feat(authz): authz v2, ers v2 protos and gencode for ABAC with actions & registered resource #2124

jakedoublev · 2025-04-28T22:55:06Z

Proposed Changes

Versioned v2 RPCs for authorization service:

logically resolve actions permitted for each attribute value within the GetEntitlements/GetDecision responses, as these are part of the desired ABAC decisioning
support registered_resources (formerly NDR) in auth service requests
separate individual, multi resource, and bulk decision requests structurally

Checklist

I have added or updated unit tests
I have added or updated integration tests (if appropriate)
I have added or updated documentation

Testing Instructions

Copilot

Pull Request Overview

This PR adds a new version of the GetEntitlements RPC to support returning detailed action information per attribute value for ABAC decisioning.

Adds new proto messages (GetEntitlementsV2Request/GetEntitlementsV2Response and EntityEntitlementsV2).
Updates generated gRPC and Connect client/server implementations for the new endpoint.

Reviewed Changes

Copilot reviewed 4 out of 6 changed files in this pull request and generated no comments.

File	Description
service/authorization/authorization.proto	Adds new V2 proto messages and deprecates the original GetEntitlementsRequest and EntityEntitlements messages.
protocol/go/authorization/authorizationconnect/authorization.connect.go	Introduces new client and handler support for the GetEntitlementsV2 RPC.
protocol/go/authorization/authorization_grpc.pb.go	Updates gRPC client and server code to include the new GetEntitlementsV2 method.

Files not reviewed (2)

docs/grpc/index.html: Language not supported
docs/openapi/authorization/authorization.swagger.json: Language not supported

Comments suppressed due to low confidence (1)

service/authorization/authorization.proto:159

The deprecation comment for GetEntitlementsRequest refers to 'GetEntitlementsRequestV2', but the new message is named 'GetEntitlementsV2Request'. Update the deprecation note to reflect the correct new message name for clarity.

// Deprecated: use GetEntitlementsRequestV2 instead

strantalis · 2025-04-28T23:21:51Z

@jakedoublev Do we need to discuss how we want to version our protos. I think there are probably a couple different strategies like what you did but also making it package level like policy.v1.

https://buf.build/docs/best-practices/style-guide/
https://buf.build/docs/lint/rules/#package_version_suffix

github-actions · 2025-04-29T14:43:38Z

Benchmark results, click to expand

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	372.205588ms
Throughput	268.67 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m20.437688361s
Average Latency	802.770089ms
Throughput	62.16 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4976
Failed Requests	24
Concurrent Requests	50
Total Time	1m11.05368456s
Average Latency	707.863723ms
Throughput	70.03 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: rewrap failed: ocrypto.ComputeECDHKey failed :ocrypto.ECPubKeyFromPem failed: failed to parse PEM formatted public key	24 occurrences

Standard Benchmark Metrics Skipped or Failed

github-actions · 2025-04-29T15:55:03Z

Benchmark results, click to expand

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	389.142548ms
Throughput	256.98 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m26.225291692s
Average Latency	860.079066ms
Throughput	57.99 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4932
Failed Requests	68
Concurrent Requests	50
Total Time	1m13.809348001s
Average Latency	735.524765ms
Throughput	66.82 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: rewrap failed: ocrypto.ComputeECDHKey failed :ocrypto.ECPubKeyFromPem failed: failed to parse PEM formatted public key	68 occurrences

Standard Benchmark Metrics Skipped or Failed

github-actions · 2025-04-29T18:09:34Z

Benchmark results, click to expand

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	375.298981ms
Throughput	266.45 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m23.140205968s
Average Latency	829.859794ms
Throughput	60.14 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4943
Failed Requests	57
Concurrent Requests	50
Total Time	1m10.666314534s
Average Latency	703.543926ms
Throughput	69.95 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: rewrap failed: ocrypto.ComputeECDHKey failed :ocrypto.ECPubKeyFromPem failed: failed to parse PEM formatted public key	57 occurrences

Standard Benchmark Metrics Skipped or Failed

github-actions · 2025-04-29T18:12:27Z

Benchmark results, click to expand

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	376.511703ms
Throughput	265.60 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m22.978616085s
Average Latency	827.810748ms
Throughput	60.26 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4945
Failed Requests	55
Concurrent Requests	50
Total Time	1m13.537124619s
Average Latency	732.440135ms
Throughput	67.24 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: rewrap failed: ocrypto.ComputeECDHKey failed :ocrypto.ECPubKeyFromPem failed: failed to parse PEM formatted public key	55 occurrences

Standard Benchmark Metrics Skipped or Failed

service/authorization/v2/authorization.proto

Copilot

Pull Request Overview

This PR introduces version 2 of the authorization and entity-resolution APIs, enabling ABAC decisioning with actions and registered resources.

