tokenserver: Validate and parse service_accounts.cfg rules.

tokenserver/appengine/impl/serviceaccounts/rpc_import_service_accounts_configs_test.go

 // Copyright 2017 The LUCI Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
 //
 //      http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
@@ skipping 25 matching lines @@
         t.Parallel()
 
         Convey("Works", t, func() {
                 ctx := gaetesting.TestingContext()
                 ctx, clk := testclock.UseTime(ctx, testclock.TestTimeUTC)
 
                 ctx = prepareCfg(ctx, `rules {
                         name: "rule 1"
                         owner: "developer@example.com"
                         service_account: "abc@robots.com"
-                        allowed_scope: "https://scope"
+                        allowed_scope: "https://www.googleapis.com/scope"
                         end_user: "user:abc@example.com"
                         end_user: "group:group-name"
                         proxy: "user:proxy@example.com"
                         max_grant_validity_duration: 3600
                 }`)
 
                 rules := NewRulesCache()
                 rpc := ImportServiceAccountsConfigsRPC{RulesCache: rules}
 
                 // No config.
                 r, err := rules.Rules(ctx)
                 So(err, ShouldEqual, policy.ErrNoPolicy)
 
                 resp, err := rpc.ImportServiceAccountsConfigs(ctx, nil)
                 So(err, ShouldBeNil)
                 So(resp, ShouldResemble, &admin.ImportedConfigs{
-                        Revision: "16d15198a351a6a9beb7afe6f3485c9a47b18f7d",
+                        Revision: "1cf48bbdc045f33856894adf9c7d7e4211e28b2a",
                 })
 
                 // Have config now.
                 r, err = rules.Rules(ctx)
                 So(err, ShouldBeNil)
-                So(r.ConfigRevision(), ShouldEqual, "16d15198a351a6a9beb7afe6f3485c9a47b18f7d")
+                So(r.ConfigRevision(), ShouldEqual, "1cf48bbdc045f33856894adf9c7d7e4211e28b2a")
 
                 // Noop import.
                 resp, err = rpc.ImportServiceAccountsConfigs(ctx, nil)
                 So(err, ShouldBeNil)
-                So(resp.Revision, ShouldEqual, "16d15198a351a6a9beb7afe6f3485c9a47b18f7d")
+                So(resp.Revision, ShouldEqual, "1cf48bbdc045f33856894adf9c7d7e4211e28b2a")
 
                 // Try to import completely broken config.
                 ctx = prepareCfg(ctx, `I'm broken`)
                 _, err = rpc.ImportServiceAccountsConfigs(ctx, nil)
                 So(err, ShouldErrLike, `line 1.0: unknown field name`)
 
                 // Old config is not replaced.
                 r, _ = rules.Rules(ctx)
-                So(r.ConfigRevision(), ShouldEqual, "16d15198a351a6a9beb7afe6f3485c9a47b18f7d")
+                So(r.ConfigRevision(), ShouldEqual, "1cf48bbdc045f33856894adf9c7d7e4211e28b2a")
 
                 // Roll time to expire local rules cache.
                 clk.Add(10 * time.Minute)
 
                 // Have new config now!
                 ctx = prepareCfg(ctx, `rules {
                         name: "rule 2"
                         owner: "developer@example.com"
                         service_account: "abc@robots.com"
-                        allowed_scope: "https://scope"
+                        allowed_scope: "https://www.googleapis.com/scope"
                         end_user: "user:abc@example.com"
                         end_user: "group:group-name"
                         proxy: "user:proxy@example.com"
                         max_grant_validity_duration: 3600
                 }`)
 
                 // Import it.
                 resp, err = rpc.ImportServiceAccountsConfigs(ctx, nil)
                 So(err, ShouldBeNil)
                 So(resp, ShouldResemble, &admin.ImportedConfigs{
-                        Revision: "663ea6e319c41b6fcee65d8d1d5c758813aa0fb1",
+                        Revision: "7d835b8ae2e227099324bf17ee1f2c828011ff1c",
                 })
 
                 // It is now active.
                 r, err = rules.Rules(ctx)
                 So(err, ShouldBeNil)
-                So(r.ConfigRevision(), ShouldEqual, "663ea6e319c41b6fcee65d8d1d5c758813aa0fb1")
+                So(r.ConfigRevision(), ShouldEqual, "7d835b8ae2e227099324bf17ee1f2c828011ff1c")
         })
 }
 
 func prepareCfg(c context.Context, configFile string) context.Context {
         return testconfig.WithCommonClient(c, memory.New(map[string]memory.ConfigSet{
                 "services/" + info.AppID(c): {
                         "service_accounts.cfg": configFile,
                 },
         }))
 }