feat(organization): add suspension support

Signed-off-by: Sylwester Piskozub <sylwesterpiskozub@gmail.com>

Author: Piskoo

app/controlplane/internal/server/grpc.go

@@ -211,6 +211,8 @@ func craftMiddleware(opts *Opts) []middleware.Middleware {
 			selector.Server(
 				// 2.d- Set its organization
 				usercontext.WithCurrentOrganizationMiddleware(opts.UserUseCase, opts.OrganizationUseCase, logHelper),
+				// 2.e- Block write operations on suspended orgs
+				usercontext.WithSuspensionMiddleware(),
 				// 3 - Check user/token authorization
 				authzMiddleware.WithAuthzMiddleware(opts.AuthzUseCase, logHelper),
 			).Match(requireAllButOrganizationOperationsMatcher()).Build(),
@@ -251,6 +253,8 @@ func craftMiddleware(opts *Opts) []middleware.Middleware {
 			usercontext.WithAttestationContextFromFederatedInfo(opts.OrganizationUseCase, logHelper),
 			// Store all memberships in the context
 			usercontext.WithCurrentMembershipsMiddleware(opts.MembershipUseCase, opts.MembershipsCache),
+			// 2.e - Block write operations on suspended orgs
+			usercontext.WithSuspensionMiddleware(),
 			// 3 - Update API Token last usage
 			usercontext.WithAPITokenUsageUpdater(opts.APITokenUseCase, logHelper),
 			// 4 - Validate the CAS Backend is fully configured and valid

app/controlplane/internal/usercontext/apitoken_middleware.go

@@ -200,7 +200,7 @@ func setCurrentOrgAndAPIToken(ctx context.Context, apiTokenUC *biz.APITokenUseCa
 				return nil, errors.New("organization not found")
 			}
 
-			ctx = entities.WithCurrentOrg(ctx, &entities.Org{Name: org.Name, ID: org.ID, CreatedAt: org.CreatedAt})
+			ctx = entities.WithCurrentOrg(ctx, &entities.Org{Name: org.Name, ID: org.ID, CreatedAt: org.CreatedAt, Suspended: org.Suspended})
 		}
 		// If no org header, org context remains unset, operations will either:
 		// 1. Work without org context
@@ -214,7 +214,7 @@ func setCurrentOrgAndAPIToken(ctx context.Context, apiTokenUC *biz.APITokenUseCa
 		}
 
 		// Set the current organization in the context
-		ctx = entities.WithCurrentOrg(ctx, &entities.Org{Name: org.Name, ID: org.ID, CreatedAt: org.CreatedAt})
+		ctx = entities.WithCurrentOrg(ctx, &entities.Org{Name: org.Name, ID: org.ID, CreatedAt: org.CreatedAt, Suspended: org.Suspended})
 	}
 
 	ctx = entities.WithCurrentAPIToken(ctx, &entities.APIToken{

app/controlplane/internal/usercontext/currentorganization_middleware.go

@@ -156,7 +156,7 @@ func setCurrentMembershipFromOrgName(ctx context.Context, user *entities.User, o
 		role = authz.RoleInstanceAdmin
 	} else {
 		role = membership.Role
-		ctx = entities.WithCurrentOrg(ctx, &entities.Org{Name: membership.Org.Name, ID: membership.Org.ID, CreatedAt: membership.CreatedAt})
+		ctx = entities.WithCurrentOrg(ctx, &entities.Org{Name: membership.Org.Name, ID: membership.Org.ID, CreatedAt: membership.CreatedAt, Suspended: membership.Org.Suspended})
 	}
 
 	// Set the authorization subject that will be used to check the policies
@@ -175,7 +175,7 @@ func setMembershipIfInstanceAdmin(ctx context.Context, orgName string, orgUC *bi
 			if err != nil {
 				return nil, fmt.Errorf("failed to find organization: %w", err)
 			}
-			ctx = entities.WithCurrentOrg(ctx, &entities.Org{Name: org.Name, ID: org.ID, CreatedAt: org.CreatedAt})
+			ctx = entities.WithCurrentOrg(ctx, &entities.Org{Name: org.Name, ID: org.ID, CreatedAt: org.CreatedAt, Suspended: org.Suspended})
 		}
 	} else {
 		// if no membership and no instance admin, return error
@@ -202,7 +202,7 @@ func setCurrentOrganizationFromDB(ctx context.Context, user *entities.User, user
 		return nil, errors.New("org not found")
 	}
 
