)]}'
{"ceilometer/api/controllers/v2.py":[{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"9d8756255253ec1da1e439e163a638e5507c62a7","unresolved":false,"context_lines":[{"line_number":299,"context_line":"    # the creating tenant differs from the tenant on whose behalf the"},{"line_number":300,"context_line":"    # alarm is being created"},{"line_number":301,"context_line":"    auth_project \u003d pecan.request.headers.get(\u0027X-RBAC-Project-Id\u0027, None)"},{"line_number":302,"context_line":"    created_by \u003d pecan.request.headers.get(\u0027X-RBAC-Project-Id\u0027, None)"},{"line_number":303,"context_line":"    is_admin \u003d auth_project is None"},{"line_number":304,"context_line":""},{"line_number":305,"context_line":"    if is_admin and on_behalf_of !\u003d created_by:"}],"source_content_type":"text/x-python","patch_set":2,"id":"1abeadc6_fe9d3ebd","line":302,"updated":"2014-08-20 23:43:41.000000000","message":"This is wrong.\nThis should be as the original code:\ncreated_by \u003d pecan.request.headers.get(\u0027X-Project-Id\u0027)","commit_id":"d5131eb144820a2223619bdf966992ea3409a0bf"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"9d8756255253ec1da1e439e163a638e5507c62a7","unresolved":false,"context_lines":[{"line_number":856,"context_line":"        now \u003d timeutils.utcnow()"},{"line_number":857,"context_line":"        auth_project \u003d pecan.request.headers.get(\u0027X-RBAC-Project-Id\u0027, None)"},{"line_number":858,"context_line":"        def_source \u003d pecan.request.cfg.sample_source"},{"line_number":859,"context_line":"        def_project_id \u003d pecan.request.headers.get(\u0027X-RBAC-Project-Id\u0027, None)"},{"line_number":860,"context_line":"        def_user_id \u003d pecan.request.headers.get(\u0027X-RBAC-User-Id\u0027, None)"},{"line_number":861,"context_line":""},{"line_number":862,"context_line":"        published_samples \u003d []"}],"source_content_type":"text/x-python","patch_set":2,"id":"1abeadc6_9e952a89","line":859,"updated":"2014-08-20 23:43:41.000000000","message":"Wrong. Please reverse to the original values","commit_id":"d5131eb144820a2223619bdf966992ea3409a0bf"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"9d8756255253ec1da1e439e163a638e5507c62a7","unresolved":false,"context_lines":[{"line_number":857,"context_line":"        auth_project \u003d pecan.request.headers.get(\u0027X-RBAC-Project-Id\u0027, None)"},{"line_number":858,"context_line":"        def_source \u003d pecan.request.cfg.sample_source"},{"line_number":859,"context_line":"        def_project_id \u003d pecan.request.headers.get(\u0027X-RBAC-Project-Id\u0027, None)"},{"line_number":860,"context_line":"        def_user_id \u003d pecan.request.headers.get(\u0027X-RBAC-User-Id\u0027, None)"},{"line_number":861,"context_line":""},{"line_number":862,"context_line":"        published_samples \u003d []"},{"line_number":863,"context_line":"        for s in samples:"}],"source_content_type":"text/x-python","patch_set":2,"id":"1abeadc6_be8e6677","line":860,"updated":"2014-08-20 23:43:41.000000000","message":"Same as above","commit_id":"d5131eb144820a2223619bdf966992ea3409a0bf"},{"author":{"_account_id":6537,"name":"gordon chung","email":"gord@live.ca","username":"chungg"},"change_message_id":"c4e3a9aa40a02df0f32ff9a5a82a71eeab07d58e","unresolved":false,"context_lines":[{"line_number":908,"context_line":"        :param samples: a list of samples within the request body."},{"line_number":909,"context_line":"        \"\"\""},{"line_number":910,"context_line":"        now \u003d timeutils.utcnow()"},{"line_number":911,"context_line":"        auth_project \u003d pecan.request.headers.get(\u0027X-RBAC-Project-Id\u0027, None)"},{"line_number":912,"context_line":"        def_source \u003d pecan.request.cfg.sample_source"},{"line_number":913,"context_line":"        def_project_id \u003d pecan.request.headers.get(\u0027X-Project-Id\u0027, None)"},{"line_number":914,"context_line":"        def_user_id \u003d pecan.request.headers.get(\u0027X-User-Id\u0027, None)"}],"source_content_type":"text/x-python","patch_set":8,"id":"9aa7fdbe_4750db31","line":911,"updated":"2014-10-28 19:51:16.000000000","message":"None is already the default for get()","commit_id":"eb5d5a21f6e9921fb05c48b6cbc561f61c7710d6"},{"author":{"_account_id":7729,"name":"Ilya Tyaptin","email":"ityaptin@mirantis.com","username":"ityaptin"},"change_message_id":"4c81edf97393c269b2bd5d2f37992a461b2a0de8","unresolved":false,"context_lines":[{"line_number":910,"context_line":"        now \u003d timeutils.utcnow()"},{"line_number":911,"context_line":"        auth_project \u003d pecan.request.headers.get(\u0027X-RBAC-Project-Id\u0027, None)"},{"line_number":912,"context_line":"        def_source \u003d pecan.request.cfg.sample_source"},{"line_number":913,"context_line":"        def_project_id \u003d pecan.request.headers.get(\u0027X-Project-Id\u0027, None)"},{"line_number":914,"context_line":"        def_user_id \u003d pecan.request.headers.get(\u0027X-User-Id\u0027, None)"},{"line_number":915,"context_line":""},{"line_number":916,"context_line":"        published_samples \u003d []"}],"source_content_type":"text/x-python","patch_set":8,"id":"7a8c0949_5f1251b5","line":913,"updated":"2014-10-30 13:43:44.000000000","message":"As Gordon said above - None is the default value for get.","commit_id":"eb5d5a21f6e9921fb05c48b6cbc561f61c7710d6"},{"author":{"_account_id":7729,"name":"Ilya Tyaptin","email":"ityaptin@mirantis.com","username":"ityaptin"},"change_message_id":"4c81edf97393c269b2bd5d2f37992a461b2a0de8","unresolved":false,"context_lines":[{"line_number":911,"context_line":"        auth_project \u003d pecan.request.headers.get(\u0027X-RBAC-Project-Id\u0027, None)"},{"line_number":912,"context_line":"        def_source \u003d pecan.request.cfg.sample_source"},{"line_number":913,"context_line":"        