Skip to content

Commit fe96b01

Browse files
migmartrimigmartri
authored
feat: allow upload/downloads using API token (#464)
Signed-off-by: Miguel Martinez Trivino <[email protected]>
1 parent ca231f1 commit fe96b01

File tree

13 files changed

+325
-81
lines changed

13 files changed

+325
-81
lines changed

‎app/controlplane/internal/biz/casmapping.go‎

Lines changed: 35 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -79,73 +79,85 @@ func (uc *CASMappingUseCase) FindByDigest(ctx context.Context, digest string) ([
7979
return uc.repo.FindByDigest(ctx, digest)
8080
}
8181

82-
// FindCASMappingForDownload returns the CASMapping appropriate for the given digest and user
82+
// FindCASMappingForDownloadByUser returns the CASMapping appropriate for the given digest and user
8383
// This means, in order
8484
// 1 - Any mapping that points to an organization which the user is member of
8585
// 1.1 If there are multiple mappings, it will pick the default one or the first one
8686
// 2 - Any mapping that is public
87-
func (uc *CASMappingUseCase) FindCASMappingForDownload(ctx context.Context, digest string, userID string) (*CASMapping, error) {
87+
func (uc *CASMappingUseCase) FindCASMappingForDownloadByUser(ctx context.Context, digest string, userID string) (*CASMapping, error) {
8888
uc.logger.Infow("msg", "finding cas mapping for download", "digest", digest, "user", userID)
8989

9090
userUUID, err := uuid.Parse(userID)
9191
if err != nil {
9292
return nil, NewErrInvalidUUID(err)
9393
}
9494

95-
if _, err = cr_v1.NewHash(digest); err != nil {
95+
// Load organizations for the given user
96+
memberships, err := uc.membershipRepo.FindByUser(ctx, userUUID)
97+
if err != nil {
98+
return nil, fmt.Errorf("failed to list memberships: %w", err)
99+
}
100+
101+
userOrgs := make([]string, 0, len(memberships))
102+
for _, m := range memberships {
103+
userOrgs = append(userOrgs, m.OrganizationID.String())
104+
}
105+
106+
return uc.FindCASMappingForDownloadByOrg(ctx, digest, userOrgs)
107+
}
108+
109+
func (uc *CASMappingUseCase) FindCASMappingForDownloadByOrg(ctx context.Context, digest string, orgs []string) (*CASMapping, error) {
110+
if _, err := cr_v1.NewHash(digest); err != nil {
96111
return nil, NewErrValidation(fmt.Errorf("invalid digest format: %w", err))
97112
}
98113

114+
if len(orgs) == 0 {
115+
return nil, NewErrValidationStr("no organizations provided")
116+
}
117+
99118
// 1 - All CAS mappings for the given digest
100119
mappings, err := uc.repo.FindByDigest(ctx, digest)
101120
if err != nil {
102121
return nil, fmt.Errorf("failed to list cas mappings: %w", err)
103122
}
104123

105-
uc.logger.Debugw("msg", fmt.Sprintf("found %d entries globally", len(mappings)), "digest", digest, "user", userID)
124+
uc.logger.Debugw("msg", fmt.Sprintf("found %d entries globally", len(mappings)), "digest", digest, "orgs", orgs)
106125
if len(mappings) == 0 {
107126
return nil, NewErrNotFound("digest not found in any mapping")
108127
}
109128

110-
// 2 - CAS mappings that the user has access to.
111-
// This means any mapping that points to an organization which the user is member of
112-
userMappings, err := filterByUser(ctx, mappings, userUUID, uc.membershipRepo)
129+
// 2 - CAS mappings associated with the given list of orgs
130+
orgMappings, err := filterByOrgs(mappings, orgs)
113131
if err != nil {
114132
return nil, fmt.Errorf("failed to load mappings associated to an user: %w", err)
115-
} else if len(userMappings) > 0 {
116-
result := defaultOrFirst(userMappings)
117-
uc.logger.Infow("msg", "mapping found!", "digest", digest, "user", userID, "casBackend", result.CASBackend.ID, "default", result.CASBackend.Default, "public", result.Public)
133+
} else if len(orgMappings) > 0 {
134+
result := defaultOrFirst(orgMappings)
135+
136+
uc.logger.Infow("msg", "mapping found!", "digest", digest, "orgs", orgs, "casBackend", result.CASBackend.ID, "default", result.CASBackend.Default, "public", result.Public)
118137
return result, nil
119138
}
120139

