fix(entityresolution): pass inline claims through multi-strategy context by jrschumacher · Pull Request #3794 · opentdf/platform

jrschumacher · 2026-07-28T19:38:42Z

Summary

pass inline ResolveEntities claims through types.JWTClaimsContextKey before calling the multi-strategy service
add regression tests for both v1 and v2 claims-only ResolveEntities paths
normalize result values before building protobuf structs so metadata/claim arrays serialize cleanly

Testing

go test ./entityresolution/multi-strategy/...
golangci-lint run ./entityresolution/multi-strategy/...
cd sdk && go test -run TestREADMECodeBlocks

Fixes #3790

Summary by CodeRabbit

New Features
- Multi-strategy entity resolution now supports inline JWT claims, including claim-to-entity field mapping and metadata.
- Added BDD support and end-to-end scenarios for claims-based authorization, including permitted and denied access outcomes.
Bug Fixes
- Improved normalization of claim and metadata values for reliable response formatting.
- Claims context is only applied when provided by a claims entity.
Tests
- Added unit and integration coverage for claims resolution, mappings, metadata, and authorization decisions.

gemini-code-assist · 2026-07-28T19:38:46Z

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

coderabbitai · 2026-07-28T19:39:04Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 8fdde3a8-8496-409f-9124-408b7b903fd7

📥 Commits

Reviewing files that changed from the base of the PR and between 58f51ab and 4968d60.

📒 Files selected for processing (4)

service/entityresolution/multi-strategy/registration.go
service/entityresolution/multi-strategy/registration_test.go
service/entityresolution/multi-strategy/v2/registration.go
service/entityresolution/multi-strategy/v2/registration_test.go

📝 Walkthrough

Walkthrough

Multi-strategy ResolveEntities now passes inline JWT claims through context and converts claim and metadata values into protobuf-compatible results. Tests cover both registration paths and BDD authorization scenarios.

Changes

Claims-aware entity resolution

Layer / File(s)	Summary
Claims context wiring and validation `service/entityresolution/multi-strategy/registration.go`, `service/entityresolution/multi-strategy/v2/registration.go`, `service/entityresolution/multi-strategy/*_test.go`	Both `ResolveEntities` implementations inject computed claims into context. Tests verify claims-provider mapping and username failure behavior.
StructPB-compatible result values `service/entityresolution/multi-strategy/registration.go`, `service/entityresolution/multi-strategy/v2/registration.go`	Claim and metadata values are converted through `StructPBCompatibleValue` before protobuf `Struct` construction.
Claims subject BDD support `tests-bdd/cukes/steps_authorization.go`, `tests-bdd/cukes/steps_authorization_test.go`, `tests-bdd/features/multi-strategy-ers-claims.feature`	BDD steps convert plain JSON claims into protobuf `Any` values and verify permit and deny outcomes for inline claims subjects.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related issues

fix(ers): preserve multi-strategy routing context across v2 entity-chain resolution #3801: Addresses preservation of JWT claims context across v2 entity-chain resolution.

Possibly related PRs

opentdf/platform#3791: Adds BDD scenarios that reproduce the missing JWT claims context.
opentdf/platform#3767: Adds related multi-strategy ERS claims-based BDD coverage.
opentdf/platform#3672: Modifies the related ERS claim and metadata transformation path.

Suggested labels: comp:authorization

Suggested reviewers: elizabethhealy, pflynn-virtru

Poem

I carry claims through context today,
While protobuf shapes guide their way.
Engineering permits, marketing denies,
Rabbit-tested mappings reach the skies. 🐇

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the primary change: passing inline claims through the multi-strategy resolution context.
Linked Issues check	✅ Passed	The changes populate JWTClaimsContextKey before resolution and add regression coverage for the inline claims failure described in issue [`#3790`].
Out of Scope Changes check	✅ Passed	The implementation, tests, and BDD coverage all support inline claims resolution and the requirements in issue [`#3790`].
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

Fix failing CI checks

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/3790-resolve-entities-jwt-claims-context

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@service/entityresolution/multi-strategy/registration.go`:
- Around line 449-473: The helper structPBCompatibleValue is duplicated in the
v2 package. Remove the duplicate implementation and reuse the existing shared or
canonical definition, updating callers as needed while preserving recursive
conversion of slices and maps.

