose migration: idempotently inserts create, read, update, delete actions for each existing attribute_namespaces row with namespace_id IS NOT NULL; Down is a no-op.
Operational Decision Record adr/decisions/2026-04-01-database-migration-backup-first-rollback.md	New ADR establishing backup/restore as the primary rollback mechanism for migrations and documenting expectations for Down scripts, validation, and runbooks.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• feat(policy): Enforce same namespace when actions referenced downstream #3206: Related changes to how standard actions are scoped/resolved by namespace; touches the same resolution/seeding concern.
• feat(policy): Seed namespaces with standard actions on creation + namespaced actions for obligation triggers #3161: Also coordinates creation/seeding of namespace-scoped standard actions and distinguishing global vs. namespaced actions.

Suggested reviewers

• jakedoublev
• alkalescent
• c-r33d

Poem

🐰 I hopped through migrations, carrots in tow,
I planted actions where namespaces grow.
Global standards I left standing tall,
Each namespace now answers when you call.
Hooray for seeds — a bunny’s gentle code show!

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The PR title 'feat(policy): Seed existing namespaces with standard actions' directly and clearly summarizes the main change: adding a database migration that retroactively seeds standard CRUD actions into all existing namespaces.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dspx-2540-migrate-standard-actions-when-enabled

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces a database migration to ensure that all existing namespaces are populated with the required standard CRUD actions. This change is necessary to support policy migration tooling that expects these actions to be present within each namespace scope, addressing a gap for namespaces created prior to the introduction of action namespacing.

Highlights

• Database Migration: Added a new migration to retroactively seed standard CRUD actions into all existing namespaces.
• Idempotency: Implemented the migration using ON CONFLICT DO NOTHING to ensure it can be safely run multiple times.
• Fixture Update: Updated the fixture loading logic to specifically target global standard actions by filtering for NULL namespace IDs.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

---

The namespaces stood empty and bare, / With standard actions missing in there. / A migration was run, / The work is now done, / And consistency fills up the air.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request introduces a database migration to retroactively seed standard actions for existing namespaces and updates the test fixtures to correctly filter for global standard actions. A high-severity issue was identified in the migration's rollback script, which is overly destructive as it deletes all namespaced standard actions, including those created during normal system operation; it is recommended to change the rollback to a no-op to ensure system stability.

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	188.939397ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	101.374433ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	391.066332ms
Throughput	255.71 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	40.415034626s
Average Latency	402.41321ms
Throughput	123.72 requests/second

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

service/internal/fixtures/fixtures.go (1)

790-818: 🛠️ Refactor suggestion | 🟠 Major

Add a regression test for namespace_id IS NULL action loading.

Please add/update a test that proves loadMigratedStandardActions excludes namespaced standard actions when both global and namespaced records share the same action names. As per coding guidelines, "Run go test ./... or make test and ensure all existing tests pass; add tests for new functionality".

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@service/internal/fixtures/fixtures.go` around lines 790 - 818, The test suite
is missing a regression test ensuring loadMigratedStandardActions only loads
actions where namespace_id IS NULL even when a namespaced action has the same
name; add a unit/integration test that sets up the DB with two actions of the
same name (one with namespace_id NULL and one with a non-NULL namespace_id),
invokes Fixtures.loadMigratedStandardActions (via the existing Fixtures test
helper or creating a Fixtures instance), and asserts that
f.MigratedData.StandardActions contains the global action ID (and not the
namespaced one); make sure to clean up test rows or use a transaction/fixture
helper so go test ./... passes and follow existing test patterns for DB
setup/teardown.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In
`@service/policy/db/migrations/20260331000000_seed_standard_actions_for_existing_namespaces.sql`:
- Around line 22-24: The down migration currently deletes all namespaced
standard actions via the DELETE FROM actions WHERE is_standard = TRUE AND
namespace_id IS NOT NULL statement, which will remove valid actions created
later by normal CreateNamespace() flow; change the down migration to be
explicitly irreversible instead of performing that broad DELETE — e.g., replace
the DELETE in this migration file
(20260331000000_seed_standard_actions_for_existing_namespaces.sql) with a
statement that raises an error/exception indicating the migration cannot be
reverted (so rollbacks fail safely), or alternatively implement a targeted
delete that only removes rows deterministically inserted by this migration
(using unique markers if available); reference the DELETE FROM actions clause
and the CreateNamespace() flow when making the change.

---

Outside diff comments:
In `@service/internal/fixtures/fixtures.go`:
- Around line 790-818: The test suite is missing a regression test ensuring
loadMigratedStandardActions only loads actions where namespace_id IS NULL even
when a namespaced action has the same name; add a unit/integration test that
sets up the DB with two actions of the same name (one with namespace_id NULL and
one with a non-NULL namespace_id), invokes Fixtures.loadMigratedStandardActions
(via the existing Fixtures test helper or creating a Fixtures instance), and
asserts that f.MigratedData.StandardActions contains the global action ID (and
not the namespaced one); make sure to clean up test rows or use a
transaction/fixture helper so go test ./... passes and follow existing test
patterns for DB setup/teardown.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 013dba12-e09e-4c15-9ee8-723c0ad03427

📥 Commits

Reviewing files that changed from the base of the PR and between 99a8147 and 98c8122.

