scheduler: make debug output for ACLs checks contain JobID.

scheduler/appengine/engine/engine.go

 // Copyright 2015 The LUCI Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
 //
 //      http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
@@ skipping 334 matching lines @@
 // specified by catalog.Definition struct. UpdateProjectJobs skips updates for
 // such jobs (assuming they are up-to-date).
 func (e *Job) matches(def catalog.Definition) bool {
         return e.JobID == def.JobID &&
                 e.Flavor == def.Flavor &&
                 e.Schedule == def.Schedule &&
                 e.Acls.Equal(&def.Acls) &&
                 bytes.Equal(e.Task, def.Task)
 }
 
+// isVisible checks if current identity has READER access to this job.
+func (e *Job) isVisible(c context.Context) (bool, error) {
+        return e.Acls.IsReader(logging.SetField(c, "JobID", e.JobID))
+}
+
+// isOwned checks if current identity has OWNER access to this job.
+func (e *Job) isOwned(c context.Context) (bool, error) {
+        return e.Acls.IsOwner(logging.SetField(c, "JobID", e.JobID))
+}
+
 // Invocation entity stores single attempt to run a job. Its parent entity
 // is corresponding Job, its ID is generated based on time.
 type Invocation struct {
         _kind  string         `gae:"$kind,Invocation"`
         _extra ds.PropertyMap `gae:"-,extra"`
 
         // ID is identifier of this particular attempt to run a job. Multiple attempts
         // to start an invocation result in multiple entities with different IDs, but
         // with same InvocationNonce.
         ID int64 `gae:"$id"`
@@ skipping 292 matching lines @@
                 return nil, transient.Tag.Apply(err)
         }
         // Non-ancestor query used, need to recheck filters.
         filtered := make([]*Job, 0, len(entities))
         for _, job := range entities {
                 if !job.Enabled {
                         continue
                 }
                 // TODO(tandrii): improve batch ACLs check here to take advantage of likely
                 // shared ACLs between most jobs of the same project.
-                if ok, err := job.Acls.IsReader(c); err != nil {
+                if ok, err := job.isVisible(c); err != nil {
                         return nil, transient.Tag.Apply(err)
                 } else if ok {
                         filtered = append(filtered, job)
                 }
         }
         return filtered, nil
 }
 
 func (e *engineImpl) GetVisibleJob(c context.Context, jobID string) (*Job, error) {
         job, err := e.getJob(c, jobID)
         if err != nil {
                 return nil, err
         } else if job == nil {
                 return nil, ErrNoSuchJob
         }
-        if ok, err := job.Acls.IsReader(c); err != nil {
+        if ok, err := job.isVisible(c); err != nil {
                 return nil, err
         } else if !ok {
                 return nil, ErrNoSuchJob
         }
         return job, nil
 }
 
 func (e *engineImpl) getOwnedJob(c context.Context, jobID string) (*Job, error) {
         job, err := e.getJob(c, jobID)
         if err != nil {
                 return nil, err
         } else if job == nil {
                 return nil, ErrNoSuchJob
         }
 
-        switch owner, err := job.Acls.IsOwner(c); {
+        switch owner, err := job.isOwned(c); {
         case err != nil:
                 return nil, err
         case owner:
                 return job, nil
         }
 
         // Not owner, but maybe reader? Give nicer error in such case.
-        switch reader, err := job.Acls.IsReader(c); {
+        switch reader, err := job.isVisible(c); {
         case err != nil:
                 return nil, err
         case reader:
                 return nil, ErrNoOwnerPermission
         default:
                 return nil, ErrNoSuchJob
         }
 }
 
 func (e *engineImpl) getJob(c context.Context, jobID string) (*Job, error) {
@@ skipping 1354 matching lines @@
                 }
                 if hasFinished {
                         return ctl.eng.rollSM(c, job, func(sm *StateMachine) error {
                                 sm.OnInvocationDone(saving.ID)
                                 return nil
                         })
                 }
                 return nil
         })
 }