121140
// 3 - mappings that are public
122141
publicMappings := filterByPublic(mappings)
123142
// The user has not access to neither proprietary nor public mappings
124143
if len(publicMappings) == 0 {
125-
uc.logger.Warnw("msg", "digest exist but user does not have access to it", "digest", digest, "user", userID)
144+
uc.logger.Warnw("msg", "digest exist but user does not have access to it", "digest", digest, "orgs", orgs)
126145
return nil, NewErrUnauthorized(errors.New("unauthorized access to the artifact"))
127146
}
128147

129148
// Pick the appropriate mapping from multiple ones
130149
result := defaultOrFirst(publicMappings)
131-
uc.logger.Infow("msg", "mapping found!", "digest", digest, "user", userID, "casBackend", result.CASBackend.ID, "default", result.CASBackend.Default, "public", result.Public)
150+
uc.logger.Infow("msg", "mapping found!", "digest", digest, "orgs", orgs, "casBackend", result.CASBackend.ID, "default", result.CASBackend.Default, "public", result.Public)
132151
return result, nil
133152
}
134153

135-
// get the casMapping based on
136-
// 1 - the mapping is part of an organization an user has access to
137-
// 2 - if there is more than one, pick the default if possible
138-
func filterByUser(ctx context.Context, mappings []*CASMapping, userID uuid.UUID, mRepo MembershipRepo) ([]*CASMapping, error) {
154+
// Extract only the mappings associated with a list of orgs
155+
func filterByOrgs(mappings []*CASMapping, orgs []string) ([]*CASMapping, error) {
139156
result := make([]*CASMapping, 0)
140157

141-
memberships, err := mRepo.FindByUser(ctx, userID)
142-
if err != nil {
143-
return nil, fmt.Errorf("failed to list memberships: %w", err)
144-
}
145-
146158
for _, mapping := range mappings {
147-
for _, m := range memberships {
148-
if mapping.OrgID == m.OrganizationID {
159+
for _, o := range orgs {
160+
if mapping.OrgID.String() == o {
149161
result = append(result, mapping)
150162
}
151163
}

‎app/controlplane/internal/biz/casmapping_integration_test.go‎

Lines changed: 38 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ const (
3939
invalidDigest = "sha256:deadbeef"
4040
)
4141

42-
func (s *casMappingIntegrationSuite) TestCASMappingForDownload() {
42+
func (s *casMappingIntegrationSuite) TestCASMappingForDownloadUser() {
4343
// Let's create 3 CASMappings:
4444
// 1. Digest: validDigest, CASBackend: casBackend1, WorkflowRunID: workflowRun
4545
// 2. Digest: validDigest, CASBackend: casBackend2, WorkflowRunID: workflowRun
@@ -60,55 +60,84 @@ func (s *casMappingIntegrationSuite) TestCASMappingForDownload() {
6060
// Since the userOrg1And2 is member of org1 and org2, she should be able to download
6161
// both validDigest and validDigest2 from two different orgs
6262
s.Run("userOrg1And2 can download validDigest from org1", func() {
63-
mapping, err := s.CASMapping.FindCASMappingForDownload(context.TODO(), validDigest, s.userOrg1And2.ID)
63+
mapping, err := s.CASMapping.FindCASMappingForDownloadByUser(context.TODO(), validDigest, s.userOrg1And2.ID)
6464
s.NoError(err)
6565
s.NotNil(mapping)
6666
s.Equal(s.casBackend1.ID, mapping.CASBackend.ID)
6767
})
6868

6969
s.Run("userOrg1And2 can download validDigest2 from org2", func() {
70-
mapping, err := s.CASMapping.FindCASMappingForDownload(context.TODO(), validDigest2, s.userOrg1And2.ID)
70+
mapping, err := s.CASMapping.FindCASMappingForDownloadByUser(context.TODO(), validDigest2, s.userOrg1And2.ID)
7171
s.NoError(err)
7272
s.NotNil(mapping)
7373
s.Equal(s.casBackend2.ID, mapping.CASBackend.ID)
7474
})
7575

7676
s.Run("userOrg1And2 can not download validDigest3 from org3", func() {
77-
mapping, err := s.CASMapping.FindCASMappingForDownload(context.TODO(), validDigest3, s.userOrg1And2.ID)
77+
mapping, err := s.CASMapping.FindCASMappingForDownloadByUser(context.TODO(), validDigest3, s.userOrg1And2.ID)
7878
s.Error(err)
7979
s.Nil(mapping)
8080
})
8181

