feat(api-token): allow org-level tokens to manage project-scoped tokens by Piskoo · Pull Request #2811 · chainloop-dev/chainloop

Piskoo · 2026-03-03T11:28:38Z

Org-level API tokens can now create, list, and revoke project-scoped API tokens.

🟢 Create project-scoped token with org-scoped token

$ chainloop org api-token create --name testorgcreate --project myproject --token <new org token>
WRN API contacted in insecure mode
INF API token provided to the command line
┌──────────────────────────────────────┬───────────────┬───────────────────┬─────────────┬─────────────────────┬────────────┬────────────┬──────────────┐
│ ID                                   │ NAME          │ SCOPE             │ DESCRIPTION │ CREATED AT          │ EXPIRES AT │ REVOKED AT │ LAST USED AT │
├──────────────────────────────────────┼───────────────┼───────────────────┼─────────────┼─────────────────────┼────────────┼────────────┼──────────────┤
│ c2a8395c-c42e-41c2-bbf9-521dbe7955d5 │ testorgcreate │ project/myproject │             │ 03 Mar 26 11:06 UTC │            │            │              │
└──────────────────────────────────────┴───────────────┴───────────────────┴─────────────┴─────────────────────┴────────────┴──────────────┴──────────────┘

Save the following token since it will not printed again:

<project token>

🔴 Create project-scoped token with project-scoped token

$ chainloop org api-token create --name testorgcreate --project myproject --token <project token>
WRN API contacted in insecure mode
INF API token provided to the command line
ERR operation not allowed
exit status 1

🔴 Create org-scoped token with project-scoped token

$ chainloop org api-token create --name testorgcreate --token <project token>
WRN API contacted in insecure mode
INF API token provided to the command line
ERR operation not allowed
exit status 1

🟢 List tokens with org-scoped token

$ chainloop org api-token ls --token <org token>
WRN API contacted in insecure mode
INF API token provided to the command line
┌──────────────────────────────────────┬───────────────┬───────────────────┬─────────────┬─────────────────────┬────────────┬────────────┬─────────────────────┐
│ ID                                   │ NAME          │ SCOPE             │ DESCRIPTION │ CREATED AT          │ EXPIRES AT │ REVOKED AT │ LAST USED AT        │
├──────────────────────────────────────┼───────────────┼───────────────────┼─────────────┼─────────────────────┼────────────┼────────────┼─────────────────────┤
│ c2a8395c-c42e-41c2-bbf9-521dbe7955d5 │ testorgcreate │ project/myproject │             │ 03 Mar 26 11:06 UTC │            │            │ 03 Mar 26 11:07 UTC │
└──────────────────────────────────────┴───────────────┴───────────────────┴─────────────┴─────────────────────┴────────────┴────────────┴─────────────────────┘

🔴 List tokens with project-scoped token

$ chainloop org api-token ls --token <project token>
WRN API contacted in insecure mode
INF API token provided to the command line
ERR operation not allowed
exit status 1

🔴 Revoke project-scoped token with project-scoped token

$ chainloop org api-token revoke --id c2a8395c-c42e-41c2-bbf9-521dbe7955d5 --token <project token>
WRN API contacted in insecure mode
INF API token provided to the command line
ERR operation not allowed
exit status 1

🟢 Revoke project-scoped token with org-scoped token

$ chainloop org api-token revoke --id c2a8395c-c42e-41c2-bbf9-521dbe7955d5 --token <org token>
WRN API contacted in insecure mode
INF API token provided to the command line
INF API token revoked!

🟢 Create project-scoped token with org-scoped token that was created in the past (List and revoke also works)

$ chainloop org api-token create --name witholdtoken --project myproject --token <org2 token>
WRN API contacted in insecure mode
INF API token provided to the command line
┌──────────────────────────────────────┬──────────────┬───────────────────┬─────────────┬─────────────────────┬────────────┬────────────┬──────────────┐
│ ID                                   │ NAME         │ SCOPE             │ DESCRIPTION │ CREATED AT          │ EXPIRES AT │ REVOKED AT │ LAST USED AT │
├──────────────────────────────────────┼──────────────┼───────────────────┼─────────────┼─────────────────────┼────────────┼────────────┼──────────────┤
│ 13db0c20-044e-4d64-aaee-4c97a6d80ef4 │ witholdtoken │ project/myproject │             │ 03 Mar 26 11:16 UTC │            │            │              │
└──────────────────────────────────────┴──────────────┴───────────────────┴─────────────┴─────────────────────┴────────────┴────────────┴──────────────┘

Save the following token since it will not printed again:

<project token>

Closes #2808

Signed-off-by: Sylwester Piskozub <[email protected]>

cubic-dev-ai

1 issue found across 5 files

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="app/controlplane/internal/service/apitoken_test.go">

<violation number="1" location="app/controlplane/internal/service/apitoken_test.go:70">
P2: This test duplicates the service's authorization logic inline rather than calling `svc.List()`. It will pass even if the actual `List` method is broken or its authorization logic changes, providing false confidence. The same issue applies to `TestAPITokenService_Revoke_OrgTokenCannotRevokeOrgTokens` below. Consider using mocks for `APITokenUseCase` (e.g., via an interface or testify mock) so the tests exercise the real service methods end-to-end.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

app/controlplane/internal/service/apitoken_test.go

Signed-off-by: Sylwester Piskozub <[email protected]>

cubic-dev-ai

1 issue found across 1 file (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="app/controlplane/pkg/biz/apitoken_integration_test.go">

