[scheduler]: ACLs phase 3 - require ACLs specs for each Job/Trigger.

scheduler/appengine/acl/acl_test.go

 // Copyright 2017 The LUCI Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
 //
 //      http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
@@ skipping 50 matching lines @@
                         _, err := ValidateAclSets(sets)
                         So(err, ShouldNotBeNil)
                 }
 
                 shouldError(&messages.AclSet{Name: "one"})
                 shouldError(&messages.AclSet{Name: "?bad i'd", Acls: validGrants})
                 shouldError(validAclSet, validAclSet)
         })
 
         Convey("Task Acls", t, func() {
-                Convey("Without AclSets", func() {
-                        jobAcls, err := ValidateTaskAcls(nil, []string{}, validGrants)
-                        So(err, ShouldBeNil)
-                        So(jobAcls.Owners, ShouldResemble, []string{})
-                        So(jobAcls.Readers, ShouldResemble, []string{"group:all"})
+                Convey("READER and OWNER ACLs are required", func() {
+                        _, err := ValidateTaskAcls(nil, []string{},
+                                []*messages.Acl{{Role: messages.Acl_READER, GrantedTo: "group:readers"}})
+                        So(err.Error(), ShouldResemble, "Job or Trigger must have OWNER acl set")
+
+                        _, err = ValidateTaskAcls(nil, []string{},
+                                []*messages.Acl{{Role: messages.Acl_OWNER, GrantedTo: "group:owners"}})
+                        So(err.Error(), ShouldResemble, "Job or Trigger must have READER acl set")
                 })
 
                 Convey("Without AclSets but with bad ACLs", func() {
                         _, err := ValidateTaskAcls(nil, []string{}, []*messages.Acl{
                                 {Role: messages.Acl_OWNER, GrantedTo: ""}})
                         So(err, ShouldNotBeNil)
                 })
 
                 Convey("Many ACLs", func() {
                         taskGrants := make([]*messages.Acl, maxGrantsPerJob)
-                        for i := 0; i < maxGrantsPerJob; i++ {
+                        taskGrants[0] = &messages.Acl{Role: messages.Acl_READER, GrantedTo: "group:readers"}
+                        for i := 1; i < maxGrantsPerJob; i++ {
                                 taskGrants[i] = &messages.Acl{Role: messages.Acl_OWNER, GrantedTo: fmt.Sprintf("group:%d", i)}
                         }
+                        So(len(taskGrants), ShouldEqual, maxGrantsPerJob)
                         Convey("Hitting max is OK", func() {
                                 r, err := ValidateTaskAcls(nil, []string{}, taskGrants)
                                 So(err, ShouldBeNil)
-                                So(len(r.Owners), ShouldEqual, maxGrantsPerJob)
+                                So(len(r.Readers), ShouldEqual, 1)
+                                So(len(r.Owners), ShouldEqual, maxGrantsPerJob-1)
                         })
                         Convey("1 too many", func() {
                                 aclSets := map[string][]*messages.Acl{
                                         "public": {{Role: messages.Acl_READER, GrantedTo: "group:all"}},
                                 }
                                 _, err := ValidateTaskAcls(aclSets, []string{"public"}, taskGrants)
                                 So(err.Error(), ShouldResemble, "Job or Trigger can have at most 32 acls, but 33 given")
                         })
                 })
 
@@ skipping 106 matching lines @@
         Convey("GrantsByRole.Equal", t, func() {
                 x1 := GrantsByRole{Readers: []string{"a"}, Owners: []string{"b", "c"}}
                 x2 := GrantsByRole{Readers: []string{"a"}, Owners: []string{"b", "c"}}
                 So(x1.Equal(&x2), ShouldBeTrue)
                 y := GrantsByRole{Readers: []string{"e", "g"}, Owners: []string{"b", "d"}}
                 z := GrantsByRole{Readers: []string{"e", "g"}, Owners: []string{"b", "c", "d"}}
                 So(x1.Equal(&y), ShouldBeFalse)
                 So(y.Equal(&z), ShouldBeFalse)
         })
 }