token-server: Add protos for new API for generating service account tokens.

tokenserver/api/admin/v1/config.proto

 // Copyright 2016 The LUCI Authors. All rights reserved.
 // Use of this source code is governed under the Apache License, Version 2.0
 // that can be found in the LICENSE file.
 
 syntax = "proto3";
 
 package tokenserver.admin;
 
 
 // TokenServerConfig is read from tokenserver.cfg in luci-config.
@@ skipping 140 matching lines @@
   //  * A service identity string ("service:<id>").
   //  * A special token "*" that mean "any LUCI service should accept the
   //    token".
   repeated string target_service = 6;
 
   // Maximum allowed validity duration (sec) of minted delegation tokens.
   //
   // Default is 12 hours.
   int64 max_validity_duration = 7;
 }
+
+
+// ServiceAccountsPermissions is read from service_accounts.cfg in luci-config.
+message ServiceAccountsPermissions {
+  // Rules specify how MintOAuthTokenViaGrant can be used.
+  //
+  // Rules are evaluated independently. One and only one rule should match the
+  // request to allow the operation. If none rules or more than one rule match,
+  // the request will be denied.
+  //
+  // See ServiceAccountRule comments for more details.
+  repeated ServiceAccountRule rules = 1;
+}
+
+
+// ServiceAccountRule describes a single allowed case of using service accounts.
+//
+// TODO(vadimsh): Implement.
+message ServiceAccountRule {
+  // A descriptive name of this rule, for the audit log.
+  string name = 1;
+
+  // Email of developers that owns this rule, to know who to contact.
+  repeated string owner = 2;
+}