luci-config: fine-grained acls

appengine/config_service/api.py

 # Copyright 2015 The Swarming Authors. All rights reserved.
 # Use of this source code is governed by the Apache v2.0 license that can be
 # found in the LICENSE file.
 
 import logging
 
 from protorpc import messages
 from protorpc import message_types
 from protorpc import remote
 import endpoints
@@ skipping 37 matching lines @@
     content = messages.BytesField(4)
   configs = messages.MessageField(ConfigEntry, 1, repeated=True)
 
 
 @auth.endpoints_api(name='config', version='v1', title='Configuration Service')
 class ConfigApi(remote.Service):
   """API to access configurations."""
 
   def can_read_config_set(self, config_set):
     try:
-      return acl.can_read_config_set(
-          config_set, headers=self.request_state.headers)
+      return acl.can_read_config_set(config_set)
     except ValueError:
       raise endpoints.BadRequestException('Invalid config set: %s' % config_set)
 
   ##############################################################################
   # endpoint: get_mapping
 
   class GetMappingResponseMessage(messages.Message):
     class Mapping(messages.Message):
       config_set = messages.StringField(1, required=True)
       location = messages.StringField(2)
@@ skipping 108 matching lines @@
   @auth.endpoints_method(
       message_types.VoidMessage,
       GetProjectsResponseMessage,
       http_method='GET',
       path='projects')
   def get_projects(self, request):  # pylint: disable=W0613
     """Gets list of registered projects.
 
     The project list is stored in services/luci-config:projects.cfg.
     """
-    if not acl.can_read_project_list():
-      raise endpoints.ForbiddenException()
-    return self.GetProjectsResponseMessage(projects=get_projects())
+    return self.GetProjectsResponseMessage(
+        projects=[p for p in get_projects() if acl.has_project_access(p.id)],
+    )
 
   ##############################################################################
   # endpoint: get_refs
 
   class GetRefsResponseMessage(messages.Message):
     class Ref(messages.Message):
       name = messages.StringField(1)
     refs = messages.MessageField(Ref, 1, repeated=True)
 
   @auth.endpoints_method(
       endpoints.ResourceContainer(
           message_types.VoidMessage,
           project_id=messages.StringField(1, required=True),
       ),
       GetRefsResponseMessage,
       http_method='GET',
       path='projects/{project_id}/refs')
   def get_refs(self, request):
     """Gets list of refs of a project."""
-    if not acl.can_read_project_config(request.project_id):
+    if not acl.has_project_access(request.project_id):
       raise endpoints.NotFoundException()
     ref_names = get_ref_names(request.project_id)
     if ref_names is None:
       # Project not found
       raise endpoints.NotFoundException()
     res = self.GetRefsResponseMessage()
     res.refs = [res.Ref(name=ref) for ref in ref_names]
     return res
 
   ##############################################################################
@@ skipping 76 matching lines @@
     # Project does not exist
     return None
   return [ref.name for ref in refs]
 
 
 def get_config_multi(config_sets, path, hashes_only):
   """Returns configs at |path| in all config sets.
 
   Returns empty config list if requester does not have project access.
   """
-  if not acl.has_project_access():
-    raise endpoints.ForbiddenException()
-
   res = GetConfigMultiResponseMessage()
+  config_sets = filter(acl.can_read_config_set, config_sets)
   configs = storage.get_latest_multi_async(
       config_sets, path, hashes_only).get_result()
   for config in configs:
     if not hashes_only and config.get('content') is None:
       logging.error(
           'Blob %s referenced from %s:%s:%s was not found',
           config['content_hash'],
           config['config_set'],
           config['revision'],
           path)
       continue
     res.configs.append(res.ConfigEntry(
         config_set=config['config_set'],
         revision=config['revision'],
         content_hash=config['content_hash'],
         content=config.get('content'),
     ))
   return res
 
 
 def raise_config_not_found():
   raise endpoints.NotFoundException('The requested config is not found')