📒 Files selected for processing (3)

• service/internal/fixtures/fixtures.go
• service/policy/db/migrations/20260331000000_seed_standard_actions_for_existing_namespaces.md
• service/policy/db/migrations/20260331000000_seed_standard_actions_for_existing_namespaces.sql

[github-actions]

X-Test Results

✅ go-pull-3228
✅ go-v0.9.0
✅ java-pull-3228
✅ js-pull-3228
✅ java-v0.9.0
✅ js-v0.9.0
cukes-report
opentdfplatformYLO4F1.dockerbuild

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	212.436298ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	101.902465ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	422.0255ms
Throughput	236.95 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	46.195171421s
Average Latency	460.492556ms
Throughput	108.24 requests/second

[elizabethhealy]

Rollback options:

Option 1: Destructive Down (Delete Namespaced Standard Actions)

• What it does: Down removes all is_standard = TRUE rows where namespace_id IS NOT NULL.
• Pros: Preserves strict up/down symmetry and “full reversal” semantics.
• Pros: Can be useful in disposable/local environments where data loss is acceptable.
• Cons: Deletes standard actions created by normal CreateNamespace behavior, not just migration-seeded rows.
• Cons: Can break existing namespaces and policy references after rollback.
• Cons: High production risk; rollback may succeed technically while leaving system functionally broken.

Option 2: Non-Destructive Down (No-Op) — Recommended

• What it does: Down performs no data deletion; seeded namespaced standard actions remain.
• Pros: Preserves namespace integrity and policy reference correctness during rollback operations.
• Pros: Aligns with forward-only data evolution once namespaced actions are a core requirement.
• Pros: Avoids accidental production outages/data loss from rollback scripts.
• Cons: Down is no longer a true data reversal (migration-version rollback only).
• Cons: Teams expecting fully reversible migrations may need explicit documentation/runbooks.
• Cons: Can no longer rollback past 20260312000000_add_namespace_to_actions.sql since that will remove the namespace and still require UNIQUE (which will no longer be true since there will be many standard actions)

Decision Rationale

• We choose Option 2 (No-Op Down) because namespaced standard actions are now foundational to correct policy behavior.
• A destructive Down creates disproportionate operational risk versus the value of strict reversibility.
• We document rollback limits explicitly (including rollback past 20260312000000_add_namespace_to_actions.sql requiring manual, potentially destructive remediation).

[github-actions]

X-Test Results

✅ go-pull-3228
✅ go-v0.9.0
✅ java-pull-3228
✅ java-v0.9.0
✅ js-pull-3228
✅ js-v0.9.0
test-cases-mapping-report
cukes-report
bats-test-results
opentdfplatformUHKOUC.dockerbuild

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In
`@service/policy/db/migrations/20260331000000_seed_standard_actions_for_existing_namespaces.md`:
- Around line 25-29: Add a concrete rollback preflight and remediation checklist
to the migration note in
20260331000000_seed_standard_actions_for_existing_namespaces.md: include exact
preflight SQL queries to detect conflicting rows in the actions table (e.g.,
SELECT name, array_agg(DISTINCT namespace) FROM actions WHERE name IN
('create','read','update','delete') GROUP BY name HAVING count(DISTINCT
namespace) > 1), criteria to identify safe-to-remove rows vs rows that require
manual merging, steps to back up affected rows (COPY or SELECT INTO), and
explicit manual cleanup commands/decision rules to restore the
pre-20260312000000 unique(name) constraint; reference the prior migration
20260312000000_add_namespace_to_actions.sql, the actions table, the name column,
and the standard action names so operators can run the checks and remediation
under incident pressure.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: f7c5f080-210e-4d6a-a097-8939ed692aee

📥 Commits

Reviewing files that changed from the base of the PR and between 98c8122 and 0670a40.

📒 Files selected for processing (2)

• service/policy/db/migrations/20260331000000_seed_standard_actions_for_existing_namespaces.md
• service/policy/db/migrations/20260331000000_seed_standard_actions_for_existing_namespaces.sql

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@adr/decisions/2026-04-01-database-migration-backup-first-rollback.md`:
- Around line 42-44: Three consecutive bullets all start with "🟩 **Good**",
making the ADR repetitive; edit the three bullets that begin with "🟩 **Good**"
(the ones referencing deterministic operator recovery, reduced dependence on
rollback logic, and alignment with production practice) to be more concise and
varied — either combine closely related points (e.g., merge deterministic
recovery and alignment with practice into one succinct bullet) and rephrase the
other to highlight reduced reliance on risky rollback logic, or use different
openings (e.g., "Helps", "Reduces", "Aligns with") so the list scans quickly and
avoids repeated wording.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 2dbb218b-bdbb-4dbc-9a89-0745456e2a3e

📥 Commits

Reviewing files that changed from the base of the PR and between 0670a40 and 23be066.

📒 Files selected for processing (1)

• adr/decisions/2026-04-01-database-migration-backup-first-rollback.md

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	198.768962ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	104.717053ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	385.548689ms
Throughput	259.37 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	41.186461554s
Average Latency	410.630496ms
Throughput	121.40 requests/second

[github-actions]

X-Test Results

✅ go-pull-3228
✅ java-pull-3228
✅ go-v0.9.0
✅ js-pull-3228
✅ java-v0.9.0
test-cases-mapping-report
✅ js-v0.9.0
bats-test-results
cukes-report
opentdfplatformPY9UKP.dockerbuild