feat: add organization setting to restrict project-scoped contracts

[Piskoo]

This PR adds a new organization-level setting that allows administrators to restrict contract creation to be only available for organization admins, preventing their creation by org members and project admins.

When setting is enabled and non-admin user tries to run att init without specifying contract an error is returned:

chainloop att init --project myproject --workflow newworkflow --replace
ERR failed to initialize the attestation: can't create the workflow: authorization error: only organization admins can create contracts

[migmartri]

is this the only place a contract is created? can you check during attestation init?

[migmartri]

We need to double check that a contract can only be created on-demand from this use case. I remember it was also created during a workflow creation, or attestation init.

Would you mind posting there an evaluation of those entrypoints and how this feature will work with the other preventWorkflowCreation feature?

[migmartri]

I don't think this is what we want. What we want is to only allow administrators to create contracts if this setting is set

[migmartri]

also, what's the use-case here? Can anybody create project contracts? can admins do it?

[migmartri]

See my inline coments

[Piskoo]

Updated with what have discussed.

is this the only place a contract is created? can you check during attestation init?

We could also restrict creation of the default contract that is created when no contract was specified in workflow creation, but is that desired behavior?

[migmartri]

Updated with what have discussed.

is this the only place a contract is created? can you check during attestation init?

We could also restrict creation of the default contract that is created when no contract was specified in workflow creation, but is that desired behavior?

I think so yes

The idea of this feature is to prevent contract sprawl, and the main source of sprawl is the attestation process.

[Piskoo]

Updated with what have discussed.

is this the only place a contract is created? can you check during attestation init?

We could also restrict creation of the default contract that is created when no contract was specified in workflow creation, but is that desired behavior?

I think so yes

The idea of this feature is to prevent contract sprawl, and the main source of sprawl is the attestation process.

Alright, added validation to att init as well

[migmartri]

Updated with what have discussed.

is this the only place a contract is created? can you check during attestation init?

We could also restrict creation of the default contract that is created when no contract was specified in workflow creation, but is that desired behavior?

I think so yes
The idea of this feature is to prevent contract sprawl, and the main source of sprawl is the attestation process.

Alright, added validation to att init as well

Thanks

Does it work in workflow create too?