feat(authz): ensure logging parity between authz v2 and v1

[jakedoublev]

Proposed Changes

Old audit log PERMIT JSON:

{
  "time": "2025-06-06T08:01:11.898519-07:00",
  "level": "AUDIT",
  "msg": "decision",
  "namespace": "authorization",
  "audit": {
    "object": {
      "type": "entity_object",
      "id": "rewrap-token-rewrap-0",
      "name": "",
      "attributes": {
        "assertions": null,
        "attrs": ["https://example.com/attr/class/value/highest"],
        "permissions": null
      }
    },
    "action": { "type": "read", "result": "success" },
    "actor": {
      "id": "rewrap-token",
      "attributes": [
        {
          "entityId": "jwtentity-0-clientid-opentdf",
          "entityCategory": "CATEGORY_ENVIRONMENT",
          "attributeValueReferences": [
            "https://example.com/attr/class/value/highest"
          ]
        },
        {
          "entityId": "jwtentity-1-clientid-opentdf",
          "entityCategory": "CATEGORY_SUBJECT",
          "attributeValueReferences": [
            "https://example.com/attr/class/value/highest"
          ]
        }
      ]
    },
    "eventMetaData": {
      "entities": [
        {
          "id": "jwtentity-1-clientid-opentdf",
          "decision": "DECISION_PERMIT",
          "entitlements": [
            "https://example.com/attr/class/value/highest"
          ]
        }
      ]
    },
    "clientInfo": {
      "userAgent": "grpc-go/1.69.4",
      "platform": "authorization",
      "requestIP": "None"
    },
    "original": null,
    "updated": null,
    "requestID": "45b48d41-20e5-4520-a4aa-cc0caa029098",
    "timestamp": "2025-06-06T08:01:11-07:00"
  }
}

New audit log PERMIT JSON:

{
  "time": "2025-06-13T16:57:34.938039-07:00",
  "level": "AUDIT",
  "msg": "decision",
  "namespace": "authorization",
  "version": "v2",
  "entityID": "jwtentity-1-clientid-opentdf",
  "action": "read",
  "audit": {
    "object": {
      "type": "entity_object",
      "id": "jwtentity-1-clientid-opentdf-read",
      "name": "decisionRequest-read",
      "attributes": { "assertions": null, "attrs": null, "permissions": null }
    },
    "action": { "type": "read", "result": "success" },
    "actor": {
      "id": "jwtentity-1-clientid-opentdf",
      "attributes": [
        {
          "entitlements": {
            "https://example.com/attr/class/value/highest": [
              {
                "id": "ad5aa68c-e275-46b1-be94-3c4c98aa7eb2",
                "Value": null,
                "name": "read"
              }
            ]
          }
        }
      ]
    },
    "eventMetaData": [
      {
        "passed": true,
        "resource_id": "rewrap-0",
        "data_rule_results": [
          {
            "passed": true,
            "resource_value_fqns": [
              "https://example.com/attr/class/value/lowest"
            ],
            "attribute": {
              "id": "e105dc51-30fa-4b15-a6ec-ee42169133d5",
              "rule": 3,
              "fqn": "https://example.com/attr/class"
            },
            "entitlement_failures": null
          }
        ]
      }
    ],
    "clientInfo": {
      "userAgent": "connect-go/1.18.1 (go1.24.4)",
      "platform": "authorization.v2",
      "requestIP": "None"
    },
    "original": null,
    "updated": null,
    "requestID": "e7c99a04-f7d1-4d20-b9dc-3747669008a4",
    "timestamp": "2025-06-13T16:57:34-07:00"
  }
}

Old audit log DENY JSON:

{
  "time": "2025-06-06T07:33:18.171544-07:00",
  "level": "AUDIT",
  "msg": "decision",
  "namespace": "authorization",
  "audit": {
    "object": {
      "type": "entity_object",
      "id": "rewrap-token-rewrap-0",
      "name": "",
      "attributes": {
        "assertions": null,
        "attrs": [
          "https://example.com/attr/class/value/highest",
          "https://example.com/attr/department/value/engineering"
        ],
        "permissions": null
      }
    },
    "action": { "type": "read", "result": "failure" },
    "actor": {
      "id": "rewrap-token",
      "attributes": [
        {
          "entityId": "jwtentity-0-clientid-opentdf",
          "entityCategory": "CATEGORY_ENVIRONMENT",
          "attributeValueReferences": [
            "https://example.com/attr/class/value/highest"
          ]
        },
        {
          "entityId": "jwtentity-1-clientid-opentdf",
          "entityCategory": "CATEGORY_SUBJECT",
          "attributeValueReferences": [
            "https://example.com/attr/class/value/highest"
          ]
        }
      ]
    },
    "eventMetaData": {
      "entities": [
        {
          "id": "jwtentity-1-clientid-opentdf",
          "decision": "DECISION_DENY",
          "entitlements": [
            "https://example.com/attr/class/value/highest"
          ]
        }
      ]
    },
    "clientInfo": {
      "userAgent": "connect-go/1.18.1 (go1.24.2)",
      "platform": "authorization",
      "requestIP": "None"
    },
    "original": null,
    "updated": null,
    "requestID": "65497d1e-1f2a-4e85-9c60-c68492ea0245",
    "timestamp": "2025-06-06T07:33:18-07:00"
  }
}

