[FEAT] allow callout service to generate users for any account (#197)

* [FEAT] allow callout service to generate users for any account, added constant `AnyAccount` for wildcard

v2/account_claims.go

@@ -24,7 +24,10 @@ import (
 )
 
 // NoLimit is used to indicate a limit field is unlimited in value.
-const NoLimit = -1
+const (
+	NoLimit    = -1
+	AnyAccount = "*"
+)
 
 type AccountLimits struct {
 	Imports         int64 `json:"imports,omitempty"`         // Max number of imports
@@ -206,7 +209,12 @@ func (ac *ExternalAuthorization) Validate(vr *ValidationResults) {
 		}
 	}
 	for _, a := range ac.AllowedAccounts {
-		if !nkeys.IsValidPublicAccountKey(a) {
+		if a == AnyAccount && len(ac.AllowedAccounts) > 1 {
+			vr.AddError("AllowedAccounts can only be a list of accounts or %q", AnyAccount)
+			continue
+		} else if a == AnyAccount {
+			continue
+		} else if !nkeys.IsValidPublicAccountKey(a) {
 			vr.AddError("Account %q is not a valid account public key", a)
 		}
 	}

v2/account_claims_test.go

@@ -16,6 +16,7 @@
 package jwt
 
 import (
+	"fmt"
 	"testing"
 	"time"
 
@@ -763,6 +764,37 @@ func TestAccountExternalAuthorizationRequiresOneUser(t *testing.T) {
 		t)
 }
 
+func TestAccountExternalAuthorizationAnyAccount(t *testing.T) {
+	akp := createAccountNKey(t)
+	apk := publicKey(akp, t)
+	ukp := createUserNKey(t)
+	upk := publicKey(ukp, t)
+
+	account := NewAccountClaims(apk)
+	account.Authorization.AllowedAccounts.Add("*")
+	account.Authorization.AuthUsers.Add(upk)
+
+	vr := &ValidationResults{}
+	account.Validate(vr)
+	AssertEquals(len(vr.Errors()), 0, t)
+}
+
+func TestAccountExternalAuthorizationAnyAccountAndSpecificFails(t *testing.T) {
+	akp := createAccountNKey(t)
+	apk := publicKey(akp, t)
+	ukp := createUserNKey(t)
+	upk := publicKey(ukp, t)
+
+	account := NewAccountClaims(apk)
+	account.Authorization.AllowedAccounts.Add("*", apk)
+	account.Authorization.AuthUsers.Add(upk)
+
+	vr := &ValidationResults{}
+	account.Validate(vr)
+	AssertEquals(len(vr.Errors()), 1, t)
+	AssertEquals(vr.Errors()[0].Error(), fmt.Sprintf("AllowedAccounts can only be a list of accounts or %q", AnyAccount), t)
+}
+
 func TestAccountClaims_DidSign(t *testing.T) {
 	akp := createAccountNKey(t)
 	apk := publicKey(akp, t)