refactor(casbackend): tighten managed-CAS org plumbing per PR review

Follow-ups from the PR review on #3121:

* JWT OrgID claim is restored to backend.OrganizationID (instead of
  the authenticated caller's currentOrg). For cross-org downloads
  (FindCASMappingForDownloadByUser may return a backend from any org
  the caller belongs to) the JWT must address the AP that actually
  owns the data; authorization is enforced earlier by the mapping
  lookup. Inline comments at those call sites were dropped — the
  reasoning lives in this commit and the design doc.

* CASCredsOpts.OrgID is now uuid.UUID instead of string, matching
  every other org-id field in biz; the JWT boundary stringifies once
  and treats uuid.Nil as "no managed binding".

* The s3accesspoint-specific ctx-key helper moves up to the
  pkg/blobmanager umbrella as backend.WithRequestingOrg /
  backend.RequestingOrgFromContext. Generic primitive, not tied to
  any one provider, and reusable for future managed backends.

* Setting the requesting-org on ctx is now done by an auth-boundary
  middleware in app/artifact-cas/internal/server/auth.go
  (requestingOrgMiddleware for unary gRPC, jwtAuthFunc enrichment for
  stream gRPC, requestingOrgHTTPMiddleware for the download HTTP
  handler). The service layer no longer carries loadBackendForClaims;
  all four CAS service entry points are back to plain loadBackend.

Assisted-by: Claude Code
Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>

Chainloop-Trace-Sessions: 234a03ed-b238-4506-95f0-235242842db2

Author: jiparis

app/artifact-cas/internal/server/auth.go

@@ -0,0 +1,69 @@
+//
+// Copyright 2026 The Chainloop Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package server
+
+import (
+	"context"
+	nhttp "net/http"
+
+	"github.com/go-kratos/kratos/v2/middleware"
+	jwtMiddleware "github.com/go-kratos/kratos/v2/middleware/auth/jwt"
+
+	casJWT "github.com/chainloop-dev/chainloop/internal/robotaccount/cas"
+	backend "github.com/chainloop-dev/chainloop/pkg/blobmanager"
+)
+
+// withRequestingOrgFromClaims reads the CAS JWT claims (already
+// verified and stashed in ctx by the JWT middleware) and stamps the
+// org UUID on the context via backend.WithRequestingOrg. Managed CAS
+// providers consume this to scope per-tenant STS sessions; other
+// providers ignore it.
+//
+// A missing or empty OrgID is treated as "no managed binding" — ctx
+// passes through unchanged so legacy tokens minted before the org-id
+// claim was added continue to work for non-managed providers.
+func withRequestingOrgFromClaims(ctx context.Context) context.Context {
+	raw, ok := jwtMiddleware.FromContext(ctx)
+	if !ok {
+		return ctx
+	}
+	claims, ok := raw.(*casJWT.Claims)
+	if !ok || claims.OrgID == "" {
+		return ctx
+	}
+	return backend.WithRequestingOrg(ctx, claims.OrgID)
+}
+
+// requestingOrgMiddleware is a kratos middleware that runs after the
+// JWT middleware on unary gRPC requests and enriches ctx with the
+// requesting org from the verified claims.
+func requestingOrgMiddleware() middleware.Middleware {
+	return func(handler middleware.Handler) middleware.Handler {
+		return func(ctx context.Context, req any) (any, error) {
+			return handler(withRequestingOrgFromClaims(ctx), req)
+		}
+	}
+}
+
+// requestingOrgHTTPMiddleware wraps an HTTP handler so the request
+// context carries the requesting org. Apply it BETWEEN the JWT
+// middleware (which populates the claims in ctx) and the actual
+// handler.
+func requestingOrgHTTPMiddleware(next nhttp.Handler) nhttp.Handler {
+	return nhttp.HandlerFunc(func(w nhttp.ResponseWriter, r *nhttp.Request) {
+		next.ServeHTTP(w, r.WithContext(withRequestingOrgFromClaims(r.Context())))
+	})
+}

app/artifact-cas/internal/server/grpc.go

@@ -86,6 +86,11 @@ func NewGRPCServer(c *conf.Server, authConf *conf.Auth, byteService *service.Byt
 					loadPublicKey(rawKey),
 					jwtMiddleware.WithSigningMethod(casJWT.SigningMethod),
 					jwtMiddleware.WithClaims(func() jwt.Claims { return &casJWT.Claims{} })),
+				// Runs after the JWT middleware on authenticated unary
+				// RPCs; stamps the requesting-org UUID from the verified
+				// claims onto ctx so managed CAS providers can scope STS
+				// sessions per tenant.
+				requestingOrgMiddleware(),
 			).Match(requireAuthentication()).Build(),
 		),
 
@@ -183,7 +188,9 @@ func jwtAuthFunc(keyFunc jwt.Keyfunc, signingMethod jwt.SigningMethod) grpc_auth
 			return nil, err
 		}
 
-		return jwtMiddleware.NewContext(ctx, claims), nil
+		ctx = jwtMiddleware.NewContext(ctx, claims)
+		// Same enrichment the unary chain does via requestingOrgMiddleware.
+		return withRequestingOrgFromClaims(ctx), nil
 	}
 }
 

app/artifact-cas/internal/server/http.go

@@ -65,7 +65,11 @@ func NewHTTPServer(c *conf.Server, authConf *conf.Auth, downloadSvc *service.Dow
 
 	srv := http.NewServer(opts...)
 
