feat(core): add service negation for op mode #2680

jrschumacher · 2025-09-04T10:42:25Z

Proposed Changes

Add support for service negation when defining a operational mode

Checklist

I have added or updated unit tests
I have added or updated integration tests (if appropriate)
I have added or updated documentation

Testing Instructions

gemini-code-assist

Summary of Changes

Hello @jrschumacher, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the flexibility of the platform's operational mode configuration. By allowing the explicit exclusion of services from predefined modes, it provides administrators with finer-grained control over resource utilization and deployment profiles, moving towards a more adaptable and maintainable service management system.

Highlights

Service Negation for Operational Modes: Introduced the ability to exclude specific services from operational modes using a negation syntax (e.g., mode: all,-servicename). This provides more granular control over which services are active within a given operational mode.
Declarative Service Configuration: Refactored the service registration logic to use a declarative configuration approach. This centralizes the definition of services and their associated modes, making it easier to manage and extend the system.
Documentation Updates: Updated the Configuring.md documentation to include details and examples for the new service negation feature, ensuring users can easily understand and utilize it.
Enhanced Service Registry: The service registry now includes new types and functions (ModeName, ServiceConfigError, ParseModesWithNegation, ServiceConfiguration, IsEnabled, RegisterServicesFromConfiguration) to support the new declarative configuration and negation logic.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

A mode, a dash, a service gone, New rules for what will carry on. With careful code, the system learns, Which paths to take, which bridge it burns.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request introduces a valuable feature allowing service negation in operational modes, enhancing deployment flexibility. The implementation includes a significant and beneficial refactoring of the service registration logic, moving from an imperative switch statement to a more maintainable declarative configuration. The changes are well-structured and include comprehensive tests for the new functionality and for backward compatibility. I've identified a few areas for improvement, including removing a duplicated example in the documentation, cleaning up unused code in tests, and simplifying a core registration function by removing what appears to be dead code. Overall, this is a solid improvement to the platform's configuration capabilities.

service/pkg/serviceregistry/serviceregistry.go

docs/Configuring.md

service/pkg/server/services_test.go

github-actions · 2025-09-04T10:48:14Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	178.812692ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	99.527488ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	351.410717ms
Throughput	284.57 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.547199384s
Average Latency	383.427268ms
Throughput	129.71 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	26.64672583s
Average Latency	265.694084ms
Throughput	187.64 requests/second

github-actions · 2025-09-04T15:53:11Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	174.647892ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	98.884813ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	344.661029ms
Throughput	290.14 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	37.046892942s
Average Latency	368.688595ms
Throughput	134.96 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	26.761817777s
Average Latency	266.890343ms
Throughput	186.83 requests/second

github-actions · 2025-09-04T15:56:48Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	178.617179ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	98.416599ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	355.345038ms
Throughput	281.42 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	37.120874021s
Average Latency	369.121235ms
Throughput	134.70 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	25.743617562s
Average Latency	256.656324ms
Throughput	194.22 requests/second

github-actions · 2025-09-04T20:12:06Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	177.513716ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	95.244621ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	356.591979ms
Throughput	280.43 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	36.757502232s
Average Latency	366.126839ms
Throughput	136.03 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	26.088899607s
Average Latency	260.050116ms
Throughput	191.65 requests/second

service/pkg/server/services.go

github-actions · 2025-09-05T12:56:41Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	180.958644ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	111.567337ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	366.000431ms
Throughput	273.22 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.024848631s
Average Latency	378.636239ms
Throughput	131.49 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	25.81833175s
Average Latency	257.154012ms
Throughput	193.66 requests/second

elizabethhealy

nit: what is the expected behavior when you negate all the services in the mode, like entity-resolution,-entity-resolution or entity-resolution,-entity-resolution,-health (idr if health is run in ers mode), can we possibly add a test case for that?

Comment was edited

jrschumacher · 2025-09-05T18:24:31Z

Good question. I would imagine the negation overrides any addition.

service/pkg/serviceregistry/serviceregistry.go

github-actions · 2025-09-10T16:51:46Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	187.225532ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	90.246998ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	355.06584ms
Throughput	281.64 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	36.992482115s
Average Latency	368.234541ms
Throughput	135.16 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	26.270315832s
Average Latency	261.774713ms
Throughput	190.33 requests/second

github-actions · 2025-09-10T17:02:15Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	174.64151ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	84.202524ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	341.938379ms
Throughput	292.45 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	36.141351537s
Average Latency	358.030995ms
Throughput	138.35 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	25.414363398s
Average Latency	253.178166ms
Throughput	196.74 requests/second

github-actions · 2025-09-10T17:09:50Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	180.694139ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	96.223173ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	341.676982ms
Throughput	292.67 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	36.321352548s
Average Latency	361.522445ms
Throughput	137.66 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	25.850374655s
Average Latency	257.618934ms
Throughput	193.42 requests/second

github-actions · 2025-09-10T19:32:09Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	180.278099ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	100.633256ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	357.63364ms
Throughput	279.62 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.023159002s
Average Latency	378.751287ms
Throughput	131.50 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	26.271354895s
Average Latency	261.375423ms
Throughput	190.32 requests/second

