old_contents: # Copyright 2017 The Chromium Authors. All rights reserved.
  # Use of this source code is governed by a BSD-style license that can be
  # found in the LICENSE file.
  import functools
  import logging
  
  from google.appengine.api import oauth
  
  from dashboard.common import datastore_hooks
  from dashboard.common import utils
  
  
  OAUTH_CLIENT_ID_WHITELIST = [
      # This oauth client id is from Pinpoint.
      '62121018386-aqdfougp0ddn93knqj6g79vvn42ajmrg.apps.googleusercontent.com',
      # This oauth client id is from the 'chromeperf' API console.
      '62121018386-h08uiaftreu4dr3c4alh3l7mogskvb7i.apps.googleusercontent.com',
      # This oauth client id is from chromiumdash.
      '377415874083-slpqb5ur4h9sdfk8anlq4qct9imivnmt.apps.googleusercontent.com',
      # This oauth client id is used to upload histograms from the perf waterfall.
      '113172445342431053212',
      'chromeperf@webrtc-perf-test.google.com.iam.gserviceaccount.com',
      'catapult-uploader@fuchsia-infra.iam.gserviceaccount.com'
  ]
  OAUTH_SCOPES = (
      'https://www.googleapis.com/auth/userinfo.email',
  )
  
  
  class ApiAuthException(Exception):
    pass
  
  
  class OAuthError(ApiAuthException):
    def __init__(self):
      super(OAuthError, self).__init__('User authentication error')
  
  
  class NotLoggedInError(ApiAuthException):
    def __init__(self):
      super(NotLoggedInError, self).__init__('User not authenticated')
  
  
  class InternalOnlyError(ApiAuthException):
    def __init__(self):
      super(InternalOnlyError, self).__init__('User does not have access')
  
  
  def _AuthorizeOauthUser():
    try:
      user = oauth.get_current_user(OAUTH_SCOPES)
      if user and not user.email().endswith('.gserviceaccount.com'):
        # For non-service account, need to verify that the OAuth client ID
        # is in our whitelist.
        client_id = oauth.get_client_id(OAUTH_SCOPES)
        if client_id not in OAUTH_CLIENT_ID_WHITELIST:
          logging.info('OAuth client id %s for user %s not in whitelist',
                       client_id, user.email())
          user = None
          raise OAuthError
    except oauth.Error:
      raise OAuthError
  
    if not user:
      raise NotLoggedInError
  
    logging.info('OAuth user logged in as: %s', user.email())
    if utils.IsGroupMember(user.email(), 'chromeperf-access'):
      datastore_hooks.SetPrivilegedRequest()
  
  
  def Authorize(function_to_wrap):
    @functools.wraps(function_to_wrap)
    def Wrapper(*args, **kwargs):
      _AuthorizeOauthUser()
  
      return function_to_wrap(*args, **kwargs)
    return Wrapper
  
new_contents: # Copyright 2017 The Chromium Authors. All rights reserved.
  # Use of this source code is governed by a BSD-style license that can be
  # found in the LICENSE file.
  import functools
  import logging
  
  from google.appengine.api import oauth
  
  from dashboard.common import datastore_hooks
  from dashboard.common import utils
  
  
  OAUTH_CLIENT_ID_WHITELIST = [
      # This oauth client id is from Pinpoint.
      '62121018386-aqdfougp0ddn93knqj6g79vvn42ajmrg.apps.googleusercontent.com',
      # This oauth client id is from the 'chromeperf' API console.
      '62121018386-h08uiaftreu4dr3c4alh3l7mogskvb7i.apps.googleusercontent.com',
      # This oauth client id is from chromiumdash.
      '377415874083-slpqb5ur4h9sdfk8anlq4qct9imivnmt.apps.googleusercontent.com',
      # This oauth client id is used to upload histograms from the perf waterfall.
      '113172445342431053212',
      'chromeperf@webrtc-perf-test.google.com.iam.gserviceaccount.com',
      'catapult-uploader@fuchsia-infra.iam.gserviceaccount.com',
      # This oauth client id used to upload histograms from cronet bots.
      '113172445342431053212'
  ]
  OAUTH_SCOPES = (
      'https://www.googleapis.com/auth/userinfo.email',
  )
  
  
  class ApiAuthException(Exception):
    pass
  
  
  class OAuthError(ApiAuthException):
    def __init__(self):
      super(OAuthError, self).__init__('User authentication error')
  
  
  class NotLoggedInError(ApiAuthException):
    def __init__(self):
      super(NotLoggedInError, self).__init__('User not authenticated')
  
  
  class InternalOnlyError(ApiAuthException):
    def __init__(self):
      super(InternalOnlyError, self).__init__('User does not have access')
  
  
  def _AuthorizeOauthUser():
    try:
      user = oauth.get_current_user(OAUTH_SCOPES)
      if user and not user.email().endswith('.gserviceaccount.com'):
        # For non-service account, need to verify that the OAuth client ID
        # is in our whitelist.
        client_id = oauth.get_client_id(OAUTH_SCOPES)
        if client_id not in OAUTH_CLIENT_ID_WHITELIST:
          logging.info('OAuth client id %s for user %s not in whitelist',
                       client_id, user.email())
          user = None
          raise OAuthError
    except oauth.Error:
      raise OAuthError
  
    if not user:
      raise NotLoggedInError
  
    logging.info('OAuth user logged in as: %s', user.email())
    if utils.IsGroupMember(user.email(), 'chromeperf-access'):
      datastore_hooks.SetPrivilegedRequest()
  
  
  def Authorize(function_to_wrap):
    @functools.wraps(function_to_wrap)
    def Wrapper(*args, **kwargs):
      _AuthorizeOauthUser()
  
      return function_to_wrap(*args, **kwargs)
    return Wrapper
  
subject: Whitelist cronet histogram account