[scheduler]: ACLs phase 3 - require ACLs specs for each Job/Trigger.

scheduler/appengine/acl/acl.go

 // Copyright 2017 The LUCI Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
 //
 //      http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
@@ skipping 23 matching lines @@
 type GrantsByRole struct {
         Owners  []string `gae:",noindex"`
         Readers []string `gae:",noindex"`
 }
 
 func (g *GrantsByRole) IsOwner(c context.Context) (bool, error) {
         return hasGrant(c, g.Owners, groupsAdministrators)
 }
 
 func (g *GrantsByRole) IsReader(c context.Context) (bool, error) {
-        if len(g.Readers) == 0 && len(g.Owners) == 0 {
-                // This is here for backwards compatiblity before ACLs were introduced.
-                // If Job doesn't specify READERs nor OWNERS explicitely, everybody can read.
-                // TODO(tAndrii): remove once every Job/Trigger has ACLs specified.
-                logging.Warningf(c, "Granting READ rights to all because no ACLs specified")
-                return true, nil
-        }
         return hasGrant(c, g.Owners, g.Readers, groupsAdministrators)
 }
 
 func (g *GrantsByRole) Equal(o *GrantsByRole) bool {
         eqSlice := func(a, b []string) bool {
                 if len(a) != len(b) {
                         return false
                 }
                 for i := range a {
                         if a[i] != b[i] {
@@ skipping 40 matching lines @@
                 grantsList, exists := pSets[set]
                 if !exists {
                         return nil, fmt.Errorf("referencing AclSet '%s' which doesn't exist", set)
                 }
                 grantsLists = append(grantsLists, grantsList)
         }
         mg := mergeGrants(grantsLists...)
         if n := len(mg.Owners) + len(mg.Readers); n > maxGrantsPerJob {
                 return nil, fmt.Errorf("Job or Trigger can have at most %d acls, but %d given", maxGrantsPerJob, n)
         }
+        if len(mg.Owners) == 0 {
+                return nil, fmt.Errorf("Job or Trigger must have OWNER acl set")
+        }
+        if len(mg.Readers) == 0 {
+                return nil, fmt.Errorf("Job or Trigger must have READER acl set")
+        }
         return mg, nil
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 
 var (
         // aclSetNameRe is used to validate AclSet Name field.
         aclSetNameRe = regexp.MustCompile(`^[0-9A-Za-z_\-\.]{1,100}$`)
         // maxGrantsPerJob is how many different grants are specified for a job.
         maxGrantsPerJob = 32
@@ skipping 68 matching lines @@
                         }
                 }
         }
         if isMember, err := auth.IsMember(c, groups...); err != nil {
                 return false, transient.Tag.Apply(err)
         } else {
                 logging.Debugf(c, "Result of group membership of %s in %s: %t", currentIdentity, groups, isMember)
                 return isMember, nil
         }
 }