feat: add --repo flag to token generate for repo-specific scoping

commit: 8443ba47c454dbb913b1d2d47dbc3aa5a9d55b03
author: brice · 7mo ago · 2026-03-19 04:54 UTC
parent: c9f8ad6
signature: unsigned

2 files · +48 -8

M internal/adapters/in/cli/auth.go +15 -8


@@ -74,6 +74,7 @@ func newTokenGenerateCmd() *cobra.Command {
74	74		scopes string
75	75		expiry string
76	76		configPath string
	77	+	repo string
77	78		)
78	79
79	80		cmd := &cobra.Command{

@@ -101,10 +102,15 @@ Admin scopes (for remote CLI access):
101	102		admin:routes:read Read-only routes access
102	103		admin:status:read Read-only status access
103	104
	105	+	Repository scoping:
	106	+	--repo myapp Scope to specific repository
	107	+	--repo "*" All repositories (default)
	108	+
104	109		Combined examples:
105		-	--scopes "push,pull" Registry only (default)
106		-	--scopes "admin::" Admin CLI only
107		-	--scopes "push,pull,admin::" Registry + full admin
	110	+	--scopes "push,pull" All repos, registry only (default)
	111	+	--scopes "push" --repo myapp Push to myapp only
	112	+	--scopes "push,pull,admin:routes:read" Minimum CI scope (all repos)
	113	+	--scopes "push,admin:routes:read" --repo app Minimum CI scope (specific repo)
108	114
109	115		EXPIRY:
110	116

@@ -115,7 +121,7 @@ Supports human-friendly durations:
115	121		Examples: 1y, 30d, 2w, 6M, 1y6M, 2w3d
116	122		Use --expiry=0 for a token that never expires (useful for CI).`,
117	123		RunE: func(cmd *cobra.Command, args []string) error {
118		-	return runTokenGenerate(subject, scopes, expiry, configPath)
	124	+	return runTokenGenerate(subject, scopes, expiry, configPath, repo)
119	125		},
120	126		}
121	127

@@ -123,6 +129,7 @@ Use --expiry=0 for a token that never expires (useful for CI).`,
123	129		cmd.Flags().StringVar(&scopes, "scopes", "push,pull", "Comma-separated list of scopes")
124	130		cmd.Flags().StringVar(&expiry, "expiry", "30d", "Token expiry duration (e.g., 1y, 30d, 2w, 24h, 0 for never)")
125	131		cmd.Flags().StringVarP(&configPath, "config", "c", "", "Path to config file")
	132	+	cmd.Flags().StringVar(&repo, "repo", "", "Repository to scope the token to (default: for all repositories)")
126	133
127	134		_ = cmd.MarkFlagRequired("subject")
128	135

@@ -434,7 +441,7 @@ The hash can be stored in your secrets backend and referenced in the config:
434	441		// runTokenGenerate generates a new authentication token.
435	442		// parseAndConvertScopes parses a comma-separated scope string and converts
436	443		// simple scopes (push, pull, ) to Docker v2 format (repository::action).
437		-	func parseAndConvertScopes(scopesStr string) []string {
	444	+	func parseAndConvertScopes(scopesStr, repo string) []string {
438	445		rawScopes := strings.Split(scopesStr, ",")
439	446		for i := range rawScopes {
440	447		rawScopes[i] = strings.TrimSpace(rawScopes[i])

@@ -465,12 +472,12 @@ func parseAndConvertScopes(scopesStr string) []string {
465	472		}
466	473		}
467	474		if len(actions) > 0 {
468		-	scopes = append(scopes, "repository:*:"+strings.Join(actions, ","))
	475	+	scopes = append(scopes, "repository:"+repo+":"+strings.Join(actions, ","))
469	476		}
470	477		return scopes
471	478		}
472	479
473		-	func runTokenGenerate(subject, scopesStr, expiryStr, configPath string) error {
	480	+	func runTokenGenerate(subject, scopesStr, expiryStr, configPath, repo string) error {
474	481		cfg, err := loadAuthConfig(configPath)
475	482		if err != nil {
476	483		return err

@@ -485,7 +492,7 @@ func runTokenGenerate(subject, scopesStr, expiryStr, configPath string) error {
485	492		}
486	493		}
487	494
488		-	scopes := parseAndConvertScopes(scopesStr)
	495	+	scopes := parseAndConvertScopes(scopesStr, repo)
489	496
490	497		// Create auth service
491	498		log := zerowrap.New(zerowrap.Config{Level: "warn"})

