feat: add organization_id to token metadata and request logs (#2185) (!2959) · Merge requests · GitLab.org / container-registry

What does this MR do?

When GitLab Rails issues a registry token, it adds meta claims like project_id and root_namespace_id for each repository. The registry now also reads organization_id from those claims. It shows up in the request logs as meta_organization_id. The storage drivers get it too, the same way as the project and namespace IDs.

Rails doesn't send the claim yet. That's gitlab#598222, which I'm also working on. The two sides can be deployed in any order.

Decisions I made:

The value comes only from the pull access in the token, same as the project and namespace IDs.
With token auth, the log lines show meta_organization_id=0 until Rails sends the claim. Requests without token auth don't get the field at all.
The storage drivers only get the ID when it's above 0. None of them use it yet, so GCS and CDN signed URLs don't change. Adding it to those URLs can be a follow-up.
The field follows the meta.* naming of the other token IDs, so it logs as meta_organization_id. I didn't use labkit's gl_organization_id, because this repository is still on labkit v1.

This is not a breaking change, and it's safe to roll back. A token without the claim reads as 0, and nothing is stored.

I tested it by hand with a registry binary built from master and one built from this branch. Both ran with filesystem storage, no database, and token auth trusting a self-signed certificate. I signed a token whose pull access has "organization_id": 42 in meta, then sent one request:

$ curl -H "Authorization: Bearer $TOKEN" http://127.0.0.1:5077/v2/group/project/tags/list
{"errors":[{"code":"NAME_UNKNOWN","message":"repository name not known to registry","detail":{"name":"group/project"}}]}

The authorized request log line from master (trimmed):

level=info msg="authorized request" auth_project_paths="[]" auth_user_name=root auth_user_type=gitlab_or_ldap ... root_repo=group vars_name=group/project

The same line from this branch:

level=info msg="authorized request" auth_project_paths="[]" auth_user_name=root auth_user_type=gitlab_or_ldap ... meta_organization_id=42 root_repo=group vars_name=group/project

With a token that has no organization_id, the branch build logs meta_organization_id=0.

I added unit tests for reading the claim from a signed token and for a pull access without it. Another one checks that a zero ID stays out of the storage options. I ran the two touched packages that have tests:

$ go test -count=1 ./registry/auth/token/
ok  	github.com/docker/distribution/registry/auth/token	0.015s
$ go test -count=1 -short ./registry/storage/
ok  	github.com/docker/distribution/registry/storage	11.964s

gofumpt -l -extra on the changed files and go vet on both packages printed nothing. I didn't run golangci-lint, make test, the integration tests or make validate-log-fields locally. Some of them need Docker, Postgres or Redis, so I'm leaving them to the pipeline.

Implemented with AI assistance; I reviewed and tested the changes.

Closes #2185 (closed)

Rails side: gitlab#598222

Author checklist

Documentation/resources

Code review guidelines

Go Style guidelines

Feature flags

When documentation is required

Documentation workflow

Reviewer checklist

Ensure the commit and MR tittle are still accurate.
If the change contains a breaking change, verify the breaking change label.
If the change is considered high risk, verify the label high-risk-change
Identify if the change can be rolled back safely. (note: all other reasons for not being able to rollback will be sufficiently captured by major version changes).

Edited Oct 10, 2026 by Hamza Hassanain

feat: add organization_id to token metadata and request logs (#2185)

What does this MR do?

Author checklist

Reviewer checklist

Merge request reports