token-server: Add protos for new API for generating service account tokens.

token-server: Add protos for new API for generating service account tokens.

Add initial boilerplate for implementation. Nothing structurally new here, this
CL repeats existing patterns in the code. Use this opportunity for minimal 
cleanup of various comments in proto.

R=iannucci@chromium.org, nodir@chromium.org, smut@google.com
BUG=731843
Review-Url: https://codereview.chromium.org/2785973002
Committed: https://github.com/luci/luci-go/commit/8fbab6da1f9e6c96cdcea4159a3b8e11f9ccace2

[Vadim Sh., 2017-03-30 05:59:16]

Description was changed from

==========
token-server: Add protos for new API for generating service account tokens.

Add initial bolierplate for implementation. Nothing structurally new here, this
CL repeats existing patterns in the code.

R=iannucci@chromium.org, nodir@chromium.org
BUG=
==========

to

==========
token-server: Add protos for new API for generating service account tokens.

Add initial bolierplate for implementation. Nothing structurally new here, this
CL repeats existing patterns in the code. Use this opportunity for minimal 
cleanup of various comments in proto.

R=iannucci@chromium.org, nodir@chromium.org
BUG=
==========

[Vadim Sh., 2017-03-30 06:04:48]

PTAL. This is mostly comments, some protos, some boilerplate, and a metric ton
of generated code.

https://codereview.chromium.org/2785973002/diff/1/tokenserver/api/admin/v1/ad...
File tokenserver/api/admin/v1/admin.proto (right):

https://codereview.chromium.org/2785973002/diff/1/tokenserver/api/admin/v1/ad...
tokenserver/api/admin/v1/admin.proto:61: // InspectOAuthTokenGrant decodes OAuth
token grant and verifies it is valid.
Read token_minter.proto and oauth_token_grant.proto first.

https://codereview.chromium.org/2785973002/diff/1/tokenserver/api/minter/v1/t...
File tokenserver/api/minter/v1/token_minter.proto (left):

https://codereview.chromium.org/2785973002/diff/1/tokenserver/api/minter/v1/t...
tokenserver/api/minter/v1/token_minter.proto:53: //      - OAuth2 token grants:
they are signed assertions that particular
After long consideration I decided to make "oauth2 token grants" separate
first-class objects since they end up having sufficiently different semantics
from delegation tokens. Trying to unify them results in a weird non-obvious
reuse of delegation token fields.

I'll try to extract as much of shared functionality as possible into reusable
functions though. For example, policy rules evaluation will probably be very
similar, so I'll try to reuse existing code.

https://codereview.chromium.org/2785973002/diff/1/tokenserver/api/minter/v1/t...
File tokenserver/api/minter/v1/token_minter.proto (right):

https://codereview.chromium.org/2785973002/diff/1/tokenserver/api/minter/v1/t...
tokenserver/api/minter/v1/token_minter.proto:94: // MintOAuthTokenGrant
generates a new grant for getting an OAuth2 token.
This is the most important comment in this CL. It describes in a nut shell the
new protocol.

[Vadim Sh., 2017-03-30 06:05:17]

The CQ bit was checked by vadimsh@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-03-30 06:05:25]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-03-30 06:09:55]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-03-30 06:09:56]

Dry run: Try jobs failed on following builders:
  Luci-go Linux Trusty 64 Tester on luci.infra.try (JOB_FAILED,
https://luci-milo.appspot.com/swarming/task/3536a34a3869e010)
  Luci-go Mac Tester on luci.infra.try (JOB_FAILED,
https://luci-milo.appspot.com/swarming/task/3536a34a1d9be110)

[Vadim Sh., 2017-03-30 21:54:24]

The CQ bit was checked by vadimsh@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-03-30 21:54:35]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-03-30 22:15:29]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-03-30 22:15:30]

Dry run: This issue passed the CQ dry run.

