token-server: Delegation config import, validation and evaluation.

tokenserver/api/minter/v1/token_minter.pb.go

 // Code generated by protoc-gen-go.
 // source: github.com/luci/luci-go/tokenserver/api/minter/v1/token_minter.proto
 // DO NOT EDIT!
 
 /*
 Package minter is a generated protocol buffer package.
 
 It is generated from these files:
         github.com/luci/luci-go/tokenserver/api/minter/v1/token_minter.proto
 
@@ skipping 310 matching lines @@
         if m != nil {
                 return m.Expiry
         }
         return nil
 }
 
 // MintDelegationTokenRequest is passed to MintDelegationToken.
 type MintDelegationTokenRequest struct {
         // Identity whose authority is delegated.
         //
-        // A string of the form "user:<email>". The token server will check its ACLs
-        // to make sure the caller is authorized to impersonate this identity.
+        // A string of the form "user:<email>" or a special token "REQUESTOR" that
+        // means to delegate caller's own identity. The token server will check its
+        // ACLs to make sure the caller is authorized to impersonate this identity.
         //
         // Required.
         DelegatedIdentity string `protobuf:"bytes,1,opt,name=delegated_identity,json=delegatedIdentity" json:"delegated_identity,omitempty"`
         // How long the token should be considered valid (in seconds).
         //
         // Default is 3600 sec.
         ValidityDuration int64 `protobuf:"varint,2,opt,name=validity_duration,json=validityDuration" json:"validity_duration,omitempty"`
         // Who will be able to use the new token.
         //
         // Each item can be an identity string (e.g. "user:<email>"), a "group:<name>"
-        // string, or special "*" string which means "Any bearer can use the token".
+        // string, special "*" string which means "Any bearer can use the token", or
+        // "REQUESTOR" string which means "Whoever is making this call can use the
+        // token".
         //
         // This is semantically is a set, the order of elements doesn't matter.
         //
         // Required.
         Audience []string `protobuf:"bytes,3,rep,name=audience" json:"audience,omitempty"`
         // What services should accept the new token.
         //
         // List of LUCI services (specified as service identities, e.g.
         // "service:app-id" or as https:// root URLs e.g. "https://<host>") that
         // should accept this token. May also contain special "*" string, which
@@ skipping 295 matching lines @@
         0x67, 0x63, 0xbf, 0xff, 0xaa, 0xdf, 0xb3, 0x7c, 0x3b, 0x78, 0x35, 0xc0, 0x8e, 0xe5, 0xeb, 0x9b,
         0x05, 0x7d, 0x19, 0x7d, 0x4b, 0x0a, 0xfb, 0x78, 0xe8, 0xe5, 0xb1, 0x4b, 0x4e, 0x7a, 0x1d, 0x3d,
         0x84, 0xa6, 0x08, 0x2e, 0x04, 0x2d, 0x7c, 0x3a, 0x74, 0x6c, 0xd7, 0xf7, 0xf4, 0xfb, 0xe8, 0x11,
         0x6f, 0xbf, 0xd5, 0x3b, 0xeb, 0xbb, 0xb6, 0x32, 0x3a, 0x7d, 0xd7, 0xef, 0xbb, 0xa7, 0x81, 0x8d,
         0xf1, 0x00, 0xeb, 0xdb, 0xdd, 0x7f, 0x34, 0xd8, 0x11, 0x23, 0x71, 0xc4, 0x35, 0x41, 0x33, 0xd0,
         0x6f, 0x3e, 0x49, 0xe8, 0x59, 0xe5, 0x7b, 0x50, 0xfd, 0xe7, 0xd1, 0xfe, 0xe6, 0x6e, 0x64, 0x35,
         0xff, 0x2b, 0xfe, 0x8f, 0xb0, 0xbe, 0x1e, 0xc8, 0xb8, 0x2d, 0x48, 0xf5, 0x8d, 0x68, 0x9b, 0x77,
         0xe6, 0x4b, 0xdd, 0x8b, 0xba, 0xb8, 0x7d, 0xdf, 0xfd, 0x17, 0x00, 0x00, 0xff, 0xff, 0x64, 0x1d,
         0xcf, 0x96, 0x08, 0x08, 0x00, 0x00,
 }