fix(authz): reuse hierarchy and entity selector indexes

[strantalis]

Proposed Changes

Hierarchy evaluation rebuilt the value-rank map and scanned entitlements for every resource. Build rank maps with the PDP and compute the highest matching entitlement once per definition and decision, including the registered-resource subject path.

Index flattened entity selectors once per entity during static subject-mapping evaluation. Also populate the existing selector deduplication set before querying matched subject mappings.

Layer 6 of 7 in the authorization performance stack. Review and merge from the bottom upward.

Checklist

• Added or updated unit or integration coverage appropriate to this layer
• Ran focused verification for this layer
• Documented behavior and validation limits below

Testing Instructions

• Race tests passed for access v2, authorization v2, obligations, and subjectmappingbuiltin.
• Added coverage for repeated decisions with different subjects/actions and indexed selector behavior across operators, arrays, and missing selectors.
• BenchmarkDecisionHierarchy, three samples on Apple M4 Max, 1,000 resources: a 1,000-value hierarchy went from about 17.8ms to 0.81ms; a 6,000-value hierarchy went from about 97ms to 1.23ms. For the latter, allocated bytes fell from about 221MB to 2.28MB per decision. The benchmark excludes PDP construction and measures in-process evaluation.
• Run with go test ./service/internal/access/v2 -run '^$' -bench BenchmarkDecisionHierarchy -benchtime=1s -count=3.

Stack-wide validation:

• Focused race tests, the full verbose policy integration suite with the race detector, SDK README code-block tests, formatting, and service lint restricted to changes since the stack base passed with zero new issues.
• make test was attempted with Colima configured. The round-trip suite failed because its required platform server at 127.0.0.1:8080 was not running.
• make lint stopped because the configured Buf API token is invalid. Separate make go-lint reported existing repository issues; the formatting issue in the new hierarchy test was corrected.
• make govulncheck reported vulnerabilities in the existing dependencies and the installed Go 1.26.3 standard library. This stack changes no dependency versions.
• GitHub CI is still running. Keep this stack in draft pending review and CI results.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

X-Test Failure Report

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	216.847517ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	125.522248ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	402.201686ms
Throughput	248.63 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	42.033415289s
Average Latency	419.479491ms
Throughput	118.95 requests/second

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	209.440863ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	123.456335ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	412.839231ms
Throughput	242.23 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	41.426910494s
Average Latency	413.345555ms
Throughput	120.69 requests/second

[github-actions]

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

• otdfctl
• service
• tests-bdd

See the workflow run for details.

[github-actions]

X-Test Results

bats-test-results
✅ go@pull-3991-main
✅ go@main-pull-3991
✅ go@main-main
✅ go@pull-3991-pull-3991
✅ go@main-v0.9.0
✅ java@main-main
✅ go@pull-3991-v0.9.0
cukes-report
✅ js@main-pull-3991
✅ js@main-main
✅ java@main-pull-3991
✅ js@main-v0.9.0
✅ java@main-v0.9.0
opentdfplatformKCQU9J.dockerbuild
govulncheck-failure-8
govulncheck-failure-3
govulncheck-failure-1