feat(sdk): source-file codegen for EntityIdentifier helpers

[marythought]

Summary

• Implements the source-file codegen approach for proto helper generation
• Adds five convenience constructors (ForToken, WithRequestToken, ForClientID, ForEmail, ForUserName) that live in the authorizationv2 proto package — no extra import needed
• Source files in protocol/go/internal/authorization/v2/ have full IDE support and standard unit tests; Go's internal package rule prevents external consumers from importing them directly
• protocol/codegen (separate Go module, stdlib only) copies source files into proto packages at build time, stripping the self-referencing import and type qualifiers so the output compiles in-package
• Wired into make proto-generate after buf generate and before sdk/codegen
• CI change detection broadened to trigger proto-generate checks on Makefile, buf config, and codegen directory changes (not just .proto files)

Before / After

Before

Constructing an EntityIdentifier requires 4 levels of proto nesting:

req := &authorization.GetDecisionRequest{
    EntityIdentifier: &authorization.EntityIdentifier{
        Identifier: &authorization.EntityIdentifier_EntityChain{
            EntityChain: &entity.EntityChain{
                Entities: []*entity.Entity{{
                    EntityType: &entity.Entity_ClientId{ClientId: "opentdf"},
                    Category:   entity.Entity_CATEGORY_SUBJECT,
                }},
            },
        },
    },
    // ...
}

After

One-line convenience constructors in the same proto package:

req := &authorization.GetDecisionRequest{
    EntityIdentifier: authorization.ForClientID("opentdf"),
    // ...
}

All five constructors:

authorization.ForToken("eyJhbGci...")        // from JWT
authorization.WithRequestToken()              // use request's Authorization header
authorization.ForClientID("opentdf")          // client ID subject
authorization.ForEmail("user@example.com")    // email subject
authorization.ForUserName("alice")            // username subject

How it works

protocol/
├── codegen/                          # Separate Go module (stdlib only, own go.mod)
│   ├── go.mod
│   ├── main.go                       # Reads internal/, copies to target dirs
│   └── main_test.go                  # Import rewriting and stale file cleanup tests
└── go/
    ├── internal/                     # Source files (survive proto-generate, not importable externally)
    │   └── authorization/v2/
    │       ├── entity_identifier.go      # Normal Go file, full IDE support
    │       └── entity_identifier_test.go # Standard unit tests
    └── authorization/v2/             # Proto-generated (nuked and recreated)
        ├── authorization.pb.go           # buf generate output
        ├── authorization_grpc.pb.go      # buf generate output
        └── entity_identifier.gen.go      # Copied from internal/ at build time

Source files import the proto package explicitly for compilation/IDE support. The codegen tool strips the self-referencing import and qualifier prefix when copying, producing clean in-package code. All source files are read and transformed before any existing .gen.go files are removed, so a failed read won't leave the target directory empty.

The codegen tool lives in protocol/codegen/ with its own go.mod (stdlib only), outside the protocol/go/ tree. This means the Makefile find cleanup only needs to exclude internal/ — no complicated exclusion patterns.

Test plan

• cd protocol/codegen && GOWORK=off go test ./... — import rewriting and stale file cleanup tests pass
• cd protocol/codegen && GOWORK=off go run . — generates .gen.go with correct import rewriting
• go test ./protocol/go/internal/authorization/v2/... — source tests pass
• go build ./protocol/go/authorization/v2/... — proto package builds with generated helpers
• go test ./sdk/... — no breakage from removing old sdk helper files
• golangci-lint run — 0 issues on all new files

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Added helper constructors to build entity identifiers from JWTs, request tokens, client IDs, emails, and usernames.
  • Added a dedicated codegen command to generate protocol helper sources.

• Chores

  • Split protocol code generation into an independent helper target and integrated it into the main generation flow.
  • Broadened CI change detection to trigger protocol-related generation when relevant files change.

• Tests

  • Added tests validating codegen transformations and entity-identifier constructors.

