feat(controlplane): add attestation bundle cache with layered resolution

app/controlplane/cmd/wire.go

@@ -38,6 +38,8 @@ import (
 	"github.com/chainloop-dev/chainloop/app/controlplane/plugins/sdk/v1"
 	"github.com/chainloop-dev/chainloop/pkg/blobmanager/loader"
 	"github.com/chainloop-dev/chainloop/pkg/cache"
+	"github.com/chainloop-dev/chainloop/pkg/cache/attestationbundle"
+	"github.com/chainloop-dev/chainloop/pkg/cache/policyevalbundle"
 	"github.com/chainloop-dev/chainloop/pkg/credentials"
 	"github.com/chainloop-dev/chainloop/pkg/natsconn"
 	"github.com/go-kratos/kratos/v2/log"
@@ -140,13 +142,14 @@ func newAuthAllowList(conf *conf.Bootstrap) *pkgConf.AllowList {
 var cacheProviderSet = wire.NewSet(
 	newMembershipsCache,
 	newClaimsCache,
-	newPolicyEvalBundleCache,
+	policyevalbundle.New,
+	attestationbundle.New,
 )
 
 func newClaimsCache(ctx context.Context, rc *natsconn.ReloadableConnection, logger log.Logger) (cache.Cache[*jwt.MapClaims], error) {
 	l := log.NewHelper(logger)
 	backend := "memory"
-	opts := []cache.Option{cache.WithTTL(10 * time.Second), cache.WithLogger(&kratosLogAdapter{h: l}), cache.WithDescription("Cache for JWT claims")}
+	opts := []cache.Option{cache.WithTTL(10 * time.Second), cache.WithLogger(l), cache.WithDescription("Cache for JWT claims")}
 	if rc != nil {
 		backend = "nats"
 		opts = append(opts, cache.WithNATS(rc.Conn, "chainloop-jwt-claims"))
@@ -159,7 +162,7 @@ func newClaimsCache(ctx context.Context, rc *natsconn.ReloadableConnection, logg
 func newMembershipsCache(ctx context.Context, rc *natsconn.ReloadableConnection, logger log.Logger) (cache.Cache[*entities.Membership], error) {
 	l := log.NewHelper(logger)
 	backend := "memory"
-	opts := []cache.Option{cache.WithTTL(time.Second), cache.WithLogger(&kratosLogAdapter{h: l}), cache.WithDescription("Cache for org memberships")}
+	opts := []cache.Option{cache.WithTTL(time.Second), cache.WithLogger(l), cache.WithDescription("Cache for org memberships")}
 	if rc != nil {
 		backend = "nats"
 		opts = append(opts, cache.WithNATS(rc.Conn, "chainloop-memberships"))
@@ -168,32 +171,3 @@ func newMembershipsCache(ctx context.Context, rc *natsconn.ReloadableConnection,
 	l.Infow("msg", "cache initialized", "bucket", "chainloop-memberships", "backend", backend, "ttl", "1s")
 	return cache.New[*entities.Membership](opts...)
 }
-
-func newPolicyEvalBundleCache(ctx context.Context, rc *natsconn.ReloadableConnection, logger log.Logger) (cache.Cache[[]byte], error) {
-	l := log.NewHelper(logger)
-	backend := "memory"
-	opts := []cache.Option{cache.WithTTL(24 * time.Hour), cache.WithLogger(&kratosLogAdapter{h: l}), cache.WithDescription("Cache for policy evaluation bundles from CAS")}
-	if rc != nil {
-		backend = "nats"
-		opts = append(opts, cache.WithNATS(rc.Conn, "chainloop-policy-eval-bundles"))
-		opts = append(opts, cache.WithReconnect(rc.Subscribe(ctx)))
-	}
-	l.Infow("msg", "cache initialized", "bucket", "chainloop-policy-eval-bundles", "backend", backend, "ttl", "24h")
-	return cache.New[[]byte](opts...)
-}
-
-// kratosLogAdapter adapts kratos log.Helper (Debugw(...interface{})) to cache.Logger (Debugw(string, ...any)).
-type kratosLogAdapter struct{ h *log.Helper }
-
-func (a *kratosLogAdapter) Debugw(msg string, keyvals ...any) {
-	a.h.Debugw(append([]any{"msg", msg}, keyvals...)...)
-}
-func (a *kratosLogAdapter) Infow(msg string, keyvals ...any) {
-	a.h.Infow(append([]any{"msg", msg}, keyvals...)...)
-}
-func (a *kratosLogAdapter) Warnw(msg string, keyvals ...any) {
-	a.h.Warnw(append([]any{"msg", msg}, keyvals...)...)
-}
-func (a *kratosLogAdapter) Errorw(msg string, keyvals ...any) {
-	a.h.Errorw(append([]any{"msg", msg}, keyvals...)...)
-}

