Skip to content

Commit 16e1849

Browse files
jiparisjiparis
authored
feat(rbac): apply RBAC to CAS downloads (#2136)
Signed-off-by: Jose I. Paris <[email protected]>
1 parent b1a3845 commit 16e1849

25 files changed

+567
-138
lines changed

‎app/controlplane/cmd/wire_gen.go‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎app/controlplane/internal/service/attestation.go‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -317,8 +317,11 @@ func (s *AttestationService) storeAttestation(ctx context.Context, envelope []by
317317
}
318318

319319
for _, ref := range references {
320-
s.log.Infow("msg", "creating CAS mapping", "name", ref.Name, "digest", ref.Digest, "workflowRun", workflowRunID, "casBackend", casBackend.ID.String())
321-
if _, err := s.casMappingUseCase.Create(ctx, ref.Digest, casBackend.ID.String(), workflowRunID); err != nil {
320+
s.log.Infow("msg", "creating CAS mapping", "name", ref.Name, "digest", ref.Digest, "project", wf.ProjectID.String(), "workflowRun", workflowRunID, "casBackend", casBackend.ID.String())
321+
if _, err := s.casMappingUseCase.Create(ctx, ref.Digest, casBackend.ID.String(), &biz.CASMappingCreateOpts{
322+
WorkflowRunID: &wfRun.ID,
323+
ProjectID: &wf.ProjectID,
324+
}); err != nil {
322325
return nil, handleUseCaseErr(err, s.log)
323326
}
324327
}

‎app/controlplane/internal/service/cascredential.go‎

Lines changed: 25 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ import (
2121
pb "github.com/chainloop-dev/chainloop/app/controlplane/api/controlplane/v1"
2222
"github.com/chainloop-dev/chainloop/app/controlplane/pkg/authz"
2323
errors "github.com/go-kratos/kratos/v2/errors"
24+
"github.com/google/uuid"
2425

2526
"github.com/chainloop-dev/chainloop/app/controlplane/pkg/biz"
2627
casJWT "github.com/chainloop-dev/chainloop/internal/robotaccount/cas"
@@ -83,23 +84,24 @@ func (s *CASCredentialsService) Get(ctx context.Context, req *pb.CASCredentialsS
8384
return nil, errors.Forbidden("forbidden", "not allowed to perform this operation")
8485
}
8586

86-
// Load the default CAS backend, we'll use it for uploads and as fallback on downloads
87-
backend, err := s.casBackendUC.FindDefaultBackend(ctx, currentOrg.ID)
88-
if err != nil && !biz.IsNotFound(err) {
89-
return nil, handleUseCaseErr(err, s.log)
90-
} else if backend == nil {
91-
return nil, errors.NotFound("not found", "main CAS backend not found")
92-
}
87+
var backend *biz.CASBackend
9388

9489
// Try to find the proper backend where the artifact is stored
9590
if role == casJWT.Downloader {
9691
var mapping *biz.CASMapping
92+
9793
// If we are logged in as a user, we'll try to find a mapping for that user
9894
if currentUser != nil {
9995
mapping, err = s.casMappingUC.FindCASMappingForDownloadByUser(ctx, req.Digest, currentUser.ID)
10096
// otherwise, we'll try to find a mapping for the current API token associated orgs
10197
} else if currentAPIToken != nil {
102-
mapping, err = s.casMappingUC.FindCASMappingForDownloadByOrg(ctx, req.Digest, []string{currentOrg.ID})
98+
var orgID uuid.UUID
99+
orgID, err = uuid.Parse(currentOrg.ID)
100+
if err != nil {
101+
return nil, handleUseCaseErr(err, s.log)
102+
}
103+
// TODO: pass projectIDs when RBAC for API tokens is supported
104+
mapping, err = s.casMappingUC.FindCASMappingForDownloadByOrg(ctx, req.Digest, []uuid.UUID{orgID}, nil)
103105
}
104106

105107
// If we can't find a mapping, we'll use the default backend
@@ -116,6 +118,21 @@ func (s *CASCredentialsService) Get(ctx context.Context, req *pb.CASCredentialsS
116118
}
117119
}
118120

