token-server: Delegation config import, validation and evaluation.

token-server: Delegation config import, validation and evaluation.

R=nodir@chromium.org
BUG=

Committed: https://github.com/luci/luci-go/commit/3730e3576f6d20480c83c47e281a3bd12669549b

[Vadim Sh., 2016-10-13 04:32:03]

This is the best readability I could manage. It is still a big hairy though, but
I believe it is less hairy than python version (mostly because rules are
independent).

Example rule:
rules {
  name: "Fake @example.com tokens"
  owner: "vadimsh@google.com"

  requestor: "group:administrators"
  target_service: "*"
  allowed_to_impersonate: "group:domain-example-com"
  allowed_audience: "*"

  max_validity_duration: 86400
}

Example request:
{
    "delegatedIdentity": "user:dude@example.com",
    "validityDuration": 3600,
    "audience": [
        "REQUESTOR"
    ],
    "services": [
        "*"
    ],
    "intent": "Just checking"
}

[nodir, 2016-10-13 22:03:52]

https://codereview.chromium.org/2413683004/diff/20001/tokenserver/api/admin/v...
File tokenserver/api/admin/v1/admin.proto (right):

https://codereview.chromium.org/2413683004/diff/20001/tokenserver/api/admin/v...
tokenserver/api/admin/v1/admin.proto:27: // Note that regularly configs are read
in background each 5 min.
remove regularly

https://codereview.chromium.org/2413683004/diff/20001/tokenserver/api/admin/v...
File tokenserver/api/admin/v1/config.proto (right):

https://codereview.chromium.org/2413683004/diff/20001/tokenserver/api/admin/v...
tokenserver/api/admin/v1/config.proto:129: //  * A special token "*" that mean
"any LUCI service should accept the
means

https://codereview.chromium.org/2413683004/diff/20001/tokenserver/appengine/d...
File tokenserver/appengine/delegation/config.go (right):

https://codereview.chromium.org/2413683004/diff/20001/tokenserver/appengine/d...
tokenserver/appengine/delegation/config.go:149: cfg.ParsedConfig =
&admin.DelegationPermissions{}
consider mutating cfg in the end before returning nil

https://codereview.chromium.org/2413683004/diff/20001/tokenserver/appengine/d...
tokenserver/appengine/delegation/config.go:264: // happen. Basically, all sets
in rule must be supersets of corresponding sets
happens

https://codereview.chromium.org/2413683004/diff/20001/tokenserver/appengine/d...
File tokenserver/appengine/delegation/rpc_import_delegation_configs.go (right):

https://codereview.chromium.org/2413683004/diff/20001/tokenserver/appengine/d...
tokenserver/appengine/delegation/rpc_import_delegation_configs.go:64: blob, err
:= proto.Marshal(msg)
do it after validation?

https://codereview.chromium.org/2413683004/diff/20001/tokenserver/appengine/d...
File tokenserver/appengine/delegation/validation.go (right):

https://codereview.chromium.org/2413683004/diff/20001/tokenserver/appengine/d...
tokenserver/appengine/delegation/validation.go:26: prefix := fmt.Sprintf("rule
#%d (%q)", i+1, rule.Name)
i think it is a perfect opportunity to make MultiErrorBuilder type similar to
components.config.validation.Context
wdyt?

[nodir, 2016-10-17 22:53:20]

lgtm since we don't have time for config validator

[Vadim Sh., 2016-10-27 04:12:00]

Added tests.

https://codereview.chromium.org/2413683004/diff/20001/tokenserver/appengine/d...
File tokenserver/appengine/delegation/config.go (right):

https://codereview.chromium.org/2413683004/diff/20001/tokenserver/appengine/d...
tokenserver/appengine/delegation/config.go:149: cfg.ParsedConfig =
&admin.DelegationPermissions{}
On 2016/10/13 22:03:52, nodir wrote:
> consider mutating cfg in the end before returning nil

Done.

https://codereview.chromium.org/2413683004/diff/20001/tokenserver/appengine/d...
tokenserver/appengine/delegation/config.go:264: // happen. Basically, all sets
in rule must be supersets of corresponding sets
On 2016/10/13 22:03:52, nodir wrote:
> happens

Done.

https://codereview.chromium.org/2413683004/diff/20001/tokenserver/appengine/d...
File tokenserver/appengine/delegation/rpc_import_delegation_configs.go (right):

https://codereview.chromium.org/2413683004/diff/20001/tokenserver/appengine/d...
tokenserver/appengine/delegation/rpc_import_delegation_configs.go:64: blob, err
:= proto.Marshal(msg)
On 2016/10/13 22:03:52, nodir wrote:
> do it after validation?

Done.

https://codereview.chromium.org/2413683004/diff/20001/tokenserver/appengine/d...
File tokenserver/appengine/delegation/validation.go (right):

https://codereview.chromium.org/2413683004/diff/20001/tokenserver/appengine/d...
tokenserver/appengine/delegation/validation.go:26: prefix := fmt.Sprintf("rule
#%d (%q)", i+1, rule.Name)
On 2016/10/13 22:03:52, nodir wrote:
> i think it is a perfect opportunity to make MultiErrorBuilder type similar to
> components.config.validation.Context
> wdyt?

Discussed this.

[Vadim Sh., 2016-10-27 04:12:05]

The CQ bit was checked by vadimsh@chromium.org

[Vadim Sh., 2016-10-27 04:12:05]

The patchset sent to the CQ was uploaded after l-g-t-m from nodir@chromium.org
Link to the patchset: https://codereview.chromium.org/2413683004/#ps40001
(title: "add crapload of tests")

[commit-bot: I haz the power, 2016-10-27 04:12:11]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Vadim Sh., 2016-10-27 04:32:10]

The CQ bit was unchecked by vadimsh@chromium.org

[Vadim Sh., 2016-10-27 04:43:50]

The CQ bit was checked by vadimsh@chromium.org

[Vadim Sh., 2016-10-27 04:43:51]

The patchset sent to the CQ was uploaded after l-g-t-m from nodir@chromium.org
Link to the patchset: https://codereview.chromium.org/2413683004/#ps60001
(title: "also check validity_duration")

[commit-bot: I haz the power, 2016-10-27 04:43:59]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-10-27 06:46:30]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-10-27 06:46:31]

Try jobs failed on following builders:
  Luci-go Win Tester on luci.infra.try (JOB_FAILED,
https://luci-milo.appspot.com/swarming/task/321d455869364e10)

[Vadim Sh., 2016-10-27 18:29:34]

The CQ bit was checked by vadimsh@chromium.org

[commit-bot: I haz the power, 2016-10-27 18:29:39]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-10-27 19:10:38]

Description was changed from

==========
token-server: Delegation config import, validation and evaluation.

R=nodir@chromium.org
BUG=
==========

to

==========
token-server: Delegation config import, validation and evaluation.

R=nodir@chromium.org
BUG=

Committed:
https://github.com/luci/luci-go/commit/3730e3576f6d20480c83c47e281a3bd12669549b
==========

[commit-bot: I haz the power, 2016-10-27 19:10:39]

Committed patchset #4 (id:60001) as
https://github.com/luci/luci-go/commit/3730e3576f6d20480c83c47e281a3bd12669549b