 		scopes     string
 		expiry     string
 		configPath string
+		repo       string
 	)
 	cmd := &cobra.Command{
     admin:routes:read      Read-only routes access
     admin:status:read      Read-only status access
+Repository scoping:
+  --repo myapp           Scope to specific repository
+  --repo "*"             All repositories (default)
 Combined examples:
-  --scopes "push,pull"                Registry only (default)
+  --scopes "push,pull"                          All repos, registry only (default)
-  --scopes "admin:*:*"                Admin CLI only
+  --scopes "push" --repo myapp                  Push to myapp only
-  --scopes "push,pull,admin:*:*"      Registry + full admin
+  --scopes "push,pull,admin:routes:read"        Minimum CI scope (all repos)
+  --scopes "push,admin:routes:read" --repo app  Minimum CI scope (specific repo)
 EXPIRY:
 Examples: 1y, 30d, 2w, 6M, 1y6M, 2w3d
 Use --expiry=0 for a token that never expires (useful for CI).`,
 		RunE: func(cmd *cobra.Command, args []string) error {
-			return runTokenGenerate(subject, scopes, expiry, configPath)
+			return runTokenGenerate(subject, scopes, expiry, configPath, repo)
 		},
 	}
 	cmd.Flags().StringVar(&scopes, "scopes", "push,pull", "Comma-separated list of scopes")
 	cmd.Flags().StringVar(&expiry, "expiry", "30d", "Token expiry duration (e.g., 1y, 30d, 2w, 24h, 0 for never)")
 	cmd.Flags().StringVarP(&configPath, "config", "c", "", "Path to config file")
+	cmd.Flags().StringVar(&repo, "repo", "*", "Repository to scope the token to (default: * for all repositories)")
 	_ = cmd.MarkFlagRequired("subject")
 // runTokenGenerate generates a new authentication token.
 // parseAndConvertScopes parses a comma-separated scope string and converts
 // simple scopes (push, pull, *) to Docker v2 format (repository:*:action).
-func parseAndConvertScopes(scopesStr string) []string {
+func parseAndConvertScopes(scopesStr, repo string) []string {
 	rawScopes := strings.Split(scopesStr, ",")
 	for i := range rawScopes {
 		rawScopes[i] = strings.TrimSpace(rawScopes[i])
 		}
 	}
 	if len(actions) > 0 {
-		scopes = append(scopes, "repository:*:"+strings.Join(actions, ","))
+		scopes = append(scopes, "repository:"+repo+":"+strings.Join(actions, ","))
 	}
 	return scopes
 }
-func runTokenGenerate(subject, scopesStr, expiryStr, configPath string) error {
+func runTokenGenerate(subject, scopesStr, expiryStr, configPath, repo string) error {
 	cfg, err := loadAuthConfig(configPath)
 	if err != nil {
 		return err
 		}
 	}
-	scopes := parseAndConvertScopes(scopesStr)
+	scopes := parseAndConvertScopes(scopesStr, repo)
 	// Create auth service
 	log := zerowrap.New(zerowrap.Config{Level: "warn"})

A internal/adapters/in/cli/auth_scopes_test.go +33 -0

@@ -0,0 +1,33 @@
	1	+	package cli
	2	+
	3	+	import (
	4	+	"testing"
	5	+
	6	+	"github.com/stretchr/testify/assert"
	7	+	)
	8	+
	9	+	func TestParseAndConvertScopes_DefaultWildcard(t *testing.T) {
	10	+	got := parseAndConvertScopes("push,pull", "*")
	11	+	assert.Equal(t, []string{"repository:*:push,pull"}, got)
	12	+	}
	13	+
	14	+	func TestParseAndConvertScopes_SpecificRepo(t *testing.T) {
	15	+	got := parseAndConvertScopes("push,pull", "myapp")
	16	+	assert.Equal(t, []string{"repository:myapp:push,pull"}, got)
	17	+	}
	18	+
	19	+	func TestParseAndConvertScopes_SpecificRepoPushOnly(t *testing.T) {
	20	+	got := parseAndConvertScopes("push", "myapp")
	21	+	assert.Equal(t, []string{"repository:myapp:push"}, got)
	22	+	}
	23	+
	24	+	func TestParseAndConvertScopes_MixedWithAdminScopes(t *testing.T) {
	25	+	got := parseAndConvertScopes("push,pull,admin:routes:read", "myapp")
	26	+	assert.ElementsMatch(t, []string{"repository:myapp:push,pull", "admin:routes:read"}, got)
	27	+	}
	28	+
	29	+	func TestParseAndConvertScopes_AlreadyV2Format_RepoIgnored(t *testing.T) {
	30	+	// When scopes are already in v2 format, --repo is ignored (scopes returned as-is)
	31	+	got := parseAndConvertScopes("repository:specific:push", "*")
	32	+	assert.Equal(t, []string{"repository:specific:push"}, got)
	33	+	}

@@ -0,0 +1,33 @@
	1	+	package cli
	2	+
	3	+	import (
	4	+	"testing"
	5	+
	6	+	"github.com/stretchr/testify/assert"
	7	+	)
	8	+
	9	+	func TestParseAndConvertScopes_DefaultWildcard(t *testing.T) {
	10	+	got := parseAndConvertScopes("push,pull", "*")
	11	+	assert.Equal(t, []string{"repository:*:push,pull"}, got)
	12	+	}
	13	+
	14	+	func TestParseAndConvertScopes_SpecificRepo(t *testing.T) {
	15	+	got := parseAndConvertScopes("push,pull", "myapp")
	16	+	assert.Equal(t, []string{"repository:myapp:push,pull"}, got)
	17	+	}
	18	+
	19	+	func TestParseAndConvertScopes_SpecificRepoPushOnly(t *testing.T) {
	20	+	got := parseAndConvertScopes("push", "myapp")
	21	+	assert.Equal(t, []string{"repository:myapp:push"}, got)
	22	+	}
	23	+
	24	+	func TestParseAndConvertScopes_MixedWithAdminScopes(t *testing.T) {
	25	+	got := parseAndConvertScopes("push,pull,admin:routes:read", "myapp")
	26	+	assert.ElementsMatch(t, []string{"repository:myapp:push,pull", "admin:routes:read"}, got)
	27	+	}
	28	+
	29	+	func TestParseAndConvertScopes_AlreadyV2Format_RepoIgnored(t *testing.T) {
	30	+	// When scopes are already in v2 format, --repo is ignored (scopes returned as-is)
	31	+	got := parseAndConvertScopes("repository:specific:push", "*")
	32	+	assert.Equal(t, []string{"repository:specific:push"}, got)
	33	+	}