fix(authz): Point caller to v2 on v1 GetDecisions resource exhaustion by elizabethhealy · Pull Request #3837 · opentdf/platform

elizabethhealy · 2026-08-05T15:53:26Z

Proposed Changes

GetDecisions fails with resource_exhausted when attribute has many values #3821
v2 GetDecisions does not call GetAttributeValuesByFqns so it does not run into the same attribute resource exhaustion issue

Checklist

I have added or updated unit tests
I have added or updated integration tests (if appropriate)
I have added or updated documentation

Testing Instructions

Summary by CodeRabbit

Bug Fixes
- Improved error handling when authorization decisions cannot load required attribute definitions.
- Error messages now direct clients to the v2 authorization API and preserve the underlying failure details.
Tests
- Added regression coverage for resource exhaustion scenarios during authorization requests.

github-actions · 2026-08-05T15:59:19Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	212.238554ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	181.487538ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	435.154825ms
Throughput	229.80 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	49.554779688s
Average Latency	493.628013ms
Throughput	100.90 requests/second

github-actions · 2026-08-05T16:09:51Z

coderabbitai · 2026-08-05T16:33:42Z

Warning

Review limit reached

@elizabethhealy, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 53 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 6fce6665-e53f-4a29-9c2d-8963e8369eea

📥 Commits

Reviewing files that changed from the base of the PR and between 0753357 and 2fbed53.

📒 Files selected for processing (1)

service/authorization/authorization_test.go

📝 Walkthrough

Walkthrough

The authorization service now gives a v2 API hint when attribute-definition retrieval fails with ResourceExhausted. A regression test verifies the status, message, and preserved underlying error.

Changes

Authorization error handling

Layer / File(s)	Summary
Resource-exhausted handling and regression coverage `service/authorization/authorization.go`, `service/authorization/authorization_test.go`	`GetDecisions` returns a statusified internal error with requested FQNs and a v2 API hint for `ResourceExhausted` retrieval failures. The regression test verifies the error response and underlying failure message.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: jakedoublev

Poem

A rabbit found an error bright,
And gave the v2 path in sight.
The test hopped in to check the clue,
With status and message carried through.
“Resource exhausted—now you know!”

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: directing v1 GetDecisions callers to v2 after resource exhaustion.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch dspx-4259-get-decision-resource-exhaustion-hint

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-08-05T16:38:14Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	242.211676ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	119.787938ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	408.084891ms
Throughput	245.05 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	48.897434102s
Average Latency	487.059168ms
Throughput	102.25 requests/second

github-actions · 2026-08-05T16:47:35Z

coderabbitai

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@service/authorization/authorization_test.go`:
- Around line 1345-1349: Update the error assertions in the authorization test
to verify that err.Error() also contains the preserved underlying message
"message size 8205724 is larger than configured max 4194304", alongside the
existing internal-code and v2-hint checks.
- Around line 1318-1350: Register a t.Cleanup callback immediately after
assigning errGetAttributesByValueFqns in the test so the shared mock error is
reset even if require.Error aborts the test. Remove the dependent manual reset
at the end of the test while preserving the existing injected ResourceExhausted
scenario.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: fe2a123e-cd35-4a23-a325-a25dd0c3d26b

📥 Commits

Reviewing files that changed from the base of the PR and between 4a98105 and 0753357.

📒 Files selected for processing (2)

service/authorization/authorization.go
service/authorization/authorization_test.go

github-actions · 2026-08-05T21:14:49Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	207.640604ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	136.859862ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	439.265774ms
Throughput	227.65 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	48.868595904s
Average Latency	486.791976ms
Throughput	102.32 requests/second

github-actions · 2026-08-05T21:16:48Z

X-Test Failure Report

govulncheck-failure-0
opentdf~~platform~~QH3DAI.dockerbuild
govulncheck-failure-3
govulncheck-failure-8
govulncheck-failure-5
govulncheck-failure-2
govulncheck-failure-1

github-actions · 2026-08-05T21:21:02Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	195.296088ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	103.150269ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	446.153387ms
Throughput	224.14 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	51.488651699s
Average Latency	512.822502ms
Throughput	97.11 requests/second

github-actions · 2026-08-05T21:23:05Z

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

examples
otdfctl
sdk
service
lib/fixtures
tests-bdd

See the workflow run for details.

github-actions · 2026-08-05T21:33:07Z

add hint on v1

5720e3c

github-actions Bot added comp:authorization size/xs labels Aug 5, 2026

preserve code

6163ea3

add warning

0753357

elizabethhealy marked this pull request as ready for review August 5, 2026 21:09

elizabethhealy requested a review from a team as a code owner August 5, 2026 21:09

coderabbitai Bot reviewed Aug 5, 2026

View reviewed changes

Comment thread service/authorization/authorization_test.go Outdated

Comment thread service/authorization/authorization_test.go Outdated

address opencode comment

2fbed53

Uh oh!

Conversation

elizabethhealy commented Aug 5, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed Changes

Checklist

Testing Instructions

Summary by CodeRabbit

Uh oh!

github-actions Bot commented Aug 5, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Aug 5, 2026

X-Test Results

Uh oh!

coderabbitai Bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Walkthrough

Changes

Uh oh!

github-actions Bot commented Aug 5, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Aug 5, 2026

X-Test Results

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Aug 5, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Aug 5, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Aug 5, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Aug 5, 2026

⚠️ Govulncheck found vulnerabilities ⚠️

Uh oh!

github-actions Bot commented Aug 5, 2026

X-Test Results

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

elizabethhealy commented Aug 5, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 5, 2026 •

edited

Loading