-	downloadHandler := middlewares_http.AuthFromQueryParam(loadPublicKey(rawKey), claimsFunc(), casJWT.SigningMethod, downloadSvc)
+	// AuthFromQueryParam verifies the JWT and stashes the claims in
+	// ctx; requestingOrgHTTPMiddleware then promotes the org-id claim
+	// into a value consumable by managed CAS providers (mirrors the
+	// gRPC chains).
+	downloadHandler := middlewares_http.AuthFromQueryParam(loadPublicKey(rawKey), claimsFunc(), casJWT.SigningMethod, requestingOrgHTTPMiddleware(downloadSvc))
 	srv.Handle(service.DownloadPath, CORSMiddleware(c.GetHttp().GetCors().GetAllowOrigins(), downloadHandler))
 	api.RegisterStatusServiceHTTPServer(srv, service.NewStatusService(Version, providers))
 	return srv, nil

app/artifact-cas/internal/service/bytestream.go

@@ -80,7 +80,7 @@ func (s *ByteStreamService) Write(stream bytestream.ByteStream_WriteServer) erro
 		return kerrors.BadRequest("resource name", err.Error())
 	}
 
-	ctx, storageBackend, err := s.loadBackendForClaims(ctx, info)
+	storageBackend, err := s.loadBackend(ctx, info.BackendType, info.StoredSecretID)
 	if err != nil && kerrors.IsNotFound(err) {
 		return err
 	} else if err != nil {
@@ -161,7 +161,7 @@ func (s *ByteStreamService) Read(req *bytestream.ReadRequest, stream bytestream.
 		return kerrors.BadRequest("resource name", "empty resource name")
 	}
 
-	ctx, backend, err := s.loadBackendForClaims(ctx, info)
+	backend, err := s.loadBackend(ctx, info.BackendType, info.StoredSecretID)
 	if err != nil && kerrors.IsNotFound(err) {
 		return err
 	} else if err != nil {

app/artifact-cas/internal/service/download.go

@@ -76,7 +76,7 @@ func (s *DownloadService) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	ctx, b, err := s.loadBackendForClaims(ctx, auth)
+	b, err := s.loadBackend(ctx, auth.BackendType, auth.StoredSecretID)
 	if err != nil && kerrors.IsNotFound(err) {
 		http.Error(w, "backend not found", http.StatusNotFound)
 		return

app/artifact-cas/internal/service/resource.go

@@ -48,7 +48,7 @@ func (s *ResourceService) Describe(ctx context.Context, req *v1.ResourceServiceD
 		return nil, err
 	}
 
-	ctx, b, err := s.loadBackendForClaims(ctx, info)
+	b, err := s.loadBackend(ctx, info.BackendType, info.StoredSecretID)
 	if err != nil && errors.IsNotFound(err) {
 		return nil, err
 	} else if err != nil {

app/artifact-cas/internal/service/service.go

@@ -23,7 +23,6 @@ import (
 
 	casJWT "github.com/chainloop-dev/chainloop/internal/robotaccount/cas"
 	backend "github.com/chainloop-dev/chainloop/pkg/blobmanager"
-	"github.com/chainloop-dev/chainloop/pkg/blobmanager/s3accesspoint"
 	"github.com/chainloop-dev/chainloop/pkg/servicelogger"
 	kerrors "github.com/go-kratos/kratos/v2/errors"
 	"github.com/go-kratos/kratos/v2/log"
@@ -50,11 +49,10 @@ func (s *commonService) loadBackend(ctx context.Context, providerType, secretID
 
 	s.log.Infow("msg", "selected provider", "provider", providerType)
 
-	// Retrieve the backend from where to download the file. The context
-	// passed here is what the backend's STS-backed credentials provider
-	// will see; the caller is responsible for having enriched it with
-	// s3accesspoint.WithRequestingOrg when the request came in via an
-	// authenticated CAS JWT. See loadBackendForClaims.
+	// The requesting-org enrichment for managed CAS providers is done
+	// at the auth boundary (see server.requestingOrgMiddleware /
+	// requestingOrgHTTPMiddleware), so ctx already carries everything
+	// the backend needs.
 	backend, err := p.FromCredentials(ctx, secretID)
 	if err != nil {
 		return nil, fmt.Errorf("failed to retrieve backend: %w", err)
@@ -63,28 +61,6 @@ func (s *commonService) loadBackend(ctx context.Context, providerType, secretID
 	return backend, nil
 }
 
