swarming: allow privileged users to schedule high priority tasks

appengine/swarming/server/acl.py

 # Copyright 2014 The LUCI Authors. All rights reserved.
 # Use of this source code is governed under the Apache License, Version 2.0
 # that can be found in the LICENSE file.
 
 """Defines access groups."""
 
 from components import auth
 from components import utils
 
 
 # Names of groups.
 # See
 # https://github.com/luci/luci-py/blob/master/appengine/swarming/doc/Access-Groups.md
 # for each level.
 #
 # TODO(vadimsh): Move them to the config.
 ADMINS_GROUP = 'swarming-admins'
 PRIVILEGED_USERS_GROUP = 'swarming-privileged-users'
 USERS_GROUP = 'swarming-users'
 BOT_BOOTSTRAP_GROUP = 'swarming-bot-bootstrap'
+HIGH_PRIORITY_TASKS_GROUP = 'swarming-high-priority-task'

[Vadim Sh., 2016/10/28 19:48:44]

swarming-high-priority-tasks? (with 's')

I'm not very excited about the name but I can't think of a better alternative.

[nodir, 2016/10/28 20:00:13]

Done
 
yeah, me neither. Maybe maruel will have a better alternative

 
 
 def is_admin():
   return auth.is_group_member(ADMINS_GROUP) or auth.is_admin()
 
 
 def is_privileged_user():
   return auth.is_group_member(PRIVILEGED_USERS_GROUP) or is_admin()
 
 
@@ skipping 32 matching lines @@
   return is_bot() or is_privileged_user()
 
 
 def is_bot_or_admin():
   """Returns True if current user can execute user-side and bot-side calls."""
   # TODO(vadimsh): Get rid of this. Swarming jobs will use service accounts
   # associated with the job when calling Swarming, not the machine ID itself.
   return is_bot() or is_admin()
 
 
+def can_schedule_high_priority_tasks():
+  """Returns True if the current user can schedule high priority tasks."""
+  return is_bot_or_admin() or auth.is_group_member(HIGH_PRIORITY_TASKS_GROUP)
+
+
 def get_user_type():
   """Returns a string describing the current access control for the user."""
   if is_admin():
     return 'admin'
   if is_privileged_user():
     return 'privileged user'
   if is_user():
     return 'user'
 
 
@@ skipping 10 matching lines @@
   # Add a swarming admin. smoke-test@example.com is used in
   # server_smoke_test.py
   admin = auth.Identity(auth.IDENTITY_USER, 'smoke-test@example.com')
   auth.bootstrap_group(ADMINS_GROUP, [admin], 'Swarming administrators')
 
   # Add an instance admin (for easier manual testing when running dev server).
   auth.bootstrap_group(
       auth.ADMIN_GROUP,
       [auth.Identity(auth.IDENTITY_USER, 'test@example.com')],
       'Users that can manage groups')