luci-config: fine-grained acls

appengine/config_service/proto/project_config.proto

 // Copyright 2014 The Swarming Authors. All rights reserved.
 // Use of this source code is governed by the Apache v2.0 license that can be
 // found in the LICENSE file.
 
 // Schemas for some of config files in projects/<project_id> config sets.
 
 syntax = "proto2";
 
 package config_service;
 
 // Schema for project.cfg
 message ProjectCfg {
   // Full name of the project.
   optional string name = 1;
+  // A list of identities that have read-only access to the. An element is one
+  // of:
+  // * "group:<group>", where group is defined on auth server.
+  // * "<email>"
+  // * "<identity>"
+  //
+  // If not specified, only admins and trusted services have access.
+  // Talk to admins to determine the group name appropriate for your project.
+  repeated string access = 2;
 }
 
 // Schema of refs.cfg.
 message RefsCfg {
   message Ref {
     // Name of the ref. Must start with "refs/".
     optional string name = 1;
 
     // Path to config directory for the ref. Defaults to "infra/config".
     optional string config_path = 3;
   }
   // List of refs that have configuration files and need to be fetched into
   // luci-config. Refs are accessible through get_refs() API endpoint.
   // A CI service can read all refs of all projects and build them.
   repeated Ref refs = 1;
 }