feat(main): update proto GIT_TAG to service/v0.8.0 by b-long · Pull Request #137 · b-long/opentdf-python-sdk

b-long · 2026-04-30T23:57:28Z

Bump default GIT_TAG from service/v0.7.2 to service/v0.8.0
Restore buf.gen.yaml to its original content after buf generate runs (was leaking absolute plugin path into tracked file)
Fix re.sub in run_buf_generate() to use a lambda replacement, preventing backslash corruption in plugin paths on Windows-style paths
Replace sys.path mutation in init.py with sys.modules aliasing so connect-generated absolute imports (e.g. import kas.kas_pb2) resolve without global side effects
Fix connect-python version pin from <0.5 to >=0.6.0 — generated connect files use the v0.6 API (connectrpc.client)
Add protoc-gen-openapiv2 as an explicit runtime dependency (was transitively available but not declared)
Add tests for the sys.modules import workaround
Add .gemini/config.yaml to suppress code review noise on generated proto files
Regenerate all proto files from service/v0.8.0 (new: obligations service, updated kasregistry/objects/unsafe/authorization)
Update test assertion to match new default GIT_TAG

- Bump default GIT_TAG from service/v0.7.2 to service/v0.8.0 - Remove unnecessary lambda from re.sub in run_buf_generate() - Restore buf.gen.yaml to its original content after buf generate runs (was leaking absolute plugin path into tracked file) - Add sys.path fix in __init__.py for connect-python v0.6+ absolute import style - Regenerate all proto files from service/v0.8.0 (new: obligations, updated kasregistry/objects/unsafe/authorization) - Update test assertion to match new default tag

gemini-code-assist

Code Review

This pull request updates the OpenTDF platform protobuf definitions to version 0.8.0, introduces new message types for obligations and key mappings, and adds a new ListKeyMappings RPC. Additionally, it includes updates to the Python generation script and runtime import handling to support newer versions of the Connect-Python plugin. My feedback focuses on cleaning up commented-out code and unused imports in the newly added proto files to improve maintainability.

Copilot

Pull request overview

This PR updates the generated Python protobuf/Connect/gRPC outputs to match OpenTDF platform service/v0.8.0, along with small generator/test adjustments to keep generation deterministic and imports working with the updated connect generator output.

Changes:

Bump the default platform GIT_TAG to service/v0.8.0 and update the related unit test assertion.
Regenerate protobuf/pyi/connect/legacy-grpc outputs for the updated protos (notably adding Policy Obligations and updating Unsafe/KAS Registry/Authorization protos).
Update the generation workflow to avoid leaking absolute plugin paths into the tracked buf.gen.yaml, and add an import workaround for connect-generated absolute imports.