def_project_id \u003d pecan.request.headers.get(\u0027X-Project-Id\u0027, None)"},{"line_number":914,"context_line":"        def_user_id \u003d pecan.request.headers.get(\u0027X-User-Id\u0027, None)"},{"line_number":915,"context_line":""},{"line_number":916,"context_line":"        published_samples \u003d []"},{"line_number":917,"context_line":"        for s in samples:"}],"source_content_type":"text/x-python","patch_set":8,"id":"7a8c0949_ff221d00","line":914,"updated":"2014-10-30 13:43:44.000000000","message":"ditto","commit_id":"eb5d5a21f6e9921fb05c48b6cbc561f61c7710d6"},{"author":{"_account_id":7729,"name":"Ilya Tyaptin","email":"ityaptin@mirantis.com","username":"ityaptin"},"change_message_id":"4c81edf97393c269b2bd5d2f37992a461b2a0de8","unresolved":false,"context_lines":[{"line_number":1410,"context_line":"        If the tenant is not admin insert an extra"},{"line_number":1411,"context_line":"        \"and \u003cvisibility_field\u003e\u003d\u003ctenant\u0027s project_id\u003e\" clause to the query."},{"line_number":1412,"context_line":"        \"\"\""},{"line_number":1413,"context_line":"        authorized_project \u003d pecan.request.headers.get(\u0027X-RBAC-Project-Id\u0027,"},{"line_number":1414,"context_line":"                                                       None)"},{"line_number":1415,"context_line":"        is_admin \u003d authorized_project is None"},{"line_number":1416,"context_line":"        if not is_admin:"}],"source_content_type":"text/x-python","patch_set":8,"id":"7a8c0949_9f83d9cb","line":1413,"updated":"2014-10-30 13:43:44.000000000","message":"ditto","commit_id":"eb5d5a21f6e9921fb05c48b6cbc561f61c7710d6"},{"author":{"_account_id":7729,"name":"Ilya Tyaptin","email":"ityaptin@mirantis.com","username":"ityaptin"},"change_message_id":"4c81edf97393c269b2bd5d2f37992a461b2a0de8","unresolved":false,"context_lines":[{"line_number":1980,"context_line":""},{"line_number":1981,"context_line":"    def _alarm(self):"},{"line_number":1982,"context_line":"        self.conn \u003d pecan.request.alarm_storage_conn"},{"line_number":1983,"context_line":"        auth_project \u003d pecan.request.headers.get(\u0027X-RBAC-Project-Id\u0027, None)"},{"line_number":1984,"context_line":"        alarms \u003d list(self.conn.get_alarms(alarm_id\u003dself._id,"},{"line_number":1985,"context_line":"                                           project\u003dauth_project))"},{"line_number":1986,"context_line":"        if not alarms:"}],"source_content_type":"text/x-python","patch_set":8,"id":"7a8c0949_bf8895e8","line":1983,"updated":"2014-10-30 13:43:44.000000000","message":"ditto","commit_id":"eb5d5a21f6e9921fb05c48b6cbc561f61c7710d6"},{"author":{"_account_id":7729,"name":"Ilya Tyaptin","email":"ityaptin@mirantis.com","username":"ityaptin"},"change_message_id":"4c81edf97393c269b2bd5d2f37992a461b2a0de8","unresolved":false,"context_lines":[{"line_number":1994,"context_line":"        scrubbed_data \u003d utils.stringify_timestamps(data)"},{"line_number":1995,"context_line":"        detail \u003d json.dumps(scrubbed_data)"},{"line_number":1996,"context_line":"        user_id \u003d pecan.request.headers.get(\u0027X-RBAC-User-Id\u0027, None)"},{"line_number":1997,"context_line":"        project_id \u003d pecan.request.headers.get(\u0027X-RBAC-Project-Id\u0027, None)"},{"line_number":1998,"context_line":"        on_behalf_of \u003d on_behalf_of or project_id"},{"line_number":1999,"context_line":"        payload \u003d dict(event_id\u003dstr(uuid.uuid4()),"},{"line_number":2000,"context_line":"                       alarm_id\u003dself._id,"}],"source_content_type":"text/x-python","patch_set":8,"id":"7a8c0949_ff693d26","line":1997,"updated":"2014-10-30 13:43:44.000000000","message":"ditto","commit_id":"eb5d5a21f6e9921fb05c48b6cbc561f61c7710d6"},{"author":{"_account_id":7729,"name":"Ilya Tyaptin","email":"ityaptin@mirantis.com","username":"ityaptin"},"change_message_id":"4c81edf97393c269b2bd5d2f37992a461b2a0de8","unresolved":false,"context_lines":[{"line_number":2034,"context_line":""},{"line_number":2035,"context_line":"        data.alarm_id \u003d self._id"},{"line_number":2036,"context_line":"        project \u003d pecan.request.headers.get(\u0027X-RBAC-Project-Id\u0027, None)"},{"line_number":2037,"context_line":"        user \u003d pecan.request.headers.get(\u0027X-RBAC-User-Id\u0027, None)"},{"line_number":2038,"context_line":"        if user:"},{"line_number":2039,"context_line":"            data.user_id \u003d user"},{"line_number":2040,"context_line":"        elif data.user_id \u003d\u003d wtypes.Unset:"}],"source_content_type":"text/x-python","patch_set":8,"id":"7a8c0949_1f77e903","line":2037,"updated":"2014-10-30 13:43:44.000000000","message":"ditto","commit_id":"eb5d5a21f6e9921fb05c48b6cbc561f61c7710d6"},{"author":{"_account_id":7729,"name":"Ilya Tyaptin","email":"ityaptin@mirantis.com","username":"ityaptin"},"change_message_id":"4c81edf97393c269b2bd5d2f37992a461b2a0de8","unresolved":false,"context_lines":[{"line_number":2158,"context_line":"        scrubbed_data \u003d utils.stringify_timestamps(data)"},{"line_number":2159,"context_line":"        detail \u003d json.dumps(scrubbed_data)"},{"line_number":2160,"context_line":"        user_id \u003d pecan.request.headers.get(\u0027X-User-Id\u0027, None)"},{"line_number":2161,"context_line":"        project_id \u003d pecan.request.headers.get(\u0027X-Project-Id\u0027, None)"},{"line_number":2162,"context_line":"        payload \u003d dict(event_id\u003dstr(uuid.uuid4()),"},{"line_number":2163,"context_line":"                       alarm_id\u003dalarm_id,"},{"line_number":2164,"context_line":"                       type\u003dtype,"}],"source_content_type":"text/x-python","patch_set":8,"id":"7a8c0949_3f74a5fc","line":2161,"updated":"2014-10-30 