feat(api-token): allow org-level tokens to manage project-scoped tokens by Piskoo · Pull Request #2811 · chainloop-dev/chainloop

Piskoo · 2026-03-03T11:28:38Z

Org-level API tokens can now create, list, and revoke project-scoped API tokens.

🟢 Create project-scoped token with org-scoped token

$ chainloop org api-token create --name testorgcreate --project myproject --token <new org token>
WRN API contacted in insecure mode
INF API token provided to the command line
┌──────────────────────────────────────┬───────────────┬───────────────────┬─────────────┬─────────────────────┬────────────┬────────────┬──────────────┐
│ ID                                   │ NAME          │ SCOPE             │ DESCRIPTION │ CREATED AT          │ EXPIRES AT │ REVOKED AT │ LAST USED AT │
├──────────────────────────────────────┼───────────────┼───────────────────┼─────────────┼─────────────────────┼────────────┼────────────┼──────────────┤
│ c2a8395c-c42e-41c2-bbf9-521dbe7955d5 │ testorgcreate │ project/myproject │             │ 03 Mar 26 11:06 UTC │            │            │              │
└──────────────────────────────────────┴───────────────┴───────────────────┴─────────────┴─────────────────────┴────────────┴──────────────┴──────────────┘

Save the following token since it will not printed again:

<project token>

🔴 Create project-scoped token with project-scoped token

$ chainloop org api-token create --name testorgcreate --project myproject --token <project token>
WRN API contacted in insecure mode
INF API token provided to the command line
ERR operation not allowed
exit status 1

🔴 Create org-scoped token with project-scoped token

$ chainloop org api-token create --name testorgcreate --token <project token>
WRN API contacted in insecure mode
INF API token provided to the command line
ERR operation not allowed
exit status 1

🟢 List tokens with org-scoped token

$ chainloop org api-token ls --token <org token>
WRN API contacted in insecure mode
INF API token provided to the command line
┌──────────────────────────────────────┬───────────────┬───────────────────┬─────────────┬─────────────────────┬────────────┬────────────┬─────────────────────┐
│ ID                                   │ NAME          │ SCOPE             │ DESCRIPTION │ CREATED AT          │ EXPIRES AT │ REVOKED AT │ LAST USED AT        │
├──────────────────────────────────────┼───────────────┼───────────────────┼─────────────┼─────────────────────┼────────────┼────────────┼─────────────────────┤
│ c2a8395c-c42e-41c2-bbf9-521dbe7955d5 │ testorgcreate │ project/myproject │             │ 03 Mar 26 11:06 UTC │            │            │ 03 Mar 26 11:07 UTC │
└──────────────────────────────────────┴───────────────┴───────────────────┴─────────────┴─────────────────────┴────────────┴────────────┴─────────────────────┘

🔴 List tokens with project-scoped token

$ chainloop org api-token ls --token <project token>
WRN API contacted in insecure mode
INF API token provided to the command line
ERR operation not allowed
exit status 1

🔴 Revoke project-scoped token with project-scoped token

$ chainloop org api-token revoke --id c2a8395c-c42e-41c2-bbf9-521dbe7955d5 --token <project token>
WRN API contacted in insecure mode
INF API token provided to the command line
ERR operation not allowed
exit status 1

🟢 Revoke project-scoped token with org-scoped token

$ chainloop org api-token revoke --id c2a8395c-c42e-41c2-bbf9-521dbe7955d5 --token <org token>
WRN API contacted in insecure mode
INF API token provided to the command line
INF API token revoked!