In `@service/entityresolution/multi-strategy/v2/registration.go`:
- Around line 465-489: Remove the duplicate structPBCompatibleValue helper from
the v2 registration file and reuse the existing implementation from the v1
registration code through the established shared-access pattern. Preserve
recursive handling for []string, []interface{}, and map[string]interface{}
values without introducing another copy.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 5e49ac7c-2bc3-4237-8a8a-4940e081f699

📥 Commits

Reviewing files that changed from the base of the PR and between 2bffa7f and 97c5210.

📒 Files selected for processing (4)

service/entityresolution/multi-strategy/registration.go
service/entityresolution/multi-strategy/registration_test.go
service/entityresolution/multi-strategy/v2/registration.go
service/entityresolution/multi-strategy/v2/registration_test.go

Signed-off-by: Ryan Schumacher <jschumacher@virtru.com>

github-actions · 2026-07-29T13:53:10Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	193.877366ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	113.632674ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	409.622973ms
Throughput	244.13 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	51.447390301s
Average Latency	512.758904ms
Throughput	97.19 requests/second

github-actions · 2026-07-29T14:02:35Z

Signed-off-by: Ryan Schumacher <jschumacher@virtru.com>

github-actions · 2026-07-29T15:56:20Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	217.394402ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	121.346909ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	447.982549ms
Throughput	223.22 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	51.545646783s
Average Latency	513.918744ms
Throughput	97.00 requests/second

github-actions · 2026-07-29T16:06:00Z

Signed-off-by: Ryan Schumacher <jschumacher@virtru.com>

github-actions · 2026-07-31T05:02:13Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	182.598692ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	90.20224ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	406.49133ms
Throughput	246.01 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	48.378036522s
Average Latency	481.635395ms
Throughput	103.35 requests/second

github-actions · 2026-07-31T05:04:04Z

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

examples
otdfctl
sdk
service
lib/fixtures
tests-bdd

See the workflow run for details.

github-actions · 2026-07-31T05:11:08Z

jrschumacher requested a review from a team as a code owner July 28, 2026 19:38

github-actions Bot added the size/s label Jul 28, 2026

coderabbitai Bot reviewed Jul 28, 2026

View reviewed changes

Comment thread service/entityresolution/multi-strategy/registration.go Outdated

Comment thread service/entityresolution/multi-strategy/v2/registration.go Outdated

jrschumacher added 3 commits July 29, 2026 09:46

fix(entityresolution): pass inline claims through multi-strategy context

7517810

Signed-off-by: Ryan Schumacher <jschumacher@virtru.com>

refactor(entityresolution): reuse shared structpb conversion helper

9c9b8d8

Signed-off-by: Ryan Schumacher <jschumacher@virtru.com>

refactor(service): extract structpb normalization helper

88c77a4

Signed-off-by: Ryan Schumacher <jschumacher@virtru.com>

jrschumacher force-pushed the fix/3790-resolve-entities-jwt-claims-context branch from fccaf85 to 88c77a4 Compare July 29, 2026 13:48

test(tests-bdd): cover direct claims multi-strategy ers path

58f51ab

Signed-off-by: Ryan Schumacher <jschumacher@virtru.com>

jrschumacher commented Jul 31, 2026

View reviewed changes

Comment thread service/entityresolution/multi-strategy/v2/registration_test.go

fix(entityresolution): scope inline claims context to claims entities

4968d60

Signed-off-by: Ryan Schumacher <jschumacher@virtru.com>

khvirtru approved these changes Jul 31, 2026

View reviewed changes

Uh oh!

Conversation

jrschumacher commented Jul 28, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Testing

Summary by CodeRabbit

Uh oh!

gemini-code-assist Bot commented Jul 28, 2026

Uh oh!

coderabbitai Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jul 29, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Jul 29, 2026

X-Test Results

Uh oh!

github-actions Bot commented Jul 29, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Jul 29, 2026

X-Test Results

Uh oh!

Uh oh!

github-actions Bot commented Jul 31, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Jul 31, 2026

⚠️ Govulncheck found vulnerabilities ⚠️

Uh oh!

github-actions Bot commented Jul 31, 2026

X-Test Results

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jrschumacher commented Jul 28, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 28, 2026 •

edited

Loading