13:43:44.000000000","message":"ditto","commit_id":"eb5d5a21f6e9921fb05c48b6cbc561f61c7710d6"},{"author":{"_account_id":7729,"name":"Ilya Tyaptin","email":"ityaptin@mirantis.com","username":"ityaptin"},"change_message_id":"4c81edf97393c269b2bd5d2f37992a461b2a0de8","unresolved":false,"context_lines":[{"line_number":2189,"context_line":""},{"line_number":2190,"context_line":"        data.alarm_id \u003d str(uuid.uuid4())"},{"line_number":2191,"context_line":"        user_limit \u003d pecan.request.headers.get(\u0027X-RBAC-User-Id\u0027, None)"},{"line_number":2192,"context_line":"        project_limit \u003d pecan.request.headers.get(\u0027X-RBAC-Project-Id\u0027, None)"},{"line_number":2193,"context_line":""},{"line_number":2194,"context_line":"        def _set_ownership(aspect, owner_limitation, header):"},{"line_number":2195,"context_line":"            attr \u003d \u0027%s_id\u0027 % aspect"}],"source_content_type":"text/x-python","patch_set":8,"id":"7a8c0949_9f5af981","line":2192,"updated":"2014-10-30 13:43:44.000000000","message":"ditto","commit_id":"eb5d5a21f6e9921fb05c48b6cbc561f61c7710d6"},{"author":{"_account_id":2284,"name":"Eoghan Glynn","email":"eglynn@redhat.com","username":"eglynn"},"change_message_id":"f19e75c20598540831d5272fa8e9d0c45554fafb","unresolved":false,"context_lines":[{"line_number":889,"context_line":"        :param limit: Maximum number of samples to return."},{"line_number":890,"context_line":"        \"\"\""},{"line_number":891,"context_line":""},{"line_number":892,"context_line":"        rbac.enforce(\u0027get_samples\u0027, pecan.request)"},{"line_number":893,"context_line":""},{"line_number":894,"context_line":"        q \u003d q or []"},{"line_number":895,"context_line":"        if limit and limit \u003c 0:"}],"source_content_type":"text/x-python","patch_set":13,"id":"5a890539_695c131a","line":892,"updated":"2014-11-24 19:43:05.000000000","message":"Would these explicit calls to enfroce be neater and less intrusive if implemented via a decorator, e.g.\n\n   @wsme_pecan.wsexpose([OldSample], [Query], int)\n   @rbac.check_policy(\u0027get_samples\u0027)\n   def get_all(self, q\u003dNone, limit\u003dNone):","commit_id":"fde42a19db337b124b99860757436e31e8bcedc7"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"0b32be1aeb91062f40302b870f892b59f503b1e0","unresolved":false,"context_lines":[{"line_number":889,"context_line":"        :param limit: Maximum number of samples to return."},{"line_number":890,"context_line":"        \"\"\""},{"line_number":891,"context_line":""},{"line_number":892,"context_line":"        rbac.enforce(\u0027get_samples\u0027, pecan.request)"},{"line_number":893,"context_line":""},{"line_number":894,"context_line":"        q \u003d q or []"},{"line_number":895,"context_line":"        if limit and limit \u003c 0:"}],"source_content_type":"text/x-python","patch_set":13,"id":"5a890539_42f0e490","line":892,"in_reply_to":"5a890539_695c131a","updated":"2014-11-25 21:17:35.000000000","message":"Well, I tied, but it does not work. The issue as far as I know is linked to the fact that pecan.request is not fully bound until you get inside the method. So I get an exception at runtime that the request object does not have the headers or environment because is not linked to the wsgi app itself yet. The only decorator I could use are the pecan.secure one but these do not allow any parameter to be passed and hence you need to build the policy name from URI which is UGLY ...","commit_id":"fde42a19db337b124b99860757436e31e8bcedc7"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"da867dbe964fdbb7027537b87ff25cb86a2a6b5a","unresolved":false,"context_lines":[{"line_number":338,"context_line":"            status_code\u003d401)"},{"line_number":339,"context_line":""},{"line_number":340,"context_line":""},{"line_number":341,"context_line":"def _get_auth_project(on_behalf_of\u003dNone):"},{"line_number":342,"context_line":"    # when an alarm is created by an admin on behalf of another tenant"},{"line_number":343,"context_line":"    # we must ensure for:"},{"line_number":344,"context_line":"    # - threshold alarm, that an implicit query constraint on project_id is"}],"source_content_type":"text/x-python","patch_set":14,"id":"5a890539_01b4fa33","line":341,"updated":"2014-11-26 17:39:40.000000000","message":"This method is a poorly-named hack with an out-of-date comment that facilitates bypassing what should now be configured in policy.json... It needs to go away, replaced with restrictions defined (and configurable) in the policy.json.","commit_id":"3a989bcc9c1c6081b0f4f2593fe38ff91efa1628"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"da867dbe964fdbb7027537b87ff25cb86a2a6b5a","unresolved":false,"context_lines":[{"line_number":357,"context_line":"    return auth_project"},{"line_number":358,"context_line":""},{"line_number":359,"context_line":""},{"line_number":360,"context_line":"def _sanitize_query(query, db_func, on_behalf_of\u003dNone):"},{"line_number":361,"context_line":"    \"\"\"Check the query."},{"line_number":362,"context_line":""},{"line_number":363,"context_line":"    See if:"}],"source_content_type":"text/x-python","patch_set":14,"id":"5a890539_c1d7524e","line":360,"updated":"2014-11-26 17:39:40.000000000","message":"Everything tied to a project should only be accessible with a token scoped to that project. Being an admin in one project should not give you any visibility, much less control, of another project. If there is something that needs to be common and accessible across projects, then don\u0027t tie it to a project.","commit_id":"3a989bcc9c1c6081b0f4f2593fe38ff91efa1628"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"da867dbe964fdbb7027537b87ff25cb86a2a6b5a","unresolved":false,"context_lines":[{"line_number":381,"context_line":"    return q"},{"line_number":382,"context_line":""},{"line_number":383,"context_line":""},{"line_number":384,"context_line":"def _verify_query_segregation(query, auth_project\u003dNone):"},{"line_number":385,"context_line":"    \"\"\"Ensure non-admin queries are not constrained to another project.