fix(authz): reuse hierarchy and entity selector indexes

[strantalis]

Build hierarchy ranks with the PDP and select the highest matching entitlement once per definition and decision. Index flattened selectors once per entity and deduplicate selectors before matched-mapping lookups.

Layer 4 of 4, based on #3990 and rebased on main at f992b60d. The merged #3983 workload replaces the superseded proof layer, #3993.

Before this rebase, all three implementations passed 800 mixed requests, 200 at each concurrency level of 1/10/25/50, with identical sampled cases. At 50 concurrent requests:

Implementation	p95	Failures
Before #3986	8.72 s	0/200
#3986 alone	180 ms	0/200
Full stack	180 ms	0/200

Single local run per implementation and concurrency level on an 8-vCPU/16-GiB Colima VM. Same Go 1.26.3 compiler and Linux/arm64 runtime; setup excluded; caching and experimental features disabled. The measured improvement comes from #3986. The remaining layers showed no additional benefit in this workload.

Rebase verification (2026-10-05): all remaining patches are unchanged and based on main with #3987 merged. Authorization race tests, SDK README tests, formatting, and lint for the stack diff passed. Full repository checks were not rerun for this unchanged-patch synchronization; the prior local run required Docker and the platform at localhost:8080, and full lint reported existing findings in unchanged files. Earlier performance measurements above were not rerun locally.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

X-Test Failure Report

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	216.847517ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	125.522248ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	402.201686ms
Throughput	248.63 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	42.033415289s
Average Latency	419.479491ms
Throughput	118.95 requests/second

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	209.440863ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	123.456335ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	412.839231ms
Throughput	242.23 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	41.426910494s
Average Latency	413.345555ms
Throughput	120.69 requests/second

[github-actions]

X-Test Results

bats-test-results
✅ go@pull-3991-main
✅ go@main-pull-3991
✅ go@main-main
✅ go@pull-3991-pull-3991
✅ go@main-v0.9.0
✅ java@main-main
✅ go@pull-3991-v0.9.0
cukes-report
✅ js@main-pull-3991
✅ js@main-main
✅ java@main-pull-3991
✅ js@main-v0.9.0
✅ java@main-v0.9.0
opentdfplatformKCQU9J.dockerbuild
govulncheck-failure-8
govulncheck-failure-3
govulncheck-failure-1

[github-actions]

X-Test Failure Report

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	221.048414ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	113.604683ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	411.583437ms
Throughput	242.96 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	45.017832197s
Average Latency	448.955331ms
Throughput	111.07 requests/second

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	244.167163ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	122.929513ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	411.893474ms
Throughput	242.78 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	44.892218405s
Average Latency	447.979933ms
Throughput	111.38 requests/second

[github-actions]

X-Test Results

✅ go@main-main
govulncheck-failure-8
✅ go@pull-3991-main
✅ go@pull-3991-v0.9.0
govulncheck-failure-1
✅ js@main-v0.9.0
govulncheck-failure-3
✅ java@main-v0.9.0
✅ js@main-main
✅ go@main-pull-3991
✅ java@main-pull-3991
✅ go@pull-3991-pull-3991
✅ go@main-v0.9.0
✅ java@main-main
opentdfplatformN3W2T0.dockerbuild
bats-test-results
✅ js@main-pull-3991

[github-actions]

X-Test Failure Report

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	110.115809ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	64.058201ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	242.800772ms
Throughput	411.86 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	26.939483184s
Average Latency	268.781058ms
Throughput	185.60 requests/second

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	228.078879ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	150.984915ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	412.826972ms
Throughput	242.23 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	44.863131936s
Average Latency	447.498337ms
Throughput	111.45 requests/second

[github-actions]

X-Test Results

✅ go@pull-3991-pull-3991
bats-test-results
✅ go@main-v0.9.0
✅ go@pull-3991-main
✅ go@pull-3991-v0.9.0
✅ java@main-main
cukes-report
✅ js@main-main
opentdfplatform07QUH6.dockerbuild
✅ go@main-main
✅ java@main-pull-3991
✅ java@main-v0.9.0
govulncheck-failure-1
govulncheck-failure-8
✅ go@main-pull-3991
authorization-scale-report
✅ js@main-pull-3991
✅ js@main-v0.9.0
govulncheck-failure-3

[github-actions]

X-Test Failure Report

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	219.047951ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	136.791509ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	420.319519ms
Throughput	237.91 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	44.999904322s
Average Latency	449.14968ms
Throughput	111.11 requests/second

