)]}'
{"barbican/model/repositories.py":[{"author":{"_account_id":10873,"name":"Juan Antonio Osorio Robles","email":"jaosorior@redhat.com","username":"ejuaoso"},"change_message_id":"8aaecb551a89d3de2baece89d0f642a314782174","unresolved":false,"context_lines":[{"line_number":1637,"context_line":"        input user ids list. Otherwise, remove existing acl user entries."},{"line_number":1638,"context_line":"        Then add the remainining input user ids as new acl user db entries."},{"line_number":1639,"context_line":"        \"\"\""},{"line_number":1640,"context_line":"        if user_ids is None:"},{"line_number":1641,"context_line":"            return"},{"line_number":1642,"context_line":""},{"line_number":1643,"context_line":"        user_ids \u003d set(user_ids)"}],"source_content_type":"text/x-python","patch_set":1,"id":"fa963961_e2780692","line":1640,"updated":"2015-03-26 13:22:03.000000000","message":"Where would it be the case that user_ids are None?","commit_id":"02193c474693c8320ac3ab566beac703ac11c1e1"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"dc1ea861202a5cd6b87ae9869673fb237255a929","unresolved":false,"context_lines":[{"line_number":1637,"context_line":"        input user ids list. Otherwise, remove existing acl user entries."},{"line_number":1638,"context_line":"        Then add the remainining input user ids as new acl user db entries."},{"line_number":1639,"context_line":"        \"\"\""},{"line_number":1640,"context_line":"        if user_ids is None:"},{"line_number":1641,"context_line":"            return"},{"line_number":1642,"context_line":""},{"line_number":1643,"context_line":"        user_ids \u003d set(user_ids)"}],"source_content_type":"text/x-python","patch_set":1,"id":"fa963961_9d3cf430","line":1640,"in_reply_to":"fa963961_e2780692","updated":"2015-03-26 17:17:25.000000000","message":"I think in case if acl is added only with creator-only flag and no users.","commit_id":"02193c474693c8320ac3ab566beac703ac11c1e1"},{"author":{"_account_id":7789,"name":"John Wood","email":"john.wood@rackspace.com","username":"woodster"},"change_message_id":"eeaf13a77d70e0d1b4e38b7b2044b444564615f3","unresolved":false,"context_lines":[{"line_number":1629,"context_line":""},{"line_number":1630,"context_line":"        user_ids is expected to be list of ids (enforced by schema validation)."},{"line_number":1631,"context_line":"        Input user ids should have complete list of acl users. It does not"},{"line_number":1632,"context_line":"        apply partial update of user ids."},{"line_number":1633,"context_line":""},{"line_number":1634,"context_line":"        If user_ids is None, no change is made in acl user data."},{"line_number":1635,"context_line":"        If user_ids list is not None, then following change is made."}],"source_content_type":"text/x-python","patch_set":2,"id":"da9b358b_c87ddf1d","line":1632,"updated":"2015-03-31 04:27:33.000000000","message":"I think a complete list is nice from security perspective (you can only have as many users as you can put into an HTTP header), otherwise it might have been good to enforce an upper limit on the number of users (and associated ACL records) you can add to a secret.","commit_id":"a796f99320e82979dd25118cd99dd86b4cfbba79"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"4db1340b23ed9bbfb49ec99243d5a7976e318918","unresolved":false,"context_lines":[{"line_number":1175,"context_line":"        session \u003d self.get_session(session)"},{"line_number":1176,"context_line":"        try:"},{"line_number":1177,"context_line":"            query \u003d session.query(models.Container)"},{"line_number":1178,"context_line":"            query \u003d query.filter_by(id\u003dentity_id, deleted\u003dFalse)"},{"line_number":1179,"context_line":"            entity \u003d query.one()"},{"line_number":1180,"context_line":"        except sa_orm.exc.NoResultFound:"},{"line_number":1181,"context_line":"            entity \u003d