From feda177b6a75ecd91266046b6cebe5da995637f5 Mon Sep 17 00:00:00 2001
From: Graham Christensen <graham@grahamc.com>
Date: Tue, 5 Nov 2024 20:51:43 -0500
Subject: [PATCH] Replace --use-scoped-token with --no-scoped-token

---
 src/cli/cmd/apply/mod.rs | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/src/cli/cmd/apply/mod.rs b/src/cli/cmd/apply/mod.rs
index 59480f1..ec5b37f 100644
--- a/src/cli/cmd/apply/mod.rs
+++ b/src/cli/cmd/apply/mod.rs
@@ -25,9 +25,10 @@ pub(crate) struct ApplySubcommand {
     #[clap(subcommand)]
     system: System,
 
-    /// Use a scoped token generated by FlakeHub that allows substituting the given output _only_.
-    #[clap(long, default_value_t = true)]
-    use_scoped_token: bool,
+    /// By default, fh apply exchanges its API token for a tightly scoped token generated by FlakeHub that _only_ allows substituting the given output.
+    /// Pass --no-scoped-token to use the system's FlakeHub token, and not perform exchanging for a tightly scoped token.
+    #[clap(long, default_value_t = false)]
+    no_scoped_token: bool,
 
     #[clap(from_global)]
     api_addr: url::Url,
@@ -86,7 +87,7 @@ impl CommandExecute for ApplySubcommand {
         tracing::info!(%output_ref, "Resolving output reference");
 
         let resolved_path =
-            FlakeHubClient::resolve(self.api_addr.as_ref(), &output_ref, self.use_scoped_token)
+            FlakeHubClient::resolve(self.api_addr.as_ref(), &output_ref, !self.no_scoped_token)
                 .await?;
 
         tracing::debug!(
@@ -99,7 +100,7 @@ impl CommandExecute for ApplySubcommand {
 
         match resolved_path.token {
             Some(token) => {
-                if self.use_scoped_token {
+                if !self.no_scoped_token {
                     let mut nix_args = vec![
                         "copy".to_string(),
                         "--option".to_string(),
@@ -168,7 +169,7 @@ impl CommandExecute for ApplySubcommand {
                 }
             }
             None => {
-                if self.use_scoped_token {
+                if !self.no_scoped_token {
                     return Err(color_eyre::eyre::eyre!(
                         "FlakeHub did not return a restricted token!"
                     ));