feat(casbackend): reject managed-only providers in service Create

CASBackendService.Create previously accepted any provider ID present
in the loader's provider map, including AWS-S3-ACCESS-POINT. A
sufficiently determined user could craft a Create request that
half-provisioned a managed row pointing at an AP ARN they don't own,
bypassing the platform reconciler's trust boundary.

Add an explicit isManagedOnlyProvider() guard at the front of Create
so the public RPC fails fast with `managed CAS backends cannot be
created via this API`. The platform reconciler still creates managed
rows by calling biz.CASBackendUseCase.Create directly, which is
unaffected. Update/SoftDelete are already guarded against managed
rows in the biz layer.

Assisted-by: Claude Code
Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>

Chainloop-Trace-Sessions: 234a03ed-b238-4506-95f0-235242842db2

Author: jiparis

app/controlplane/internal/service/casbackend.go

@@ -21,6 +21,7 @@ import (
 	pb "github.com/chainloop-dev/chainloop/app/controlplane/api/controlplane/v1"
 	"github.com/chainloop-dev/chainloop/app/controlplane/pkg/biz"
 	backend "github.com/chainloop-dev/chainloop/pkg/blobmanager"
+	"github.com/chainloop-dev/chainloop/pkg/blobmanager/s3accesspoint"
 	"github.com/go-kratos/kratos/v2/errors"
 	"google.golang.org/protobuf/types/known/timestamppb"
 )
@@ -66,6 +67,16 @@ func (s *CASBackendService) Create(ctx context.Context, req *pb.CASBackendServic
 		return nil, err
 	}
 
+	// Managed-only providers (currently AWS-S3-ACCESS-POINT) are
+	// reserved for the platform reconciler, which provisions them via
+	// the biz layer directly. Reject any attempt to create one through
+	// the public RPC so a user can't end up with a half-provisioned row
+	// pointing at an AP they don't own.
+	if isManagedOnlyProvider(req.Provider) {
+		return nil, errors.BadRequest("invalid CAS backend",
+			"managed CAS backends cannot be created via this API")
+	}
+
 	backendP, ok := s.providers[req.Provider]
 	if !ok {
 		return nil, errors.BadRequest("invalid CAS backend", "invalid CAS backend")
@@ -237,3 +248,12 @@ func bizCASBackendToPb(in *biz.CASBackend) *pb.CASBackendItem {
 
 	return r
 }
+
+// isManagedOnlyProvider returns true when the supplied provider ID can
+// only be instantiated by the platform reconciler — never by a user via
+// the public CASBackendService.Create RPC. Today that's just the S3
+// Access Point provider; if more managed providers land later, list
+// them here.
+func isManagedOnlyProvider(id string) bool {
+	return id == s3accesspoint.ProviderID
+}

app/controlplane/internal/service/casbackend_test.go

@@ -20,6 +20,7 @@ import (
 	"time"
 
 	"github.com/chainloop-dev/chainloop/app/controlplane/pkg/biz"
+	"github.com/chainloop-dev/chainloop/pkg/blobmanager/s3accesspoint"
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 )
@@ -67,3 +68,28 @@ func TestBizCASBackendToPb_HidesManagedDetails(t *testing.T) {
 		assert.True(t, got.IsManaged)
 	})
 }
+
+// TestIsManagedOnlyProvider locks down which provider IDs are reserved
+// for the platform reconciler. If a new managed provider is added but
+// this list isn't updated, users would be able to create the row
+// directly via CASBackendService.Create — a privilege escalation against
+// the managed-CAS trust model.
+func TestIsManagedOnlyProvider(t *testing.T) {
+	tests := []struct {
+		id       string
+		expected bool
+	}{
+		{s3accesspoint.ProviderID, true},
+		{"AWS-S3", false},
+		{"OCI", false},
+		{"AzureBlob", false},
+		{"INLINE", false},
+		{"", false},
+		{"unknown-provider", false},
+	}
+	for _, tc := range tests {
+		t.Run(tc.id, func(t *testing.T) {
+			assert.Equal(t, tc.expected, isManagedOnlyProvider(tc.id))
+		})
+	}
+}