Reviewed changes

Copilot reviewed 25 out of 50 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
otdf-python-proto/tests/test_generate_connect_proto.py	Updates assertion for the new default `service/v0.8.0` tag.
otdf-python-proto/src/otdf_python_proto/init.py	Adds a `sys.path` workaround to support connect-generated absolute imports.
otdf-python-proto/scripts/generate_connect_proto.py	Updates default tag; restores `buf.gen.yaml` after generation; adjusts plugin-path substitution.
otdf-python-proto/src/otdf_python_proto/wellknownconfiguration/wellknown_configuration_connect.py	Regenerated connect client imports to absolute-style.
otdf-python-proto/src/otdf_python_proto/kas/kas_connect.py	Regenerated connect client imports to absolute-style.
otdf-python-proto/src/otdf_python_proto/entityresolution/entity_resolution_connect.py	Regenerated connect client imports to absolute-style.
otdf-python-proto/src/otdf_python_proto/authorization/authorization_connect.py	Regenerated connect client imports to absolute-style.
otdf-python-proto/src/otdf_python_proto/policy/unsafe/unsafe_pb2.py	Regenerated protobuf for updated Unsafe KAS key delete request/response shapes.
otdf-python-proto/src/otdf_python_proto/policy/unsafe/unsafe_pb2.pyi	Regenerated stubs for updated Unsafe KAS key delete request/response shapes.
otdf-python-proto/src/otdf_python_proto/policy/objects_pb2.py	Regenerated protobuf for new obligation-related policy objects.
otdf-python-proto/src/otdf_python_proto/policy/objects_pb2.pyi	Regenerated stubs for new obligation-related policy objects.
otdf-python-proto/src/otdf_python_proto/policy/obligations/init.py	Adds/keeps package marker for new obligations module.
otdf-python-proto/src/otdf_python_proto/policy/obligations/obligations_pb2.py	New generated protobuf module for obligations service/messages.
otdf-python-proto/src/otdf_python_proto/policy/obligations/obligations_pb2.pyi	New generated stubs for obligations service/messages.
otdf-python-proto/src/otdf_python_proto/policy/obligations/obligations_connect.py	New generated Connect client/server scaffolding for obligations.
otdf-python-proto/src/otdf_python_proto/policy/kasregistry/key_access_server_registry_pb2.py	Regenerated protobuf for KAS Registry changes (incl. key mappings, algorithm validation updates).
otdf-python-proto/src/otdf_python_proto/policy/kasregistry/key_access_server_registry_pb2.pyi	Regenerated stubs for KAS Registry changes (incl. key mappings).
otdf-python-proto/src/otdf_python_proto/policy/kasregistry/key_access_server_registry_connect.py	Regenerated Connect client/server with new `ListKeyMappings` RPC.
otdf-python-proto/src/otdf_python_proto/authorization/v2/authorization_pb2.py	Regenerated protobuf with updated validation constraints/limits.
otdf-python-proto/proto-files/policy/unsafe/unsafe.proto	Updates Unsafe delete KAS key request/response schema.
otdf-python-proto/proto-files/policy/objects.proto	Adds obligation-related policy object messages.
otdf-python-proto/proto-files/policy/obligations/obligations.proto	Adds new obligations service proto definitions.
otdf-python-proto/proto-files/policy/kasregistry/key_access_server_registry.proto	Updates algorithm validation and adds key-mapping RPC/messages.
otdf-python-proto/proto-files/authorization/v2/authorization.proto	Updates validation constraints (entity chain size, resource/decision limits).
otdf-python-proto/src/otdf_python_proto/legacy_grpc/policy/obligations/init.py	Adds/keeps package marker for legacy gRPC obligations outputs.
otdf-python-proto/src/otdf_python_proto/legacy_grpc/policy/obligations/obligations_pb2_grpc.py	New generated legacy gRPC stubs for obligations service.
otdf-python-proto/src/otdf_python_proto/legacy_grpc/policy/kasregistry/key_access_server_registry_pb2_grpc.py	Regenerated legacy gRPC stubs with new `ListKeyMappings` RPC.
otdf-python-proto/src/otdf_python_proto/logger/audit/init.py	Package marker file (created/updated by generation).
otdf-python-proto/src/otdf_python_proto/legacy_grpc/wellknownconfiguration/init.py	Package marker file (created/updated by generation).
otdf-python-proto/src/otdf_python_proto/legacy_grpc/policy/unsafe/init.py	Package marker file (created/updated by generation).
otdf-python-proto/src/otdf_python_proto/legacy_grpc/policy/subjectmapping/init.py	Package marker file (created/updated by generation).
otdf-python-proto/src/otdf_python_proto/legacy_grpc/policy/resourcemapping/init.py	Package marker file (created/updated by generation).
otdf-python-proto/src/otdf_python_proto/legacy_grpc/policy/registeredresources/init.py	Package marker file (created/updated by generation).
otdf-python-proto/src/otdf_python_proto/legacy_grpc/policy/namespaces/init.py	Package marker file (created/updated by generation).
otdf-python-proto/src/otdf_python_proto/legacy_grpc/policy/keymanagement/init.py	Package marker file (created/updated by generation).
otdf-python-proto/src/otdf_python_proto/legacy_grpc/policy/kasregistry/init.py	Package marker file (created/updated by generation).
otdf-python-proto/src/otdf_python_proto/legacy_grpc/policy/attributes/init.py	Package marker file (created/updated by generation).
otdf-python-proto/src/otdf_python_proto/legacy_grpc/policy/actions/init.py	Package marker file (created/updated by generation).
otdf-python-proto/src/otdf_python_proto/legacy_grpc/policy/init.py	Package marker file (created/updated by generation).
otdf-python-proto/src/otdf_python_proto/legacy_grpc/logger/audit/init.py	Package marker file (created/updated by generation).
otdf-python-proto/src/otdf_python_proto/legacy_grpc/logger/init.py	Package marker file (created/updated by generation).
otdf-python-proto/src/otdf_python_proto/legacy_grpc/kas/init.py	Package marker file (created/updated by generation).
otdf-python-proto/src/otdf_python_proto/legacy_grpc/entityresolution/v2/init.py	Package marker file (created/updated by generation).
otdf-python-proto/src/otdf_python_proto/legacy_grpc/entityresolution/init.py	Package marker file (created/updated by generation).
otdf-python-proto/src/otdf_python_proto/legacy_grpc/entity/init.py	Package marker file (created/updated by generation).
otdf-python-proto/src/otdf_python_proto/legacy_grpc/common/init.py	Package marker file (created/updated by generation).
otdf-python-proto/src/otdf_python_proto/legacy_grpc/authorization/v2/init.py	Package marker file (created/updated by generation).
otdf-python-proto/src/otdf_python_proto/legacy_grpc/authorization/init.py	Package marker file (created/updated by generation).
otdf-python-proto/src/otdf_python_proto/entityresolution/v2/init.py	Package marker file (created/updated by generation).
otdf-python-proto/src/otdf_python_proto/authorization/v2/init.py	Package marker file (created/updated by generation).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-05-01T00:11:35Z

