chore(ers): add multi-strategy provider contract matrix by jrschumacher · Pull Request #3809 · opentdf/platform

jrschumacher · 2026-07-31T08:08:40Z

Summary

add a shared resolved-token-chain contract suite for multi-strategy providers
enroll claims, SQLite-backed SQL, and seeded LDAP adapters in the same single-token and multi-token scenarios
verify token flow avoids a second ResolveEntities call while caller-provided entity chains still use ERS
document how new providers and new behavior variations join the matrix

Validation

cd service && go test ./entityresolution/integration -run TestMultiStrategyProviderResolvedTokenChainContract -count=1
cd service && go test ./entityresolution/multi-strategy/... ./internal/access/v2 -count=1 -coverprofile=/tmp/3801-enhanced.cover
cd service && go test ./entityresolution/integration -run "Test(MultiStrategyProviderResolvedTokenChainContract|MultiStrategyEntityResolutionV2|Integration_ResolveEntities_ReturnsPopulatedRepresentation|Integration_TokenChainPreservesResolvedClaims|Integration_FailureIsolation_MixedBatch)" -count=1
cd service && golangci-lint run ./internal/access/v2 ./entityresolution/integration
go test ./tests-bdd/cukes -count=1

Coverage

service/internal/access/v2: 68.5% -> 70.1%
aggregate targeted packages: 55.2% -> 55.8%

Stacked on #3808.

coderabbitai · 2026-07-31T08:09:34Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: ac87c948-abfe-444b-8091-00d82e5bca89

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-07-31T08:12:57Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	205.202277ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	113.959057ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	0
Failed Decrypts	100
Total Time	266.161471ms
Throughput	0.00 requests/second

Error Summary

Error Message	Occurrences
splitKey.unable to reconstruct split key: map[{https://localhost:8080 }:tdf: rewrap request 403
kao unwrap failed for split {https://localhost:8080 }: permission_denied: request error
rpc error: code = PermissionDenied desc = forbidden: pdp-denied]
tdf: rewrap request 403
kao unwrap failed for split {https://localhost:8080 }: permission_denied: request error
rpc error: code = PermissionDenied desc = forbidden: pdp-denied	100 occurrences

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	0
Failed Requests	5000
Concurrent Requests	50
Total Time	41.518467285s
Throughput	0.00 requests/second

Error Summary:

Error Message	Occurrences
read error: reader.WriteTo failed: splitKey.unable to reconstruct split key: map[{https://localhost:8080 }:tdf: rewrap request 403 kao unwrap failed for split {https://localhost:8080 }: permission_denied: request error rpc error: code = PermissionDenied desc = forbidden: pdp-denied] tdf: rewrap request 403 kao unwrap failed for split {https://localhost:8080 }: permission_denied: request error rpc error: code = PermissionDenied desc = forbidden: pdp-denied	5000 occurrences

github-actions · 2026-07-31T08:19:39Z

github-actions · 2026-07-31T08:23:38Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	203.289019ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	111.025906ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	403.460748ms
Throughput	247.86 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	49.435820728s
Average Latency	492.287769ms
Throughput	101.14 requests/second

github-actions · 2026-07-31T08:34:19Z

github-actions · 2026-07-31T08:42:03Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	276.22735ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	111.527638ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	574.389754ms
Throughput	174.10 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	49.779284466s
Average Latency	496.290737ms
Throughput	100.44 requests/second

github-actions · 2026-07-31T08:50:32Z

github-actions · 2026-07-31T08:58:00Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	212.945614ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	108.760074ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	410.632351ms
Throughput	243.53 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	49.479333661s
Average Latency	493.43816ms
Throughput	101.05 requests/second

github-actions · 2026-07-31T08:59:15Z

X-Test Failure Report

opentdf~~platform~~RV4TDM.dockerbuild
govulncheck-failure-1
govulncheck-failure-8
govulncheck-failure-3
govulncheck-failure-2
govulncheck-failure-5
govulncheck-failure-0

github-actions · 2026-07-31T09:03:28Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	205.840733ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	113.453232ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	436.429735ms
Throughput	229.13 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	52.45521858s
Average Latency	521.979738ms
Throughput	95.32 requests/second

github-actions · 2026-07-31T09:13:15Z

X-Test Failure Report

✅ go@main-pull-3809
✅ go@main-main
✅ go@pull-3809-pull-3809
✅ go@pull-3809-v0.9.0
✅ go@main-v0.9.0
✅ java@main-main
✅ js@main-pull-3809
✅ js@main-main
cukes-report
✅ java@main-v0.9.0
✅ java@main-pull-3809
✅ js@main-v0.9.0
opentdf~~platform~~7KY7TX.dockerbuild
govulncheck-failure-8
govulncheck-failure-3
govulncheck-failure-1
govulncheck-failure-0
govulncheck-failure-2
govulncheck-failure-5

github-actions · 2026-07-31T20:46:24Z

The merge-base changed after approval.

github-actions · 2026-08-04T19:04:12Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	124.485424ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	74.099289ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	292.048171ms
Throughput	342.41 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	32.996806071s
Average Latency	329.021784ms
Throughput	151.53 requests/second

github-actions · 2026-08-04T19:14:37Z

X-Test Results

✅ go@main-pull-3809
✅ go@pull-3809-pull-3809
✅ go@main-main
✅ go@pull-3809-main
✅ java@main-pull-3809
✅ go@main-v0.9.0
✅ java@main-main
✅ js@main-pull-3809
✅ java@main-v0.9.0
✅ js@main-main
cukes-report
✅ js@main-v0.9.0
✅ go@pull-3809-v0.9.0
opentdf~~platform~~Z7T55Q.dockerbuild
govulncheck-failure-8
govulncheck-failure-1
govulncheck-failure-5
govulncheck-failure-0

The merge-base changed after approval.

