fix(policy): narrow authorization attribute lookups

[strantalis]

Proposed Changes

GetEntitleableAttributesByFqns was using the general attribute query, which hydrated unrelated values, mappings, grants, and keys before issuing its targeted subject-mapping query. Add an authorization-specific SQL query that selects requested values and the ordered active siblings required for hierarchy evaluation.

Preserve normalization, inactive-value errors, missing-value errors, hierarchy order, namespace identity, and allow-traversal behavior. General attribute reads and key mapping lookups continue using their existing queries. No schema migration or public protocol change is needed.

This addresses the default decision path exercised by DSPX-4625. It is separate from the paginated ListSubjectMappings optimization.

Layer 1 of 7 in the authorization performance stack. Review and merge from the bottom upward.

Checklist

• Added or updated unit or integration coverage appropriate to this layer
• Ran focused verification for this layer
• Documented behavior and validation limits below

Testing Instructions

• Focused policy DB and authorization tests, including race-enabled GetEntitleableAttributesByFqns integration tests, passed.
• Used the current DSPX-4625 test fixture through a local Go overlay: 6,011 subject mappings, 6,000 resource mappings, three resources per request, 50 concurrent requests, cache and experimental features disabled. The fixture remains in its separate test task.
• Two local comparisons gave p95 of 4.066s and 4.027s with the old lookup, versus 135.6ms and 133.6ms with the targeted lookup. All 50 requests returned the expected decisions in each run. These are local regression measurements, not a production latency guarantee.
• Generated SQL with make policy-sql-gen; make fmt passed.

Stack-wide validation:

• Focused race tests, the full verbose policy integration suite with the race detector, SDK README code-block tests, formatting, and service lint restricted to changes since the stack base passed with zero new issues.
• make test was attempted with Colima configured. The round-trip suite failed because its required platform server at 127.0.0.1:8080 was not running.
• make lint stopped because the configured Buf API token is invalid. Separate make go-lint reported existing repository issues; the formatting issue in the new hierarchy test was corrected.
• make govulncheck reported vulnerabilities in the existing dependencies and the installed Go 1.26.3 standard library. This stack changes no dependency versions.
• GitHub CI is still running. Keep this stack in draft pending review and CI results.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	238.731867ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	130.726931ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	413.145896ms
Throughput	242.05 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	41.437711459s
Average Latency	413.643254ms
Throughput	120.66 requests/second

[github-actions]

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

• otdfctl
• service
• tests-bdd

See the workflow run for details.

[github-actions]

X-Test Results

✅ go@pull-3986-main
✅ go@pull-3986-pull-3986
✅ go@pull-3986-v0.9.0
✅ go@main-v0.9.0
✅ go@main-main
✅ java@main-pull-3986
cukes-report
bats-test-results
✅ go@main-pull-3986
✅ js@main-main
✅ js@main-pull-3986
✅ java@main-main
✅ js@main-v0.9.0
✅ java@main-v0.9.0
opentdfplatformTQPUGI.dockerbuild
govulncheck-failure-3
govulncheck-failure-8
govulncheck-failure-1