fix(authz): Add exponential pagination backoff on subject mapping list for v2 GetDecisions by elizabethhealy · Pull Request #3832 · opentdf/platform

elizabethhealy · 2026-08-04T17:17:45Z

Proposed Changes

Subject mappings can be >= 4mb if they have many scs, this can cause resource exhaustion errors
Adds an exponential backoff to the pagination list limit to avoid this error
- basically if it sees a resource exhaustion error, it cuts the list page limit and tries again

Checklist

I have added or updated unit tests
I have added or updated integration tests (if appropriate)
I have added or updated documentation

Testing Instructions

Summary by CodeRabbit

Bug Fixes
- Improved authorization policy retrieval when responses exceed message-size limits by automatically retrying with smaller page sizes.
- Preserved complete results across paginated requests while continuing to surface unrelated errors.
- Decision requests now succeed for large subject-mapping configurations when authorization remains valid.
Tests
- Added coverage for pagination, retry behavior, error handling, and large authorization configurations.
- Updated test logging to report result counts instead of full response contents.

coderabbitai · 2026-08-04T17:17:52Z

Warning

Review limit reached

@elizabethhealy, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 25 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 9cb444d8-6cd6-4f88-812e-66d2a02922a8

📥 Commits

Reviewing files that changed from the base of the PR and between 4a83a3a and 580daa5.

📒 Files selected for processing (3)

tests-bdd/cukes/steps_attributes.go
tests-bdd/cukes/steps_subjectmappings.go
tests-bdd/features/authz-v2-resource-exhaustion-attribute-values.feature

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the subject-mapping pagination backoff added for v2 GetDecisions, which matches the primary objective.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-08-04T17:22:12Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	143.660446ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	75.046117ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	302.695245ms
Throughput	330.37 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	40.638662775s
Average Latency	404.673106ms
Throughput	123.04 requests/second

github-actions · 2026-08-04T17:27:27Z

X-Test Failure Report

cukes-report
govulncheck-failure-2
opentdf~~platform~~L6S43G.dockerbuild
govulncheck-failure-8
govulncheck-failure-3
govulncheck-failure-5
govulncheck-failure-1
govulncheck-failure-0

github-actions · 2026-08-04T17:30:12Z

X-Test Failure Report

govulncheck-failure-0
opentdf~~platform~~XRU8ZL.dockerbuild
govulncheck-failure-1
govulncheck-failure-3
govulncheck-failure-8
govulncheck-failure-2
govulncheck-failure-5

github-actions · 2026-08-04T17:31:27Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	210.134538ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	106.60281ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	439.348585ms
Throughput	227.61 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	48.347803925s
Average Latency	481.191033ms
Throughput	103.42 requests/second

github-actions · 2026-08-04T17:33:21Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	196.229465ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	107.454783ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	436.889542ms
Throughput	228.89 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	51.802587725s
Average Latency	515.102711ms
Throughput	96.52 requests/second

github-actions · 2026-08-04T17:41:12Z

X-Test Failure Report

✅ js@main-main
✅ java@main-v0.9.0
✅ js@main-v0.9.0
cukes-report
govulncheck-failure-1
opentdf~~platform~~36RIYZ.dockerbuild
govulncheck-failure-8
govulncheck-failure-3
govulncheck-failure-5
govulncheck-failure-2
govulncheck-failure-0

github-actions · 2026-08-04T17:45:33Z

X-Test Failure Report

bats-test-results
govulncheck-failure-2
opentdf~~platform~~V48MTG.dockerbuild
govulncheck-failure-1
govulncheck-failure-8
govulncheck-failure-3
govulncheck-failure-5
govulncheck-failure-0

github-actions · 2026-08-04T17:51:53Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	225.158525ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	109.986049ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	422.160154ms
Throughput	236.88 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	49.90290659s
Average Latency	497.285027ms
Throughput	100.19 requests/second

github-actions · 2026-08-04T18:01:43Z

github-actions · 2026-08-04T19:15:50Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	210.455552ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	112.703211ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	402.818565ms
Throughput	248.25 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	49.291562365s
Average Latency	491.453241ms
Throughput	101.44 requests/second

github-actions · 2026-08-04T19:24:02Z

github-actions · 2026-08-04T19:35:44Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	225.595277ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	117.648275ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	410.625533ms
Throughput	243.53 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	52.319257825s
Average Latency	521.593752ms
Throughput	95.57 requests/second

github-actions · 2026-08-04T19:44:45Z

github-actions · 2026-08-04T21:56:58Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	197.093896ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	101.329467ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	612.776298ms
Throughput	163.19 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	48.565326176s
Average Latency	484.323302ms
Throughput	102.95 requests/second

