feat(policy): obligations + values CRUD (#2545)

### Proposed Changes

adds sqlc queries for obligation_definitions CRUD + DB client methods
and integration tests

### Checklist

- [ ] I have added or updated unit tests
- [ ] I have added or updated integration tests (if appropriate)
- [ ] I have added or updated documentation

### Testing Instructions

---------

Co-authored-by: Krish Suchak <suchak.krish@gmail.com>
Co-authored-by: Chris Reed <creed@virtru.com>

Author: 3 people

docs/grpc/index.html

@@ -50,6 +50,10 @@ var clientsToGenerateList = []runner.ClientsToGenerate{
 		GrpcClientInterface: "NamespaceServiceClient",
 		GrpcPackagePath:     "github.com/opentdf/platform/protocol/go/policy/namespaces",
 	},
+	{
+		GrpcClientInterface: "ServiceClient",
+		GrpcPackagePath:     "github.com/opentdf/platform/protocol/go/policy/obligations",
+	},
 	{
 		GrpcClientInterface: "RegisteredResourcesServiceClient",
 		GrpcPackagePath:     "github.com/opentdf/platform/protocol/go/policy/registeredresources",

docs/openapi/policy/objects.openapi.yaml

@@ -8,6 +8,8 @@ import (
 	"path"
 	"path/filepath"
 
+	"golang.org/x/text/cases"
+	"golang.org/x/text/language"
 	"golang.org/x/tools/go/packages"
 )
 
@@ -61,7 +63,14 @@ func Generate(clientsToGenerateList []ClientsToGenerate, outputDir string) error
 						if client.PackageNameOverride != "" {
 							packageName = client.PackageNameOverride
 						}
-						code := generateWrapper(ts.Name.Name, iface, client.GrpcPackagePath, packageName, client.Suffix)
+						// In order to counter package name fatigue (policy.attributes.AttributesService),
+						// newer services are simply named "Service" (policy.obligations.Service).
+						// This prefix logic is necessary for newer services.
+						prefix := ""
+						if ts.Name.Name == "ServiceClient" {
+							prefix = cases.Title(language.English).String(packageName)
+						}
+						code := generateWrapper(ts.Name.Name, iface, client.GrpcPackagePath, packageName, prefix, client.Suffix)
 						outputPath := filepath.Join(outputDir, packageName+".go")
 						err = os.WriteFile(outputPath, []byte(code), 0o644) //nolint:gosec // ignore G306
 						if err != nil {
@@ -105,13 +114,13 @@ func getMethodNames(interfaceType *ast.InterfaceType) []string {
 }
 
 // Generate wrapper code for the Connect RPC client interface
-func generateWrapper(interfaceName string, interfaceType *ast.InterfaceType, packagePath string, packageName string, suffix string) string {
+func generateWrapper(interfaceName string, interfaceType *ast.InterfaceType, packagePath, packageName, prefix, suffix string) string {
 	// Get method names dynamically from the interface
 	methods := getMethodNames(interfaceType)
 	connectPackageName := packageName + "connect"
 
 	// Start generating the wrapper code
-	wrapperCode := fmt.Sprintf(`// Wrapper for %s (generated code) DO NOT EDIT
+	wrapperCode := fmt.Sprintf(`// Wrapper for %s%s (generated code) DO NOT EDIT
 package sdkconnect
 
 import (
@@ -121,47 +130,52 @@ import (
 	"%s"
 )
 
-type %s%sConnectWrapper struct {
+type %s%s%sConnectWrapper struct {
 	%s.%s
 }
 
-func New%s%sConnectWrapper(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) *%s%sConnectWrapper {
-	return &%s%sConnectWrapper{%s: %s.New%s(httpClient, baseURL, opts...)}
+func New%s%s%sConnectWrapper(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) *%s%s%sConnectWrapper {
+	return &%s%s%sConnectWrapper{%s: %s.New%s(httpClient, baseURL, opts...)}
 }
 `,
+		prefix,
 		interfaceName,
 		packagePath,
 		packagePath+"/"+connectPackageName,
+		prefix,
 		interfaceName,
 		suffix,
 		connectPackageName,
 		interfaceName,
+		prefix,
 		interfaceName,
 		suffix,
+		prefix,
 		interfaceName,
 		suffix,
+		prefix,
 		interfaceName,
 		suffix,
 		interfaceName,
 		connectPackageName,
 		interfaceName)
 
 	// Generate the interface type definition
-	wrapperCode += generateInterfaceType(interfaceName, methods, packageName, suffix)
+	wrapperCode += generateInterfaceType(interfaceName, methods, packageName, prefix, suffix)
 	// Now generate a wrapper function for each method in the interface
 	for _, method := range methods {
-		wrapperCode += generateWrapperMethod(interfaceName, method, packageName, suffix)
+		wrapperCode += generateWrapperMethod(interfaceName, method, packageName, prefix, suffix)
 	}
 