🟢 Create project-scoped token with org-scoped token that was created in the past (List and revoke also works)

$ chainloop org api-token create --name witholdtoken --project myproject --token <org2 token>
WRN API contacted in insecure mode
INF API token provided to the command line
┌──────────────────────────────────────┬──────────────┬───────────────────┬─────────────┬─────────────────────┬────────────┬────────────┬──────────────┐
│ ID                                   │ NAME         │ SCOPE             │ DESCRIPTION │ CREATED AT          │ EXPIRES AT │ REVOKED AT │ LAST USED AT │
├──────────────────────────────────────┼──────────────┼───────────────────┼─────────────┼─────────────────────┼────────────┼────────────┼──────────────┤
│ 13db0c20-044e-4d64-aaee-4c97a6d80ef4 │ witholdtoken │ project/myproject │             │ 03 Mar 26 11:16 UTC │            │            │              │
└──────────────────────────────────────┴──────────────┴───────────────────┴─────────────┴─────────────────────┴────────────┴────────────┴──────────────┘

Save the following token since it will not printed again:

<project token>

Closes #2808

Signed-off-by: Sylwester Piskozub <sylwesterpiskozub@gmail.com>

cubic-dev-ai

1 issue found across 5 files

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="app/controlplane/internal/service/apitoken_test.go">

<violation number="1" location="app/controlplane/internal/service/apitoken_test.go:70">
P2: This test duplicates the service's authorization logic inline rather than calling `svc.List()`. It will pass even if the actual `List` method is broken or its authorization logic changes, providing false confidence. The same issue applies to `TestAPITokenService_Revoke_OrgTokenCannotRevokeOrgTokens` below. Consider using mocks for `APITokenUseCase` (e.g., via an interface or testify mock) so the tests exercise the real service methods end-to-end.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

cubic-dev-ai · 2026-03-03T11:40:35Z

app/controlplane/internal/service/apitoken_test.go

+			ctx := context.Background()
+			ctx = entities.WithCurrentAPIToken(ctx, tc.token)
+
+			scope := mapTokenScope(pb.APITokenServiceListRequest_SCOPE_UNSPECIFIED)


P2: This test duplicates the service's authorization logic inline rather than calling svc.List(). It will pass even if the actual List method is broken or its authorization logic changes, providing false confidence. The same issue applies to TestAPITokenService_Revoke_OrgTokenCannotRevokeOrgTokens below. Consider using mocks for APITokenUseCase (e.g., via an interface or testify mock) so the tests exercise the real service methods end-to-end.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At app/controlplane/internal/service/apitoken_test.go, line 70: <comment>This test duplicates the service's authorization logic inline rather than calling `svc.List()`. It will pass even if the actual `List` method is broken or its authorization logic changes, providing false confidence. The same issue applies to `TestAPITokenService_Revoke_OrgTokenCannotRevokeOrgTokens` below. Consider using mocks for `APITokenUseCase` (e.g., via an interface or testify mock) so the tests exercise the real service methods end-to-end.</comment> <file context> @@ -0,0 +1,132 @@ + ctx := context.Background() + ctx = entities.WithCurrentAPIToken(ctx, tc.token) + + scope := mapTokenScope(pb.APITokenServiceListRequest_SCOPE_UNSPECIFIED) + if token := entities.CurrentAPIToken(ctx); token != nil && token.ProjectID == nil { + scope = biz.APITokenScopeProject </file context>

Signed-off-by: Sylwester Piskozub <sylwesterpiskozub@gmail.com>

cubic-dev-ai

1 issue found across 1 file (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="app/controlplane/pkg/biz/apitoken_integration_test.go">

<violation number="1" location="app/controlplane/pkg/biz/apitoken_integration_test.go:153">
P2: Unsafe `append` may mutate `s.APIToken.DefaultAuthzPolicies`. In Go, `append` reuses the underlying array when capacity permits, which would silently corrupt the shared `DefaultAuthzPolicies` field. The production code already has a safe helper `withOrgLevelPolicies` (apitoken.go:47) — consider using it here, or copy the slice first.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

app/controlplane/pkg/biz/apitoken_integration_test.go

Signed-off-by: Sylwester Piskozub <sylwesterpiskozub@gmail.com>

migmartri · 2026-03-03T16:21:41Z

app/controlplane/internal/service/apitoken.go

 	}

+	// Org-level API tokens can only create project-scoped tokens
+	if token := entities.CurrentAPIToken(ctx); token != nil && token.ProjectID == nil {


how come we didn't need to change anything in the middleware or in authz.go?

