test(authz): cover multi-resource obligation FQN limit validation

Add proto and service-side tests for FulfillableObligationFqns on
GetDecisionMultiResourceRequest, which was previously untested.

Signed-off-by: jakedoublev <jake.vanvorhis@virtru.com>

Author: jakedoublev

service/authorization/v2/authorization_test.go

@@ -973,6 +973,34 @@ func Test_GetDecisionMultiResourceRequest_Succeeds(t *testing.T) {
 	}
 }
 
+func Test_GetDecisionMultiResourceRequest_ProtoValidationAllowsManyObligations(t *testing.T) {
+	v := getValidator()
+
+	fiftyOneObligations := make([]string, 51)
+	for i := range 51 {
+		fiftyOneObligations[i] = sampleObligationValueFQN
+	}
+
+	req := &authzV2.GetDecisionMultiResourceRequest{
+		EntityIdentifier: &authzV2.EntityIdentifier{
+			Identifier: &authzV2.EntityIdentifier_RegisteredResourceValueFqn{
+				RegisteredResourceValueFqn: sampleRegisteredResourceFQN,
+			},
+		},
+		Action: sampleActionCreate,
+		Resources: []*authzV2.Resource{
+			{
+				Resource: &authzV2.Resource_RegisteredResourceValueFqn{
+					RegisteredResourceValueFqn: sampleRegisteredResourceFQN,
+				},
+			},
+		},
+		FulfillableObligationFqns: fiftyOneObligations,
+	}
+	err := v.Validate(req)
+	require.NoError(t, err, "validation should allow more than 50 obligations so the service can enforce configured limits")
+}
+
 func Test_GetDecisionMultiResourceRequest_ProtoValidationAllowsManyResources(t *testing.T) {
 	v := getValidator()
 	upperBoundLimit := 1000

service/authorization/v2/validation_test.go

@@ -57,13 +57,34 @@ func Test_validateGetEntitlementsRequest_DefaultRequestLimit(t *testing.T) {
 	assert.Contains(t, err.Error(), "entity_identifier.entity_chain.entities exceeds maximum count: got 11, max 10")
 }
 
-func Test_validateGetDecisionMultiResourceRequest_DefaultRequestLimit(t *testing.T) {
+func Test_validateGetDecisionMultiResourceRequest_DefaultRequestLimits(t *testing.T) {
 	service := newValidationTestService(t, nil)
 
-	err := service.validateGetDecisionMultiResourceRequest(newDecisionMultiResourceRequestWithResourceCount(1001), "")
-	require.Error(t, err)
-	assert.Equal(t, connect.CodeInvalidArgument, connect.CodeOf(err))
-	assert.Contains(t, err.Error(), "resources exceeds maximum count: got 1001, max 1000")
+	cases := []struct {
+		name        string
+		request     *authzV2.GetDecisionMultiResourceRequest
+		expectedErr string
+	}{
+		{
+			name:        "resources",
+			request:     newDecisionMultiResourceRequestWithResourceCount(1001),
+			expectedErr: "resources exceeds maximum count: got 1001, max 1000",
+		},
+		{
+			name:        "fulfillable obligation fqns",
+			request:     newDecisionMultiResourceRequestWithObligationCount(51),
+			expectedErr: "fulfillable_obligation_fqns exceeds maximum count: got 51, max 50",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			err := service.validateGetDecisionMultiResourceRequest(tc.request, "")
+			require.Error(t, err)
+			assert.Equal(t, connect.CodeInvalidArgument, connect.CodeOf(err))
+			assert.Contains(t, err.Error(), tc.expectedErr)
+		})
+	}
 }
 
 func Test_validateGetDecisionBulkRequest_DefaultRequestLimit(t *testing.T) {
@@ -106,6 +127,7 @@ func Test_validateGetDecisionMultiResourceRequest_ExactlyAtDefaultLimitPasses(t
 	service := newValidationTestService(t, nil)
 
 	require.NoError(t, service.validateGetDecisionMultiResourceRequest(newDecisionMultiResourceRequestWithResourceCount(1000), ""))
+	require.NoError(t, service.validateGetDecisionMultiResourceRequest(newDecisionMultiResourceRequestWithObligationCount(50), ""))
 }
 
 func Test_validateGetDecisionBulkRequest_ExactlyAtDefaultLimitPasses(t *testing.T) {
@@ -127,6 +149,7 @@ func Test_validateDecisionRequests_UseCustomRequestLimits(t *testing.T) {
 	require.NoError(t, service.validateGetDecisionRequest(newDecisionRequestWithAttributeValueCount(21)))
 	require.NoError(t, service.validateGetDecisionRequest(newDecisionRequestWithObligationCount(51)))
 	require.NoError(t, service.validateGetDecisionMultiResourceRequest(newDecisionMultiResourceRequestWithResourceCount(1001), ""))
+	require.NoError(t, service.validateGetDecisionMultiResourceRequest(newDecisionMultiResourceRequestWithObligationCount(51), ""))
 	require.NoError(t, service.validateGetDecisionBulkRequest(newDecisionBulkRequestWithDecisionCount(201)))
 }
 
@@ -275,6 +298,21 @@ func newDecisionMultiResourceRequestWithAttributeValueCount(count int) *authzV2.
 	}
 }
 
+func newDecisionMultiResourceRequestWithObligationCount(count int) *authzV2.GetDecisionMultiResourceRequest {
+	return &authzV2.GetDecisionMultiResourceRequest{
+		EntityIdentifier: newTokenEntityIdentifier(),
+		Action:           sampleActionCreate,
+		Resources: []*authzV2.Resource{
+			{
+				Resource: &authzV2.Resource_RegisteredResourceValueFqn{
+					RegisteredResourceValueFqn: sampleRegisteredResourceFQN,
+				},
+			},
+		},
+		FulfillableObligationFqns: newObligationFQNs(count),
+	}
+}
+
 func newDecisionMultiResourceRequestWithResourceCount(count int) *authzV2.GetDecisionMultiResourceRequest {
 	resources := make([]*authzV2.Resource, count)
 	for i := range count {