Method Load

pkg/policies/group_loader.go:116–176

(ctx context.Context, attachment *v1.PolicyGroupAttachment)

}

func (c *ChainloopGroupLoader) Load(ctx context.Context, attachment *v1.PolicyGroupAttachment) (*v1.PolicyGroup, *PolicyDescriptor, error) {
	ref := attachment.GetRef()

	// Fast path: check cache
	if cached, ok, _ := c.cache.Get(ctx, ref); ok {
		return cached.Group, cached.Reference, nil
	}

	// Use singleflight to coalesce concurrent fetches for the same ref.
	// All operations inside use a fixed-timeout context independent of any
	// caller's deadline so that all singleflight waiters get uniform behavior.
	result, err, _ := c.flight.Do(ref, func() (interface{}, error) {
		sfCtx, cancel := context.WithTimeout(context.Background(), remoteLoaderFetchTimeout)
		defer cancel()

		// Double-check cache inside singleflight
		if cached, ok, _ := c.cache.Get(sfCtx, ref); ok {
			return cached, nil
		}

		if !IsProviderScheme(ref) {
			return nil, fmt.Errorf("invalid group reference %q", ref)
		}

		providerRef := ProviderParts(ref)

		resp, err := c.Client.GetPolicyGroup(sfCtx, &pb.AttestationServiceGetPolicyGroupRequest{
			Provider:  providerRef.Provider,
			GroupName: providerRef.Name,
			OrgName:   providerRef.OrgName,
		})
		if err != nil {
			return nil, fmt.Errorf("requesting remote group (provider: %s, name: %s): %w", providerRef.Provider, providerRef.Name, err)
		}

		h, err := crv1.NewHash(resp.Reference.GetDigest())
		if err != nil {
			return nil, fmt.Errorf("parsing digest: %w", err)
		}

		orgName := providerRef.OrgName
		if u, err := url.Parse(resp.Reference.GetUrl()); err == nil {
			if orgParam := u.Query().Get("org"); orgParam != "" {
				orgName = orgParam
			}
		}

		reference := policyReferenceResourceDescriptor(providerRef.Name, resp.Reference.GetUrl(), orgName, h)
		cached := &groupWithReference{Group: resp.GetGroup(), Reference: reference}

		_ = c.cache.Set(sfCtx, ref, cached)

		return cached, nil
	})
	if err != nil {
		return nil, nil, err
	}