feat(casbackend): redact AP ARN and provider ID from managed-backend wire output

For Managed=true CAS backends, replace Location with "managed by
Chainloop" and Provider with "Chainloop" everywhere the controlplane
emits a CASBackend outside its trust boundary:

* API responses (bizCASBackendToPb), so `chainloop cas-backend ls`
  no longer prints the AWS account ID, region, or AP name.
* Audit-log events on the NATS bus (CASBackendCreated,
  CASBackendUpdated, CASBackendDeleted, CASBackendPermanentDeleted,
  CASBackendStatusChanged), so downstream consumers can't surface the
  same details to tenants either.

The DB and biz layer continue to carry the real ARN and provider ID
unchanged, so PerformValidation, the platform reconciler, and any
forensic join by CASBackendID still work. Two helpers
(displayLocation, displayProvider) keep the sanitization rule in one
place.

Assisted-by: Claude Code
Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>

Chainloop-Trace-Sessions: 234a03ed-b238-4506-95f0-235242842db2

Author: jiparis

app/controlplane/internal/service/casbackend.go

@@ -193,13 +193,25 @@ func (s *CASBackendService) Revalidate(ctx context.Context, req *pb.CASBackendSe
 }
 
 func bizCASBackendToPb(in *biz.CASBackend) *pb.CASBackendItem {
+	// Managed backends hide both Location (AP ARN) and Provider
+	// (AWS-S3-ACCESS-POINT) from API clients — both are implementation
+	// details that tenants don't need to know. The DB and biz layer
+	// still carry the real values; only the wire format is sanitized.
+	// See biz.CASBackendManagedLocationDisplay /
+	// biz.CASBackendManagedProviderDisplay.
+	location := in.Location
+	provider := string(in.Provider)
+	if in.Managed {
+		location = biz.CASBackendManagedLocationDisplay
+		provider = biz.CASBackendManagedProviderDisplay
+	}
 	r := &pb.CASBackendItem{
-		Id: in.ID.String(), Location: in.Location, Description: in.Description,
+		Id: in.ID.String(), Location: location, Description: in.Description,
 		Name:        in.Name,
 		CreatedAt:   timestamppb.New(*in.CreatedAt),
 		UpdatedAt:   timestamppb.New(*in.UpdatedAt),
 		ValidatedAt: timestamppb.New(*in.ValidatedAt),
-		Provider:    string(in.Provider),
+		Provider:    provider,
 		Default:     in.Default,
 		Fallback:    in.Fallback,
 		IsInline:    in.Inline,

app/controlplane/internal/service/casbackend_test.go

@@ -0,0 +1,69 @@
+//
+// Copyright 2026 The Chainloop Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package service
+
+import (
+	"testing"
+	"time"
+
+	"github.com/chainloop-dev/chainloop/app/controlplane/pkg/biz"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+)
+
+// TestBizCASBackendToPb_HidesManagedDetails guards the rule that
+// managed-backend implementation details (AP ARN, provider ID) never
+// leak to API clients. Non-managed rows keep their original Location
+// and Provider; managed rows are rewritten to stable placeholders.
+// Regression-prevention only — both fields are otherwise straightforward
+// to map.
+func TestBizCASBackendToPb_HidesManagedDetails(t *testing.T) {
+	now := time.Now()
+	realLocation := "arn:aws:s3:us-east-1:471112941097:accesspoint/chainloop-org-dev"
+	realProvider := biz.CASBackendProvider("AWS-S3-ACCESS-POINT")
+
+	base := biz.CASBackend{
+		ID:          uuid.New(),
+		Name:        "backend",
+		Location:    realLocation,
+		CreatedAt:   &now,
+		UpdatedAt:   &now,
+		ValidatedAt: &now,
+		Provider:    realProvider,
+	}
+
+	t.Run("non-managed exposes location and provider verbatim", func(t *testing.T) {
+		in := base
+		in.Managed = false
+		got := bizCASBackendToPb(&in)
+		assert.Equal(t, realLocation, got.Location,
+			"non-managed rows must surface their real location")
+		assert.Equal(t, string(realProvider), got.Provider,
+			"non-managed rows must surface their real provider")
+		assert.False(t, got.IsManaged)
+	})
+
+	t.Run("managed replaces location and provider with placeholders", func(t *testing.T) {
+		in := base
+		in.Managed = true
+		got := bizCASBackendToPb(&in)
+		assert.Equal(t, biz.CASBackendManagedLocationDisplay, got.Location,
+			"managed rows must never leak the underlying AP ARN")
+		assert.Equal(t, biz.CASBackendManagedProviderDisplay, got.Provider,
+			"managed rows must never leak the backing provider ID")
+		assert.True(t, got.IsManaged)
+	})
+}