None"}],"source_content_type":"text/x-python","patch_set":3,"id":"da9b358b_cfc025e3","line":1178,"updated":"2015-03-31 18:57:50.000000000","message":"Missing expiration filter?","commit_id":"34c1f03135d29233913f7d212fd812880a2721f4"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"bce88ccdc30a9d2276b8b28754703fe143cbe554","unresolved":false,"context_lines":[{"line_number":1175,"context_line":"        session \u003d self.get_session(session)"},{"line_number":1176,"context_line":"        try:"},{"line_number":1177,"context_line":"            query \u003d session.query(models.Container)"},{"line_number":1178,"context_line":"            query \u003d query.filter_by(id\u003dentity_id, deleted\u003dFalse)"},{"line_number":1179,"context_line":"            entity \u003d query.one()"},{"line_number":1180,"context_line":"        except sa_orm.exc.NoResultFound:"},{"line_number":1181,"context_line":"            entity \u003d None"}],"source_content_type":"text/x-python","patch_set":3,"id":"da9b358b_0ac5db59","line":1178,"in_reply_to":"da9b358b_2ae9bf14","updated":"2015-03-31 19:16:26.000000000","message":"I could have sworn containers also had expirations (from when I was working on the client code for them) but now I can\u0027t find any trace, so nevermind, I suppose... \u003c_\u003c","commit_id":"34c1f03135d29233913f7d212fd812880a2721f4"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"5d4cf3caf15120244f71fe59868b6b699849f2b5","unresolved":false,"context_lines":[{"line_number":1175,"context_line":"        session \u003d self.get_session(session)"},{"line_number":1176,"context_line":"        try:"},{"line_number":1177,"context_line":"            query \u003d session.query(models.Container)"},{"line_number":1178,"context_line":"            query \u003d query.filter_by(id\u003dentity_id, deleted\u003dFalse)"},{"line_number":1179,"context_line":"            entity \u003d query.one()"},{"line_number":1180,"context_line":"        except sa_orm.exc.NoResultFound:"},{"line_number":1181,"context_line":"            entity \u003d None"}],"source_content_type":"text/x-python","patch_set":3,"id":"da9b358b_2ae9bf14","line":1178,"in_reply_to":"da9b358b_cfc025e3","updated":"2015-03-31 19:09:35.000000000","message":"I see expiration is applicable for secrets which is present in above line 683. Is there a expiration logic for containers? Please clarify as I don\u0027t see any.","commit_id":"34c1f03135d29233913f7d212fd812880a2721f4"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"4db1340b23ed9bbfb49ec99243d5a7976e318918","unresolved":false,"context_lines":[{"line_number":1652,"context_line":"            project_id\u003dproject_id).filter_by(deleted\u003dFalse)"},{"line_number":1653,"context_line":""},{"line_number":1654,"context_line":""},{"line_number":1655,"context_line":"class SecretAclRepo(BaseRepo):"},{"line_number":1656,"context_line":"    \"\"\"Repository for the SecretACL entity."},{"line_number":1657,"context_line":""},{"line_number":1658,"context_line":"    There is no need for SecretACLUserRepo as none of logic access"}],"source_content_type":"text/x-python","patch_set":3,"id":"da9b358b_afb72185","line":1655,"updated":"2015-03-31 18:57:50.000000000","message":"Per Paul\u0027s comment on an unrelated CR (and looking at other stuff in this file), should this be SecretACLRepo?\n\nhttps://review.openstack.org/#/c/140575/17/barbican/plugin/snakeoil_ca.py","commit_id":"34c1f03135d29233913f7d212fd812880a2721f4"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"5d4cf3caf15120244f71fe59868b6b699849f2b5","unresolved":false,"context_lines":[{"line_number":1652,"context_line":"            project_id\u003dproject_id).filter_by(deleted\u003dFalse)"},{"line_number":1653,"context_line":""},{"line_number":1654,"context_line":""},{"line_number":1655,"context_line":"class SecretAclRepo(BaseRepo):"},{"line_number":1656,"context_line":"    \"\"\"Repository for the SecretACL entity."