[nodir, 2017-04-03 22:51:55]

lgtm

https://codereview.chromium.org/2785973002/diff/20001/tokenserver/api/admin/v...
File tokenserver/api/admin/v1/config.proto (right):

https://codereview.chromium.org/2785973002/diff/20001/tokenserver/api/admin/v...
tokenserver/api/admin/v1/config.proto:178: // Email of developers that added
this rule, to know who to contact.
s/added/own
added can be derived from git log

https://codereview.chromium.org/2785973002/diff/20001/tokenserver/api/minter/...
File tokenserver/api/minter/v1/token_minter.proto (right):

https://codereview.chromium.org/2785973002/diff/20001/tokenserver/api/minter/...
tokenserver/api/minter/v1/token_minter.proto:355: string grant_token            
  = 1; // base64-encoded token with the grant
remove "base64-encoded" because it is meant to be opaque and you don't specify
the token message

https://codereview.chromium.org/2785973002/diff/20001/tokenserver/api/oauth_t...
File tokenserver/api/oauth_token_grant.proto (right):

https://codereview.chromium.org/2785973002/diff/20001/tokenserver/api/oauth_t...
tokenserver/api/oauth_token_grant.proto:23: int64 subtoken_id = 1;
grant_id?

[Vadim Sh., 2017-07-28 22:39:54]

Description was changed from

==========
token-server: Add protos for new API for generating service account tokens.

Add initial bolierplate for implementation. Nothing structurally new here, this
CL repeats existing patterns in the code. Use this opportunity for minimal 
cleanup of various comments in proto.

R=iannucci@chromium.org, nodir@chromium.org
BUG=
==========

to

==========
token-server: Add protos for new API for generating service account tokens.

Add initial bolierplate for implementation. Nothing structurally new here, this
CL repeats existing patterns in the code. Use this opportunity for minimal 
cleanup of various comments in proto.

R=iannucci@chromium.org, nodir@chromium.org
BUG=731843
==========

[Vadim Sh., 2017-07-28 22:40:38]

Description was changed from

==========
token-server: Add protos for new API for generating service account tokens.

Add initial bolierplate for implementation. Nothing structurally new here, this
CL repeats existing patterns in the code. Use this opportunity for minimal 
cleanup of various comments in proto.

R=iannucci@chromium.org, nodir@chromium.org
BUG=731843
==========

to

==========
token-server: Add protos for new API for generating service account tokens.

Add initial bolierplate for implementation. Nothing structurally new here, this
CL repeats existing patterns in the code. Use this opportunity for minimal 
cleanup of various comments in proto.

R=iannucci@chromium.org, nodir@chromium.org, smut@google.com
BUG=731843
==========

[Vadim Sh., 2017-07-28 22:40:47]

vadimsh@chromium.org changed reviewers:
+ smut@google.com

[Vadim Sh., 2017-07-28 22:44:46]

Sana, PTAL. This CL looks scary due to a lot of autogenerated code, but the
actual changes are not that big (it's mostly new *.proto structs).

This is to support
https://docs.google.com/document/d/19n1ZVSeuPBdQZfoCDsMhYbfAgXx0Cr5ZZ--coAA1H...

Important parts are:
1. token_minter.proto
2. oauth_token_grant.proto
3. config.proto (though it is mostly empty now)

The rest is auto generated code or support boilerplate.

https://codereview.chromium.org/2785973002/diff/20001/tokenserver/api/admin/v...
File tokenserver/api/admin/v1/config.proto (right):

https://codereview.chromium.org/2785973002/diff/20001/tokenserver/api/admin/v...
tokenserver/api/admin/v1/config.proto:178: // Email of developers that added
this rule, to know who to contact.
On 2017/04/03 22:51:55, nodir wrote:
> s/added/own
> added can be derived from git log

Done.

https://codereview.chromium.org/2785973002/diff/20001/tokenserver/api/minter/...
File tokenserver/api/minter/v1/token_minter.proto (right):

https://codereview.chromium.org/2785973002/diff/20001/tokenserver/api/minter/...
tokenserver/api/minter/v1/token_minter.proto:355: string grant_token            
  = 1; // base64-encoded token with the grant
On 2017/04/03 22:51:55, nodir wrote:
> remove "base64-encoded" because it is meant to be opaque and you don't specify
> the token message

Done. I mentioned base64 only to indicate that the token doesn't have any fancy
characters.

https://codereview.chromium.org/2785973002/diff/20001/tokenserver/api/oauth_t...
File tokenserver/api/oauth_token_grant.proto (right):

https://codereview.chromium.org/2785973002/diff/20001/tokenserver/api/oauth_t...
tokenserver/api/oauth_token_grant.proto:23: int64 subtoken_id = 1;
On 2017/04/03 22:51:55, nodir wrote:
> grant_id?

