auth: Keep audit log of all generated delegation tokens.

auth: Keep audit log of all generated delegation tokens.

Also fix broken config.py.

R=nodir@chromium.org
BUG=

Committed: https://github.com/luci/luci-py/commit/df1f40bebb93b5c00bbbf1e8360b303f595cb2f0

[Vadim Sh., 2016-07-20 01:29:07]

Description was changed from

==========
auth: Keep audit log of all generates delegation tokens.

Also fix broken config.py.

R=nodir@chromium.org
BUG=
==========

to

==========
auth: Keep audit log of all generated delegation tokens.

Also fix broken config.py.

R=nodir@chromium.org
BUG=
==========

[Vadim Sh., 2016-07-20 01:31:12]

PTAL, this will give me some peace of mind.

All current clients of /delegation endpoint are caching the tokens (as far as I
know), so it shouldn't be a big deal to keep creating datastore entities.

[nodir, 2016-07-20 18:04:22]

lgtm

https://codereview.chromium.org/2164733003/diff/40001/appengine/auth_service/...
File appengine/auth_service/delegation.py (right):

https://codereview.chromium.org/2164733003/diff/40001/appengine/auth_service/...
appengine/auth_service/delegation.py:87: caller_ip =
ipaddr.ip_from_string(self.request.remote_addr)
ip is not provided by the user, so perhaps it should not result in HTTP 400

https://codereview.chromium.org/2164733003/diff/40001/appengine/auth_service/...
appengine/auth_service/delegation.py:317: # List of service that accept the
token (or empty list if all).
services

https://codereview.chromium.org/2164733003/diff/40001/appengine/auth_service/...
appengine/auth_service/delegation.py:340:
creation_time=utils.timestamp_to_datetime(subtoken.creation_time*1e6),
using datetime.fromtimestamp is probably more straightforward

[Vadim Sh., 2016-07-20 20:07:07]

https://codereview.chromium.org/2164733003/diff/40001/appengine/auth_service/...
File appengine/auth_service/delegation.py (right):

https://codereview.chromium.org/2164733003/diff/40001/appengine/auth_service/...
appengine/auth_service/delegation.py:87: caller_ip =
ipaddr.ip_from_string(self.request.remote_addr)
On 2016/07/20 18:04:22, nodir wrote:
> ip is not provided by the user, so perhaps it should not result in HTTP 400

Done. Replaced with get_peer_ip, it is already validated.

https://codereview.chromium.org/2164733003/diff/40001/appengine/auth_service/...
appengine/auth_service/delegation.py:317: # List of service that accept the
token (or empty list if all).
On 2016/07/20 18:04:22, nodir wrote:
> services

Done.

https://codereview.chromium.org/2164733003/diff/40001/appengine/auth_service/...
appengine/auth_service/delegation.py:340:
creation_time=utils.timestamp_to_datetime(subtoken.creation_time*1e6),
On 2016/07/20 18:04:22, nodir wrote:
> using datetime.fromtimestamp is probably more straightforward

It returns local time, not UTC.

[Vadim Sh., 2016-07-20 20:07:14]

The CQ bit was checked by vadimsh@chromium.org

[Vadim Sh., 2016-07-20 20:07:15]

The patchset sent to the CQ was uploaded after l-g-t-m from nodir@chromium.org
Link to the patchset: https://codereview.chromium.org/2164733003/#ps60001
(title: "auth: Keep audit log of all generates delegation tokens.")

[commit-bot: I haz the power, 2016-07-20 20:07:26]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-07-20 20:09:43]

Description was changed from

==========
auth: Keep audit log of all generated delegation tokens.

Also fix broken config.py.

R=nodir@chromium.org
BUG=
==========

to

==========
auth: Keep audit log of all generated delegation tokens.

Also fix broken config.py.

R=nodir@chromium.org
BUG=

Committed:
https://github.com/luci/luci-py/commit/df1f40bebb93b5c00bbbf1e8360b303f595cb2f0
==========

[commit-bot: I haz the power, 2016-07-20 20:09:44]

Committed patchset #4 (id:60001) as
https://github.com/luci/luci-py/commit/df1f40bebb93b5c00bbbf1e8360b303f595cb2f0