-// loadBackendForClaims is the request-scoped wrapper around loadBackend.
-// It pulls the requesting-org UUID out of the CAS JWT claims and stamps
-// it onto the context so providers that need per-tenant attribution
-// (currently AWS-S3-ACCESS-POINT) can mint correctly-scoped sessions.
-//
-// The OrgID claim is empty for legacy tokens minted before this PR; in
-// that case WithRequestingOrg sets an empty value and only managed
-// providers (which fail closed) will reject the request — every existing
-// provider ignores the key entirely, so non-managed flows stay unchanged.
-//
-// Returns the loaded backend together with the enriched context so the
-// caller can reuse it for the subsequent Upload/Download calls. Callers
-// MUST use the returned context, not the original one.
-func (s *commonService) loadBackendForClaims(ctx context.Context, claims *casJWT.Claims) (context.Context, backend.UploaderDownloader, error) {
-	ctx = s3accesspoint.WithRequestingOrg(ctx, claims.OrgID)
-	b, err := s.loadBackend(ctx, claims.BackendType, claims.StoredSecretID)
-	if err != nil {
-		return ctx, nil, err
-	}
-	return ctx, b, nil
-}
-
 type NewOpt func(s *commonService)
 
 func WithLogger(logger log.Logger) NewOpt {

app/controlplane/internal/service/attestation.go

@@ -494,13 +494,7 @@ func (s *AttestationService) GetUploadCreds(ctx context.Context, req *cpAPI.Atte
 	// Return the backend information and associated credentials (if applicable)
 	resp := &cpAPI.AttestationServiceGetUploadCredsResponse_Result{Backend: bizCASBackendToPb(backend)}
 	if backend.SecretName != "" {
-		// OrgID comes from the authenticated robot account (the caller),
-		// not the backend's owner. Even though GetByIDInOrgOrPublic above
-		// already scopes the lookup to robotAccount.OrgID, the security
-		// invariant for managed CAS requires the JWT org-id claim to
-		// originate from the caller's identity rather than the row we
-		// happened to resolve.
-		ref := &biz.CASCredsOpts{BackendType: string(backend.Provider), SecretPath: backend.SecretName, Role: casJWT.Uploader, MaxBytes: backend.Limits.MaxBytes, OrgID: robotAccount.OrgID}
+		ref := &biz.CASCredsOpts{BackendType: string(backend.Provider), SecretPath: backend.SecretName, Role: casJWT.Uploader, MaxBytes: backend.Limits.MaxBytes, OrgID: backend.OrganizationID}
 		t, err := s.casCredsUseCase.GenerateTemporaryCredentials(ref)
 		if err != nil {
 			return nil, handleUseCaseErr(err, s.log)

app/controlplane/internal/service/cascredential.go

@@ -149,12 +149,7 @@ func (s *CASCredentialsService) Get(ctx context.Context, req *pb.CASCredentialsS
 		return nil, errors.BadRequest("invalid argument", "cannot upload or download artifacts from an inline CAS backend")
 	}
 
-	// OrgID MUST come from the authenticated caller, not the resolved backend.
-	// For managed CAS the JWT's org-id claim drives the AssumeRole session
-	// name and AP-policy aws:userid match; pulling it from backend.OrganizationID
-	// would short-circuit that check against the very row a tampered secret
-	// could redirect.
-	ref := &biz.CASCredsOpts{BackendType: string(backend.Provider), SecretPath: backend.SecretName, Role: role, MaxBytes: backend.Limits.MaxBytes, OrgID: currentOrg.ID}
+	ref := &biz.CASCredsOpts{BackendType: string(backend.Provider), SecretPath: backend.SecretName, Role: role, MaxBytes: backend.Limits.MaxBytes, OrgID: backend.OrganizationID}
 	t, err := s.casUC.GenerateTemporaryCredentials(ref)
 	if err != nil {
 		return nil, handleUseCaseErr(err, s.log)

app/controlplane/internal/service/casredirect.go

@@ -126,12 +126,7 @@ func (s *CASRedirectService) GetDownloadURL(ctx context.Context, req *pb.GetDown
 
 	// 2- add authentication token to the query params ?t=[token]
 	if backend.SecretName != "" {
-		// OrgID comes from the authenticated caller (currentOrg from
-		// ctx), not the resolved backend. For managed CAS this is what
-		// keys the AssumeRole session name and the AP-policy aws:userid
-		// match; deriving it from backend.OrganizationID would weaken
-		// the cross-tenant guarantee.
-		ref := &biz.CASCredsOpts{BackendType: string(backend.Provider), SecretPath: backend.SecretName, Role: casJWT.Downloader, MaxBytes: backend.Limits.MaxBytes, OrgID: currentOrg.ID}
+		ref := &biz.CASCredsOpts{BackendType: string(backend.Provider), SecretPath: backend.SecretName, Role: casJWT.Downloader, MaxBytes: backend.Limits.MaxBytes, OrgID: backend.OrganizationID}
 		t, err := s.casCredsUseCase.GenerateTemporaryCredentials(ref)
 		if err != nil {
 			return nil, handleUseCaseErr(err, s.log)