fix(ers): preserve resolved token-chain context

[jrschumacher]

Summary

• preserve final mapped multi-strategy token-chain payloads in v2 entity chains instead of projecting to lossy typed identities
• consume only marked pre-resolved token-chain claims directly in authz, while keeping explicit entity-chain resolution on the normal ERS ResolveEntities path
• add access-layer regression tests, multi-strategy integration coverage, and token-based BDD coverage for the no-rehydrate flow

Testing

• cd service && golangci-lint run ./entityresolution/multi-strategy/... ./internal/access/v2 ./entityresolution/integration
• cd service && go test ./entityresolution/multi-strategy/... ./internal/access/v2 ./entityresolution/integration -run "Test(ResolveEntities_ClaimsProviderUsesInlineClaimsContext|ResolveEntities_UserNameEntityDoesNotSeedClaimsContext|EntityRepresentationFromClaimsEntity_RequiresPreResolvedPrefix|ResolveEntitiesFromEntityChain_UsesPreResolvedClaimsEntitiesDirectly|MultiStrategy_ClaimsOnly|MultiStrategy_SQLOnly|MultiStrategyEntityResolutionV2|Integration_CreateEntityChainsFromTokens_PreservesLDAPAttributesInChain|Integration_ResolveEntities_ReturnsPopulatedRepresentation|Integration_TokenChainPreservesResolvedClaims|Integration_FailureIsolation_MixedBatch)" -count=1
• go test ./tests-bdd/cukes -run "TestConvertInterfaceToAny_PlainClaimsJSON" -count=1

Notes

• Full local Godog execution is currently blocked in this environment by existing local platform startup/port issues unrelated to these code changes.

Fixes #3801

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	166.463788ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	91.241094ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	372.844193ms
Throughput	268.21 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	45.230601093s
Average Latency	450.656692ms
Throughput	110.54 requests/second

[github-actions]

X-Test Failure Report

✅ java@main-main
✅ js@main-main
✅ js@main-pull-3808
✅ java@main-v0.9.0
✅ js@main-v0.9.0
cukes-report
opentdfplatform951MN6.dockerbuild
govulncheck-failure-5
govulncheck-failure-3
govulncheck-failure-8
govulncheck-failure-2
govulncheck-failure-1
govulncheck-failure-0

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 1cece44f-b7a0-4a2e-94ed-3f42e316f25b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	207.422309ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	109.009937ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	0
Failed Decrypts	100
Total Time	273.290013ms
Throughput	0.00 requests/second

Error Summary

Error Message	Occurrences
splitKey.unable to reconstruct split key: map[{https://localhost:8080 }:tdf: rewrap request 403
kao unwrap failed for split {https://localhost:8080 }: permission_denied: request error
rpc error: code = PermissionDenied desc = forbidden: pdp-denied]
tdf: rewrap request 403
kao unwrap failed for split {https://localhost:8080 }: permission_denied: request error
rpc error: code = PermissionDenied desc = forbidden: pdp-denied	100 occurrences

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	0
Failed Requests	5000
Concurrent Requests	50
Total Time	40.88377479s
Throughput	0.00 requests/second

Error Summary:

Error Message

Occurrences

read error: reader.WriteTo failed: splitKey.unable to reconstruct split key: map[{https://localhost:8080 }:tdf: rewrap request 403 kao unwrap failed for split {https://localhost:8080 }: permission_denied: request error rpc error: code = PermissionDenied desc = forbidden: pdp-denied] tdf: rewrap request 403 kao unwrap failed for split {https://localhost:8080 }: permission_denied: request error rpc error: code = PermissionDenied desc = forbidden: pdp-denied

5000 occurrences

[github-actions]

X-Test Failure Report

✅ go@main-v0.9.0
✅ go@pull-3808-v0.9.0
✅ java@main-main
✅ js@main-main
✅ java@main-v0.9.0
✅ js@main-v0.9.0
cukes-report
server-logs-go@pull-3808-pull-3808
❌ go@pull-3808-pull-3808
server-logs-go@main-pull-3808
❌ go@main-pull-3808
server-logs-java@main-pull-3808
❌ java@main-pull-3808
server-logs-js@main-pull-3808
❌ js@main-pull-3808
opentdfplatformONEF5W.dockerbuild
govulncheck-failure-3
govulncheck-failure-8
govulncheck-failure-0
govulncheck-failure-2
govulncheck-failure-1
govulncheck-failure-5

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	210.349164ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	110.191894ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	437.175012ms
Throughput	228.74 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	54.826904906s
Average Latency	546.346572ms
Throughput	91.20 requests/second

[github-actions]

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

• examples
• otdfctl
• sdk
• service
• lib/fixtures
• tests-bdd

See the workflow run for details.

[github-actions]

X-Test Results

bats-test-results
✅ go@main-pull-3808
✅ go@pull-3808-pull-3808
✅ go@pull-3808-main
✅ go@main-main
✅ go@pull-3808-v0.9.0
✅ go@main-v0.9.0
✅ java@main-pull-3808
✅ java@main-main
✅ js@main-pull-3808
✅ java@main-v0.9.0
✅ js@main-main
cukes-report
✅ js@main-v0.9.0
opentdfplatformS6E1YO.dockerbuild
govulncheck-failure-8
govulncheck-failure-3
govulncheck-failure-5
govulncheck-failure-2
govulncheck-failure-1
govulncheck-failure-0