feat(policy): Add FQN to RegisteredResourceValues

[jakedoublev]

• add fqn to policy.RegisteredResourceValue and regenerate protobuf/OpenAPI docs
• populate registered resource value FQNs across get/list/create/update/delete and embedded resource values

Summary by CodeRabbit

• New Features
  • RegisteredResourceValue objects now include a fully qualified name (fqn) field that is returned in all API responses. This field combines the namespace and resource value identifier into a unified reference format.

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces a Fully Qualified Name (FQN) field to the RegisteredResourceValue model. The change ensures that resource values can be uniquely identified and referenced by their FQN across the system. The implementation includes necessary protobuf updates, database hydration logic, and comprehensive integration test updates to maintain consistency across all CRUD operations.

Highlights

• Schema Update: Added the fqn field to the RegisteredResourceValue protobuf definition and updated the associated documentation.
• Logic Implementation: Introduced helper functions to calculate and hydrate FQNs for registered resource values across various database operations.
• Service Integration: Updated Get, List, Create, Update, and Delete operations to ensure the fqn field is correctly populated in responses.
• Test Coverage: Updated integration tests to verify the presence and accuracy of the fqn field in resource value lifecycle events.

New Features

🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Ignored Files

• Ignored by pattern: docs/openapi/**/* (2)
  • docs/openapi/policy/objects.openapi.yaml
  • docs/openapi/policy/registeredresources/registered_resources.openapi.yaml
• Ignored by pattern: protocol/**/* (1)
  • protocol/go/policy/objects.pb.go

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

---

A resource value needed a name, To rise above its simple frame. With FQN now in the set, It's easier to find, you bet.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[coderabbitai]

Warning

Rate limit exceeded

@jakedoublev has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 11 minutes and 31 seconds before requesting another review.

To continue reviewing without waiting, purchase usage credits in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 09f41fe0-0cc7-4572-b1c5-6e19e81fb61b

📥 Commits

Reviewing files that changed from the base of the PR and between 6802b34 and f3fcb05.

📒 Files selected for processing (4)

• otdfctl/e2e/registered-resources.bats
• service/integration/registered_resources_test.go
• service/policy/db/registered_resources.go
• service/policy/registeredresources/registered_resources.go

📝 Walkthrough

Walkthrough

This PR adds an fqn field to the RegisteredResourceValue message that contains a fully-qualified name composed of the namespace, resource name, and value. The field is computed and hydrated in all data access functions, documented in API schemas and gRPC docs, and verified through updated tests.

Changes

Hydrate RegisteredResourceValue with FQN

Layer / File(s)	Summary
Proto message schema definition service/policy/objects.proto	RegisteredResourceValue message now includes fqn as a string field (tag 5).
API specification updates docs/openapi/policy/objects.openapi.yaml, docs/openapi/policy/registeredresources/registered_resources.openapi.yaml, docs/grpc/index.html	OpenAPI and gRPC documentation schemas document the new fqn field in RegisteredResourceValue.
FQN computation and hydration helpers service/policy/db/registered_resources.go	Introduces registeredResourceValueFQN function to build FQN strings from namespace, resource name, and value, and hydrateRegisteredResourceValueFQNs to populate Fqn fields on RegisteredResourceValue slices.
FQN population in data accessors service/policy/db/registered_resources.go	Updates GetRegisteredResource, ListRegisteredResources, GetRegisteredResourceValue, ListRegisteredResourceValues, and DeleteRegisteredResourceValue to compute and set the Fqn field using the helper functions.
FQN population test assertions service/integration/registered_resources_test.go	Updates deletion, lookup, and batch retrieval tests to verify that returned RegisteredResourceValue objects include the computed FQN matching expected values.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

• opentdf/platform#3312: Both PRs modify the same service/policy/db/registered_resources.go functions (notably ListRegisteredResources), so the changes are directly related at the code level.
• opentdf/platform#3165: Both PRs modify the registered-resources DB/logic (service/policy/db/registered_resources.go and related registered resource handling), with the main PR adding/setting RegisteredResourceValue.fqn and the retrieved PR changing namespace handling and query behavior, so they are related.
• opentdf/platform#3206: Both PRs touch service/policy/db/registered_resources.go and make related changes to RegisteredResourceValue handling (main PR adds/hydrates the FQN field while the retrieved PR refactors action/attribute resolution and enforces namespace consistency), so they are related.

