integration/tag: Use subtests, make parallel and move to client unit test
<!--
Please make sure you've read and understood our contributing guidelines;
https://github.com/moby/moby/blob/master/CONTRIBUTING.md

** Make sure all your commits include a signature generated with `git commit -s` **

For additional information on our contributing process, read our contributing
guide https://docs.docker.com/opensource/code/

If this is a bug fix, make sure your description includes "fixes #xxxx", or
"closes #xxxx"

Please provide the following information:
-->

**- What I did**

**- How I did it**

**- How to verify it**

**- Description for the changelog**
<!--
Write a short (one line) summary that describes the changes in this
pull request for inclusion in the changelog:
-->


**- A picture of a cute animal (not mandatory but encouraged)**


integration/image/tag_test.go
package image // import "github.com/docker/docker/integration/image"

import (
	"context"
	"fmt"
	"testing"

	"github.com/docker/docker/testutil"
	"gotest.tools/v3/assert"
	is "gotest.tools/v3/assert/cmp"
)

// tagging a named image in a new unprefixed repo should work
func TestTagUnprefixedRepoByNameOrName(t *testing.T) {
	defer setupTest(t)()
	client := testEnv.APIClient()
	ctx := context.Background()

	// By name
	err := client.ImageTag(ctx, "busybox:latest", "testfoobarbaz")
	assert.NilError(t, err)

	// By ID
	insp, _, err := client.ImageInspectWithRaw(ctx, "busybox")
	assert.NilError(t, err)
	err = client.ImageTag(ctx, insp.ID, "testfoobarbaz")
	assert.NilError(t, err)
}

// ensure we don't allow the use of invalid repository names or tags; these tag operations should fail
// TODO (yongtang): Migrate to unit tests
func TestTagInvalidReference(t *testing.T) {
	defer setupTest(t)()
	client := testEnv.APIClient()
	ctx := context.Background()

	invalidRepos := []string{"fo$z$", "Foo@3cc", "Foo$3", "Foo*3", "Fo^3", "Foo!3", "F)xcz(", "fo%asd", "FOO/bar"}

	for _, repo := range invalidRepos {
		err := client.ImageTag(ctx, "busybox", repo)
		assert.Check(t, is.ErrorContains(err, "not a valid repository/tag"))
	}

	longTag := testutil.GenerateRandomAlphaOnlyString(121)

	invalidTags := []string{"repo:fo$z$", "repo:Foo@3cc", "repo:Foo$3", "repo:Foo*3", "repo:Fo^3", "repo:Foo!3", "repo:%goodbye", "repo:#hashtagit", "repo:F)xcz(", "repo:-foo", "repo:..", longTag}

	for _, repotag := range invalidTags {
		err := client.ImageTag(ctx, "busybox", repotag)
		assert.Check(t, is.ErrorContains(err, "not a valid repository/tag"))
	}

	// test repository name begin with '-'
	err := client.ImageTag(ctx, "busybox:latest", "-busybox:test")
	assert.Check(t, is.ErrorContains(err, "Error parsing reference"))

	// test namespace name begin with '-'
	err = client.ImageTag(ctx, "busybox:latest", "-test/busybox:test")
	assert.Check(t, is.ErrorContains(err, "Error parsing reference"))

	// test index name begin with '-'
	err = client.ImageTag(ctx, "busybox:latest", "-index:5000/busybox:test")
	assert.Check(t, is.ErrorContains(err, "Error parsing reference"))

	// test setting tag fails
	err = client.ImageTag(ctx, "busybox:latest", "sha256:sometag")
	assert.Check(t, is.ErrorContains(err, "refusing to create an ambiguous tag using digest algorithm as name"))
}

// ensure we allow the use of valid tags
func TestTagValidPrefixedRepo(t *testing.T) {
	defer setupTest(t)()
	client := testEnv.APIClient()
	ctx := context.Background()

	validRepos := []string{"fooo/bar", "fooaa/test", "foooo:t", "HOSTNAME.DOMAIN.COM:443/foo/bar"}

	for _, repo := range validRepos {
		err := client.ImageTag(ctx, "busybox", repo)
		assert.NilError(t, err)
	}
}

// tag an image with an existed tag name without -f option should work
func TestTagExistedNameWithoutForce(t *testing.T) {
	defer setupTest(t)()
	client := testEnv.APIClient()
	ctx := context.Background()

	err := client.ImageTag(ctx, "busybox:latest", "busybox:test")
	assert.NilError(t, err)
}

// ensure tagging using official names works
// ensure all tags result in the same name
func TestTagOfficialNames(t *testing.T) {
	defer setupTest(t)()
	client := testEnv.APIClient()
	ctx := context.Background()

	names := []string{
		"docker.io/busybox",
		"index.docker.io/busybox",
		"library/busybox",
		"docker.io/library/busybox",
		"index.docker.io/library/busybox",
	}

	for _, name := range names {
		err := client.ImageTag(ctx, "busybox", name+":latest")
		assert.NilError(t, err)

