feat(core): generate connect-go v2 service stubs in protocol/go by alkalescent · Pull Request #4237 · opentdf/platform

alkalescent · 2026-10-16T20:35:06Z

Proposed Changes

connect-go v2 stubs. buf.gen.yaml also runs the connect-go v2 plugin (buf.build/connectrpc/go:v2.0.1) with package_suffix=connectv2. Each service gets a v2 stub package next to its v1 stub package, for example policy/attributes/attributesconnectv2 next to policy/attributes/attributesconnect. The messages and v1 stubs do not change.
Consumers. Services that register on connect-go v2, including the platform services in feat(core)!: serve platform services on connect-go v2 and authenticate before decoding #4216, import these packages from a released protocol/go.
Go 1.26. connect-go v2 requires Go 1.26, so protocol/go and go.work move to Go 1.26. Modules that update to this protocol/go release need Go 1.26.

Checklist

I have added or updated unit tests
I have added or updated integration tests (if appropriate)
I have added or updated documentation

Testing Instructions

Summary by CodeRabbit

New Features
- Go clients and servers can now communicate with Connect v2 across authorization, entity resolution, key access, policy management, and well-known configuration services.
- The new bindings cover operations such as making authorization decisions, resolving entities, managing policy resources, and retrieving configuration.
- Existing Connect integrations remain available alongside the new bindings.

buf.gen.yaml also runs the connect-go v2 plugin with the connectv2 package suffix, so each service gets a v2 stub package next to its v1 stub package. connect-go v2 requires Go 1.26, so protocol/go and go.work move to Go 1.26. Signed-off-by: Krish Suchak <suchak.krish@gmail.com>

coderabbitai · 2026-10-16T20:35:14Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 368ad660-6ef2-48d7-a737-e202e095333a

📥 Commits

Reviewing files that changed from the base of the PR and between b048476 and 14109c5.

⛔ Files ignored due to path filters: 2

go.work is excluded by !**/*.work
protocol/go/go.sum is excluded by !**/*.sum

📒 Files selected for processing: 19

buf.gen.yaml
protocol/go/authorization/authorizationconnectv2/authorization.connect.go
protocol/go/authorization/v2/authorizationv2connectv2/authorization.connect.go
protocol/go/entityresolution/entityresolutionconnectv2/entity_resolution.connect.go
protocol/go/entityresolution/v2/entityresolutionv2connectv2/entity_resolution.connect.go
protocol/go/go.mod
protocol/go/kas/kasconnectv2/kas.connect.go
protocol/go/policy/actions/actionsconnectv2/actions.connect.go
protocol/go/policy/attributes/attributesconnectv2/attributes.connect.go
protocol/go/policy/dynamicvaluemapping/dynamicvaluemappingconnectv2/dynamic_value_mapping.connect.go
protocol/go/policy/kasregistry/kasregistryconnectv2/key_access_server_registry.connect.go
protocol/go/policy/keymanagement/keymanagementconnectv2/key_management.connect.go
protocol/go/policy/namespaces/namespacesconnectv2/namespaces.connect.go
protocol/go/policy/obligations/obligationsconnectv2/obligations.connect.go
protocol/go/policy/registeredresources/registeredresourcesconnectv2/registered_resources.connect.go
protocol/go/policy/resourcemapping/resourcemappingconnectv2/resource_mapping.connect.go
protocol/go/policy/subjectmapping/subjectmappingconnectv2/subject_mapping.connect.go
protocol/go/policy/unsafe/unsafeconnectv2/unsafe.connect.go
protocol/go/wellknownconfiguration/wellknownconfigurationconnectv2/wellknown_configuration.connect.go

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The protocol Go module adds Connect Go v2 generation and generated client and server bindings for authorization, entity resolution, key access, and policy services.

Changes: Connect v2 Go Bindings

Layer / File(s)	Summary
Generation setup and core service bindings `buf.gen.yaml`, `protocol/go/go.mod`, `protocol/go/authorization/...`, `protocol/go/entityresolution/...`, `protocol/go/kas/...`	The generator adds the Connect Go v2 plugin. The Go module adds Connect v2 and updates its Go version. Generated bindings provide client interfaces, server registration, request adapters, and unimplemented handlers for authorization, entity-resolution, and access services.
Policy administration bindings `protocol/go/policy/actions/...`, `protocol/go/policy/attributes/...`, `protocol/go/policy/dynamicvaluemapping/...`, `protocol/go/policy/namespaces/...`, `protocol/go/policy/registeredresources/...`, `protocol/go/policy/resourcemapping/...`, `protocol/go/policy/subjectmapping/...`	Generated bindings expose client and server APIs for policy actions, attributes, dynamic value mappings, namespaces, registered resources, resource mappings, and subject mappings.
Supporting policy service bindings `protocol/go/policy/kasregistry/...`, `protocol/go/policy/keymanagement/...`, `protocol/go/policy/obligations/...`, `protocol/go/policy/unsafe/...`, `protocol/go/wellknownconfiguration/...`	Generated bindings expose client and server APIs for key-access-server registry, provider configuration, obligations, unsafe operations, and well-known configuration.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Feature