8282
s.Run("userOrg1And2 can download validDigestPublic from org3", func() {
83-
mapping, err := s.CASMapping.FindCASMappingForDownload(context.TODO(), validDigestPublic, s.userOrg1And2.ID)
83+
mapping, err := s.CASMapping.FindCASMappingForDownloadByUser(context.TODO(), validDigestPublic, s.userOrg1And2.ID)
8484
s.NoError(err)
8585
s.NotNil(mapping)
8686
s.Equal(s.casBackend3.ID, mapping.CASBackend.ID)
8787
})
8888

8989
s.Run("userOrg2 can download validDigest2 from org2", func() {
90-
mapping, err := s.CASMapping.FindCASMappingForDownload(context.TODO(), validDigest2, s.userOrg2.ID)
90+
mapping, err := s.CASMapping.FindCASMappingForDownloadByUser(context.TODO(), validDigest2, s.userOrg2.ID)
9191
s.NoError(err)
9292
s.NotNil(mapping)
9393
s.Equal(s.casBackend2.ID, mapping.CASBackend.ID)
9494
})
9595

9696
s.Run("userOrg2 can download validDigestPublic from org3", func() {
97-
mapping, err := s.CASMapping.FindCASMappingForDownload(context.TODO(), validDigestPublic, s.userOrg2.ID)
97+
mapping, err := s.CASMapping.FindCASMappingForDownloadByUser(context.TODO(), validDigestPublic, s.userOrg2.ID)
9898
s.NoError(err)
9999
s.NotNil(mapping)
100100
s.Equal(s.casBackend3.ID, mapping.CASBackend.ID)
101101
})
102102

103103
s.Run("userOrg2 can download validDigest from org2", func() {
104-
mapping, err := s.CASMapping.FindCASMappingForDownload(context.TODO(), validDigest, s.userOrg2.ID)
104+
mapping, err := s.CASMapping.FindCASMappingForDownloadByUser(context.TODO(), validDigest, s.userOrg2.ID)
105105
s.NoError(err)
106106
s.NotNil(mapping)
107107
s.Equal(s.casBackend2.ID, mapping.CASBackend.ID)
108108
})
109109

110110
s.Run("userOrg2 can not download invalidDigest", func() {
111-
mapping, err := s.CASMapping.FindCASMappingForDownload(context.TODO(), invalidDigest, s.userOrg2.ID)
111+
mapping, err := s.CASMapping.FindCASMappingForDownloadByUser(context.TODO(), invalidDigest, s.userOrg2.ID)
112+
s.Error(err)
113+
s.Nil(mapping)
114+
})
115+
}
116+
117+
func (s *casMappingIntegrationSuite) TestCASMappingForDownloadByOrg() {
118+
ctx := context.Background()
119+
_, err := s.CASMapping.Create(ctx, validDigest, s.casBackend1.ID.String(), s.workflowRun.ID.String())
120+
require.NoError(s.T(), err)
121+
_, err = s.CASMapping.Create(ctx, validDigestPublic, s.casBackend3.ID.String(), s.publicWorkflowRun.ID.String())
122+
require.NoError(s.T(), err)
123+
124+
// both validDigest and validDigest2 from two different orgs
125+
s.Run("validDigest is in org1", func() {
126+
mapping, err := s.CASMapping.FindCASMappingForDownloadByOrg(ctx, validDigest, []string{s.org1.ID})
127+
s.NoError(err)
128+
s.NotNil(mapping)
129+
s.Equal(s.casBackend1.ID, mapping.CASBackend.ID)
130+
})
131+
132+
s.Run("validDigestPublic is available from any org", func() {
133+
mapping, err := s.CASMapping.FindCASMappingForDownloadByOrg(ctx, validDigestPublic, []string{uuid.NewString()})
134+
s.NoError(err)
135+
s.NotNil(mapping)
136+
s.Equal(s.casBackend3.ID, mapping.CASBackend.ID)
137+
})
138+
139+
s.Run("can't find an invalid digest", func() {
140+
mapping, err := s.CASMapping.FindCASMappingForDownloadByOrg(ctx, invalidDigest, []string{s.org1.ID})
112141
s.Error(err)
113142
s.Nil(mapping)
114143
})

‎app/controlplane/internal/biz/referrer.go‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -144,10 +144,10 @@ func (s *ReferrerUseCase) ExtractAndPersist(ctx context.Context, att *dsse.Envel
144144
return nil
145145
}
146146