github-actions · 2026-08-04T22:06:24Z

github-actions · 2026-08-05T15:53:33Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	222.702898ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	123.088968ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	445.337537ms
Throughput	224.55 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	54.31428294s
Average Latency	541.662568ms
Throughput	92.06 requests/second

github-actions · 2026-08-05T16:02:59Z

coderabbitai · 2026-08-06T14:39:36Z

⚠️ Action not completed

Already reviewed.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

github-actions · 2026-08-06T14:52:29Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	220.959175ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	118.911115ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	421.578619ms
Throughput	237.20 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	50.939322937s
Average Latency	507.580438ms
Throughput	98.16 requests/second

github-actions · 2026-08-06T15:02:21Z

github-actions · 2026-08-06T15:05:03Z

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

examples
otdfctl
sdk
service
lib/fixtures
tests-bdd

See the workflow run for details.

github-actions · 2026-08-06T15:07:33Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	171.057513ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	88.276531ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	344.670365ms
Throughput	290.13 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	42.789604447s
Average Latency	426.403223ms
Throughput	116.85 requests/second

alkalescent · 2026-08-06T16:10:45Z

+// when returning an error.
+func paginateAll(fetchPage func(offset, limit int32) (nextOffset int32, err error)) error {
+	var offset int32
+	limit := int32(entitlementPolicyMaxPageSize)


What happens when the policy service max is lower than the hardcoded 2500; does it fail? What if we use ListRequestLimitDefault from service/policy/config/config.go here as the initial limit instead?

strantalis · 2026-08-06T20:46:01Z

@elizabethhealy do we have more context around where we are seeing this issue? Also does this have to do with us requesting all of policy?

elizabethhealy · 2026-08-07T14:04:14Z

@elizabethhealy do we have more context around where we are seeing this issue? Also does this have to do with us requesting all of policy?

@strantalis this specific failure hasnt come up from customers, but there was an issue around v1 getdecisions resource exhaustion #3821 -- we decided to just reccomend upgrading to v2 as a solution there -- but that triggered my investigation into the v2 logic and if resource exhaustion could be triggered there and i found this issue with overly padded subject mappings and resource mappings. ya i believe it does stem from the fact that were pulling all of policy. this is just a short term fix to make sure we dont run into any errors, but as were growing i believe pulling all of policy into memory to do getdecisions may not be feasible anymore -- we may have to rethink the logic here.

elizabethhealy · 2026-08-07T16:34:25Z

moving back to draft until needed

add resource exhaustion test

9bac33b

github-actions Bot added the size/xs label Aug 4, 2026

replace print with count

784210f

remove unused import

0f1f960

Update get_decisions_resource_exhaustion_rt_test.go

1e9b895

only run the one

d3dc589

use a page size backoff for listing

8c588fb

cleanup

a5d4350

switch the rt test to a cuke, reduce comments

13b8886

elizabethhealy changed the title ~~DRAFT: fix(authz): get decision resource exhaustion~~ DRAFT: fix(authz): get decision v2 resource exhaustion Aug 5, 2026

update feature

4a83a3a

elizabethhealy changed the title ~~DRAFT: fix(authz): get decision v2 resource exhaustion~~ fix(authz): Add exponential pagination backoff on subject mapping list for v2 GetDecisions Aug 5, 2026

elizabethhealy marked this pull request as ready for review August 6, 2026 14:34

elizabethhealy requested a review from a team as a code owner August 6, 2026 14:34

add another cuke

be2869a

reduce comments

580daa5

alkalescent reviewed Aug 6, 2026

View reviewed changes

elizabethhealy marked this pull request as draft August 7, 2026 16:34

Uh oh!

Conversation

elizabethhealy commented Aug 4, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed Changes

Checklist

Testing Instructions

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

github-actions Bot commented Aug 4, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Aug 4, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Aug 4, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Aug 4, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Aug 4, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Aug 4, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Aug 4, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Aug 4, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Aug 4, 2026

X-Test Results

Uh oh!

github-actions Bot commented Aug 4, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Aug 4, 2026

X-Test Results

Uh oh!

github-actions Bot commented Aug 4, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Aug 4, 2026

X-Test Results

Uh oh!

github-actions Bot commented Aug 4, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

elizabethhealy commented Aug 4, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 4, 2026 •

edited

Loading

coderabbitai Bot commented Aug 6, 2026 •

edited

Loading

strantalis commented Aug 6, 2026 •

edited

Loading