Merge branch 'PFM-4137' into PFM-4146

Author: jiparis

.chainloop.yml

@@ -1,6 +1,6 @@
 # This indicates the [current version]+next
 # to indicate that we are building a new version of the project
-projectVersion: v1.74.0+next
+projectVersion: v1.74.1+next
 
 # Experimental feature used by Chainloop labs shared workflow https://github.com/chainloop-dev/labs
 # It maps the material names with location in disk so they get automatically attested

app/controlplane/api/gen/frontend/workflowcontract/v1/crafting_schema.ts

@@ -330,13 +330,13 @@ message PolicySpecV2 {
     string embedded = 2;
 
     // generic reference for file:// and http(s):// schemes
-    string ref = 3;
+    string ref = 4;
 
     option (buf.validate.oneof).required = true;
   }
 
   // if set, it will match any material supported by Chainloop
-  CraftingSchema.Material.MaterialType kind = 4 [(buf.validate.field).enum = {
+  CraftingSchema.Material.MaterialType kind = 3 [(buf.validate.field).enum = {
     not_in: [3]
   }];
 }

app/controlplane/api/workflowcontract/v1/crafting_schema.pb.go

@@ -214,15 +214,12 @@ func (s *OrganizationService) UpdateMembership(ctx context.Context, req *pb.Orga
 }
 
 func (s *OrganizationService) canCreateOrganization(ctx context.Context) (bool, error) {
-	// Restricted org creation is disabled, allow creation only to users
-	if !s.authz.RestrictOrgCreation {
-		if entities.CurrentMembership(ctx) != nil {
-			return true, nil
-		}
-		return false, nil
+	// if org creation restriction is disabled, allow creation to all users
+	if !s.authz.RestrictOrgCreation && entities.CurrentUser(ctx) != nil {
+		return true, nil
 	}
 
-	// otherwise, check for permissions
+	// otherwise, check for permissions (both users and API tokens)
 	if err := s.checkPolicy(ctx, authz.PolicyOrganizationCreate); err != nil {
 		return false, err
 	}

app/controlplane/api/workflowcontract/v1/crafting_schema.proto

@@ -331,22 +331,19 @@ func (s *service) visibleProjects(ctx context.Context) []uuid.UUID {
 
 // checkPolicy Checks a policy against a user or a token
 func (s *service) checkPolicy(ctx context.Context, policy *authz.Policy) error {
-	_, token, err := requireCurrentUserOrAPIToken(ctx)
-	if err != nil {
-		return err
-	}
-
 	// Token case
-	if token != nil {
-		for _, p := range token.Policies {
-			if p.Resource == policy.Resource && p.Action == policy.Action {
-				return nil
-			}
+	sub := usercontext.CurrentAuthzSubject(ctx)
+	if sub != "" {
+		ok, err := s.authz.Enforce(ctx, sub, policy)
+		if err != nil {
+			return handleUseCaseErr(err, s.log)
+		}
+		if ok {
+			return nil
 		}
-		return errors.Forbidden("forbidden", "not allowed")
 	}
 
-	// user case
+	// Other cases
 	m := entities.CurrentMembership(ctx)
 	if m == nil {
 		return errors.Forbidden("forbidden", "not allowed")

app/controlplane/internal/service/organization.go

@@ -7,9 +7,9 @@ description: Chainloop is an open source software supply chain control plane, a
 
 type: application
 # Bump the patch (not minor, not major) version on each change in the Chart Source code
-version: 1.326.0
+version: 1.327.0
 # Do not update appVersion, this is handled automatically by the release process
-appVersion: v1.74.0
+appVersion: v1.74.1
 
 dependencies:
   - name: common
@@ -33,11 +33,11 @@ dependencies:
 
 annotations:
     images: |
-        - image: ghcr.io/chainloop-dev/chainloop/artifact-cas:v1.74.0
+        - image: ghcr.io/chainloop-dev/chainloop/artifact-cas:v1.74.1
           name: artifact-cas
-        - image: ghcr.io/chainloop-dev/chainloop/control-plane:v1.74.0
+        - image: ghcr.io/chainloop-dev/chainloop/control-plane:v1.74.1
           name: control-plane
-        - image: ghcr.io/chainloop-dev/chainloop/control-plane-migrations:v1.74.0
+        - image: ghcr.io/chainloop-dev/chainloop/control-plane-migrations:v1.74.1
           name: control-plane-migrations
-        - image: ghcr.io/chainloop-dev/chainloop/cli:v1.74.0
+        - image: ghcr.io/chainloop-dev/chainloop/cli:v1.74.1
           name: cli

app/controlplane/internal/service/service.go

@@ -138,7 +138,7 @@ controlplane:
   image:
     registry: ghcr.io
     repository: chainloop-dev/chainloop/control-plane
-    tag: "v1.74.0"
+    tag: "v1.74.1"
 
 
   ## @param controlplane.containerPorts.http controlplane HTTP container port
@@ -219,7 +219,7 @@ controlplane:
     image:
       registry: ghcr.io
       repository: chainloop-dev/chainloop/control-plane-migrations
-      tag: "v1.74.0"
+      tag: "v1.74.1"
     # Run the migration job forcing SSL, required in AWS RDS for PostgreSQL 15
     ssl: false
 
@@ -996,7 +996,7 @@ cas:
   image:
     registry: ghcr.io
     repository: chainloop-dev/chainloop/artifact-cas
-    tag: "v1.74.0"
+    tag: "v1.74.1"
 
   ## @param cas.containerPorts.http controlplane HTTP container port
   ## @param cas.containerPorts.grpc controlplane gRPC container port

deployment/chainloop/Chart.yaml

@@ -10,7 +10,7 @@ import (
 )
 
 const (
-	chainloopVersion = "v1.74.0"
+	chainloopVersion = "v1.74.1"
 )
 
 var execOpts = dagger.ContainerWithExecOpts{