chore(policy): tests for namespaced policy config flag enforcement by jakedoublev · Pull Request #3749 · opentdf/platform

jakedoublev · 2026-07-14T20:00:22Z

Summary

add service-level NamespacedPolicy validation tests for subject mappings and subject condition sets
add matching validation tests for actions, registered resources, and resource mappings
keep resource mapping group coverage at protovalidate level because namespace is always required there

Summary by CodeRabbit

Bug Fixes
- Improved validation for namespaced policy operations.
- Requests creating actions, resources, mappings, or subject configurations now return a clear invalid-argument error when no namespace is provided.
- Standardized namespace validation behavior across policy-related services.
Tests
- Added coverage confirming namespace requirements and consistent error responses for namespaced policies.

Signed-off-by: jakedoublev <jake.vanvorhis@virtru.com>

coderabbitai · 2026-07-14T20:00:30Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 18af8b25-c13c-49dd-93e7-d1eba327d094

📥 Commits

Reviewing files that changed from the base of the PR and between baba709 and 5ad1b60.

📒 Files selected for processing (8)

service/policy/actions/actions.go
service/policy/actions/actions_test.go
service/policy/registeredresources/registered_resources.go
service/policy/registeredresources/registered_resources_test.go
service/policy/resourcemapping/resource_mapping.go
service/policy/resourcemapping/resource_mapping_test.go
service/policy/subjectmapping/subject_mapping.go
service/policy/subjectmapping/subject_mapping_test.go

📝 Walkthrough

Walkthrough

This change centralizes the missing-namespace validation error across policy creation services and adds tests confirming connect.CodeInvalidArgument responses when namespaced policy requests omit both namespace fields.

Changes

Namespaced policy validation

Layer / File(s)	Summary
Centralize namespace validation and coverage `service/policy/{actions,registeredresources,resourcemapping,subjectmapping}/*`	Creation endpoints reuse `errNamespacedPolicyNamespaceRequired`, while tests cover missing namespace fields for actions, registered resources, resource mappings, subject mappings, and condition sets.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

opentdf/platform#3165: Related registered-resource namespaced-policy validation.
opentdf/platform#3172: Related subject-mapping namespace validation.
opentdf/platform#3565: Related resource-mapping namespace fields and validation.

Suggested reviewers: alkalescent, c-r33d, elizabethhealy

Poem

I’m a bunny with errors to share,
One namespace message, neat and fair.
Actions and mappings now agree,
Tests hop along with certainty.
Missing fields? InvalidArgument springs!

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and accurately reflects the main change: added namespaced policy enforcement coverage in policy services.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/namespaced-policy-validation-tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

gemini-code-assist · 2026-07-14T20:00:32Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request enhances the test suite for the policy service by introducing validation tests for namespaced policies. The changes ensure that when the system is configured for namespaced policies, service methods correctly reject requests that fail to provide required namespace information, thereby improving the robustness of the policy enforcement layer.

Highlights

Namespaced Policy Validation: Added comprehensive test coverage to ensure that service-level operations correctly enforce namespace requirements when NamespacedPolicy is enabled.
Service Test Expansion: Updated Action, Registered Resource, Resource Mapping, and Subject Mapping test suites to include validation failure scenarios for missing namespace identifiers.

New Features

🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Namespaces required for the flow, To keep the policies in tow. Tests now ensure the rules are met, With errors caught in every set.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request adds unit tests across several policy services—specifically actions, registered resources, resource mapping, and subject mapping—to verify that namespace information is correctly required when the NamespacedPolicy configuration is enabled. I have no feedback to provide as there are no review comments.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

github-actions · 2026-07-14T20:05:37Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	216.144124ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	115.118447ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	429.761215ms
Throughput	232.69 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	45.526712409s
Average Latency	453.69875ms
Throughput	109.83 requests/second

Signed-off-by: jakedoublev <jake.vanvorhis@virtru.com>

github-actions · 2026-07-14T20:13:30Z

X-Test Failure Report

✅ java@main-pull-3749
✅ java@main-main
✅ js@main-main
✅ go@pull-3749-pull-3749
✅ js@main-pull-3749
cukes-report
opentdf~~platform~~X348BM.dockerbuild
govulncheck-failure-3
govulncheck-failure-8
govulncheck-failure-2
govulncheck-failure-1
govulncheck-failure-0
govulncheck-failure-5

github-actions · 2026-07-14T20:17:35Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	237.607333ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	116.090899ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	449.344084ms
Throughput	222.55 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	45.435073578s
Average Latency	452.846062ms
Throughput	110.05 requests/second

github-actions · 2026-07-14T20:26:50Z

X-Test Failure Report

✅ go@main-pull-3749
✅ go@main-main
✅ go@pull-3749-main
✅ java@main-pull-3749
✅ java@main-main
✅ go@pull-3749-pull-3749
✅ js@main-pull-3749
✅ js@main-main
cukes-report
opentdf~~platform~~DXEJFX.dockerbuild
govulncheck-failure-0
govulncheck-failure-8
govulncheck-failure-3
govulncheck-failure-1
govulncheck-failure-2
govulncheck-failure-5

