luci-config: fine-grained acls

appengine/components/components/config/common.py

Index: appengine/components/components/config/common.py
diff --git a/appengine/components/components/config/common.py b/appengine/components/components/config/common.py
index 47d7f20759a943073404db469f79b04538072428..f0f7dde2c8a3a3309d45f677df9e5e2d7231ab97 100644
--- a/appengine/components/components/config/common.py
+++ b/appengine/components/components/config/common.py
@@ -15,6 +15,7 @@ utils.fix_protobuf_package()
 
 from google import protobuf
 
+from components import auth
 from components import utils
 from components.datastore_utils import config
 
@@ -32,7 +33,7 @@ PROJECT_ID_RGX = re.compile(r'^%s$' % PROJECT_ID_PATTERN)
 PROJECT_CONFIG_SET_RGX = re.compile(r'^projects/(%s)$' % PROJECT_ID_PATTERN)
 
 REF_CONFIG_SET_RGX = re.compile(
-    r'^projects/(%s)/(refs/.+$)' % PROJECT_ID_PATTERN)
+    r'^projects/(%s)/(refs/.+)$' % PROJECT_ID_PATTERN)
 
 ALL_CONFIG_SET_RGX = [
   SERVICE_CONFIG_SET_RGX,
@@ -56,6 +57,8 @@ CONSTANTS = lib_config.register('components_config', ConstantConfig.__dict__)
 class ConfigSettings(config.GlobalConfig):
   # Hostname of the config service.
   service_hostname = ndb.StringProperty(indexed=False)
+  # Identity account used by config service.
+  trusted_config_account = auth.IdentityProperty(indexed=False)
 
 
 ################################################################################