Add v2 proto definitions for entity resolution service (ResolveEntities, CreateEntityChainsFromTokens).
Introduce core Entity, Token, and EntityChain messages for actor identification.
Define v2 authorization service with separate GetDecision, GetDecisionMultiResource, GetDecisionBulk, and GetEntitlements RPCs.

Reviewed Changes

Copilot reviewed 13 out of 18 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
service/entityresolution/v2/entity_resolution.proto	New v2 messages and RPCs for entity resolution
service/entity/entity.proto	Core entity and token message definitions
service/authorization/v2/authorization.proto	v2 authorization RPCs and supporting messages
protocol/go/entityresolution/v2/entityresolutionv2connect/entity_resolution.connect.go	Generated Connect client/server code
protocol/go/entityresolution/v2/entity_resolution_grpc.pb.go	Generated gRPC code
protocol/go/authorization/v2/authorizationv2connect/authorization.connect.go	Generated Connect client/server code
protocol/go/authorization/v2/authorization_grpc.pb.go	Generated gRPC code

Files not reviewed (5)

docs/openapi/authorization/authorization.swagger.json: Language not supported
docs/openapi/authorization/v2/authorization.swagger.json: Language not supported
docs/openapi/entity/entity.swagger.json: Language not supported
docs/openapi/entityresolution/entity_resolution.swagger.json: Language not supported
docs/openapi/entityresolution/v2/entity_resolution.swagger.json: Language not supported

Comments suppressed due to low confidence (4)

service/entityresolution/v2/entity_resolution.proto:27

[nitpick] The field entity in EntityNotFoundError is ambiguous. Renaming it to entity_id or requested_entity would more clearly convey its purpose.

message EntityNotFoundError {

service/entityresolution/v2/entity_resolution.proto:12

[nitpick] Consider renaming original_id to ephemeral_id for consistency with other messages that track request IDs.

  string original_id = 1;

service/authorization/v2/authorization.proto:155

New v2 RPCs have been added; ensure unit and integration tests cover GetDecision, GetDecisionMultiResource, GetDecisionBulk, and GetEntitlements paths.

service AuthorizationService {

service/entityresolution/v2/entity_resolution.proto:43

After adding ResolveEntities and CreateEntityChainsFromTokens, add tests for edge cases (e.g., empty token list, invalid entities) to validate new behavior.

service EntityResolutionService {

service/authorization/v2/authorization.proto

github-actions · 2025-05-14T22:02:26Z

Benchmark results, click to expand

Benchmark Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	451.645036ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	373.994337ms
Throughput	267.38 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m16.547529682s
Average Latency	763.231097ms
Throughput	65.32 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4944
Failed Requests	56
Concurrent Requests	50
Total Time	1m6.426146292s
Average Latency	662.078785ms
Throughput	74.43 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	56 occurrences

Standard Benchmark Metrics Skipped or Failed

github-actions · 2025-05-14T22:06:21Z

Benchmark results, click to expand

Benchmark Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	435.646677ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	368.202832ms
Throughput	271.59 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m17.92424909s
Average Latency	776.77377ms
Throughput	64.16 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4949
Failed Requests	51
Concurrent Requests	50
Total Time	1m9.628691635s
Average Latency	693.311204ms
Throughput	71.08 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	51 occurrences

Standard Benchmark Metrics Skipped or Failed

service/authorization/v2/authorization.proto

service/authorization/authorization.proto

service/entityresolution/entity_resolution.proto

github-actions · 2025-05-14T22:26:17Z

Benchmark results, click to expand

Benchmark Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	449.128697ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	377.608253ms
Throughput	264.82 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m21.150039485s
Average Latency	809.094859ms
Throughput	61.61 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4944
Failed Requests	56
Concurrent Requests	50
Total Time	1m11.469037256s
Average Latency	710.588435ms
Throughput	69.18 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	56 occurrences

