buildbucket: use OptionalLogin if service account is not passed

client/cmd/buildbucket/base_command.go

 // Copyright 2016 The LUCI Authors. All rights reserved.
 // Use of this source code is governed under the Apache License, Version 2.0
 // that can be found in the LICENSE file.
 
 package main
 
 import (
         "errors"
         "fmt"
         "strings"
@@ skipping 18 matching lines @@
                 "path to service account json file.")
         r.Flags.StringVar(&r.host, "host",
                 "cr-buildbucket.appspot.com",
                 "host for the buildbucket service instance.")
 }
 
 func (r *baseCommandRun) makeService(ctx context.Context, a subcommands.Application) (*buildbucket.Service, error) {
         if r.host == "" {
                 return nil, errors.New("a host for the buildbucket service must be provided")
         }
-        authenticator := auth.NewAuthenticator(ctx, auth.SilentLogin, auth.Options{ServiceAccountJSONPath: r.serviceAccountJSONPath})
+
+        loginMode := auth.OptionalLogin
+        if r.serviceAccountJSONPath != "" {
+                // if service account is specified, the request MUST be authenticated
+                // otherwise it is optional.
+                loginMode = auth.SilentLogin
+        }
+        authenticator := auth.NewAuthenticator(ctx, loginMode, auth.Options{ServiceAccountJSONPath: r.serviceAccountJSONPath})
 
         client, err := authenticator.Client()
         if err != nil {
                 logging.Errorf(ctx, "could not create client: %s", err)
                 return nil, err
         }
         logging.Debugf(ctx, "client created")
 
         service, err := buildbucket.New(client)
         if err != nil {
@@ skipping 16 matching lines @@
         case host == "localhost", strings.HasPrefix(host, "localhost:"):
         case host == "127.0.0.1", strings.HasPrefix(host, "127.0.0.1:"):
         case host == "[::1]", strings.HasPrefix(host, "[::1]:"):
         case strings.HasPrefix(host, ":"):
 
         default:
                 return false
         }
         return true
 }