From 14465856e38570d59f1b3ffaa690ef17bba9fdda Mon Sep 17 00:00:00 2001 From: strantalis Date: Thu, 22 Oct 2026 18:27:22 -0400 Subject: [PATCH 1/2] fix(docs): H3-1137 use Go 1.26.10 Signed-off-by: strantalis --- docs/getting-started/docker-compose.yaml | 2 +- tests/sdk-examples/go/go.mod | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/getting-started/docker-compose.yaml b/docs/getting-started/docker-compose.yaml index 3e8e8a74..a8dd2d62 100644 --- a/docs/getting-started/docker-compose.yaml +++ b/docs/getting-started/docker-compose.yaml @@ -531,7 +531,7 @@ services: # Generate hybrid post-quantum KAS keys (X-Wing, P256+ML-KEM-768, P384+ML-KEM-1024). # Uses a Go image to build and run the keygen from the platform source. generate-pqc-keys: - image: golang:1.25-alpine + image: golang:1.26.10-alpine@sha256:27f2d3b83cfc5803c8078f8e730af0f7c431bf067afaec8f60a36fb763187cba volumes: - keys:/keys depends_on: diff --git a/tests/sdk-examples/go/go.mod b/tests/sdk-examples/go/go.mod index 245c6aea..aa447b75 100644 --- a/tests/sdk-examples/go/go.mod +++ b/tests/sdk-examples/go/go.mod @@ -1,6 +1,6 @@ module github.com/opentdf/docs/examples -go 1.25.0 +go 1.26.10 require ( github.com/opentdf/platform/lib/ocrypto v0.10.0 From 0496eb9dc4ab0351bd6c90c265b5d6552d937107 Mon Sep 17 00:00:00 2001 From: strantalis Date: Fri, 23 Oct 2026 06:58:46 -0400 Subject: [PATCH 2/2] chore(deps): H3-1137 refresh vendored OpenAPI specs --- .../policy/attributes/attributes.openapi.yaml | 102 +++++++++++++++++- .../dynamic_value_mapping.openapi.yaml | 2 +- 2 files changed, 99 insertions(+), 5 deletions(-) diff --git a/specs/policy/attributes/attributes.openapi.yaml b/specs/policy/attributes/attributes.openapi.yaml index 3588e95d..1b1392ca 100644 --- a/specs/policy/attributes/attributes.openapi.yaml +++ b/specs/policy/attributes/attributes.openapi.yaml @@ -199,7 +199,7 @@ paths: summary: GetEntitleableAttributesByFqns description: |- Returns only entitlement-relevant information (rule, value identity, ordered - definition values, and subject mappings) for the requested attribute value + definition values, subject mappings, and dynamic mappings) for the requested attribute value FQNs, for server-side decisioning / entitlement resolution. operationId: policy.attributes.AttributesService.GetEntitleableAttributesByFqns parameters: @@ -1216,6 +1216,88 @@ components: - booleanOperator additionalProperties: false description: A collection of Conditions evaluated by the boolean_operator provided + policy.DynamicValueMapping: + type: object + properties: + id: + type: string + title: id + attributeDefinition: + title: attribute_definition + description: the Attribute Definition whose values are entitled dynamically + $ref: '#/components/schemas/policy.Attribute' + valueResolver: + title: value_resolver + description: the dynamic resolver matched against the requested resource value segment + $ref: '#/components/schemas/policy.DynamicValueResolver' + subjectConditionSet: + title: subject_condition_set + description: |- + optional static pre-gate on the entity, evaluated with normal SubjectConditionSet + semantics (no dynamic overload). When present, both the gate and the resolver must + pass for entitlement. + $ref: '#/components/schemas/policy.SubjectConditionSet' + actions: + type: array + items: + $ref: '#/components/schemas/policy.Action' + title: actions + description: the actions permitted by subjects in this mapping + namespace: + title: namespace + description: the namespace containing this mapping + $ref: '#/components/schemas/policy.Namespace' + metadata: + title: metadata + $ref: '#/components/schemas/common.Metadata' + title: DynamicValueMapping + additionalProperties: false + description: |- + Dynamic Value Mapping: a Policy assigning permitted action(s) to + dynamically-requested values under an Attribute Definition. It raises entitlement + authority from a concrete Attribute Value to the Attribute Definition: at decision time + the value_resolver compares the requested resource value segment against the entity + representation, avoiding pre-provisioning a value + subject mapping per discrete value. + + Combination semantics: multiple dynamic value mappings on the same definition are OR-ed (any + match