fix(policy): DPSX-4630 PDP allows permits decisions on inactive attribute values with direct entitlements

[ryanulit]

Proposed Changes

Bug

Existing logic in the access PDP is allowing direct entitlements passed in from an entity representation to bypass active/inactive checks on attribute values when making a permit/deny decision. A simple test has been added to verify the initial bug.

Checklist

• I have added or updated unit tests
• I have added or updated integration tests (if appropriate)
• I have added or updated documentation

Testing Instructions

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Team

Run ID: 00ffe9fe-f4b7-4bb3-ae04-fc993ae17233

📥 Commits

Reviewing files that changed from the base of the PR and between d5933ed and 85de8c2.

📒 Files selected for processing (1)

• service/internal/access/v2/pdp_test.go

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The PDP test suite adds active and inactive values to a third attribute. New subruns verify denial for inactive values and mixed active/inactive resources, plus access for an active value when its sibling is inactive.

Changes

Direct entitlement decision tests

Layer / File(s)	Summary
Attribute fixtures and decision cases service/internal/access/v2/pdp_test.go	Adds active and inactive values for attr3, includes the attribute in the PDP, and verifies direct entitlement decisions for inactive, mixed, and active sibling values.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 85de8

This change adds regression coverage for direct entitlements involving inactive attribute values without altering production behavior. The new cases cover inactive-value denial, mixed-value denial, and continued access for active siblings, with no current merge-blocking risk identified.

Suggested reviewers: alkalescent

Poem

A rabbit checks each value in line
One sleeps, one stays active and fine
The PDP guards the sleeping gate
Mixed paths now meet a denied fate
While active siblings still pass through
The tests confirm what rules should do

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the PDP issue involving permit decisions for inactive attribute values and direct entitlements. It matches the pull request objective and is specific enough for project hi…

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch DSPX-4630-direct-entitlements-allow-inactive-attr-decrypt

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

• otdfctl
• service
• tests-bdd

See the workflow run for details.

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	139.780461ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	80.107465ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	268.245641ms
Throughput	372.79 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	36.284379813s
Average Latency	362.197492ms
Throughput	137.80 requests/second

[github-actions]

X-Test Results

bats-test-results
✅ go@pull-3984-main
✅ go@main-pull-3984
✅ go@main-main
✅ go@pull-3984-pull-3984
✅ go@pull-3984-v0.9.0
✅ go@main-v0.9.0
✅ java@main-pull-3984
✅ java@main-main
✅ js@main-main
cukes-report
✅ js@main-v0.9.0
✅ js@main-pull-3984
✅ java@main-v0.9.0
opentdfplatformVBDKC8.dockerbuild
govulncheck-failure-8
govulncheck-failure-3
govulncheck-failure-1