\"\"\""},{"line_number":386,"context_line":"    auth_project \u003d (auth_project or"},{"line_number":387,"context_line":"                    rbac.get_limited_to_project(pecan.request.headers))"}],"source_content_type":"text/x-python","patch_set":14,"id":"5a890539_61ae9e83","line":384,"updated":"2014-11-26 17:39:40.000000000","message":"Similar to comments above, this method needs to be removed/reworked.","commit_id":"3a989bcc9c1c6081b0f4f2593fe38ff91efa1628"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"da867dbe964fdbb7027537b87ff25cb86a2a6b5a","unresolved":false,"context_lines":[{"line_number":2382,"context_line":"        )"},{"line_number":2383,"context_line":""},{"line_number":2384,"context_line":""},{"line_number":2385,"context_line":"# TODO(fabiog): this decorator should disappear and have a more unified"},{"line_number":2386,"context_line":"# way of controlling access and scope. Before messing with this, though"},{"line_number":2387,"context_line":"# I feel this file should be re-factored in smaller chunks one for each"},{"line_number":2388,"context_line":"# controller (e.g. meters, alarms and so on ...). Right now its size is"}],"source_content_type":"text/x-python","patch_set":14,"id":"5a890539_e1efeeaf","line":2385,"updated":"2014-11-26 17:39:40.000000000","message":"It needs to disappear as part of this change. Once we move to using policy.json, that policy.json needs to be the controlling factor, not hard-coded usage of this decorator.","commit_id":"3a989bcc9c1c6081b0f4f2593fe38ff91efa1628"},{"author":{"_account_id":2284,"name":"Eoghan Glynn","email":"eglynn@redhat.com","username":"eglynn"},"change_message_id":"db5bd32c001e5178748f38a79651ba53e616791f","unresolved":false,"context_lines":[{"line_number":899,"context_line":"        :param limit: Maximum number of samples to return."},{"line_number":900,"context_line":"        \"\"\""},{"line_number":901,"context_line":""},{"line_number":902,"context_line":"        rbac.enforce(\u0027get_samples\u0027, pecan.request)"},{"line_number":903,"context_line":""},{"line_number":904,"context_line":"        q \u003d q or []"},{"line_number":905,"context_line":"        if limit and limit \u003c 0:"}],"source_content_type":"text/x-python","patch_set":15,"id":"3a961159_89b23c92","line":902,"updated":"2014-12-11 14:57:03.000000000","message":"The RBAC support has recently begun to land in gnocchi, I wonder could we settle on a consistent naming style for the rules in both cases?\n\ni.e. in gnocchi, space- rather than underscore-separated rule names are used, e.g. s/get_samples/get samples/.","commit_id":"e9d8b6df63772086db77e95ab20d99949fea5623"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"7fc7f8023fca30dc970e6d953f57b459705ff284","unresolved":false,"context_lines":[{"line_number":899,"context_line":"        :param limit: Maximum number of samples to return."},{"line_number":900,"context_line":"        \"\"\""},{"line_number":901,"context_line":""},{"line_number":902,"context_line":"        rbac.enforce(\u0027get_samples\u0027, pecan.request)"},{"line_number":903,"context_line":""},{"line_number":904,"context_line":"        q \u003d q or []"},{"line_number":905,"context_line":"        if limit and limit \u003c 0:"}],"source_content_type":"text/x-python","patch_set":15,"id":"3a961159_e47cc5b7","line":902,"in_reply_to":"3a961159_89b23c92","updated":"2014-12-11 15:14:02.000000000","message":"Eoghan, I followed Keystone lead here:\nhttps://github.com/openstack/keystone/blob/master/etc/policy.v3cloudsample.json\nSame in Nova:\nhttps://github.com/openstack/nova/blob/master/etc/nova/policy.json","commit_id":"e9d8b6df63772086db77e95ab20d99949fea5623"}],"ceilometer/api/rbac.py":[{"author":{"_account_id":10987,"name":"Igor Degtiarov","username":"tovstun","inactive":true},"change_message_id":"0f0a3e06335483d5abe24eea2dcb7e0a21531793","unresolved":false,"context_lines":[{"line_number":37,"context_line":""},{"line_number":38,"context_line":"        prh \u003d core.state.request.headers"},{"line_number":39,"context_line":"        request_method \u003d (environ[\u0027REQUEST_METHOD\u0027]).lower()"},{"line_number":40,"context_line":"        base_method \u003d re.sub(r\u0027/v2/\u0027, r\u0027\u0027, environ[\u0027PATH_INFO\u0027])"},{"line_number":41,"context_line":"        base_method \u003d re.sub(r\u0027/.*\u0027, \"\", base_method)"},{"line_number":42,"context_line":"        rule_method \u003d \"telemetry:\" + request_method + \"_\" + base_method"},{"line_number":43,"context_line":""}],"source_content_type":"text/x-python","patch_set":8,"id":"7a8c0949_5ed90521","line":40,"updated":"2014-11-07 13:53:33.000000000","message":"It is seems that it will be enough s/r\u0027\u0027/\u0027\u0027 amiright?","commit_id":"eb5d5a21f6e9921fb05c48b6cbc561f61c7710d6"},{"author":{"_account_id":10987,"name":"Igor Degtiarov","username":"tovstun","inactive":true},"change_message_id":"0f0a3e06335483d5abe24eea2dcb7e0a21531793","unresolved":false,"context_lines":[{"line_number":69,"context_line":"    @classmethod"},{"line_number":70,"context_line":"    def requires_admin(cls):"},{"line_number":71,"context_line":"        prh \u003d core.state.request.headers"},{"line_number":72,"context_line":"        if \u0027admin\u0027 in prh.get(\u0027X-Roles\u0027, \"\"):"},{"line_number":73,"context_line":"            return True"},{"line_number":74,"context_line":"        return False"}],"source_content_type":"text/x-python","patch_set":8,"id":"7a8c0949_5e4745bc","line":72,"updated":"2014-11-07 13:53:33.000000000","message":"Try to guess is it enough to