feat(cli): display instance admin status in organization describe

app/cli/cmd/organization_describe.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2023-2025 The Chainloop Authors.
+// Copyright 2023-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -46,6 +46,7 @@ func newOrganizationDescribeCmd() *cobra.Command {
 func contextTableOutput(config *action.ConfigContextItem) error {
 	gt := output.NewTableWriter()
 	gt.SetTitle("Current Context")
+
 	gt.AppendRow(table.Row{"Logged in as", config.CurrentUser.PrintUserProfileWithEmail()})
 	gt.AppendSeparator()
 

app/cli/pkg/action/config_current_context.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2023 The Chainloop Authors.
+// Copyright 2023-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -37,11 +37,12 @@ type ConfigContextItem struct {
 }
 
 type UserItem struct {
-	ID        string     `json:"id"`
-	Email     string     `json:"email"`
-	FirstName string     `json:"firstName"`
-	LastName  string     `json:"lastName"`
-	CreatedAt *time.Time `json:"createdAt"`
+	ID            string     `json:"id"`
+	Email         string     `json:"email"`
+	FirstName     string     `json:"firstName"`
+	LastName      string     `json:"lastName"`
+	CreatedAt     *time.Time `json:"createdAt"`
+	InstanceAdmin bool       `json:"instanceAdmin,omitempty"`
 }
 
 // PrintUserProfileWithEmail formats the user's profile with their email.
@@ -58,11 +59,19 @@ func (u *UserItem) PrintUserProfileWithEmail() string {
 		name = u.LastName
 	}
 
+	var result string
 	// If we have a name, format with email, otherwise just return email
 	if name != "" {
-		return name + " <" + u.Email + ">"
+		result = name + " <" + u.Email + ">"
+	} else {
+		result = u.Email
 	}
-	return u.Email
+
+	if u.InstanceAdmin {
+		result += " (Instance admin)"
+	}
+
+	return result
 }
 
 func (action *ConfigCurrentContext) Run() (*ConfigContextItem, error) {
@@ -87,10 +96,11 @@ func pbUserItemToAction(in *pb.User) *UserItem {
 	}
 
 	return &UserItem{
-		ID:        in.Id,
-		Email:     in.Email,
-		FirstName: in.FirstName,
-		LastName:  in.LastName,
-		CreatedAt: toTimePtr(in.CreatedAt.AsTime()),
+		ID:            in.Id,
+		Email:         in.Email,
+		FirstName:     in.FirstName,
+		LastName:      in.LastName,
+		CreatedAt:     toTimePtr(in.CreatedAt.AsTime()),
+		InstanceAdmin: in.InstanceAdmin,
 	}
 }

app/controlplane/api/controlplane/v1/response_messages.proto

@@ -253,6 +253,7 @@ message User {
   google.protobuf.Timestamp updated_at = 6;
   string first_name = 4;
   string last_name = 5;
+  bool instance_admin = 7;
 }
 
 message OrgMembershipItem {

app/controlplane/internal/service/context.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2024-2025 The Chainloop Authors.
+// Copyright 2024-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -17,9 +17,11 @@ package service
 
 import (
 	"context"
+	"slices"
 
 	pb "github.com/chainloop-dev/chainloop/app/controlplane/api/controlplane/v1"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/usercontext/entities"
+	"github.com/chainloop-dev/chainloop/app/controlplane/pkg/authz"
 	"github.com/chainloop-dev/chainloop/app/controlplane/pkg/biz"
 	errors "github.com/go-kratos/kratos/v2/errors"
 	"google.golang.org/protobuf/types/known/timestamppb"
@@ -67,7 +69,7 @@ func (s *ContextService) Current(ctx context.Context, _ *pb.ContextServiceCurren
 		}
 	} else if currentUser != nil {
 		res.CurrentUser = &pb.User{
-			Id: currentUser.ID, Email: currentUser.Email, FirstName: currentUser.FirstName, LastName: currentUser.LastName, CreatedAt: timestamppb.New(*currentUser.CreatedAt),
+			Id: currentUser.ID, Email: currentUser.Email, FirstName: currentUser.FirstName, LastName: currentUser.LastName, CreatedAt: timestamppb.New(*currentUser.CreatedAt), InstanceAdmin: isInstanceAdmin(ctx),
 		}
 
 		// For regular users, we need to load the membership manually
@@ -143,3 +145,15 @@ func bizPolicyViolationBlockingStrategyToPb(blockOnPolicyViolation bool) pb.OrgI
 
 	return pb.OrgItem_POLICY_VIOLATION_BLOCKING_STRATEGY_ADVISORY
 }
+
+// isInstanceAdmin checks if the current user has instance admin role
+func isInstanceAdmin(ctx context.Context) bool {
+	m := entities.CurrentMembership(ctx)
+	if m == nil {
+		return false
+	}
+
+	return slices.ContainsFunc(m.Resources, func(r *entities.ResourceMembership) bool {
+		return r.Role == authz.RoleInstanceAdmin && r.ResourceType == authz.ResourceTypeInstance
+	})
+}