printers low-toner alerts; geenforce display readiness + token scope-binding; air-gap docker deploy kit

shopdb/core/api/apitokens.py

@@ -45,6 +45,24 @@ def _validate_scopes(scopes, owner):
     return scopes, None
 
 
+def _validate_resourcescopes(resourcescopes):
+    """Validate a resourcescopes payload. Return (list_or_none, error_response).
+
+    resourcescopes is a DIFFERENT axis from scopes: it pins the token to a set
+    of resource names (today geenforce manifest scope names, e.g.
+    gea-shopfloor-display), not permission names, so there is no catalog to
+    check against - a plugin owns the meaning. None/absent = unrestricted.
+    """
+    if resourcescopes is None:
+        return None, None
+    if not isinstance(resourcescopes, list) \
+            or not all(isinstance(s, str) for s in resourcescopes):
+        return None, error_response(
+            ErrorCodes.VALIDATION_ERROR,
+            'resourcescopes must be a list of resource-scope names')
+    return [s.strip() for s in resourcescopes if s.strip()], None
+
+
 @apitokens_bp.route('', methods=['GET'])
 @jwt_required()
 def list_apitokens():
@@ -93,6 +111,11 @@ def create_apitoken():
     if scope_error is not None:
         return scope_error
 
+    resourcescopelist, resource_error = _validate_resourcescopes(
+        data.get('resourcescopes'))
+    if resource_error is not None:
+        return resource_error
+
     secret = ApiToken.generate_secret()
     token = ApiToken(
         userid=current_user.userid,
@@ -102,6 +125,7 @@ def create_apitoken():
         expiresat=expiresat,
     )
     token.scopelist = scopelist
+    token.resourcescopelist = resourcescopelist
     db.session.add(token)
     db.session.flush()
 
@@ -147,6 +171,12 @@ def update_apitoken(tokenid: int):
         if scope_error is not None:
             return scope_error
         token.scopelist = scopelist
+    if 'resourcescopes' in data:
+        resourcescopelist, resource_error = _validate_resourcescopes(
+            data.get('resourcescopes'))
+        if resource_error is not None:
+            return resource_error
+        token.resourcescopelist = resourcescopelist
 
     db.session.commit()
     return success_response(token.to_dict(), message='Token updated')