[coderabbitai]

Warning

Rate limit exceeded

@marythought has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 5 minutes and 10 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 5 minutes and 10 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 03ef7a46-325e-4b93-b059-c25181dfca02

📥 Commits

Reviewing files that changed from the base of the PR and between 37fa13a and 54c5bef.

⛔ Files ignored due to path filters (1)

• protocol/codegen/go.work is excluded by !**/*.work

📒 Files selected for processing (3)

• protocol/codegen/go.mod
• protocol/codegen/main.go
• protocol/codegen/main_test.go

📝 Walkthrough

Walkthrough

Adds a new standalone codegen tool in protocol/codegen that generates exported helper .gen.go files from sources in protocol/go/internal/; updates Makefile and CI to run and detect this codegen step; adds internal entity identifier helpers and their generated public counterparts plus tests.

Changes

Cohort / File(s)	Summary
Build & CI Makefile, .github/workflows/checks.yaml	Makefile: add proto-helper-generate target, run protocol/codegen step from proto-generate, and adjust cleanup to preserve internal dirs. Workflow: extend proto-change detection to include Makefile, buf.*, protocol/codegen/, protocol/go/internal/, and sdk/codegen/.
Codegen tool protocol/codegen/go.mod, protocol/codegen/main.go, protocol/codegen/main_test.go	New Go module and executable that reads mapped internal/ Go files, removes self-referencing proto imports and alias qualifiers, cleans stale *.gen.go files, writes transformed *.gen.go outputs, and includes unit tests for import rewriting and stale-file removal.
Internal helpers & tests protocol/go/internal/authorization/v2/entity_identifier.go, protocol/go/internal/authorization/v2/entity_identifier_test.go	Add internal constructors (ForToken, WithRequestToken, ForClientID, ForEmail, ForUserName) and comprehensive tests verifying variants, categories, and edge cases.
Generated helpers protocol/go/authorization/v2/entity_identifier.gen.go	New generated public constructors mirroring the internal helpers, produced by the codegen tool (stripped imports/qualifiers).

Sequence Diagram

sequenceDiagram
    participant Src as Internal Source\n(protocol/go/internal/*)
    participant CG as Codegen Tool\n(protocol/codegen)
    participant FS as Filesystem\n(protocol/go/*)
    Src->>CG: Read mapped .go source files
    CG->>CG: Rewrite imports & strip alias qualifiers
    CG->>FS: Remove stale `*.gen.go` files
    CG->>FS: Write new `*.gen.go` outputs
    FS-->>FS: `entity_identifier.gen.go` created/updated

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~22 minutes

Poem

🐇 I nibble at imports, hop through each file bright,
I strip an alias here and make the helpers right.
From internal burrows to public meadow gleam,
I sprout small constructors — a developer's dream.

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 44.62% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the primary change: introducing a source-file codegen approach to generate EntityIdentifier helper constructors.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch DSPX-2594-entity-identifier-helpers

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces a set of ergonomic constructor functions within the SDK to streamline the instantiation of authorization entity identifiers. By abstracting the underlying protocol buffer structure, these changes make the developer experience more intuitive and reduce the verbosity required for common authorization tasks.

Highlights

• Convenience Constructors: Added five new helper functions (ForToken, WithRequestToken, ForClientID, ForEmail, ForUserName) to simplify the creation of EntityIdentifier objects.
• Reduced Boilerplate: Significantly reduced the complexity of authorization requests by eliminating the need for deep proto nesting when defining entity identifiers.
• Testing: Included comprehensive unit tests for all new constructors to ensure correct protocol buffer structure generation.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

---

With builders clean and code so bright, / The nested structs now take to flight. / No more deep chains to make us weep, / Just simple calls for us to keep.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	189.101595ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	93.984904ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	383.151481ms
Throughput	260.99 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.778792206s
Average Latency	395.79023ms
Throughput	125.70 requests/second

[github-actions]

X-Test Results

✅ go-pull-3232
✅ go-v0.9.0
✅ java-pull-3232
✅ js-pull-3232
✅ java-v0.9.0
✅ js-v0.9.0
test-cases-mapping-report
bats-test-results
cukes-report
opentdfplatformJF2PK6.dockerbuild

