fix(rbac): use resource ID instead of membership id in ParentID field (#2295)

Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>

Author: jiparis

app/controlplane/api/controlplane/v1/project.pb.go

@@ -68,7 +68,7 @@ message ProjectMember {
   google.protobuf.Timestamp updated_at = 5;
   // The ID of latest project version this member is associated with
   string latest_project_version_id = 6;
-  // Optional parent ID for nested project memberships
+  // Optional parent resource ID for nested project memberships
   optional string parent_id = 7;
 }
 

app/controlplane/api/controlplane/v1/project.proto

@@ -388,8 +388,8 @@ func bizProjectMembershipToPb(m *biz.ProjectMembership) *pb.ProjectMember {
 		Role: role,
 	}
 
-	if m.ParentID != nil {
-		pbMember.ParentId = biz.ToPtr(m.ParentID.String())
+	if m.ParentResourceID != nil {
+		pbMember.ParentId = biz.ToPtr(m.ParentResourceID.String())
 	}
 
 	if m.User != nil {

app/controlplane/api/gen/frontend/controlplane/v1/project.ts

@@ -94,8 +94,10 @@ type ProjectMembership struct {
 	CreatedAt *time.Time
 	// UpdatedAt is the timestamp when the membership was last updated.
 	UpdatedAt *time.Time
-	// ParentID is used for nested memberships, if applicable
+	// ParentID is the parent membership object used for nested memberships, if applicable
 	ParentID *uuid.UUID
+	// ParentResourceID identifies the parent resource of this membership, if applicable
+	ParentResourceID *uuid.UUID
 }
 
 // GroupProjectInfo represents detailed information about a project that a group is a member of

app/controlplane/api/gen/jsonschema/controlplane.v1.ProjectMember.jsonschema.json

@@ -128,7 +128,7 @@ func (r *ProjectRepo) ListMembers(ctx context.Context, orgID uuid.UUID, projectI
 		Where(
 			membership.ResourceTypeEQ(authz.ResourceTypeProject),
 			membership.ResourceID(projectID),
-		)
+		).WithParent()
 
 	// Get total count before applying pagination
 	totalCount, err := query.Count(ctx)
@@ -362,6 +362,11 @@ func entProjectMembershipToBiz(m *ent.Membership, u *ent.User, g *ent.Group) *bi
 		ParentID:       m.ParentID,
 	}
 
+	// Add the parent resource ID if it exists
+	if m.Edges.Parent != nil {
+		mem.ParentResourceID = &m.Edges.Parent.ResourceID
+	}
+
 	if u != nil {
 		mem.User = entUserToBizUser(u)
 	}