scheduler ACLs: Add debug lines.

scheduler/appengine/acl/acl.go

 // Copyright 2017 The LUCI Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
 //
 //      http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
 package acl
 
 import (
         "fmt"
         "regexp"
         "sort"
         "strings"
 
         "github.com/luci/luci-go/common/data/stringset"
         "github.com/luci/luci-go/common/errors"
+        "github.com/luci/luci-go/common/logging"
         "github.com/luci/luci-go/common/retry/transient"
         "github.com/luci/luci-go/scheduler/appengine/messages"
         "github.com/luci/luci-go/server/auth"
         "github.com/luci/luci-go/server/auth/identity"
         "golang.org/x/net/context"
 )
 
 // GrantsByRole can answer questions who can READ and who OWNS the task.
 type GrantsByRole struct {
         Owners  []string `gae:",noindex"`
         Readers []string `gae:",noindex"`
 }
 
 func (g *GrantsByRole) IsOwner(c context.Context) (bool, error) {
         return hasGrant(c, g.Owners, groupsAdministrators)
 }
 
 func (g *GrantsByRole) IsReader(c context.Context) (bool, error) {
         if len(g.Readers) == 0 && len(g.Owners) == 0 {
                 // This is here for backwards compatiblity before ACLs were introduced.
                 // If Job doesn't specify READERs nor OWNERS explicitely, everybody can read.
                 // TODO(tAndrii): remove once every Job/Trigger has ACLs specified.
+                logging.Warningf(c, "Granting READ rights to all because no ACLs specified")
                 return true, nil
         }
         return hasGrant(c, g.Owners, g.Readers, groupsAdministrators)
 }
 
 func (g *GrantsByRole) Equal(o *GrantsByRole) bool {
         eqSlice := func(a, b []string) bool {
                 if len(a) != len(b) {
                         return false
                 }
@@ skipping 118 matching lines @@
                         if strings.HasPrefix(grant, "group:") {
                                 groups = append(groups, grant[len("group:"):])
                                 continue
                         }
                         grantedIdentity := identity.Identity(grant)
                         if !strings.ContainsRune(grant, ':') {
                                 // Just email.
                                 grantedIdentity = identity.Identity("user:" + grant)
                         }
                         if grantedIdentity == currentIdentity {
+                                logging.Debugf(c, "Found grant %s for %s", currentIdentity)
                                 return true, nil
                         }
                 }
         }
         if isMember, err := auth.IsMember(c, groups...); err != nil {
                 return false, transient.Tag.Apply(err)
         } else {
+                logging.Debugf(c, "Result of group membership of %s in %s: %t", currentIdentity, groups, isMember)
                 return isMember, nil
         }
 }