migmartri · 2026-03-03T16:23:15Z

app/controlplane/pkg/biz/apitoken.go


+// OrgLevelAPITokenPolicies are additional policies granted only to org-level tokens.
+// They allow managing project-scoped tokens.
+var OrgLevelAPITokenPolicies = []*authz.Policy{


why is this var exposed?

migmartri · 2026-03-03T16:23:33Z

app/controlplane/pkg/biz/apitoken.go

+}
+
+// withOrgLevelPolicies returns a new slice with OrgLevelAPITokenPolicies appended.
+func withOrgLevelPolicies(policies []*authz.Policy) []*authz.Policy {


this doesn't look that useful?

migmartri · 2026-03-03T16:24:02Z

app/controlplane/pkg/biz/apitoken.go


+	// Org-level tokens additionally get project-level API token management policies
+	if projectID == nil && orgUUID != nil {
+		policies = withOrgLevelPolicies(policies)


I'd personally just add the policies here, being very explicit saying that org level API tokens can manage project tokens.

migmartri · 2026-03-03T16:24:27Z

app/controlplane/pkg/biz/apitoken.go

+// OrgLevelAPITokenPolicies are additional policies granted only to org-level tokens.
+// They allow managing project-scoped tokens.
+var OrgLevelAPITokenPolicies = []*authz.Policy{
+	authz.PolicyAPITokenCreate,


I'd call this PolicyProjectLevelAPITokenCreate since it's only project level tokens

migmartri · 2026-03-03T16:25:40Z

app/controlplane/internal/service/apitoken.go

 	}

+	// Org-level API tokens can only create project-scoped tokens
+	if token := entities.CurrentAPIToken(ctx); token != nil && token.ProjectID == nil {


this is something that could be done with Enforce otherwise the policies are worthless no?

Piskoo added 2 commits March 3, 2026 12:19

allow org tokens to create project tokens

fc57a0d

Signed-off-by: Sylwester Piskozub <sylwesterpiskozub@gmail.com>

rm config; add atlas

1a6ad75

Signed-off-by: Sylwester Piskozub <sylwesterpiskozub@gmail.com>

Piskoo marked this pull request as ready for review March 3, 2026 11:37

Piskoo requested review from jiparis and migmartri March 3, 2026 11:37

cubic-dev-ai bot reviewed Mar 3, 2026

View reviewed changes

fix test

c3bfddc

Signed-off-by: Sylwester Piskozub <sylwesterpiskozub@gmail.com>

cubic-dev-ai bot reviewed Mar 3, 2026

View reviewed changes

app/controlplane/pkg/biz/apitoken_integration_test.go Outdated Show resolved Hide resolved

lint

bfe1290

Signed-off-by: Sylwester Piskozub <sylwesterpiskozub@gmail.com>

migmartri reviewed Mar 3, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(api-token): allow org-level tokens to manage project-scoped tokens#2811

feat(api-token): allow org-level tokens to manage project-scoped tokens#2811
Piskoo wants to merge 4 commits intochainloop-dev:mainfrom
Piskoo:pfm-4759

Piskoo commented Mar 3, 2026 •

edited

Loading

Uh oh!

cubic-dev-ai bot left a comment

Uh oh!

cubic-dev-ai bot Mar 3, 2026 •

edited

Loading

Uh oh!

cubic-dev-ai bot left a comment

Uh oh!

Uh oh!

migmartri Mar 3, 2026

Uh oh!

migmartri Mar 3, 2026

Uh oh!

migmartri Mar 3, 2026

Uh oh!

migmartri Mar 3, 2026

Uh oh!

migmartri Mar 3, 2026

Uh oh!

migmartri Mar 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Piskoo commented Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

migmartri Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

migmartri Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

migmartri Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

migmartri Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

migmartri Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

migmartri Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Piskoo commented Mar 3, 2026 •

edited

Loading

cubic-dev-ai bot Mar 3, 2026 •

edited

Loading