LogDog: Project READ access for user endpoints.

appengine/logdog/coordinator/endpoints/logs/get_test.go

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 package logs
 
 import (
         "bytes"
         "errors"
         "fmt"
@@ skipping 161 matching lines @@
                         })
 
                         Convey(`Will fail with Internal if the datastore Get() doesn't work.`, func() {
                                 c, fb := featureBreaker.FilterRDS(c, nil)
                                 fb.BreakFeatures(errors.New("testing error"), "GetMulti")
 
                                 _, err := svr.Get(c, &req)
                                 So(err, ShouldBeRPCInternal)
                         })
 
-                        Convey(`Will fail with NotFound if the log stream does not exist (different project).`, func() {
+                        Convey(`Will fail with PermissionDenied if the project does not exist.`, func() {
                                 req.Project = "does-not-exist"
                                 _, err := svr.Get(c, &req)
-                                So(err, ShouldBeRPCNotFound)
+                                So(err, ShouldBeRPCPermissionDenied)
+                        })
+
+                        Convey(`Will fail with PermissionDenied if the user can't access the project.`, func() {
+                                req.Project = "proj-exclusive"
+                                _, err := svr.Get(c, &req)
+                                So(err, ShouldBeRPCPermissionDenied)
                         })
 
                         Convey(`Will fail with NotFound if the log path does not exist (different path).`, func() {
                                 req.Path = "testing/+/does/not/exist"
                                 _, err := svr.Get(c, &req)
                                 So(err, ShouldBeRPCNotFound)
                         })
                 })
 
                 Convey(`Testing Tail requests (no logs)`, func() {
                         req := logdog.TailRequest{
                                 Project: string(project),
                                 Path:    string(tls.Path),
                         }
 
                         Convey(`Will succeed with no logs.`, func() {
                                 resp, err := svr.Tail(c, &req)
 
                                 So(err, ShouldBeRPCOK)
                                 So(resp, shouldHaveLogs)
                         })
 
-                        Convey(`Will fail with NotFound if the log stream does not exist (different project).`, func() {
+                        Convey(`Will fail with PermissionDenied if the project does not exist.`, func() {
                                 req.Project = "does-not-exist"
                                 _, err := svr.Tail(c, &req)
-                                So(err, ShouldBeRPCNotFound)
+                                So(err, ShouldBeRPCPermissionDenied)
+                        })
+
+                        Convey(`Will fail with PermissionDenied if the user can't access the project.`, func() {
+                                req.Project = "proj-exclusive"
+                                _, err := svr.Tail(c, &req)
+                                So(err, ShouldBeRPCPermissionDenied)
                         })
 
                         Convey(`Will fail with NotFound if the log path does not exist (different path).`, func() {
                                 req.Path = "testing/+/does/not/exist"
                                 _, err := svr.Tail(c, &req)
                                 So(err, ShouldBeRPCNotFound)
                         })
                 })
 
                 Convey(`When testing log data is added`, func() {
@@ skipping 313 matching lines @@
         t.Parallel()
 
         testGetImpl(t, false)
 }
 
 func TestGetArchived(t *testing.T) {
         t.Parallel()
 
         testGetImpl(t, false)
 }