feat(cli): Unsafe update key cli

[c-r33d]

Summary

Adds CLI support for unsafely updating KAS registry keys through the new UnsafeUpdateKey service RPC.

This introduces:

• otdfctl policy kas-registry key unsafe update
• support for changing eligible keys between remote and public_key
• support for updating the provider config on an existing remote key
• unsafe confirmation behavior consistent with other destructive/unsafe key commands
• CLI docs and examples for the new command
• E2E BATS coverage for successful updates and service-originated validation errors

CLI Behavior

The new command accepts:

• --id: system key ID to update
• --mode: target key mode, limited client-side to remote or public_key
• --provider-config-id: provider config ID for remote mode or remote provider config updates
• --force: bypasses interactive unsafe confirmation

Request validation for provider config combinations is intentionally handled by the service. The CLI now validates only CLI-level concerns like required
flags, UUID parsing, and unsupported mode strings.

Testing

Updated otdfctl/e2e/kas-keys.bats to cover:

• remote to public key mode
• public key to remote mode
• remote provider config-only update
• invalid provider config UUID
• missing ID
• service errors for missing provider config
• service errors for provider config not allowed
• service errors for unsupported existing key mode

Depends On

• feat(policy): Add UnsafeUpdateKey rpc. #3728: feat(policy): Add UnsafeUpdateKey rpc.
• feat(policy): Add UnsafeUpdateKey implementation #3731: feat(policy): Add UnsafeUpdateKey implementation

Summary by CodeRabbit

• New Features

  • Added an unsafe update command for KAS keys.
  • Supports switching between remote and public_key modes.
  • Supports updating provider configuration for existing remote keys.
  • Added confirmation prompts and result details after updates.

• Bug Fixes

  • Added validation for unsupported modes, missing identifiers, and invalid provider configurations.

• Documentation

  • Added usage guidance and safety warnings for the new command.
  • Updated the unsafe delete command examples.

[coderabbitai]

Warning

Review limit reached

@c-r33d, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 52 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 3c5cd1f2-2a0d-4329-9fb8-b8c09abc41ff

📥 Commits

Reviewing files that changed from the base of the PR and between d97cf47 and bed77cb.

📒 Files selected for processing (1)

• otdfctl/docs/man/policy/kas-registry/key/unsafe/update.md

📝 Walkthrough

Walkthrough

Adds an unsafe KAS key update command with mode and provider configuration validation, confirmation, SDK integration, documentation, and end-to-end tests for supported and rejected update scenarios.

Changes

Unsafe KAS key update

Layer / File(s)	Summary
SDK unsafe-update wiring otdfctl/go.mod, otdfctl/pkg/handlers/kas-keys.go	Updates the platform SDK version and forwards unsafe update requests through UnsafeUpdateKasKey.
CLI command and validation otdfctl/cmd/policy/kasKeys.go, otdfctl/docs/man/policy/kas-registry/key/unsafe/*	Registers the update command, validates modes and flags, confirms the operation, renders the result, and documents supported usage.
Transition coverage and setup otdfctl/e2e/kas-keys.bats	Tests remote/public-key mode changes, provider configuration updates, required inputs, and invalid combinations.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant CLI
  participant KASKeyHandler
  participant UnsafeSDK
  CLI->>KASKeyHandler: Validate and submit unsafe update
  KASKeyHandler->>UnsafeSDK: UnsafeUpdateKey(id, mode, provider config)
  UnsafeSDK-->>KASKeyHandler: Updated KAS key
  KASKeyHandler-->>CLI: Render updated key metadata

Loading

Possibly related PRs

• opentdf/platform#3728: Provides the underlying unsafe update RPC wiring used by this CLI integration.
• opentdf/platform#3731: Implements and validates the server-side unsafe-update transition logic.

Suggested reviewers: alkalescent

Poem

A rabbit hops through keys tonight,
From remote paths to public light.
It checks each mode, confirms with care,
Sends provider details through the air.
“Unsafe,” it whispers, “but tests are bright!”

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: adding an unsafe update command to the CLI.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch unsafe-update-key-cli

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	223.681781ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	114.676486ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	426.003384ms
Throughput	234.74 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	46.392952672s
Average Latency	462.464573ms
Throughput	107.77 requests/second

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request adds support for unsafely updating KAS registry keys via a new CLI command and service RPC. It enables changing key modes between 'remote' and 'public_key' and updating provider configurations for existing remote keys, while ensuring necessary safety checks and validation are in place.

Highlights

• New CLI Command: Added otdfctl policy kas-registry key unsafe update to support modifying KAS registry keys.
• Service RPC: Introduced UnsafeUpdateKey RPC to allow switching key modes and updating provider configurations.
• Validation and Safety: Implemented strict validation for key modes and provider configurations, including interactive confirmation for unsafe operations.
• Testing: Expanded E2E BATS coverage and added unit tests for the new update functionality and error handling.

