swarming: switch to a 'capability focused' ACL system

appengine/swarming/proto/config.proto

 // Copyright 2016 The LUCI Authors. All rights reserved.
 // Use of this source code is governed under the Apache License, Version 2.0
 // that can be found in the LICENSE file.
 
 syntax = "proto2";
 
 
 // Schema for settings.cfg service config file in luci-config.
 message SettingsCfg {
   // id to inject into pages if applicable.
@@ skipping 135 matching lines @@
 // server. 
 //
 // All groups default to 'administrators'.
 //
 // See
 // https://github.com/luci/luci-py/blob/master/appengine/swarming/doc/Access-Groups.md
 // for more detail.
 
 message AuthSettings {
   // Members of this group have full administrative access.
+  //
+  // Grants:
+  // - config view and edit
+  // - all of bot_bootstrap_group membership
+  // - all of privileged_users_group membership
   optional string admins_group = 1;

[Vadim Sh., 2017/07/25 17:02:50]

nit: \n (and in other fields). With such big multi line comments new lines
between fields will make this stuff more readable.

[M-A Ruel, 2017/07/25 18:11:39]

Done.

   // Members of this group can fetch swarming bot code and bootstrap bots.
+  //
+  // Grants:
+  // - bot create: create a token to annonymously fetch the bot code.

[Vadim Sh., 2017/07/25 17:02:50]

typo: anonymously

[M-A Ruel, 2017/07/25 18:11:39]

Done.

   optional string bot_bootstrap_group = 2;
   // Members of this group can schedule tasks and see everyone else's tasks.
+  //
+  // Grants:
+  // - cancel any task
+  // - delete or terminate any bot
+  // - all of view_all_bots_group membership
+  // - all of view_all_tasks_group membership
   optional string privileged_users_group = 3;
   // Members of this group can schedule tasks and see only their own tasks.
+  //
+  // Grants:
+  // - create a task
+  // - view and edit own task
   optional string users_group = 4;
+  // Members of this group can view all bots. This is a read-only group.
+  //
+  // Grants:
+  // - view all bots
+  optional string view_all_bots_group = 5;
+  // Members of this group can view all tasks. This is a read-only group.
+  //
+  // Grants:
+  // - view all tasks
+  optional string view_all_tasks_group = 6;
 }