swarming: switch to a 'capability focused' ACL system

appengine/swarming/handlers_bot.py

 # Copyright 2015 The LUCI Authors. All rights reserved.
 # Use of this source code is governed under the Apache License, Version 2.0
 # that can be found in the LICENSE file.
 
 """Internal bot API handlers."""
 
 import base64
 import json
 import logging
 
@@ skipping 133 matching lines @@
       return existing_token
 
     machine_type = None
     if bot_id:
       bot_info = bot_management.get_info_key(bot_id).get()
       if bot_info:
         machine_type = bot_info.machine_type
 
     # TODO(vadimsh): Remove is_ip_whitelisted_machine check once all bots are
     # using auth for bootstrap and updating.
-    if (not acl.is_bootstrapper() and
+    if (not acl.can_create_bot() and
         not acl.is_ip_whitelisted_machine() and
         not (bot_id and bot_auth.is_authenticated_bot(bot_id, machine_type))):
       raise auth.AuthorizationError('Not allowed to access the bot code')
 
     return bot_code.generate_bootstrap_token() if generate_token else None
 
 
 class BootstrapHandler(_BotAuthenticatingHandler):
   """Returns python code to run to bootstrap a swarming bot."""
 
@@ skipping 880 matching lines @@
       ('/swarming/api/v1/bot/poll', BotPollHandler),
       ('/swarming/api/v1/bot/server_ping', ServerPingHandler),
       ('/swarming/api/v1/bot/task_update', BotTaskUpdateHandler),
       ('/swarming/api/v1/bot/task_update/<task_id:[a-f0-9]+>',
           BotTaskUpdateHandler),
       ('/swarming/api/v1/bot/task_error', BotTaskErrorHandler),
       ('/swarming/api/v1/bot/task_error/<task_id:[a-f0-9]+>',
           BotTaskErrorHandler),
   ]
   return [webapp2.Route(*i) for i in routes]