121+
// If the backend was not found, use the default backend for the current org, only if the user is admin and RBAC doesn't apply.
122+
if backend == nil {
123+
if currentAuthzSubject == string(authz.RoleAdmin) || currentAuthzSubject == string(authz.RoleOwner) {
124+
// Load the default CAS backend, we'll use it for uploads and as fallback on downloads
125+
backend, err = s.casBackendUC.FindDefaultBackend(ctx, currentOrg.ID)
126+
if err != nil && !biz.IsNotFound(err) {
127+
return nil, handleUseCaseErr(err, s.log)
128+
} else if backend == nil {
129+
return nil, errors.NotFound("not found", "main CAS backend not found")
130+
}
131+
} else {
132+
return nil, errors.Forbidden("forbidden", "operation not allowed")
133+
}
134+
}
135+
119136
// inline backends don't have a download URL
120137
if backend.Inline {
121138
return nil, errors.BadRequest("invalid argument", "cannot upload or download artifacts from an inline CAS backend")

‎app/controlplane/internal/service/casredirect.go‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ import (
3030
casJWT "github.com/chainloop-dev/chainloop/internal/robotaccount/cas"
3131
kerrors "github.com/go-kratos/kratos/v2/errors"
3232
khttp "github.com/go-kratos/kratos/v2/transport/http"
33+
"github.com/google/uuid"
3334
)
3435

3536
const (
@@ -82,7 +83,12 @@ func (s *CASRedirectService) GetDownloadURL(ctx context.Context, req *pb.GetDown
8283
if currentUser != nil {
8384
mapping, err = s.casMappingUC.FindCASMappingForDownloadByUser(ctx, req.Digest, currentUser.ID)
8485
} else if currentAPIToken != nil {
85-
mapping, err = s.casMappingUC.FindCASMappingForDownloadByOrg(ctx, req.Digest, []string{currentOrg.ID})
86+
var orgID uuid.UUID
87+
orgID, err = uuid.Parse(currentOrg.ID)
88+
if err != nil {
89+
return nil, handleUseCaseErr(err, s.log)
90+
}
91+
mapping, err = s.casMappingUC.FindCASMappingForDownloadByOrg(ctx, req.Digest, []uuid.UUID{orgID}, nil)
8692
}
8793

8894
if err != nil {

‎app/controlplane/pkg/authz/authz.go‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -203,7 +203,6 @@ var rolesMap = map[Role][]*Policy{
203203
PolicyWorkflowRunRead,
204204

205205
PolicyArtifactDownload,
206-
PolicyArtifactUpload,
207206

208207
PolicyCASBackendList,
209208

‎app/controlplane/pkg/biz/casmapping.go‎

Lines changed: 59 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,10 @@ package biz
1818
import (
1919
"context"
2020
"fmt"
21+
"slices"
2122
"time"
2223

24+
"github.com/chainloop-dev/chainloop/app/controlplane/pkg/authz"
2325
"github.com/chainloop-dev/chainloop/pkg/attestation/renderer/chainloop"
2426
"github.com/chainloop-dev/chainloop/pkg/servicelogger"
2527
"github.com/go-kratos/kratos/v2/log"
@@ -34,59 +36,62 @@ type CASMapping struct {
3436
Digest string
3537
CreatedAt *time.Time
3638
// A public mapping means that the material/attestation can be downloaded by anyone
37-
Public bool
39+
Public bool
40+
ProjectID uuid.UUID
41+
}
42+
43+
type CASMappingFindOptions struct {
44+
Orgs []uuid.UUID
45+
ProjectIDs []uuid.UUID
3846
}
3947

4048
type CASMappingRepo interface {
4149
// Create a mapping with an optional workflow run id
42-
Create(ctx context.Context, digest string, casBackendID uuid.UUID, workflowRunID *uuid.UUID) (*CASMapping, error)
50+
Create(ctx context.Context, digest string, casBackendID uuid.UUID, opts *CASMappingCreateOpts) (*CASMapping, error)
4351
// List all the CAS mappings for the given digest
4452
FindByDigest(ctx context.Context, digest string) ([]*CASMapping, error)
4553
}
4654

4755
type CASMappingUseCase struct {
4856
repo CASMappingRepo
4957
membershipRepo MembershipRepo
58+
projectsRepo ProjectsRepo
5059
logger *log.Helper
5160
}
5261

