printers low-toner alerts; geenforce display readiness + token scope-binding; air-gap docker deploy kit

plugins/geenforce/service.py

@@ -8,6 +8,7 @@ Kept out of the CLI and routes so both share one implementation:
 """
 
 import hashlib
+import json
 import os
 import tempfile
 from datetime import datetime, timezone
@@ -288,6 +289,34 @@ def blob_path(sha256):
     return os.path.join(_payload_dir(), sha256)
 
 
+def blob_referenced_by_scopes(sha256, scopenames):
+    """True when any of these scopes' CURRENT published manifest references
+    sha256 as an entry payload.
+
+    Backs the resource-bound token check on GET /payload: a token pinned to its
+    own scope(s) may only pull blobs those scopes actually ship, not any blob by
+    hash. Empty scopenames -> False (a bound-but-empty token reaches nothing).
+    """
+    if not scopenames:
+        return False
+    rows = db.session.query(ManifestPublishedVersion).join(
+        ManifestScope,
+        ManifestPublishedVersion.scopeid == ManifestScope.scopeid,
+    ).filter(
+        ManifestScope.scopename.in_(list(scopenames)),
+        ManifestPublishedVersion.iscurrent == True,  # noqa: E712
+    ).all()
+    for row in rows:
+        try:
+            doc = json.loads(row.manifestjson)
+        except (ValueError, TypeError):
+            continue
+        for entry in doc.get('Applications', []) or []:
+            if entry.get('PayloadSha256') == sha256:
+                return True
+    return False
+
+
 def store_blob(rawbytes, filename, contenttype=None):
     """Store bytes in the content-addressed payload store; return the sha256.