feat(xtest): cover disabled KAO lookup and registry cache isolation by c-r33d · Pull Request #606 · opentdf/tests

c-r33d · 2026-09-16T18:42:10Z

Adds tests that verify decryption fails when KAO URI lookup is disabled and that cached keys with the same KID remain isolated across KAS registrations. Enables caching on km3 and fixes artifact names for platform branches containing /.

Validation: 61 offline tests and all static checks passed. Live validation is in progress against codex/kas-key-details.

Summary by CodeRabbit

Bug Fixes
- Improved key-access-server resolution during decryption, including support for alternate server URIs.
- Improved handling of cached keys across multiple key-access servers, including keys with matching identifiers.
- Improved test-result, audit-log, and server-log artifact naming for platform variants.
Diagnostics
- Added more detailed logging for key-access-server startup and key lookup operations.

Signed-off-by: Chris Reed <creed@virtru.com>

coderabbitai · 2026-09-16T18:42:17Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 01d8268b-91fe-44fb-9cc8-a2e3a6b315be

📥 Commits

Reviewing files that changed from the base of the PR and between 18f67c6 and 96b2f15.

📒 Files selected for processing (2)

.github/workflows/xtest.yml
xtest/test_abac.py

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

Walkthrough

The pull request updates the KM3 test workflow and adds ABAC tests for KAS URI resolution, disabled alternate registrations, and cache handling for identical key IDs across registries.

Changes

KAS resolution testing

Layer / File(s)	Summary
Test workflow configuration `.github/workflows/xtest.yml`	The KM3 action uses a newer commit with five-minute key-cache expiration and debug logging. Artifact uploads use sanitized platform tags.
ABAC KAS resolution and cache validation `xtest/test_abac.py`	Tests record KAO-based lookups, reject alternate registrations when disabled, and validate cached keys with identical KIDs in different registries.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Other

Suggested reviewers: dmihalcik-virtru

Merge Risk: ⚪ Minimal · up to 96b2f

The workflow and test updates have no identified merge-blocking risk.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 6 functions across 1 files. (1 skipped: 1 …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main changes: tests for disabled KAO lookup and cache isolation across KAS registries.

✨ Finishing Touches

📝 Generate docstrings

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{A rabbit reads each line,
The patch grows clear beneath the moon,
Small changes hop in place,
Tests guard the garden path,
Reviews bloom before the dawn.}

_{Comment @coderabbitai help to get the list of available commands.}

Signed-off-by: Chris Reed <creed@virtru.com>

github-actions · 2026-09-16T18:51:49Z

X-Test Failure Report

github-actions · 2026-09-16T19:17:20Z

X-Test Results

✅ java@main-main
✅ java@v0.18.0-main
✅ java@main-v0.26.0
✅ js@v0.4.0-v0.26.0
✅ go@main-v0.26.0
✅ js@main-v0.26.0
✅ js@main-main
✅ go@main-main
✅ go@v0.37.0-v0.26.0
✅ go@v0.37.0-main
✅ java@v0.18.0-v0.26.0
✅ js@v0.4.0-main

Signed-off-by: Chris Reed <creed@virtru.com>

github-actions · 2026-09-17T12:13:23Z

X-Test Failure Report

✅ go@main-v0.26.0
✅ go@main-main
✅ js@v0.4.0-v0.26.0
✅ go@v0.37.0-main
✅ go@v0.37.0-v0.26.0
✅ js@v0.4.0-main

github-actions · 2026-09-17T12:37:44Z

X-Test Results

✅ java@v0.18.0-main
✅ go@main-main
✅ go@v0.37.0-v0.26.0
✅ go@v0.37.0-main
✅ go@main-v0.26.0
✅ js@v0.4.0-main
✅ js@main-v0.26.0
✅ js@v0.4.0-v0.26.0
✅ java@main-v0.26.0
✅ java@main-main
✅ js@main-main
✅ java@v0.18.0-v0.26.0

github-actions · 2026-09-17T18:30:50Z

X-Test Results

✅ java@main-v0.26.0
✅ go@main-main
✅ js@main-v0.26.0
✅ go@v0.37.0-main
✅ js@v0.4.0-v0.26.0
✅ go@v0.37.0-v0.26.0
✅ java@main-main
✅ js@main-main
✅ js@v0.4.0-main
✅ go@main-v0.26.0

sonarqubecloud · 2026-09-17T19:09:48Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

