Milo: ACLs for internal swarm jobs

milo/appengine/swarming/build.go

 // Copyright 2015 The LUCI Authors. All rights reserved.
 // Use of this source code is governed under the Apache License, Version 2.0
 // that can be found in the LICENSE file.
 
 package swarming
 
 import (
         "bytes"
         "fmt"
         "net/http"
         "net/url"
         "strings"
         "time"
 
         "golang.org/x/net/context"
 
         swarming "github.com/luci/luci-go/common/api/swarming/swarming/v1"
         "github.com/luci/luci-go/common/errors"
         "github.com/luci/luci-go/common/logging"
         "github.com/luci/luci-go/common/proto/google"
         miloProto "github.com/luci/luci-go/common/proto/milo"
         "github.com/luci/luci-go/common/sync/parallel"
         "github.com/luci/luci-go/logdog/client/annotee"
         "github.com/luci/luci-go/logdog/client/coordinator"
         "github.com/luci/luci-go/logdog/common/types"
         "github.com/luci/luci-go/milo/api/resp"
+        "github.com/luci/luci-go/milo/appengine/common"
         "github.com/luci/luci-go/milo/appengine/logdog"
         "github.com/luci/luci-go/server/auth"
 )
 
 // errNotMiloJob is returned if a Swarming task is fetched that does not self-
 // identify as a Milo job.
-var errNotMiloJob = errors.New("Not a Milo Job")
+var errNotMiloJob = errors.New("Not a Milo Job or access denied")
 
 // SwarmingTimeLayout is time layout used by swarming.
 const SwarmingTimeLayout = "2006-01-02T15:04:05.999999999"
 
 // logDogFetchTimeout is the amount of time to wait while fetching a LogDog
 // stream before we time out the fetch.
 const logDogFetchTimeout = 30 * time.Second
 
 // Swarming task states..
 const (
@@ skipping 94 matching lines @@
         // If the log fetch was cancelled, this is undefined.
         log string
 }
 
 // swarmingFetch fetches (in parallel) the components that it is configured to
 // fetch.
 //
 // After fetching, an ACL check is performed to confirm that the user is
 // permitted to view the resulting data. If this check fails, get returns
 // errNotMiloJob.
-//
-// TODO(hinoka): Make this ACL check something more specific than the
-// resence of the "allow_milo" dimension.
 func swarmingFetch(c context.Context, svc swarmingService, taskID string, req swarmingFetchParams) (
         *swarmingFetchResult, error) {
 
         // logErr is managed separately from other fetch errors, since in some
         // situations it's acceptable to not have a log stream.
         var logErr error
         var fr swarmingFetchResult
 
         // Special Context to enable the cancellation of log fetching.
         logsCancelled := false
@@ skipping 26 matching lines @@
                                 // explicitly.
                                 fr.log, logErr = svc.getTaskOutput(logCtx, taskID)
                                 return nil
                         }
                 }
         })
         if err != nil {
                 return nil, err
         }
 
-        // Current ACL implementation: error if this is not a Milo job.
+        // Current ACL implementation:
+        // If allow_milo:1 is present, it is a public job.  Don't bother with ACL check.
+        // If it is not present, check the luci_project tag, and see if user is allowed
+        // to access said project.
         switch {
         case req.fetchReq:
-                if !isMiloJob(fr.req.Tags) {
+                if !isAllowed(c, fr.req.Tags) {
                         return nil, errNotMiloJob
                 }
 
         case req.fetchRes:
-                if !isMiloJob(fr.res.Tags) {
+                if !isAllowed(c, fr.res.Tags) {
                         return nil, errNotMiloJob
                 }
 
         default:
                 // No metadata to decide if this is a Milo job, so assume that it is not.
                 return nil, errNotMiloJob
         }
 
         if req.fetchRes && logErr != nil {
                 switch fr.res.State {
@@ skipping 442 matching lines @@
 
 func infoComponent(st resp.Status, label, text string) *resp.BuildComponent {
         return &resp.BuildComponent{
                 Type:   resp.Summary,
                 Label:  label,
                 Text:   []string{text},
                 Status: st,
         }
 }
 
-func isMiloJob(tags []string) bool {
+// isAllowed checks if:
+// 1. allow_milo:1 is present.  If so, it's a public job.
+// 2. luci_project is present, and if the logged in user has access to that project.
+func isAllowed(c context.Context, tags []string) bool {
         for _, t := range tags {
                 if t == "allow_milo:1" {
                         return true
                 }
         }
+        for _, t := range tags {
+                if strings.HasPrefix(t, "luci_project:") {
+                        sp := strings.SplitN(t, ":", 2)
+                        if len(sp) != 2 {
+                                return false
+                        }
+                        logging.Debugf(c, "Checking if user has access to %s", sp[1])
+                        // sp[1] is the project ID.
+                        allowed, err := common.IsAllowed(c, sp[1])
+                        if err != nil {
+                                logging.WithError(err).Errorf(c, "could not perform acl check")
+                                return false
+                        }
+                        return allowed
+                }
+        }
         return false
 }
 
 // taskPageURL returns a URL to a human-consumable page of a swarming task.
 // Supports server aliases.
 func taskPageURL(swarmingHostname, taskID string) string {
         return fmt.Sprintf("https://%s/user/task/%s", swarmingHostname, taskID)
 }
 
 // botPageURL returns a URL to a human-consumable page of a swarming bot.
@@ skipping 49 matching lines @@
         for _, tag := range v {
                 var value string
                 parts := strings.SplitN(tag, ":", 2)
                 if len(parts) == 2 {
                         value = parts[1]
                 }
                 res[parts[0]] = value
         }
         return res
 }