feat(jans-cedarling): Update Tests, Examples, and Benchmarks After Core Changes by haileyesus2433 · Pull Request #13464 · JanssenProject/jans

haileyesus2433 · 2026-03-12T07:09:38Z

Prepare

Read PR guidelines
Read license information

Description

Target issue

Test and Document the changes

Static code analysis has been run locally and issues have been fixed
Relevant unit and integration tests have been added/updated
Relevant documentation has been updated if any (i.e. user guides, installation and configuration guides, technical design docs etc)

Please check the below before submitting your PR. The PR will not be merged if there are no commits that start with docs: to indicate documentation changes or if the below checklist is not selected.

I confirm that there is no impact on the docs due to the code changes in this PR.

…figurations - Deleted several obsolete test files including `authorize_resource_entity.rs`, `cases_authorize_different_principals.rs`, `cases_authorize_namespace_jans2.rs`, `cases_authorize_without_check_jwt.rs`, and `schema_type_mapping.rs` to clean up the test suite. - Updated `authorize_multi_issuer.rs` to remove unnecessary parameters in callback functions. - Adjusted `mod.rs` to reflect the removal of deleted test modules, enhancing clarity and maintainability of the test structure. Signed-off-by: haileyesus2433 <haileyesusbe@gmail.com>

…recated fields - Updated `authz_authorize_benchmark.rs` to utilize `RequestUnsigned` and renamed the benchmark function for clarity. - Simplified `prepare_cedarling` function by removing unused parameters and deprecated fields in `AuthorizationConfig`. - Adjusted `authz_authorize_multi_issuer_benchmark.rs` and `context_data_store_benchmark.rs` to remove unnecessary fields related to user and workload principals. - Cleaned up `startup_benchmark.rs` by eliminating deprecated fields from `BootstrapConfig` and `EntityBuilderConfig`. Signed-off-by: haileyesus2433 <haileyesusbe@gmail.com>

…e deprecated files - Updated `authorize_unsigned.rs`, `bulk_authorization_benchmark.rs`, `lock_integration.rs`, `log_init.rs`, and `profiling.rs` to utilize default settings for `AuthorizationConfig` and `EntityBuilderConfig`, removing unnecessary fields. - Deleted obsolete files `authorize_with_jwt_validation.rs` and `authorize_without_jwt_validation.rs` to clean up the examples directory. - Adjusted imports and function calls to reflect the removal of deprecated fields, enhancing code clarity and maintainability. Signed-off-by: haileyesus2433 <haileyesusbe@gmail.com>

- Eliminated the `built_entities` method from the `AuthorizeEntitiesData` implementation, streamlining the authorization logic. - Removed associated documentation comments to enhance code clarity and maintainability. - Adjusted imports to reflect the removal of the unused method. Signed-off-by: haileyesus2433 <haileyesusbe@gmail.com>

… streamline imports - Deleted obsolete files related to role and token entity building, including `build_role_entity.rs` and `build_token_entities.rs`, to clean up the entity builder module. - Refactored imports in `build_multi_issuer_entity.rs` and `build_principal_entity.rs` to remove unused dependencies and enhance code clarity. - Removed legacy user and workload entity building logic from `build_principal_entity.rs`, aligning with the current authorization paths. Signed-off-by: haileyesus2433 <haileyesusbe@gmail.com>

- Removed unused fields and methods from the `JwtService` and `Token` structures, including `signed_authz_available` and `jwt_sig_validation_required`. - Streamlined the `validate_tokens` method by eliminating unnecessary logic and comments, focusing on single token validation. - Updated imports to reflect the removal of deprecated items, enhancing code clarity and maintainability. Signed-off-by: haileyesus2433 <haileyesusbe@gmail.com>

coderabbitai · 2026-03-12T07:09:50Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: ed0bdcf3-7250-4422-991a-c4786a4d0e42

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch jans-cedarling-13441

📝 Coding Plan

Generate coding plan for human review comments

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Tip

CodeRabbit can use Trivy to scan for security misconfigurations and secrets in Infrastructure as Code files.