<violation number="1" location="app/controlplane/pkg/biz/apitoken_integration_test.go:153">
P2: Unsafe `append` may mutate `s.APIToken.DefaultAuthzPolicies`. In Go, `append` reuses the underlying array when capacity permits, which would silently corrupt the shared `DefaultAuthzPolicies` field. The production code already has a safe helper `withOrgLevelPolicies` (apitoken.go:47) — consider using it here, or copy the slice first.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

app/controlplane/pkg/biz/apitoken_integration_test.go

Signed-off-by: Sylwester Piskozub <[email protected]>

app/controlplane/internal/service/apitoken.go

app/controlplane/pkg/biz/apitoken.go

migmartri · 2026-03-03T16:24:27Z

app/controlplane/pkg/biz/apitoken.go

+// OrgLevelAPITokenPolicies are additional policies granted only to org-level tokens.
+// They allow managing project-scoped tokens.
+var OrgLevelAPITokenPolicies = []*authz.Policy{
+	authz.PolicyAPITokenCreate,


I'd call this PolicyProjectLevelAPITokenCreate since it's only project level tokens

I was mentioning this above. We can create this specific resource, and then calling the enforcer directly from the service (instead of checking token!=nil && token.ProjectId == nil ...)

But this one is needed for the middleware to let the request pass.

migmartri · 2026-03-03T16:25:40Z

app/controlplane/internal/service/apitoken.go

 	}

+	// Org-level API tokens can only create project-scoped tokens
+	if token := entities.CurrentAPIToken(ctx); token != nil && token.ProjectID == nil {


this is something that could be done with Enforce otherwise the policies are worthless no?

Signed-off-by: Sylwester Piskozub <[email protected]>

cubic-dev-ai

1 issue found across 2 files (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="app/controlplane/pkg/biz/apitoken_integration_test.go">

<violation number="1" location="app/controlplane/pkg/biz/apitoken_integration_test.go:153">
P2: Missing total policy count assertion in the org-level token test. The project-level subtest correctly checks `s.Len(token.Policies, len(s.APIToken.DefaultAuthzPolicies))`, but the org-level subtest only verifies that certain policies are present without asserting the total count. This weakens the test — extra unintended policies on org tokens won't be caught. Consider adding a `Len` check here, consistent with the project-level subtest and the old test.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

app/controlplane/pkg/biz/apitoken_integration_test.go

jiparis · 2026-03-04T15:37:17Z

app/controlplane/internal/service/apitoken.go

+	// Org-level API tokens can only create project-scoped tokens
+	if token := entities.CurrentAPIToken(ctx); token != nil && token.ProjectID == nil {
+		if !req.ProjectReference.IsSet() {
+			return nil, errors.Forbidden("forbidden", "org-level API tokens must specify a project when creating new tokens")


so this special case is needed because we now allow org tokens to pass.

jiparis · 2026-03-04T15:39:31Z

app/controlplane/internal/service/apitoken.go

 	}

-	tokens, err := s.APITokenUseCase.List(ctx, currentOrg.ID, biz.WithAPITokenStatusFilter(mapTokenStatusFilter(req.GetStatusFilter())), biz.WithAPITokenProjectFilter(defaultProjectFilter), biz.WithAPITokenScope(mapTokenScope(req.Scope)))
+	// Org-level API tokens can only see project-scoped tokens


Perhaps we can simplify all of this with a new resource "ProjectApiToken" and enforcing that specific permission.

jiparis · 2026-03-04T15:41:02Z

app/controlplane/pkg/biz/apitoken.go

+// OrgLevelAPITokenPolicies are additional policies granted only to org-level tokens.
+// They allow managing project-scoped tokens.
+var OrgLevelAPITokenPolicies = []*authz.Policy{
+	authz.PolicyAPITokenCreate,


I was mentioning this above. We can create this specific resource, and then calling the enforcer directly from the service (instead of checking token!=nil && token.ProjectId == nil ...)

migmartri · 2026-03-04T18:00:59Z

Thanks

Piskoo added 2 commits March 3, 2026 12:19

allow org tokens to create project tokens

fc57a0d

Signed-off-by: Sylwester Piskozub <[email protected]>

rm config; add atlas

1a6ad75

Signed-off-by: Sylwester Piskozub <[email protected]>

Piskoo marked this pull request as ready for review March 3, 2026 11:37

Piskoo requested review from jiparis and migmartri March 3, 2026 11:37

cubic-dev-ai bot reviewed Mar 3, 2026

View reviewed changes

app/controlplane/internal/service/apitoken_test.go Show resolved Hide resolved

fix test

c3bfddc

Signed-off-by: Sylwester Piskozub <[email protected]>

cubic-dev-ai bot reviewed Mar 3, 2026

View reviewed changes

app/controlplane/pkg/biz/apitoken_integration_test.go Outdated Show resolved Hide resolved

lint

bfe1290

Signed-off-by: Sylwester Piskozub <[email protected]>

migmartri reviewed Mar 3, 2026

View reviewed changes

refactor

6de09ca

Signed-off-by: Sylwester Piskozub <[email protected]>

cubic-dev-ai bot reviewed Mar 4, 2026

View reviewed changes

app/controlplane/pkg/biz/apitoken_integration_test.go Show resolved Hide resolved

jiparis reviewed Mar 4, 2026

View reviewed changes

jiparis approved these changes Mar 4, 2026

View reviewed changes

migmartri merged commit 22932b1 into chainloop-dev:main Mar 4, 2026
15 checks passed

Conversation

Piskoo commented Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

migmartri Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

jiparis Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

jiparis Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

migmartri Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jiparis Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

jiparis Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

jiparis Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

migmartri commented Mar 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Piskoo commented Mar 3, 2026 •

edited

Loading