entitles); within a mapping, the optional subject_condition_set's subject sets are AND-ed + (every set must pass), matching subject mapping evaluation. + + Coexistence: a definition with a dynamic value mapping cannot also carry value-level subject + mappings, and values under such a definition cannot be added to a registered resource's action + attribute values (those values resolve at decision time, so they are not meaningful as static + registered-resource entitlements). + policy.DynamicValueResolver: + type: object + properties: + subjectExternalSelectorValue: + type: string + title: subject_external_selector_value + description: |- + a selector for a field value on a flattened Entity Representation (such as from + idP/LDAP), e.g. ".patientAssignments[]" + operator: + not: + enum: + - 2 + title: operator + description: |- + how the requested resource value segment is compared against each value the selector + resolves from the entity representation. NOT_IN is unsupported because dynamic resolution + is existential over the resolved entity values. IN_CONTAINS is substring-based and + over-matches by design (e.g. "admin" matches "superadmin", "admin-readonly"); prefer IN + unless substring matching is genuinely intended. + $ref: '#/components/schemas/policy.SubjectMappingOperatorEnum' + title: DynamicValueResolver + required: + - subjectExternalSelectorValue + - operator + additionalProperties: false + description: |- + Dynamic Value Resolver: the dynamic half of a DynamicValueMapping. It resolves a selector + against the entity representation, then tests whether any resolved entity value matches the + requested resource value segment under the operator. The match is inherently existential over + the resolved entity values. policy.KasPublicKey: type: object properties: @@ -2268,9 +2350,11 @@ components: the subject mappings needed to resolve entitlements. Hierarchy definitions additionally carry their ordered values with subject mappings, for hierarchy rule propagation. It does not return KAS keys, grants, resource mappings, - obligations, or metadata. A value that does not exist under a definition with - allow_traversal is returned with its definition and an empty value identity (no - value_id, no subject mappings). + obligations, or metadata. Missing policy values retain their active parent + definition with an empty value identity. Persisted inactive values retain + their identity and inactive state. Unknown or inactive parents are omitted. + Dynamic mappings are scoped to the returned definitions. The PDP decides + whether the returned policy entitles the request. policy.attributes.GetEntitleableAttributesByFqnsResponse: type: object properties: @@ -2338,6 +2422,12 @@ components: namespaced-policy decisioning and registered-resource matching. Only the identity is populated; grants, keys, and metadata are not. $ref: '#/components/schemas/policy.Namespace' + dynamicValueMappings: + type: array + items: + $ref: '#/components/schemas/policy.DynamicValueMapping' + title: dynamic_value_mappings + description: Dynamic mappings for this definition, for evaluation by the PDP. title: EntitleableDefinition additionalProperties: false description: |- @@ -2360,6 +2450,10 @@ components: $ref: '#/components/schemas/policy.SubjectMapping' title: subject_mappings description: subject mappings used to resolve entitlements for this value + active: + title: active + description: Present for persisted values. Missing policy values have no active state. + $ref: '#/components/schemas/google.protobuf.BoolValue' title: EntitleableValue additionalProperties: false description: An attribute value plus the subject mappings that entitle it. diff --git a/specs/policy/dynamicvaluemapping/dynamic_value_mapping.openapi.yaml b/specs/policy/dynamicvaluemapping/dynamic_value_mapping.openapi.yaml index 00ad9805..6c6d33f1 100644 --- a/specs/policy/dynamicvaluemapping/dynamic_value_mapping.openapi.yaml +++ b/specs/policy/dynamicvaluemapping/dynamic_value_mapping.openapi.yaml @@ -1230,7 +1230,7 @@ components: type: string title: namespace_id format: uuid - description: 'Optional: namespace ID or FQN for the mapping' + description: 'Required: namespace ID or FQN for the mapping' namespaceFqn: type: string title: namespace_fqn