From 94f01ebed9cf12008bdaf51a50457c123b6bdb00 Mon Sep 17 00:00:00 2001
From: Cole Helbling <cole.helbling@determinate.systems>
Date: Tue, 8 Oct 2024 07:46:16 -0700
Subject: [PATCH] fixup: rename flag to `--use-scoped-token`, default to true

---
 src/cli/cmd/apply/mod.rs | 20 +++++++++-----------
 1 file changed, 9 insertions(+), 11 deletions(-)

diff --git a/src/cli/cmd/apply/mod.rs b/src/cli/cmd/apply/mod.rs
index 6131648..d5b78f9 100644
--- a/src/cli/cmd/apply/mod.rs
+++ b/src/cli/cmd/apply/mod.rs
@@ -25,8 +25,9 @@ pub(crate) struct ApplySubcommand {
     #[clap(subcommand)]
     system: System,
 
-    #[clap(long, default_value_t = false)]
-    request_restricted_token: bool,
+    /// Use a scoped token generated by FlakeHub that allows substituting the given output _only_.
+    #[clap(long, default_value_t = true)]
+    use_scoped_token: bool,
 
     #[clap(from_global)]
     api_addr: url::Url,
@@ -84,12 +85,9 @@ impl CommandExecute for ApplySubcommand {
 
         tracing::info!("Resolving {}", output_ref);
 
-        let resolved_path = FlakeHubClient::resolve(
-            self.api_addr.as_ref(),
-            &output_ref,
-            self.request_restricted_token,
-        )
-        .await?;
+        let resolved_path =
+            FlakeHubClient::resolve(self.api_addr.as_ref(), &output_ref, self.use_scoped_token)
+                .await?;
 
         tracing::debug!(
             "Successfully resolved reference {} to path {}",
@@ -100,7 +98,7 @@ impl CommandExecute for ApplySubcommand {
         let profile_path = applyer.profile_path();
 
         match resolved_path.token {
-            Some(token) if self.request_restricted_token => {
+            Some(token) if self.use_scoped_token => {
                 let mut nix_args = vec![
                     "copy".to_string(),
                     "--from".to_string(),
@@ -137,12 +135,12 @@ impl CommandExecute for ApplySubcommand {
 
                 dir.close()?;
             }
-            None if self.request_restricted_token => {
+            None if self.use_scoped_token => {
                 return Err(color_eyre::eyre::eyre!(
                     "FlakeHub did not return a restricted token!"
                 ));
             }
-            Some(_) if !self.request_restricted_token => {
+            Some(_) if !self.use_scoped_token => {
                 tracing::warn!(
                     "Received a restricted token from FlakeHub, but we didn't request one! Ignoring."
                 );