},{"line_number":1657,"context_line":""},{"line_number":1658,"context_line":"    There is no need for SecretACLUserRepo as none of logic access"}],"source_content_type":"text/x-python","patch_set":3,"id":"da9b358b_cad49348","line":1655,"in_reply_to":"da9b358b_afb72185","updated":"2015-03-31 19:09:35.000000000","message":"Okay. Will address in next patch.","commit_id":"34c1f03135d29233913f7d212fd812880a2721f4"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"97fc4ee5259b7d535d4da9a2d6190c72f213f7b8","unresolved":false,"context_lines":[{"line_number":1686,"context_line":""},{"line_number":1687,"context_line":"    def create_or_replace_from(self, secret, secret_acl\u003dNone, user_ids\u003dNone,"},{"line_number":1688,"context_line":"                               session\u003dNone):"},{"line_number":1689,"context_line":"        session \u003d self.get_session(session)"},{"line_number":1690,"context_line":"        secret.updated_at \u003d timeutils.utcnow()"},{"line_number":1691,"context_line":"        secret.secret_acls.append(secret_acl)"},{"line_number":1692,"context_line":"        secret.save(session\u003dsession)"}],"source_content_type":"text/x-python","patch_set":3,"id":"da9b358b_d230c003","line":1689,"updated":"2015-04-01 03:53:06.000000000","message":"What happens when secret_acl is None?","commit_id":"34c1f03135d29233913f7d212fd812880a2721f4"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"2e27bf8ed5e399a466dfa5d3c41e2fad99d4434e","unresolved":false,"context_lines":[{"line_number":1686,"context_line":""},{"line_number":1687,"context_line":"    def create_or_replace_from(self, secret, secret_acl\u003dNone, user_ids\u003dNone,"},{"line_number":1688,"context_line":"                               session\u003dNone):"},{"line_number":1689,"context_line":"        session \u003d self.get_session(session)"},{"line_number":1690,"context_line":"        secret.updated_at \u003d timeutils.utcnow()"},{"line_number":1691,"context_line":"        secret.secret_acls.append(secret_acl)"},{"line_number":1692,"context_line":"        secret.save(session\u003dsession)"}],"source_content_type":"text/x-python","patch_set":3,"id":"baa041b7_07a095f3","line":1689,"in_reply_to":"da9b358b_d230c003","updated":"2015-04-01 16:49:08.000000000","message":"It should not be None when reaching at this point. I declared secret_acl just as keyword argument to make it easier to use in function call. I can make it positional argument if its confusing.","commit_id":"34c1f03135d29233913f7d212fd812880a2721f4"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"97fc4ee5259b7d535d4da9a2d6190c72f213f7b8","unresolved":false,"context_lines":[{"line_number":1688,"context_line":"                               session\u003dNone):"},{"line_number":1689,"context_line":"        session \u003d self.get_session(session)"},{"line_number":1690,"context_line":"        secret.updated_at \u003d timeutils.utcnow()"},{"line_number":1691,"context_line":"        secret.secret_acls.append(secret_acl)"},{"line_number":1692,"context_line":"        secret.save(session\u003dsession)"},{"line_number":1693,"context_line":""},{"line_number":1694,"context_line":"        self._create_or_replace_acl_users(secret_acl, user_ids,"}],"source_content_type":"text/x-python","patch_set":3,"id":"da9b358b_120e283b","line":1691,"updated":"2015-04-01 03:53:06.000000000","message":"At what point(s) do we validate that we do not have duplicate acls?  it seems like we should have unique secret,id/operation combinations.","commit_id":"34c1f03135d29233913f7d212fd812880a2721f4"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"ba7ed0f66ad15bd352a8adaaad0e2f6d55815a16","unresolved":false,"context_lines":[{"line_number":1688,"context_line":"                               session\u003dNone):"},{"line_number":1689,"context_line":"        session \u003d self.get_session(session)"},{"line_number":1690,"context_line":"        secret.updated_at \u003d timeutils.utcnow()"},{"line_number":1691,"context_line":"        secret.secret_acls.append(secret_acl)"},{"line_number":1692,"context_line":"        