[milo] better ACL system for masters.

milo/buildsource/buildbot/pubsub.go

 // Copyright 2016 The LUCI Authors. All rights reserved.
 // Use of this source code is governed under the Apache License, Version 2.0
 // that can be found in the LICENSE file.
 
 package buildbot
 
 import (
         "bytes"
         "compress/gzip"
         "compress/zlib"
@@ skipping 43 matching lines @@
         Master *buildbotMaster  `json:"master"`
         Builds []*buildbotBuild `json:"builds"`
 }
 
 // buildbotMasterEntry is a container for a marshaled and packed buildbot
 // master json.
 type buildbotMasterEntry struct {
         // Name of the buildbot master.
         Name string `gae:"$id"`
         // Internal
         Internal bool

[Vadim Sh., 2017/07/11 21:04:59]

will this be removed?

[iannucci, 2017/07/11 21:10:28]

later CL

         // Data is the json serialzed and gzipped blob of the master data.
         Data []byte `gae:",noindex"`
         // Modified is when this entry was last modified.
         Modified time.Time
 }
 
+// buildbotMasterPublic is a struct that exists for public builtbot masters, and
+// not for internal masters. It's used for ACL checks.
+type buildbotMasterPublic struct {
+        Name string `gae:"$id"`
+}
+
 func putDSMasterJSON(
         c context.Context, master *buildbotMaster, internal bool) error {
         for _, builder := range master.Builders {
                 // Trim out extra info in the "Changes" portion of the pending build state,
                 // we don't actually need comments, files, and properties
                 for _, pbs := range builder.PendingBuildStates {
                         for i := range pbs.Source.Changes {
                                 pbs.Source.Changes[i].Comments = ""
                                 pbs.Source.Changes[i].Files = nil
                                 pbs.Source.Changes[i].Properties = nil
                         }
                 }
         }
         entry := buildbotMasterEntry{
                 Name:     master.Name,
                 Internal: internal,
                 Modified: clock.Now(c).UTC(),
         }
+        toPut := []interface{}{&entry}
+        publicTag := &buildbotMasterPublic{master.Name}
+        if internal {
+                // do the deletion immediately so that the 'public' bit is removed from
+                // datastore before any internal details are actually written to datastore.
+                if err := ds.Delete(c, publicTag); err != nil && err != ds.ErrNoSuchEntity {
+                        return err
+                }
+        } else {
+                toPut = append(toPut, publicTag)
+        }
         gzbs := bytes.Buffer{}
         gsw := gzip.NewWriter(&gzbs)
         cw := iotools.CountingWriter{Writer: gsw}
         e := json.NewEncoder(&cw)
         if err := e.Encode(master); err != nil {
                 return err
         }
         gsw.Close()
         entry.Data = gzbs.Bytes()
         logging.Debugf(c, "Length of json data: %d", cw.Count)
         logging.Debugf(c, "Length of gzipped data: %d", len(entry.Data))
-        return ds.Put(c, &entry)
+        return ds.Put(c, toPut)
 }
 
 // unmarshal a gzipped byte stream into a list of buildbot builds and masters.
 func unmarshal(
         c context.Context, msg []byte) ([]*buildbotBuild, *buildbotMaster, error) {
         bm := buildMasterMsg{}
         if len(msg) == 0 {
                 return bm.Builds, bm.Master, nil
         }
         reader, err := zlib.NewReader(bytes.NewReader(msg))
@@ skipping 270 matching lines @@
 
         }
         if master != nil {
                 code := doMaster(c, master, internal)
                 if code != 0 {
                         return code
                 }
         }
         return http.StatusOK
 }