Extend LUCI_CONTEXT["local_auth"] protocol to understand accounts.

common/auth/localauth/server_test.go

 // Copyright 2017 The LUCI Authors. All rights reserved.
 // Use of this source code is governed under the Apache License, Version 2.0
 // that can be found in the LICENSE file.
 
 package localauth
 
 import (
         "bytes"
         "encoding/json"
         "fmt"
@@ skipping 72 matching lines @@
 func TestProtocol(t *testing.T) {
         t.Parallel()
 
         ctx := context.Background()
         ctx, _ = testclock.UseTime(ctx, testclock.TestRecentTimeLocal)
 
         Convey("With server", t, func(c C) {
                 // Use channels to pass mocked requests/responses back and forth.
                 requests := make(chan []string, 10000)
                 responses := make(chan interface{}, 1)
+
+                testGen := func(ctx context.Context, scopes []string, lifetime time.Duration) (*oauth2.Token, error) {

[Vadim Sh., 2017/06/19 20:16:28]

no changes here, just moved

+                        requests <- scopes
+                        var resp interface{}
+                        select {
+                        case resp = <-responses:
+                        default:
+                                c.Println("Unexpected token request")
+                                return nil, fmt.Errorf("Unexpected request")
+                        }
+                        switch resp := resp.(type) {
+                        case error:
+                                return nil, resp
+                        case *oauth2.Token:
+                                return resp, nil
+                        default:
+                                panic("unknown response")
+                        }
+                }
+
                 s := Server{
-                        TokenGenerator: func(ctx context.Context, scopes []string, lifetime time.Duration) (*oauth2.Token, error) {
-                                requests <- scopes
-                                var resp interface{}
-                                select {
-                                case resp = <-responses:
-                                default:
-                                        c.Println("Unexpected token request")
-                                        return nil, fmt.Errorf("Unexpected request")
-                                }
-                                switch resp := resp.(type) {
-                                case error:
-                                        return nil, resp
-                                case *oauth2.Token:
-                                        return resp, nil
-                                default:
-                                        panic("unknown response")
-                                }
-                        },
+                        TokenGenerators: map[string]TokenGenerator{"acc_id": testGen},
                 }
                 p, err := s.Initialize(ctx)
                 So(err, ShouldBeNil)
 
                 done := make(chan struct{})
                 go func() {
                         s.Serve()
                         close(done)
                 }()
                 defer func() {
                         s.Close()
                         <-done
                 }()
 
                 goodRequest := func() *http.Request {
                         return prepReq(p, "/rpc/LuciLocalAuthService.GetOAuthToken", map[string]interface{}{
-                                "scopes": []string{"B", "A"},
-                                "secret": p.Secret,
+                                "scopes":     []string{"B", "A"},
+                                "secret":     p.Secret,
+                                "account_id": "acc_id",
                         })
                 }
 
                 Convey("Happy path", func() {
                         responses <- &oauth2.Token{
                                 AccessToken: "tok1",
                                 Expiry:      clock.Now(ctx).Add(30 * time.Minute),
                         }
                         So(call(goodRequest()), ShouldEqual, `HTTP 200 (json): {"access_token":"tok1","expiry":1454502906}`)
                         So(<-requests, ShouldResemble, []string{"A", "B"})
@@ skipping 54 matching lines @@
 
                 Convey("Unknown RPC method", func() {
                         req := prepReq(p, "/rpc/LuciLocalAuthService.UnknownMethod", map[string]interface{}{})
                         So(call(req), ShouldEqual, `HTTP 404: Unknown RPC method "UnknownMethod"`)
                 })
 
                 Convey("No scopes", func() {
                         req := prepReq(p, "/rpc/LuciLocalAuthService.GetOAuthToken", map[string]interface{}{
                                 "secret": p.Secret,
                         })
-                        So(call(req), ShouldEqual, `HTTP 400: Field "scopes" is required.`)
+                        So(call(req), ShouldEqual, `HTTP 400: Bad request: field "scopes" is required.`)
                 })
 
                 Convey("No secret", func() {
                         req := prepReq(p, "/rpc/LuciLocalAuthService.GetOAuthToken", map[string]interface{}{
                                 "scopes": []string{"B", "A"},
                         })
-                        So(call(req), ShouldEqual, `HTTP 400: Field "secret" is required.`)
+                        So(call(req), ShouldEqual, `HTTP 400: Bad request: field "secret" is required.`)
                 })
 
                 Convey("Bad secret", func() {
                         req := prepReq(p, "/rpc/LuciLocalAuthService.GetOAuthToken", map[string]interface{}{
-                                "scopes": []string{"B", "A"},
-                                "secret": []byte{0, 1, 2, 3},
+                                "scopes":     []string{"B", "A"},
+                                "secret":     []byte{0, 1, 2, 3},
+                                "account_id": "acc_id",
                         })
                         So(call(req), ShouldEqual, `HTTP 403: Invalid secret.`)
                 })
 
+                Convey("No account ID", func() {
+                        req := prepReq(p, "/rpc/LuciLocalAuthService.GetOAuthToken", map[string]interface{}{
+                                "scopes": []string{"B", "A"},
+                                "secret": p.Secret,
+                        })
+                        So(call(req), ShouldEqual, `HTTP 400: Bad request: field "account_id" is required.`)
+                })
+
+                Convey("Unknown account ID", func() {
+                        req := prepReq(p, "/rpc/LuciLocalAuthService.GetOAuthToken", map[string]interface{}{
+                                "scopes":     []string{"B", "A"},
+                                "secret":     p.Secret,
+                                "account_id": "unknown_acc_id",
+                        })
+                        So(call(req), ShouldEqual, `HTTP 404: Unrecognized account ID "unknown_acc_id".`)
+                })
+
                 Convey("Token generator returns fatal error", func() {
                         responses <- fmt.Errorf("fatal!!111")
                         So(call(goodRequest()), ShouldEqual, `HTTP 200 (json): {"error_code":-1,"error_message":"fatal!!111"}`)
                 })
 
                 Convey("Token generator returns ErrorWithCode", func() {
                         responses <- errWithCode{
                                 error: fmt.Errorf("with code"),
                                 code:  123,
                         }
@@ skipping 53 matching lines @@
                 panic(err)
         }
 
         tp := ""
         if resp.Header.Get("Content-Type") == "application/json; charset=utf-8" {
                 tp = " (json)"
         }
 
         return fmt.Sprintf("HTTP %d%s: %s", resp.StatusCode, tp, strings.TrimSpace(string(blob)))
 }