147-
// GetFromRoot returns the referrer identified by the provided content digest, including its first-level references
147+
// GetFromRootUser returns the referrer identified by the provided content digest, including its first-level references
148148
// For example if sha:deadbeef represents an attestation, the result will contain the attestation + materials associated to it
149149
// It only returns referrers that belong to organizations the user is member of
150-
func (s *ReferrerUseCase) GetFromRoot(ctx context.Context, digest, rootKind, userID string) (*StoredReferrer, error) {
150+
func (s *ReferrerUseCase) GetFromRootUser(ctx context.Context, digest, rootKind, userID string) (*StoredReferrer, error) {
151151
userUUID, err := uuid.Parse(userID)
152152
if err != nil {
153153
return nil, NewErrInvalidUUID(err)
@@ -166,6 +166,10 @@ func (s *ReferrerUseCase) GetFromRoot(ctx context.Context, digest, rootKind, use
166166
orgIDs = append(orgIDs, m.OrganizationID)
167167
}
168168

169+
return s.GetFromRoot(ctx, digest, rootKind, orgIDs)
170+
}
171+
172+
func (s *ReferrerUseCase) GetFromRoot(ctx context.Context, digest, rootKind string, orgIDs []uuid.UUID) (*StoredReferrer, error) {
169173
filters := make([]GetFromRootFilter, 0)
170174
if rootKind != "" {
171175
filters = append(filters, WithKind(rootKind))

‎app/controlplane/internal/biz/referrer_integration_test.go‎

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ func (s *referrerIntegrationTestSuite) TestGetFromRootInPublicSharedIndex() {
5353
s.T().Run("storing it associated with a private workflow keeps it private and not in the index", func(t *testing.T) {
5454
err = s.sharedEnabledUC.ExtractAndPersist(ctx, envelope, s.workflow1.ID.String())
5555
require.NoError(s.T(), err)
56-
ref, err := s.Referrer.GetFromRoot(ctx, wantReferrerAtt.Digest, "", s.user.ID)
56+
ref, err := s.Referrer.GetFromRootUser(ctx, wantReferrerAtt.Digest, "", s.user.ID)
5757
s.NoError(err)
5858
s.False(ref.InPublicWorkflow)
5959
res, err := s.sharedEnabledUC.GetFromRootInPublicSharedIndex(ctx, wantReferrerAtt.Digest, "")
@@ -69,7 +69,7 @@ func (s *referrerIntegrationTestSuite) TestGetFromRootInPublicSharedIndex() {
6969
err = s.sharedEnabledUC.ExtractAndPersist(ctx, envelope, s.workflow2.ID.String())
7070
require.NoError(s.T(), err)
7171
// It's marked as public in the internal index
72-
ref, err := s.sharedEnabledUC.GetFromRoot(ctx, wantReferrerAtt.Digest, "", s.user.ID)
72+
ref, err := s.sharedEnabledUC.GetFromRootUser(ctx, wantReferrerAtt.Digest, "", s.user.ID)
7373
s.NoError(err)
7474
s.True(ref.InPublicWorkflow)
7575

@@ -165,21 +165,21 @@ func (s *referrerIntegrationTestSuite) TestExtractAndPersists() {
165165
s.T().Run("it can store properly the first time", func(t *testing.T) {
166166
err := s.Referrer.ExtractAndPersist(ctx, envelope, s.workflow1.ID.String())
167167
s.NoError(err)
168-
prevStoredRef, err = s.Referrer.GetFromRoot(ctx, wantReferrerAtt.Digest, "", s.user.ID)
168+
prevStoredRef, err = s.Referrer.GetFromRootUser(ctx, wantReferrerAtt.Digest, "", s.user.ID)
169169
s.NoError(err)
170170
})
171171

172172
s.T().Run("and it's idempotent", func(t *testing.T) {
173173
err := s.Referrer.ExtractAndPersist(ctx, envelope, s.workflow1.ID.String())
174174
s.NoError(err)
175-
ref, err := s.Referrer.GetFromRoot(ctx, wantReferrerAtt.Digest, "", s.user.ID)
175+
ref, err := s.Referrer.GetFromRootUser(ctx, wantReferrerAtt.Digest, "", s.user.ID)
176176
s.NoError(err)
177177
// Check it's the same referrer than previously retrieved, including timestamps
178178
s.Equal(prevStoredRef, ref)
179179
})
180180

