feat(api): get workflowRuns by digest (#344)

---------

Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>

Author: migmartri

app/cli/internal/action/workflow_run_describe.go

@@ -85,7 +85,9 @@ func NewWorkflowRunDescribe(cfg *ActionsOpts) *WorkflowRunDescribe {
 
 func (action *WorkflowRunDescribe) Run(runID string, verify bool, publicKey string) (*WorkflowRunItemFull, error) {
 	client := pb.NewWorkflowRunServiceClient(action.cfg.CPConnection)
-	resp, err := client.View(context.Background(), &pb.WorkflowRunServiceViewRequest{Id: runID})
+	resp, err := client.View(context.Background(), &pb.WorkflowRunServiceViewRequest{
+		Ref: &pb.WorkflowRunServiceViewRequest_Id{Id: runID},
+	})
 	if err != nil {
 		return nil, err
 	}

app/controlplane/api/controlplane/v1/workflow_run.pb.go

@@ -107,7 +107,13 @@ message WorkflowRunServiceListResponse {
 }
 
 message WorkflowRunServiceViewRequest {
-  string id = 1 [(validate.rules).string.uuid = true];
+  // It can search by either ID or digest
+  oneof ref {
+    option (validate.required) = true;
+    
+    string id = 1 [(validate.rules).string.uuid = true];
+    string digest = 2 [(validate.rules).string = {min_len: 1}];
+  }
 }
 
 message WorkflowRunServiceViewResponse {

app/controlplane/api/controlplane/v1/workflow_run.pb.validate.go

@@ -49,6 +49,9 @@ type WorkflowRepo interface {
 
 type CreateOpts struct {
 	Name, OrgID, Project, Team, ContractID string
+	// Public means that the associated workflow runs, attestations and materials
+	// are reachable by other users, regardless of their organization
+	Public bool
 }
 
 type WorkflowUseCase struct {

app/controlplane/api/controlplane/v1/workflow_run.proto

@@ -18,6 +18,7 @@ package biz
 import (
 	"context"
 	"errors"
+	"fmt"
 	"time"
 
 	schemav1 "github.com/chainloop-dev/chainloop/app/controlplane/api/workflowcontract/v1"
@@ -152,7 +153,14 @@ func (uc *WorkflowContractUseCase) FindVersionByID(ctx context.Context, versionI
 		return nil, err
 	}
 
-	return uc.repo.FindVersionByID(ctx, versionUUID)
+	r, err := uc.repo.FindVersionByID(ctx, versionUUID)
+	if err != nil {
+		return nil, fmt.Errorf("finding contract version: %w", err)
+	} else if r == nil {
+		return nil, NewErrNotFound("contract version")
+	}
+
+	return r, nil
 }
 
 func (uc *WorkflowContractUseCase) Update(ctx context.Context, orgID, contractID, name string, schema *schemav1.CraftingSchema) (*WorkflowContractWithVersion, error) {

app/controlplane/api/gen/frontend/controlplane/v1/workflow_run.ts

@@ -64,6 +64,7 @@ const (
 type WorkflowRunRepo interface {
 	Create(ctx context.Context, workflowID, robotaccountID, contractVersion uuid.UUID, runURL, runnerType string, casBackends []uuid.UUID) (*WorkflowRun, error)
 	FindByID(ctx context.Context, ID uuid.UUID) (*WorkflowRun, error)
+	FindByAttestationDigest(ctx context.Context, digest string) (*WorkflowRun, error)
 	FindByIDInOrg(ctx context.Context, orgID, ID uuid.UUID) (*WorkflowRun, error)
 	MarkAsFinished(ctx context.Context, ID uuid.UUID, status WorkflowRunStatus, reason string) error
 	SaveAttestation(ctx context.Context, ID uuid.UUID, att *dsse.Envelope, digest string) error
@@ -247,7 +248,8 @@ func (uc *WorkflowRunUseCase) List(ctx context.Context, orgID, workflowID string
 	return uc.wfRunRepo.List(ctx, orgUUID, workflowUUID, p)
 }
 
-func (uc *WorkflowRunUseCase) View(ctx context.Context, orgID, runID string) (*WorkflowRun, error) {
+// Returns the workflow run with the provided ID if it belongs to the org or its public
+func (uc *WorkflowRunUseCase) GetByIDInOrgOrPublic(ctx context.Context, orgID, runID string) (*WorkflowRun, error) {
 	orgUUID, err := uuid.Parse(orgID)
 	if err != nil {
 		return nil, NewErrInvalidUUID(err)
@@ -258,7 +260,41 @@ func (uc *WorkflowRunUseCase) View(ctx context.Context, orgID, runID string) (*W
 		return nil, NewErrInvalidUUID(err)
 	}
 
-	return uc.wfRunRepo.FindByIDInOrg(ctx, orgUUID, runUUID)
+	wfrun, err := uc.wfRunRepo.FindByID(ctx, runUUID)
+	if err != nil {
+		return nil, fmt.Errorf("finding workflow run: %w", err)
+	}
+
+	// If the workflow is public or belongs to the org we can return it
+	return workflowRunInOrgOrPublic(wfrun, orgUUID)
+}
+
+func (uc *WorkflowRunUseCase) GetByDigestInOrgOrPublic(ctx context.Context, orgID, digest string) (*WorkflowRun, error) {
+	orgUUID, err := uuid.Parse(orgID)
+	if err != nil {
+		return nil, NewErrInvalidUUID(err)
+	}
+
+	if _, err := v1.NewHash(digest); err != nil {
+		return nil, NewErrValidation(fmt.Errorf("invalid digest format: %w", err))
+	}
+
+	wfrun, err := uc.wfRunRepo.FindByAttestationDigest(ctx, digest)
+	if err != nil {
+		return nil, fmt.Errorf("finding workflow run: %w", err)
+	}
+
+	// If the workflow is public or belongs to the org we can return it
+	return workflowRunInOrgOrPublic(wfrun, orgUUID)
+}
+
+// filter the workflow runs that belong to the org or are public
+func workflowRunInOrgOrPublic(wfRun *WorkflowRun, orgID uuid.UUID) (*WorkflowRun, error) {
+	if wfRun == nil || (wfRun.Workflow.OrgID != orgID && !wfRun.Workflow.Public) {
+		return nil, NewErrNotFound("workflow run")
+	}
+
+	return wfRun, nil
 }
 
 // Implements https://pkg.go.dev/entgo.io/ent/schema/field#EnumValues