53-
func NewCASMappingUseCase(repo CASMappingRepo, mRepo MembershipRepo, logger log.Logger) *CASMappingUseCase {
54-
return &CASMappingUseCase{repo, mRepo, servicelogger.ScopedHelper(logger, "cas-mapping-usecase")}
62+
func NewCASMappingUseCase(repo CASMappingRepo, mRepo MembershipRepo, pRepo ProjectsRepo, logger log.Logger) *CASMappingUseCase {
63+
return &CASMappingUseCase{repo, mRepo, pRepo, servicelogger.ScopedHelper(logger, "cas-mapping-usecase")}
64+
}
65+
66+
type CASMappingCreateOpts struct {
67+
WorkflowRunID *uuid.UUID
68+
ProjectID *uuid.UUID
5569
}
5670

5771
// Create a mapping with an optional workflow run id
58-
func (uc *CASMappingUseCase) Create(ctx context.Context, digest string, casBackendID string, workflowRunID string) (*CASMapping, error) {
72+
func (uc *CASMappingUseCase) Create(ctx context.Context, digest string, casBackendID string, opts *CASMappingCreateOpts) (*CASMapping, error) {
5973
casBackendUUID, err := uuid.Parse(casBackendID)
6074
if err != nil {
6175
return nil, NewErrInvalidUUID(err)
6276
}
6377

64-
var workflowRunUUID *uuid.UUID
65-
if workflowRunID != "" {
66-
runUUID, err := uuid.Parse(workflowRunID)
67-
if err != nil {
68-
return nil, NewErrInvalidUUID(err)
69-
}
70-
workflowRunUUID = &runUUID
71-
}
72-
7378
// parse the digest to make sure is a valid sha256 sum
7479
if _, err = cr_v1.NewHash(digest); err != nil {
7580
return nil, NewErrValidation(fmt.Errorf("invalid digest format: %w", err))
7681
}
7782

78-
return uc.repo.Create(ctx, digest, casBackendUUID, workflowRunUUID)
83+
return uc.repo.Create(ctx, digest, casBackendUUID, opts)
7984
}
8085

8186
func (uc *CASMappingUseCase) FindByDigest(ctx context.Context, digest string) ([]*CASMapping, error) {
8287
return uc.repo.FindByDigest(ctx, digest)
8388
}
8489

85-
// FindCASMappingForDownloadByUser returns the CASMapping appropriate for the given digest and user
86-
// This means, in order
87-
// 1 - Any mapping that points to an organization which the user is member of
88-
// 1.1 If there are multiple mappings, it will pick the default one or the first one
89-
// 2 - Any mapping that is public
90+
// FindCASMappingForDownloadByUser returns the CASMapping appropriate for the given digest and user.
91+
// This means, in order:
92+
// 1 - Any mapping that points to an organization which the user is member of.
93+
// 1.1 If there are multiple mappings, it will pick the default one or the first one.
94+
// 2 - Any mapping that is public.
9095
func (uc *CASMappingUseCase) FindCASMappingForDownloadByUser(ctx context.Context, digest string, userID string) (*CASMapping, error) {
9196
uc.logger.Infow("msg", "finding cas mapping for download", "digest", digest, "user", userID)
9297

@@ -95,26 +100,42 @@ func (uc *CASMappingUseCase) FindCASMappingForDownloadByUser(ctx context.Context
95100
return nil, NewErrInvalidUUID(err)
96101
}
97102

98-
// Load organizations for the given user
99-
memberships, err := uc.membershipRepo.FindByUser(ctx, userUUID)
103+
// Load ALL memberships for the given user
104+
memberships, err := uc.membershipRepo.ListAllByUser(ctx, userUUID)
100105
if err != nil {
101106
return nil, fmt.Errorf("failed to list memberships: %w", err)
102107
}
103108

104-
userOrgs := make([]string, 0, len(memberships))
109+
userOrgs := make([]uuid.UUID, 0)
110+
// This map holds the list of project IDs by org with RBAC active (user is org "member")
111+
projectIDs := make(map[uuid.UUID][]uuid.UUID)
105112
for _, m := range memberships {
106-
userOrgs = append(userOrgs, m.OrganizationID.String())
113+
if m.ResourceType == authz.ResourceTypeOrganization {
114+
userOrgs = append(userOrgs, m.ResourceID)
115+
// If the role in the org is member, we must enable RBAC for projects.
116+
if m.Role == authz.RoleOrgMember {
117+
// get list of projects in org, and match it with the memberships to build a filter
118+
orgProjects, err := getProjectsWithMembership(ctx, uc.projectsRepo, m.ResourceID, memberships)
119+
if err != nil {
120+
return nil, err
121+
}
122+
// note that appending an empty slice to a nil slice doesn't change it (it's still nil)
123+
projectIDs[m.ResourceID] = orgProjects
124+
}
125+
}
107126
}
108127