check containing of word \u0027admin\u0027 in string of headers[\u0027X-Roles\u0027]? I mean probably would be better s/in/\u003d\u003d","commit_id":"eb5d5a21f6e9921fb05c48b6cbc561f61c7710d6"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"dc6d44852f28b4755640ebaaa8ce99360ce91dbf","unresolved":false,"context_lines":[{"line_number":47,"context_line":"                    prh[\u0027X-RBAC-Project-Domain-Name\u0027] \u003d penv["},{"line_number":48,"context_line":"                        \u0027HTTP_X_PROJECT_DOMAIN_NAME\u0027]"},{"line_number":49,"context_line":"                    prh[\u0027X-RBAC-User-Domain-Id\u0027] \u003d penv["},{"line_number":50,"context_line":"                        \u0027HTTP_X_USER_DOMAIN_ID\u0027]"},{"line_number":51,"context_line":"                    return True"},{"line_number":52,"context_line":"                else:"},{"line_number":53,"context_line":"                    return False"}],"source_content_type":"text/x-python","patch_set":9,"id":"5a890539_f22e198b","line":50,"updated":"2014-11-17 12:12:58.000000000","message":"Just out of curiosity, why are some headers in the headers dict and some in the environment? What\u0027s special about the two not being retrieved from prh?\n\nAnd, minor nit, I\u0027m guessing prh is shorthand for pecan request headers. I think `headers` or `request_headers` would be more readable. We don\u0027t really care at this point that it is pecan do we?","commit_id":"237a4c7d40529eac2856970a4d0062f1dfaf2a91"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"b7c89a1bb1116bd69dffc46e2342997105f6681e","unresolved":false,"context_lines":[{"line_number":47,"context_line":"                    prh[\u0027X-RBAC-Project-Domain-Name\u0027] \u003d penv["},{"line_number":48,"context_line":"                        \u0027HTTP_X_PROJECT_DOMAIN_NAME\u0027]"},{"line_number":49,"context_line":"                    prh[\u0027X-RBAC-User-Domain-Id\u0027] \u003d penv["},{"line_number":50,"context_line":"                        \u0027HTTP_X_USER_DOMAIN_ID\u0027]"},{"line_number":51,"context_line":"                    return True"},{"line_number":52,"context_line":"                else:"},{"line_number":53,"context_line":"                    return False"}],"source_content_type":"text/x-python","patch_set":9,"id":"5a890539_6d4f9134","line":50,"in_reply_to":"5a890539_f22e198b","updated":"2014-11-19 00:53:23.000000000","message":"Chris, is that the Domain related stuff are injected by the Keystone as part of the token validation and are in the environment. Sure I will change the names into headers and environment.","commit_id":"237a4c7d40529eac2856970a4d0062f1dfaf2a91"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"dc6d44852f28b4755640ebaaa8ce99360ce91dbf","unresolved":false,"context_lines":[{"line_number":64,"context_line":"    @staticmethod"},{"line_number":65,"context_line":"    def requires_admin():"},{"line_number":66,"context_line":"        prh \u003d core.state.request.headers"},{"line_number":67,"context_line":"        if \u0027admin\u0027 in prh.get(\u0027X-Roles\u0027, \"\"):"},{"line_number":68,"context_line":"            return True"},{"line_number":69,"context_line":"        return False"}],"source_content_type":"text/x-python","patch_set":9,"id":"5a890539_92b2354a","line":67,"updated":"2014-11-17 12:12:58.000000000","message":"Do you need to split on \u0027,\u0027 to turn this into a list? Other wise an X-Roles header of: \"X-Roles: cow, house, notadmin\" will match. In the removed acl.py a split is done.","commit_id":"237a4c7d40529eac2856970a4d0062f1dfaf2a91"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"b7c89a1bb1116bd69dffc46e2342997105f6681e","unresolved":false,"context_lines":[{"line_number":64,"context_line":"    @staticmethod"},{"line_number":65,"context_line":"    def requires_admin():"},{"line_number":66,"context_line":"        prh \u003d core.state.request.headers"},{"line_number":67,"context_line":"        if \u0027admin\u0027 in prh.get(\u0027X-Roles\u0027, \"\"):"},{"line_number":68,"context_line":"            return True"},{"line_number":69,"context_line":"        return False"}],"source_content_type":"text/x-python","patch_set":9,"id":"5a890539_6d66b1bc","line":67,"in_reply_to":"5a890539_92b2354a","updated":"2014-11-19 00:53:23.000000000","message":"Good catch this is a mistake ...I will fix it\nThanks.","commit_id":"237a4c7d40529eac2856970a4d0062f1dfaf2a91"},{"author":{"_account_id":10987,"name":"Igor Degtiarov","username":"tovstun","inactive":true},"change_message_id":"e639d325ebf879f4b03559510ea03d0ca477f900","unresolved":false,"context_lines":[{"line_number":64,"context_line":"    @staticmethod"},{"line_number":65,"context_line":"    def requires_admin():"},{"line_number":66,"context_line":"        prh \u003d core.state.request.headers"},{"line_number":67,"context_line":"        if \u0027admin\u0027 in prh.get(\u0027X-Roles\u0027, \"\"):"},{"line_number":68,"context_line":"            return True"},{"line_number":69,"context_line":"        return False"}],"source_content_type":"text/x-python","patch_set":9,"id":"5a890539_52836dcb","line":67,"in_reply_to":"5a890539_92b2354a","updated":"2014-11-17 12:30:36.000000000","message":"This question is very similar to mine, for patch set 8.","commit_id":"237a4c7d40529eac2856970a4d0062f1dfaf2a91"},{"author":{"_account_id":10987,"name":"Igor Degtiarov","username":"tovstun","inactive":true},"change_message_id":"e4fc56b656d956cb6a4410ea0126e73c781a35b6","unresolved":false,"context_lines":[{"line_number":32,"context_line":"    :param request: HTTP request"},{"line_number":33,"context_line":"    :param policy_name: the policy name to validate authz against."