tokenserver: Extract rules check into a separate function.

tokenserver/appengine/impl/serviceaccounts/rpc_inspect_oauth_token_grant_test.go

 // Copyright 2017 The LUCI Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
 //
 //      http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
@@ skipping 21 matching lines @@
 
         . "github.com/smartystreets/goconvey/convey"
 )
 
 func TestInspectOAuthTokenGrant(t *testing.T) {
         ctx := context.Background()
         ctx, tc := testclock.UseTime(ctx, testclock.TestTimeUTC)
 
         rpc := InspectOAuthTokenGrantRPC{
                 Signer: signingtest.NewSigner(0, nil),
+                Rules: func(context.Context) (*Rules, error) {
+                        return loadConfig(`rules {
+                                name: "rule 1"
+                                service_account: "serviceaccount@robots.com"
+                                proxy: "user:proxy@example.com"
+                                end_user: "user:enduser@example.com"
+                                max_grant_validity_duration: 7200
+                        }`)
+                },
         }
 
         original := &tokenserver.OAuthTokenGrantBody{
                 TokenId:          123,
                 ServiceAccount:   "serviceaccount@robots.com",
                 Proxy:            "user:proxy@example.com",
                 EndUser:          "user:enduser@example.com",
                 IssuedAt:         google.NewTimestamp(clock.Now(ctx)),
                 ValidityDuration: 3600,
         }
 
+        matchingRule := &admin.ServiceAccountRule{
+                Name:                     "rule 1",
+                ServiceAccount:           []string{"serviceaccount@robots.com"},
+                Proxy:                    []string{"user:proxy@example.com"},
+                EndUser:                  []string{"user:enduser@example.com"},
+                MaxGrantValidityDuration: 7200,
+        }
+
         tok, _ := SignGrant(ctx, rpc.Signer, original)
 
         Convey("Happy path", t, func() {
                 resp, err := rpc.InspectOAuthTokenGrant(ctx, &admin.InspectOAuthTokenGrantRequest{
                         Token: tok,
                 })
                 So(err, ShouldBeNil)
                 So(resp, ShouldResemble, &admin.InspectOAuthTokenGrantResponse{
-                        Valid:        true,
-                        Signed:       true,
-                        NonExpired:   true,
-                        SigningKeyId: "f9da5a0d0903bda58c6d664e3852a89c283d7fe9",
-                        TokenBody:    original,
+                        Valid:          true,
+                        Signed:         true,
+                        NonExpired:     true,
+                        SigningKeyId:   "f9da5a0d0903bda58c6d664e3852a89c283d7fe9",
+                        TokenBody:      original,
+                        AllowedByRules: true,
+                        MatchingRule:   matchingRule,
                 })
         })
 
         Convey("Not base64", t, func() {
                 resp, err := rpc.InspectOAuthTokenGrant(ctx, &admin.InspectOAuthTokenGrantRequest{
                         Token: "@@@@@@@@@@@@@",
                 })
                 So(err, ShouldBeNil)
                 So(resp, ShouldResemble, &admin.InspectOAuthTokenGrantResponse{
                         InvalidityReason: "not base64 - illegal base64 data at input byte 0",
@@ skipping 21 matching lines @@
                 })
                 So(err, ShouldBeNil)
 
                 So(resp, ShouldResemble, &admin.InspectOAuthTokenGrantResponse{
                         Valid:            false,
                         Signed:           false,
                         NonExpired:       true,
                         InvalidityReason: "bad signature - crypto/rsa: verification error",
                         SigningKeyId:     "f9da5a0d0903bda58c6d664e3852a89c283d7fe9",
                         TokenBody:        original,
+                        AllowedByRules:   true,
+                        MatchingRule:     matchingRule,
                 })
         })
 
+        Convey("Now allowed by rules", t, func() {
+                another := *original
+                another.ServiceAccount = "unknown@robots.com"
+                tok, _ := SignGrant(ctx, rpc.Signer, &another)
+
+                resp, err := rpc.InspectOAuthTokenGrant(ctx, &admin.InspectOAuthTokenGrantRequest{
+                        Token: tok,
+                })
+                So(err, ShouldBeNil)
+                So(resp, ShouldResemble, &admin.InspectOAuthTokenGrantResponse{
+                        Valid:            false,
+                        Signed:           true,
+                        NonExpired:       true,
+                        InvalidityReason: "not allowed by the rules",
+                        SigningKeyId:     "f9da5a0d0903bda58c6d664e3852a89c283d7fe9",
+                        TokenBody:        &another,
+                })
+        })
+
         Convey("Expired", t, func() {
                 tc.Add(2 * time.Hour)
 
                 resp, err := rpc.InspectOAuthTokenGrant(ctx, &admin.InspectOAuthTokenGrantRequest{
                         Token: tok,
                 })
                 So(err, ShouldBeNil)
 
                 So(resp, ShouldResemble, &admin.InspectOAuthTokenGrantResponse{
                         Valid:            false,
                         Signed:           true,
                         NonExpired:       false,
                         InvalidityReason: "expired",
                         SigningKeyId:     "f9da5a0d0903bda58c6d664e3852a89c283d7fe9",
                         TokenBody:        original,
+                        AllowedByRules:   true,
+                        MatchingRule:     matchingRule,
                 })
         })
 }