feat(policy): SPIKE transactions support

service/pkg/db/db.go

@@ -54,6 +54,7 @@ func (t Table) Field(field string) string {
 // We can rename this but wanted to get mocks working.
 type PgxIface interface {
 	Acquire(ctx context.Context) (*pgxpool.Conn, error)
+	Begin(ctx context.Context) (pgx.Tx, error)
 	Exec(context.Context, string, ...any) (pgconn.CommandTag, error)
 	QueryRow(context.Context, string, ...any) pgx.Row
 	Query(context.Context, string, ...any) (pgx.Rows, error)

service/policy/db/attribute_fqn.go

@@ -40,7 +40,7 @@ func (c *PolicyDBClient) upsertAttrFqn(ctx context.Context, opts attrFqnUpsertOp
 	case opts.attributeID != "":
 		fqn, err = c.Queries.UpsertAttributeDefinitionFqn(ctx, opts.attributeID)
 	case opts.namespaceID != "":
-		fqn, err = c.Queries.UpsertAttributeNamespaceFqn(ctx, opts.namespaceID)
+		fqn, err = c.Queries.UpsertAttributeNamespaceFqn(ctx, opts.valueID)
 	default:
 		err = fmt.Errorf("at least one of namespaceId, attributeId, or valueId must be set")
 	}

service/policy/db/policy.go

@@ -1,6 +1,9 @@
 package db
 
 import (
+	"context"
+
+	"github.com/jackc/pgx/v5"
 	"github.com/opentdf/platform/protocol/go/common"
 	"github.com/opentdf/platform/service/logger"
 	"github.com/opentdf/platform/service/pkg/db"
@@ -19,6 +22,18 @@ type PolicyDBClient struct {
 	*Queries
 }
 
+func (c *PolicyDBClient) BeginTx(ctx context.Context) (pgx.Tx, error) {
+	tx, err := c.Client.Pgx.Begin(ctx)
+	if err != nil {
+		return nil, err
+	}
+	return tx, nil
+}
+
+func (c *PolicyDBClient) WithTx(tx pgx.Tx) *PolicyDBClient {
+	return &PolicyDBClient{c.Client, c.logger, c.Queries.WithTx(tx)}
+}
+
 var (
 	TableAttributes                    = "attribute_definitions"
 	TableAttributeValues               = "attribute_values"

service/policy/namespaces/namespaces.go

@@ -93,12 +93,25 @@
 	}
 	rsp := &namespaces.CreateNamespaceResponse{}
 
-	n, err := ns.dbClient.CreateNamespace(ctx, req)
+	tx, err := ns.dbClient.BeginTx(ctx)
+	if err != nil {
+		ns.logger.Audit.PolicyCRUDFailure(ctx, auditParams)
+		return nil, db.StatusifyError(err, "begin txn failed", slog.String("name", req.GetName()))
+	}
+	// safe to ignore error per https://pkg.go.dev/github.com/jackc/pgx#hdr-Transactions
+	defer tx.Rollback(ctx)
+
+	n, err := ns.dbClient.WithTx(tx).CreateNamespace(ctx, req)
 	if err != nil {
 		ns.logger.Audit.PolicyCRUDFailure(ctx, auditParams)
 		return nil, db.StatusifyError(err, db.ErrTextCreationFailed, slog.String("name", req.GetName()))
 	}
 
+	if err = tx.Commit(ctx); err != nil {
+		ns.logger.Audit.PolicyCRUDFailure(ctx, auditParams)
+		return nil, db.StatusifyError(err, "commit txn failed", slog.String("name", req.GetName()))
+	}
+
 	auditParams.ObjectID = n.GetId()
 	auditParams.Original = n
 	ns.logger.Audit.PolicyCRUDSuccess(ctx, auditParams)