code: func projectACLMiddleware(c *router.Context, next router.Handler) {
  	luciProject := c.Params.ByName("project")
  	switch allowed, err := common.IsAllowed(c.Context, luciProject); {
  	case err != nil:
  		ErrorHandler(c, err)
  	case !allowed:
  		if auth.CurrentIdentity(c.Context) == identity.AnonymousIdentity {
  			ErrorHandler(c, errors.New("not logged in", grpcutil.UnauthenticatedTag))
  		} else {
  			ErrorHandler(c, errors.New("no access to project", grpcutil.PermissionDeniedTag))
  		}
  	default:
  		c.Context = git.WithProject(c.Context, luciProject)
  		next(c)
  	}
  }
docs: // projectACLMiddleware adds ACL checks on a per-project basis.
  // Expects c.Params to have project parameter.