tokenserver: Implement InspectOAuthTokenGrant RPC.

tokenserver/appengine/impl/serviceaccounts/rpc_inspect_oauth_token_grant.go

Index: tokenserver/appengine/impl/serviceaccounts/rpc_inspect_oauth_token_grant.go
diff --git a/tokenserver/appengine/impl/serviceaccounts/rpc_inspect_oauth_token_grant.go b/tokenserver/appengine/impl/serviceaccounts/rpc_inspect_oauth_token_grant.go
index dbc8cfd5a4dd859169f5f07fba8772788e0e0562..a8e388694061f1631579d918e0d8d1f6a11cc1cf 100644
--- a/tokenserver/appengine/impl/serviceaccounts/rpc_inspect_oauth_token_grant.go
+++ b/tokenserver/appengine/impl/serviceaccounts/rpc_inspect_oauth_token_grant.go
@@ -9,14 +9,35 @@ import (
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 
+	"github.com/luci/luci-go/server/auth/signing"
+
+	"github.com/luci/luci-go/tokenserver/api"
 	"github.com/luci/luci-go/tokenserver/api/admin/v1"
 )
 
-// InspectOAuthTokenGrantRPC implements Admin.InspectOAuthTokenGrant method.
+// InspectOAuthTokenGrantRPC implements admin.InspectOAuthTokenGrant method.
 type InspectOAuthTokenGrantRPC struct {
+	// Signer is mocked in tests.
+	//
+	// In prod it is gaesigner.Signer.
+	Signer signing.Signer
 }
 
 // InspectOAuthTokenGrant decodes the given OAuth token grant.
-func (r *ImportServiceAccountsConfigsRPC) InspectOAuthTokenGrant(c context.Context, req *admin.InspectOAuthTokenGrantRequest) (*admin.InspectOAuthTokenGrantResponse, error) {
-	return nil, grpc.Errorf(codes.Unavailable, "not implemented")
+func (r *InspectOAuthTokenGrantRPC) InspectOAuthTokenGrant(c context.Context, req *admin.InspectOAuthTokenGrantRequest) (*admin.InspectOAuthTokenGrantResponse, error) {
+	inspection, err := InspectGrant(c, r.Signer, req.Token)
+	if err != nil {
+		return nil, grpc.Errorf(codes.Internal, err.Error())
+	}
+	resp := &admin.InspectOAuthTokenGrantResponse{
+		Valid:            inspection.Signed && inspection.NonExpired,
+		Signed:           inspection.Signed,
+		NonExpired:       inspection.NonExpired,
+		InvalidityReason: inspection.InvalidityReason,
+	}
+	if env, _ := inspection.Envelope.(*tokenserver.OAuthTokenGrantEnvelope); env != nil {
+		resp.SigningKeyId = env.KeyId
+	}
+	resp.TokenBody, _ = inspection.Body.(*tokenserver.OAuthTokenGrantBody)
+	return resp, nil
 }