auth: Make luci-go services trust signatures produced by the token server.

server/auth/auth_test.go

 // Copyright 2015 The LUCI Authors. All rights reserved.
 // Use of this source code is governed under the Apache License, Version 2.0
 // that can be found in the LICENSE file.
 
 package auth
 
 import (
         "errors"
         "net"
         "net/http"
         "testing"
 
         "golang.org/x/net/context"
 
         "github.com/luci/luci-go/server/secrets"
 
         "github.com/luci/luci-go/server/auth/authdb"
         "github.com/luci/luci-go/server/auth/identity"
         "github.com/luci/luci-go/server/auth/service/protocol"
+        "github.com/luci/luci-go/server/auth/signing"
 
         . "github.com/luci/luci-go/common/testing/assertions"
         . "github.com/smartystreets/goconvey/convey"
 )
 
 func TestAuthenticate(t *testing.T) {
         Convey("IsAllowedOAuthClientID on default DB", t, func() {
                 c := context.Background()
                 auth := Authenticator{fakeOAuthMethod{clientID: "some_client_id"}}
                 _, err := auth.Authenticate(c, makeRequest())
@@ skipping 110 matching lines @@
 type fakeDB struct {
         allowedClientID string
         authServiceURL  string
         tokenServiceURL string
 }
 
 func (db *fakeDB) IsAllowedOAuthClientID(c context.Context, email, clientID string) (bool, error) {
         return clientID == db.allowedClientID, nil
 }
 
 func (db *fakeDB) IsMember(c context.Context, id identity.Identity, group string) (bool, error) {

[Vadim Sh., 2016/10/03 20:47:12]

this is the main fake used in server/auth/* tests. It can't import the fake in
server/auth/authtest because of dependency cycle.

         return true, nil
 }
 
 func (db *fakeDB) SharedSecrets(c context.Context) (secrets.Store, error) {
         return nil, errors.New("fakeDB: SharedSecrets is not implemented")
 }
 
+func (db *fakeDB) GetCertificates(c context.Context, id identity.Identity) (*signing.PublicCertificates, error) {
+        return nil, errors.New("fakeDB: GetCertificates is not implemented")
+}
+
 func (db *fakeDB) GetWhitelistForIdentity(c context.Context, ident identity.Identity) (string, error) {
         return "", nil
 }
 
 func (db *fakeDB) IsInWhitelist(c context.Context, ip net.IP, whitelist string) (bool, error) {
         return whitelist == "bots" && ip.String() == "1.2.3.4", nil
 }
 
 func (db *fakeDB) GetAuthServiceURL(c context.Context) (string, error) {
         if db.authServiceURL == "" {
                 return "", errors.New("fakeDB: GetAuthServiceURL is not configured")
         }
         return db.authServiceURL, nil
 }
 
 func (db *fakeDB) GetTokenServiceURL(c context.Context) (string, error) {
         if db.authServiceURL == "" {
                 return "", errors.New("fakeDB: GetTokenServiceURL is not configured")
         }
         return db.tokenServiceURL, nil
 }