feat: add organization setting to restrict project-scoped contracts

app/controlplane/api/controlplane/v1/organization.proto

@@ -96,6 +96,9 @@ message OrganizationServiceUpdateRequest {
 
   // prevent workflows and projects from being created implicitly during attestation init
   optional bool prevent_implicit_workflow_creation = 5;
+
+  // prevent_project_scoped_contracts restricts contract creation to only organization-level contracts
+  optional bool prevent_project_scoped_contracts = 6;
 }
 
 message OrganizationServiceUpdateResponse {

app/controlplane/api/controlplane/v1/response_messages.proto

@@ -281,6 +281,8 @@ message OrgItem {
   repeated string policy_allowed_hostnames = 5;
   // prevent workflows and projects from being created implicitly during attestation init
   bool prevent_implicit_workflow_creation = 7;
+  // prevent_project_scoped_contracts restricts contract creation to only organization-level contracts
+  bool prevent_project_scoped_contracts = 8;
 
   enum PolicyViolationBlockingStrategy {
     POLICY_VIOLATION_BLOCKING_STRATEGY_UNSPECIFIED = 0;

app/controlplane/internal/service/context.go

@@ -122,6 +122,7 @@ func bizOrgToPb(m *biz.Organization) *pb.OrgItem {
 		DefaultPolicyViolationStrategy:  bizPolicyViolationBlockingStrategyToPb(m.BlockOnPolicyViolation),
 		PolicyAllowedHostnames:          m.PoliciesAllowedHostnames,
 		PreventImplicitWorkflowCreation: m.PreventImplicitWorkflowCreation,
+		PreventProjectScopedContracts:   m.PreventProjectScopedContracts,
 	}
 }
 

app/controlplane/internal/service/organization.go

@@ -89,7 +89,7 @@ func (s *OrganizationService) Update(ctx context.Context, req *pb.OrganizationSe
 		}
 	}
 
-	org, err := s.orgUC.Update(ctx, currentUser.ID, req.Name, req.BlockOnPolicyViolation, policiesAllowedHostnames, req.PreventImplicitWorkflowCreation)
+	org, err := s.orgUC.Update(ctx, currentUser.ID, req.Name, req.BlockOnPolicyViolation, policiesAllowedHostnames, req.PreventImplicitWorkflowCreation, req.PreventProjectScopedContracts)
 	if err != nil {
 		return nil, handleUseCaseErr(err, s.log)
 	}

app/controlplane/internal/service/workflowcontract.go

@@ -34,12 +34,14 @@ type WorkflowContractService struct {
 	*service
 
 	contractUseCase *biz.WorkflowContractUseCase
+	orgUseCase      *biz.OrganizationUseCase
 }
 
-func NewWorkflowSchemaService(uc *biz.WorkflowContractUseCase, opts ...NewOpt) *WorkflowContractService {
+func NewWorkflowSchemaService(uc *biz.WorkflowContractUseCase, orgUC *biz.OrganizationUseCase, opts ...NewOpt) *WorkflowContractService {
 	return &WorkflowContractService{
 		service:         newService(opts...),
 		contractUseCase: uc,
+		orgUseCase:      orgUC,
 	}
 }
 
@@ -109,9 +111,20 @@ func (s *WorkflowContractService) Create(ctx context.Context, req *pb.WorkflowCo
 		return nil, errors.BadRequest("invalid", "project is required")
 	}
 
+	// Check organization settings for project-scoped contracts
+	org, err := s.orgUseCase.FindByID(ctx, currentOrg.ID)
+	if err != nil {
+		return nil, handleUseCaseErr(err, s.log)
+	}
+
 	// if the project is provided we make sure it exists and the user has permission to it
 	var projectID *uuid.UUID
 	if req.ProjectReference.IsSet() {
+		// Check if organization prevents project-scoped contracts
+		if org.PreventProjectScopedContracts {
+			return nil, errors.BadRequest("invalid", "organization does not allow project-scoped contracts")
+		}
+
 		// Make sure the provided project exists and the user has permission to create tokens in it
 		project, err := s.userHasPermissionOnProject(ctx, currentOrg.ID, req.GetProjectReference(), authz.PolicyWorkflowContractCreate)
 		if err != nil {