Standard Benchmark Metrics Skipped or Failed

github-actions · 2025-05-14T22:26:56Z

Benchmark results, click to expand

Benchmark Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	456.902492ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	369.000533ms
Throughput	271.00 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m16.131418418s
Average Latency	758.980223ms
Throughput	65.68 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4943
Failed Requests	57
Concurrent Requests	50
Total Time	1m8.093860261s
Average Latency	677.908322ms
Throughput	72.59 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	57 occurrences

Standard Benchmark Metrics Skipped or Failed

Invalidated by push of ed406b7

github-actions · 2025-05-15T14:40:13Z

Benchmark results, click to expand

Benchmark Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	465.184423ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	361.349675ms
Throughput	276.74 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m20.669800907s
Average Latency	804.662581ms
Throughput	61.98 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4950
Failed Requests	50
Concurrent Requests	50
Total Time	1m11.211293036s
Average Latency	707.504765ms
Throughput	69.51 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	50 occurrences

Standard Benchmark Metrics Skipped or Failed

🤖 I have created a release *beep* *boop* --- ## [0.3.3](protocol/go/v0.3.2...protocol/go/v0.3.3) (2025-05-15) ### Features * **authz:** authz v2, ers v2 protos and gencode for ABAC with actions & registered resource ([#2124](#2124)) ([ea7992a](ea7992a)) * **policy:** DSPX-1018 NDR retrieval by FQN support ([#2131](#2131)) ([0001041](0001041)) * **policy:** DSPX-1057 registered resource action attribute values (protos only) ([#2217](#2217)) ([6375596](6375596)) * **policy:** key management crud ([#2110](#2110)) ([4c3d53d](4c3d53d)) * **policy:** Modify get request to search for keys by kasid with keyid. ([#2147](#2147)) ([780d2e4](780d2e4)) * **policy:** Return KAS Key structure ([#2172](#2172)) ([7f97b99](7f97b99)) * **policy:** rotate keys rpc ([#2180](#2180)) ([0d00743](0d00743)) ### Bug Fixes * **policy:** return kas uri on keys for definition, namespace and values ([#2186](#2186)) ([6c55fb8](6c55fb8)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>

…s & registered resource (#2124) ### Proposed Changes Versioned v2 RPCs for authorization service: 1. logically resolve actions permitted for each attribute value within the GetEntitlements/GetDecision responses, as these are part of the desired ABAC decisioning 2. support `registered_resources` (formerly NDR) in auth service requests 3. separate individual, multi resource, and bulk decision requests structurally ### Checklist - [ ] I have added or updated unit tests - [ ] I have added or updated integration tests (if appropriate) - [ ] I have added or updated documentation ### Testing Instructions --------- Co-authored-by: Ryan Yanulites <[email protected]>

🤖 I have created a release *beep* *boop* --- ## [0.3.3](protocol/go/v0.3.2...protocol/go/v0.3.3) (2025-05-15) ### Features * **authz:** authz v2, ers v2 protos and gencode for ABAC with actions & registered resource ([#2124](#2124)) ([ea7992a](ea7992a)) * **policy:** DSPX-1018 NDR retrieval by FQN support ([#2131](#2131)) ([0001041](0001041)) * **policy:** DSPX-1057 registered resource action attribute values (protos only) ([#2217](#2217)) ([6375596](6375596)) * **policy:** key management crud ([#2110](#2110)) ([4c3d53d](4c3d53d)) * **policy:** Modify get request to search for keys by kasid with keyid. ([#2147](#2147)) ([780d2e4](780d2e4)) * **policy:** Return KAS Key structure ([#2172](#2172)) ([7f97b99](7f97b99)) * **policy:** rotate keys rpc ([#2180](#2180)) ([0d00743](0d00743)) ### Bug Fixes * **policy:** return kas uri on keys for definition, namespace and values ([#2186](#2186)) ([6c55fb8](6c55fb8)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>

### Proposed Changes Follow-up PR to #2124 - adds scaffolded V2 AuthorizationService - registers services side-by-side and sets up SDK support for backwards compatibility - adds proper deprecation comments for expected DX - adds service version key/value logging attributes to service loggers ### Checklist - [ ] I have added or updated unit tests - [ ] I have added or updated integration tests (if appropriate) - [ ] I have added or updated documentation ### Testing Instructions --------- Co-authored-by: jakedoublev <[email protected]> Co-authored-by: Jake Van Vorhis <[email protected]>