🤖 I have created a release *beep* *boop* --- ## [0.10.0](service/v0.9.0...service/v0.10.0) (2025-09-17) ### ⚠ BREAKING CHANGES * **policy:** Add manager column to provider configuration for multi-instance support ([#2601](#2601)) ### Features * **authz:** add obligation policy decision point ([#2706](#2706)) ([bb2a4f8](bb2a4f8)) * **core:** add service negation for op mode ([#2680](#2680)) ([029db8c](029db8c)) * **core:** Bump default write timeout. ([#2671](#2671)) ([6a233c1](6a233c1)) * **core:** Encapsulate>Encrypt ([#2676](#2676)) ([3c5a614](3c5a614)) * **core:** Lets key manager factory take context ([#2715](#2715)) ([8d70993](8d70993)) * **policy:** add FQN of obligation definitions/values to protos ([#2703](#2703)) ([45ded0e](45ded0e)) * **policy:** Add manager column to provider configuration for multi-instance support ([#2601](#2601)) ([a5fc994](a5fc994)) * **policy:** Add obligation triggers ([#2675](#2675)) ([22d0837](22d0837)) * **policy:** add protovalidate for obligation defs + vals ([#2699](#2699)) ([af5c049](af5c049)) * **policy:** Allow creation and update of triggers on Obligation Values ([#2691](#2691)) ([b1e7ba1](b1e7ba1)) * **policy:** Allow for additional context to be added to obligation triggers ([#2705](#2705)) ([7025599](7025599)) * **policy:** Include Triggers in GET/LISTable reqs ([#2704](#2704)) ([b4381d1](b4381d1)) * **policy:** obligations + values CRUD ([#2545](#2545)) ([c194e35](c194e35)) * use public AES protected key from lib/ocrypto ([#2600](#2600)) ([75d7590](75d7590)) ### Bug Fixes * **core:** remove extraneous comment ([#2741](#2741)) ([ada8da6](ada8da6)) * **core:** return services in the order they were registered ([#2733](#2733)) ([1d661db](1d661db)) * **deps:** bump github.com/opentdf/platform/lib/ocrypto from 0.3.0 to 0.6.0 in /service ([#2714](#2714)) ([00354b3](00354b3)) * **deps:** bump github.com/opentdf/platform/protocol/go from 0.7.0 to 0.9.0 in /service ([#2726](#2726)) ([9004368](9004368)) * **deps:** bump protocol/go to 0.10.0 in service ([#2734](#2734)) ([11e6201](11e6201)) * **deps:** update protovalidate to v0.14.2 to use new buf validate MessageOneofRule ([#2698](#2698)) ([1cae18e](1cae18e)) * **policy:** Registered Resources should consider actions correctly within Decision Requests ([#2681](#2681)) ([cf264a2](cf264a2)) * sanitize db schema identifiers ([#2682](#2682)) ([0d3dd94](0d3dd94)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>

jrschumacher added 3 commits September 4, 2025 05:36

feat(core): add service negation for op mode

245e7af

refactor

c5cb6d6

Fix lint

71fdf7b

jrschumacher requested a review from a team as a code owner September 4, 2025 10:42

github-actions bot added docs Documentation size/m labels Sep 4, 2025

gemini-code-assist bot reviewed Sep 4, 2025

View reviewed changes

service/pkg/serviceregistry/serviceregistry.go Outdated Show resolved Hide resolved

docs/Configuring.md Outdated Show resolved Hide resolved

service/pkg/server/services_test.go Outdated Show resolved Hide resolved

strantalis changed the title ~~eat(core): add service negation for op mode~~ feat(core): add service negation for op mode Sep 4, 2025

jrschumacher added 2 commits September 4, 2025 10:47

Fix lint issues

d8d9e4d

Fix gemini concerns

88fcba2

get fresh instance of configuration

0b060af

jrschumacher commented Sep 5, 2025

View reviewed changes

service/pkg/server/services.go Outdated Show resolved Hide resolved

elizabethhealy previously approved these changes Sep 5, 2025

View reviewed changes

elizabethhealy previously approved these changes Sep 8, 2025

View reviewed changes

ntrevino-virtru reviewed Sep 8, 2025

View reviewed changes

service/pkg/serviceregistry/serviceregistry.go Show resolved Hide resolved

jrschumacher added 3 commits September 9, 2025 10:29

Get fresh instance of the configuration

8662068

Refactor

7fc4781

Fix race condition

f040745

jrschumacher dismissed elizabethhealy’s stale review via f040745 September 10, 2025 16:47

jrschumacher force-pushed the service-negation branch from bcce5a2 to f040745 Compare September 10, 2025 16:47

Lint issues

eb94a23

Fix lint issues

a58daa3

Fix test error

5f40e07

strantalis approved these changes Sep 11, 2025

View reviewed changes

jrschumacher added this pull request to the merge queue Sep 11, 2025

Merged via the queue into main with commit 029db8c Sep 11, 2025
32 checks passed

jrschumacher deleted the service-negation branch September 11, 2025 22:27

opentdf-automation bot mentioned this pull request Sep 11, 2025

chore(main): release service 0.10.0 #2672

Merged

feat(core): add service negation for op mode #2680

feat(core): add service negation for op mode #2680

Uh oh!

Conversation

jrschumacher commented Sep 4, 2025

Proposed Changes

Checklist

Testing Instructions

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Sep 4, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Uh oh!

github-actions bot commented Sep 4, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Uh oh!

github-actions bot commented Sep 4, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Uh oh!

github-actions bot commented Sep 4, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Uh oh!

Uh oh!

github-actions bot commented Sep 5, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Uh oh!

elizabethhealy left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jrschumacher commented Sep 5, 2025

Uh oh!

Uh oh!

github-actions bot commented Sep 10, 2025

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Uh oh!

github-actions bot commented Sep 10, 2025

Benchmark authorization.GetDecisions Results:

elizabethhealy left a comment •

edited

Loading