+from pathlib import Path
 from importlib import metadata

+# connect-python v0.6+ generates absolute sub-package imports (e.g. `import kas.kas_pb2`)
+# rather than relative ones. Add this package's directory to sys.path so those imports resolve.
+_pkg_dir = str(Path(__file__).parent)
+if _pkg_dir not in sys.path:
+    sys.path.insert(0, _pkg_dir)
+


Modifying sys.path from a library __init__.py (especially inserting at position 0) has global side effects: after importing otdf_python_proto, imports like import policy / import kas may unexpectedly resolve to this package's internal modules and shadow unrelated third-party modules with the same names. Consider an approach that avoids sys.path mutation (e.g., configuring the generator to emit package-prefixed imports, or using explicit module aliasing in sys.modules limited to the needed names).

Suggested change

from pathlib import Path

from importlib import metadata

# connect-python v0.6+ generates absolute sub-package imports (e.g. `import kas.kas_pb2`)

# rather than relative ones. Add this package's directory to sys.path so those imports resolve.

_pkg_dir = str(Path(__file__).parent)

if _pkg_dir not in sys.path:

sys.path.insert(0, _pkg_dir)

from importlib import metadata, import_module

# connect-python v0.6+ generates absolute sub-package imports (e.g. `import kas.kas_pb2`)

# rather than relative ones. Register only the generated top-level package names that

# need to resolve into this package, instead of mutating sys.path for the whole process.

def _register_generated_package_aliases():

for alias in ("common", "entity", "kas", "legacy_grpc", "logger", "policy"):

sys.modules.setdefault(alias, import_module(f".{alias}", __name__))

_register_generated_package_aliases()

Copilot · 2026-05-01T00:11:35Z

+# connect-python v0.6+ generates absolute sub-package imports (e.g. `import kas.kas_pb2`)
+# rather than relative ones. Add this package's directory to sys.path so those imports resolve.


The comment says this is needed for connect-python v0.6+, but pyproject.toml currently pins connect-python[compiler]>=0.4.2,<0.5. Either update the dependency constraint (if the project now requires v0.6+) or adjust the comment to match the supported versions, to avoid confusing future maintainers.

Suggested change

# connect-python v0.6+ generates absolute sub-package imports (e.g. `import kas.kas_pb2`)

# rather than relative ones. Add this package's directory to sys.path so those imports resolve.

# Some generated protobuf modules use absolute sub-package imports

# (e.g. `import kas.kas_pb2`) rather than relative ones. Add this package's

# directory to sys.path so those imports resolve.

Copilot · 2026-05-01T00:11:35Z

+from pathlib import Path
 from importlib import metadata

+# connect-python v0.6+ generates absolute sub-package imports (e.g. `import kas.kas_pb2`)
+# rather than relative ones. Add this package's directory to sys.path so those imports resolve.
+_pkg_dir = str(Path(__file__).parent)
+if _pkg_dir not in sys.path:
+    sys.path.insert(0, _pkg_dir)
+


This new import-resolution workaround is easy to regress (e.g., if package layout changes or new top-level proto packages are added). Consider adding a small unit test that imports otdf_python_proto and then successfully imports one of the connect-generated absolute imports (e.g., import kas.kas_pb2 or import policy.objects_pb2) to lock in the expected behavior.

Suggested change

from pathlib import Path

from importlib import metadata

# connect-python v0.6+ generates absolute sub-package imports (e.g. `import kas.kas_pb2`)

# rather than relative ones. Add this package's directory to sys.path so those imports resolve.

_pkg_dir = str(Path(__file__).parent)

if _pkg_dir not in sys.path:

sys.path.insert(0, _pkg_dir)

import types

from pathlib import Path

from importlib import metadata

# connect-python v0.6+ generates absolute sub-package imports (e.g. `import kas.kas_pb2`)

# rather than relative ones. Register this package's generated subpackages as top-level

# package aliases so those absolute imports resolve without mutating global sys.path.

_pkg_path = Path(__file__).parent

def _register_generated_top_level_packages():

for child in _pkg_path.iterdir():

if not child.is_dir() or child.name.startswith("_"):

continue

module_name = child.name

if module_name in sys.modules:

continue

package_module = types.ModuleType(module_name)

package_module.__file__ = str(child / "__init__.py")

package_module.__package__ = module_name

package_module.__path__ = [str(child)]

sys.modules[module_name] = package_module

_register_generated_top_level_packages()