Invalidated by push of 0541af3

github-actions · 2026-08-05T14:47:33Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	159.11225ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	78.880452ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	343.786838ms
Throughput	290.88 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.26290113s
Average Latency	391.390736ms
Throughput	127.35 requests/second

github-actions · 2026-08-05T14:57:26Z

github-actions · 2026-08-05T21:57:41Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	202.403087ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	117.793482ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	415.812191ms
Throughput	240.49 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	49.292343853s
Average Latency	491.073511ms
Throughput	101.44 requests/second

github-actions · 2026-08-05T22:05:57Z

Signed-off-by: Ryan Schumacher <jschumacher@virtru.com>

github-actions · 2026-08-06T01:44:29Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	209.301469ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	116.041436ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	413.498736ms
Throughput	241.84 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	51.363433808s
Average Latency	511.785184ms
Throughput	97.35 requests/second

github-actions · 2026-08-06T01:53:06Z

github-actions · 2026-08-07T09:26:31Z

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

examples
otdfctl
sdk
service
lib/fixtures
tests-bdd

See the workflow run for details.

github-actions · 2026-08-07T09:27:04Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	126.062601ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	67.123637ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	277.104369ms
Throughput	360.87 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	29.469480801s
Average Latency	294.139458ms
Throughput	169.67 requests/second

github-actions · 2026-08-07T09:37:00Z

jrschumacher requested a review from a team as a code owner July 31, 2026 08:08

github-actions Bot added the size/m label Jul 31, 2026

jrschumacher changed the title ~~test(entityresolution): add multi-strategy provider contract matrix~~ test(ers): add multi-strategy provider contract matrix Jul 31, 2026

jrschumacher force-pushed the test-3801-provider-contract-matrix branch from 103cc9c to 1663292 Compare July 31, 2026 08:18

jrschumacher force-pushed the test-3801-provider-contract-matrix branch from 1663292 to 7ae6c88 Compare July 31, 2026 08:36

jrschumacher changed the title ~~test(ers): add multi-strategy provider contract matrix~~ chore(ers): add multi-strategy provider contract matrix Jul 31, 2026

jrschumacher force-pushed the test-3801-provider-contract-matrix branch 2 times, most recently from 0eb2217 to 5ef0af5 Compare July 31, 2026 08:56

strantalis previously approved these changes Aug 4, 2026

View reviewed changes

jrschumacher force-pushed the test-3801-provider-contract-matrix branch from 5ef0af5 to bf75d26 Compare August 4, 2026 18:58

khvirtru previously approved these changes Aug 4, 2026

View reviewed changes

strantalis previously approved these changes Aug 4, 2026

View reviewed changes

jrschumacher mentioned this pull request Aug 4, 2026

fix(ers): address inline claims review feedback #3836

Merged

elizabethhealy previously approved these changes Aug 4, 2026

View reviewed changes

jrschumacher force-pushed the test-3801-provider-contract-matrix branch from bf75d26 to 0541af3 Compare August 5, 2026 14:42

strantalis previously approved these changes Aug 5, 2026

View reviewed changes

jrschumacher dismissed strantalis’s stale review via 72d990b August 5, 2026 21:50

jrschumacher force-pushed the test-3801-provider-contract-matrix branch from 0541af3 to 72d990b Compare August 5, 2026 21:50

chore(ers): add multi-strategy provider contract matrix

7bf5613

Signed-off-by: Ryan Schumacher <jschumacher@virtru.com>

jrschumacher force-pushed the test-3801-provider-contract-matrix branch from 72d990b to 7bf5613 Compare August 6, 2026 01:39

strantalis previously approved these changes Aug 6, 2026

View reviewed changes

fix(ers): address inline claims review feedback (#3836)

83bff99

jrschumacher dismissed strantalis’s stale review via 83bff99 August 7, 2026 09:22

Uh oh!

Conversation

jrschumacher commented Jul 31, 2026

Summary

Validation

Coverage

Uh oh!

coderabbitai Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

github-actions Bot commented Jul 31, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

Error Summary

TDF3 Benchmark Results:

Error Summary:

Uh oh!

github-actions Bot commented Jul 31, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Jul 31, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Jul 31, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Jul 31, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Jul 31, 2026

X-Test Results

Uh oh!

github-actions Bot commented Jul 31, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Jul 31, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Jul 31, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Jul 31, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Jul 31, 2026

X-Test Results

Uh oh!

github-actions Bot commented Aug 4, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Aug 4, 2026

X-Test Results

Uh oh!

github-actions Bot commented Aug 5, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

coderabbitai Bot commented Jul 31, 2026 •

edited

Loading