auth: Keep audit log of all generated delegation tokens.

appengine/auth_service/config.py

Index: appengine/auth_service/config.py
diff --git a/appengine/auth_service/config.py b/appengine/auth_service/config.py
index f50f50df190373bb7162f77f885642c1d3102d73..0fd2736b3d9af8d9c45d84457873ee5253358521 100644
--- a/appengine/auth_service/config.py
+++ b/appengine/auth_service/config.py
@@ -22,7 +22,6 @@ changes as well as removes a need to write some UI for them.
 
 import collections
 import logging
-import os
 import posixpath
 
 from google import protobuf
@@ -45,6 +44,10 @@ import importer
 Revision = collections.namedtuple('Revision', ['revision', 'url'])
 
 
+class CannotLoadConfigError(Exception):
+  """Raised when fetching configs if they are missing or invalid."""
+
+
 def is_remote_configured():
   """True if config service backend URL is defined.
 
@@ -104,7 +107,7 @@ def refetch_config(force=False):
   # Grab and validate all new configs in parallel.
   try:
     configs = _fetch_configs(_CONFIG_SCHEMAS)
-  except config.CannotLoadConfigError as exc:
+  except CannotLoadConfigError as exc:
     logging.error('Failed to fetch configs\n%s', exc)
     return
 
@@ -534,11 +537,11 @@ def _fetch_configs(paths):
   for path, future in zip(paths, futures):
     rev, conf = future.get_result()
     if conf is None:
-      raise config.CannotLoadConfigError('Config %s is missing' % path)
+      raise CannotLoadConfigError('Config %s is missing' % path)
     try:
       validation.validate(config.self_config_set(), path, conf)
     except ValueError as exc:
-      raise config.CannotLoadConfigError(
+      raise CannotLoadConfigError(
           'Config %s at rev %s failed to pass validation: %s' %
           (path, rev, exc))
     out[path] = (Revision(rev, _gitiles_url(configs_url, rev, path)), conf)