token-server: Delegation config import, validation and evaluation.

tokenserver/api/minter/v1/token_minter.proto

 // Copyright 2016 The LUCI Authors. All rights reserved.
 // Use of this source code is governed under the Apache License, Version 2.0
 // that can be found in the LICENSE file.
 
 syntax = "proto3";
 
 package tokenserver.minter;
 
 import "google/protobuf/timestamp.proto";
 
@@ skipping 190 matching lines @@
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // Delegation Tokens messages
 
 
 // MintDelegationTokenRequest is passed to MintDelegationToken.
 message MintDelegationTokenRequest {
   // Identity whose authority is delegated.
   //
-  // A string of the form "user:<email>". The token server will check its ACLs
-  // to make sure the caller is authorized to impersonate this identity.
+  // A string of the form "user:<email>" or a special token "REQUESTOR" that
+  // means to delegate caller's own identity. The token server will check its
+  // ACLs to make sure the caller is authorized to impersonate this identity.
   //
   // Required.
   string delegated_identity = 1;
 
   // How long the token should be considered valid (in seconds).
   //
   // Default is 3600 sec.
   int64 validity_duration = 2;
 
   // Who will be able to use the new token.
   //
   // Each item can be an identity string (e.g. "user:<email>"), a "group:<name>"
-  // string, or special "*" string which means "Any bearer can use the token".
+  // string, special "*" string which means "Any bearer can use the token", or
+  // "REQUESTOR" string which means "Whoever is making this call can use the
+  // token".
   //
   // This is semantically is a set, the order of elements doesn't matter.
   //
   // Required.
   repeated string audience = 3;
 
   // What services should accept the new token.
   //
   // List of LUCI services (specified as service identities, e.g.
   // "service:app-id" or as https:// root URLs e.g. "https://<host>") that
@@ skipping 19 matching lines @@
 message MintDelegationTokenResponse {
   // The actual base64-encoded signed token.
   string token = 1;
 
   // Same data as in 'token' in deserialized form, just for convenience.
   //
   // Mostly for JSON encoding users, since they may not understand proto-encoded
   // tokens.
   messages.Subtoken delegation_subtoken = 2;
 }