109-
mapping, err := uc.FindCASMappingForDownloadByOrg(ctx, digest, userOrgs)
128+
mapping, err := uc.FindCASMappingForDownloadByOrg(ctx, digest, userOrgs, projectIDs)
110129
if err != nil {
111130
return nil, fmt.Errorf("failed to find cas mapping for download: %w", err)
112131
}
113132

114133
return mapping, nil
115134
}
116135

117-
func (uc *CASMappingUseCase) FindCASMappingForDownloadByOrg(ctx context.Context, digest string, orgs []string) (result *CASMapping, err error) {
136+
// FindCASMappingForDownloadByOrg looks for the CAS mapping to download the referenced artifact in one of the passed organizations.
137+
// The result will get filtered out if RBAC is enabled (projectIDs is not Nil)
138+
func (uc *CASMappingUseCase) FindCASMappingForDownloadByOrg(ctx context.Context, digest string, orgs []uuid.UUID, projectIDs map[uuid.UUID][]uuid.UUID) (result *CASMapping, err error) {
118139
if _, err := cr_v1.NewHash(digest); err != nil {
119140
return nil, NewErrValidation(fmt.Errorf("invalid digest format: %w", err))
120141
}
@@ -143,8 +164,8 @@ func (uc *CASMappingUseCase) FindCASMappingForDownloadByOrg(ctx context.Context,
143164
return nil, NewErrNotFound("digest not found in any mapping")
144165
}
145166

146-
// 2 - CAS mappings associated with the given list of orgs
147-
orgMappings, err := filterByOrgs(mappings, orgs)
167+
// 2 - CAS mappings associated with the given list of orgs and project IDs
168+
orgMappings, err := filterByOrgs(mappings, orgs, projectIDs)
148169
if err != nil {
149170
return nil, fmt.Errorf("failed to load mappings associated to an user: %w", err)
150171
} else if len(orgMappings) > 0 {
@@ -163,14 +184,20 @@ func (uc *CASMappingUseCase) FindCASMappingForDownloadByOrg(ctx context.Context,
163184
return defaultOrFirst(publicMappings), nil
164185
}
165186

166-
// Extract only the mappings associated with a list of orgs
167-
func filterByOrgs(mappings []*CASMapping, orgs []string) ([]*CASMapping, error) {
187+
// Extract only the mappings associated with a list of orgs and optionally a list of projects
188+
func filterByOrgs(mappings []*CASMapping, orgs []uuid.UUID, projectIDs map[uuid.UUID][]uuid.UUID) ([]*CASMapping, error) {
168189
result := make([]*CASMapping, 0)
169190

170191
for _, mapping := range mappings {
171192
for _, o := range orgs {
172-
if mapping.OrgID.String() == o {
173-
result = append(result, mapping)
193+
if mapping.OrgID == o {
194+
if visibleProjects, ok := projectIDs[mapping.OrgID]; ok {
195+
if slices.Contains(visibleProjects, mapping.ProjectID) {
196+
result = append(result, mapping)
197+
}
198+
} else {
199+
result = append(result, mapping)
200+
}
174201
}
175202
}
176203
}

