config_service: implement admin group

appengine/config_service/acl.py

 # Copyright 2015 The LUCI Authors. All rights reserved.
 # Use of this source code is governed under the Apache License, Version 2.0
 # that can be found in the LICENSE file.
 
-import re
-
 from components import auth
 from components import config
 from components import utils
 from components.config.proto import service_config_pb2
 
 import common
 import projects
 import services
 import storage
 
 
-def read_acl_cfg():
+# Cache acl.cfg for 10min. It never changes.
+@utils.cache_with_expiration(10 * 60)
+def get_acl_cfg():
   return storage.get_self_config_async(
       common.ACL_FILENAME, service_config_pb2.AclCfg).get_result()
 
 
 def can_read_config_sets(config_sets):
   """Returns a mapping {config_set: has_access}.
 
   has_access is True if current requester has access to the config set.
 
   Raise:
@@ skipping 27 matching lines @@
     access_map['projects/' + pid] = access
   for sid, access in has_services_access(service_ids).iteritems():
     access_map['services/' + sid] = access
 
   return {
     cs: access_map[check_via[cs]]
     for cs in config_sets
   }
 
 
+def is_admin():
+  acl_cfg = get_acl_cfg()
+  return auth.is_group_member(
+      acl_cfg and acl_cfg.admin_group or auth.ADMIN_GROUP)
+
+
 def has_services_access(service_ids):
   """Returns a mapping {service_id: has_access}.
 
   has_access is True if current requester can read service configs.
   """
   if not service_ids:
     return {}
   for sid in service_ids:
     assert isinstance(sid, basestring)
     assert sid
 
-  if auth.is_admin():
+  if is_admin():
     return {sid: True for sid in service_ids}
 
   cfgs = {
     s.id: s
     for s in services.get_services_async().get_result()
   }
   return {
     sid: cfgs.get(sid) and config.api._has_access(cfgs.get(sid).access)
     for sid in service_ids
   }
 
 
 def has_projects_access(project_ids):
   if not project_ids:
     return {}
-  super_group = read_acl_cfg().project_access_group
-  if auth.is_admin() or super_group and auth.is_group_member(super_group):
+  super_group = get_acl_cfg().project_access_group
+  if is_admin() or super_group and auth.is_group_member(super_group):
     return {pid: True for pid in project_ids}
   return {
     pid: meta and config.api._has_access(meta.access)
     for pid, meta in projects.get_metadata(project_ids).iteritems()
   }