auth: Make luci-go services trust signatures produced by the token server.

server/auth/authdb/snapshot_test.go

 // Copyright 2016 The LUCI Authors. All rights reserved.
 // Use of this source code is governed under the Apache License, Version 2.0
 // that can be found in the LICENSE file.
 
 package authdb
 
 import (
+        "encoding/json"
         "net"
+        "net/http"
         "testing"
 
         "golang.org/x/net/context"
 
         "github.com/luci/luci-go/server/auth/identity"
+        "github.com/luci/luci-go/server/auth/internal"
         "github.com/luci/luci-go/server/auth/service/protocol"
+        "github.com/luci/luci-go/server/auth/signing"
+        "github.com/luci/luci-go/server/auth/signing/signingtest"
         "github.com/luci/luci-go/server/secrets"
 
         . "github.com/smartystreets/goconvey/convey"
 )
 
 func TestSnapshotDB(t *testing.T) {
         Convey("IsAllowedOAuthClientID works", t, func() {
                 c := context.Background()
                 db, err := NewSnapshotDB(&protocol.AuthDB{
                         OauthClientId: strPtr("primary-client-id"),
@@ skipping 100 matching lines @@
                         "secret-2": {
                                 Current: secrets.NamedBlob{Blob: []byte("current")},
                                 Previous: []secrets.NamedBlob{
                                         {Blob: []byte("prev1")},
                                         {Blob: []byte("prev2")},
                                 },
                         },
                 })
         })
 
+        Convey("GetCertificates works", t, func(c C) {
+                db, err := NewSnapshotDB(&protocol.AuthDB{
+                        OauthClientId: strPtr("primary-client-id"),
+                        OauthAdditionalClientIds: []string{
+                                "additional-client-id-1",
+                                "additional-client-id-2",
+                        },
+                        TokenServerUrl: strPtr("http://token-server"),
+                }, "http://auth-service", 1234)
+                So(err, ShouldBeNil)
+
+                authService := signingtest.NewSigner(0, &signing.ServiceInfo{
+                        AppID:              "auth-service",
+                        ServiceAccountName: "auth-service-account@example.com",
+                })
+
+                tokenService := signingtest.NewSigner(1, &signing.ServiceInfo{
+                        AppID:              "token-server",
+                        ServiceAccountName: "token-server-account@example.com",
+                })
+
+                calls := 0
+
+                ctx := context.Background()
+                ctx = internal.WithTestTransport(ctx, func(r *http.Request, body string) (int, string) {
+                        calls++
+                        var certs *signing.PublicCertificates
+                        var err error
+                        switch r.URL.String() {
+                        case "http://auth-service/auth/api/v1/server/certificates":
+                                certs, err = authService.Certificates(ctx)
+                        case "http://token-server/auth/api/v1/server/certificates":
+                                certs, err = tokenService.Certificates(ctx)
+                        default:
+                                return 404, "Wrong URL"
+                        }
+                        if err != nil {
+                                panic(err)
+                        }
+                        blob, err := json.Marshal(certs)
+                        if err != nil {
+                                panic(err)
+                        }
+                        return 200, string(blob)
+                })
+
+                good := []identity.Identity{
+                        "service:auth-service",
+                        "service:token-server",
+                        "user:auth-service-account@example.com",
+                        "user:token-server-account@example.com",
+                }
+                for _, ident := range good {
+                        certs, err := db.GetCertificates(ctx, ident)
+                        So(err, ShouldBeNil)
+                        So(certs, ShouldNotBeNil)
+                }
+
+                // Fetched two bundles, once.
+                So(calls, ShouldEqual, 2)
+
+                // For unknown signer returns (nil, nil).
+                certs, err := db.GetCertificates(ctx, "service:unknown")
+                So(err, ShouldBeNil)
+                So(certs, ShouldBeNil)
+        })
+
         Convey("IsInWhitelist works", t, func() {
                 c := context.Background()
                 db, err := NewSnapshotDB(&protocol.AuthDB{
                         IpWhitelistAssignments: []*protocol.AuthIPWhitelistAssignment{
                                 {
                                         Identity:    strPtr("user:abc@example.com"),
                                         IpWhitelist: strPtr("whitelist"),
                                 },
                         },
                         IpWhitelists: []*protocol.AuthIPWhitelist{
@@ skipping 74 matching lines @@
                         },
                 },
         }, "http://auth-service", 1234)
 
         b.ResetTimer()
 
         for i := 0; i < b.N; i++ {
                 db.IsMember(c, "user:somedude@example.com", "outer")
         }
 }