auth: Fix delegation.cfg config validation.

appengine/auth_service/config_test.py

 #!/usr/bin/env python
 # Copyright 2015 The LUCI Authors. All rights reserved.
 # Use of this source code is governed under the Apache License, Version 2.0
 # that can be found in the LICENSE file.
 
 import datetime
 import logging
 import sys
 import unittest
 
@@ skipping 445 matching lines @@
   def call_validate_delegation_config(r):
     ctx = validation_context.Context()
     conf = config_pb2.DelegationConfig(rules=[r])
     config.validate_delegation_config(conf, ctx)
     return [m.text for m in ctx.messages]
 
   def test_validate_delegation_config_ok(self):
     # Good one.
     msg = self.call_validate_delegation_config(
         config_pb2.DelegationConfig.Rule(
-            user_id=['service:abc'],
+            user_id=['service:abc', 'group:group'],
             target_service=['service:def'],
             max_validity_duration=3600,
             allowed_to_impersonate=['user:a@a.com', 'bot:*', 'group:abc']))
     self.assertEqual([], msg)
 
   def test_validate_delegation_config_user_id(self):
     # Empty user_id list.
     msg = self.call_validate_delegation_config(
         config_pb2.DelegationConfig.Rule(
             target_service=['service:def'],
             max_validity_duration=3600,
             allowed_to_impersonate=['user:a@a.com', 'bot:*', 'group:abc']))
     self.assertEqual(['rules #0: missing user_id field'], msg)
 
     # Bad user_id.
     msg = self.call_validate_delegation_config(
         config_pb2.DelegationConfig.Rule(
             user_id=['wat'],
             target_service=['service:def'],
             max_validity_duration=3600,
             allowed_to_impersonate=['user:a@a.com', 'bot:*', 'group:abc']))
     self.assertEqual([
-      'rules #0: bad identity string "wat" in user_id: '
+      'rules #0: user_id: not a valid identity "wat": '
       'Missing \':\' separator in Identity string'
     ], msg)
 
-    # Star + redundant entries.
-    msg = self.call_validate_delegation_config(
-        config_pb2.DelegationConfig.Rule(
-            user_id=['*', 'user:a@a.com'],
-            target_service=['service:def'],
-            max_validity_duration=3600,
-            allowed_to_impersonate=['user:a@a.com', 'bot:*', 'group:abc']))
-    self.assertEqual(
-        ['rules #0: redundant entries in user_id, it has "*"" already'], msg)
-
   def test_validate_delegation_config_target_service(self):
     # Empty target_service list.
     msg = self.call_validate_delegation_config(
         config_pb2.DelegationConfig.Rule(
             user_id=['service:abc'],
             max_validity_duration=3600,
             allowed_to_impersonate=['user:a@a.com', 'bot:*', 'group:abc']))
     self.assertEqual(['rules #0: missing target_service field'], msg)
 
     # Bad target_service.
     msg = self.call_validate_delegation_config(
         config_pb2.DelegationConfig.Rule(
             user_id=['service:abc'],
             target_service=['wat'],
             max_validity_duration=3600,
             allowed_to_impersonate=['user:a@a.com', 'bot:*', 'group:abc']))
     self.assertEqual([
-      'rules #0: bad identity string "wat" in target_service: '
+      'rules #0: target_service: bad identity string "wat": '
       'Missing \':\' separator in Identity string'
     ], msg)
 
     # Star + redundant entries.
     msg = self.call_validate_delegation_config(
         config_pb2.DelegationConfig.Rule(
             user_id=['service:abc'],
             target_service=['*', 'service:def'],
             max_validity_duration=3600,
             allowed_to_impersonate=['user:a@a.com', 'bot:*', 'group:abc']))
@@ skipping 19 matching lines @@
               target_service=['*'],
               max_validity_duration=3600,
               allowed_to_impersonate=[uid]))
     # Good cases.
     self.assertEqual([], call('group:abc'))
     self.assertEqual([], call('group:external/abc'))
     self.assertEqual([], call('user:*'))
     self.assertEqual([], call('service:abc'))
     # Bad cases.
     self.assertEqual(
-        ['rules #0: not a valid group name: bad\\name'],
+        ['rules #0: allowed_to_impersonate: not a valid group name: bad\\name'],
         call('group:bad\\name'))
     self.assertEqual([
-      'rules #0: not a valid identity glob "hmm:*": '
+      'rules #0: allowed_to_impersonate: not a valid identity glob "hmm:*": '
       'Invalid Identity kind: hmm'
     ], call('hmm:*'))
     self.assertEqual([
-      'rules #0: not a valid identity glob "*": Missing \':\' '
-      'separator in IdentityGlob string'
-    ], call('*'))
-    self.assertEqual([
-      'rules #0: not a valid identity "a@a.com": Missing \':\' '
-      'separator in Identity string'
+      'rules #0: allowed_to_impersonate: not a valid identity "a@a.com": '
+      'Missing \':\' separator in Identity string'
     ], call('a@a.com'))
 
   def test_update_service_config(self):
     # Missing.
     self.assertIsNone(config._get_service_config('abc.cfg'))
     self.assertIsNone(config._get_service_config_rev('abc.cfg'))
     # Updated.
     rev = config.Revision('rev', 'url')
     self.assertTrue(config._update_service_config('abc.cfg', rev, 'body'))
     self.assertEqual('body', config._get_service_config('abc.cfg'))
@@ skipping 20 matching lines @@
     self.assertEqual(1, len(proto.rules))
 
 
 if __name__ == '__main__':
   if '-v' in sys.argv:
     unittest.TestCase.maxDiff = None
     logging.basicConfig(level=logging.DEBUG)
   else:
     logging.basicConfig(level=logging.FATAL)
   unittest.main()