Method Load

pkg/policies/loader.go:181–241

(ctx context.Context, attachment *v1.PolicyAttachment)

}

func (c *ChainloopLoader) Load(ctx context.Context, attachment *v1.PolicyAttachment) (*v1.Policy, *PolicyDescriptor, error) {
	ref := attachment.GetRef()

	// Fast path: check cache
	if cached, ok, _ := c.cache.Get(ctx, ref); ok {
		return cached.Policy, cached.Reference, nil
	}

	// Use singleflight to coalesce concurrent fetches for the same ref.
	// All operations inside use a fixed-timeout context independent of any
	// caller's deadline so that all singleflight waiters get uniform behavior.
	result, err, _ := c.flight.Do(ref, func() (interface{}, error) {
		sfCtx, cancel := context.WithTimeout(context.Background(), remoteLoaderFetchTimeout)
		defer cancel()

		// Double-check cache inside singleflight
		if cached, ok, _ := c.cache.Get(sfCtx, ref); ok {
			return cached, nil
		}

		if !IsProviderScheme(ref) {
			return nil, fmt.Errorf("invalid policy reference %q", ref)
		}

		providerRef := ProviderParts(ref)

		resp, err := c.Client.GetPolicy(sfCtx, &pb.AttestationServiceGetPolicyRequest{
			Provider:   providerRef.Provider,
			PolicyName: providerRef.Name,
			OrgName:    providerRef.OrgName,
		})
		if err != nil {
			return nil, fmt.Errorf("requesting remote policy (provider: %s, name: %s): %w", providerRef.Provider, providerRef.Name, err)
		}

		h, err := crv1.NewHash(resp.Reference.GetDigest())
		if err != nil {
			return nil, fmt.Errorf("parsing digest: %w", err)
		}

		orgName := providerRef.OrgName
		if u, err := url.Parse(resp.Reference.GetUrl()); err == nil {
			if orgParam := u.Query().Get("org"); orgParam != "" {
				orgName = orgParam
			}
		}

		reference := policyReferenceResourceDescriptor(providerRef.Name, resp.Reference.GetUrl(), orgName, h)
		cached := &policyWithReference{Policy: resp.GetPolicy(), Reference: reference}

		_ = c.cache.Set(sfCtx, ref, cached)

		return cached, nil
	})
	if err != nil {
		return nil, nil, err
	}