Skip to content

feat(rbac): apply RBAC to CAS downloads #2136

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 14 commits into from
Jun 26, 2025
Merged

feat(rbac): apply RBAC to CAS downloads #2136

merged 14 commits into from
Jun 26, 2025

Conversation

jiparis
Copy link
Member

@jiparis jiparis commented Jun 26, 2025 •
edited
Loading

In this PR:

  • a new project_id field is added to CAS backends.
  • Artifacts coming from new attestations will be stored with the project ID they come from
  • project_id will be used to filter out candidate during CASMapping query. This applies to both CASCredential and CASRedirect services.
  • Remove upload for "members"

refs #2121

jiparis added 5 commits June 25, 2025 16:23
@jiparis
remove artifact uploads from org members
6b73ab8 
Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>
@jiparis
add project_id field
12b5791 
Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>
@jiparis
include project_id in attestations
36529a3 
Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>
@jiparis
apply RBAC to CAS credential download
05dac2e 
Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>
@jiparis
fix
4a26b0b 
Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>
@jiparis jiparis requested review from migmartri and javirln June 26, 2025 08:04
jiparis
jiparis commented Jun 26, 2025
View reviewed changes
@jiparis
Merge branch 'main' into PFM-3163-cas
c4d6ac8 
Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>
jiparis
jiparis commented Jun 26, 2025
View reviewed changes
migmartri
migmartri reviewed Jun 26, 2025
View reviewed changes
migmartri
migmartri reviewed Jun 26, 2025
View reviewed changes
migmartri
migmartri approved these changes Jun 26, 2025
View reviewed changes
Copy link
Member

@migmartri migmartri left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

modulo you apply the changes we discussed offline

jiparis added 8 commits June 26, 2025 11:49
@jiparis
use default backend only if admin
bf7477a 
Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>
@jiparis
apply suggestions
58131f4 
Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>
@jiparis
fix tests
4cb7d33 
Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>
@jiparis
fix tests
a27e718 
Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>
@jiparis
log project ID
54a2e5e 
Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>
@jiparis
fix err assignment
41222c0 
Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>
@jiparis
lint
d8db35e 
Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>
@jiparis
fix lint
1170b1b 
Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>
@jiparis jiparis merged commit 16e1849 into chainloop-dev:main Jun 26, 2025
13 checks passed
@jiparis jiparis deleted the PFM-3163-cas branch June 26, 2025 11:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@migmartri migmartri migmartri approved these changes

@javirln javirln Awaiting requested review from javirln

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@jiparis @migmartri