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"    \"\"\""},{"line_number":37,"context_line":"    global _ENFORCER"},{"line_number":38,"context_line":"    if not _ENFORCER:"}],"source_content_type":"text/x-python","patch_set":13,"id":"5a890539_94354a48","line":35,"updated":"2014-11-20 09:56:02.000000000","message":"odd empty line?","commit_id":"fde42a19db337b124b99860757436e31e8bcedc7"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"e826a9369f1386b9c8e3ab1cf8f9558aee568248","unresolved":false,"context_lines":[{"line_number":32,"context_line":"    :param request: HTTP request"},{"line_number":33,"context_line":"    :param policy_name: the policy name to validate authz against."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"    \"\"\""},{"line_number":37,"context_line":"    global _ENFORCER"},{"line_number":38,"context_line":"    if not _ENFORCER:"}],"source_content_type":"text/x-python","patch_set":13,"id":"5a890539_309babca","line":35,"in_reply_to":"5a890539_94354a48","updated":"2014-11-20 18:53:52.000000000","message":"Yep. It was a editing mistake ... will fix it later.","commit_id":"fde42a19db337b124b99860757436e31e8bcedc7"},{"author":{"_account_id":2284,"name":"Eoghan Glynn","email":"eglynn@redhat.com","username":"eglynn"},"change_message_id":"f19e75c20598540831d5272fa8e9d0c45554fafb","unresolved":false,"context_lines":[{"line_number":47,"context_line":"        if rule_method \u003d\u003d rule_name:"},{"line_number":48,"context_line":"            if not _ENFORCER.enforce("},{"line_number":49,"context_line":"                    rule_name,"},{"line_number":50,"context_line":"                    # TODO(fabiog): add here the project/domain context"},{"line_number":51,"context_line":"                    {},"},{"line_number":52,"context_line":"                    {\u0027roles\u0027: roles}):"},{"line_number":53,"context_line":"                pecan.core.abort(status_code\u003d401,"}],"source_content_type":"text/x-python","patch_set":13,"id":"5a890539_fe0c3b44","line":50,"updated":"2014-11-24 19:43:05.000000000","message":"Removing this TODO comment would make a downstream backport to stable/juno cleaner.","commit_id":"fde42a19db337b124b99860757436e31e8bcedc7"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"0b32be1aeb91062f40302b870f892b59f503b1e0","unresolved":false,"context_lines":[{"line_number":47,"context_line":"        if rule_method \u003d\u003d rule_name:"},{"line_number":48,"context_line":"            if not _ENFORCER.enforce("},{"line_number":49,"context_line":"                    rule_name,"},{"line_number":50,"context_line":"                    # TODO(fabiog): add here the project/domain context"},{"line_number":51,"context_line":"                    {},"},{"line_number":52,"context_line":"                    {\u0027roles\u0027: roles}):"},{"line_number":53,"context_line":"                pecan.core.abort(status_code\u003d401,"}],"source_content_type":"text/x-python","patch_set":13,"id":"5a890539_223cb82e","line":50,"in_reply_to":"5a890539_fe0c3b44","updated":"2014-11-25 21:17:35.000000000","message":"Ok, will do","commit_id":"fde42a19db337b124b99860757436e31e8bcedc7"},{"author":{"_account_id":2284,"name":"Eoghan Glynn","email":"eglynn@redhat.com","username":"eglynn"},"change_message_id":"f19e75c20598540831d5272fa8e9d0c45554fafb","unresolved":false,"context_lines":[{"line_number":50,"context_line":"                    # TODO(fabiog): add here the project/domain context"},{"line_number":51,"context_line":"                    {},"},{"line_number":52,"context_line":"                    {\u0027roles\u0027: roles}):"},{"line_number":53,"context_line":"                pecan.core.abort(status_code\u003d401,"},{"line_number":54,"context_line":"                                 detail\u003d\u0027RBAC Authorization Failed\u0027)"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":""}],"source_content_type":"text/x-python","patch_set":13,"id":"5a890539_1e5ca74a","line":53,"updated":"2014-11-24 19:43:05.000000000","message":"I think the appropriate response code here is 403 Forbidden, as opposed to 401 Unauthorized.\n\nDespite the name, 401 is IIUC more related to authentication challenges and failures than the pure authorization case - i.e. we know who you are, we\u0027re just not going to let you this thing.\n\nSee for example: http://danielirvine.com/blog/2011/07/18/understanding-403-forbidden/","commit_id":"fde42a19db337b124b99860757436e31e8bcedc7"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"0b32be1aeb91062f40302b870f892b59f503b1e0","unresolved":false,"context_lines":[{"line_number":50,"context_line":"                    # TODO(fabiog): add here the project/domain context"},{"line_number":51,"context_line":"                    {},"},{"line_number":52,"context_line":"                    {\u0027roles\u0027: roles}):"},{"line_number":53,"context_line":"                pecan.core.abort(status_code\u003d401,"},{"line_number":54,"context_line":"                                 detail\u003d\u0027RBAC Authorization Failed\u0027)"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":""}],"source_content_type":"text/x-python","patch_set":13,"id":"5a890539_62708008","line":53,"in_reply_to":"5a890539_1e5ca74a","updated":"2014-11-25 21:17:35.000000000","message":"I will change it, no problem. We are really dealing with authorization since authentication is handled by Keystone. It is a little bit of a gray area because where really the server stops and the app starts in our case ...","commit_id":"fde42a19db337b124b99860757436e31e8bcedc7"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"da867dbe964fdbb7027537b87ff25cb86a2a6b5a","unresolved":false,"context_lines":[{"line_number":26,"context_line":"_ENFORCER \u003d None"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"def enforce(policy_name, request):"},{"line_number":30,"context_line":"    \"\"\"Return the user and project the request should be limited to."