‎app/controlplane/pkg/biz/casmapping_integration_test.go‎

Lines changed: 18 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -48,15 +48,15 @@ func (s *casMappingIntegrationSuite) TestCASMappingForDownloadUser() {
4848
// 3. Digest: validDigest2, CASBackend: casBackend2, WorkflowRunID: workflowRun
4949
// 4. Digest: validDigest3, CASBackend: casBackend3, WorkflowRunID: workflowRun
5050
// 4. Digest: validDigestPublic, CASBackend: casBackend3, WorkflowRunID: workflowRunPublic
51-
_, err := s.CASMapping.Create(context.TODO(), validDigest, s.casBackend1.ID.String(), s.workflowRun.ID.String())
51+
_, err := s.CASMapping.Create(context.TODO(), validDigest, s.casBackend1.ID.String(), &biz.CASMappingCreateOpts{WorkflowRunID: &s.workflowRun.ID})
5252
require.NoError(s.T(), err)
53-
_, err = s.CASMapping.Create(context.TODO(), validDigest, s.casBackend2.ID.String(), s.workflowRun.ID.String())
53+
_, err = s.CASMapping.Create(context.TODO(), validDigest, s.casBackend2.ID.String(), &biz.CASMappingCreateOpts{WorkflowRunID: &s.workflowRun.ID})
5454
require.NoError(s.T(), err)
55-
_, err = s.CASMapping.Create(context.TODO(), validDigest2, s.casBackend2.ID.String(), s.workflowRun.ID.String())
55+
_, err = s.CASMapping.Create(context.TODO(), validDigest2, s.casBackend2.ID.String(), &biz.CASMappingCreateOpts{WorkflowRunID: &s.workflowRun.ID})
5656
require.NoError(s.T(), err)
57-
_, err = s.CASMapping.Create(context.TODO(), validDigest3, s.casBackend3.ID.String(), s.workflowRun.ID.String())
57+
_, err = s.CASMapping.Create(context.TODO(), validDigest3, s.casBackend3.ID.String(), &biz.CASMappingCreateOpts{WorkflowRunID: &s.workflowRun.ID})
5858
require.NoError(s.T(), err)
59-
_, err = s.CASMapping.Create(context.TODO(), validDigestPublic, s.casBackend3.ID.String(), s.publicWorkflowRun.ID.String())
59+
_, err = s.CASMapping.Create(context.TODO(), validDigestPublic, s.casBackend3.ID.String(), &biz.CASMappingCreateOpts{WorkflowRunID: &s.publicWorkflowRun.ID})
6060
require.NoError(s.T(), err)
6161

6262
// Since the userOrg1And2 is member of org1 and org2, she should be able to download
@@ -118,41 +118,41 @@ func (s *casMappingIntegrationSuite) TestCASMappingForDownloadUser() {
118118

119119
func (s *casMappingIntegrationSuite) TestCASMappingForDownloadByOrg() {
120120
ctx := context.Background()
121-
_, err := s.CASMapping.Create(ctx, validDigest, s.casBackend1.ID.String(), s.workflowRun.ID.String())
121+
_, err := s.CASMapping.Create(ctx, validDigest, s.casBackend1.ID.String(), &biz.CASMappingCreateOpts{WorkflowRunID: &s.workflowRun.ID})
122122
require.NoError(s.T(), err)
123-
_, err = s.CASMapping.Create(ctx, validDigestPublic, s.casBackend3.ID.String(), s.publicWorkflowRun.ID.String())
123+
_, err = s.CASMapping.Create(ctx, validDigestPublic, s.casBackend3.ID.String(), &biz.CASMappingCreateOpts{WorkflowRunID: &s.publicWorkflowRun.ID})
124124
require.NoError(s.T(), err)
125-
_, err = s.CASMapping.Create(ctx, validDigestWithoutRun, s.casBackend3.ID.String(), "")
125+
_, err = s.CASMapping.Create(ctx, validDigestWithoutRun, s.casBackend3.ID.String(), nil)
126126
require.NoError(s.T(), err)
127127

128128
// both validDigest and validDigest2 from two different orgs
129129
s.Run("validDigest is in org1", func() {
130-
mapping, err := s.CASMapping.FindCASMappingForDownloadByOrg(ctx, validDigest, []string{s.org1.ID})
130+
mapping, err := s.CASMapping.FindCASMappingForDownloadByOrg(ctx, validDigest, []uuid.UUID{uuid.MustParse(s.org1.ID)}, nil)
131131
s.NoError(err)
132132
s.NotNil(mapping)
133133
s.Equal(s.casBackend1.ID, mapping.CASBackend.ID)
134134
})
135135

136136
s.Run("validDigestPublic is available from any org", func() {
137-
mapping, err := s.CASMapping.FindCASMappingForDownloadByOrg(ctx, validDigestPublic, []string{uuid.NewString()})
137+
mapping, err := s.CASMapping.FindCASMappingForDownloadByOrg(ctx, validDigestPublic, []uuid.UUID{uuid.New()}, nil)
138138
s.NoError(err)
139139
s.NotNil(mapping)
140140
s.Equal(s.casBackend3.ID, mapping.CASBackend.ID)
141141
})
142142