🤖 I have created a release *beep* *boop* --- ## [0.5.3](service/v0.5.2...service/v0.5.3) (2025-05-22) ### Features * **authz:** authz v2 versioning implementation ([#2173](#2173)) ([557fc21](557fc21)) * **authz:** authz v2, ers v2 protos and gencode for ABAC with actions & registered resource ([#2124](#2124)) ([ea7992a](ea7992a)) * **authz:** export entity id prefix constant from entity instead of authorization service v1 ([#2261](#2261)) ([94079a9](94079a9)) * **authz:** subject mapping plugin support for ABAC with actions ([#2223](#2223)) ([d08b939](d08b939)) * bulk keycloak provisioning ([#2205](#2205)) ([59e4485](59e4485)) * **core:** add otel to opentdf services ([#1858](#1858)) ([53a7aa0](53a7aa0)) * **core:** Adds EC withSalt options ([#2126](#2126)) ([67b6fb8](67b6fb8)) * **core:** enhance db configuration options ([#2285](#2285)) ([ed9ff59](ed9ff59)) * **core:** New Key Index and Manager Plugin SPI ([#2095](#2095)) ([eb446fc](eb446fc)) * **core:** support onConfigUpdate hook when registering services ([#1992](#1992)) ([366d4dc](366d4dc)) * **core:** v2 ERS with proto updates ([#2210](#2210)) ([a161ef8](a161ef8)) * **policy:** actions crud service endpoints and proto validation ([#2037](#2037)) ([e933fa9](e933fa9)) * **policy:** actions service RPCs should actually hit storage layer CRUD ([#2063](#2063)) ([da4faf5](da4faf5)) * **policy:** add enhanced standard/custom actions protos ([#2020](#2020)) ([bbac53f](bbac53f)) * **policy:** Add platform key indexer. ([#2189](#2189)) ([861ef8d](861ef8d)) * **policy:** consume lib/identifier parse function ([#2181](#2181)) ([1cef22b](1cef22b)) * **policy:** DSPX-1018 NDR retrieval by FQN support ([#2131](#2131)) ([0001041](0001041)) * **policy:** DSPX-1057 registered resource action attribute values (DB + Service implementation) ([#2191](#2191)) ([6bf1b2e](6bf1b2e)) * **policy:** DSPX-1057 registered resource action attribute values (protos only) ([#2217](#2217)) ([6375596](6375596)) * **policy:** DSPX-893 NDR define crud protos ([#2056](#2056)) ([55a5c27](55a5c27)) * **policy:** DSPX-898 NDR database schema ([#2055](#2055)) ([2a10a6a](2a10a6a)) * **policy:** DSPX-901 NDR database crud ([#2071](#2071)) ([20e0a5f](20e0a5f)) * **policy:** DSPX-902 NDR service crud implementation (2/2) ([#2066](#2066)) ([030ad33](030ad33)) * **policy:** DSPX-902 NDR service crud protos only (1/2) ([#2092](#2092)) ([24b6cb5](24b6cb5)) * **policy:** Finish resource mapping groups ([#2224](#2224)) ([5ff754e](5ff754e)) * **policy:** GetMatchedSubjectMappings should provide value FQN ([#2151](#2151)) ([ad80044](ad80044)) * **policy:** key management crud ([#2110](#2110)) ([4c3d53d](4c3d53d)) * **policy:** Key