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"    :param request: HTTP request"}],"source_content_type":"text/x-python","patch_set":14,"id":"5a890539_5cb26907","line":29,"updated":"2014-11-26 17:39:40.000000000","message":"Why is this such a non-standard implementation? Compare with the equivalent in nova, etc.","commit_id":"3a989bcc9c1c6081b0f4f2593fe38ff91efa1628"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"da867dbe964fdbb7027537b87ff25cb86a2a6b5a","unresolved":false,"context_lines":[{"line_number":47,"context_line":"        if rule_method \u003d\u003d rule_name:"},{"line_number":48,"context_line":"            if not _ENFORCER.enforce("},{"line_number":49,"context_line":"                    rule_name,"},{"line_number":50,"context_line":"                    {},"},{"line_number":51,"context_line":"                    {\u0027roles\u0027: roles}):"},{"line_number":52,"context_line":"                pecan.core.abort(status_code\u003d403,"},{"line_number":53,"context_line":"                                 detail\u003d\u0027RBAC Authorization Failed\u0027)"}],"source_content_type":"text/x-python","patch_set":14,"id":"5a890539_fc14f5ea","line":50,"updated":"2014-11-26 17:39:40.000000000","message":"need to specify target","commit_id":"3a989bcc9c1c6081b0f4f2593fe38ff91efa1628"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"da867dbe964fdbb7027537b87ff25cb86a2a6b5a","unresolved":false,"context_lines":[{"line_number":48,"context_line":"            if not _ENFORCER.enforce("},{"line_number":49,"context_line":"                    rule_name,"},{"line_number":50,"context_line":"                    {},"},{"line_number":51,"context_line":"                    {\u0027roles\u0027: roles}):"},{"line_number":52,"context_line":"                pecan.core.abort(status_code\u003d403,"},{"line_number":53,"context_line":"                                 detail\u003d\u0027RBAC Authorization Failed\u0027)"},{"line_number":54,"context_line":""}],"source_content_type":"text/x-python","patch_set":14,"id":"5a890539_dcee59ed","line":51,"updated":"2014-11-26 17:39:40.000000000","message":"needs to include more than just roles","commit_id":"3a989bcc9c1c6081b0f4f2593fe38ff91efa1628"},{"author":{"_account_id":2284,"name":"Eoghan Glynn","email":"eglynn@redhat.com","username":"eglynn"},"change_message_id":"25ac12f7ae588092092e2f6704e1e598ec6f471c","unresolved":false,"context_lines":[{"line_number":48,"context_line":"            if not _ENFORCER.enforce("},{"line_number":49,"context_line":"                    rule_name,"},{"line_number":50,"context_line":"                    {},"},{"line_number":51,"context_line":"                    {\u0027roles\u0027: roles}):"},{"line_number":52,"context_line":"                pecan.core.abort(status_code\u003d403,"},{"line_number":53,"context_line":"                                 detail\u003d\u0027RBAC Authorization Failed\u0027)"},{"line_number":54,"context_line":""}],"source_content_type":"text/x-python","patch_set":14,"id":"5a890539_2be7dead","line":51,"in_reply_to":"5a890539_dcee59ed","updated":"2014-11-28 15:28:39.000000000","message":"Agreed, we\u0027ll need a more explicit target to enable the richer policy rules as envisaged by the docstring in:\n\n  https://review.openstack.org/#/c/137476/2/openstack/common/policy.py","commit_id":"3a989bcc9c1c6081b0f4f2593fe38ff91efa1628"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"da867dbe964fdbb7027537b87ff25cb86a2a6b5a","unresolved":false,"context_lines":[{"line_number":56,"context_line":"# TODO(fabiog): these methods are still used because the scoping part is really"},{"line_number":57,"context_line":"# convoluted and difficult to separate out."},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"def get_limited_to(headers):"},{"line_number":60,"context_line":"    \"\"\"Return the user and project the request should be limited to."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"    :param headers: HTTP headers dictionary"}],"source_content_type":"text/x-python","patch_set":14,"id":"5a890539_dc73b94c","line":59,"updated":"2014-11-26 17:39:40.000000000","message":"This should no longer be needed","commit_id":"3a989bcc9c1c6081b0f4f2593fe38ff91efa1628"},{"author":{"_account_id":2284,"name":"Eoghan Glynn","email":"eglynn@redhat.com","username":"eglynn"},"change_message_id":"25ac12f7ae588092092e2f6704e1e598ec6f471c","unresolved":false,"context_lines":[{"line_number":56,"context_line":"# TODO(fabiog): these methods are still used because the scoping part is really"},{"line_number":57,"context_line":"# convoluted and difficult to separate out."},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"def get_limited_to(headers):"},{"line_number":60,"context_line":"    \"\"\"Return the user and project the request should be limited to."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"    :param headers: HTTP headers dictionary"}],"source_content_type":"text/x-python","patch_set":14,"id":"5a890539_4bafca94","line":59,"in_reply_to":"5a890539_dc73b94c","updated":"2014-11-28 15:28:39.000000000","message":"It\u0027s still used to the cross-project scoping (subsequent to the initial policy enforcement)","commit_id":"3a989bcc9c1c6081b0f4f2593fe38ff91efa1628"},{"author":{"_account_id":2284,"name":"Eoghan Glynn","email":"eglynn@redhat.com","username":"eglynn"},"change_message_id":"25ac12f7ae588092092e2f6704e1e598ec6f471c","unresolved":false,"context_lines":[{"line_number":71,"context_line":""},{"line_number":72,"context_line":"    roles \u003d headers.get(\u0027X-Roles\u0027, \"\").split(\",\")"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"    if not _ENFORCER.enforce(\u0027context_is_admin\u0027,"},{"line_number":75,"context_line":"                             {},"},{"line_number":76,"context_line":"                             {\u0027roles\u0027: roles}):"},{"line_number":77,"context_line":"        return headers.get(\u0027X-User-Id\u0027), headers.get(\u0027X-Project-Id\u0027)"}],"source_content_type":"text/x-python","patch_set":14,"id":"5a890539_3411045e","line":74,"updated":"2014-11-28 15:28:39.000000000","message":"Rather than hardcoding the rule that implements cross-tenant segregation to \u0027context_is_admin\u0027, how about making that configurable?