LogDog: Implement prefix expiration.

appengine/logdog/coordinator/endpoints/services/registerStream.go

Index: appengine/logdog/coordinator/endpoints/services/registerStream.go
diff --git a/appengine/logdog/coordinator/endpoints/services/registerStream.go b/appengine/logdog/coordinator/endpoints/services/registerStream.go
index 4511b3bf796cdf8f1f4d99e4880ee9f5a57ac1e0..7451e92c1e768c46c31de7b13a586f23a2bd79d1 100644
--- a/appengine/logdog/coordinator/endpoints/services/registerStream.go
+++ b/appengine/logdog/coordinator/endpoints/services/registerStream.go
@@ -119,7 +119,16 @@ func (s *server) RegisterStream(c context.Context, req *logdog.RegisterStreamReq
 		return nil, grpcutil.Internal
 	}
 
-	// The prefix secret must match the request secret. If it does, we know this
+	// If we're past prefix's expiration, reject this stream.
+	if now := clock.Now(c); !now.Before(pfx.Expiration) {

[nodir, 2016/05/19 00:54:00]

I am not sure how you do the migration (CL description does not address that),
but it may make sense to skip this check if pfx.Expiration.IsZero()

[dnj (Google), 2016/05/19 02:06:19]

Hmm good question. I have an idea: Since we're defining an expiration, I'll say
that if the Prefix expiration is zero, I'll add the smallest expiration
parameter to the Prefix's creation time and use that.

This will be okay as long as I make sure the config has a non-zero value for
that before I enable this, else all existing Prefixes will suddenly not work
anymore :)

[nodir, 2016/05/19 03:06:33]

Yeah, how you gonna fetch new configs without deploying new proto files? I'd be
on the safe side by having a default prefix expiration if service config doesn't
have it

[dnj (Google), 2016/05/19 03:20:06]

Oh that part's easy. I'll upload the new version, shut down the Collector fleet,
deploy the config, wait for luci-config to pick it up, and then hit the "Migrate
Traffic" button and bring the fleet back up. I'll have to do that anyway on
account of the other changes.

+		log.Fields{
+			"prefix":     pfx.Prefix,
+			"expiration": pfx.Expiration,
+		}.Errorf(c, "The log stream Prefix has expired.")
+		return nil, grpcutil.Errf(codes.FailedPrecondition, "prefix has expired")
+	}
+
+	// The prefix secret much match the request secret. If it does, we know this

[nodir, 2016/05/19 00:54:00]

must

 	// is a legitimate registration attempt.
 	if subtle.ConstantTimeCompare(pfx.Secret, req.Secret) != 1 {
 		log.Errorf(c, "Request secret does not match prefix secret.")