Milo: Use luci-config for storing buildbot acls

milo/appengine/common/acl.go

 // Copyright 2016 The LUCI Authors. All rights reserved.
 // Use of this source code is governed under the Apache License, Version 2.0
 // that can be found in the LICENSE file.
 
 package common
 
 import (
+        "errors"
+
+        "golang.org/x/net/context"
+
         "github.com/luci/luci-go/luci_config/common/cfgtypes"
         "github.com/luci/luci-go/luci_config/server/cfgclient/access"
         "github.com/luci/luci-go/luci_config/server/cfgclient/backend"
-        "golang.org/x/net/context"
+        "github.com/luci/luci-go/server/auth"
 )
 
 // Helper functions for ACL checking.
 
 // IsAllowed checks to see if the user in the context is allowed to access
 // the given project.
 func IsAllowed(c context.Context, project string) (bool, error) {
         // Get the project, because that's where the ACLs lie.
         err := access.Check(
                 c, backend.AsUser,
                 cfgtypes.ProjectConfigSet(cfgtypes.ProjectName(project)))
         switch err {
         case nil:
                 return true, nil
         case access.ErrNoAccess:
                 return false, nil
         default:
                 return false, err
         }
 }
 
+var errMissingReaders = errors.New("missing readers for buildbot internal")
+
 // IsAllowedInternal is a shorthand for checking to see if the user is a reader
 // of a magic project named "chrome".
 func IsAllowedInternal(c context.Context) (bool, error) {
-        // TODO(hinoka): Move this to luci-cfg.
-        return IsAllowed(c, "chrome")
+        settings, err := GetSettings(c)
+        if err != nil {
+                return false, err
+        }
+        if settings.BuildbotInternalReader == "" {
+                return false, errMissingReaders

[nodir, 2017/03/20 21:41:32]

is it an error though? I think it just means that only admins can this

[hinoka, 2017/03/20 22:19:26]

Done.

+        }
+        return auth.IsMember(c, settings.BuildbotInternalReader)
 }