scheduler ACLs: improve ACL-related error handling in UI and API.

scheduler/appengine/ui/invocation.go

Index: scheduler/appengine/ui/invocation.go
diff --git a/scheduler/appengine/ui/invocation.go b/scheduler/appengine/ui/invocation.go
index 227a3df0470509eea5fd41970e0a579c7b8fce75..e221da227a3d980e17913485db5b0e0bed1d249e 100644
--- a/scheduler/appengine/ui/invocation.go
+++ b/scheduler/appengine/ui/invocation.go
@@ -56,16 +56,16 @@ func invocationPage(c *router.Context) {
 
 	// panic on internal datastore errors to trigger HTTP 500.
 	switch {
+	case err2 == engine.ErrNoSuchJob:
+		http.Error(c.Writer, "No such job or no permission", http.StatusNotFound)
+		return
+	case err1 == engine.ErrNoSuchInvocation:
+		http.Error(c.Writer, "No such invocation", http.StatusNotFound)
+		return
 	case err1 != nil:
 		panic(err1)
 	case err2 != nil:
 		panic(err2)
-	case inv == nil:
-		http.Error(c.Writer, "No such invocation", http.StatusNotFound)
-		return
-	case job == nil:
-		http.Error(c.Writer, "No such job", http.StatusNotFound)
-		return
 	}
 
 	jobUI := makeJob(c.Context, job)