Add a .trivyignore file to your project to customize which findings Trivy reports.

mo-auto · 2026-03-12T07:09:57Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

…ration files and examples - Eliminated `CEDARLING_USER_AUTHZ`, `CEDARLING_WORKLOAD_AUTHZ`, and `CEDARLING_ID_TOKEN_TRUST_MODE` from various configuration files including JSON and YAML examples. - Streamlined the `bootstrap_props` and `docker-compose-env` configurations to enhance clarity and maintainability. - Updated test configurations to reflect the removal of deprecated fields, ensuring consistency across the codebase. Signed-off-by: haileyesus2433 <haileyesusbe@gmail.com>

olehbozhok · 2026-03-12T15:16:04Z

jans-cedarling/cedarling/examples/profiling.rs

-    id_token: &str,
-    userinfo_token: &str,
-) {
+async fn call_authorize_unsigned(cedarling: &Cedarling) {


It would be great to have 2 files for profiling. For the unsigned, you already made. Can you make authorize_multi_issuer profiling?

olehbozhok · 2026-03-12T17:03:49Z

@coderabbitai can you verify if changes in jans-cedarling/flask-sidecar/main/base/cedarling/cedarling.py are valid?

olehbozhok · 2026-03-12T17:04:51Z

@SafinWasi, can you take a look and verify if changes in jans-cedarling/flask-sidecar/main/base/cedarling/cedarling.py are OK?

jans-cedarling/flask-sidecar/main/base/cedarling/cedarling.py

olehbozhok

You also need to remove outdated fields/entities in testing files (folder test_files). And remove unused files

haileyesus2433 · 2026-03-12T17:43:07Z

You also need to remove outdated fields/entities in testing files (folder test_files). And remove unused files

oh ok i forgot about those thanks, its a huge refactor and need help in spotting things i missed thanks

coderabbitai · 2026-03-12T17:58:19Z

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

Let me gather the file contents and diff to verify the changes.

🏁 Script executed:

#!/bin/bash
# Read the current content of cedarling.py
fd "cedarling.py" --full-path | grep "flask-sidecar" | head -5

cat jans-cedarling/flask-sidecar/main/base/cedarling/cedarling.py 2>/dev/null || echo "File not found at that path"

# Also look for the file in alternative paths
fd "cedarling.py" jans-cedarling/flask-sidecar/

Length of output: 8159

Now let me check the Python bindings .pyi files to verify these API calls.

🏁 Script executed:

#!/bin/bash
# List and read the .pyi stub files
fd "\.pyi$" jans-cedarling/bindings/cedarling_python/

echo "=== Reading all .pyi files ==="
fd "\.pyi$" jans-cedarling/bindings/cedarling_python/ --exec cat {} \;

echo "=== Check for AuthorizeMultiIssuerRequest ==="
rg -n "AuthorizeMultiIssuerRequest|authorize_multi_issuer|TokenInput|EntityData|AuthorizeResultResponse" jans-cedarling/bindings/cedarling_python/ -A2

echo "=== Check for get_logs_by_request_id_and_tag ==="
rg -n "get_logs_by_request_id|request_id|is_allowed|response\b" jans-cedarling/bindings/cedarling_python/ -A2

echo "=== Check diagnostics / decision ==="
rg -n "diagnostics|decision|reason|errors" jans-cedarling/bindings/cedarling_python/ -A2

Length of output: 123334

@olehbozhok: I've reviewed jans-cedarling/flask-sidecar/main/base/cedarling/cedarling.py against the Python binding .pyi stubs and Rust source. Here is my findings:

✅ API Usage — All Valid

Call in `cedarling.py`	Binding interface	Status
`BootstrapConfig.from_env()`	`from_env(options: Dict \| None = None)`	✅
`BootstrapConfig.load_from_json(str)`	`load_from_json(config_json: str)`	✅
`EntityData.from_dict({cedar_entity_mapping: {entity_type, id}, ...})`	Documented dict structure	✅
`TokenInput(mapping=..., payload=...)`	`__init__(mapping: str, payload: str)`	✅
`AuthorizeMultiIssuerRequest(tokens, action, resource, context)`	`__init__(tokens, action, resource, context=None)`	✅
`cedarling.authorize_multi_issuer(request)` → `MultiIssuerAuthorizeResult`	Matches `.pyi`	✅
`authorize_result.request_id()`	`MultiIssuerAuthorizeResult.request_id() -> str`	✅
`cedarling.get_logs_by_request_id_and_tag(request_id, tag)`	Matches `.pyi`	✅
`authorize_result.is_allowed()`	`MultiIssuerAuthorizeResult.is_allowed() -> bool`	✅
`authorize_result.response()`	`MultiIssuerAuthorizeResult.response() -> AuthorizeResultResponse`	✅
`resp.decision.value`	`Decision.value: str`	✅
`resp.diagnostics.reason` / `.errors`	`Diagnostics.reason: set[str]`, `.errors: List[PolicyEvaluationError]`	✅

