printers low-toner alerts; geenforce display readiness + token scope-binding; air-gap docker deploy kit

shopdb/core/models/apitoken.py

@@ -53,6 +53,13 @@ class ApiToken(BaseModel):
     # authority). A scoped token grants ONLY these, intersected with what the
     # owner holds, and suspends the admin bypass. See scopelist below.
     scopes = db.Column(db.Text, nullable=True)
+    # JSON array of RESOURCE-scope names (a different axis from `scopes`, which
+    # is what the token may DO). Today these are geenforce manifest scope names
+    # (e.g. gea-shopfloor-display): a resource-bound geenforce.fetch token may
+    # only pull those scopes' manifests and only blobs those manifests
+    # reference. NULL = unrestricted (any resource), for back-compat. See
+    # resourcescopelist below.
+    resourcescopes = db.Column(db.Text, nullable=True)
 
     user = db.relationship('User', backref=db.backref('apitokens', lazy='dynamic'))
 
@@ -98,6 +105,25 @@ class ApiToken(BaseModel):
         else:
             self.scopes = json.dumps(list(names))
 
+    @property
+    def resourcescopelist(self):
+        """Parsed resource-scope names, or None when the token is unrestricted."""
+        if self.resourcescopes is None:
+            return None
+        try:
+            value = json.loads(self.resourcescopes)
+        except (ValueError, TypeError):
+            return None
+        return value if isinstance(value, list) else None
+
+    @resourcescopelist.setter
+    def resourcescopelist(self, names):
+        """Store a resource-scope list, or None to clear the restriction."""
+        if names is None:
+            self.resourcescopes = None
+        else:
+            self.resourcescopes = json.dumps(list(names))
+
     @staticmethod
     def unknown_scope_names(names) -> list:
         """Return the subset of names that are not in the permission catalog.
@@ -119,6 +145,7 @@ class ApiToken(BaseModel):
             'expiresat': self.expiresat.isoformat() + 'Z' if self.expiresat else None,
             'lastusedat': self.lastusedat.isoformat() + 'Z' if self.lastusedat else None,
             'scopes': self.scopelist,
+            'resourcescopes': self.resourcescopelist,
             'isactive': self.isactive,
             'isexpired': self.is_expired,
             'createddate': self.createddate.isoformat() + 'Z' if self.createddate else None,