-	ctx = entities.WithCurrentOrg(ctx, &entities.Org{Name: membership.Org.Name, ID: membership.Org.ID, CreatedAt: membership.CreatedAt})
+	ctx = entities.WithCurrentOrg(ctx, &entities.Org{Name: membership.Org.Name, ID: membership.Org.ID, CreatedAt: membership.CreatedAt, Suspended: membership.Org.Suspended})
 
 	// Set the authorization subject that will be used to check the policies
 	ctx = WithAuthzSubject(ctx, string(membership.Role))

app/controlplane/internal/usercontext/entities/organization.go

@@ -23,6 +23,7 @@ import (
 type Org struct {
 	ID, Name  string
 	CreatedAt *time.Time
+	Suspended bool
 }
 
 func WithCurrentOrg(ctx context.Context, org *Org) context.Context {

app/controlplane/internal/usercontext/federated_middleware.go

@@ -61,7 +61,7 @@ func WithAttestationContextFromFederatedInfo(orgUC *biz.OrganizationUseCase, log
 			}
 
 			// Set the current organization and API-Token in the context
-			ctx = entities.WithCurrentOrg(ctx, &entities.Org{Name: org.Name, ID: org.ID, CreatedAt: org.CreatedAt})
+			ctx = entities.WithCurrentOrg(ctx, &entities.Org{Name: org.Name, ID: org.ID, CreatedAt: org.CreatedAt, Suspended: org.Suspended})
 			logger.Infow("msg", "[authN] processed credentials", "type", "Federated delegation")
 
 			return handler(ctx, req)

app/controlplane/internal/usercontext/robotaccount_middleware.go

@@ -111,7 +111,7 @@ func WithAttestationContextFromRobotAccount(robotAccountUseCase *biz.RobotAccoun
 				return nil, fmt.Errorf("error retrieving the organization: %w", err)
 			}
 
-			ctx = entities.WithCurrentOrg(ctx, &entities.Org{Name: org.Name, ID: org.ID, CreatedAt: org.CreatedAt})
+			ctx = entities.WithCurrentOrg(ctx, &entities.Org{Name: org.Name, ID: org.ID, CreatedAt: org.CreatedAt, Suspended: org.Suspended})
 
 			// Check that the encoded workflow ID is the one associated with the robot account
 			// NOTE: This in theory should not be necessary since currently we allow a robot account to be attached to ONLY ONE workflowID

app/controlplane/internal/usercontext/suspension_middleware.go

@@ -0,0 +1,85 @@
+package usercontext
+
+import (
+	"context"
+	"regexp"
+
+	"github.com/chainloop-dev/chainloop/app/controlplane/internal/usercontext/entities"
+	"github.com/chainloop-dev/chainloop/app/controlplane/pkg/authz"
+	errorsAPI "github.com/go-kratos/kratos/v2/errors"
+	"github.com/go-kratos/kratos/v2/middleware"
+	"github.com/go-kratos/kratos/v2/transport"
+)
+
+// readOnlyActions are policy actions considered safe during suspension.
+var readOnlyActions = map[string]bool{
+	authz.ActionRead: true,
+	authz.ActionList: true,
+}
+
+// suspensionExemptRegexp matches operations that are allowed when suspended even though
+// they cannot be classified as read-only via ServerOperationsMap policies.
+// This covers two cases:
+//   - Empty-policy reads: operations mapped with {} in ServerOperationsMap that are actually reads
+//   - Self-service writes: operations the user needs to leave/delete even when suspended
+var suspensionExemptRegexp = regexp.MustCompile(`controlplane.v1.CASCredentialsService/Get|controlplane.v1.UserService/(ListMemberships|SetCurrentMembership|DeleteMembership)|controlplane.v1.GroupService/(List|Get|ListMembers|ListProjects|ListPendingInvitations)|controlplane.v1.AuthService/DeleteAccount|controlplane.v1.OrganizationService/Delete$`)
+
+// WithSuspensionMiddleware blocks write operations when the current organization is suspended.
+//
+// Classification logic:
+//  1. If the operation has policies in ServerOperationsMap with only read/list actions -> allow
+//  2. If the operation matches suspensionExemptRegexp -> allow
+//  3. Everything else (writes, empty policies, unmapped operations) -> block
+func WithSuspensionMiddleware() middleware.Middleware {
+	return func(handler middleware.Handler) middleware.Handler {
+		return func(ctx context.Context, req interface{}) (interface{}, error) {
+			org := entities.CurrentOrg(ctx)
+			// No org context (e.g., user info, status endpoints), pass through
+			if org == nil {
+				return handler(ctx, req)
+			}
+
+			if !org.Suspended {
+				return handler(ctx, req)
+			}
+
+			// Org is suspended, determine if the operation is read-only
+			t, ok := transport.FromServerContext(ctx)
+			if !ok {
+				return nil, suspendedError()
+			}
+
+			apiOperation := t.Operation()
+
+			// Check exemptions first
+			if suspensionExemptRegexp.MatchString(apiOperation) {
+				return handler(ctx, req)
+			}
+
+			// Look up policies in ServerOperationsMap
+			policies, err := authz.PoliciesLookup(apiOperation)
+			if err != nil {
+				// Operation not in ServerOperationsMap, block by default
+				return nil, suspendedError()
+			}
+
+			// Empty policies, no action metadata to classify as read-only, block
+			if len(policies) == 0 {
+				return nil, suspendedError()
+			}
+
+			// Allow only if ALL policy actions are read-only
+			for _, p := range policies {
+				if !readOnlyActions[p.Action] {
+					return nil, suspendedError()
+				}
+			}
+
+			return handler(ctx, req)
+		}
+	}
+}
+
+func suspendedError() error {
+	return errorsAPI.Forbidden("suspended", "organization is suspended, read-only access only")
+}

