LogDog: Add prefix registration endpoint.

appengine/logdog/coordinator/context.go

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 package coordinator
 
 import (
         "fmt"
 
         "github.com/luci/gae/service/info"
         luciConfig "github.com/luci/luci-go/common/config"
         log "github.com/luci/luci-go/common/logging"
         "golang.org/x/net/context"
 )
 
+// NamespaceAccessType specifies the type of namespace access that is being
+// requested for WithProjectNamespace.
+type NamespaceAccessType int
+
+const (
+        // NamespaceAccessNoAuth grants unconditional access to a project's namespace.

[nodir, 2016/05/19 16:43:17]

please clarify that this simply skips the check

[dnj (Google), 2016/05/19 22:52:04]

Done.

+        //
+        // This must only be used by endpoints that enforce admin- or service-only
+        // access.
+        NamespaceAccessNoAuth NamespaceAccessType = iota
+
+        // NamespaceAccessREAD enforces READ permission access to a project's
+        // namespace.
+        NamespaceAccessREAD
+
+        // NamespaceAccessWRITE enforces WRITE permission access to a project's
+        // namespace.
+        NamespaceAccessWRITE
+)
+
 type servicesKeyType int
 
 // WithServices installs the supplied Services instance into a Context.
 func WithServices(c context.Context, s Services) context.Context {
         return context.WithValue(c, servicesKeyType(0), s)
 }
 
 // GetServices gets the Services instance installed in the supplied Context.
 //
 // If no Services has been installed, it will panic.
 func GetServices(c context.Context) Services {
         s, ok := c.Value(servicesKeyType(0)).(Services)
         if !ok {
                 panic("no Services instance is installed")
         }
         return s
 }
 
 // WithProjectNamespace sets the current namespace to the project name.
 //
 // It will return an error if the project name or the project's namespace is
 // invalid
 //
 // If the current user does not have READ permission for the project, a
 // MembershipError will be returned.

[nodir, 2016/05/19 16:43:17]

this comment needs an update

[dnj (Google), 2016/05/19 22:52:04]

Done.

-func WithProjectNamespace(c *context.Context, project luciConfig.ProjectName) error {
-        return withProjectNamespaceImpl(c, project, true)
-}
-
-// WithProjectNamespaceNoAuth sets the current namespace to the project name. It
-// does NOT assert that the current user has project access. This should only be
-// used for service functions that are not acting on behalf of a user.
-//
-// It will fail if the project name is invalid.
-func WithProjectNamespaceNoAuth(c *context.Context, project luciConfig.ProjectName) error {
-        return withProjectNamespaceImpl(c, project, false)
-}
-
-func withProjectNamespaceImpl(c *context.Context, project luciConfig.ProjectName, auth bool) error {
+func WithProjectNamespace(c *context.Context, project luciConfig.ProjectName, at NamespaceAccessType) error {
         // TODO(dnj): REQUIRE this to be non-empty once namespacing is mandatory.
         if project == "" {
                 return nil
         }
 
         if err := project.Validate(); err != nil {
                 log.WithError(err).Errorf(*c, "Project name is invalid.")
                 return err
         }
 
-        // Validate the user's READ access to the named project, if authenticating.
-        if auth {
+        // Validate the current user has the requested access.
+        switch at {
+        case NamespaceAccessNoAuth:
+                break
+
+        case NamespaceAccessREAD:
                 if err := IsProjectReader(*c, project); err != nil {
-                        log.WithError(err).Errorf(*c, "User cannot access requested project.")
+                        log.WithError(err).Errorf(*c, "User denied READ access to requested project.")
                         return err
                 }
+
+        case NamespaceAccessWRITE:
+                if err := IsProjectWriter(*c, project); err != nil {
+                        log.WithError(err).Errorf(*c, "User denied WRITE access to requested project.")
+                        return err
+                }
+
+        default:
+                return fmt.Errorf("unknown access type: %v", at)
         }
 
         pns := ProjectNamespace(project)
         nc, err := info.Get(*c).Namespace(pns)

[nodir, 2016/05/19 16:43:17]

please add a check that namespace is not set already to a different value
because code calls WithProjectNamespace multiple times within the same request

[dnj (Google), 2016/05/19 22:52:04]

That's allowed. This function only enters namespaces; it doesn't care where it
was coming from.

[nodir, 2016/05/25 17:34:05]

Acknowledged.

         if err != nil {
                 log.Fields{
                         log.ErrorKey: err,
                         "project":    project,
                         "namespace":  pns,
                 }.Errorf(*c, "Failed to set namespace.")
                 return err
         }
 
         *c = nc
@@ skipping 14 matching lines @@
         if ns == "" {
                 return ""
         }
 
         project := ProjectFromNamespace(ns)
         if project != "" {
                 return project
         }
         panic(fmt.Errorf("current namespace %q does not begin with project namespace prefix (%q)", ns, projectNamespacePrefix))
 }