swarming: switch to a 'capability focused' ACL system

appengine/swarming/proto/config.proto

Index: appengine/swarming/proto/config.proto
diff --git a/appengine/swarming/proto/config.proto b/appengine/swarming/proto/config.proto
index ea5e6f3092134b0cb2a21a200b0c4fb3930f105a..a3c9fff6e56c5a8485eef81d8a009b3a4c8a9677 100644
--- a/appengine/swarming/proto/config.proto
+++ b/appengine/swarming/proto/config.proto
@@ -153,11 +153,19 @@ message DimensionACLs {
 
 message AuthSettings {
   // Members of this group have full administrative access.
+  // Membership of this group acts a superset of privileged_users_group and

[Vadim Sh., 2017/07/24 23:07:26]

this phrase is confusing... how can a membership act? Also "a superset of
<group_name>" reads like a superset of a group (a group that includes another
group), which is not true for 'admins_group'.

either

"Membership in this group grants superset of privileges granted by memberships
in privileged_users_group and bot_bootstrap groups"

or 

"Members of this group are implicitly granted same privileges as member of
privileged_users_group and bot_bootstrap groups"

or 

"Membership grants same privileges as memberships in privileged_users_group and
bot_bootstrap"

or just list all permissions explicitly:

"Grants:
  can_view_task for all tasks
  can_edit_task for all tasks
  can_view_all_tasks
  ...
"

(and same for all other groups). Then reads won't need to do mental set math to
figure out what each group grants.

[M-A Ruel, 2017/07/25 13:46:38]

Did the Grants: way.

+  // bot_bootstrap_group.
   optional string admins_group = 1;
   // Members of this group can fetch swarming bot code and bootstrap bots.
   optional string bot_bootstrap_group = 2;
   // Members of this group can schedule tasks and see everyone else's tasks.
+  // Membership of this group acts a superset of users_group, view_bots_group
+  // and view_tasks_group.
   optional string privileged_users_group = 3;
   // Members of this group can schedule tasks and see only their own tasks.
   optional string users_group = 4;
+  // Members of this group can view all bots. This is a read-only group.
+  optional string view_all_bots_group = 5;
+  // Members of this group can view all tasks. This is a read-only group.
+  optional string view_all_tasks_group = 6;
 }