⚠️ One Concern — Token Mapping Case Mismatch

In cedarling.py, the TokenInput mapping strings use lowercase 't':

TokenInput(mapping="Jans::Access_token", payload=access_token)
TokenInput(mapping="Jans::Id_token",     payload=id_token)
TokenInput(mapping="Jans::Userinfo_token", payload=userinfo_token)

But the binding tests (test_authorize_multi_issuer.py) and example.py consistently use uppercase 'T':

TokenInput(mapping="Jans::Access_Token", payload=ACCESS_TOKEN)
TokenInput(mapping="Jans::Id_Token",     payload=ID_TOKEN)
TokenInput(mapping="Jans::Userinfo_Token", payload=USERINFO_TOKEN)

Since mapping is an entity type name resolved against the Cedar schema, and Cedar is case-sensitive, using "Jans::Access_token" instead of "Jans::Access_Token" will cause a runtime entity resolution failure if the schema defines these types with uppercase 'T'. This should be confirmed against the actual Cedar schema being used by the sidecar.

🧠 Learnings used

Learnt from: CR
Repo: JanssenProject/jans PR: 0
File: jans-cedarling/AGENTS.md:0-0
Timestamp: 2026-03-04T18:43:54.762Z
Learning: Applies to jans-cedarling/bindings/cedarling_python/**/*.pyi : After making changes to `bindings/cedarling_python`, validate the `.pyi` files in `bindings/cedarling_python/cedarling_python` to ensure type hints match Rust interface changes

Learnt from: SafinWasi
Repo: JanssenProject/jans PR: 13463
File: jans-cedarling/flask-sidecar/README.md:21-22
Timestamp: 2026-03-12T06:56:13.094Z
Learning: In `jans-cedarling/flask-sidecar/README.md`, the cedarling Python binding wheel filename (e.g., `cedarling_python-0.0.0-cp311-cp311-manylinux_2_34_x86_64.whl`) is intentionally hardcoded because the sidecar is pinned to Python 3.11. The filename only changes if the Python version of the sidecar changes, so do not flag it as needing a glob or dynamic substitution note.

Learnt from: CR
Repo: JanssenProject/jans PR: 0
File: jans-cedarling/AGENTS.md:0-0
Timestamp: 2026-03-04T18:43:54.762Z
Learning: Applies to jans-cedarling/bindings/cedarling_python/**/*.py : Use `mypy` to validate type annotations in Python bindings: `mypy cedarling_python`

Learnt from: moabu
Repo: JanssenProject/jans PR: 13060
File: CHANGELOG.md:25-26
Timestamp: 2026-01-22T14:33:53.554Z
Learning: Repo: JanssenProject/jans — For Release Please-generated PRs (chore(main): release …), CHANGELOG.md is auto-generated; avoid suggesting manual edits (e.g., duplicate/formatting cleanups) and ignore minor nits in that file.

Learnt from: CR
Repo: JanssenProject/jans PR: 0
File: jans-cedarling/AGENTS.md:0-0
Timestamp: 2026-03-04T18:43:54.762Z
Learning: Applies to jans-cedarling/**/*.rs : Include both positive and negative test cases for all tests

Learnt from: CR
Repo: JanssenProject/jans PR: 0
File: jans-cedarling/AGENTS.md:0-0
Timestamp: 2026-03-04T18:43:54.762Z
Learning: Applies to jans-cedarling/**/*.rs : Use standard Rust docstrings without Python-style sections (avoid # Arguments, # Returns). Focus on "why" not "what", include examples for complex functionality, and keep documentation concise.

