swarming: allow privileged users to schedule high priority tasks

appengine/swarming/server/acl.py

 # Copyright 2014 The LUCI Authors. All rights reserved.
 # Use of this source code is governed under the Apache License, Version 2.0
 # that can be found in the LICENSE file.
 
 """Defines access groups."""
 
 from components import auth
 from components import utils
 
 
@@ skipping 39 matching lines @@
   # associated with the job when calling Swarming, not the machine IP.
   return is_ip_whitelisted_machine() or is_admin()
 
 
 def is_bot_or_user():
   # TODO(vadimsh): Get rid of this. Swarming jobs will use service accounts
   # associated with the job when calling Swarming, not the machine ID itself.
   return is_bot() or is_user()
 
 
 def is_bot_or_privileged_user():

[M-A Ruel, 2016/10/31 22:11:20]

^^ :/

[nodir, 2016/10/31 22:18:15]

it looks like you are proposing to call this function in other files, but in
that case the knowledge "who can schedule high priority tasks" is in many
places, rather than one.

I could use is_bot_or_privileged_user in can_schedule_high_priority_tasks.
the function seems to be marked to be deprecated though

   # TODO(vadimsh): Get rid of this. Swarming jobs will use service accounts
   # associated with the job when calling Swarming, not the machine ID itself.
   return is_bot() or is_privileged_user()
 
 
 def is_bot_or_admin():
   """Returns True if current user can execute user-side and bot-side calls."""
   # TODO(vadimsh): Get rid of this. Swarming jobs will use service accounts
   # associated with the job when calling Swarming, not the machine ID itself.
   return is_bot() or is_admin()
 
 
+def can_schedule_high_priority_tasks():
+  """Returns True if the current user can schedule high priority tasks."""
+  return is_bot() or is_privileged_user()
+
+
 def get_user_type():
   """Returns a string describing the current access control for the user."""
   if is_admin():
     return 'admin'
   if is_privileged_user():
     return 'privileged user'
   if is_user():
     return 'user'
 
 
@@ skipping 10 matching lines @@
   # Add a swarming admin. smoke-test@example.com is used in
   # server_smoke_test.py
   admin = auth.Identity(auth.IDENTITY_USER, 'smoke-test@example.com')
   auth.bootstrap_group(ADMINS_GROUP, [admin], 'Swarming administrators')
 
   # Add an instance admin (for easier manual testing when running dev server).
   auth.bootstrap_group(
       auth.ADMIN_GROUP,
       [auth.Identity(auth.IDENTITY_USER, 'test@example.com')],
       'Users that can manage groups')