github-actions · 2026-09-17T19:26:35Z

X-Test Results

✅ js@main-main
✅ go@v0.37.0-main
✅ go@v0.37.0-v0.26.0
✅ java@main-main
✅ java@main-v0.26.0
✅ js@main-v0.26.0
✅ js@v0.4.0-main
✅ js@v0.4.0-v0.26.0
✅ go@main-v0.26.0
✅ go@main-main

github-actions · 2026-09-17T19:56:38Z

X-Test Results

✅ js@v0.4.0-v0.26.0
✅ go@v0.37.0-v0.26.0
✅ js@main-main
✅ js@main-v0.26.0
✅ js@v0.4.0-main
✅ java@main-v0.26.0
✅ go@v0.37.0-main
✅ java@main-main
✅ go@main-v0.26.0
✅ go@main-main

c-r33d and others added 4 commits September 16, 2026 08:55

feat(xtest): add independent platform feature overrides

5b6f799

Signed-off-by: Chris Reed <creed@virtru.com>

test(xtest): cover KAO URI lookup with isolated KM3

77eb137

Signed-off-by: Chris Reed <creed@virtru.com>

Merge branch 'main' into test/kas-uri-from-kao

868014b

test(xtest): cover disabled KAO lookup and registry cache isolation

0159d8a

Signed-off-by: Chris Reed <creed@virtru.com>

c-r33d requested review from a team as code owners September 16, 2026 18:42

c-r33d mentioned this pull request Sep 16, 2026

feat(ci): configure additional KAS key cache expiration opentdf/platform#4064

Merged

3 tasks

ci(xtest): configure KM3 cache through the platform action

5aa87cf

Signed-off-by: Chris Reed <creed@virtru.com>

c-r33d changed the title ~~test(xtest): cover disabled KAO lookup and registry cache isolation~~ feat(xtest): cover disabled KAO lookup and registry cache isolation Sep 17, 2026

c-r33d commented Sep 17, 2026

View reviewed changes

Comment thread .github/workflows/xtest.yml

c-r33d mentioned this pull request Sep 17, 2026

fix(ci): configure additional KAS cache as nanoseconds opentdf/platform#4067

Merged

c-r33d added 2 commits September 17, 2026 06:54

fix(xtest): pass KM3 cache expiration in nanoseconds

3b5c8f3

Signed-off-by: Chris Reed <creed@virtru.com>

fix(ci): sanitize platform refs for xtest log artifacts

3e2e6b0

Signed-off-by: Chris Reed <creed@virtru.com>

Base automatically changed from test/kas-uri-from-kao to main September 17, 2026 18:03

Merge main and align KAO cache tests with merged #605

97b99c3

test(xtest): assert KAO lookup logs and failed rewrap audit

96b2f15

test(xtest): remove unavailable rewrap error audit assertion

23e92b3

Navigation Menu

feat(xtest): cover disabled KAO lookup and registry cache isolation - #606

feat(xtest): cover disabled KAO lookup and registry cache isolation#606
c-r33d wants to merge 10 commits into
mainfrom
codex/kao-registry-cache-tests

c-r33d commented Sep 16, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Sep 16, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

github-actions Bot commented Sep 16, 2026

Uh oh!

github-actions Bot commented Sep 16, 2026

Uh oh!

Uh oh!

github-actions Bot commented Sep 17, 2026

Uh oh!

github-actions Bot commented Sep 17, 2026

Uh oh!

github-actions Bot commented Sep 17, 2026

Uh oh!

sonarqubecloud Bot commented Sep 17, 2026

Uh oh!

github-actions Bot commented Sep 17, 2026

Uh oh!

github-actions Bot commented Sep 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

c-r33d commented Sep 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Sep 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

github-actions Bot commented Sep 16, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Sep 16, 2026

X-Test Results

Uh oh!

Uh oh!

github-actions Bot commented Sep 17, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Sep 17, 2026

X-Test Results

Uh oh!

github-actions Bot commented Sep 17, 2026

X-Test Results

Uh oh!

sonarqubecloud Bot commented Sep 17, 2026

Quality Gate passed

Uh oh!

github-actions Bot commented Sep 17, 2026

X-Test Results

Uh oh!

github-actions Bot commented Sep 17, 2026

X-Test Results

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

c-r33d commented Sep 16, 2026 •

edited

Loading

coderabbitai Bot commented Sep 16, 2026 •

edited

Loading