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	224.65715ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	121.138769ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	435.938595ms
Throughput	229.39 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	44.362109534s
Average Latency	442.799033ms
Throughput	112.71 requests/second

[github-actions]

X-Test Results

✅ go@main-pull-3991
✅ go@main-v0.9.0
✅ go@pull-3991-main
✅ go@pull-3991-v0.9.0
✅ js@main-main
✅ go@main-main
✅ java@main-pull-3991
✅ js@main-v0.9.0
authorization-scale-report
bats-test-results
cukes-report
govulncheck-failure-3
✅ go@pull-3991-pull-3991
✅ java@main-v0.9.0
govulncheck-failure-1
govulncheck-failure-8
✅ java@main-main
✅ js@main-pull-3991
opentdfplatformFFVDUQ.dockerbuild

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	224.181893ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	130.128111ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	418.00614ms
Throughput	239.23 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	43.787596948s
Average Latency	436.96236ms
Throughput	114.19 requests/second

[github-actions]

X-Test Results

✅ go@main-main
✅ go@pull-3991-pull-3991
cukes-report
✅ go@pull-3991-v0.9.0
✅ java@main-main
✅ go@main-pull-3991
opentdfplatformXD3GQ3.dockerbuild
✅ go@main-v0.9.0
bats-test-results
✅ go@pull-3991-main
✅ js@main-v0.9.0
✅ java@main-pull-3991
govulncheck-failure-8
✅ js@main-main
✅ java@main-v0.9.0
govulncheck-failure-1
govulncheck-failure-3
authorization-scale-report
✅ js@main-pull-3991

[github-actions]

X-Test Failure Report

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	212.981332ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	128.804949ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	423.908566ms
Throughput	235.90 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	45.179729293s
Average Latency	450.646657ms
Throughput	110.67 requests/second

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	253.868898ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	136.98231ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	408.774361ms
Throughput	244.63 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	45.372436063s
Average Latency	452.539339ms
Throughput	110.20 requests/second

[github-actions]

X-Test Results

✅ go@pull-3991-main
✅ js@main-v0.9.0
govulncheck-failure-8
govulncheck-failure-1
✅ java@main-main
✅ go@main-v0.9.0
✅ go@pull-3991-v0.9.0
✅ go@main-pull-3991
govulncheck-failure-3
✅ java@main-pull-3991
✅ go@main-main
bats-test-results
opentdfplatformY568FN.dockerbuild
✅ js@main-main
cukes-report
authorization-scale-report
✅ java@main-v0.9.0
✅ js@main-pull-3991
✅ go@pull-3991-pull-3991

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	172.651719ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	99.787099ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	356.04901ms
Throughput	280.86 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.243700202s
Average Latency	381.784433ms
Throughput	130.74 requests/second

[github-actions]

X-Test Results

✅ js@main-pull-3991
✅ java@main-v0.9.0
✅ go@main-v0.9.0
bats-test-results
✅ java@main-main
✅ go@main-main
✅ js@main-main
cukes-report
opentdfplatformTNCJLD.dockerbuild
✅ java@main-pull-3991
✅ go@pull-3991-pull-3991
✅ go@main-pull-3991
authorization-scale-report
✅ go@pull-3991-v0.9.0
✅ go@pull-3991-main
govulncheck-failure-8
✅ js@main-v0.9.0
govulncheck-failure-3
govulncheck-failure-1

[github-actions]

X-Test Failure Report

[github-actions]

Benchmark results, click to expand

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	410.151729ms
Throughput	243.81 requests/second

TDF3 Benchmark Results

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	43.383521221s
Average Latency	432.737384ms
Throughput	115.25 requests/second

[github-actions]

Benchmark results, click to expand

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	430.715522ms
Throughput	232.17 requests/second

TDF3 Benchmark Results

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	45.408267342s
Average Latency	452.842591ms
Throughput	110.11 requests/second

[github-actions]

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

• otdfctl
• service
• tests-bdd

See the workflow run for details.

[github-actions]

X-Test Results

authorization-scale-report
bats-test-results
✅ go@main-v0.9.0
✅ go@pull-3991-pull-3991
govulncheck-failure-0
✅ java@main-v0.9.0
✅ go@pull-3991-v0.9.0
✅ js@main-v0.9.0
✅ java@main-main
cukes-report
govulncheck-failure-7
opentdfplatformKMQE3C.dockerbuild
✅ java@main-pull-3991
✅ js@main-pull-3991
govulncheck-failure-2
✅ go@main-pull-3991
✅ js@main-main
✅ go@pull-3991-main
✅ go@main-main