app/controlplane/internal/usercontext/suspension_middleware_test.go

@@ -0,0 +1,218 @@
+package usercontext
+
+import (
+	"context"
+	"testing"
+
+	"github.com/chainloop-dev/chainloop/app/controlplane/internal/usercontext/entities"
+	"github.com/go-kratos/kratos/v2/transport"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type suspensionMockTransport struct {
+	operation string
+}
+
+func (tr *suspensionMockTransport) Kind() transport.Kind            { return transport.KindGRPC }
+func (tr *suspensionMockTransport) Endpoint() string                { return "" }
+func (tr *suspensionMockTransport) Operation() string               { return tr.operation }
+func (tr *suspensionMockTransport) RequestHeader() transport.Header { return nil }
+func (tr *suspensionMockTransport) ReplyHeader() transport.Header   { return nil }
+
+var passHandler = func(_ context.Context, _ interface{}) (interface{}, error) { return "ok", nil }
+
+func TestWithSuspensionMiddleware(t *testing.T) {
+	suspendedOrg := &entities.Org{ID: "org-1", Name: "test", Suspended: true}
+	activeOrg := &entities.Org{ID: "org-1", Name: "test", Suspended: false}
+
+	tests := []struct {
+		name      string
+		org       *entities.Org
+		operation string
+		wantErr   bool
+		wantMsg   string
+	}{
+		{
+			name:    "no org context passes through",
+			org:     nil,
+			wantErr: false,
+		},
+		{
+			name:      "non-suspended org passes through",
+			org:       activeOrg,
+			operation: "/controlplane.v1.WorkflowService/Create",
+			wantErr:   false,
+		},
+		{
+			name:      "suspended org allows read operation",
+			org:       suspendedOrg,
+			operation: "/controlplane.v1.ReferrerService/DiscoverPrivate",
+			wantErr:   false,
+		},
+		{
+			name:      "suspended org allows list operation",
+			org:       suspendedOrg,
+			operation: "/controlplane.v1.WorkflowService/List",
+			wantErr:   false,
+		},
+		{
+			name:      "suspended org allows read policy operation",
+			org:       suspendedOrg,
+			operation: "/controlplane.v1.ContextService/Current",
+			wantErr:   false,
+		},
+		{
+			name:      "suspended org allows exempt empty-policy read",
+			org:       suspendedOrg,
+			operation: "/controlplane.v1.CASCredentialsService/Get",
+			wantErr:   false,
+		},
+		{
+			name:      "suspended org allows exempt navigation operation",
+			org:       suspendedOrg,
+			operation: "/controlplane.v1.UserService/ListMemberships",
+			wantErr:   false,
+		},
+		{
+			name:      "suspended org allows exempt group read",
+			org:       suspendedOrg,
+			operation: "/controlplane.v1.GroupService/ListMembers",
+			wantErr:   false,
+		},
+		{
+			name:      "suspended org allows self-service org delete",
+			org:       suspendedOrg,
+			operation: "/controlplane.v1.OrganizationService/Delete",
+			wantErr:   false,
+		},
+		{
+			name:      "suspended org allows self-service leave org",
+			org:       suspendedOrg,
+			operation: "/controlplane.v1.UserService/DeleteMembership",
+			wantErr:   false,
+		},
+		{
+			name:      "suspended org allows self-service delete account",
+			org:       suspendedOrg,
+			operation: "/controlplane.v1.AuthService/DeleteAccount",
+			wantErr:   false,
+		},
+		{
+			name:      "suspended org blocks empty-policy write",