181181
s.T().Run("contains all the info", func(t *testing.T) {
182-
got, err := s.Referrer.GetFromRoot(ctx, wantReferrerAtt.Digest, "", s.user.ID)
182+
got, err := s.Referrer.GetFromRootUser(ctx, wantReferrerAtt.Digest, "", s.user.ID)
183183
s.NoError(err)
184184
// parent i.e attestation
185185
s.Equal(wantReferrerAtt.Digest, got.Digest)
@@ -198,22 +198,22 @@ func (s *referrerIntegrationTestSuite) TestExtractAndPersists() {
198198
})
199199

200200
s.T().Run("can get sha1 digests too", func(t *testing.T) {
201-
got, err := s.Referrer.GetFromRoot(ctx, wantReferrerCommit.Digest, "", s.user.ID)
201+
got, err := s.Referrer.GetFromRootUser(ctx, wantReferrerCommit.Digest, "", s.user.ID)
202202
s.NoError(err)
203203
s.Equal(wantReferrerCommit.Digest, got.Digest)
204204
})
205205

206206
s.T().Run("can't be accessed by a second user in another org", func(t *testing.T) {
207207
// the user2 has not access to org1
208-
got, err := s.Referrer.GetFromRoot(ctx, wantReferrerAtt.Digest, "", s.user2.ID)
208+
got, err := s.Referrer.GetFromRootUser(ctx, wantReferrerAtt.Digest, "", s.user2.ID)
209209
s.True(biz.IsNotFound(err))
210210
s.Nil(got)
211211
})
212212

213213
s.T().Run("but another workflow can be attached", func(t *testing.T) {
214214
err = s.Referrer.ExtractAndPersist(ctx, envelope, s.workflow2.ID.String())
215215
s.NoError(err)
216-
got, err := s.Referrer.GetFromRoot(ctx, wantReferrerAtt.Digest, "", s.user.ID)
216+
got, err := s.Referrer.GetFromRootUser(ctx, wantReferrerAtt.Digest, "", s.user.ID)
217217
s.NoError(err)
218218
require.Len(t, got.OrgIDs, 2)
219219
s.Contains(got.OrgIDs, s.org1UUID)
@@ -222,7 +222,7 @@ func (s *referrerIntegrationTestSuite) TestExtractAndPersists() {
222222
// and it's idempotent (no new orgs added)
223223
err = s.Referrer.ExtractAndPersist(ctx, envelope, s.workflow2.ID.String())
224224
s.NoError(err)
225-
got, err = s.Referrer.GetFromRoot(ctx, wantReferrerAtt.Digest, "", s.user.ID)
225+
got, err = s.Referrer.GetFromRootUser(ctx, wantReferrerAtt.Digest, "", s.user.ID)
226226
s.NoError(err)
227227
require.Len(t, got.OrgIDs, 2)
228228
s.Equal([]uuid.UUID{s.org1UUID, s.org2UUID}, got.OrgIDs)
@@ -232,13 +232,13 @@ func (s *referrerIntegrationTestSuite) TestExtractAndPersists() {
232232
s.T().Run("and now user2 has access to it since it has access to workflow2 in org2", func(t *testing.T) {
233233
err = s.Referrer.ExtractAndPersist(ctx, envelope, s.workflow2.ID.String())
234234
s.NoError(err)
235-
got, err := s.Referrer.GetFromRoot(ctx, wantReferrerAtt.Digest, "", s.user2.ID)
235+
got, err := s.Referrer.GetFromRootUser(ctx, wantReferrerAtt.Digest, "", s.user2.ID)
236236
s.NoError(err)
237237
require.Len(t, got.OrgIDs, 2)
238238
})
239239

240240
s.T().Run("you can ask for info about materials that are subjects", func(t *testing.T) {
241-
got, err := s.Referrer.GetFromRoot(ctx, wantReferrerContainerImage.Digest, "", s.user.ID)
241+
got, err := s.Referrer.GetFromRootUser(ctx, wantReferrerContainerImage.Digest, "", s.user.ID)
242242
s.NoError(err)
243243
// parent i.e attestation
244244
s.Equal(wantReferrerContainerImage.Digest, got.Digest)
@@ -252,7 +252,7 @@ func (s *referrerIntegrationTestSuite) TestExtractAndPersists() {
252252
})
253253

254254
s.T().Run("it might not have references", func(t *testing.T) {
255-
got, err := s.Referrer.GetFromRoot(ctx, wantReferrerSarif.Digest, "", s.user.ID)
255+
got, err := s.Referrer.GetFromRootUser(ctx, wantReferrerSarif.Digest, "", s.user.ID)
256256
s.NoError(err)
257257
// parent i.e attestation
258258
s.Equal(wantReferrerSarif.Digest, got.Digest)
@@ -262,7 +262,7 @@ func (s *referrerIntegrationTestSuite) TestExtractAndPersists() {
262262
})
263263

