feat(contracts): add managed flag

[migmartri]

Summary

Adds a managed boolean to workflow contracts to mark resources provisioned and operated by Chainloop. Managed contracts cannot be updated or deleted by users.

Mirrors the same flag added for CAS backends in #3092:

• New managed field on the workflow_contracts Ent schema (default false)
• Managed exposed on biz.WorkflowContract; ContractCreateOpts accepts Managed *bool for internal callers
• Update and Delete use cases return a validation error when the contract is managed
• Surfaced read-only as is_managed on WorkflowContractItem in the API

Disclosure

Assisted by Claude Code.

[cubic-dev-ai]

1 issue found across 19 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="app/controlplane/pkg/biz/workflowcontract.go">

<violation number="1" location="app/controlplane/pkg/biz/workflowcontract.go:416">
P2: Add tests for the new managed-contract guards in Update and Delete. These are new authorization/validation branches and currently have no matching test coverage.

(Based on your team's feedback about adding or updating tests for new paths.) [FEEDBACK_USED]</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.}

[cubic-dev-ai]

P2: Add tests for the new managed-contract guards in Update and Delete. These are new authorization/validation branches and currently have no matching test coverage.

(Based on your team's feedback about adding or updating tests for new paths.)

View Feedback

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At app/controlplane/pkg/biz/workflowcontract.go, line 416:

<comment>Add tests for the new managed-contract guards in Update and Delete. These are new authorization/validation branches and currently have no matching test coverage.

(Based on your team's feedback about adding or updating tests for new paths.) </comment>

<file context>
@@ -408,6 +412,11 @@ func (uc *WorkflowContractUseCase) Update(ctx context.Context, orgID, name strin
 	}
 
+	// Managed contracts are owned and operated by Chainloop and cannot be modified by users.
+	if wfContractPreUpdate.Managed {
+		return nil, NewErrValidationStr("managed contracts cannot be modified")
+	}
</file context>