New Features

🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Ignored Files

• Ignored by pattern: docs/openapi/**/* (1)
  • docs/openapi/policy/unsafe/unsafe.openapi.yaml
• Ignored by pattern: protocol/**/* (3)
  • protocol/go/policy/unsafe/unsafe.pb.go
  • protocol/go/policy/unsafe/unsafe_grpc.pb.go
  • protocol/go/policy/unsafe/unsafeconnect/unsafe.connect.go

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

---

The keys were set in stone and cold, But now a change is brave and bold. With unsafe flags and careful hand, We update keys across the land.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request introduces an unsafe key update feature (UnsafeUpdateKey) allowing administrators to switch key modes between REMOTE and PUBLIC_KEY_ONLY or update the provider configuration for existing remote keys. The changes span Protobuf definitions, database queries, service-layer logic, CLI commands, and comprehensive tests. The review feedback suggests several defensive programming enhancements to prevent potential nil pointer dereferences when handling key objects and responses, as well as adding a default case to a key mode switch statement to ensure robust validation.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[github-actions]

X-Test Results

✅ go@main-pull-3733
✅ go@pull-3733-pull-3733
bats-test-results
✅ go@pull-3733-main
✅ go@main-main
✅ go@main-v0.9.0
✅ java@main-main
✅ java@main-pull-3733
✅ go@pull-3733-v0.9.0
✅ js@main-pull-3733
✅ java@main-v0.9.0
cukes-report
✅ js@main-v0.9.0
✅ js@main-main
opentdfplatformWOBAZX.dockerbuild
govulncheck-failure-3
govulncheck-failure-1
govulncheck-failure-8
govulncheck-failure-2
govulncheck-failure-5
govulncheck-failure-0

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	214.518208ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	113.29158ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	427.194209ms
Throughput	234.09 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	45.77429927s
Average Latency	455.679059ms
Throughput	109.23 requests/second

[github-actions]

X-Test Results

✅ go@pull-3733-main
✅ go@main-pull-3733
✅ go@main-main
✅ java@main-pull-3733
✅ go@pull-3733-v0.9.0
✅ java@main-main
✅ java@main-v0.9.0
✅ js@main-main
✅ go@main-v0.9.0
✅ go@pull-3733-pull-3733
✅ js@main-pull-3733
✅ js@main-v0.9.0
cukes-report
govulncheck-failure-3
opentdfplatformVFRI14.dockerbuild
govulncheck-failure-8
govulncheck-failure-1
govulncheck-failure-0
govulncheck-failure-5
govulncheck-failure-2

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[github-actions]

X-Test Failure Report

[github-actions]

X-Test Failure Report

opentdfplatformMBXEB9.dockerbuild
govulncheck-failure-8
govulncheck-failure-3
govulncheck-failure-1
govulncheck-failure-0
govulncheck-failure-5
govulncheck-failure-2

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	199.766478ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	105.096128ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	434.798846ms
Throughput	229.99 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	52.501771637s
Average Latency	522.980571ms
Throughput	95.23 requests/second

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	220.535034ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	147.288396ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	420.603577ms
Throughput	237.75 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	53.577239306s
Average Latency	534.802618ms
Throughput	93.32 requests/second

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	207.50465ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	112.392737ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	410.439141ms
Throughput	243.64 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	51.745343871s
Average Latency	515.24364ms
Throughput	96.63 requests/second

[github-actions]

X-Test Failure Report

opentdfplatformG2JQZ2.dockerbuild
govulncheck-failure-8
govulncheck-failure-2
govulncheck-failure-3
govulncheck-failure-1
govulncheck-failure-0
govulncheck-failure-5

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	210.425154ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	117.346691ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	418.119072ms
Throughput	239.17 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	50.159183916s
Average Latency	499.946237ms
Throughput	99.68 requests/second

[github-actions]

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

• examples
• otdfctl
• sdk
• service
• lib/fixtures
• tests-bdd

See the workflow run for details.

[github-actions]

X-Test Results

bats-test-results
✅ go@pull-3733-main
✅ go@main-pull-3733
✅ go@main-main
✅ go@pull-3733-pull-3733
✅ go@main-v0.9.0
✅ go@pull-3733-v0.9.0
✅ java@main-pull-3733
✅ js@main-main
✅ java@main-main
✅ java@main-v0.9.0
✅ js@main-v0.9.0
cukes-report
✅ js@main-pull-3733
opentdfplatformK5E807.dockerbuild
govulncheck-failure-8
govulncheck-failure-3
govulncheck-failure-1
govulncheck-failure-0
govulncheck-failure-5
govulncheck-failure-2