macaroons: add custom caveat contraint and checker

The way the macaroon bakery library lnd uses works is that one has to
register a Checker method for each caveat name that should be supported.
Since we want to allow fully customizable custom caveats we add another
layer of naming to the caveat by splitting the condition of the "outer"
caveat into two pieces, the custom caveat name and the actual custom
caveat condition.
The custom Checker function only checks that the format is correct and
that there is a handler available for a custom condition. It does not
check the condition itself, however. If the passed in acceptor signals
acceptance of a custom caveat then the bakery accepts the macaroon as a
whole (given its signature, standard caveats and permissions are all
correct) and assumes that another component down the line will make sure
the actual custom condition of a caveat is valid.

macaroons/constraints_test.go

@@ -6,6 +6,8 @@ import (
 	"testing"
 	"time"
 
+	"github.com/stretchr/testify/require"
+
 	"github.com/lightningnetwork/lnd/macaroons"
 	macaroon "gopkg.in/macaroon.v2"
 )
@@ -112,3 +114,34 @@ func TestIPLockBadIP(t *testing.T) {
 		t.Fatalf("IPLockConstraint with bad IP should fail.")
 	}
 }
+
+// TestCustomConstraint tests that a custom constraint with a name and value can
+// be added to a macaroon.
+func TestCustomConstraint(t *testing.T) {
+	// Test a custom caveat with a value first.
+	constraintFunc := macaroons.CustomConstraint("unit-test", "test-value")
+	testMacaroon := createDummyMacaroon(t)
+	require.NoError(t, constraintFunc(testMacaroon))
+
+	require.Equal(
+		t, []byte("lnd-custom unit-test test-value"),
+		testMacaroon.Caveats()[0].Id,
+	)
+	require.True(t, macaroons.HasCustomCaveat(testMacaroon, "unit-test"))
+	require.False(t, macaroons.HasCustomCaveat(testMacaroon, "test-value"))
+	require.False(t, macaroons.HasCustomCaveat(testMacaroon, "something"))
+	require.False(t, macaroons.HasCustomCaveat(nil, "foo"))
+
+	// Custom caveats don't necessarily need a value, just the name is fine
+	// too to create a tagged macaroon.
+	constraintFunc = macaroons.CustomConstraint("unit-test", "")
+	testMacaroon = createDummyMacaroon(t)
+	require.NoError(t, constraintFunc(testMacaroon))
+
+	require.Equal(
+		t, []byte("lnd-custom unit-test"), testMacaroon.Caveats()[0].Id,
+	)
+	require.True(t, macaroons.HasCustomCaveat(testMacaroon, "unit-test"))
+	require.False(t, macaroons.HasCustomCaveat(testMacaroon, "test-value"))
+	require.False(t, macaroons.HasCustomCaveat(testMacaroon, "something"))
+}