fix(core): log at debug instead of error for expected IPC missing client id state

[jakedoublev]

Closes #3631

Summary by CodeRabbit

• Bug Fixes
  • Refined error handling and logging behavior in authentication metadata retrieval to appropriately categorize and report different error conditions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 9be0dfc2-ced6-4785-8648-9e0a080c233e

📥 Commits

Reviewing files that changed from the base of the PR and between da38619 and 22462ed.

📒 Files selected for processing (1)

• service/internal/auth/authn.go

---

📝 Walkthrough

Walkthrough

In IPCMetadataClientInterceptor, the error handling for client-ID retrieval is changed from an if/else to a switch statement. ErrNoMetadataFound is now an explicit no-op, ErrMissingClientID is downgraded from error to debug logging, and all other errors continue to log at error level.

Changes

IPC Interceptor Log Level Fix

Layer / File(s)	Summary
Error handling switch in IPCMetadataClientInterceptor service/internal/auth/authn.go	Replaces the two-branch if/else with a switch over the client-ID retrieval error: ErrNoMetadataFound is silently suppressed, ErrMissingClientID logs at debug level, and unexpected errors still log at error level.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

🐇 A hop through the logs, a tweak to the noise,
No more false alarms to muddy the poise.
ErrMissingClientID sneaks to debug's den,
While errors that matter still holler again.
The rabbit refactors, and all is serene! 🌿

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title directly and specifically describes the main change: downgrading the log level from error to debug for expected missing client ID conditions in IPC flows.
Linked Issues check	✅ Passed	The changes align with all five objectives from issue #3631: reducing operational noise, aligning severity with impact, maintaining consistency with ErrNoMetadataFound handling, preserving debuggability, and targeting the correct component and function.
Out of Scope Changes check	✅ Passed	All changes are limited to error handling and logging severity in IPCMetadataClientInterceptor; no unrelated modifications to control flow, headers, or other components are present.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/DSPX-3632

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request updates the logging behavior within the IPC metadata interceptor to prevent unnecessary error logs when a client ID is missing. Since missing client IDs can occur during legitimate IPC calls across service boundaries, logging these as debug messages provides better visibility without triggering false-positive error alerts.

Highlights

• Logging adjustment: Changed the log level for missing client ID errors in the IPC metadata interceptor from error to debug to reduce noise for expected scenarios.

New Features

🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

---

In code where the signals are sent, An error was not what we meant. With debug now in place, We clear up the space, And logs are now calm and content.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request updates the IPCMetadataClientInterceptor in service/internal/auth/authn.go to handle different error types returned by GetClientIDFromContext using a switch statement. Specifically, it ignores ErrNoMetadataFound, logs ErrMissingClientID at the debug level to assist with debugging, and continues to log all other errors at the error level. There are no review comments, and I have no feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	183.027239ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	106.276443ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	426.579491ms
Throughput	234.42 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	45.834400107s
Average Latency	456.620854ms
Throughput	109.09 requests/second

[github-actions]

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

• examples
• otdfctl
• sdk
• service
• lib/fixtures
• tests-bdd

See the workflow run for details.

[github-actions]

X-Test Results

✅ go@main-pull-3636
✅ go@main-v0.9.0
✅ java@main-v0.9.0
✅ java@main-pull-3636
✅ js@main-pull-3636
✅ js@main-v0.9.0
cukes-report
opentdfplatformVUOSQ3.dockerbuild
govulncheck-failure-8
govulncheck-failure-0
govulncheck-failure-3
govulncheck-failure-1
govulncheck-failure-5
govulncheck-failure-2