is_revoked bails out on first unrelated branch

[Yuriy Taraday]

When verifying if token is revoked using revocation tree, is_revoked immediately returns False if on another level we get first tree in a bundle that has no branches related to the token.

This happens because new bundle is verified too early. This check needs to be shifted to upper level.

Example:

* create a token for one user in some project;
* revoke some other user's tokens;
* revoke this user's tokens in the same project.

The token created in the first step will still be considered valid.

[Adam Young (ayoung)]

One variation of this I have seen is where a user has a project/role revoked, then gets a token for a second project/role. If the whole user is then disabled, the token is would not be considered invalid.

 and a token comes in with a different role/project in it.

[Dolph Mathews (dolph)]

https://review.openstack.org/#/c/81235/

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/81235
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=a96d87200d14cc123f8a538b717db9624ece8a15
Submitter: Jenkins
Branch: master

commit a96d87200d14cc123f8a538b717db9624ece8a15
Author: Yuriy Taraday <email address hidden>
Date: Tue Mar 18 15:23:39 2014 +0400

    is_revoked check all viable subtrees

    An indentation error coupled with an early return lead to cases
    where a subtree containing a pertinent revocation event was not
    searched, and a revoked token would report as unrevoked.

    Closes-bug: #1294292
    Change-Id: If56ae64d8a30b461563ee8be002544117fb14215