fix(core): distinguish rewrap denials

[elizabethhealy]

Proposed Changes

• Add a dedicated RewrapDenied audit helper that records ActionResultFailure.
• Use RewrapDenied when an existing GetDecision authorization result rejects a rewrap.
• Preserve RewrapFailure and ActionResultError for technical rewrap failures.
• Add focused coverage asserting that authorization DENY emits a failure-result rewrap audit event and PERMIT emits a success-result event.

Scope

This change only reclassifies audit events that are already emitted for policy authorization denials. It does not add new audit-emission paths.

Existing cases that do not currently emit a rewrap audit event remain unchanged and should be addressed separately, including:

• GetDecision or GetDecisionMultiResource service/RPC errors.
• Policy-binding validation failures.
• Wrapped-key or other pre-authorization key-validation failures.

Checklist

• I have added or updated unit tests
• I have added or updated integration tests (not required for this change)
• I have added or updated documentation (not required for this change)

Testing Instructions

From service/:

go test ./kas/access ./logger/audit -count=1

The focused KAS access and audit logger packages pass locally.

Summary by CodeRabbit

• Bug Fixes
  • Rewrap audit events now distinguish policy-denied access from other errors: denied attempts are recorded as failures, successful attempts as successes, and other rewrap errors retain the error result.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: db4975f5-cb69-4837-a15b-5bd480266af9

---

📥 Commits

Reviewing files that changed from the base of the PR and between 6d3a01a and c4c2afc.

---

📒 Files selected for processing (5)

• service/kas/access/rewrap.go
• service/kas/access/rewrap_test.go
• service/logger/audit/logger.go
• service/logger/audit/logger_test.go
• service/logger/audit/rewrap.go

---

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

---

📝 Walkthrough

Walkthrough

Denied TDF3 rewraps now use a dedicated audit helper. The audit event records a failure result for denied access, while successful rewraps record success and other failures retain the error result.

Changes

TDF3 Rewrap Audit Results

Layer / File(s)	Summary
Rewrap audit result semantics service/logger/audit/rewrap.go, service/logger/audit/logger.go, service/logger/audit/logger_test.go	The audit parameters and helpers distinguish denied rewraps from other failures. Denied rewraps record a failure result. Tests cover the denied helper and its processor-error handling.
Denied TDF3 rewrap integration service/kas/access/rewrap.go, service/kas/access/rewrap_test.go	Denied access calls RewrapDenied; audit errors continue to be logged before the KAO is marked forbidden. Tests check audit results for permit and deny decisions.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: dmihalcik-virtru

---

Merge Risk: ⚪ Minimal · up to c4c2a

No actionable merge-blocking risk is evident from the supplied changes; merge after normal checks.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 5 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: distinguishing authorization denials from technical rewrap failures in audit events.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

---

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 2

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

---

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

---

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{A rabbit checks the audit trail,
And sees denied events marked well.
A permit earns success,
A failure keeps its status,
Then hops away, content.}

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Benchmark results, click to expand

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	299.706434ms
Throughput	333.66 requests/second

TDF3 Benchmark Results

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	34.348011974s
Average Latency	342.707878ms
Throughput	145.57 requests/second

[github-actions]

X-Test Results

✅ go@pull-4204-v0.9.0
✅ go@pull-4204-main
✅ js@main-main
✅ go@main-pull-4204
bats-test-results
✅ java@main-v0.9.0
govulncheck-failure-2
govulncheck-failure-7
opentdfplatformN544U8.dockerbuild
✅ java@main-main
✅ js@main-pull-4204
✅ go@pull-4204-pull-4204
govulncheck-failure-0
✅ go@main-v0.9.0
✅ go@main-main
cukes-report
✅ js@main-v0.9.0
✅ java@main-pull-4204

[github-actions]

Benchmark results, click to expand

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	406.376901ms
Throughput	246.08 requests/second

TDF3 Benchmark Results

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	42.436842377s
Average Latency	422.933062ms
Throughput	117.82 requests/second

[github-actions]

X-Test Results

✅ go@pull-4204-pull-4204
✅ go@main-v0.9.0
✅ java@main-pull-4204
✅ js@main-pull-4204
✅ go@main-pull-4204
✅ go@main-main
opentdfplatformHDXPL7.dockerbuild
✅ java@main-v0.9.0
cukes-report
✅ go@pull-4204-main
✅ js@main-v0.9.0
govulncheck-failure-0
✅ go@pull-4204-v0.9.0
✅ java@main-main
bats-test-results
✅ js@main-main
govulncheck-failure-7
govulncheck-failure-2

[github-actions]

Benchmark results, click to expand

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	330.128477ms
Throughput	302.91 requests/second

TDF3 Benchmark Results

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	37.186780887s
Average Latency	371.027078ms
Throughput	134.46 requests/second

[github-actions]

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

• otdfctl
• sdk
• service
• lib/fixtures
• tests-bdd

See the workflow run for details.

[github-actions]

X-Test Results

✅ go@main-main
govulncheck-failure-4
✅ go@main-pull-4204
✅ java@main-v0.9.0
✅ go@pull-4204-v0.9.0
govulncheck-failure-2
✅ go@pull-4204-pull-4204
govulncheck-failure-1
cukes-report
bats-test-results
✅ js@main-pull-4204
✅ go@pull-4204-main
✅ js@main-main
✅ go@main-v0.9.0
✅ js@main-v0.9.0
✅ java@main-main
govulncheck-failure-0
✅ java@main-pull-4204
opentdfplatformUIAEIK.dockerbuild
govulncheck-failure-7