feat(rbac): contributor role

app/cli/internal/action/membership_list.go

@@ -162,10 +162,11 @@ func pbMembershipItemToAction(in *pb.OrgMembershipItem) *MembershipItem {
 type Role string
 
 const (
-	RoleAdmin  Role = "admin"
-	RoleOwner  Role = "owner"
-	RoleViewer Role = "viewer"
-	RoleMember Role = "member"
+	RoleAdmin       Role = "admin"
+	RoleOwner       Role = "owner"
+	RoleViewer      Role = "viewer"
+	RoleMember      Role = "member"
+	RoleContributor Role = "contributor"
 )
 
 type Roles []Role
@@ -175,6 +176,7 @@ var AvailableRoles = Roles{
 	RoleOwner,
 	RoleViewer,
 	RoleMember,
+	RoleContributor,
 }
 
 func (roles Roles) String() string {
@@ -195,6 +197,8 @@ func pbRoleToString(role pb.MembershipRole) Role {
 		return RoleOwner
 	case pb.MembershipRole_MEMBERSHIP_ROLE_ORG_MEMBER:
 		return RoleMember
+	case pb.MembershipRole_MEMBERSHIP_ROLE_ORG_CONTRIBUTOR:
+		return RoleContributor
 	}
 	return ""
 }
@@ -209,6 +213,8 @@ func stringToPbRole(role Role) pb.MembershipRole {
 		return pb.MembershipRole_MEMBERSHIP_ROLE_ORG_OWNER
 	case RoleMember:
 		return pb.MembershipRole_MEMBERSHIP_ROLE_ORG_MEMBER
+	case RoleContributor:
+		return pb.MembershipRole_MEMBERSHIP_ROLE_ORG_CONTRIBUTOR
 	}
 	return pb.MembershipRole_MEMBERSHIP_ROLE_UNSPECIFIED
 }

app/controlplane/api/controlplane/v1/response_messages.proto

@@ -254,6 +254,7 @@ enum MembershipRole {
   MEMBERSHIP_ROLE_ORG_ADMIN = 2;
   MEMBERSHIP_ROLE_ORG_OWNER = 3;
   MEMBERSHIP_ROLE_ORG_MEMBER = 4;
+  MEMBERSHIP_ROLE_ORG_CONTRIBUTOR = 5;
 }
 
 message OrgItem {

app/controlplane/internal/service/attestation.go

@@ -126,6 +126,12 @@ func (s *AttestationService) GetContract(ctx context.Context, req *cpAPI.Attesta
 		return nil, errors.NotFound("not found", "contract not found")
 	}
 
+	// If contract is private, check we have permissions on the project
+	scopedEntity := contractVersion.Contract.ScopedEntity
+	if rbacEnabled(ctx) && contractVersion.Contract.IsProjectScoped() && scopedEntity.ID != wf.ProjectID {
+		return nil, errors.NotFound("not found", "contract not found")
+	}
+
 	resp := &cpAPI.AttestationServiceGetContractResponse_Result{
 		Workflow: bizWorkflowToPb(wf),
 		Contract: bizWorkFlowContractVersionToPb(contractVersion.Version),
@@ -674,10 +680,14 @@ func (s *AttestationService) FindOrCreateWorkflow(ctx context.Context, req *cpAP
 
 	// try to load project and apply RBAC if needed
 	if _, err := s.userHasPermissionOnProject(ctx, apiToken.OrgID, &cpAPI.IdentityReference{Name: &req.ProjectName}, authz.PolicyWorkflowCreate); err != nil {
-		// if the project is not found, we ignore the error, since we'll create the project in this call
+		// if the project is not found, check if user can create projects
 		if !errors.IsNotFound(err) {
 			return nil, err
 		}
+
+		if err = s.userCanCreateProject(ctx); err != nil {
+			return nil, err
+		}
 	}
 
 	// we need this token to forward it to the provider service next

app/controlplane/internal/service/cascredential.go

@@ -128,7 +128,7 @@ func (s *CASCredentialsService) Get(ctx context.Context, req *pb.CASCredentialsS
 
 		if mapping != nil {
 			backend = mapping.CASBackend
-		} else if currentAuthzSubject == string(authz.RoleAdmin) || currentAuthzSubject == string(authz.RoleOwner) {
+		} else if authz.Role(currentAuthzSubject).IsAdmin() {
 			// fallback to default mapping for admins
 			backend = defaultBackend
 		}

app/controlplane/internal/service/group.go

@@ -265,6 +265,10 @@ func (g *GroupService) ListMembers(ctx context.Context, req *pb.GroupServiceList
 		RequesterID:       requesterUUID,
 	}
 
+	if err = g.userHasPermissionOnGroupMembershipsWithPolicy(ctx, currentOrg.ID, req.GetGroupReference(), authz.PolicyGroupListMemberships); err != nil {
+		return nil, err
+	}
+
 	// Parse groupID and groupName from the request
 	opts.ID, opts.Name, err = req.GetGroupReference().Parse()
 	if err != nil {
@@ -509,6 +513,7 @@ func (g *GroupService) ListProjects(ctx context.Context, req *pb.GroupServiceLis
 	orgUUID, err := uuid.Parse(currentOrg.ID)
 	if err != nil {
 		return nil, errors.BadRequest("invalid", "invalid organization ID")
+
 	}
 
 	// Parse groupID and groupName from the request
@@ -585,7 +590,7 @@ func (g *GroupService) userHasPermissionOnGroupMembershipsWithPolicy(ctx context
 	}
 
 	// Allow if user has admin or owner role
-	if userRole == string(authz.RoleAdmin) || userRole == string(authz.RoleOwner) {
+	if authz.Role(userRole).IsAdmin() {
 		return nil
 	}