feat(sdk): add AccessToken accessor to SDK by alkalescent · Pull Request #3775 · opentdf/platform

alkalescent · 2026-07-22T21:27:35Z

Proposed Changes

Add a public AccessToken(ctx context.Context) (auth.AccessToken, error) method on the SDK that returns a valid access token from the configured tokenSource, passing the SDK's own HTTP client (the same client the auth interceptor uses).
Return a new ErrNoAccessTokenSource sentinel when the SDK was constructed without credentials (nil token source) instead of panicking. Uncredentialed clients are a supported configuration (buildIDPTokenSource returns nil in that case).

Checklist

I have added or updated unit tests
I have added or updated integration tests (if appropriate)
I have added or updated documentation

Testing Instructions

cd sdk && go test . -race -run TestAccessToken

Summary by CodeRabbit

New Features
- Added access-token retrieval through the SDK’s authentication interface.
- Supports configured token sources and reports clear errors when credentials are unavailable or invalid.
Tests
- Added coverage for successful token retrieval, missing token sources, and empty tokens.

Expose a public AccessToken method on the SDK that returns a valid access token from the configured token source, passing the SDK's own HTTP client. Returns ErrNoAccessTokenSource when the SDK was created without credentials (nil token source) instead of panicking. Signed-off-by: Krish Suchak <suchak.krish@gmail.com>

gemini-code-assist · 2026-07-22T21:27:38Z

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

coderabbitai · 2026-07-22T21:27:43Z

Warning

Review limit reached

@alkalescent, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 51 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 4e03d1c3-4c5d-430e-93c7-e45103e59353

📥 Commits

Reviewing files that changed from the base of the PR and between 049718f and 68bcc4e.

📒 Files selected for processing (1)

sdk/access_token_test.go

📝 Walkthrough

Walkthrough

The SDK gains an Auth() client that retrieves access tokens through the configured token source, reports missing or invalid tokens, and includes tests covering successful, missing-source, and empty-token cases.

Changes

Authentication access

Layer / File(s)	Summary
Token access implementation `sdk/sdk.go`, `sdk/auth_client.go`	Adds `ErrNoAccessTokenSource`, exposes `SDK.Auth()`, and implements token retrieval with error propagation and non-empty token validation.
Token access validation `sdk/access_token_test.go`	Tests successful retrieval, missing token sources, and empty token responses.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant SDK
  participant AuthClient
  participant tokenSource
  SDK->>AuthClient: Auth()
  AuthClient->>tokenSource: AccessToken(ctx, httpClient)
  tokenSource-->>AuthClient: token or error
  AuthClient-->>SDK: auth.AccessToken or validation error

Suggested reviewers: marythought

Poem

A bunny checks the token gate,
Finds empty paths and seals their fate.
A bright token hops right through,
Tests confirm what code should do.
“Auth!” cries Bun, “the flow is neat!”

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title matches the main change: adding access-token retrieval to the SDK, though the final API is exposed via Auth().AccessToken.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch sdk-access-token-accessor

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-07-22T21:33:33Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	215.894894ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	111.553998ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	425.536492ms
Throughput	235.00 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	50.236919976s
Average Latency	499.419218ms
Throughput	99.53 requests/second

github-actions · 2026-07-22T21:40:49Z

jakedoublev · 2026-07-23T16:30:16Z

@marythought thoughts on this being a top-level method on the SDK instance vs nested somewhere? It seems like we want to be cautious about how many methods are on the SDK client itself, right?

marythought · 2026-07-23T17:41:21Z

@marythought thoughts on this being a top-level method on the SDK instance vs nested somewhere? It seems like we want to be cautious about how many methods are on the SDK client itself, right?

@alkalescent Rather than a top-level method, could we put this behind an Auth() accessor on the SDK — so the call reads s.Auth().AccessToken(ctx)? It's a departure from the current pattern, but it keeps the client's public surface lean and lines up better with how we group things in the Virtru SDK. Happy to talk it through if that's more than you signed up for.

  func (s *SDK) Auth() *AuthClient { return &AuthClient{sdk: s} }

  type AuthClient struct{ sdk *SDK }

  func (a *AuthClient) AccessToken(ctx context.Context) (auth.AccessToken, error) {
      if a.sdk.tokenSource == nil {
          return "", ErrNoAccessTokenSource
      }
      return a.sdk.tokenSource.AccessToken(ctx, a.sdk.httpClient)
  }