264264
s.T().Run("or it does not exist", func(t *testing.T) {
265-
got, err := s.Referrer.GetFromRoot(ctx, "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "", s.user.ID)
265+
got, err := s.Referrer.GetFromRootUser(ctx, "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "", s.user.ID)
266266
s.True(biz.IsNotFound(err))
267267
s.Nil(got)
268268
})
@@ -287,20 +287,20 @@ func (s *referrerIntegrationTestSuite) TestExtractAndPersists() {
287287
s.NoError(err)
288288

289289
// but retrieval should fail. In the future we will ask the user to provide the artifact type in these cases of ambiguity
290-
got, err := s.Referrer.GetFromRoot(ctx, wantReferrerSarif.Digest, "", s.user.ID)
290+
got, err := s.Referrer.GetFromRootUser(ctx, wantReferrerSarif.Digest, "", s.user.ID)
291291
s.Nil(got)
292292
s.ErrorContains(err, "present in 2 kinds")
293293
})
294294

295295
s.T().Run("it should not fail on retrieval if we filter out by one kind", func(t *testing.T) {
296296
// but retrieval should fail. In the future we will ask the user to provide the artifact type in these cases of ambiguity
297-
got, err := s.Referrer.GetFromRoot(ctx, wantReferrerSarif.Digest, "SARIF", s.user.ID)
297+
got, err := s.Referrer.GetFromRootUser(ctx, wantReferrerSarif.Digest, "SARIF", s.user.ID)
298298
s.NoError(err)
299299
s.Equal(wantReferrerSarif.Digest, got.Digest)
300300
s.Equal(true, got.Downloadable)
301301
s.Equal("SARIF", got.Kind)
302302

303-
got, err = s.Referrer.GetFromRoot(ctx, wantReferrerSarif.Digest, "ARTIFACT", s.user.ID)
303+
got, err = s.Referrer.GetFromRootUser(ctx, wantReferrerSarif.Digest, "ARTIFACT", s.user.ID)
304304
s.NoError(err)
305305
s.Equal(wantReferrerSarif.Digest, got.Digest)
306306
s.Equal(true, got.Downloadable)
@@ -309,7 +309,7 @@ func (s *referrerIntegrationTestSuite) TestExtractAndPersists() {
309309

310310
s.T().Run("now there should a container image pointing to two attestations", func(t *testing.T) {
311311
// but retrieval should fail. In the future we will ask the user to provide the artifact type in these cases of ambiguity
312-
got, err := s.Referrer.GetFromRoot(ctx, wantReferrerContainerImage.Digest, "", s.user.ID)
312+
got, err := s.Referrer.GetFromRootUser(ctx, wantReferrerContainerImage.Digest, "", s.user.ID)
313313
s.NoError(err)
314314
// it should be referenced by two attestations since it's subject of both
315315
require.Len(t, got.References, 2)
@@ -320,7 +320,7 @@ func (s *referrerIntegrationTestSuite) TestExtractAndPersists() {
320320
})
321321

322322
s.T().Run("if all associated workflows are private, the referrer is private", func(t *testing.T) {
323-
got, err := s.Referrer.GetFromRoot(ctx, wantReferrerAtt.Digest, "", s.user.ID)
323+
got, err := s.Referrer.GetFromRootUser(ctx, wantReferrerAtt.Digest, "", s.user.ID)
324324
s.NoError(err)
325325
s.False(got.InPublicWorkflow)
326326
s.Equal([]uuid.UUID{s.workflow1.ID, s.workflow2.ID}, got.WorkflowIDs)
@@ -334,7 +334,7 @@ func (s *referrerIntegrationTestSuite) TestExtractAndPersists() {
334334
_, err := s.Workflow.Update(ctx, s.org1.ID, s.workflow1.ID.String(), &biz.WorkflowUpdateOpts{Public: toPtrBool(true)})
335335
require.NoError(t, err)
336336

337-
got, err := s.Referrer.GetFromRoot(ctx, wantReferrerAtt.Digest, "", s.user.ID)
337+
got, err := s.Referrer.GetFromRootUser(ctx, wantReferrerAtt.Digest, "", s.user.ID)
338338
s.NoError(err)
339339
s.True(got.InPublicWorkflow)
340340
for _, r := range got.References {

0 commit comments

Comments
 (0)