143143
s.Run("validDigestWithoutRun is available only to org 3", func() {
144-
mapping, err := s.CASMapping.FindCASMappingForDownloadByOrg(ctx, validDigestWithoutRun, []string{s.casBackend3.OrganizationID.String()})
144+
mapping, err := s.CASMapping.FindCASMappingForDownloadByOrg(ctx, validDigestWithoutRun, []uuid.UUID{s.casBackend3.OrganizationID}, nil)
145145
s.NoError(err)
146146
s.NotNil(mapping)
147147
s.Equal(s.casBackend3.ID, mapping.CASBackend.ID)
148148

149-
mapping, err = s.CASMapping.FindCASMappingForDownloadByOrg(ctx, validDigestWithoutRun, []string{s.org1.ID})
149+
mapping, err = s.CASMapping.FindCASMappingForDownloadByOrg(ctx, validDigestWithoutRun, []uuid.UUID{uuid.MustParse(s.org1.ID)}, nil)
150150
s.Error(err)
151151
s.Nil(mapping)
152152
})
153153

154154
s.Run("can't find an invalid digest", func() {
155-
mapping, err := s.CASMapping.FindCASMappingForDownloadByOrg(ctx, invalidDigest, []string{s.org1.ID})
155+
mapping, err := s.CASMapping.FindCASMappingForDownloadByOrg(ctx, invalidDigest, []uuid.UUID{uuid.MustParse(s.org1.ID)}, nil)
156156
s.Error(err)
157157
s.Nil(mapping)
158158
})
@@ -163,13 +163,13 @@ func (s *casMappingIntegrationSuite) TestFindByDigest() {
163163
// 2. Digest: validDigest2, CASBackend: casBackend1, WorkflowRunID: workflowRun
164164
// 3. Digest: validDigest, CASBackend: casBackend2, WorkflowRunID: workflowRun
165165
// 4. Digest: validDigest, CASBackend: casBackend3, WorkflowRunID: publicWorkflowRun
166-
_, err := s.CASMapping.Create(context.TODO(), validDigest, s.casBackend1.ID.String(), s.workflowRun.ID.String())
166+
_, err := s.CASMapping.Create(context.TODO(), validDigest, s.casBackend1.ID.String(), &biz.CASMappingCreateOpts{WorkflowRunID: &s.workflowRun.ID})
167167
require.NoError(s.T(), err)
168-
_, err = s.CASMapping.Create(context.TODO(), validDigest2, s.casBackend1.ID.String(), s.workflowRun.ID.String())
168+
_, err = s.CASMapping.Create(context.TODO(), validDigest2, s.casBackend1.ID.String(), &biz.CASMappingCreateOpts{WorkflowRunID: &s.workflowRun.ID})
169169
require.NoError(s.T(), err)
170-
_, err = s.CASMapping.Create(context.TODO(), validDigest, s.casBackend2.ID.String(), s.workflowRun.ID.String())
170+
_, err = s.CASMapping.Create(context.TODO(), validDigest, s.casBackend2.ID.String(), &biz.CASMappingCreateOpts{WorkflowRunID: &s.workflowRun.ID})
171171
require.NoError(s.T(), err)
172-
_, err = s.CASMapping.Create(context.TODO(), validDigest, s.casBackend3.ID.String(), s.publicWorkflowRun.ID.String())
172+
_, err = s.CASMapping.Create(context.TODO(), validDigest, s.casBackend3.ID.String(), &biz.CASMappingCreateOpts{WorkflowRunID: &s.publicWorkflowRun.ID})
173173
require.NoError(s.T(), err)
174174

175175
testcases := []struct {
@@ -320,12 +320,7 @@ func (s *casMappingIntegrationSuite) TestCreate() {
320320
}
321321

322322
s.Run(tc.name, func() {
323-
var workflowRunID string
324-
if tc.workflowRunID != nil {
325-
workflowRunID = tc.workflowRunID.String()
326-
}
327-
328-
got, err := s.CASMapping.Create(context.TODO(), tc.digest, tc.casBackendID.String(), workflowRunID)
323+
got, err := s.CASMapping.Create(context.TODO(), tc.digest, tc.casBackendID.String(), &biz.CASMappingCreateOpts{WorkflowRunID: tc.workflowRunID})
329324
if tc.wantErr {
330325
s.Error(err)
331326
} else {

0 commit comments

Comments
 (0)