feat(policies): GetPolicy endpoint to resolve remote policies (#1219)

Signed-off-by: Jose I. Paris <[email protected]>

Author: jiparis

app/controlplane/api/controlplane/v1/workflow_run.pb.go

@@ -33,6 +33,9 @@ service AttestationService {
   // This one is kept since it leverages robot-accounts in the context of a workflow
   rpc GetUploadCreds(AttestationServiceGetUploadCredsRequest) returns (AttestationServiceGetUploadCredsResponse);
   rpc Cancel(AttestationServiceCancelRequest) returns (AttestationServiceCancelResponse);
+
+  // Get policies from remote providers
+  rpc GetPolicy(AttestationServiceGetPolicyRequest) returns (AttestationServiceGetPolicyResponse);
 }
 
 // Administrative service for the operator
@@ -41,6 +44,18 @@ service WorkflowRunService {
   rpc View(WorkflowRunServiceViewRequest) returns (WorkflowRunServiceViewResponse);
 }
 
+message AttestationServiceGetPolicyRequest {
+  // Provider name. If not set, the default provider will be used
+  string provider = 1;
+
+  // Policy name (it must exist in the provider)
+  string policy_name = 2 [(buf.validate.field).string.min_len = 1];
+}
+
+message AttestationServiceGetPolicyResponse {
+  workflowcontract.v1.Policy policy = 1;
+}
+
 message AttestationServiceGetContractRequest {
   int32 contract_revision = 1;
   // This parameter is not needed by Robot Account since they have the workflowID embedded.

app/controlplane/api/controlplane/v1/workflow_run.proto

@@ -23,6 +23,7 @@ package main
 import (
 	conf "github.com/chainloop-dev/chainloop/app/controlplane/internal/conf/controlplane/config/v1"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/dispatcher"
+	"github.com/chainloop-dev/chainloop/app/controlplane/internal/policies"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/server"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/service"
 	"github.com/chainloop-dev/chainloop/app/controlplane/pkg/authz"
@@ -48,10 +49,11 @@ func wireApp(*conf.Bootstrap, credentials.ReaderWriter, log.Logger, sdk.Availabl
 			wire.Bind(new(biz.CASClient), new(*biz.CASClientUseCase)),
 			serviceOpts,
 			wire.Value([]biz.CASClientOpts{}),
-			wire.FieldsOf(new(*conf.Bootstrap), "Server", "Auth", "Data", "CasServer", "ReferrerSharedIndex", "Onboarding", "PrometheusIntegration"),
+			wire.FieldsOf(new(*conf.Bootstrap), "Server", "Auth", "Data", "CasServer", "ReferrerSharedIndex", "Onboarding", "PrometheusIntegration", "PolicyProviders"),
 			wire.FieldsOf(new(*conf.Data), "Database"),
 			dispatcher.New,
 			authz.NewDatabaseEnforcer,
+			policies.NewRegistry,
 			newApp,
 			newProtoValidator,
 			newDataConf,