[scheduler]: ACLs phase 1 - per Job ACL specification and enforcement.

scheduler/appengine/acl/acl.go

 // Copyright 2017 The LUCI Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
 //
 //      http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
 package acl
 
 import (
-        "golang.org/x/net/context"
+        "context"
+        "fmt"
+        "regexp"
+        "sort"
+        "strings"
 
+        "github.com/luci/luci-go/scheduler/appengine/messages"
         "github.com/luci/luci-go/server/auth"
 )
 
+// IsJobOwner is deprecated. UIse GrantsByRole.IsOwner instead.
 func IsJobOwner(c context.Context, projectID, jobName string) bool {
         // TODO(vadimsh): Do real ACLs.
         ok, err := auth.IsMember(c, "administrators")
         if err != nil {
                 panic(err)
         }
         return ok
 }
+
+// GrantsByRole can answer questions who can READ and who OWNS the task.
+type GrantsByRole struct {
+        Owners  []string `gae:",noindex"`
+        Readers []string `gae:",noindex"`
+}
+
+func (g *GrantsByRole) IsOwner(c context.Context) (bool, error) {
+        return hasGrant(c, g.Owners, groupsAdministrators)
+}
+
+func (g *GrantsByRole) IsReader(c context.Context) (bool, error) {
+        return hasGrant(c, g.Owners, g.Readers, groupsAdministrators)
+}
+
+func (g *GrantsByRole) Equal(o *GrantsByRole) bool {
+        eqSlice := func(a, b []string) bool {
+                if len(a) != len(b) {
+                        return false
+                }
+                for i := range a {
+                        if a[i] != b[i] {
+                                return false
+                        }
+                }
+                return true
+        }
+        return eqSlice(g.Owners, o.Owners) && eqSlice(g.Readers, o.Readers)
+}
+
+// AclSets are parsed and indexed `AclSet` of a project.
+type AclSets map[string][]*messages.Acl
+
+// ValidateAclSets validates list of AclSet of a project and returns AclSets.
+func ValidateAclSets(sets []*messages.AclSet) (AclSets, error) {

[Vadim Sh., 2017/08/01 01:56:19]

you may or may not be interested in this thing:
https://godoc.org/github.com/luci/luci-go/common/config/validation

[tandrii(chromium), 2017/08/01 22:50:01]

Neat! I'm punting it to another CL to refactor catalog validation as well as
acl.
Btw, does scheduler service provide validation endpoint to be called by
LUCI-config?

[Vadim Sh., 2017/08/01 23:04:09]

No.

+        as := make(AclSets, len(sets))
+        for _, s := range sets {
+                if s.Name == "" {
+                        return nil, fmt.Errorf("missing 'name' field'")
+                }
+                if !aclSetNameRe.MatchString(s.Name) {
+                        return nil, fmt.Errorf("%q is not valid value for 'name' field", s.Name)
+                }
+                if _, isDup := as[s.Name]; isDup {
+                        return nil, fmt.Errorf("aclSet name %q is not unique", s.Name)
+                }
+                if len(s.GetAcls()) == 0 {
+                        return nil, fmt.Errorf("aclSet %q has no entries", s.Name)
+                }
+                as[s.Name] = s.GetAcls()
+        }
+        return as, nil
+}
+
+// ValidateTaskAcls validates task's ACLs and returns TaskAcls.
+func ValidateTaskAcls(pSets AclSets, tSets []string, tAcls []*messages.Acl) (*GrantsByRole, error) {
+        grantsLists := make([][]*messages.Acl, 0, 1+len(tSets))
+        if err := validateGrants(tAcls); err != nil {
+                return nil, err
+        }
+        grantsLists = append(grantsLists, tAcls)
+        for _, set := range tSets {
+                grantsList, exists := pSets[set]
+                if !exists {
+                        return nil, fmt.Errorf("referencing AclSet '%s' which doesn't exist", set)
+                }
+                grantsLists = append(grantsLists, grantsList)
+        }
+        mg := mergeGrants(grantsLists...)
+        if n := len(mg.Owners) + len(mg.Readers); n > maxGrantsPerJob {
+                return nil, fmt.Errorf("Job or Trigger can have at most %d acls, but %d given", maxGrantsPerJob, n)
+        }
+        return mg, nil
+}
+
+////////////////////////////////////////////////////////////////////////////////
+
+var (
+        // aclSetNameRe is used to validate AclSet Name field.
+        aclSetNameRe = regexp.MustCompile(`^[0-9A-Za-z_\-\.]{1,100}$`)

[tandrii(chromium), 2017/08/01 22:50:01]

changed here instead.