…kslashes in plugin path

…nd comment

…nnect absolute imports

… absolute imports

…piv2 dependency

…view

b-long · 2026-05-08T01:22:21Z

/gemini review

gemini-code-assist

Code Review

This pull request introduces significant updates to protobuf definitions and generated code across several services. Key changes include enhanced validation rules for entity and resource identifiers, expanded support for key algorithms, and the introduction of a new 'Obligations' service with its own messages and RPCs. Additionally, it adds key mapping functionality to the KAS registry, updates Python dependencies, and refines the proto generation script. Feedback from the review points out a missing newline at the end of a new proto file and suggests simplifying a regular expression substitution in the generation script.

gemini-code-assist Bot reviewed May 1, 2026

View reviewed changes

b-long requested a review from Copilot May 1, 2026 00:04

Copilot started reviewing on behalf of b-long May 1, 2026 00:04 View session

Copilot AI reviewed May 1, 2026

View reviewed changes

b-long added the help wanted Extra attention is needed label May 4, 2026

b-long added 6 commits May 7, 2026 20:13

fix(proto-gen): use lambda replacement in re.sub to safely handle bac…

aa406c9

…kslashes in plugin path

fix(proto): correct misleading version reference in sys.path workarou…

6176120

…nd comment

fix(proto): replace sys.path mutation with sys.modules aliases for co…

9adb443

…nnect absolute imports

test(proto): add tests and fix two-pass stub registration for connect…

d20b5cd

… absolute imports

fix(proto): update connect-python to >=0.6.0 and add protoc-gen-opena…

138a31c

…piv2 dependency

chore: add Gemini config to ignore generated proto files from code re…

aca1809

…view

gemini-code-assist Bot reviewed May 8, 2026

View reviewed changes

Comment thread otdf-python-proto/proto-files/policy/obligations/obligations.proto

Comment thread otdf-python-proto/scripts/generate_connect_proto.py

b-long merged commit 05ea9a4 into main May 8, 2026
11 checks passed

b-long deleted the feat/update-service-080 branch May 8, 2026 01:41

github-actions Bot mentioned this pull request May 8, 2026

chore(main): release otdf-python 0.5.0 #138

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(main): update proto GIT_TAG to service/v0.8.0#137

feat(main): update proto GIT_TAG to service/v0.8.0#137
b-long merged 7 commits intomainfrom
feat/update-service-080

b-long commented Apr 30, 2026 •

edited

Loading

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI May 1, 2026

Uh oh!

Copilot AI May 1, 2026

Uh oh!

Copilot AI May 1, 2026

Uh oh!

Uh oh!

b-long commented May 8, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		# connect-python v0.6+ generates absolute sub-package imports (e.g. `import kas.kas_pb2`)
		# rather than relative ones. Add this package's directory to sys.path so those imports resolve.

-# connect-python v0.6+ generates absolute sub-package imports (e.g. `import kas.kas_pb2`)
-# rather than relative ones. Add this package's directory to sys.path so those imports resolve.
+# Some generated protobuf modules use absolute sub-package imports
+# (e.g. `import kas.kas_pb2`) rather than relative ones. Add this package's
+# directory to sys.path so those imports resolve.

-from pathlib import Path
-from importlib import metadata
-# connect-python v0.6+ generates absolute sub-package imports (e.g. `import kas.kas_pb2`)
-# rather than relative ones. Add this package's directory to sys.path so those imports resolve.
-_pkg_dir = str(Path(__file__).parent)
-if _pkg_dir not in sys.path:
-    sys.path.insert(0, _pkg_dir)
+import types
+from pathlib import Path
+from importlib import metadata
+# connect-python v0.6+ generates absolute sub-package imports (e.g. `import kas.kas_pb2`)
+# rather than relative ones. Register this package's generated subpackages as top-level
+# package aliases so those absolute imports resolve without mutating global sys.path.
+_pkg_path = Path(__file__).parent
+def _register_generated_top_level_packages():
+    for child in _pkg_path.iterdir():
+        if not child.is_dir() or child.name.startswith("_"):
+            continue
+        module_name = child.name
+        if module_name in sys.modules:
+            continue
+        package_module = types.ModuleType(module_name)
+        package_module.__file__ = str(child / "__init__.py")
+        package_module.__package__ = module_name
+        package_module.__path__ = [str(child)]
+        sys.modules[module_name] = package_module
+_register_generated_top_level_packages()

Conversation

b-long commented Apr 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI May 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI May 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI May 1, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

b-long commented May 8, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

b-long commented Apr 30, 2026 •

edited

Loading