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	183.510297ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	89.736877ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	409.024782ms
Throughput	244.48 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	40.392944017s
Average Latency	402.245808ms
Throughput	123.78 requests/second

[github-actions]

X-Test Results

✅ go-pull-3232
✅ go-v0.9.0
✅ java-pull-3232
✅ java-v0.9.0
✅ js-pull-3232
✅ js-v0.9.0
test-cases-mapping-report
bats-test-results
cukes-report
opentdfplatform6QOC6Y.dockerbuild

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	202.230264ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	100.49553ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	383.932203ms
Throughput	260.46 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.983775709s
Average Latency	398.453395ms
Throughput	125.05 requests/second

[github-actions]

X-Test Results

✅ go-pull-3232
✅ go-v0.9.0
✅ java-pull-3232
✅ js-pull-3232
✅ java-v0.9.0
test-cases-mapping-report
bats-test-results
✅ js-v0.9.0
cukes-report
opentdfplatformGOI5R6.dockerbuild

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@protocol/go/authorization/v2/entity_identifier_test.go`:
- Around line 34-98: The three tests TestForClientID, TestForEmail, and
TestForUserName duplicate the same assertions; refactor them into a single
table-driven test (e.g., TestEntityChainConstructors) that iterates over cases
with fields: name, constructor (ForClientID/ForEmail/ForUserName), input string,
a small checker to extract the expected value from the entity (using type
assertions to *entity.Entity_ClientId, *entity.Entity_EmailAddress,
*entity.Entity_UserName), and expected value; inside each subtest call the
constructor, use extractEntityChain and chain.GetEntities(), assert len==1, run
the checker and compare the returned value to expected, and assert
e.GetCategory() == entity.Entity_CATEGORY_SUBJECT to replace the three existing
tests.
- Around line 1-107: Add edge-case unit tests that exercise empty-string inputs
and ensure constructors behave as intended: create tests like
TestForClientID_EmptyString, TestForEmail_EmptyString,
TestForUserName_EmptyString and TestForToken_EmptyString that call
ForClientID(""), ForEmail(""), ForUserName(""), ForToken("") respectively, use
extractEntityChain(t, eid) (or GetIdentifier for Token) to retrieve the created
entity, assert the chain/entities length is still correct (e.g., 1) and that the
specific field (ClientId, EmailAddress, UserName, Token.Jwt) equals the empty
string (or whatever the defined behavior should be), and for WithRequestToken
consider a test asserting that WithRequestToken still returns true/false as
expected; make sure to follow existing test patterns (extractEntityChain, type
assertions like (*entity.Entity_ClientId), and category checks) to keep
consistency.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 77800d08-e88c-4e00-81e7-569b52d2fa87

📥 Commits

Reviewing files that changed from the base of the PR and between 780ef79 and 3803d27.

📒 Files selected for processing (1)

• protocol/go/authorization/v2/entity_identifier_test.go

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	175.812045ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	83.027364ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	403.147059ms
Throughput	248.05 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	42.545200729s
Average Latency	423.652456ms
Throughput	117.52 requests/second

[github-actions]

X-Test Results

✅ go-pull-3232
✅ java-pull-3232
✅ go-v0.9.0
✅ js-pull-3232
✅ java-v0.9.0
✅ js-v0.9.0
test-cases-mapping-report
bats-test-results
cukes-report
opentdfplatformCGRWL8.dockerbuild

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	199.213828ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	100.622403ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	382.076638ms
Throughput	261.73 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	40.814419605s
Average Latency	405.593548ms
Throughput	122.51 requests/second

[github-actions]

X-Test Failure Report

✅ java-pull-3232
✅ go-v0.9.0
✅ js-pull-3232
✅ java-v0.9.0
test-cases-mapping-report
✅ js-v0.9.0
bats-test-results
cukes-report
opentdfplatformVOA47Z.dockerbuild

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	203.404755ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	99.689247ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	384.677875ms
Throughput	259.96 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	40.444486178s
Average Latency	402.623917ms
Throughput	123.63 requests/second

[github-actions]

X-Test Results

✅ go-pull-3232
✅ go-v0.9.0
✅ java-pull-3232
✅ js-pull-3232
✅ java-v0.9.0
✅ js-v0.9.0
test-cases-mapping-report
bats-test-results
cukes-report
opentdfplatformTKZ8TN.dockerbuild

[marythought]

Implementation approach is pending decision on ADR: Proto helper code generation. The current PR places helpers in the sdk package as an interim solution; the final location will depend on the ADR outcome.

