prevent default contract creation as well

Signed-off-by: Sylwester Piskozub <sylwesterpiskozub@gmail.com>

Author: Piskoo

app/controlplane/cmd/wire_gen.go

@@ -59,6 +59,7 @@ type AttestationService struct {
 	projectVersionUseCase   *biz.ProjectVersionUseCase
 	projectUseCase          *biz.ProjectUseCase
 	signingUseCase          *biz.SigningUseCase
+	userUseCase             *biz.UserUseCase
 }
 
 type NewAttestationServiceOpts struct {
@@ -78,6 +79,7 @@ type NewAttestationServiceOpts struct {
 	ProjectUC          *biz.ProjectUseCase
 	ProjectVersionUC   *biz.ProjectVersionUseCase
 	SigningUseCase     *biz.SigningUseCase
+	UserUC             *biz.UserUseCase
 	Opts               []NewOpt
 }
 
@@ -100,6 +102,7 @@ func NewAttestationService(opts *NewAttestationServiceOpts) *AttestationService
 		projectUseCase:          opts.ProjectUC,
 		projectVersionUseCase:   opts.ProjectVersionUC,
 		signingUseCase:          opts.SigningUseCase,
+		userUseCase:             opts.UserUC,
 	}
 }
 
@@ -748,14 +751,21 @@ func (s *AttestationService) FindOrCreateWorkflow(ctx context.Context, req *cpAP
 		return &cpAPI.FindOrCreateWorkflowResponse{Result: bizWorkflowToPb(wf)}, nil
 	}
 
+	// Get organization
+	org, err := s.orgUseCase.FindByID(ctx, apiToken.OrgID)
+	if err != nil {
+		return nil, handleUseCaseErr(err, s.log)
+	}
+
 	// the workflow does not exist, let's create it alongside its project and contract
 	createOpts := &biz.WorkflowCreateOpts{
-		OrgID:            apiToken.OrgID,
-		Name:             req.GetWorkflowName(),
-		Project:          req.GetProjectName(),
-		ContractName:     req.GetContractName(),
-		ContractBytes:    req.GetContractBytes(),
-		ImplicitCreation: true, // Mark as implicit creation from attestation init
+		OrgID:                               apiToken.OrgID,
+		Name:                                req.GetWorkflowName(),
+		Project:                             req.GetProjectName(),
+		ContractName:                        req.GetContractName(),
+		ContractBytes:                       req.GetContractBytes(),
+		ImplicitCreation:                    true, // Mark as implicit creation from attestation init
+		OrgRestrictContractCreationToAdmins: org.RestrictContractCreationToOrgAdmins,
 	}
 
 	// set project owner if RBAC is enabled
@@ -766,6 +776,14 @@ func (s *AttestationService) FindOrCreateWorkflow(ctx context.Context, req *cpAP
 			return nil, handleUseCaseErr(err, s.log)
 		}
 		createOpts.Owner = &userID
+
+		// Check if user is an org admin
+		membership, err := s.userUseCase.MembershipInOrg(ctx, user.ID, org.Name)
+
+		if err == nil && membership != nil {
+			isAdmin := membership.Role.IsAdmin()
+			createOpts.UserIsOrgAdmin = isAdmin
+		}
 	}
 
 	wf, err := s.workflowUseCase.Create(ctx, createOpts)

app/controlplane/internal/service/attestation.go

@@ -81,6 +81,10 @@ type WorkflowCreateOpts struct {
 	Owner *uuid.UUID
 	// ImplicitCreation indicates whether this workflow is being created implicitly via attestation init
 	ImplicitCreation bool
+	// UserIsOrgAdmin indicates whether the current user is an organization admin
+	UserIsOrgAdmin bool
+	// OrgRestrictContractCreationToAdmins is the organization's setting for restricting contract creation
+	OrgRestrictContractCreationToAdmins bool
 }
 
 type WorkflowUpdateOpts struct {

app/controlplane/pkg/biz/workflow.go

@@ -118,6 +118,11 @@ func (r *WorkflowRepo) Create(ctx context.Context, opts *biz.WorkflowCreateOpts)
 			contract, err := contractInOrg(ctx, r.data.DB, orgUUID, nil, &defaultContractName)
 			if err != nil {
 				if ent.IsNotFound(err) {
+					// Check if contract creation is restricted to org admins
+					if opts.OrgRestrictContractCreationToAdmins && !opts.UserIsOrgAdmin {
+						return biz.NewErrUnauthorizedStr("only organization admins can create contracts")
+					}
+
 					// Create a new contract associated with the workflow
 					contract, _, err = r.contractRepo.addCreateToTx(ctx, tx, &biz.ContractCreateOpts{
 						OrgID:     orgUUID,