[scheduler]: ACLs phase 1 - per Job ACL specification and enforcement.

scheduler/appengine/frontend/handler.go

 // Copyright 2015 The LUCI Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
 //
 //      http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
@@ skipping 48 matching lines @@
         "github.com/luci/luci-go/scheduler/appengine/task/noop"
         "github.com/luci/luci-go/scheduler/appengine/task/swarming"
         "github.com/luci/luci-go/scheduler/appengine/task/urlfetch"
         "github.com/luci/luci-go/scheduler/appengine/ui"
 )
 
 //// Global state. See init().
 
 var (
         globalCatalog catalog.Catalog
-        globalEngine  engine.Engine
+        globalEngine  engine.EngineInternal
 
         // Known kinds of tasks.
         managers = []task.Manager{
                 &buildbucket.TaskManager{},
                 &gitiles.TaskManager{},
                 &noop.TaskManager{},
                 &swarming.TaskManager{},
                 &urlfetch.TaskManager{},
         }
 )
@@ skipping 76 matching lines @@
                         next(c)
                 },
         )
 
         // Setup HTTP routes.
         r := router.New()
 
         gaemiddleware.InstallHandlersWithMiddleware(r, base)
 
         ui.InstallHandlers(r, base, ui.Config{
-                Engine:        globalEngine,
+                Engine:        globalEngine.PublicAPI(),
                 Catalog:       globalCatalog,
                 TemplatesPath: "templates",
         })
 
         r.POST("/pubsub", base, pubsubPushHandler) // auth is via custom tokens
         r.GET("/internal/cron/read-config", base.Extend(gaemiddleware.RequireCron), readConfigCron)
         r.POST("/internal/tasks/read-project-config", base.Extend(gaemiddleware.RequireTaskQueue("read-project-config")), readProjectConfigTask)
         r.POST("/internal/tasks/timers", base.Extend(gaemiddleware.RequireTaskQueue("timers")), actionTask)
         r.POST("/internal/tasks/invocations", base.Extend(gaemiddleware.RequireTaskQueue("invocations")), actionTask)
 
         // Devserver can't accept PubSub pushes, so allow manual pulls instead to
         // simplify local development.
         if appengine.IsDevAppServer() {
                 r.GET("/pubsub/pull/:ManagerName/:Publisher", base, pubsubPullHandler)
         }
 
         // Install RPC servers.
         api := prpc.Server{
                 UnaryServerInterceptor: grpcmon.NewUnaryServerInterceptor(nil),
         }
         scheduler.RegisterSchedulerServer(&api, apiservers.SchedulerServer{
-                Engine:  globalEngine,
+                Engine:  globalEngine.PublicAPI(),
                 Catalog: globalCatalog,
         })
         discovery.Enable(&api)
         api.InstallHandlers(r, base)
 
         http.DefaultServeMux.Handle("/", r)
 }
 
 // pubsubPushHandler handles incoming PubSub messages.
 func pubsubPushHandler(c *router.Context) {
@@ skipping 103 matching lines @@
                 return
         }
         count, _ := strconv.Atoi(rc.Request.Header.Get("X-AppEngine-TaskExecutionCount"))
         err = globalEngine.ExecuteSerializedAction(rc.Context, body, count)
         if err != nil {
                 rc.err(err, "Error when executing the action")
                 return
         }
         rc.ok()
 }