app/controlplane/internal/service/workflowrun.go

@@ -27,7 +27,7 @@ import (
 	"github.com/chainloop-dev/chainloop/app/controlplane/pkg/biz"
 	"github.com/chainloop-dev/chainloop/app/controlplane/pkg/pagination"
 	chainloop "github.com/chainloop-dev/chainloop/pkg/attestation/renderer/chainloop"
-	"github.com/chainloop-dev/chainloop/pkg/cache"
+	"github.com/chainloop-dev/chainloop/pkg/cache/policyevalbundle"
 	"github.com/chainloop-dev/chainloop/pkg/credentials"
 	errors "github.com/go-kratos/kratos/v2/errors"
 	"github.com/google/uuid"
@@ -46,7 +46,7 @@ type WorkflowRunService struct {
 	credsReader             credentials.Reader
 	casClient               biz.CASClient
 	casMappingUC            *biz.CASMappingUseCase
-	policyEvalCache         cache.Cache[[]byte]
+	policyEvalCache         *policyevalbundle.Cache
 }
 
 type NewWorkflowRunServiceOpts struct {
@@ -57,7 +57,7 @@ type NewWorkflowRunServiceOpts struct {
 	CredsReader        credentials.Reader
 	CASClient          biz.CASClient
 	CASMappingUC       *biz.CASMappingUseCase
-	PolicyEvalCache    cache.Cache[[]byte]
+	PolicyEvalCache    *policyevalbundle.Cache
 	Opts               []NewOpt
 }
 

app/controlplane/pkg/biz/biz.go

@@ -34,6 +34,7 @@ var ProviderSet = wire.NewSet(
 	NewUserUseCase,
 	NewRootAccountUseCase,
 	NewWorkflowRunUseCase,
+	wire.Struct(new(WorkflowRunUseCaseOpts), "*"),
 	NewOrganizationUseCase,
 	NewWorkflowContractUseCase,
 	NewCASCredentialsUseCase,

app/controlplane/pkg/biz/testhelpers/wire.go

@@ -35,6 +35,7 @@ import (
 	"github.com/chainloop-dev/chainloop/app/controlplane/plugins/sdk/v1"
 	robotaccount "github.com/chainloop-dev/chainloop/internal/robotaccount/cas"
 	backends "github.com/chainloop-dev/chainloop/pkg/blobmanager"
+	"github.com/chainloop-dev/chainloop/pkg/cache/attestationbundle"
 	"github.com/chainloop-dev/chainloop/pkg/credentials"
 	"github.com/chainloop-dev/chainloop/pkg/natsconn"
 	"github.com/go-kratos/kratos/v2/log"
@@ -65,10 +66,20 @@ func WireTestData(context.Context, *TestDatabase, *testing.T, log.Logger, creden
 			authzConfig,
 			authzUseCaseConfig,
 			biz.NewIndexConfig,
+			newAttestationBundleCache,
+			newNilCASClient,
 		),
 	)
 }
 
+func newAttestationBundleCache() *attestationbundle.Cache {
+	return nil
+}
+
+func newNilCASClient() biz.CASClient {
+	return nil
+}
+
 func authzConfig() *authz.Config {
 	return &authz.Config{RolesMap: authz.RolesMap}
 }