		// ensure we don't have multiple tag names.
		insp, _, err := client.ImageInspectWithRaw(ctx, "busybox")
		assert.NilError(t, err)
		assert.Assert(t, !is.Contains(insp.RepoTags, name)().Success())
	}

	for _, name := range names {
		err := client.ImageTag(ctx, name+":latest", "fooo/bar:latest")
		assert.NilError(t, err)
	}
}

// ensure tags can not match digests
func TestTagMatchesDigest(t *testing.T) {
	defer setupTest(t)()
	client := testEnv.APIClient()
	ctx := context.Background()

	digest := "busybox@sha256:abcdef76720241213f5303bda7704ec4c2ef75613173910a56fb1b6e20251507"
	// test setting tag fails
	err := client.ImageTag(ctx, "busybox:latest", digest)
	assert.Check(t, is.ErrorContains(err, "refusing to create a tag with a digest reference"))

	// check that no new image matches the digest
	_, _, err = client.ImageInspectWithRaw(ctx, digest)
	assert.Check(t, is.ErrorContains(err, fmt.Sprintf("No such image: %s", digest)))
}

package image // import "github.com/docker/docker/integration/image"

import (
	"context"
	"fmt"
	"testing"

	"gotest.tools/v3/assert"
	is "gotest.tools/v3/assert/cmp"
)

// tagging a named image in a new unprefixed repo should work
func TestTagUnprefixedRepoByNameOrName(t *testing.T) {
	defer setupTest(t)()
	client := testEnv.APIClient()
	ctx := context.Background()

	// By name
	err := client.ImageTag(ctx, "busybox:latest", "testfoobarbaz")
	assert.NilError(t, err)

	// By ID
	insp, _, err := client.ImageInspectWithRaw(ctx, "busybox")
	assert.NilError(t, err)
	err = client.ImageTag(ctx, insp.ID, "testfoobarbaz")
	assert.NilError(t, err)
}

func TestTagUsingDigestAlgorithmAsName(t *testing.T) {
	defer setupTest(t)()
	client := testEnv.APIClient()
	ctx := context.Background()
	err := client.ImageTag(ctx, "busybox:latest", "sha256:sometag")
	assert.Check(t, is.ErrorContains(err, "refusing to create an ambiguous tag using digest algorithm as name"))
}

// ensure we allow the use of valid tags
func TestTagValidPrefixedRepo(t *testing.T) {
	defer setupTest(t)()
	client := testEnv.APIClient()
	ctx := context.Background()

	validRepos := []string{"fooo/bar", "fooaa/test", "foooo:t", "HOSTNAME.DOMAIN.COM:443/foo/bar"}

	for _, repo := range validRepos {
		repo := repo
		t.Run(repo, func(t *testing.T) {
			t.Parallel()
			err := client.ImageTag(ctx, "busybox", repo)
			assert.NilError(t, err)
		})
	}
}

// tag an image with an existed tag name without -f option should work
func TestTagExistedNameWithoutForce(t *testing.T) {
	defer setupTest(t)()
	client := testEnv.APIClient()
	ctx := context.Background()

	err := client.ImageTag(ctx, "busybox:latest", "busybox:test")
	assert.NilError(t, err)
}

// ensure tagging using official names works
// ensure all tags result in the same name
func TestTagOfficialNames(t *testing.T) {
	defer setupTest(t)()
	client := testEnv.APIClient()
	ctx := context.Background()

	names := []string{
		"docker.io/busybox",
		"index.docker.io/busybox",
		"library/busybox",
		"docker.io/library/busybox",
		"index.docker.io/library/busybox",
	}

	for _, name := range names {
		name := name
		t.Run("tag from busybox to "+name, func(t *testing.T) {
			err := client.ImageTag(ctx, "busybox", name+":latest")
			assert.NilError(t, err)

			// ensure we don't have multiple tag names.
			insp, _, err := client.ImageInspectWithRaw(ctx, "busybox")
			assert.NilError(t, err)
			// TODO(vvoland): Not sure what's actually being tested here. Is is still doing anything useful?
			assert.Assert(t, !is.Contains(insp.RepoTags, name)().Success())

			err = client.ImageTag(ctx, name+":latest", "test-tag-official-names/foobar:latest")
			assert.NilError(t, err)
		})
	}
}

// ensure tags can not match digests
func TestTagMatchesDigest(t *testing.T) {
	defer setupTest(t)()
	client := testEnv.APIClient()
	ctx := context.Background()

	digest := "busybox@sha256:abcdef76720241213f5303bda7704ec4c2ef75613173910a56fb1b6e20251507"
	// test setting tag fails
	err := client.ImageTag(ctx, "busybox:latest", digest)
	assert.Check(t, is.ErrorContains(err, "refusing to create a tag with a digest reference"))

	// check that no new image matches the digest
	_, _, err = client.ImageInspectWithRaw(ctx, digest)
	assert.Check(t, is.ErrorContains(err, fmt.Sprintf("No such image: %s", digest)))
}

Hmmm, in this case if we were to move the check from the client side to the API then we still need it as an integration test to test the whole path.

Although it would probably be the best to actually have the unified check (same errors) on both sides, so the daemon doesn't have to deal with requests which can be determined to be invalid by the client, and still have the daemon perform the check if other client is used.

I restored the TODO and added a bit more context.