secret.save(session\u003dsession)"},{"line_number":1693,"context_line":""},{"line_number":1694,"context_line":"        self._create_or_replace_acl_users(secret_acl, user_ids,"}],"source_content_type":"text/x-python","patch_set":3,"id":"baa041b7_e8b0ce8d","line":1691,"in_reply_to":"baa041b7_e798116d","updated":"2015-04-02 05:24:04.000000000","message":"Will add unique constraint on (secret_id, operation) and (container_id, operation). \n\nWill add unique contsraint in respective user tables for (acl_id, user_id).","commit_id":"34c1f03135d29233913f7d212fd812880a2721f4"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"2e27bf8ed5e399a466dfa5d3c41e2fad99d4434e","unresolved":false,"context_lines":[{"line_number":1688,"context_line":"                               session\u003dNone):"},{"line_number":1689,"context_line":"        session \u003d self.get_session(session)"},{"line_number":1690,"context_line":"        secret.updated_at \u003d timeutils.utcnow()"},{"line_number":1691,"context_line":"        secret.secret_acls.append(secret_acl)"},{"line_number":1692,"context_line":"        secret.save(session\u003dsession)"},{"line_number":1693,"context_line":""},{"line_number":1694,"context_line":"        self._create_or_replace_acl_users(secret_acl, user_ids,"}],"source_content_type":"text/x-python","patch_set":3,"id":"baa041b7_e798116d","line":1691,"in_reply_to":"da9b358b_120e283b","updated":"2015-04-01 16:49:08.000000000","message":"Validations are done in controller layer which are in part 3.\n\nThe reason I did not have unique index is because of soft deletes behavior\n\nCurrently in barbican, deletes are performed as soft deletes which means those records still persist in database with delete timestamp and deleted flag as true. Soft deletes are there to maintain historical status of records which in this case may have some value to track when specific user was removed from ACL. That\u0027s why, we cannot define unique index for acl_id and user_id combination which is alright as application makes update instead of insert whenever there is active combination of acl_id and operation already exists.","commit_id":"34c1f03135d29233913f7d212fd812880a2721f4"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"97fc4ee5259b7d535d4da9a2d6190c72f213f7b8","unresolved":false,"context_lines":[{"line_number":1709,"context_line":"        \"\"\""},{"line_number":1710,"context_line":"        if user_ids is None:"},{"line_number":1711,"context_line":"            return"},{"line_number":1712,"context_line":""},{"line_number":1713,"context_line":"        user_ids \u003d set(user_ids)"},{"line_number":1714,"context_line":""},{"line_number":1715,"context_line":"        now \u003d timeutils.utcnow()"}],"source_content_type":"text/x-python","patch_set":3,"id":"da9b358b_52b71086","line":1712,"updated":"2015-04-01 03:53:06.000000000","message":"So, if one wanted to modify the list of users to contain no users, one would pass in [] ?\n\nWhen would user_ids be None ?","commit_id":"34c1f03135d29233913f7d212fd812880a2721f4"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"2e27bf8ed5e399a466dfa5d3c41e2fad99d4434e","unresolved":false,"context_lines":[{"line_number":1709,"context_line":"        \"\"\""},{"line_number":1710,"context_line":"        if user_ids is None:"},{"line_number":1711,"context_line":"            return"},{"line_number":1712,"context_line":""},{"line_number":1713,"context_line":"        user_ids \u003d set(user_ids)"},{"line_number":1714,"context_line":""},{"line_number":1715,"context_line":"        now \u003d timeutils.utcnow()"}],"source_content_type":"text/x-python","patch_set":3,"id":"baa041b7_e73a51e7","line":1712,"in_reply_to":"da9b358b_52b71086","updated":"2015-04-01 16:49:08.000000000","message":"User_ids can be None when acl data ONLY has creator_only data e.g.