tokenserver: Protos for service account rules.

tokenserver: Protos for service account rules.

Also slightly change RPC messages (unused yet) for consistency.

R=smut@google.com
BUG=731843
Review-Url: https://codereview.chromium.org/2987383002
Committed: https://github.com/luci/luci-go/commit/5e63e25d0fb4fdcc6adc8afceb24a9244f06c724

[Vadim Sh., 2017-08-02 22:35:01]

This is proto-only changes in unused protos.

[smut, 2017-08-02 23:04:17]

Lgtm. I normally wouldn't be this pedantic, but the cl was mostly comments so I
commented on them.

https://codereview.chromium.org/2987383002/diff/1/tokenserver/api/admin/v1/co...
File tokenserver/api/admin/v1/config.proto (right):

https://codereview.chromium.org/2987383002/diff/1/tokenserver/api/admin/v1/co...
tokenserver/api/admin/v1/config.proto:94: // Email of developers that owns this
rule, to know who to contact.
"own", not "owns", because "developers" is plural (subject-verb agreement)

https://codereview.chromium.org/2987383002/diff/1/tokenserver/api/admin/v1/co...
tokenserver/api/admin/v1/config.proto:181: // The usage of a service account is
initiated by an end user, though some
s/though/through/

https://codereview.chromium.org/2987383002/diff/1/tokenserver/api/admin/v1/co...
tokenserver/api/admin/v1/config.proto:198: // that applies to a given service
account.
So when checking ServiceAccountsPermissions you will iterate over all
ServiceAccountRules and inspect each rule's service_accounts, and if you find
exactly one ServiceAccountRule that contains the service account being
requested, you will follow that rule. If you find zero or more than one it's an
error.

Am I understanding right?

https://codereview.chromium.org/2987383002/diff/1/tokenserver/api/admin/v1/co...
tokenserver/api/admin/v1/config.proto:204: // in MintOAuthTokenViaGrant RPC
handler, right before generating the OAuth
"during in" redundant, remove one.

https://codereview.chromium.org/2987383002/diff/1/tokenserver/api/admin/v1/co...
tokenserver/api/admin/v1/config.proto:222: // This identities represent a
"proxy" services that do something with service
s/This/These/, s/services/service/

[Vadim Sh., 2017-08-03 00:23:28]

https://codereview.chromium.org/2987383002/diff/1/tokenserver/api/admin/v1/co...
File tokenserver/api/admin/v1/config.proto (right):

https://codereview.chromium.org/2987383002/diff/1/tokenserver/api/admin/v1/co...
tokenserver/api/admin/v1/config.proto:94: // Email of developers that owns this
rule, to know who to contact.
On 2017/08/02 23:04:16, smut wrote:
> "own", not "owns", because "developers" is plural (subject-verb agreement)

Done.

https://codereview.chromium.org/2987383002/diff/1/tokenserver/api/admin/v1/co...
tokenserver/api/admin/v1/config.proto:181: // The usage of a service account is
initiated by an end user, though some
On 2017/08/02 23:04:16, smut wrote:
> s/though/through/

Done.

https://codereview.chromium.org/2987383002/diff/1/tokenserver/api/admin/v1/co...
tokenserver/api/admin/v1/config.proto:198: // that applies to a given service
account.
On 2017/08/02 23:04:16, smut wrote:
> So when checking ServiceAccountsPermissions you will iterate over all
> ServiceAccountRules and inspect each rule's service_accounts, and if you find
> exactly one ServiceAccountRule that contains the service account being
> requested, you will follow that rule. If you find zero or more than one it's
an
> error.
> 
> Am I understanding right?

Yes.

"More than one" check will happen when the config is being imported (and double
checked when it is loaded into memory for serving). The "in-memory"
representation of this config will be map[service account
email]ServiceAccountRule, to avoid scanning it linearly all the time.

https://codereview.chromium.org/2987383002/diff/1/tokenserver/api/admin/v1/co...
tokenserver/api/admin/v1/config.proto:204: // in MintOAuthTokenViaGrant RPC
handler, right before generating the OAuth
On 2017/08/02 23:04:16, smut wrote:
> "during in" redundant, remove one.

Done.

https://codereview.chromium.org/2987383002/diff/1/tokenserver/api/admin/v1/co...
tokenserver/api/admin/v1/config.proto:222: // This identities represent a
"proxy" services that do something with service
On 2017/08/02 23:04:16, smut wrote:
> s/This/These/, s/services/service/

Done.

[Vadim Sh., 2017-08-03 00:23:44]

The CQ bit was checked by vadimsh@chromium.org

[Vadim Sh., 2017-08-03 00:23:45]

The patchset sent to the CQ was uploaded after l-g-t-m from smut@google.com
Link to the patchset: https://codereview.chromium.org/2987383002/#ps20001
(title: "tokenserver: Protos for service account rules.")

[commit-bot: I haz the power, 2017-08-03 00:23:54]

CQ is trying da patch.

Follow status at:
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-08-03 00:28:44]

CQ is committing da patch.

Bot data: {"patchset_id": 20001, "attempt_start_ts": 1501719824822840,
"parent_rev": "6ad55f6eef0b637bacc1782dc260803facb1b021", "commit_rev":
"5e63e25d0fb4fdcc6adc8afceb24a9244f06c724"}

[commit-bot: I haz the power, 2017-08-03 00:28:48]

Description was changed from

==========
tokenserver: Protos for service account rules.

Also slightly change RPC messages (unused yet) for consistency.

R=smut@google.com
BUG=731843
==========

to

==========
tokenserver: Protos for service account rules.

Also slightly change RPC messages (unused yet) for consistency.

R=smut@google.com
BUG=731843

Review-Url: https://codereview.chromium.org/2987383002
Committed:
https://github.com/luci/luci-go/commit/5e63e25d0fb4fdcc6adc8afceb24a9244f06c724
==========

[commit-bot: I haz the power, 2017-08-03 00:28:49]

Committed patchset #2 (id:20001) as
https://github.com/luci/luci-go/commit/5e63e25d0fb4fdcc6adc8afceb24a9244f06c724