  Call site:
  token, err := s.Auth().AccessToken(ctx)

Move the top-level SDK.AccessToken method behind an Auth() accessor (s.Auth().AccessToken(ctx)) via a new AuthClient type to keep the SDK client's public surface lean. Also gate an empty token returned by the source, returning ErrAccessTokenInvalid. Addresses PR review feedback. Signed-off-by: Krish Suchak <suchak.krish@gmail.com>

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@sdk/access_token_test.go`:
- Around line 12-17: Extend TestAccessToken_ReturnsTokenFromSource using a
recording token source, explicitly configure SDK.httpClient and the test
context, then call Auth().AccessToken with that context. Assert the source
received the exact context and HTTP client instances unchanged, while preserving
the existing token and no-error assertions.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 4763a805-d722-4071-9816-34a149f58ef8

📥 Commits

Reviewing files that changed from the base of the PR and between 88e21dc and 049718f.

📒 Files selected for processing (3)

sdk/access_token_test.go
sdk/auth_client.go
sdk/sdk.go

github-actions · 2026-07-23T21:21:22Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	152.893086ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	86.312223ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	340.749099ms
Throughput	293.47 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.811115681s
Average Latency	386.557249ms
Throughput	128.83 requests/second

Add a recording token source that verifies Auth().AccessToken forwards the context (via a propagated context value) and the exact httpClient instance to the underlying token source. Addresses PR review feedback. Signed-off-by: Krish Suchak <suchak.krish@gmail.com>

github-actions · 2026-07-23T21:25:05Z

X-Test Failure Report

cukes-report
opentdf~~platform~~J0FQ8J.dockerbuild
govulncheck-failure-1
govulncheck-failure-2
govulncheck-failure-3
govulncheck-failure-5
govulncheck-failure-8
govulncheck-failure-0

alkalescent · 2026-07-23T21:26:24Z

@marythought moved to Auth accessor

github-actions · 2026-07-23T21:29:11Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	192.029543ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	99.312802ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	433.326628ms
Throughput	230.77 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	48.6808709s
Average Latency	484.883536ms
Throughput	102.71 requests/second

github-actions · 2026-07-23T21:31:11Z

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

examples
otdfctl
sdk
service
lib/fixtures
tests-bdd

See the workflow run for details.

github-actions · 2026-07-23T21:40:10Z

marythought

thank you for doing this!

alkalescent requested review from a team as code owners July 22, 2026 21:27

github-actions Bot added comp:sdk A software development kit, including library, for client applications and inter-service communicati size/s labels Jul 22, 2026

jakedoublev requested a review from marythought July 23, 2026 16:29

bnrobinson93 reviewed Jul 23, 2026

View reviewed changes

Comment thread sdk/sdk.go Outdated

coderabbitai Bot reviewed Jul 23, 2026

View reviewed changes

Comment thread sdk/access_token_test.go

marythought approved these changes Jul 23, 2026

View reviewed changes

marythought added this pull request to the merge queue Jul 23, 2026

Merged via the queue into main with commit 2911e22 Jul 23, 2026
45 checks passed

marythought deleted the sdk-access-token-accessor branch July 23, 2026 23:18

opentdf-automation Bot mentioned this pull request Jul 23, 2026

chore(main): release sdk 0.28.0 #3784

Open

Uh oh!

Conversation

alkalescent commented Jul 22, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed Changes

Checklist

Testing Instructions

Summary by CodeRabbit

Uh oh!

gemini-code-assist Bot commented Jul 22, 2026

Uh oh!

coderabbitai Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

github-actions Bot commented Jul 22, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Jul 22, 2026

X-Test Results

Uh oh!

jakedoublev commented Jul 23, 2026

Uh oh!

Uh oh!

marythought commented Jul 23, 2026

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot commented Jul 23, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Jul 23, 2026

X-Test Failure Report

Uh oh!

alkalescent commented Jul 23, 2026

Uh oh!

github-actions Bot commented Jul 23, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Jul 23, 2026

⚠️ Govulncheck found vulnerabilities ⚠️

Uh oh!

github-actions Bot commented Jul 23, 2026

X-Test Results

Uh oh!

marythought left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

alkalescent commented Jul 22, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 22, 2026 •

edited

Loading