[milo] better ACL system for masters.

milo/buildsource/buildbot/build.go

Index: milo/buildsource/buildbot/build.go
diff --git a/milo/buildsource/buildbot/build.go b/milo/buildsource/buildbot/build.go
index 5d29650074e76662a0eac3fb62e8b7f5172e686d..349bc8cc4aa68cf81adcff5d0561d04f5b8aa1a4 100644
--- a/milo/buildsource/buildbot/build.go
+++ b/milo/buildsource/buildbot/build.go
@@ -31,6 +31,10 @@ var errBuildNotFound = errors.New("Build not found")
 // getBuild fetches a buildbot build from the datastore and checks ACLs.
 // The return code matches the master responses.
 func getBuild(c context.Context, master, builder string, buildNum int) (*buildbotBuild, error) {
+	if err := canAccessMaster(c, master); err != nil {
+		return nil, err
+	}
+
 	result := &buildbotBuild{
 		Master:      master,
 		Buildername: builder,
@@ -38,8 +42,7 @@ func getBuild(c context.Context, master, builder string, buildNum int) (*buildbo
 	}
 
 	err := datastore.Get(c, result)
-	err = checkAccess(c, err, result.Internal)
-	if err == errMasterNotFound {
+	if err == datastore.ErrNoSuchEntity {
 		err = errBuildNotFound
 	}