feat(policy): DSPX-3888 enforce object limits

[jakedoublev]

Summary

• add policy object-limit enforcement per namespace in policy configuration
• use internal count-only database queries without hydrating policy objects
• return RESOURCE_EXHAUSTED when configured limits are reached

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	170.793284ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	97.02ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	345.332195ms
Throughput	289.58 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	37.791052569s
Average Latency	377.350582ms
Throughput	132.31 requests/second

[github-actions]

X-Test Results

✅ go@pull-3906-main
✅ go@main-main
✅ go@main-v0.9.0
✅ go@main-pull-3906
✅ java@main-pull-3906
bats-test-results
✅ java@main-main
✅ go@pull-3906-v0.9.0
cukes-report
✅ go@pull-3906-pull-3906
✅ js@main-pull-3906
✅ js@main-main
✅ java@main-v0.9.0
✅ js@main-v0.9.0
opentdfplatformPX1UP5.dockerbuild
govulncheck-failure-8
govulncheck-failure-3
govulncheck-failure-1
govulncheck-failure-5
govulncheck-failure-0
govulncheck-failure-2
govulncheck-failure-4

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	237.994979ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	135.111094ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	429.286919ms
Throughput	232.94 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	44.134960767s
Average Latency	440.495253ms
Throughput	113.29 requests/second

[github-actions]

X-Test Results

✅ go@main-main
✅ go@main-pull-3906
✅ go@pull-3906-main
bats-test-results
✅ go@pull-3906-v0.9.0
✅ go@main-v0.9.0
✅ java@main-pull-3906
✅ go@pull-3906-pull-3906
✅ java@main-v0.9.0
✅ js@main-main
✅ js@main-v0.9.0
✅ java@main-main
cukes-report
✅ js@main-pull-3906
govulncheck-failure-2
govulncheck-failure-1
opentdfplatformS42VZV.dockerbuild
govulncheck-failure-3
govulncheck-failure-8
govulncheck-failure-5
govulncheck-failure-0
govulncheck-failure-4

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	183.367263ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	108.441867ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	408.176012ms
Throughput	244.99 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	40.620522536s
Average Latency	405.427662ms
Throughput	123.09 requests/second

[github-actions]

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

• examples
• otdfctl
• sdk
• service
• lib/ocrypto
• lib/fixtures
• tests-bdd

See the workflow run for details.

[github-actions]

X-Test Results

✅ go@pull-3906-main
✅ go@main-pull-3906
✅ go@main-main
✅ go@main-v0.9.0
✅ go@pull-3906-pull-3906
✅ java@main-pull-3906
cukes-report
✅ js@main-main
✅ go@pull-3906-v0.9.0
✅ java@main-v0.9.0
✅ js@main-v0.9.0
✅ js@main-pull-3906
✅ java@main-main
opentdfplatformOMFY0N.dockerbuild
govulncheck-failure-3
govulncheck-failure-2
govulncheck-failure-8
govulncheck-failure-4
govulncheck-failure-1
govulncheck-failure-0
govulncheck-failure-5