[scheduler]: ACLs phase 1 - per Job ACL specification and enforcement.

scheduler/appengine/engine/engine.go

Index: scheduler/appengine/engine/engine.go
diff --git a/scheduler/appengine/engine/engine.go b/scheduler/appengine/engine/engine.go
index 57799b38eda49460691045f44521bc2fdc68d4d2..36357d5caa932c26102d720fc93882ecedd0b86d 100644
--- a/scheduler/appengine/engine/engine.go
+++ b/scheduler/appengine/engine/engine.go
@@ -48,6 +48,7 @@ import (
 	"github.com/luci/luci-go/server/auth/signing"
 	"github.com/luci/luci-go/server/tokens"
 
+	"github.com/luci/luci-go/scheduler/appengine/acl"
 	"github.com/luci/luci-go/scheduler/appengine/catalog"
 	"github.com/luci/luci-go/scheduler/appengine/schedule"
 	"github.com/luci/luci-go/scheduler/appengine/task"
@@ -269,6 +270,9 @@ type Job struct {
 	// of the engine. See Catalog.UnmarshalTask().
 	Task []byte `gae:",noindex"`
 
+	// ACLs are the latest ACLs applied to Job and all its invocations.
+	Acls acl.GrantsByRole `gae:",noindex"`
+
 	// State is the job's state machine state, see StateMachine.
 	State JobState
 }
@@ -328,6 +332,7 @@ func (e *Job) matches(def catalog.Definition) bool {
 	return e.JobID == def.JobID &&
 		e.Flavor == def.Flavor &&
 		e.Schedule == def.Schedule &&
+		def.Acls.Equal(&e.Acls) &&

[Vadim Sh., 2017/08/01 01:56:19]

nit: swap

e.Acls.Equal(&def.Acls)

[tandrii(chromium), 2017/08/01 22:50:01]

Done.

 		bytes.Equal(e.Task, def.Task)
 }