Merge branch '353555-nested-repositories-container-registry-token' into 'master'

Add support for the nested repositories container registry access token

See merge request gitlab-org/gitlab!83756

app/services/auth/container_registry_authentication_service.rb

@@ -50,6 +50,12 @@ module Auth
       access_token(['pull'], names)
     end
 
+    def self.pull_nested_repositories_access_token(name)
+      name = name.chomp('/') if name.end_with?('/')
+      paths = [name, "#{name}/*"]
+      access_token(['pull'], paths)
+    end
+
     def self.access_token(actions, names, type = 'repository')
       names = names.flatten
       registry = Gitlab.config.registry

spec/support/shared_examples/services/container_registry_auth_service_shared_examples.rb

@@ -204,6 +204,46 @@ RSpec.shared_examples 'a container registry auth service' do
     it_behaves_like 'not a container repository factory'
   end
 
+  describe '.pull_nested_repositories_access_token' do
+    let_it_be(:project) { create(:project) }
+
+    let(:token) { described_class.pull_nested_repositories_access_token(project.full_path) }
+    let(:access) do
+      [
+        {
+          'type' => 'repository',
+          'name' => project.full_path,
+          'actions' => ['pull']
+        },
+        {
+          'type' => 'repository',
+          'name' => "#{project.full_path}/*",
+          'actions' => ['pull']
+        }
+      ]
+    end
+
+    subject { { token: token } }
+
+    it 'has the correct scope' do
+      expect(payload).to include('access' => access)
+    end
+
+    it_behaves_like 'a valid token'
+    it_behaves_like 'not a container repository factory'
+
+    context 'with path ending with a slash' do
+      let(:token) { described_class.pull_nested_repositories_access_token("#{project.full_path}/") }
+
+      it 'has the correct scope' do
+        expect(payload).to include('access' => access)
+      end
+
+      it_behaves_like 'a valid token'
+      it_behaves_like 'not a container repository factory'
+    end
+  end
+
   context 'user authorization' do
     let_it_be(:current_user) { create(:user) }