management proto ([#2115](#2115)) ([561f853](561f853)) * **policy:** Modify get request to search for keys by kasid with keyid. ([#2147](#2147)) ([780d2e4](780d2e4)) * **policy:** Restrict KAS deletion when tied to Key ([#2144](#2144)) ([4c4ab13](4c4ab13)) * **policy:** Return KAS Key structure ([#2172](#2172)) ([7f97b99](7f97b99)) * **policy:** rotate keys rpc ([#2180](#2180)) ([0d00743](0d00743)) * **policy:** stored enhanced actions database migration, CRUD queries, SM updates ([#2040](#2040)) ([e6b7c79](e6b7c79)) * **sdk:** Add a KAS allowlist ([#2085](#2085)) ([d7cfdf3](d7cfdf3)) * **sdk:** add nanotdf plaintext policy ([#2182](#2182)) ([e5c56db](e5c56db)) * **sdk:** Use ConnectRPC in the go client ([#2200](#2200)) ([fc34ee6](fc34ee6)) ### Bug Fixes * **core:** access pdp cleanup before actions in ABAC decisioning ([#2123](#2123)) ([9b38a3c](9b38a3c)) * **core:** Autobump service ([#2080](#2080)) ([006c724](006c724)) * **core:** Autobump service ([#2104](#2104)) ([1f72cc7](1f72cc7)) * **core:** Autobump service ([#2108](#2108)) ([be5b7d7](be5b7d7)) * **core:** bump to go 1.24 and bump service proto module dependencies ([#2064](#2064)) ([94891a0](94891a0)) * **core:** Fix DPoP with grpc-gateway ([#2044](#2044)) ([4483ef2](4483ef2)) * **core:** fix service go.mod ([#2141](#2141)) ([3b98f6d](3b98f6d)) * **core:** Improves errors when under heavy load ([#2132](#2132)) ([4490a14](4490a14)) * **core:** Let legacy KAOs use new trust plugins ([#2218](#2218)) ([5aa6916](5aa6916)) * **core:** migrate from mitchellh/mapstructure to go-viper/mapstructure ([#2087](#2087)) ([0a3a82e](0a3a82e)) * **core:** update viper to 1.20.1 ([#2088](#2088)) ([09099e9](09099e9)) * **core:** Updates vulnerable dep go/x/net ([#2072](#2072)) ([11c02cd](11c02cd)) * **deps:** bump github.com/creasty/defaults from 1.7.0 to 1.8.0 in /service ([#2242](#2242)) ([86a9b46](86a9b46)) * **deps:** bump github.com/jackc/pgx/v5 from 5.5.5 to 5.7.5 in /service ([#2249](#2249)) ([d8f3b67](d8f3b67)) * **deps:** bump the internal group across 1 directory with 2 updates ([#2296](#2296)) ([7f92c70](7f92c70)) * **deps:** bump toolchain in /lib/fixtures and /examples to resolve CVE GO-2025-3563 ([#2061](#2061)) ([9c16843](9c16843)) * handle empty private and public key ctx structs ([#2272](#2272)) ([f3fc647](f3fc647)) * **policy:** remove predefined rules in actions protos ([#2069](#2069)) ([060f059](060f059)) * **policy:** return kas uri on keys for definition, namespace and values ([#2186](#2186)) ([6c55fb8](6c55fb8)) * update key_mode to provide more context ([#2226](#2226)) ([44d0805](44d0805)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>

