chore(authz): prove stacked optimizations at policy scale

[strantalis]

Proposed Changes

Add the large-policy concurrency coverage from #3983 on top of the authorization performance stack. #3983 remains open against main for comparison; this PR validates the optimized implementation and publishes the same latency statistics in the GitHub Actions summary.

The fixture contains 6,011 subject mappings and 6,000 resource mappings. Each request asks the public V2 endpoint for three resource decisions, with synchronized concurrency levels of 1, 10, 25, and 50. Fixture creation is outside the measured operation. Every response must match its peers and contain the expected PERMIT decisions.

The fixture and summary reporting are copied from #3983 at a5ae1c5. The stack copy tightens the maximum duration from five seconds to 500 ms per request and separates that gate from a minimum five-second timeout. This lets regressions report completed-request timings while still failing the gate.

Layer 7 of 7, based on #3991. This is a comparison copy of #3983, not independent coverage that needs to be merged twice. Reconcile the duplicate test changes when one version lands.

Checklist

• Added public-endpoint regression coverage
• Retained decision correctness assertions
• Published latency statistics in the CI summary

Testing Instructions

Run each concurrency tag in a separate process when using PLATFORM_IMAGE=DEBUG. Reusing the inline platform across scenarios can retain authentication state. CI uses the containerized platform.

CUKES_LOG_HANDLER=console PLATFORM_IMAGE=DEBUG go test ./tests-bdd -v --tags=cukes --godog.tags=@concurrency-50 --count=1 features/authorization-v2-subject-mapping-performance.feature

Local results with the optimized stack, one process per concurrency level:

Concurrent requests	p95	Maximum	500 ms gate
1	43.85 ms	43.85 ms	Pass
10	67.65 ms	67.65 ms	Pass
25	73.58 ms	76.52 ms	Pass
50	122.93 ms	123.64 ms	Pass

Every optimized case passed its expected-decision assertions with zero failed requests. As a control, a temporary Go overlay restored the original SQL lookup from the stack base, 5173b4c, while retaining the same test and other stack changes. At 50 concurrent requests, that control recorded p95 3.975 s and maximum 4.182 s, with zero request errors or response inconsistencies. It failed the 500 ms gate as expected. This isolates the targeted-query improvement; it is not a benchmark of every optimization independently.

Validation:

• make fmt, cd tests-bdd && go test ./... -race, lint for the new tests-bdd changes, actionlint .github/workflows/checks.yaml, and SDK README code-block tests passed.
• The combined local inline-server run passed concurrency 1 but failed the subsequent three scenarios during setup because stale authentication state rejected their tokens. Running those scenarios in separate processes passed, as shown above. Containerized CI is still pending.
• make lint remains blocked by the configured invalid Buf API token. The stack's existing broad lint/dependency findings are outside this test-only copy.
• make test was rerun with Colima configured. The round-trip suite failed because its required local platform at 127.0.0.1:8080 was not running; no other package was reported failed.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	201.21514ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	117.335154ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	432.140324ms
Throughput	231.41 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.738357771s
Average Latency	386.598031ms
Throughput	129.07 requests/second

[github-actions]

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

• otdfctl
• service
• tests-bdd

See the workflow run for details.

[github-actions]

X-Test Results

bats-test-results
✅ go@main-main
✅ go@pull-3993-pull-3993
✅ go@pull-3993-main
✅ go@pull-3993-v0.9.0
✅ java@main-main
✅ java@main-pull-3993
✅ go@main-pull-3993
✅ go@main-v0.9.0
✅ java@main-v0.9.0
✅ js@main-main
✅ js@main-pull-3993
✅ js@main-v0.9.0
opentdfplatformTLGD5M.dockerbuild
govulncheck-failure-1
govulncheck-failure-8
govulncheck-failure-3