Suggested labels

comp:db, comp:policy, size/m, docs

Suggested reviewers

• c-r33d
• elizabethhealy

Poem

🐰 A fully-qualified name takes form,
Through namespaces and values warm,
Each resource now declares its way,
With FQN lighting up the day! ✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'feat(policy): Add FQN to RegisteredResourceValues' accurately and clearly summarizes the main change—adding an FQN field to the RegisteredResourceValue schema, as evidenced by the proto definition update, OpenAPI schema changes, and database/API logic additions.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch DSPX-3194-registered-resource-value-fqn

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	169.150431ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	94.443558ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	439.83648ms
Throughput	227.36 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	43.183650181s
Average Latency	429.754579ms
Throughput	115.78 requests/second

[gemini-code-assist]

Code Review

This pull request introduces a new fqn (Fully Qualified Name) field to the RegisteredResourceValue object, updating the protobuf definition, documentation, and database logic to populate this field. Integration tests have been expanded to verify the FQN in various service responses. Feedback was provided regarding a potential performance regression in the DeleteRegisteredResourceValue method, where an additional database fetch was added; it is recommended to use a SQL RETURNING clause to improve efficiency and maintain consistency with other deletion methods.

[github-actions]

X-Test Failure Report

opentdfplatformIF5HPK.dockerbuild
govulncheck-failure-8

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	198.22811ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	102.497441ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	413.064803ms
Throughput	242.09 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	43.999897994s
Average Latency	438.367107ms
Throughput	113.64 requests/second

[github-actions]

X-Test Failure Report

cukes-report
opentdfplatformOW8LYY.dockerbuild
govulncheck-failure-8

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	140.243767ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	77.47134ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	400.907935ms
Throughput	249.43 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	40.468726632s
Average Latency	403.406945ms
Throughput	123.55 requests/second

[github-actions]

X-Test Failure Report

opentdfplatform7WTNEG.dockerbuild
govulncheck-failure-8

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	182.444856ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	90.79466ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	428.541042ms
Throughput	233.35 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	42.959232504s
Average Latency	427.558819ms
Throughput	116.39 requests/second

[github-actions]

X-Test Failure Report

opentdfplatformNCB3BJ.dockerbuild
govulncheck-failure-8

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	185.401557ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	93.417265ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	413.181875ms
Throughput	242.02 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	43.728833497s
Average Latency	435.493385ms
Throughput	114.34 requests/second

[github-actions]

X-Test Failure Report

✅ java-v0.9.0
✅ js-pull-3446
bats-test-results
✅ js-v0.9.0
cukes-report
opentdfplatformWKQZ9I.dockerbuild
govulncheck-failure-8

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	192.047334ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	103.006417ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	418.469732ms
Throughput	238.97 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	43.265946745s
Average Latency	431.557979ms
Throughput	115.56 requests/second

[github-actions]

X-Test Results

✅ go-pull-3446
✅ java-pull-3446
✅ go-v0.9.0
bats-test-results
✅ java-v0.9.0
✅ js-v0.9.0
✅ js-pull-3446
cukes-report
opentdfplatformPIASUN.dockerbuild
govulncheck-failure-8

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	177.597405ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	89.824997ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	429.848076ms
Throughput	232.64 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	42.116025659s
Average Latency	419.185415ms
Throughput	118.72 requests/second

[github-actions]

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

• tests-bdd

See the workflow run for details.

[github-actions]

X-Test Results

✅ go-pull-3446
✅ go-v0.9.0
✅ java-pull-3446
bats-test-results
✅ java-v0.9.0
✅ js-pull-3446
✅ js-v0.9.0
cukes-report
opentdfplatformY97TB6.dockerbuild
govulncheck-failure-8