swarming: switch to a 'capability focused' ACL system

appengine/swarming/handlers_frontend.py

 # Copyright 2013 The LUCI Authors. All rights reserved.
 # Use of this source code is governed under the Apache License, Version 2.0
 # that can be found in the LICENSE file.
 
 """Main entry point for Swarming service.
 
 This file contains the URL handlers for all the Swarming service URLs,
 implemented using the webapp2 framework.
 """
 
@@ skipping 18 matching lines @@
 
 # Helper class for displaying the sort options in html templates.
 SortOptions = collections.namedtuple('SortOptions', ['key', 'name'])
 
 
 ### is_admin pages.
 
 
 class RestrictedConfigHandler(auth.AuthenticatingHandler):
   @auth.autologin
-  @auth.require(acl.is_admin)
+  @auth.require(acl.can_view_config)
   def get(self):
     # Template parameters schema matches settings_info() return value.
     self.response.write(template.render(
         'swarming/restricted_config.html', config.settings_info()))
 
 
 class UploadBotConfigHandler(auth.AuthenticatingHandler):
   """Stores a new bot_config.py script."""
 
   @auth.autologin
-  @auth.require(acl.is_admin)
+  @auth.require(acl.can_view_config)
   def get(self):
     bot_config = bot_code.get_bot_config()
     params = {
       'content': bot_config.content.decode('utf-8'),
       'path': self.request.path,
       'version': bot_config.version,
       'when': bot_config.when,
       'who': bot_config.who or 'N/A',
       'xsrf_token': self.generate_xsrf_token(),
     }
     self.response.write(
         template.render('swarming/restricted_upload_bot_config.html', params))
 
-  @auth.require(acl.is_admin)
+  @auth.require(acl.can_edit_config)
   def post(self):
     script = self.request.get('script', '')
     if not script:
       self.abort(400, 'No script uploaded')
 
     # Make sure the script is valid utf-8. For some odd reason, the script
     # instead may or may not be an unicode instance. This depends if it is on
     # AppEngine production or not.
     if isinstance(script, str):
       script = script.decode('utf-8', 'replace')
     script = script.encode('utf-8')
     bot_code.store_bot_config(self.request.host_url, script)
     self.get()
 
 
 class UploadBootstrapHandler(auth.AuthenticatingHandler):
   """Stores a new bootstrap.py script."""
 
   @auth.autologin
-  @auth.require(acl.is_admin)
+  @auth.require(acl.can_view_config)
   def get(self):
     bootstrap = bot_code.get_bootstrap(self.request.host_url)
     params = {
       'content': bootstrap.content.decode('utf-8'),
       'path': self.request.path,
       'version': bootstrap.version,
       'when': bootstrap.when,
       'who': bootstrap.who or 'N/A',
       'xsrf_token': self.generate_xsrf_token(),
     }
     self.response.write(
         template.render('swarming/restricted_upload_bootstrap.html', params))
 
-  @auth.require(acl.is_admin)
+  @auth.require(acl.can_edit_config)
   def post(self):
     script = self.request.get('script', '')
     if not script:
       self.abort(400, 'No script uploaded')
 
     # Make sure the script is valid utf-8. For some odd reason, the script
     # instead may or may not be an unicode instance. This depends if it is on
     # AppEngine production or not.
     if isinstance(script, str):
       script = script.decode('utf-8', 'replace')
     script = script.encode('utf-8')
     bot_code.store_bootstrap(script)
     self.get()
 
 
 ### Mapreduce related handlers
 
 
 class RestrictedLaunchMapReduceJob(auth.AuthenticatingHandler):
   """Enqueues a task to start a map reduce job on the backend module.
 
   A tree of map reduce jobs inherits module and version of a handler that
   launched it. All UI handlers are executes by 'default' module. So to run a
   map reduce on a backend module one needs to pass a request to a task running
   on backend module.
   """
 
-  @auth.require(acl.is_admin)
+  @auth.require(acl.can_edit_config)

[Vadim Sh., 2017/07/24 23:07:25]

:-/

   def post(self):
     job_id = self.request.get('job_id')
     assert job_id in mapreduce_jobs.MAPREDUCE_JOBS
     success = utils.enqueue_task(
         url='/internal/taskqueue/mapreduce/launch/%s' % job_id,
         queue_name=mapreduce_jobs.MAPREDUCE_TASK_QUEUE,
         use_dedicated_module=False)
     # New tasks should show up on the status page.
     if success:
       self.redirect('/restricted/mapreduce/status')
@@ skipping 141 matching lines @@
   ]
   return [webapp2.Route(*i) for i in routes]
 
 
 def create_application(debug):
   routes = []
   routes.extend(get_routes())
   routes.extend(handlers_bot.get_routes())
   routes.extend(handlers_endpoints.get_routes())
   return webapp2.WSGIApplication(routes, debug=debug)