fix: validate project_id when creating CAS mappings - #3359
Open
migmartri wants to merge 2 commits into
Open
Conversation
cas_mappings.project_id is not enforced at the database level, so CASMappingRepo.Create accepted any UUID, including a project version ID. Such a mapping never matches the project-scoped predicate used to resolve downloads, making the artifact unreachable for roles with RBAC enabled while remaining downloadable for org owners and admins. The referenced project must now exist and belong to the CAS backend's organization, so a bad write fails at creation time. Assisted-by: Claude Code Signed-off-by: Miguel Martinez <miguel@chainloop.dev> Chainloop-Trace-Sessions: e19606bd-40e5-400d-a907-29de5fd17b1a
Contributor
Security Checks — ✅ 2 passingPR info
|
| Scan | Reason |
|---|---|
vulnerability-scan |
no manifest/lockfile changed |
github-actions-scan |
no workflow files changed |
iac-scan |
no IaC files changed |
Powered by Chainloop and Chainloop Trace
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed across 3 files
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
A project row that is no longer live is not a valid target for a new mapping, and is not guaranteed to be reachable by project-filtered downloads. Align the check with the rest of the project lookups in the data layer, which all filter on deleted_at. Assisted-by: Claude Code Signed-off-by: Miguel Martinez <miguel@chainloop.dev> Chainloop-Trace-Sessions: e19606bd-40e5-400d-a907-29de5fd17b1a
matiasinsaurralde
approved these changes
Aug 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #3358
cas_mappings.project_idis not enforced at the database level, soCASMappingRepo.Createaccepted any UUID — including aproject_versions.id, which has been observed in real data. A mapping carrying such a value never matches theorganization_id = <org> AND project_id IN (<visible project ids>)predicate used to resolve downloads, so the artifact is unreachable for roles with project RBAC enabled while org owners and admins can still download it.Createnow validates that the referenced project exists and belongs to the CAS backend's organization, so a bad write fails at creation time rather than producing a mapping only some roles can read. This mirrors the existing validation of the other database-unenforced reference on the same write,workflow_run_id.The check is deliberately at the application level rather than a foreign key: it is a single indexed lookup on a path that already resolves the CAS backend and validates the workflow run, and it avoids a table-wide constraint on a high-volume write path.
The download lookup also logs the visible project IDs when a digest is not accessible, which is the information needed to tell an RBAC filter miss apart from a genuinely absent mapping.
Repairing existing rows and correcting writers that pass a project version ID are out of scope.
AI assistance: implemented with Claude Code.