 	// Output the generated wrapper code
 	return wrapperCode
 }
 
-func generateInterfaceType(interfaceName string, methods []string, packageName string, suffix string) string {
+func generateInterfaceType(interfaceName string, methods []string, packageName, prefix, suffix string) string {
 	// Generate the interface type definition
 	interfaceType := fmt.Sprintf(`
-type %s%s interface {
-`, interfaceName, suffix)
+type %s%s%s interface {
+`, prefix, interfaceName, suffix)
 	for _, method := range methods {
 		interfaceType += fmt.Sprintf(`	%s(ctx context.Context, req *%s.%sRequest) (*%s.%sResponse, error)
 `, method, packageName, method, packageName, method)
@@ -171,15 +185,15 @@ type %s%s interface {
 }
 
 // Generate the wrapper method for a specific method in the interface
-func generateWrapperMethod(interfaceName, methodName, packageName string, suffix string) string {
+func generateWrapperMethod(interfaceName, methodName, packageName, prefix, suffix string) string {
 	return fmt.Sprintf(`
-func (w *%s%sConnectWrapper) %s(ctx context.Context, req *%s.%sRequest) (*%s.%sResponse, error) {
+func (w *%s%s%sConnectWrapper) %s(ctx context.Context, req *%s.%sRequest) (*%s.%sResponse, error) {
 	// Wrap Connect RPC client request
 	res, err := w.%s.%s(ctx, connect.NewRequest(req))
 	if res == nil {
 		return nil, err
 	}
 	return res.Msg, err
 }
-`, interfaceName, suffix, methodName, packageName, methodName, packageName, methodName, interfaceName, methodName)
+`, prefix, interfaceName, suffix, methodName, packageName, methodName, packageName, methodName, interfaceName, methodName)
 }

docs/openapi/policy/obligations/obligations.openapi.yaml

@@ -18,6 +18,7 @@ require (
 	github.com/testcontainers/testcontainers-go v0.37.0
 	github.com/xeipuuv/gojsonschema v1.2.0
 	golang.org/x/oauth2 v0.30.0
+	golang.org/x/text v0.26.0
 	golang.org/x/tools v0.34.0
 	google.golang.org/grpc v1.73.0
 	google.golang.org/protobuf v1.36.6
@@ -94,7 +95,6 @@ require (
 	golang.org/x/net v0.41.0 // indirect
 	golang.org/x/sync v0.15.0 // indirect
 	golang.org/x/sys v0.33.0 // indirect
-	golang.org/x/text v0.26.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect

protocol/go/policy/objects.pb.go

@@ -63,6 +63,7 @@ type SDK struct {
 	EntityResolutionV2      sdkconnect.EntityResolutionServiceClientV2
 	KeyAccessServerRegistry sdkconnect.KeyAccessServerRegistryServiceClient
 	Namespaces              sdkconnect.NamespaceServiceClient
+	Obligations             sdkconnect.ObligationsServiceClient
 	RegisteredResources     sdkconnect.RegisteredResourcesServiceClient
 	ResourceMapping         sdkconnect.ResourceMappingServiceClient
 	SubjectMapping          sdkconnect.SubjectMappingServiceClient
@@ -188,6 +189,7 @@ func New(platformEndpoint string, opts ...Option) (*SDK, error) {
 		Actions:                 sdkconnect.NewActionServiceClientConnectWrapper(platformConn.Client, platformConn.Endpoint, platformConn.Options...),
 		Attributes:              sdkconnect.NewAttributesServiceClientConnectWrapper(platformConn.Client, platformConn.Endpoint, platformConn.Options...),
 		Namespaces:              sdkconnect.NewNamespaceServiceClientConnectWrapper(platformConn.Client, platformConn.Endpoint, platformConn.Options...),
+		Obligations:             sdkconnect.NewObligationsServiceClientConnectWrapper(platformConn.Client, platformConn.Endpoint, platformConn.Options...),
 		RegisteredResources:     sdkconnect.NewRegisteredResourcesServiceClientConnectWrapper(platformConn.Client, platformConn.Endpoint, platformConn.Options...),
 		ResourceMapping:         sdkconnect.NewResourceMappingServiceClientConnectWrapper(platformConn.Client, platformConn.Endpoint, platformConn.Options...),
 		SubjectMapping:          sdkconnect.NewSubjectMappingServiceClientConnectWrapper(platformConn.Client, platformConn.Endpoint, platformConn.Options...),