fix(controlplane): enforce project RBAC on CAS download redirect lookups (PFM-6716) - #3400
Conversation
…ups (PFM-6716) CASRedirectService/GetDownloadURL resolved CAS mappings with no RBAC scopes for API-token callers, so a project-scoped token could mint a download URL for any artifact in its organization as long as it knew the digest. The guarded sibling endpoint, CASCredentialsService/Get, already restricted the same lookup to the token's visible projects. Both endpoints now build the scopes through a shared service helper, rbacScopesForOrg, so the token-to-scope resolution lives in one place and cannot drift between the two download paths again. Assisted-by: OpenCode Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev> Chainloop-Trace-Sessions: ses_f92e40175ffePQw6J062DZywDK
AI Session Checks — 🟡 83% · ✅ 0 failing
|
| Status | Attribution | File | Lines |
|---|---|---|---|
| created | ai | app/controlplane/internal/service/casredirect_integration_test.go |
+214 / -0 |
| modified | ai | app/controlplane/internal/service/service_test.go |
+63 / -0 |
| modified | ai | app/controlplane/internal/service/service.go |
+14 / -0 |
| modified | ai | app/controlplane/internal/service/cascredential.go |
+1 / -6 |
| modified | ai | app/controlplane/internal/service/casredirect.go |
+1 / -1 |
Policies (4)
| Status | Policy | Material | Messages |
|---|---|---|---|
| ✅ Passed | ai-config-ai-agents-allowed |
ai-coding-session-ses-f9 |
- |
| ✅ Passed | ai-config-no-dangerous-commands |
ai-coding-session-ses-f9 |
- |
| ✅ Passed | ai-config-no-secrets |
ai-coding-session-ses-f9 |
- |
| ✅ Passed | ai-config-mcp-servers-allowed |
ai-coding-session-ses-f9 |
- |
Security Checks — ✅ 7 passing
✅ secret-scan
| Status | Policy | Messages |
|---|---|---|
| ✅ Passed | secrets-detection |
- |
✅ sast-scan
| Status | Policy | Messages |
|---|---|---|
| ✅ Passed | owasp-top10-2025 |
- |
| ✅ Passed | sast |
- |
| ✅ Passed | cwe-top25 |
- |
| ✅ Passed | cwe-top26-40-cusp |
- |
PR info
| Status | Policy | Messages |
|---|---|---|
| ✅ Passed | pr-description-required |
- |
| ✅ Passed | pr-user-story-linked |
- |
⏭️ 3 scans not applied
| Scan | Reason |
|---|---|
vulnerability-scan |
no manifest/lockfile changed |
github-actions-scan |
no workflow files changed |
iac-scan |
no IaC files changed |
Powered by Chainloop and Chainloop Trace
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
No issues found across 5 files
Heads up: you’re close to your included review allowance. Set a flex budget so reviews don’t pause.
Re-trigger cubic
2 participants
What does this PR do?
Closes a project-isolation bypass in
CASRedirectService/GetDownloadURL(PFM-6716). The endpoint resolved CAS mappings without RBAC scopes for API-token callers, so a project-scoped API token could mint a download URL for any artifact in its organization as long as it knew the digest. The siblingCASCredentialsService/Getendpoint already restricted the same lookup to the token's visible projects.Both download endpoints now derive the lookup scopes from a single shared helper,
rbacScopesForOrg, so the token-to-scope resolution lives in one place and cannot drift between the two download paths again. The helper documents the scope convention at the point of use: an organization present in the scopes map limits access to the caller's visible projects, while an absent one keeps the organization fully reachable for callers RBAC does not apply to.🤖 Posted by Maximus bot (Claude Code) on behalf of @migmartri