feat(authz): logic for authz v2 (actions within ABAC decisioning)

[jakedoublev]

RPC logic in authorization service consuming new access PDP v2

Out of scope:

• named errors
• audit logs
• GetDecisionsBulk
• protovalidate unit tests

[github-actions]

Benchmark results, click to expand

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	355.63604ms
Throughput	281.19 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m15.881632703s
Average Latency	756.804621ms
Throughput	65.89 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4954
Failed Requests	46
Concurrent Requests	50
Total Time	1m7.138082257s
Average Latency	668.827634ms
Throughput	73.79 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: rewrap failed: ocrypto.ComputeECDHKey failed :ocrypto.ECPubKeyFromPem failed: failed to parse PEM formatted public key	46 occurrences

Standard Benchmark Metrics Skipped or Failed

[github-actions]

Benchmark results, click to expand

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	361.786438ms
Throughput	276.41 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m16.70931614s
Average Latency	764.567899ms
Throughput	65.18 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4948
Failed Requests	52
Concurrent Requests	50
Total Time	1m9.256354855s
Average Latency	688.129563ms
Throughput	71.44 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: rewrap failed: ocrypto.ComputeECDHKey failed :ocrypto.ECPubKeyFromPem failed: failed to parse PEM formatted public key	52 occurrences

Standard Benchmark Metrics Skipped or Failed

[github-actions]

Benchmark results, click to expand

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	379.828163ms
Throughput	263.28 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m22.335739919s
Average Latency	820.459103ms
Throughput	60.73 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4948
Failed Requests	52
Concurrent Requests	50
Total Time	1m11.139688492s
Average Latency	707.459493ms
Throughput	69.55 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: rewrap failed: ocrypto.ComputeECDHKey failed :ocrypto.ECPubKeyFromPem failed: failed to parse PEM formatted public key	52 occurrences

Standard Benchmark Metrics Skipped or Failed

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	465.287001ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	267.306196ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	344.619184ms
Throughput	290.18 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	53.368333602s
Average Latency	530.277359ms
Throughput	93.69 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4930
Failed Requests	70
Concurrent Requests	50
Total Time	45.135022729s
Average Latency	446.098582ms
Throughput	109.23 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	70 occurrences

Standard Benchmark Metrics Skipped or Failed

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	463.182669ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	277.073942ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	351.313788ms
Throughput	284.65 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	52.648072078s
Average Latency	523.224343ms
Throughput	94.97 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4936
Failed Requests	64
Concurrent Requests	50
Total Time	44.231880216s
Average Latency	436.962522ms
Throughput	111.59 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	64 occurrences

Standard Benchmark Metrics Skipped or Failed

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	448.048679ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	267.357003ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	337.795067ms
Throughput	296.04 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	52.329244045s
Average Latency	521.033225ms
Throughput	95.55 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4974
Failed Requests	26
Concurrent Requests	50
Total Time	43.979737433s
Average Latency	436.616073ms
Throughput	113.10 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	26 occurrences

Standard Benchmark Metrics Skipped or Failed

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	485.014387ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	284.723172ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	361.728789ms
Throughput	276.45 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	56.229009043s
Average Latency	558.987635ms
Throughput	88.92 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4946
Failed Requests	54
Concurrent Requests	50
Total Time	46.715064393s
Average Latency	462.873221ms
Throughput	105.88 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	54 occurrences

Standard Benchmark Metrics Skipped or Failed

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	468.744002ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	271.849345ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	366.402509ms
Throughput	272.92 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	57.835793954s
Average Latency	575.716738ms
Throughput	86.45 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4948
Failed Requests	52
Concurrent Requests	50
Total Time	48.472949091s
Average Latency	479.317678ms
Throughput	102.08 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	52 occurrences

Standard Benchmark Metrics Skipped or Failed

[strantalis]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces the core logic for the v2 authorization service, including new gRPC endpoints (GetDecision, GetDecisionMultiResource, GetEntitlements) and helper functions for processing decisions. It also refactors the KAS access PDP to consume these new v2 authorization services. Additionally, a new benchmark tool for GetDecisionMultiResource and unit tests for decision roll-up logic have been added. The changes are well-structured and the new tests are a welcome addition.

I've identified a critical issue in the new benchmark tool that needs addressing, and a medium-severity suggestion for error handling consistency.

Summary of Findings

• Benchmark Resource Creation: The benchmark-decision-v2.go tool reuses the same resource object pointer in a loop, leading to all benchmarked resources being identical except for the last EphemeralId set. This needs to be fixed by creating new resource instances within the loop.
• Error Handling Consistency: In service/authorization/v2/authorization.go, an error from an internal helper function (rollupMultiResourceDecision) is returned directly. It's recommended to wrap it as a connect.Error with connect.CodeInternal for consistency with other error returns in the service.
• Code Quality and New Features: The PR successfully implements the v2 authorization logic and integrates it into KAS. The addition of unit tests for helper functions and a new benchmark tool are positive contributions.

Merge Readiness

This pull request introduces significant and valuable functionality for v2 authorization. However, there is a critical issue in the benchmark-decision-v2.go tool that affects its correctness. Additionally, a medium-severity issue regarding error handling consistency has been noted.

I recommend that these issues, particularly the critical one, be addressed before merging. As an AI, I am not authorized to approve pull requests; please ensure further review and approval from team members.

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	474.082885ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	282.485488ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	334.075623ms
Throughput	299.33 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	53.587052724s
Average Latency	532.031528ms
Throughput	93.31 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4948
Failed Requests	52
Concurrent Requests	50
Total Time	44.104234127s
Average Latency	433.748008ms
Throughput	112.19 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	52 occurrences

Standard Benchmark Metrics Skipped or Failed

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	465.854098ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	290.053164ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	353.074119ms
Throughput	283.23 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	52.889050572s
Average Latency	526.543061ms
Throughput	94.54 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4947
Failed Requests	53
Concurrent Requests	50
Total Time	45.327980715s
Average Latency	446.377295ms
Throughput	109.14 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	53 occurrences

Standard Benchmark Metrics Skipped or Failed