token-server: Delegation config import, validation and evaluation.

tokenserver/api/admin/v1/admin.proto

 // Copyright 2016 The LUCI Authors. All rights reserved.
 // Use of this source code is governed under the Apache License, Version 2.0
 // that can be found in the LICENSE file.
 
 syntax = "proto3";
 
 package tokenserver.admin;
 
 import "google/protobuf/empty.proto";
 
 import "github.com/luci/luci-go/tokenserver/api/machine_token.proto";
 
 
 // Admin service is used by service administrators to manage the server.
 service Admin {
   // ImportCAConfigs makes the server read CA configs from luci-config.
   //
+  // This reads 'tokenserver.cfg' file.
+  //
   // Note that regularly configs are read in background each 5 min.
   // ImportCAConfigs can be used to force config reread immediately. It will
   // block until the configs are read.
   rpc ImportCAConfigs(google.protobuf.Empty) returns (ImportedConfigs);
 
+  // ImportDelegationConfigs makes the server read 'delegation.cfg' config.
+  //
+  // Note that regularly configs are read in background each 5 min.

[nodir, 2016/10/13 22:03:52]

remove regularly

+  // ImportDelegationConfigs can be used to force config reread immediately. It
+  // will block until the configs are read.
+  rpc ImportDelegationConfigs(google.protobuf.Empty) returns (ImportedConfigs);
+
   // InspectMachineToken decodes a machine token and verifies it is valid.
   //
   // It verifies the token was signed by a private key of the token server and
   // checks token's expiration time and revocation status.
   //
   // It tries to give as much information about the token and its status as
   // possible (e.g. it checks for revocation status even if token is already
   // expired).
   //
   // Administrators can use this call to debug issues with tokens.
@@ skipping 80 matching lines @@
   //
   // Resolved from 'ca_id' field of the token body.
   string cert_ca_name = 7;
 
   // The decoded token body (depends on token_type request parameter). Empty if
   // token was malformed and couldn't be deserialized.
   oneof token_type {
     tokenserver.MachineTokenBody luci_machine_token = 20;
   }
 }