Add 'mint_oauth_token' method to RPC client.

appengine/swarming/swarming_bot/bot_code/remote_client.py

 # Copyright 2016 The LUCI Authors. All rights reserved.
 # Use of this source code is governed under the Apache License, Version 2.0
 # that can be found in the LICENSE file.
 
 import base64
 import logging
 import threading
 import time
 import traceback
 import urllib
 
 from utils import net
 
 from remote_client_errors import BotCodeError
 from remote_client_errors import InitializationError
 from remote_client_errors import InternalError
+from remote_client_errors import MintOAuthTokenError
 from remote_client_errors import PollError
 
 
 # RemoteClient will attempt to refresh the authentication headers once they are
 # this close to the expiration.
 #
 # The total possible delay between the headers are checked and used is the sum:
 #  1) FileRefresherThread update interval (15 sec).
 #  2) FileReaderThread update interval (15 sec).
 #  3) NET_CONNECTION_TIMEOUT_SEC, when resending requests on errors (3 min).
@@ skipping 247 matching lines @@
     url_path = '/swarming/api/v1/bot/bot_code/%s?bot_id=%s' % (
         bot_version, urllib.quote_plus(bot_id))
     if not self._url_retrieve(new_zip_path, url_path):
       raise BotCodeError(new_zip_path, self._server + url_path, bot_version)
 
   def ping(self):
     """Unlike all other methods, this one isn't authenticated."""
     resp = net.url_read(self._server + '/swarming/api/v1/bot/server_ping')
     if resp is None:
       logging.error('No response from server_ping')
+
+  def mint_oauth_token(self, task_id, bot_id, account_id, scopes):
+    """Asks the server to generate an access token for a service account.
+
+    Each task has two service accounts associated with it: 'system' and 'task'.
+    Swarming server is capable of generating oauth tokens for them (if the bot
+    is currently authorized to have access to them).
+
+    Args:
+      task_id: identifier of currently executing task.
+      bot_id: name of the bot.
+      account_id: logical identifier of the account (e.g 'system' or 'task').
+      scopes: list of OAuth scopes the new token should have.
+
+    Returns:
+      {
+        'service_account': <str>,      # account email or 'bot', or 'none'
+        'access_token': <str> or None, # actual token, if using real account
+        'expiry': <int>,               # unix timestamp in seconds
+      }
+
+    Raises:
+      InternalError if can't contact the server after many attempts or the
+      server consistently replies with HTTP 5** errors.
+
+      MintOAuthTokenError on fatal errors.
+    """
+    resp = self._url_read_json('/swarming/api/v1/bot/oauth_token', data={
+        'account_id': account_id,
+        'id': bot_id,
+        'scopes': scopes,
+        'task_id': task_id,
+    })
+    if not resp:
+      raise InternalError('Error when minting the token')
+    if resp.get('error'):
+      raise MintOAuthTokenError(resp['error'])
+    return resp