Provide opaque token by image check

Author: eikek

components/renku_data_services/notebooks/core_sessions.py

@@ -531,10 +531,8 @@ async def __requires_image_pull_secret(nb_config: NotebooksConfig, image: str, i
     return False
 
 
-def __format_image_pull_secret(secret_name: str, access_token: str, registry_domain: str) -> ExtraSecret:
-    registry_secret = {
-        "auths": {registry_domain: {"auth": base64.b64encode(f"oauth2:{access_token}".encode()).decode()}}
-    }
+def __format_image_pull_secret(secret_name: str, token: str, registry_domain: str) -> ExtraSecret:
+    registry_secret = {"auths": {registry_domain: {"auth": token}}}
     registry_secret = json.dumps(registry_secret)
     registry_secret = base64.b64encode(registry_secret.encode()).decode()
     return ExtraSecret(
@@ -561,7 +559,7 @@ async def __get_gitlab_image_pull_secret_v2(
 
     return __format_image_pull_secret(
         secret_name=secret_name,
-        access_token=image_check_result.token,
+        token=image_check_result.token,
         registry_domain=image_check_result.image_provider.registry_url,
     )
 

components/renku_data_services/notebooks/image_check.py

@@ -14,6 +14,7 @@
 
 from __future__ import annotations
 
+import base64
 from dataclasses import dataclass, field
 from typing import final
 
@@ -22,7 +23,7 @@
 from renku_data_services.app_config import logging
 from renku_data_services.base_models.core import APIUser
 from renku_data_services.connected_services.db import ConnectedServicesRepository
-from renku_data_services.connected_services.models import ImageProvider, OAuth2Client, OAuth2Connection
+from renku_data_services.connected_services.models import ImageProvider, OAuth2Client, OAuth2Connection, ProviderKind
 from renku_data_services.errors import errors
 from renku_data_services.notebooks.api.classes.image import Image, ImageRepoDockerAPI
 
@@ -111,10 +112,13 @@ async def check_image(image: Image, user: APIUser, connected_services: Connected
             logger.info(f"Error getting connected account: {e}")
             unauth_error = e
 
+    token = f"{reg_api.username}:{reg_api.oauth2_token}"
+    token = base64.b64encode(token.encode()).decode()
+
     return CheckResult(
         accessible=result == 200,
         response_code=result,
         image_provider=image_provider,
-        token=reg_api.oauth2_token,
+        token=token,
         error=unauth_error,
     )