🤖 I have created a release *beep* *boop* --- ## [0.7.0](protocol/go/v0.6.2...protocol/go/v0.7.0) (2025-08-08) ### ⚠ BREAKING CHANGES * **policy:** disable kas grants in favor of key mappings ([#2220](#2220)) * **core:** Require go 1.23+ ([#1979](#1979)) ### Features * add ability to retrieve policy resources by id or name ([#1901](#1901)) ([deb4455](deb4455)) * **authz:** authz v2, ers v2 protos and gencode for ABAC with actions & registered resource ([#2124](#2124)) ([ea7992a](ea7992a)) * **authz:** improve v2 request proto validation ([#2357](#2357)) ([f927b99](f927b99)) * **authz:** sensible request limit upper bounds ([#2526](#2526)) ([b3093cc](b3093cc)) * **core:** adds bulk rewrap to sdk and service ([#1835](#1835)) ([11698ae](11698ae)) * **core:** EXPERIMENTAL: EC-wrapped key support ([#1902](#1902)) ([652266f](652266f)) * **core:** Require go 1.23+ ([#1979](#1979)) ([164c922](164c922)) * **core:** v2 ERS with proto updates ([#2210](#2210)) ([a161ef8](a161ef8)) * **policy:** add enhanced standard/custom actions protos ([#2020](#2020)) ([bbac53f](bbac53f)) * **policy:** Add legacy keys. ([#2613](#2613)) ([57370b0](57370b0)) * **policy:** Add list key mappings rpc. ([#2533](#2533)) ([fbc2724](fbc2724)) * **policy:** add obligation protos ([#2579](#2579)) ([50882e1](50882e1)) * **policy:** Add validation to delete keys ([#2576](#2576)) ([cc169d9](cc169d9)) * **policy:** add values to CreateObligationRequest ([#2614](#2614)) ([94535cc](94535cc)) * **policy:** adds new public keys table ([#1836](#1836)) ([cad5048](cad5048)) * **policy:** Allow the deletion of a key. ([#2575](#2575)) ([82b96f0](82b96f0)) * **policy:** cache SubjectConditionSet selectors in dedicated column maintained via trigger ([#2320](#2320)) ([215791f](215791f)) * **policy:** Change return type for delete key proto. ([#2566](#2566)) ([c1ae924](c1ae924)) * **policy:** Default Platform Keys ([#2254](#2254)) ([d7447fe](d7447fe)) * **policy:** disable kas grants in favor of key mappings ([#2220](#2220)) ([30f8cf5](30f8cf5)) * **policy:** DSPX-1018 NDR retrieval by FQN support ([#2131](#2131)) ([0001041](0001041)) * **policy:** DSPX-1057 registered resource action attribute values (protos only) ([#2217](#2217)) ([6375596](6375596)) * **policy:** DSPX-893 NDR define crud protos ([#2056](#2056)) ([55a5c27](55a5c27)) * **policy:** DSPX-902 NDR service crud protos only (1/2) ([#2092](#2092)) ([24b6cb5](24b6cb5)) * **policy:** Finish resource mapping groups ([#2224](#2224)) ([5ff754e](5ff754e)) * **policy:** key management crud ([#2110](#2110)) ([4c3d53d](4c3d53d)) * **policy:** Key management proto ([#2115](#2115)) ([561f853](561f853)) * **policy:** Modify get request to search for keys by kasid with keyid. ([#2147](#2147)) ([780d2e4](780d2e4)) * **policy:** Return KAS Key structure ([#2172](#2172)) ([7f97b99](7f97b99)) * **policy:** Return Simple Kas Keys from non-Key RPCs ([#2387](#2387)) ([5113e0e](5113e0e)) * **policy:** rotate keys rpc ([#2180](#2180)) ([0d00743](0d00743)) * **policy:** Update key status's and UpdateKey rpc. ([#2315](#2315)) ([7908db9](7908db9)) * **policy:** Update simple kas key ([#2378](#2378)) ([09d8239](09d8239)) ### Bug Fixes * add pagination to list public key mappings response ([#1889](#1889)) ([9898fbd](9898fbd)) * **core:** Allow 521 curve to be used ([#2485](#2485)) ([aaf43dc](aaf43dc)) * **core:** Fixes protoJSON parse bug on ec rewrap ([#1943](#1943)) ([9bebfd0](9bebfd0)) * **core:** Update fixtures and flattening in sdk and service ([#1827](#1827)) ([d6d6a7a](d6d6a7a)) * **deps:** bump toolchain in /lib/fixtures and /examples to resolve CVE GO-2025-3563 ([#2061](#2061)) ([9c16843](9c16843)) * **policy:** protovalidate deprecated action types and removal of gRPC gateway in subject mappings svc ([#2377](#2377)) ([54a6de0](54a6de0)) * **policy:** remove gRPC gateway in policy except where needed ([#2382](#2382)) ([1937acb](1937acb)) * **policy:** remove new public keys rpc's ([#1962](#1962)) ([5049bab](5049bab)) * **policy:** remove predefined rules in actions protos ([#2069](#2069)) ([060f059](060f059)) * **policy:** return kas uri on keys for definition, namespace and values ([#2186](#2186)) ([6c55fb8](6c55fb8)) * **sdk:** Fix compatibility between bulk and non-bulk rewrap ([#1914](#1914)) ([74abbb6](74abbb6)) * update key_mode to provide more context ([#2226](#2226)) ([44d0805](44d0805)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com> Co-authored-by: Krish Suchak <[email protected]>