+        // maxGrantsPerJob is how many different grants are specified for a job.
+        maxGrantsPerJob = 32
+
+        groupsAdministrators = []string{"group:administrators"}
+)
+
+func validateGrants(gs []*messages.Acl) error {
+        for _, g := range gs {
+                if g.GetRole() != messages.Acl_OWNER && g.GetRole() != messages.Acl_READER {
+                        return fmt.Errorf("invalid role %q", g.GetRole())
+                }
+                if g.GetGrantedTo() == "" {
+                        return fmt.Errorf("missing granted_to for role %s", g.GetRole())
+                }

[Vadim Sh., 2017/08/01 01:56:18]

please validate granted_to:

if it has prefix "group:", then make sure suffix is not empty.
If it has no ':' then make sure identity.MakeIdentity("user:"+granted_to)
doesn't return an error.
Otherwise check that identity.MakeIdentity(granted_to) doesn't return an error.

[tandrii(chromium), 2017/08/01 22:50:01]

Done.

+        }
+        return nil
+}
+
+// mergeGrants merges valid grants into GrantsByRole, removing and sorting duplicates.
+func mergeGrants(grantsLists ...[]*messages.Acl) *GrantsByRole {
+        all := map[messages.Acl_Role]map[string]bool{

[Vadim Sh., 2017/08/01 01:56:19]

you may or may not be interested in
https://godoc.org/github.com/luci/luci-go/common/data/stringset

In particular its ToSlice method.

[tandrii(chromium), 2017/08/01 22:50:01]

indeed I am :) Done.

+                messages.Acl_OWNER:  {},
+                messages.Acl_READER: {},
+        }
+        for _, grantsList := range grantsLists {
+                for _, g := range grantsList {
+                        all[g.GetRole()][g.GetGrantedTo()] = true
+                }
+        }
+
+        sortKeys := func(m map[string]bool) []string {
+                r := make([]string, 0, len(m))
+                for k := range m {
+                        r = append(r, k)
+                }
+                sort.Strings(r)
+                return r
+        }
+        return &GrantsByRole{
+                Owners:  sortKeys(all[messages.Acl_OWNER]),
+                Readers: sortKeys(all[messages.Acl_READER]),
+        }
+}
+
+// hasGrant is current user is covered by any given grants.
+func hasGrant(c context.Context, grantsList ...[]string) (bool, error) {
+        groups := []string{}
+        for _, grants := range grantsList {
+                for _, grant := range grants {
+                        parts := strings.SplitN(grant, ":", 2)
+                        if len(parts) < 2 {
+                                // grant is just email.
+                                if auth.CurrentIdentity(c).Email() == grant {

[Vadim Sh., 2017/08/01 01:56:19]

this returns "" if CurretnIdentity is not of 'user' kind.

A somewhat safer check would be

if auth.CurrentIdentity(c) == identity.Identity("user:"+grant) {
  ....
}

[tandrii(chromium), 2017/08/01 22:50:01]

Done & refactored.

+                                        return true, nil
+                                }
+                                continue
+                        }
+                        kind, value := parts[0], parts[1]
+                        // TODO(tandrii): other kinds.
+                        switch kind {
+                        case "group":
+                                groups = append(groups, value)
+                        default:
+                                panic(fmt.Errorf("granted_to '%s' kind is not supported", grant))

[Vadim Sh., 2017/08/01 01:56:19]

just check auth.CurrentIdentity(c) == identity.Identity(grant)

[tandrii(chromium), 2017/08/01 22:50:01]

Done.

+                        }
+                }
+        }
+        return auth.IsMember(c, groups...)
+}