…urations - Deleted multiple deprecated policy store files including `agama-store_2.yaml`, `policy-store_entity_mapping.yaml`, and others to clean up the test suite. - Updated `bootstrap_props.json` and `bootstrap_props.yaml` to reference the new policy store file `policy-store_ok.yaml`. - Removed unused files related to local JWKS and policy store locks, enhancing clarity and maintainability of the test configurations. Signed-off-by: haileyesus2433 <haileyesusbe@gmail.com>

haileyesus2433 · 2026-03-13T13:02:29Z

You also need to remove outdated fields/entities in testing files (folder test_files). And remove unused files

resolved in f677cb5

Signed-off-by: Oleh Bozhok <6554798+olehbozhok@users.noreply.github.com>

…arling-13441 Signed-off-by: Oleh Bozhok <6554798+olehbozhok@users.noreply.github.com>

Signed-off-by: Oleh Bozhok <6554798+olehbozhok@users.noreply.github.com>

olehbozhok · 2026-03-13T20:42:32Z

@haileyesus2433 I removed some outdated fields from the code and merged the last changes from main. Testing code still has some problems, pls analyze them and fix if needed.

haileyesus2433 added 6 commits March 11, 2026 05:33

haileyesus2433 added this to the 2.0.0 milestone Mar 12, 2026

haileyesus2433 requested review from dagregi and olehbozhok March 12, 2026 07:09

haileyesus2433 self-assigned this Mar 12, 2026

olehbozhok approved these changes Mar 12, 2026

View reviewed changes

olehbozhok reviewed Mar 12, 2026

View reviewed changes

jans-cedarling/flask-sidecar/main/base/cedarling/cedarling.py Outdated Show resolved Hide resolved

olehbozhok requested changes Mar 12, 2026

View reviewed changes

dagregi approved these changes Mar 13, 2026

View reviewed changes

olehbozhok added 4 commits March 13, 2026 19:30

chore(jans-cedarling): remove claim mappings

4e06114

Signed-off-by: Oleh Bozhok <6554798+olehbozhok@users.noreply.github.com>

chore(jans-cedarling): remove role mapping

ab79f09

Signed-off-by: Oleh Bozhok <6554798+olehbozhok@users.noreply.github.com>

chore(jans-cedarling): remove user_id

ac12bcb

Signed-off-by: Oleh Bozhok <6554798+olehbozhok@users.noreply.github.com>

chore(jans-cedarling): remove get_token_metadata

ea09d13

Signed-off-by: Oleh Bozhok <6554798+olehbozhok@users.noreply.github.com>

coderabbitai bot approved these changes Mar 13, 2026

View reviewed changes

olehbozhok added 2 commits March 13, 2026 21:27

Merge commit 'c3a62f95d95ff4a65a4908371f3f6390638257b7' into jans-ced…

422c75c

…arling-13441 Signed-off-by: Oleh Bozhok <6554798+olehbozhok@users.noreply.github.com>

chore(jans-cedarling): add fix build app after merging

7ba068e

Signed-off-by: Oleh Bozhok <6554798+olehbozhok@users.noreply.github.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(jans-cedarling): Update Tests, Examples, and Benchmarks After Core Changes#13464

feat(jans-cedarling): Update Tests, Examples, and Benchmarks After Core Changes#13464
haileyesus2433 wants to merge 14 commits intojans-cedarling-13381from
jans-cedarling-13441

haileyesus2433 commented Mar 12, 2026

Uh oh!

coderabbitai bot commented Mar 12, 2026 •

edited

Loading

Review skipped

Uh oh!

mo-auto commented Mar 12, 2026 •

edited

Loading

Uh oh!

olehbozhok Mar 12, 2026

Uh oh!

olehbozhok commented Mar 12, 2026

Uh oh!

olehbozhok commented Mar 12, 2026

Uh oh!

Uh oh!

olehbozhok left a comment •

edited

Loading

Uh oh!

haileyesus2433 commented Mar 12, 2026

Uh oh!

coderabbitai bot commented Mar 12, 2026

Uh oh!

haileyesus2433 commented Mar 13, 2026

Uh oh!

olehbozhok commented Mar 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

haileyesus2433 commented Mar 12, 2026

Prepare

Description

Target issue

Test and Document the changes

Uh oh!

coderabbitai bot commented Mar 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

mo-auto commented Mar 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

olehbozhok Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

olehbozhok commented Mar 12, 2026

Uh oh!

olehbozhok commented Mar 12, 2026

Uh oh!

Uh oh!

olehbozhok left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

haileyesus2433 commented Mar 12, 2026

Uh oh!

coderabbitai bot commented Mar 12, 2026

✅ API Usage — All Valid

⚠️ One Concern — Token Mapping Case Mismatch

Uh oh!

haileyesus2433 commented Mar 13, 2026

Uh oh!

olehbozhok commented Mar 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

coderabbitai bot commented Mar 12, 2026 •

edited

Loading

mo-auto commented Mar 12, 2026 •

edited

Loading

olehbozhok left a comment •

edited

Loading