[scheduler]: ACLs phase 1 - per Job ACL specification and enforcement.

scheduler/appengine/catalog/catalog_test.go

 // Copyright 2015 The LUCI Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
 //
 //      http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
 package catalog
 
 import (
         "errors"
         "testing"
 
         "github.com/golang/protobuf/proto"
         "golang.org/x/net/context"
         "google.golang.org/api/pubsub/v1"
 
         memcfg "github.com/luci/luci-go/common/config/impl/memory"
         "github.com/luci/luci-go/luci_config/server/cfgclient/backend/testconfig"
 
+        "github.com/luci/luci-go/scheduler/appengine/acl"
         "github.com/luci/luci-go/scheduler/appengine/messages"
         "github.com/luci/luci-go/scheduler/appengine/task"
 
         . "github.com/luci/luci-go/common/testing/assertions"
         . "github.com/smartystreets/goconvey/convey"
 )
 
 func TestRegisterTaskManagerAndFriends(t *testing.T) {
         Convey("RegisterTaskManager works", t, func() {
                 c := New("scheduler.cfg")
@@ skipping 161 matching lines @@
                         So(err, ShouldBeNil)
                         So(projects, ShouldResemble, []string{"broken", "project1", "project2"})
                 })
 
                 Convey("GetProjectJobs works", func() {
                         defs, err := cat.GetProjectJobs(ctx, "project1")
                         So(err, ShouldBeNil)
                         So(defs, ShouldResemble, []Definition{
                                 {
                                         JobID:    "project1/noop-job-1",
-                                        Revision: "776a16076543daae60a3c9df9a3ea2d7a4067045",
+                                        Acls:     acl.GrantsByRole{Readers: []string{"group:all"}, Owners: []string{"group:some-admins"}},
+                                        Revision: "847cf9c217f7bad214805f3bea7a30799383940b",
                                         Schedule: "*/10 * * * * * *",
                                         Task:     []uint8{0xa, 0x0},
                                 },
                                 {
                                         JobID:    "project1/noop-job-2",
-                                        Revision: "776a16076543daae60a3c9df9a3ea2d7a4067045",
+                                        Acls:     acl.GrantsByRole{Readers: []string{"group:all"}, Owners: []string{"group:some-admins"}},
+                                        Revision: "847cf9c217f7bad214805f3bea7a30799383940b",
                                         Schedule: "*/10 * * * * * *",
                                         Task:     []uint8{0xa, 0x0},
                                 },
                                 {
                                         JobID:    "project1/urlfetch-job-1",
-                                        Revision: "776a16076543daae60a3c9df9a3ea2d7a4067045",
+                                        Acls:     acl.GrantsByRole{Readers: []string{"group:all"}, Owners: []string{"group:debuggers", "group:some-admins"}},
+                                        Revision: "847cf9c217f7bad214805f3bea7a30799383940b",
                                         Schedule: "*/10 * * * * * *",
                                         Task:     []uint8{18, 21, 18, 19, 104, 116, 116, 112, 115, 58, 47, 47, 101, 120, 97, 109, 112, 108, 101, 46, 99, 111, 109},
                                 },
                                 {
                                         JobID:    "project1/urlfetch-job-2",
-                                        Revision: "776a16076543daae60a3c9df9a3ea2d7a4067045",
+                                        Acls:     acl.GrantsByRole{Readers: []string{"group:all"}, Owners: []string{"group:some-admins"}},
+                                        Revision: "847cf9c217f7bad214805f3bea7a30799383940b",
                                         Schedule: "*/10 * * * * * *",
                                         Task:     []uint8{18, 21, 18, 19, 104, 116, 116, 112, 115, 58, 47, 47, 101, 120, 97, 109, 112, 108, 101, 46, 99, 111, 109},
                                 },
                         })
 
                         // Make sure URL fetch jobs are parsed correctly and identically.
                         newStyleDef := defs[2].Task
                         oldStyleDef := defs[3].Task
                         So(newStyleDef, ShouldResemble, oldStyleDef)
                         msg := messages.TaskDefWrapper{}
@@ skipping 85 matching lines @@
         fakeTaskManager
 }
 
 func (b brokenTaskManager) ProtoMessageType() proto.Message {
         return nil
 }
 
 ////
 
 const project1Cfg = `
+
+acl_sets {
+        name: "public"
+        acls {
+                role: READER
+                granted_to: "group:all"
+        }
+        acls {
+                role: OWNER
+                granted_to: "group:some-admins"
+        }
+}
+
 job {
   id: "noop-job-1"
   schedule: "*/10 * * * * * *"
+        acl_sets: "public"
 
   noop: {}
 }
 
 job {
   id: "noop-job-2"
   schedule: "*/10 * * * * * *"
+        acl_sets: "public"
 
   noop: {}
 }
 
 job {
   id: "noop-job-3"
   schedule: "*/10 * * * * * *"
   disabled: true
 
   noop: {}
 }
 
 job {
   id: "urlfetch-job-1"
   schedule: "*/10 * * * * * *"
+        acl_sets: "public"
+        acls {
+                role: OWNER
+                granted_to: "group:debuggers"
+        }
 
   url_fetch: {
     url: "https://example.com"
   }
 }
 
 # Old-style URL fetch job definition.
 job {
   id: "urlfetch-job-2"
   schedule: "*/10 * * * * * *"
+        acl_sets: "public"
 
   task: {
     url_fetch: {
       url: "https://example.com"
     }
   }
 }
 
 # Will be skipped since SwarmingTask Manager is not registered.
 job {
@@ skipping 16 matching lines @@
         "projects/project1": {
                 "scheduler.cfg": project1Cfg,
         },
         "projects/project2": {
                 "scheduler.cfg": project2Cfg,
         },
         "projects/broken": {
                 "scheduler.cfg": "broken!!!!111",
         },
 }