chore(ers): add array-valued claims BDD coverage

[khvirtru]

Summary

• Adds BDD coverage for array-valued claims flowing through multi-strategy ERS
• Tests that JSON arrays (e.g., groups: ["engineering", "devops"]) survive the full pipeline: claims provider → output mapping → flattening → subject mapping evaluation → authorization decision
• Uses .groups[] wildcard selector in subject condition sets — the flattening library produces indexed/wildcard keys, not a plain .groups key for arrays

Scenarios

#	Scenario	Claims	Expected
1	Matching array element	groups: ["engineering", "devops"]	PERMIT
2	No matching element	groups: ["marketing", "sales"]	DENY
3	anyOf with multiple values	groups: ["security", "devops"] matches security	PERMIT

Test plan

• Cucumber BDD Tests CI job passes
• All 3 scenarios pass with claims-only ERS (no LDAP)
• No regressions in existing BDD scenarios

🤖 Generated with Claude Code

Summary by CodeRabbit

• Tests
  • Added coverage for array-valued claims in multi-strategy authorization scenarios.
  • Verified wildcard subject selectors, including matching and nonmatching arrays.
  • Added validation for rules that permit access when any array value matches.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 791462c2-5e3c-458d-9e0c-b7661c71d08e

📥 Commits

Reviewing files that changed from the base of the PR and between 4a98105 and 446ae8b.

📒 Files selected for processing (1)

• tests-bdd/features/claims-array-ers.feature

---

📝 Walkthrough

Walkthrough

The PR adds BDD coverage for array-valued groups claims in multi-strategy ERS. The scenarios test .groups[] wildcard mapping, matching and nonmatching arrays, and anyOf evaluation.

Changes

Array-valued claims ERS coverage

Layer / File(s)	Summary
Claims mapping and decision scenarios tests-bdd/features/claims-array-ers.feature	Adds shared ERS setup and scenarios for PERMIT on matching arrays, DENY on nonmatching arrays, and PERMIT when anyOf matches one array value.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• opentdf/platform#3794: Covers inline-claims resolution paths used by these array-valued claims tests.
• opentdf/platform#3797: Adds related BDD coverage for multi-strategy ERS condition evaluation.

Suggested reviewers: elizabethhealy

Poem

A rabbit maps groups in a row,
Through wildcard paths the values flow.
Engineering grants the right,
Missing groups deny the flight,
Security makes anyOf glow.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: adding BDD coverage for array-valued claims in ERS.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}