tokenserver: Protos for service account rules.

tokenserver/api/minter/v1/token_minter.proto

 // Copyright 2016 The LUCI Authors. All rights reserved.
 // Use of this source code is governed under the Apache License, Version 2.0
 // that can be found in the LICENSE file.
 
 syntax = "proto3";
 
 package tokenserver.minter;
 
 import "google/protobuf/timestamp.proto";
 
@@ skipping 322 matching lines @@
   // An end user that wants to act as the service account (perhaps indirectly).
   //
   // A string of the form "user:<email>". On Swarming, this is an identity of
   // a user that posted the task.
   //
   // TODO(vadimsh): Verify that this user is present during MintOAuthTokenGrant
   // RPC by requiring the end user's credentials, e.g make Swarming forward
   // user's OAuth token to the token server, where it can be validated.
   //
   // Required.
-  string end_user_identity = 3;
+  string end_user = 3;
 
   // Optional reason why the grant is created.
   //
   // Used only for logging and auditing purposes. Doesn't become part of the
   // grant.
   string intent = 4;
 }
 
 
 // MintOAuthTokenGrantResponse is returned by MintOAuthTokenGrant.
@@ skipping 13 matching lines @@
 //
 // Additional implicit field is the identity of whoever makes this call. It is
 // compared against 'wielder_identity' inside the token.
 message MintOAuthTokenViaGrantRequest {
   // A previously generated grant, as returned by MintOAuthTokenGrant.
   string grant_token = 1;
 
   // The list of OAuth scopes the access token should have.
   //
   // The server may reject the request if some scopes are not allowed.
-  repeated string oauth_scopes = 2;
+  repeated string oauth_scope = 2;
 
   // Minimally accepted validity duration of the returned OAuth token (seconds).
   //
   // The server may return a token that lives longer than this. The maximum is
   // 1h. An attempt to get a token that lives longer than 1h will result in
   // an error.
   //
   // The returned token validity duration doesn't depend on the lifetime of
   // the grant: it's possible to use a grant that expires in 1 sec to get an
   // access token that lives for 1h.
   //
   // Default is 300 sec.
   int64 min_validity_duration = 3;
 }
 
 
 // MintOAuthTokenViaGrantResponse is returned by MintOAuthTokenViaGrant.
 message MintOAuthTokenViaGrantResponse {
   string access_token = 1;              // service account OAuth2 access token
   google.protobuf.Timestamp expiry = 2; // when this token expires
 
   // Identifier of the service and its version that produced the token.
   //
   // Has the form "<app-id>/<module-version>". Used only for logging and
   // monitoring.
   string service_version = 3;
 }