[milo] better ACL system for masters.

milo/buildsource/buildbot/build.go

 // Copyright 2016 The LUCI Authors. All rights reserved.
 // Use of this source code is governed under the Apache License, Version 2.0
 // that can be found in the LICENSE file.
 
 package buildbot
 
 import (
         "encoding/json"
         "errors"
         "fmt"
@@ skipping 13 matching lines @@
         "github.com/luci/luci-go/common/logging"
         "github.com/luci/luci-go/milo/api/resp"
         "github.com/luci/luci-go/milo/common/model"
 )
 
 var errBuildNotFound = errors.New("Build not found")
 
 // getBuild fetches a buildbot build from the datastore and checks ACLs.
 // The return code matches the master responses.
 func getBuild(c context.Context, master, builder string, buildNum int) (*buildbotBuild, error) {
+        if err := canAccessMaster(c, master); err != nil {
+                return nil, err
+        }
+
         result := &buildbotBuild{
                 Master:      master,
                 Buildername: builder,
                 Number:      buildNum,
         }
 
         err := datastore.Get(c, result)
-        err = checkAccess(c, err, result.Internal)
-        if err == errMasterNotFound {
+        if err == datastore.ErrNoSuchEntity {
                 err = errBuildNotFound
         }
 
         return result, err
 }
 
 // result2Status translates a buildbot result integer into a model.Status.
 func result2Status(s *int) (status model.Status) {
         if s == nil {
                 return model.Running
@@ skipping 599 matching lines @@
         var newAliases map[string][]*buildbotLinkAlias
         if l := remainingAliases.Len(); l > 0 {
                 newAliases = make(map[string][]*buildbotLinkAlias, l)
                 remainingAliases.Iter(func(v string) bool {
                         newAliases[v] = s.Aliases[v]
                         return true
                 })
         }
         s.Aliases = newAliases
 }