def prepare_auth_params_json(bot, manifest):
  """Returns a dict to put into JSON file passed to task_runner.

  This JSON file contains various tokens and configuration parameters that allow
  task_runner to make HTTP calls authenticated by bot's own credentials.

  The file is managed by bot_main.py (main Swarming bot process) and consumed by
  task_runner.py.

  It lives it the task work directory.

  Args:
    bot: instance of bot.Bot.
    manifest: dict with the task manifest, as generated by the backend in /poll.
  """
  # This is "<kind>:<id>", e.g. "user:abc@example.com" or "bot:abc.example.com".
  # Service accounts appear as "user:<account-email>" strings.
  bot_ident = manifest.get('bot_authenticated_as', '')
  bot_service_account = 'none'
  if bot_ident.startswith('user:'):
    bot_service_account = bot_ident[len('user:'):]

  def account(acc_id):
    acc = (manifest.get('service_accounts') or {}).get(acc_id) or {}
    return acc.get('service_account') or 'none'

  return {
    'bot_id': bot.id,
    'task_id': manifest['task_id'],
    'swarming_http_headers': bot.remote.get_authentication_headers(),
    'swarming_http_headers_exp': bot.remote.authentication_headers_expiration,
    'bot_service_account': bot_service_account,
    'system_service_account': account('system'),
    'task_service_account': account('task'),
  }