printers low-toner alerts; geenforce display readiness + token scope-binding; air-gap docker deploy kit

migrations/versions/7d30_apitoken_resourcescopes.py

@@ -0,0 +1,36 @@
+"""apitokens.resourcescopes: pin a service token to specific resource scopes.
+
+A geenforce.fetch token handed to a fleet (e.g. displays) should reach only its
+own manifest scope(s) and the blobs those scopes ship, not every scope by name
+or every blob by hash. This nullable JSON column carries that allowlist; NULL =
+unrestricted, so every existing token keeps working unchanged. Idempotent.
+"""
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision = '7d30_apitoken_resourcescopes'
+down_revision = '7d29_supportteam_webhookurl'
+branch_labels = None
+depends_on = None
+
+
+def _has_column(bind, table, column):
+    inspector = sa.inspect(bind)
+    if table not in inspector.get_table_names():
+        return False
+    return column in {c['name'] for c in inspector.get_columns(table)}
+
+
+def upgrade():
+    bind = op.get_bind()
+    if not _has_column(bind, 'apitokens', 'resourcescopes'):
+        op.add_column('apitokens',
+                      sa.Column('resourcescopes', sa.Text(), nullable=True))
+
+
+def downgrade():
+    bind = op.get_bind()
+    if _has_column(bind, 'apitokens', 'resourcescopes'):
+        op.drop_column('apitokens', 'resourcescopes')