LogDog: Project READ access for user endpoints.

appengine/logdog/coordinator/endpoints/logs/get_test.go

Index: appengine/logdog/coordinator/endpoints/logs/get_test.go
diff --git a/appengine/logdog/coordinator/endpoints/logs/get_test.go b/appengine/logdog/coordinator/endpoints/logs/get_test.go
index b767d825b7d850664b737401bfc5ca023e0b4e17..fb5dfe22333e8f343b7f9799ee0d1a85d5f9517d 100644
--- a/appengine/logdog/coordinator/endpoints/logs/get_test.go
+++ b/appengine/logdog/coordinator/endpoints/logs/get_test.go
@@ -179,10 +179,16 @@ func testGetImpl(t *testing.T, archived bool) {
 				So(err, ShouldBeRPCInternal)
 			})
 
-			Convey(`Will fail with NotFound if the log stream does not exist (different project).`, func() {
+			Convey(`Will fail with PermissionDenied if the project does not exist.`, func() {
 				req.Project = "does-not-exist"
 				_, err := svr.Get(c, &req)
-				So(err, ShouldBeRPCNotFound)
+				So(err, ShouldBeRPCPermissionDenied)
+			})
+
+			Convey(`Will fail with PermissionDenied if the user can't access the project.`, func() {
+				req.Project = "proj-exclusive"
+				_, err := svr.Get(c, &req)
+				So(err, ShouldBeRPCPermissionDenied)
 			})
 
 			Convey(`Will fail with NotFound if the log path does not exist (different path).`, func() {
@@ -205,10 +211,16 @@ func testGetImpl(t *testing.T, archived bool) {
 				So(resp, shouldHaveLogs)
 			})
 
-			Convey(`Will fail with NotFound if the log stream does not exist (different project).`, func() {
+			Convey(`Will fail with PermissionDenied if the project does not exist.`, func() {
 				req.Project = "does-not-exist"
 				_, err := svr.Tail(c, &req)
-				So(err, ShouldBeRPCNotFound)
+				So(err, ShouldBeRPCPermissionDenied)
+			})
+
+			Convey(`Will fail with PermissionDenied if the user can't access the project.`, func() {
+				req.Project = "proj-exclusive"
+				_, err := svr.Tail(c, &req)
+				So(err, ShouldBeRPCPermissionDenied)
 			})
 
 			Convey(`Will fail with NotFound if the log path does not exist (different path).`, func() {