feat(authz): GetEntitlementsV2 protos and gencode

afe3ad1

jakedoublev requested review from a team as code owners April 28, 2025 22:55

jakedoublev requested a review from Copilot April 28, 2025 22:56

Copilot AI reviewed Apr 28, 2025

View reviewed changes

fix copilot-flagged comment

c547edc

proto fixes

8843729

jakedoublev changed the title ~~feat(authz): GetEntitlementsV2 protos and gencode~~ feat(authz): authz v2 protos and gencode Apr 29, 2025

jakedoublev marked this pull request as draft April 29, 2025 14:36

put back auth service change accidentally committed

65fd691

latest changes

288592d

jakedoublev added 2 commits April 29, 2025 11:04

draft v2 protos

999a876

put back original authz protos

50d8436

jakedoublev commented Apr 29, 2025

View reviewed changes

service/authorization/v2/authorization.proto Outdated Show resolved Hide resolved

jakedoublev and others added 7 commits April 30, 2025 07:35

Merge branch 'main' into feat/entitle-actions-protos

6993846

undo change to original authn proto file

88c25d2

rename reg res fqn to use value

b3c41f3

add entity chain comment

13cf017

Merge branch 'main' into feat/entitle-actions-protos

ec22eb2

Merge branch 'main' into feat/entitle-actions-protos

decdd36

rename bulk methods to use same prefix

7e9e22b

jakedoublev commented Apr 30, 2025

View reviewed changes

service/authorization/v2/authorization.proto Outdated Show resolved Hide resolved

jakedoublev commented Apr 30, 2025

View reviewed changes

service/authorization/v2/authorization.proto Outdated Show resolved Hide resolved

jakedoublev added 2 commits April 30, 2025 13:29

update protos per meeting outcome

2364f25

cleanup

c25a26f

Copilot AI reviewed May 14, 2025

View reviewed changes

service/authorization/v2/authorization.proto Outdated Show resolved Hide resolved

service/authorization/v2/authorization.proto Show resolved Hide resolved

fix misnumbered index called out by copilot

96d86d7

ryanulit requested changes May 14, 2025

View reviewed changes

service/authorization/v2/authorization.proto Outdated Show resolved Hide resolved

service/authorization/authorization.proto Show resolved Hide resolved

service/entityresolution/entity_resolution.proto Show resolved Hide resolved

jakedoublev added 2 commits May 14, 2025 15:21

rm empty commits to unchanged proto files

33d98c7

validation PR suggestion

33dc394

ryanulit previously approved these changes May 14, 2025

View reviewed changes

jakedoublev enabled auto-merge May 15, 2025 14:15

Merge remote-tracking branch 'origin' into feat/entitle-actions-protos

ed406b7

ryanulit approved these changes May 15, 2025

View reviewed changes

jrschumacher approved these changes May 15, 2025

View reviewed changes

strantalis approved these changes May 15, 2025

View reviewed changes

jakedoublev added this pull request to the merge queue May 15, 2025

Merged via the queue into main with commit ea7992a May 15, 2025
28 checks passed

jakedoublev deleted the feat/entitle-actions-protos branch May 15, 2025 16:08

This was referenced May 15, 2025

chore(main): release protocol/go 0.3.3 #2135

Merged

chore(main): release service 0.5.3 #2046

Merged

opentdf-automation bot mentioned this pull request Jul 25, 2025

chore(main): release protocol/go 0.7.0 #2567

Merged

feat(authz): authz v2, ers v2 protos and gencode for ABAC with actions & registered resource #2124

feat(authz): authz v2, ers v2 protos and gencode for ABAC with actions & registered resource #2124

Uh oh!

Conversation

jakedoublev commented Apr 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed Changes

Checklist

Testing Instructions

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

strantalis commented Apr 28, 2025

Uh oh!

github-actions bot commented Apr 29, 2025

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Error Summary:

Standard Benchmark Metrics Skipped or Failed

Uh oh!

github-actions bot commented Apr 29, 2025

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Error Summary:

Standard Benchmark Metrics Skipped or Failed

Uh oh!

github-actions bot commented Apr 29, 2025

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Error Summary:

Standard Benchmark Metrics Skipped or Failed

Uh oh!

github-actions bot commented Apr 29, 2025

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Error Summary:

Standard Benchmark Metrics Skipped or Failed

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented May 14, 2025

Benchmark Results:

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Error Summary:

Standard Benchmark Metrics Skipped or Failed

Uh oh!

github-actions bot commented May 14, 2025

Benchmark Results:

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Error Summary:

Standard Benchmark Metrics Skipped or Failed

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented May 14, 2025

Benchmark Results:

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Error Summary:

jakedoublev commented Apr 28, 2025 •

edited

Loading