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	156.462307ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	78.00071ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	384.808246ms
Throughput	259.87 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.614376179s
Average Latency	384.492865ms
Throughput	129.49 requests/second

[github-actions]

X-Test Results

✅ go-pull-3232
✅ java-pull-3232
✅ go-v0.9.0
✅ js-pull-3232
✅ java-v0.9.0
✅ js-v0.9.0
test-cases-mapping-report
bats-test-results
cukes-report
opentdfplatform52KK3Q.dockerbuild
govulncheck-failure-7
govulncheck-failure-2

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	204.873202ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	100.159686ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	380.204207ms
Throughput	263.02 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	40.801260413s
Average Latency	404.80639ms
Throughput	122.55 requests/second

[github-actions]

X-Test Failure Report

cukes-report
opentdfplatformIZM8MB.dockerbuild
govulncheck-failure-7
govulncheck-failure-2

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	190.148246ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	89.787127ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	411.880809ms
Throughput	242.79 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	40.600390532s
Average Latency	404.569719ms
Throughput	123.15 requests/second

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@protocol/codegen/go.mod`:
- Around line 1-3: Update the Go toolchain version in the module directive to a
patched release to silence stdlib OSV warnings; in the go.mod for module
github.com/opentdf/platform/protocol/codegen replace the "go 1.25.0" directive
with the patched version used in the workspace (e.g., "go 1.25.8") so the
codegen tool aligns with the workspace toolchain and addresses the flagged
stdlib advisories.

In `@protocol/go/authorization/v2/entity_identifier.gen.go`:
- Around line 10-64: The new helper constructors (ForToken, WithRequestToken,
ForClientID, ForEmail, ForUserName, entityIdentifierFromEntity) are available
and callers should use them instead of manually constructing EntityIdentifier
structs; update locations such as accessPdp.go to replace inline builds of
EntityIdentifier/EntityChain/Entity with calls to
ForClientID/ForEmail/ForUserName (or ForToken/WithRequestToken as appropriate)
so the code is simpler and consistent across the codebase.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 920c0c2c-c700-40a8-bbc8-d815ba7eb616

📥 Commits

Reviewing files that changed from the base of the PR and between f5130f9 and 7a155ef.

📒 Files selected for processing (8)

• .github/workflows/checks.yaml
• Makefile
• protocol/codegen/go.mod
• protocol/codegen/main.go
• protocol/codegen/main_test.go
• protocol/go/authorization/v2/entity_identifier.gen.go
• protocol/go/internal/authorization/v2/entity_identifier.go
• protocol/go/internal/authorization/v2/entity_identifier_test.go

[github-actions]

X-Test Results

✅ go-pull-3232
✅ java-pull-3232
✅ go-v0.9.0
✅ js-pull-3232
✅ java-v0.9.0
✅ js-v0.9.0
test-cases-mapping-report
bats-test-results
cukes-report
opentdfplatformVI32T8.dockerbuild
govulncheck-failure-7
govulncheck-failure-2

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	196.502758ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	96.677213ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	386.831695ms
Throughput	258.51 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	40.139562371s
Average Latency	399.95873ms
Throughput	124.57 requests/second

[github-actions]

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

• service
• tests-bdd

See the workflow run for details.

[github-actions]

X-Test Results

✅ go-pull-3232
✅ go-v0.9.0
✅ java-pull-3232
✅ java-v0.9.0
✅ js-pull-3232
✅ js-v0.9.0
test-cases-mapping-report
bats-test-results
cukes-report
opentdfplatformVVG2MY.dockerbuild
govulncheck-failure-7
govulncheck-failure-2