tokenserver: Extract rules check into a separate function.

tokenserver/api/admin/v1/admin.proto

 // Copyright 2016 The LUCI Authors. All rights reserved.
 // Use of this source code is governed under the Apache License, Version 2.0
 // that can be found in the LICENSE file.
 
 syntax = "proto3";
 
 package tokenserver.admin;
 
 import "google/protobuf/empty.proto";
 
 import "github.com/luci/luci-go/server/auth/delegation/messages/delegation.proto";
+import "github.com/luci/luci-go/tokenserver/api/admin/v1/config.proto";
 import "github.com/luci/luci-go/tokenserver/api/machine_token.proto";
 import "github.com/luci/luci-go/tokenserver/api/oauth_token_grant.proto";
 
 
 // Admin service is used by service administrators to manage the server.
 service Admin {
   // ImportCAConfigs makes the server read 'tokenserver.cfg'.
   rpc ImportCAConfigs(google.protobuf.Empty) returns (ImportedConfigs);
 
   // ImportDelegationConfigs makes the server read 'delegation.cfg'.
@@ skipping 195 matching lines @@
 message InspectOAuthTokenGrantRequest {
   // The token body.
   string token = 1;
 }
 
 
 // InspectOAuthTokenGrantResponse is return value of InspectOAuthTokenGrant RPC.
 message InspectOAuthTokenGrantResponse {
   // True if the token is valid.
   //
-  // A token is valid if its signature is correct and it hasn't expired yet.
+  // A token is valid if its signature is correct, it hasn't expired yet and
+  // token server rules still allow it.
   bool valid = 1;
 
   // Human readable summary of why token is invalid.
   //
   // Summarizes the rest of the fields of this struct. Set only if 'valid' is
   // false.
   string invalidity_reason = 2;
 
   // True if the token signature was verified.
   //
@@ skipping 16 matching lines @@
   // We use "non_" prefix to make default 'false' value safer.
   bool non_expired = 4;
 
   // ID of a token server private key used to sign the token.
   string signing_key_id = 5;
 
   // The deserialized token body.
   //
   // May be empty if token was malformed and couldn't be deserialized.
   tokenserver.OAuthTokenGrantBody token_body = 6;
+
+  // The service_accounts.cfg rule that governs the service account usage.
+  //
+  // May be present even if the token is not allowed by it.
+  admin.ServiceAccountRule matching_rule = 7;
+
+  // True if current service_accounts.cfg rules allow this token.
+  bool allowed_by_rules = 8;
 }