From a7762944c0ef5b9108725aa0f1d6a74aa7e45407 Mon Sep 17 00:00:00 2001
From: isaac-hammes <isaac.hammes@puppet.com>
Date: Mon, 13 Jul 2026 12:42:53 -0400
Subject: [PATCH] (maint) Accept ARTIFACTORY_ACCESS_TOKEN in
 check_authorization

JFrog deprecated API-key authentication and blocked new API-key
creation in Artifactory 7.98. The bundled puppet-artifactory-client
SDK already accepts an access token via the ARTIFACTORY_ACCESS_TOKEN
env var, but check_authorization here only recognized
ARTIFACTORY_USERNAME/PASSWORD or ARTIFACTORY_API_KEY. Callers that
had migrated to a scoped access token or reference token would hit
the "unable to determine credentials" error even though the
underlying SDK would authenticate fine.

Add ARTIFACTORY_ACCESS_TOKEN to the accepted set and update the
error message to guide new callers toward it while noting
ARTIFACTORY_API_KEY as deprecated.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 CHANGELOG.md                           |  4 ++++
 lib/packaging/artifactory.rb           | 13 ++++++++-----
 spec/lib/packaging/artifactory_spec.rb | 24 +++++++++++++++++++++---
 3 files changed, 33 insertions(+), 8 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5c40e501..99c7a102 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,10 @@ This changelog adheres to [Keep a CHANGELOG](http://keepachangelog.com).
 
 ## [Unreleased]
 ### Added
+- (maint) Accept `ARTIFACTORY_ACCESS_TOKEN` in `check_authorization` so callers can authenticate
+  with a scoped access token or reference token. `ARTIFACTORY_API_KEY` is still accepted for
+  backwards compatibility, but JFrog has deprecated API-key auth (blocked new keys in Artifactory
+  7.98) and callers should migrate.
 - (maint) Provide a mechanism, by way of a new environment variable `PACKAGING_GITREF_REPLACEMENT`,
   which allows us to not require a release tag before building product.
 
diff --git a/lib/packaging/artifactory.rb b/lib/packaging/artifactory.rb
index 885ce6c2..3f60716f 100644
--- a/lib/packaging/artifactory.rb
+++ b/lib/packaging/artifactory.rb
@@ -134,7 +134,9 @@ def rpm_repo_contents(platform_tag)
     # Verify the correct environment variables are set in order to process
     # authorization to access the artifactory repos
     def check_authorization
-      unless (ENV['ARTIFACTORY_USERNAME'] && ENV['ARTIFACTORY_PASSWORD']) || ENV['ARTIFACTORY_API_KEY']
+      unless (ENV['ARTIFACTORY_USERNAME'] && ENV['ARTIFACTORY_PASSWORD']) ||
+             ENV['ARTIFACTORY_ACCESS_TOKEN'] ||
+             ENV['ARTIFACTORY_API_KEY']
         raise <<-DOC
   Unable to determine credentials for Artifactory. Please set one of the
   following environment variables:
@@ -143,10 +145,11 @@ def check_authorization
   ARTIFACTORY_USERNAME
   ARTIFACTORY_PASSWORD
 
-  If you would like to use the API key, ensure ARTIFACTORY_USERNAME and
-  ARTIFACTORY_PASSWORD are not set, as these take precedence. Instead, please
-  set:
-  ARTIFACTORY_API_KEY
+  For scoped access token or reference token authentication, please set:
+  ARTIFACTORY_ACCESS_TOKEN
+
+  ARTIFACTORY_API_KEY is also accepted for backwards compatibility, but is
+  deprecated by JFrog and should be migrated to ARTIFACTORY_ACCESS_TOKEN.
 
   You can also set the path to a pem file with your custom certificates with:
   ARTIFACTORY_SSL_PEM_FILE
diff --git a/spec/lib/packaging/artifactory_spec.rb b/spec/lib/packaging/artifactory_spec.rb
index 0d7c8ba8..3f432d5f 100644
--- a/spec/lib/packaging/artifactory_spec.rb
+++ b/spec/lib/packaging/artifactory_spec.rb
@@ -200,11 +200,29 @@
   end
 
   describe '#check_authorization' do
+    let(:auth_env_vars) {
+      %w[ARTIFACTORY_USERNAME ARTIFACTORY_PASSWORD ARTIFACTORY_ACCESS_TOKEN ARTIFACTORY_API_KEY]
+    }
+
+    around(:each) do |example|
+      originals = auth_env_vars.each_with_object({}) { |k, h| h[k] = ENV[k] }
+      auth_env_vars.each { |k| ENV[k] = nil }
+      example.run
+      originals.each { |k, v| ENV[k] = v }
+    end
+
     it 'fails gracefully if authorization is not set' do
-      original_artifactory_api_key = ENV['ARTIFACTORY_API_KEY']
-      ENV['ARTIFACTORY_API_KEY'] = nil
       expect { artifact.deploy_package('path/to/el/7/x86_64/package.rpm') }.to raise_error
-      ENV['ARTIFACTORY_API_KEY'] = original_artifactory_api_key
+    end
+
+    it 'accepts ARTIFACTORY_ACCESS_TOKEN as an auth source' do
+      ENV['ARTIFACTORY_ACCESS_TOKEN'] = 'anaccesstokenthatdefinitelyworks'
+      expect { artifact.send(:check_authorization) }.not_to raise_error
+    end
+
+    it 'still accepts ARTIFACTORY_API_KEY for backwards compatibility' do
+      ENV['ARTIFACTORY_API_KEY'] = 'anapikeythatdefinitelyworks'
+      expect { artifact.send(:check_authorization) }.not_to raise_error
     end
   end
 end