github-actions · 2026-07-14T20:33:42Z

X-Test Failure Report

bats-test-results
✅ go@main-pull-3749
✅ go@main-main
✅ go@pull-3749-main
✅ java@main-pull-3749
✅ java@main-main
✅ go@pull-3749-pull-3749
✅ js@main-pull-3749
✅ js@main-main
cukes-report
opentdf~~platform~~DXEJFX.dockerbuild
govulncheck-failure-0
govulncheck-failure-8
govulncheck-failure-3
govulncheck-failure-1
govulncheck-failure-2
govulncheck-failure-5

github-actions · 2026-07-14T22:10:17Z

X-Test Failure Report

bats-test-results
✅ go@main-pull-3749
✅ go@main-main
✅ go@pull-3749-main
✅ java@main-pull-3749
✅ java@main-main
✅ go@pull-3749-pull-3749
✅ js@main-pull-3749
✅ js@main-main
cukes-report
opentdf~~platform~~DXEJFX.dockerbuild
govulncheck-failure-0
govulncheck-failure-8
govulncheck-failure-3
govulncheck-failure-1
govulncheck-failure-2
govulncheck-failure-5

Signed-off-by: jakedoublev <jake.vanvorhis@virtru.com>

github-actions · 2026-07-15T19:13:04Z

X-Test Failure Report

bats-test-results
✅ go@main-pull-3749
✅ go@main-main
✅ go@pull-3749-main
✅ java@main-pull-3749
✅ java@main-main
✅ go@pull-3749-pull-3749
✅ js@main-pull-3749
✅ js@main-main
cukes-report
opentdf~~platform~~DXEJFX.dockerbuild
govulncheck-failure-0
govulncheck-failure-8
govulncheck-failure-3
govulncheck-failure-1
govulncheck-failure-2
govulncheck-failure-5

…dation-tests

Invalidated by push of 92e716e

github-actions · 2026-07-15T19:20:35Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	223.875436ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	117.970569ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	448.352189ms
Throughput	223.04 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	46.817981719s
Average Latency	466.208399ms
Throughput	106.80 requests/second

github-actions · 2026-07-15T19:21:56Z

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

examples
otdfctl
sdk
service
lib/fixtures
tests-bdd

See the workflow run for details.

github-actions · 2026-07-15T19:28:49Z

jakedoublev added 2 commits July 13, 2026 15:36

test(policy): cover namespaced subject mapping validation

12f9074

Signed-off-by: jakedoublev <jake.vanvorhis@virtru.com>

test(policy): cover namespaced create validation

d6013c6

Signed-off-by: jakedoublev <jake.vanvorhis@virtru.com>

github-actions Bot added comp:policy Policy Configuration ( attributes, subject mappings, resource mappings, kas registry) size/xs labels Jul 14, 2026

gemini-code-assist Bot reviewed Jul 14, 2026

View reviewed changes

test(policy): assert namespaced validation errors

5ad1b60

Signed-off-by: jakedoublev <jake.vanvorhis@virtru.com>

jakedoublev changed the title ~~test(policy): cover namespaced policy validation~~ chore(policy): tests for namespaced policy config flag enforcement Jul 14, 2026

jakedoublev marked this pull request as ready for review July 14, 2026 20:27

jakedoublev requested review from a team as code owners July 14, 2026 20:27

jakedoublev enabled auto-merge July 14, 2026 20:27

elizabethhealy previously approved these changes Jul 14, 2026

View reviewed changes

chore: merge main into namespaced policy validation tests

f2f01a1

Signed-off-by: jakedoublev <jake.vanvorhis@virtru.com>

Merge remote-tracking branch 'origin' into fix/namespaced-policy-vali…

92e716e

…dation-tests

jakedoublev requested a review from elizabethhealy July 15, 2026 19:27

elizabethhealy approved these changes Jul 15, 2026

View reviewed changes

jakedoublev added this pull request to the merge queue Jul 15, 2026

Merged via the queue into main with commit 54d5c78 Jul 15, 2026
45 checks passed

jakedoublev deleted the fix/namespaced-policy-validation-tests branch July 15, 2026 19:45

Uh oh!

Conversation

jakedoublev commented Jul 14, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

gemini-code-assist Bot commented Jul 14, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

github-actions Bot commented Jul 14, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Jul 14, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Jul 14, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Jul 14, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Jul 14, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Jul 14, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Jul 15, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Jul 15, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Jul 15, 2026

⚠️ Govulncheck found vulnerabilities ⚠️

Uh oh!

github-actions Bot commented Jul 15, 2026

X-Test Results

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jakedoublev commented Jul 14, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 14, 2026 •

edited

Loading