printers low-toner alerts; geenforce display readiness + token scope-binding; air-gap docker deploy kit

shopdb/utils/apitoken_auth.py

@@ -76,16 +76,13 @@ def touch_apitoken_lastused(token):
         db.session.commit()
 
 
-def service_token_authorized(scope):
-    """True when the current request carries a managed token scoped for `scope`
-    whose owner is active and holds that permission. Accepts X-API-Key or a
-    Bearer PAT (the before_request shim resolves Bearer into g.apitokenid).
-    Touches lastusedat on success.
+def authorized_service_token(scope):
+    """Return the ApiToken authorizing this request for `scope`, or None.
 
-    The single contract-surface entry point for unattended SERVICE tokens
-    (collector.ingest, geenforce.fetch, ...), so plugins authorize a service
-    token without reaching into core token internals. Returns False on any
-    miss; the caller returns its own 401.
+    Same checks as service_token_authorized (managed token scoped for `scope`,
+    active owner holding the permission), but hands back the token itself so a
+    caller can read its resource binding (token.resourcescopelist) without
+    reaching into core token internals. Touches lastusedat on success.
     """
     from shopdb.core.models import User
 
@@ -99,15 +96,29 @@ def service_token_authorized(scope):
         if tokenid is not None:
             token = db.session.get(ApiToken, tokenid)
     if token is None:
-        return False
+        return None
     scopelist = token.scopelist
     if not scopelist or scope not in scopelist:
-        return False
+        return None
     user = db.session.get(User, token.userid)
     if user is None or not user.isactive or not user.haspermission(scope):
-        return False
+        return None
     touch_apitoken_lastused(token)
-    return True
+    return token
+
+
+def service_token_authorized(scope):
+    """True when the current request carries a managed token scoped for `scope`
+    whose owner is active and holds that permission. Accepts X-API-Key or a
+    Bearer PAT (the before_request shim resolves Bearer into g.apitokenid).
+    Touches lastusedat on success.
+
+    The single contract-surface entry point for unattended SERVICE tokens
+    (collector.ingest, geenforce.fetch, ...), so plugins authorize a service
+    token without reaching into core token internals. Returns False on any
+    miss; the caller returns its own 401.
+    """
+    return authorized_service_token(scope) is not None
 
 
 def install_apitoken_auth(app):