Renamed to token_id.

[smut, 2017-07-28 23:07:37]

s/bolierplate/boilerplate/ in the description

lgtm

https://codereview.chromium.org/2785973002/diff/80001/tokenserver/api/minter/...
File tokenserver/api/minter/v1/token_minter.proto (right):

https://codereview.chromium.org/2785973002/diff/80001/tokenserver/api/minter/...
tokenserver/api/minter/v1/token_minter.proto:56: //  * OAuth2 access tokens:
these are regular Google OAuth2 access tokens
Is "Google OAuth2" actually different than "OAuth2"?

[Vadim Sh., 2017-07-28 23:10:55]

Description was changed from

==========
token-server: Add protos for new API for generating service account tokens.

Add initial bolierplate for implementation. Nothing structurally new here, this
CL repeats existing patterns in the code. Use this opportunity for minimal 
cleanup of various comments in proto.

R=iannucci@chromium.org, nodir@chromium.org, smut@google.com
BUG=731843
==========

to

==========
token-server: Add protos for new API for generating service account tokens.

Add initial boilerplate for implementation. Nothing structurally new here, this
CL repeats existing patterns in the code. Use this opportunity for minimal 
cleanup of various comments in proto.

R=iannucci@chromium.org, nodir@chromium.org, smut@google.com
BUG=731843
==========

[Vadim Sh., 2017-07-28 23:11:09]

https://codereview.chromium.org/2785973002/diff/80001/tokenserver/api/minter/...
File tokenserver/api/minter/v1/token_minter.proto (right):

https://codereview.chromium.org/2785973002/diff/80001/tokenserver/api/minter/...
tokenserver/api/minter/v1/token_minter.proto:56: //  * OAuth2 access tokens:
these are regular Google OAuth2 access tokens
On 2017/07/28 23:07:37, smut wrote:
> Is "Google OAuth2" actually different than "OAuth2"?

Yeah, only Google servers accept them :) Support for a generic OAuth2 would mean
support for multiple OAuth2 identity providers.

[Vadim Sh., 2017-07-28 23:11:32]

The CQ bit was checked by vadimsh@chromium.org

[Vadim Sh., 2017-07-28 23:11:33]

The patchset sent to the CQ was uploaded after l-g-t-m from nodir@chromium.org
Link to the patchset: https://codereview.chromium.org/2785973002/#ps80001
(title: "more nits")

[commit-bot: I haz the power, 2017-07-28 23:11:46]

CQ is trying da patch.

Follow status at:
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-07-28 23:26:30]

CQ is committing da patch.

Bot data: {"patchset_id": 80001, "attempt_start_ts": 1501283492354290,
"parent_rev": "6df39efb0e62cd4d0a7f23c59b593ae14a777105", "commit_rev":
"8fbab6da1f9e6c96cdcea4159a3b8e11f9ccace2"}

[commit-bot: I haz the power, 2017-07-28 23:26:35]

Description was changed from

==========
token-server: Add protos for new API for generating service account tokens.

Add initial boilerplate for implementation. Nothing structurally new here, this
CL repeats existing patterns in the code. Use this opportunity for minimal 
cleanup of various comments in proto.

R=iannucci@chromium.org, nodir@chromium.org, smut@google.com
BUG=731843
==========

to

==========
token-server: Add protos for new API for generating service account tokens.

Add initial boilerplate for implementation. Nothing structurally new here, this
CL repeats existing patterns in the code. Use this opportunity for minimal 
cleanup of various comments in proto.

R=iannucci@chromium.org, nodir@chromium.org, smut@google.com
BUG=731843

Review-Url: https://codereview.chromium.org/2785973002
Committed:
https://github.com/luci/luci-go/commit/8fbab6da1f9e6c96cdcea4159a3b8e11f9ccace2
==========

[commit-bot: I haz the power, 2017-07-28 23:26:37]

Committed patchset #5 (id:80001) as
https://github.com/luci/luci-go/commit/8fbab6da1f9e6c96cdcea4159a3b8e11f9ccace2