New audit log DENY JSON:

{
  "time": "2025-06-13T17:00:41.113762-07:00",
  "level": "AUDIT",
  "msg": "decision",
  "namespace": "authorization",
  "version": "v2",
  "entityID": "jwtentity-1-clientid-opentdf",
  "action": "read",
  "audit": {
    "object": {
      "type": "entity_object",
      "id": "jwtentity-1-clientid-opentdf-read",
      "name": "decisionRequest-read",
      "attributes": { "assertions": null, "attrs": null, "permissions": null }
    },
    "action": { "type": "read", "result": "failure" },
    "actor": {
      "id": "jwtentity-1-clientid-opentdf",
      "attributes": [
        {
          "entitlements": {
            "https://example.com/attr/class/value/highest": [
              {
                "id": "ad5aa68c-e275-46b1-be94-3c4c98aa7eb2",
                "Value": null,
                "name": "read"
              }
            ]
          }
        }
      ]
    },
    "eventMetaData": [
      {
        "passed": false,
        "resource_id": "rewrap-0",
        "data_rule_results": [
          {
            "passed": true,
            "resource_value_fqns": [
              "https://example.com/attr/class/value/highest"
            ],
            "attribute": {
              "id": "e105dc51-30fa-4b15-a6ec-ee42169133d5",
              "rule": 3,
              "fqn": "https://example.com/attr/class"
            },
            "entitlement_failures": null
          },
          {
            "passed": false,
            "resource_value_fqns": ["https://example.com/attr/department/value/engineering"],
            "attribute": {
              "id": "38733cb4-0299-4d3a-a24b-981d3065f931",
              "rule": 2,
              "fqn": "https://example.com/attr/department"
            },
            "entitlement_failures": [
              {
                "attribute_value": "https://example.com/attr/department/value/engineering",
                "action": "read"
              }
            ]
          }
        ]
      }
    ],
    "clientInfo": {
      "userAgent": "connect-go/1.18.1 (go1.24.4)",
      "platform": "authorization.v2",
      "requestIP": "None"
    },
    "original": null,
    "updated": null,
    "requestID": "3e4d2964-582b-428f-a074-a3d49041cb22",
    "timestamp": "2025-06-13T17:00:41-07:00"
  }
}

Checklist

• I have added or updated unit tests
• I have added or updated integration tests (if appropriate)
• I have added or updated documentation

Testing Instructions

[gemini-code-assist]

Summary of Changes

Hello @jakedoublev, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request enhances the audit logging capabilities for the authorization v2 service. The primary goal is to ensure that the audit logs for access decisions provide comprehensive details about the evaluation process, mirroring the intent of the v1 logs while reflecting the v2 architecture. This involves restructuring the data captured during the decision evaluation and formatting it appropriately for the audit trail.

Highlights

• Audit Log Parity: This PR focuses on bringing the audit logging for the v2 authorization decision process closer to the v1 structure and content, specifically for the 'decision' event.
• Detailed V2 Decision Logging: Introduced a new audit event type and creation logic (GetDecisionV2EventParams, CreateV2GetDecisionEvent) to capture and log the detailed results of the v2 policy evaluation, including the specific resource values and attribute evaluation outcomes.
• Updated Data Structure: Modified the DataRuleResult struct in the v2 PDP logic to include ResourceValueFQNs and a simplified Attribute definition, providing more context on why a specific data rule passed or failed in the audit log.
• Integration into PDP: The v2 Policy Decision Point (pdp.go) is updated to call the new v2 audit logging function after evaluating a decision.
• Minor Refactoring and Test Updates: Includes minor code cleanup (e.g., logger parameter naming, removing redundant log fields) and updates to unit tests to align with the changes in the DataRuleResult structure.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist is currently in preview and may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments to provide feedback.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

---

Logs flow like a stream, Showing access, a coded dream. V2 now joins the flow, Details clear, watch them grow.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configureGemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request introduces audit logging for authorization v2 decisions, aiming to achieve parity with the existing v1 logging format. The changes involve updating the DataRuleResult structure, implementing a new CreateV2GetDecisionEvent function to build the v2 audit event, and integrating this new logging mechanism into the PolicyDecisionPoint's GetDecision method. The modifications to evaluate.go and pdp_test.go are consistent with these new data structures.

The new log structure appears to align well with the example provided in the PR description. A few points to consider for future improvement include potentially strengthening the type for ResourceDecisions in GetDecisionV2EventParams.

A significant concern is that the PR checklist indicates unit tests have not been added or updated. While existing tests in pdp_test.go were adapted for data structure changes, it is crucial to add specific tests that verify the content and structure of the new v2 audit logs themselves. This is essential to confirm that the "logging parity" goal is met and to prevent regressions.

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	443.969472ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	278.90912ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	340.115817ms
Throughput	294.02 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	36.719441522s
Average Latency	364.70013ms
Throughput	136.17 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	25.785219317s
Average Latency	256.878184ms
Throughput	193.91 requests/second

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	455.851498ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	269.74098ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	345.508327ms
Throughput	289.43 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	36.518036286s
Average Latency	363.312555ms
Throughput	136.92 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	25.39432428s
Average Latency	252.642152ms
Throughput	196.89 requests/second