Suggested reviewers: pflynn-virtru

Merge Risk: ⚪ Minimal · up to 14109

The generated bindings match the checked runtime APIs and obligations service definitions. No merge-blocking issue remains beyond normal checks.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: generating Connect-Go v2 service stubs in protocol/go.
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 34 functions across 17 files. (2 skipped: …
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 34 functions across 17 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches

📝 Generate docstrings

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{A rabbit checks the routes with care,
New Connect paths appear out there.
Requests go in, responses flow,
The handlers answer, fast or slow.
The rabbit hops; the bindings glow.}

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-10-16T20:42:50Z

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

otdfctl
sdk
service
tests-bdd

See the workflow run for details.

github-actions · 2026-10-16T20:48:57Z

X-Test Results

✅ go@pull-4237-main
✅ go@main-main
✅ go@pull-4237-v0.9.0
✅ js@main-v0.9.0
govulncheck-failure-7
✅ js@main-pull-4237
✅ java@main-pull-4237
✅ java@main-main
bats-test-results
✅ go@main-v0.9.0
✅ go@main-pull-4237
✅ js@main-main
govulncheck-failure-1
authorization-scale-report
govulncheck-failure-2
✅ go@pull-4237-pull-4237
✅ java@main-v0.9.0
opentdf~~platform~~YTCPRO.dockerbuild
govulncheck-failure-0

github-actions · 2026-10-16T20:55:46Z

Benchmark results, click to expand

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	408.584705ms
Throughput	244.75 requests/second

TDF3 Benchmark Results

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	46.684909195s
Average Latency	465.951132ms
Throughput	107.10 requests/second

c-r33d · 2026-10-19T14:07:14Z


 require (
 	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260709200747-435963d16310.1
 	connectrpc.com/connect v1.20.0


Do we need v1 still?

Yes, we need both deps as we generate both v1 and v2 bindings until the migration is complete. Servers will move to v2 while clients can stay on v1.

elizabethhealy · 2026-10-19T15:19:12Z

@@ -1,6 +1,6 @@
-go 1.25.5
+go 1.26.0


if were updating the go work should we update the go ver of the rest of the modules as well?

alkalescent mentioned this pull request Oct 16, 2026

feat(core)!: serve platform services on connect-go v2 and authenticate before decoding #4216

Open

2 of 3 tasks

github-actions Bot added the size/xs label Oct 16, 2026

alkalescent marked this pull request as ready for review October 16, 2026 21:02

alkalescent requested review from a team as code owners October 16, 2026 21:02

c-r33d reviewed Oct 19, 2026

View reviewed changes

elizabethhealy reviewed Oct 19, 2026

View reviewed changes

Navigation Menu

Repository navigation

feat(core): generate connect-go v2 service stubs in protocol/go - #4237

feat(core): generate connect-go v2 service stubs in protocol/go#4237
alkalescent wants to merge 1 commit into
mainfrom
feat/protocol-connect-v2-stubs

alkalescent commented Oct 16, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Oct 16, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 16, 2026

Uh oh!

github-actions Bot commented Oct 16, 2026

Uh oh!

github-actions Bot commented Oct 16, 2026

Bulk Benchmark Results

TDF3 Benchmark Results

Uh oh!

c-r33d Oct 19, 2026

Uh oh!

alkalescent Oct 19, 2026

Uh oh!

elizabethhealy Oct 19, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

alkalescent commented Oct 16, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed Changes

Checklist

Testing Instructions

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Oct 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 16, 2026

⚠️ Govulncheck found vulnerabilities ⚠️

Uh oh!

github-actions Bot commented Oct 16, 2026

X-Test Results

Uh oh!

github-actions Bot commented Oct 16, 2026

Bulk Benchmark Results

TDF3 Benchmark Results

Uh oh!

c-r33d Oct 19, 2026

Choose a reason for hiding this comment

Uh oh!

alkalescent Oct 19, 2026

Choose a reason for hiding this comment

Uh oh!

elizabethhealy Oct 19, 2026

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

alkalescent commented Oct 16, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Oct 16, 2026 •

edited

Loading