feat(policy): Add UnsafeUpdateKey rpc.

[c-r33d]

Summary

• Add a new UnsafeUpdateKey proto, to enable the following flows:
  • Switching a key from public_key <-> remote
  • Switching provider configurations for a key

Summary by CodeRabbit

• New Features

  • Added the UnsafeUpdateKey API for updating an existing key using its ID, target key mode, and optional provider configuration.
  • The API response returns the updated key details.
  • Added client and server interface support for the new operation.

• Documentation

  • Updated gRPC and OpenAPI documentation with request fields, response schemas, endpoint details, and safety warnings.

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces a new administrative RPC method, UnsafeUpdateKey, to the policy service. This operation is designed to support specific key management workflows by allowing the transition between remote and public-key-only modes for existing keys. The changes include the necessary protobuf definitions, client-side interface updates, and a service-level stub to facilitate future implementation.

Highlights

• New RPC Method: Added the UnsafeUpdateKey RPC method to the UnsafeService to allow for in-place key mode updates.
• Protocol Buffer Definitions: Defined UnsafeUpdateKeyRequest and UnsafeUpdateKeyResponse messages with validation logic for key modes.
• Implementation Stub: Added a placeholder implementation for UnsafeUpdateKey that currently returns an 'Unimplemented' error.

New Features

🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Ignored Files

• Ignored by pattern: docs/openapi/**/* (1)
  • docs/openapi/policy/unsafe/unsafe.openapi.yaml
• Ignored by pattern: protocol/**/* (3)
  • protocol/go/policy/unsafe/unsafe.pb.go
  • protocol/go/policy/unsafe/unsafe_grpc.pb.go
  • protocol/go/policy/unsafe/unsafeconnect/unsafe.connect.go

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

---

A key is updated with care, Changing modes in the thin air. Though logic is yet to be found, The structure is safe and sound.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 7426353b-5b43-46c4-a8a8-a84aea8d0abd

📥 Commits

Reviewing files that changed from the base of the PR and between 2146d0f and e7f15b4.

⛔ Files ignored due to path filters (2)

• protocol/go/policy/unsafe/unsafe.pb.go is excluded by !**/*.pb.go
• protocol/go/policy/unsafe/unsafe_grpc.pb.go is excluded by !**/*.pb.go

📒 Files selected for processing (6)

• docs/grpc/index.html
• docs/openapi/policy/unsafe/unsafe.openapi.yaml
• protocol/go/policy/unsafe/unsafeconnect/unsafe.connect.go
• sdk/sdkconnect/unsafe.go
• service/policy/unsafe/unsafe.go
• service/policy/unsafe/unsafe.proto

---

📝 Walkthrough

Walkthrough

The unsafe policy service adds an UnsafeUpdateKey RPC contract with validated request fields and a KasKey response. Connect transport and SDK wrappers expose the method, while the current service implementation returns an unimplemented error. gRPC and OpenAPI documentation describe the new operation.

Changes

UnsafeUpdateKey RPC

Layer / File(s)	Summary
RPC contract and validation service/policy/unsafe/unsafe.proto	Defines UnsafeUpdateKeyRequest, UnsafeUpdateKeyResponse, field validation rules, and the new service RPC.
Connect and SDK wiring protocol/go/policy/unsafe/unsafeconnect/unsafe.connect.go, sdk/sdkconnect/unsafe.go, service/policy/unsafe/unsafe.go	Adds client and handler interfaces, Connect routing, SDK forwarding, and an unimplemented service method.
API documentation docs/grpc/index.html, docs/openapi/policy/unsafe/unsafe.openapi.yaml	Documents the RPC, request and response schemas, and service operation entries.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: jakedoublev

Poem

I’m a rabbit with keys in a neat little row,
An unsafe update now has a place to go.
Proto fields hop, Connect wires gleam,
Docs bloom softly beside the stream.
“Not implemented yet!” the service will say—
But the pathway is ready for a future day.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: adding the new UnsafeUpdateKey RPC for policy unsafe services.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch unsafe-update-key

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Code Review

This pull request introduces a new UnsafeUpdateKey RPC to the UnsafeService in the policy service, enabling in-place updates of key modes between REMOTE and PUBLIC_KEY_ONLY. The changes include adding the Protobuf definitions with CEL validation rules, updating the generated documentation, and adding the corresponding client SDK methods and service stubs. Feedback on the pull request points out an issue with the CEL validation logic in UnsafeUpdateKeyRequest, where an invalid key_mode can trigger redundant and confusing validation errors; a suggestion is provided to make the conditional validation cleaner.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	199.987487ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	120.037582ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	418.815008ms
Throughput	238.77 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	43.374573802s
Average Latency	431.853034ms
Throughput	115.27 requests/second

[github-actions]

X-Test Results

✅ go@pull-3728-main
✅ go@main-pull-3728
✅ go@main-main
✅ java@main-pull-3728
✅ go@pull-3728-v0.9.0
✅ go@main-v0.9.0
✅ java@main-main
✅ go@pull-3728-pull-3728
✅ js@main-pull-3728
✅ js@main-main
✅ java@main-v0.9.0
✅ js@main-v0.9.0
cukes-report
opentdfplatformRJP5G4.dockerbuild
govulncheck-failure-8
govulncheck-failure-3
govulncheck-failure-2
govulncheck-failure-0
govulncheck-failure-1
govulncheck-failure-5

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	207.328883ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	112.855985ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	418.283579ms
Throughput	239.07 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	45.117822195s
Average Latency	449.045142ms
Throughput	110.82 requests/second

[github-actions]

X-Test Results

bats-test-results
✅ go@main-pull-3728
✅ go@pull-3728-pull-3728
✅ go@main-main
✅ go@main-v0.9.0
✅ java@main-pull-3728
✅ go@pull-3728-v0.9.0
✅ java@main-main
✅ go@pull-3728-main
cukes-report
✅ js@main-pull-3728
✅ js@main-main
✅ java@main-v0.9.0
✅ js@main-v0.9.0
opentdfplatform01IQ8S.dockerbuild
govulncheck-failure-8
govulncheck-failure-0
govulncheck-failure-1
govulncheck-failure-3
govulncheck-failure-2
govulncheck-failure-5

[c-r33d]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	202.460193ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	105.30323ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	615.577259ms
Throughput	162.45 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	50.109226001s
Average Latency	499.169343ms
Throughput	99.78 requests/second

[github-actions]

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

• examples
• otdfctl
• sdk
• service
• lib/fixtures
• tests-bdd

See the workflow run for details.

[github-actions]

X-Test Results

✅ go@main-pull-3728
✅ go@pull-3728-pull-3728
✅ go@pull-3728-main
✅ go@main-main
✅ go@main-v0.9.0
✅ java@main-main
✅ java@main-pull-3728
✅ js@main-pull-3728
✅ go@pull-3728-v0.9.0
✅ java@main-v0.9.0
✅ js@main-v0.9.0
✅ js@main-main
cukes-report
opentdfplatform8VPS83.dockerbuild
govulncheck-failure-8
govulncheck-failure-3
govulncheck-failure-2
govulncheck-failure-0
govulncheck-failure-5
govulncheck-failure-1