-
Notifications
You must be signed in to change notification settings - Fork 24
feat(policy): Add obligation triggers #2675
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
…igation-definitions-sql-crud
Benchmark results, click to expandBenchmark authorization.GetDecisions Results:
Benchmark authorization.v2.GetMultiResourceDecision Results:
Standard Benchmark Metrics Skipped or FailedBulk Benchmark Results
TDF3 Benchmark Results:
NANOTDF Benchmark Results:
|
/gemini review |
Benchmark results, click to expandBenchmark authorization.GetDecisions Results:
Benchmark authorization.v2.GetMultiResourceDecision Results:
Standard Benchmark Metrics Skipped or FailedBulk Benchmark Results
TDF3 Benchmark Results:
NANOTDF Benchmark Results:
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Code Review
This pull request effectively implements the AddObligationTrigger
and RemoveObligationTrigger
functionalities. The introduction of reusable IdFqnIdentifier
and IdNameIdentifier
messages in protobuf is a great improvement for consistency across the API. The database queries are well-structured and include important validation, such as ensuring entities belong to the same namespace. The addition of comprehensive integration and validation tests is also commendable. I've found one high-severity issue related to logging logic that should be addressed.
Benchmark results, click to expandBenchmark authorization.GetDecisions Results:
Benchmark authorization.v2.GetMultiResourceDecision Results:
Standard Benchmark Metrics Skipped or FailedBulk Benchmark Results
TDF3 Benchmark Results:
NANOTDF Benchmark Results:
|
Benchmark results, click to expandBenchmark authorization.GetDecisions Results:
Benchmark authorization.v2.GetMultiResourceDecision Results:
Standard Benchmark Metrics Skipped or FailedBulk Benchmark Results
TDF3 Benchmark Results:
NANOTDF Benchmark Results:
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM pending protovalidate bumps needed before this in #2698
Benchmark results, click to expandBenchmark authorization.GetDecisions Results:
Benchmark authorization.v2.GetMultiResourceDecision Results:
Standard Benchmark Metrics Skipped or FailedBulk Benchmark Results
TDF3 Benchmark Results:
NANOTDF Benchmark Results:
|
Benchmark results, click to expandBenchmark authorization.GetDecisions Results:
Benchmark authorization.v2.GetMultiResourceDecision Results:
Standard Benchmark Metrics Skipped or FailedBulk Benchmark Results
TDF3 Benchmark Results:
NANOTDF Benchmark Results:
|
Benchmark results, click to expandBenchmark authorization.GetDecisions Results:
Benchmark authorization.v2.GetMultiResourceDecision Results:
Standard Benchmark Metrics Skipped or FailedBulk Benchmark Results
TDF3 Benchmark Results:
NANOTDF Benchmark Results:
|
🤖 I have created a release *beep* *boop* --- ## [0.9.0](protocol/go/v0.8.0...protocol/go/v0.9.0) (2025-09-11) ### Features * **policy:** add FQN of obligation definitions/values to protos ([#2703](#2703)) ([45ded0e](45ded0e)) * **policy:** Add obligation triggers ([#2675](#2675)) ([22d0837](22d0837)) * **policy:** Allow creation and update of triggers on Obligation Values ([#2691](#2691)) ([b1e7ba1](b1e7ba1)) * **policy:** Allow for additional context to be added to obligation triggers ([#2705](#2705)) ([7025599](7025599)) * **policy:** obligations + values CRUD ([#2545](#2545)) ([c194e35](c194e35)) ### Bug Fixes * **deps:** update protovalidate to v0.14.2 to use new buf validate MessageOneofRule ([#2698](#2698)) ([1cae18e](1cae18e)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>
🤖 I have created a release *beep* *boop* --- ## [0.10.0](service/v0.9.0...service/v0.10.0) (2025-09-17) ### ⚠ BREAKING CHANGES * **policy:** Add manager column to provider configuration for multi-instance support ([#2601](#2601)) ### Features * **authz:** add obligation policy decision point ([#2706](#2706)) ([bb2a4f8](bb2a4f8)) * **core:** add service negation for op mode ([#2680](#2680)) ([029db8c](029db8c)) * **core:** Bump default write timeout. ([#2671](#2671)) ([6a233c1](6a233c1)) * **core:** Encapsulate>Encrypt ([#2676](#2676)) ([3c5a614](3c5a614)) * **core:** Lets key manager factory take context ([#2715](#2715)) ([8d70993](8d70993)) * **policy:** add FQN of obligation definitions/values to protos ([#2703](#2703)) ([45ded0e](45ded0e)) * **policy:** Add manager column to provider configuration for multi-instance support ([#2601](#2601)) ([a5fc994](a5fc994)) * **policy:** Add obligation triggers ([#2675](#2675)) ([22d0837](22d0837)) * **policy:** add protovalidate for obligation defs + vals ([#2699](#2699)) ([af5c049](af5c049)) * **policy:** Allow creation and update of triggers on Obligation Values ([#2691](#2691)) ([b1e7ba1](b1e7ba1)) * **policy:** Allow for additional context to be added to obligation triggers ([#2705](#2705)) ([7025599](7025599)) * **policy:** Include Triggers in GET/LISTable reqs ([#2704](#2704)) ([b4381d1](b4381d1)) * **policy:** obligations + values CRUD ([#2545](#2545)) ([c194e35](c194e35)) * use public AES protected key from lib/ocrypto ([#2600](#2600)) ([75d7590](75d7590)) ### Bug Fixes * **core:** remove extraneous comment ([#2741](#2741)) ([ada8da6](ada8da6)) * **core:** return services in the order they were registered ([#2733](#2733)) ([1d661db](1d661db)) * **deps:** bump github.com/opentdf/platform/lib/ocrypto from 0.3.0 to 0.6.0 in /service ([#2714](#2714)) ([00354b3](00354b3)) * **deps:** bump github.com/opentdf/platform/protocol/go from 0.7.0 to 0.9.0 in /service ([#2726](#2726)) ([9004368](9004368)) * **deps:** bump protocol/go to 0.10.0 in service ([#2734](#2734)) ([11e6201](11e6201)) * **deps:** update protovalidate to v0.14.2 to use new buf validate MessageOneofRule ([#2698](#2698)) ([1cae18e](1cae18e)) * **policy:** Registered Resources should consider actions correctly within Decision Requests ([#2681](#2681)) ([cf264a2](cf264a2)) * sanitize db schema identifiers ([#2682](#2682)) ([0d3dd94](0d3dd94)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>
Proposed Changes
1.) Implement
AddObligationTrigger
andRemoveObligationTrigger
methods within the Obligation Service2.) Add proto-validate logic to the above RPCs
Checklist
Testing Instructions