[mscoutermarsh]

Add --cidrs on pscale service-token create and pscale service-token update so a service token can be limited to IPv4 addresses or CIDR ranges.

Details

Decisions

• Followed pscale password update --cidrs: a repeatable or comma-separated --cidrs flag. The field is omitted when the flag is not passed. A pointer to the slice is sent when it is, including an empty slice, so --cidrs "" clears the restriction instead of sending a blank entry.
• Added pscale service-token update <id> --cidrs. It sends PATCH /organizations/:organization/service-tokens/:id with body { "cidrs": [...] } and no other keys. There was no service-token update command before this.
• Addresses are not validated in the CLI. Anything that is not an IPv4 address or range is rejected by the API with HTTP 422 and the message IP restrictions must be a list of valid IPv4 addresses or ranges. That message is printed as-is.
• The list is printed with the token's other fields: a cidrs column on list, show, and create, and cidrs in JSON. show and update JSON keep the existing show shape and do not print the token secret. Human update prints IP restrictions: ... or IP restrictions: none, same as password update.
• duplicate prints cidrs when the response includes them. It does not send its own list. Copying the restriction onto the new token is left to the server.

Tests

• TestServiceToken_CreateCmd — create omits cidrs when the flag is absent.
• TestServiceToken_CreateCmdWithCIDRs — create sends the list and prints it.
• TestServiceTokens_CreateWithCIDRs — POST body is the cidrs array.
• TestServiceTokens_UpdateCIDRs — PATCH path and body are only { "cidrs": ["203.0.113.10/32"] }.
• TestServiceTokens_UpdateClearsCIDRs — an empty list is sent as { "cidrs": [] }, not omitted.
• TestServiceToken_UpdateCmdSetsCIDRs, TestServiceToken_UpdateCmdClearsCIDRs, TestServiceToken_UpdateCmdRequiresCIDRs — flag wiring, clear, and the missing-flag error. Update JSON includes cidrs and not the secret.
• TestServiceToken_ShowCmd and TestServiceToken_ShowCmdHuman — the list is in show JSON and in the human table.

Terminal capture (run against a local API; token values redacted)

$ pscale service-token create --org big-bang --name cli-demo-2 --cidrs 198.51.100.0/24,203.0.113.10
Creating service token in org big-bang
  ID             NAME         CIDRS                              TOKEN                                                    EXPIRES AT   CREATED AT  
 -------------- ------------ ---------------------------------- -------------------------------------------------------- ------------ ------------ 
  9h01epeu9lnm   cli-demo-2   198.51.100.0/24, 203.0.113.10/32   pscale_tkn_<redacted>                now         

[exit 0]

$ pscale service-token update 8j1uz4j5y8uj --org big-bang --cidrs 10.0.0.0/8,192.168.1.1
Updating service token 8j1uz4j5y8uj in org big-bang
Service token 8j1uz4j5y8uj was successfully updated.
IP restrictions: 10.0.0.0/8, 192.168.1.1/32
[exit 0]

$ pscale service-token show 8j1uz4j5y8uj --org big-bang
Fetching service token 8j1uz4j5y8uj from org big-bang
  ID             NAME       CIDRS                        LAST USED AT   LAST USED IP   LAST USED ORGANIZATION   EXPIRES AT   CREATED AT     
 -------------- ---------- ---------------------------- -------------- -------------- ------------------------ ------------ --------------- 
  8j1uz4j5y8uj   cli-demo   10.0.0.0/8, 192.168.1.1/32                                                                       9 seconds ago  

[exit 0]

$ pscale service-token update 8j1uz4j5y8uj --org big-bang --cidrs not-an-ip
Updating service token 8j1uz4j5y8uj in org big-bang
Error: IP restrictions must be a list of valid IPv4 addresses or ranges
[exit 2]

$ pscale service-token update 8j1uz4j5y8uj --org big-bang --cidrs ""
Updating service token 8j1uz4j5y8uj in org big-bang
Service token 8j1uz4j5y8uj was successfully updated.
IP restrictions: none
[exit 0]

$ pscale service-token show 8j1uz4j5y8uj --org big-bang
Fetching service token 8j1uz4j5y8uj from org big-bang
  ID             NAME       CIDRS   LAST USED AT   LAST USED IP   LAST USED ORGANIZATION   EXPIRES AT   CREATED AT      
 -------------- ---------- ------- -------------- -------------- ------------------------ ------------ ---------------- 
  8j1uz4j5y8uj   cli-demo                                                                               10 seconds ago  

[exit 0]

Skipped

• Locking pscale auth login to the current IP. That is a later change.
• Client-side parsing of addresses. The API already rejects a bad list.
• A duplicate-specific copy of the list.
• Updating the agent command guide.

Risks

• A later edit of the same PATCH must leave CIDRs nil unless it means to replace the list. Nil omits the field; a set pointer replaces it, and an empty slice clears it.
• --cidrs "" depends on the same flag behavior as password update. The clear test covers it.
• List and create JSON now include cidrs. It is null when the token has no restriction.

  

[cursor]

Risk: high. Cursor Bugbot completed with no findings (Security Agent was not present); this is not approved because it changes service-token IP access control. Human review is needed and no reviewers were assigned.

  

_{Sent by Cursor Approval Agent: cli-reviewer}