+			org:       suspendedOrg,
+			operation: "/controlplane.v1.GroupService/AddMember",
+			wantErr:   true,
+			wantMsg:   "suspended",
+		},
+		{
+			name:      "suspended org blocks another empty-policy write",
+			org:       suspendedOrg,
+			operation: "/controlplane.v1.GroupService/RemoveMember",
+			wantErr:   true,
+			wantMsg:   "suspended",
+		},
+		{
+			name:      "suspended org blocks empty-policy org create",
+			org:       suspendedOrg,
+			operation: "/controlplane.v1.OrganizationService/Create",
+			wantErr:   true,
+			wantMsg:   "suspended",
+		},
+		{
+			name:      "suspended org blocks unmapped write",
+			org:       suspendedOrg,
+			operation: "/controlplane.v1.CASBackendService/Update",
+			wantErr:   true,
+			wantMsg:   "suspended",
+		},
+		{
+			name:      "suspended org blocks another unmapped write",
+			org:       suspendedOrg,
+			operation: "/controlplane.v1.OrgInvitationService/Revoke",
+			wantErr:   true,
+			wantMsg:   "suspended",
+		},
+		{
+			name:      "suspended org blocks attestation write",
+			org:       suspendedOrg,
+			operation: "/controlplane.v1.AttestationService/Init",
+			wantErr:   true,
+			wantMsg:   "suspended",
+		},
+		{
+			name:      "suspended org blocks attestation state write",
+			org:       suspendedOrg,
+			operation: "/controlplane.v1.AttestationStateService/Save",
+			wantErr:   true,
+			wantMsg:   "suspended",
+		},
+		{
+			name:      "suspended org blocks signing write",
+			org:       suspendedOrg,
+			operation: "/controlplane.v1.SigningService/GenerateSigningCert",
+			wantErr:   true,
+			wantMsg:   "suspended",
+		},
+		{
+			name:      "suspended org blocks mapped write policy",
+			org:       suspendedOrg,
+			operation: "/controlplane.v1.WorkflowService/Create",
+			wantErr:   true,
+			wantMsg:   "suspended",
+		},
+		{
+			name:      "suspended org blocks mapped update policy",
+			org:       suspendedOrg,
+			operation: "/controlplane.v1.CASBackendService/Revalidate",
+			wantErr:   true,
+			wantMsg:   "suspended",
+		},
+		{
+			name:      "suspended org blocks OrganizationService/DeleteMembership despite Delete being exempt",
+			org:       suspendedOrg,
+			operation: "/controlplane.v1.OrganizationService/DeleteMembership",
+			wantErr:   true,
+			wantMsg:   "suspended",
+		},
+		{
+			name:      "suspended org blocks unknown future endpoint",
+			org:       suspendedOrg,
+			operation: "/controlplane.v1.NewService/SomeWrite",
+			wantErr:   true,
+			wantMsg:   "suspended",
+		},
+		{
+			name:    "suspended org with no transport context is blocked",
+			org:     suspendedOrg,
+			wantErr: true,
+			wantMsg: "suspended",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := context.Background()
+
+			if tt.org != nil {
+				ctx = entities.WithCurrentOrg(ctx, tt.org)
+			}
+
+			if tt.operation != "" {
+				ctx = transport.NewServerContext(ctx, &suspensionMockTransport{operation: tt.operation})
+			}
+
+			m := WithSuspensionMiddleware()
+			result, err := m(passHandler)(ctx, nil)
+
+			if tt.wantErr {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), tt.wantMsg)
+				assert.Nil(t, result)
+			} else {
+				require.NoError(t, err)
+				assert.Equal(t, "ok", result)
+			}
+		})
+	}
+}