LogDog: Project READ access for user endpoints.

appengine/logdog/coordinator/project.go

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 package coordinator
 
 import (
         "strings"
 
-        "github.com/luci/gae/service/datastore/meta"
         "github.com/luci/gae/service/info"
-        "github.com/luci/luci-go/common/config"
+        "github.com/luci/luci-go/appengine/logdog/coordinator/config"
+        luciConfig "github.com/luci/luci-go/common/config"
+        log "github.com/luci/luci-go/common/logging"
+        "github.com/luci/luci-go/common/parallel"
         "github.com/luci/luci-go/common/proto/logdog/svcconfig"
         "golang.org/x/net/context"

[nodir, 2016/05/19 00:38:58]

should be in a separate import block

 )
 
-// projectNamespacePrefix is the datastore namespace prefix for project
-// namespaces.
-const projectNamespacePrefix = "luci."
+const (
+        // projectNamespacePrefix is the datastore namespace prefix for project
+        // namespaces.
+        projectNamespacePrefix = "luci."

[nodir, 2016/05/19 00:38:58]

I'd definitely use "project." so namespaces are "project.chromium" and so on. It
makes more sense to me than luci.chromium

later: but it is too late

+
+        // projectConfigWorkers is the number of workers that will pull project
+        // configs from the config service.
+        projectConfigWorkers = 16
+)
 
 // ProjectNamespace returns the AppEngine namespace for a given luci-config
 // project name.
-func ProjectNamespace(project config.ProjectName) string {
+func ProjectNamespace(project luciConfig.ProjectName) string {
         return projectNamespacePrefix + string(project)
 }
 
 // ProjectFromNamespace returns the current project installed in the supplied
 // Context's namespace.
 //
 // If the namespace does not have a project namespace prefix, this function
 // will return an empty string.
-func ProjectFromNamespace(ns string) config.ProjectName {
+func ProjectFromNamespace(ns string) luciConfig.ProjectName {
         if !strings.HasPrefix(ns, projectNamespacePrefix) {
                 return ""
         }
-        return config.ProjectName(ns[len(projectNamespacePrefix):])
+        return luciConfig.ProjectName(ns[len(projectNamespacePrefix):])
 }
 
 // CurrentProject returns the current project based on the currently-loaded
 // namespace.
 //
 // If there is no current namespace, or if the current namespace is not a valid
 // project namespace, an empty string will be returned.
-func CurrentProject(c context.Context) config.ProjectName {
+func CurrentProject(c context.Context) luciConfig.ProjectName {
         if ns, ok := info.Get(c).GetNamespace(); ok {
                 return ProjectFromNamespace(ns)
         }
         return ""
 }
 
 // CurrentProjectConfig returns the project-specific configuration for the
 // current project.
 //
 // If there is no current project namespace, or if the current project has no
 // configuration, config.ErrInvalidConfig will be returned.
 func CurrentProjectConfig(c context.Context) (*svcconfig.ProjectConfig, error) {
         return GetServices(c).ProjectConfig(c, CurrentProject(c))
 }
 
-// AllProjectsWithNamespaces scans current namespaces and returns those that
-// belong to LUCI projects.
-func AllProjectsWithNamespaces(c context.Context) ([]config.ProjectName, error) {
-        var projects []config.ProjectName
-        err := meta.NamespacesWithPrefix(c, projectNamespacePrefix, func(ns string) error {
-                if proj := ProjectFromNamespace(ns); proj != "" {
-                        projects = append(projects, proj)
-                }
-                return nil
-        })
+// ActiveProjects returns a full list of all config service projects with LogDog
+// project configurations.
+//
+// If userOnly is true, any project not accessible by the current user will not
+// be returned.
+func ActiveProjects(c context.Context, userOnly bool) ([]luciConfig.ProjectName, error) {
+        projects, err := config.Projects(c)
         if err != nil {
                 return nil, err
         }
+        log.Infof(c, "All projects: %v", projects)
+
+        svcs := GetServices(c)
+        err = parallel.WorkPool(projectConfigWorkers, func(taskC chan<- func() error) {
+                for i := range projects {
+                        i := i
+                        taskC <- func() error {
+                                var err error
+                                if userOnly {
+                                        // Verify user access. This includes loading the project's config.
+                                        err = IsProjectReader(c, projects[i])
+                                } else {
+                                        _, err = svcs.ProjectConfig(c, projects[i])
+                                }
+
+                                switch {
+                                case err == nil:
+                                        // Project config loaded and (if requested) user had access.
+                                        return nil
+
+                                case err == luciConfig.ErrNoConfig, err == config.ErrInvalidConfig, IsMembershipError(err):
+                                        // No configuration for this project, the configuration is invalid, or
+                                        // the user didn't have access. Remove it from the list.
+                                        projects[i] = ""
+                                        return nil
+
+                                default:
+                                        log.Fields{
+                                                log.ErrorKey: err,
+                                                "project":    projects[i],
+                                                "userOnly":   userOnly,
+                                        }.Errorf(c, "Failed to check project.")
+                                        return err
+                                }
+                        }
+                }
+        })
+        if err != nil {
+                log.WithError(err).Errorf(c, "Failed to get project list.")
+                return nil, err
+        }
+
+        // Remove any projects that have been blanked out.
+        cidx := 0
+        for _, proj := range projects {
+                if proj != "" {
+                        projects[cidx] = proj
+                        cidx++
+                }
+        }
+        projects = projects[:cidx]
+        log.Infof(c, "Pruned projects: %v", projects)
         return projects, nil
 }