\n\n\n        {\n          \"read\":{            \n            \"creator-only\": true\n          }\n        }","commit_id":"34c1f03135d29233913f7d212fd812880a2721f4"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"97fc4ee5259b7d535d4da9a2d6190c72f213f7b8","unresolved":false,"context_lines":[{"line_number":1719,"context_line":"        for acl_user in secret_acl.acl_users:"},{"line_number":1720,"context_line":"            if acl_user.user_id in user_ids:  # input user_id already exists"},{"line_number":1721,"context_line":"                acl_user.updated_at \u003d now"},{"line_number":1722,"context_line":"                user_ids.remove(acl_user.user_id)"},{"line_number":1723,"context_line":"            else:"},{"line_number":1724,"context_line":"                acl_user.delete(session)"},{"line_number":1725,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"da9b358b_d2820094","line":1722,"updated":"2015-04-01 03:53:06.000000000","message":"Unless I\u0027m reading this incorrectly, you seem to be modifying the user_list that is passed in.  Usually, if one wants to make modifications to an input, one makes a copy to avoid side effects.","commit_id":"34c1f03135d29233913f7d212fd812880a2721f4"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"2e27bf8ed5e399a466dfa5d3c41e2fad99d4434e","unresolved":false,"context_lines":[{"line_number":1719,"context_line":"        for acl_user in secret_acl.acl_users:"},{"line_number":1720,"context_line":"            if acl_user.user_id in user_ids:  # input user_id already exists"},{"line_number":1721,"context_line":"                acl_user.updated_at \u003d now"},{"line_number":1722,"context_line":"                user_ids.remove(acl_user.user_id)"},{"line_number":1723,"context_line":"            else:"},{"line_number":1724,"context_line":"                acl_user.delete(session)"},{"line_number":1725,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"baa041b7_aaaf70e2","line":1722,"in_reply_to":"da9b358b_d2820094","updated":"2015-04-01 16:49:08.000000000","message":"Does line # 1713 in this file addresses the concern as it makes a copy which only has unique ids.","commit_id":"34c1f03135d29233913f7d212fd812880a2721f4"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"4db1340b23ed9bbfb49ec99243d5a7976e318918","unresolved":false,"context_lines":[{"line_number":1743,"context_line":"            entity.delete(session\u003dsession)"},{"line_number":1744,"context_line":""},{"line_number":1745,"context_line":""},{"line_number":1746,"context_line":"class ContainerAclRepo(BaseRepo):"},{"line_number":1747,"context_line":"    \"\"\"Repository for the ContainerACL entity."},{"line_number":1748,"context_line":""},{"line_number":1749,"context_line":"    There is no need for ContainerACLUserRepo as none of logic access"}],"source_content_type":"text/x-python","patch_set":3,"id":"da9b358b_6fb23996","line":1746,"updated":"2015-03-31 18:57:50.000000000","message":"Same as above.","commit_id":"34c1f03135d29233913f7d212fd812880a2721f4"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"5d4cf3caf15120244f71fe59868b6b699849f2b5","unresolved":false,"context_lines":[{"line_number":1743,"context_line":"            entity.delete(session\u003dsession)"},{"line_number":1744,"context_line":""},{"line_number":1745,"context_line":""},{"line_number":1746,"context_line":"class ContainerAclRepo(BaseRepo):"},{"line_number":1747,"context_line":"    \"\"\"Repository for the ContainerACL entity."},{"line_number":1748,"context_line":""},{"line_number":1749,"context_line":"    There is no need for ContainerACLUserRepo as none of logic access"}],"source_content_type":"text/x-python","patch_set":3,"id":"da9b358b_6ac6a79b","line":1746,"in_reply_to":"da9b358b_6fb23996","updated":"2015-03-31 19:09:35.000000000","message":"Okay. Will address in next patch.","commit_id":"34c1f03135d29233913f7d212fd812880a2721f4"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"97fc4ee5259b7d535d4da9a2d6190c72f213f7b8","unresolved":false,"context_lines":[{"line_number":1744,"context_line":""},{"line_number":1745,"context_line":""},{"line_number":1746,"context_line":"class ContainerAclRepo(BaseRepo):"},{"line_number":1747,"context_line":"    \"\"\"Repository for the ContainerACL entity."