app/controlplane/pkg/biz/casbackend.go

@@ -48,8 +48,54 @@ const (
 	MinCASBackendMaxBytes           int64              = 10 * 1024 * 1024 // 10MB minimum
 	errMsgCredentialsAccess                            = "Failed to access CAS backend credentials in external Secrets Manager"
 	errMsgCredentialsFormat                            = "Invalid CAS backend credentials format from external Secrets Manager"
+
+	// CASBackendManagedLocationDisplay is the placeholder substituted for
+	// CASBackend.Location whenever a managed backend is exposed beyond
+	// the controlplane's trust boundary (API responses, audit events).
+	// The real ARN remains in the DB so PerformValidation, the platform
+	// reconciler, and forensic joins by CASBackendID still work — only
+	// the wire-format Location is sanitized.
+	CASBackendManagedLocationDisplay = "managed by Chainloop"
+
+	// CASBackendManagedProviderDisplay is the placeholder substituted
+	// for CASBackend.Provider on managed backends. The underlying
+	// provider ID ("AWS-S3-ACCESS-POINT" today, possibly other managed
+	// providers tomorrow) is itself an implementation detail that
+	// tenants shouldn't see; "Chainloop" tells them everything they
+	// need to know about ownership without revealing the backing
+	// technology.
+	CASBackendManagedProviderDisplay = "Chainloop"
 )
 
+// displayLocation returns the location string we expose outside the
+// controlplane's trust boundary. Managed backends get a stable
+// placeholder; everything else passes through verbatim. Use this for
+// any path that emits a CASBackend.Location to API clients or to the
+// audit event bus.
+func displayLocation(b *CASBackend) string {
+	if b != nil && b.Managed {
+		return CASBackendManagedLocationDisplay
+	}
+	if b == nil {
+		return ""
+	}
+	return b.Location
+}
+
+// displayProvider returns the provider string we expose outside the
+// controlplane's trust boundary. Managed backends report a generic
+// "Chainloop" provider name so the specific backing technology stays
+// internal. Non-managed backends pass through their provider ID.
+func displayProvider(b *CASBackend) string {
+	if b == nil {
+		return ""
+	}
+	if b.Managed {
+		return CASBackendManagedProviderDisplay
+	}
+	return string(b.Provider)
+}
+
 var CASBackendInlineDescription = "Embed artifacts content in the attestation (fallback)"
 
 type CASBackendValidationStatus string
@@ -411,8 +457,8 @@ func (uc *CASBackendUseCase) Create(ctx context.Context, orgID, name, location,
 			CASBackendBase: &events.CASBackendBase{
 				CASBackendID:   &backend.ID,
 				CASBackendName: backend.Name,
-				Provider:       string(backend.Provider),
-				Location:       backend.Location,
+				Provider:       displayProvider(backend),
+				Location:       displayLocation(backend),
 				Default:        backend.Default,
 			},
 			CASBackendDescription: description,
@@ -533,8 +579,8 @@ func (uc *CASBackendUseCase) Update(ctx context.Context, orgID, id string, descr
 			CASBackendBase: &events.CASBackendBase{
 				CASBackendID:   &after.ID,
 				CASBackendName: after.Name,
-				Provider:       string(after.Provider),
-				Location:       after.Location,
+				Provider:       displayProvider(after),
+				Location:       displayLocation(after),
 				Default:        after.Default,
 			},
 			NewDescription:     description,
@@ -643,8 +689,8 @@ func (uc *CASBackendUseCase) SoftDelete(ctx context.Context, orgID, id string) e
 			CASBackendBase: &events.CASBackendBase{
 				CASBackendID:   &backend.ID,
 				CASBackendName: backend.Name,
-				Provider:       string(backend.Provider),
-				Location:       backend.Location,
+				Provider:       displayProvider(backend),
+				Location:       displayLocation(backend),
 				Default:        backend.Default,
 			},
 		}, &orgUUID)
@@ -692,8 +738,8 @@ func (uc *CASBackendUseCase) Delete(ctx context.Context, id string) error {
 			CASBackendBase: &events.CASBackendBase{
 				CASBackendID:   &backend.ID,
 				CASBackendName: backend.Name,
-				Provider:       string(backend.Provider),
-				Location:       backend.Location,
+				Provider:       displayProvider(backend),
+				Location:       displayLocation(backend),
 				Default:        backend.Default,
 			},
 		}, &backend.OrganizationID)
@@ -782,8 +828,8 @@ func (uc *CASBackendUseCase) PerformValidation(ctx context.Context, id string) e
 				CASBackendBase: &events.CASBackendBase{
 					CASBackendID:   &backend.ID,
 					CASBackendName: backend.Name,
-					Provider:       string(backend.Provider),
-					Location:       backend.Location,
+					Provider:       displayProvider(backend),
+					Location:       displayLocation(backend),
 					Default:        backend.Default,
 				},
 				PreviousStatus: string(previousStatus),