},{"line_number":1748,"context_line":""},{"line_number":1749,"context_line":"    There is no need for ContainerACLUserRepo as none of logic access"},{"line_number":1750,"context_line":"    ContainerACLUser (ACL user data) directly. Its always derived from"}],"source_content_type":"text/x-python","patch_set":3,"id":"da9b358b_bd198d7b","line":1747,"updated":"2015-04-01 03:53:06.000000000","message":"Same questions/comments as above.","commit_id":"34c1f03135d29233913f7d212fd812880a2721f4"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"124b368da91ab23f3556a9cd8fa3d4b666c9ab73","unresolved":false,"context_lines":[{"line_number":1733,"context_line":"        \"\"\""},{"line_number":1734,"context_line":"        if user_ids is None:"},{"line_number":1735,"context_line":"            return"},{"line_number":1736,"context_line":""},{"line_number":1737,"context_line":"        user_ids \u003d set(user_ids)"},{"line_number":1738,"context_line":""},{"line_number":1739,"context_line":"        now \u003d timeutils.utcnow()"}],"source_content_type":"text/x-python","patch_set":4,"id":"baa041b7_c8773801","line":1736,"updated":"2015-04-02 14:28:30.000000000","message":"Lets say I have an ACL which contains users and creator_only.\nI now want to modify this ACL to only have creator_only (and no users).  How would I do it?\n\nWould I submit a PATCH with a user_ids of [] ? Will that result in [] being submitted as user_ids here?  Would that result in all existing user_ids being removed?\n\nI\u0027d like to see a unit test for this specific case.\n\nOr would I need to remove the ACL entirely first, and then re-add it without a user-list?","commit_id":"315daccb485128eea3bcd0a87a3bd33f85baeeb2"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"712e5b9659327c12f79745370ec483650cbf0b94","unresolved":false,"context_lines":[{"line_number":1733,"context_line":"        \"\"\""},{"line_number":1734,"context_line":"        if user_ids is None:"},{"line_number":1735,"context_line":"            return"},{"line_number":1736,"context_line":""},{"line_number":1737,"context_line":"        user_ids \u003d set(user_ids)"},{"line_number":1738,"context_line":""},{"line_number":1739,"context_line":"        now \u003d timeutils.utcnow()"}],"source_content_type":"text/x-python","patch_set":4,"id":"baa041b7_e29b34c8","line":1736,"in_reply_to":"baa041b7_c8773801","updated":"2015-04-02 16:01:02.000000000","message":"Yes to delete all existing users for ACL operation, users need to be empty list []. If none or not provided, then user data is left untouched. \nJust to clarify, if list of users is provided, then its taken as whole list of users for that ACL.\n\nThere is a test in part 3 (secret acl controller logic) around this.\n\nhttps://review.openstack.org/#/c/164335/14/barbican/tests/api/controllers/test_acls.py,cm (Line # 516 onwards)\n\nUser list change to empty list is done in Line # 532 and asserted in Line# 542.\n\nDoes this cover the case you are thinking of?\n\n\nBtw, similar test is there for Container ACL as well. https://review.openstack.org/#/c/165205/10/barbican/tests/api/controllers/test_acls.py,cm (Line 1119 onwards)","commit_id":"315daccb485128eea3bcd0a87a3bd33f85baeeb2"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"642238c0f0d29ccef2f487ae9efbaad37a400230","unresolved":false,"context_lines":[{"line_number":1733,"context_line":"        \"\"\""},{"line_number":1734,"context_line":"        if user_ids is None:"},{"line_number":1735,"context_line":"            return"},{"line_number":1736,"context_line":""},{"line_number":1737,"context_line":"        user_ids \u003d set(user_ids)"},{"line_number":1738,"context_line":""},{"line_number":1739,"context_line":"        now \u003d timeutils.utcnow()"}],"source_content_type":"text/x-python","patch_set":4,"id":"baa041b7_029df864","line":1736,"in_reply_to":"baa041b7_e29b34c8","updated":"2015-04-02 16:04:18.000000000","message":"great - works for me.","commit_id":"315daccb485128eea3bcd0a87a3bd33f85baeeb2"}]}