\n\ne.g. an additional rule in the policy.json that doesn\u0027t identify an individual API, but instead indicates the rule that should be used to limiting scoping:\n\nthen the current behaviour would be:\n\n  \"project segregation\" :  \"context_is_admin\"\n\nwhereas restricting to the same project as the target resource regardless of admin-ness could be something like:\n\n  \"project segregation\" :  \"project_id:%(target.project.id)\"\n\n(that would require that the target is passed to the enforcer)","commit_id":"3a989bcc9c1c6081b0f4f2593fe38ff91efa1628"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"c35f27f5a1202be855a11f3751033c3cc2412a18","unresolved":false,"context_lines":[{"line_number":71,"context_line":""},{"line_number":72,"context_line":"    roles \u003d headers.get(\u0027X-Roles\u0027, \"\").split(\",\")"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"    if not _ENFORCER.enforce(\u0027context_is_admin\u0027,"},{"line_number":75,"context_line":"                             {},"},{"line_number":76,"context_line":"                             {\u0027roles\u0027: roles}):"},{"line_number":77,"context_line":"        return headers.get(\u0027X-User-Id\u0027), headers.get(\u0027X-Project-Id\u0027)"}],"source_content_type":"text/x-python","patch_set":14,"id":"5a890539_d5b6a7db","line":74,"in_reply_to":"5a890539_3411045e","updated":"2014-12-02 18:53:00.000000000","message":"Ok, I\u0027ll look into this.\nI think I will need to do this with two rules because an admin can come in with a defined project but still has wider access.","commit_id":"3a989bcc9c1c6081b0f4f2593fe38ff91efa1628"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"08ce1025ebb0e4dc61447cd99e9276b2d48f544b","unresolved":false,"context_lines":[{"line_number":71,"context_line":""},{"line_number":72,"context_line":"    roles \u003d headers.get(\u0027X-Roles\u0027, \"\").split(\",\")"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"    if not _ENFORCER.enforce(\u0027context_is_admin\u0027,"},{"line_number":75,"context_line":"                             {},"},{"line_number":76,"context_line":"                             {\u0027roles\u0027: roles}):"},{"line_number":77,"context_line":"        return headers.get(\u0027X-User-Id\u0027), headers.get(\u0027X-Project-Id\u0027)"}],"source_content_type":"text/x-python","patch_set":14,"id":"5a890539_4db727d8","line":74,"in_reply_to":"5a890539_d5b6a7db","updated":"2014-12-04 18:42:47.000000000","message":"Ok got you. So you are saying to have a further level of indirection. The problem though is that I cannot have two rules with the same name, so I can add a project_segregation rule, but then you will need to manually change it to use the project.id concept. Alternatively I can create two separate rules like context_is_admin and context_is_project and then you can change it accordingly to your needs.","commit_id":"3a989bcc9c1c6081b0f4f2593fe38ff91efa1628"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"da867dbe964fdbb7027537b87ff25cb86a2a6b5a","unresolved":false,"context_lines":[{"line_number":78,"context_line":"    return None, None"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"def get_limited_to_project(headers):"},{"line_number":82,"context_line":"    \"\"\"Return the project the request should be limited to."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"    :param headers: HTTP headers dictionary"}],"source_content_type":"text/x-python","patch_set":14,"id":"5a890539_fc707542","line":81,"updated":"2014-11-26 17:39:40.000000000","message":"This should no longer be needed","commit_id":"3a989bcc9c1c6081b0f4f2593fe38ff91efa1628"}],"ceilometer/cmd/api.py":[{"author":{"_account_id":6537,"name":"gordon chung","email":"gord@live.ca","username":"chungg"},"change_message_id":"c4e3a9aa40a02df0f32ff9a5a82a71eeab07d58e","unresolved":false,"context_lines":[{"line_number":23,"context_line":"    srv \u003d app.build_server()"},{"line_number":24,"context_line":"    srv.serve_forever()"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"if __name__ \u003d\u003d \u0027__main__\u0027:"},{"line_number":27,"context_line":"    main()"}],"source_content_type":"text/x-python","patch_set":8,"id":"9aa7fdbe_e249bd60","line":26,"updated":"2014-10-28 19:51:16.000000000","message":"what\u0027s this for?","commit_id":"eb5d5a21f6e9921fb05c48b6cbc561f61c7710d6"}],"ceilometer/tests/api/v2/test_alarm_scenarios.py":[{"author":{"_account_id":10987,"name":"Igor Degtiarov","username":"tovstun","inactive":true},"change_message_id":"0f0a3e06335483d5abe24eea2dcb7e0a21531793","unresolved":false,"context_lines":[{"line_number":1883,"context_line":"            self._assert_is_subset(dict(alarm_id\u003dalarm[\u0027alarm_id\u0027],"},{"line_number":1884,"context_line":"                                        detail\u003d\u0027{\"state\": \"alarm\"}\u0027,"},{"line_number":1885,"context_line":"                                        on_behalf_of\u003dalarm[\u0027project_id\u0027],"},{"line_number":1886,"context_line":"                                        project_id\u003dNone,"},{"line_number":1887,"context_line":"                                        type\u003d\u0027rule change\u0027,"},{"line_number":1888,"context_line":"                                        user_id\u003dNone),"},{"line_number":1889,"context_line":"                                   history[0])"}],"source_content_type":"text/x-python","patch_set":8,"id":"7a8c0949_3e88b9c4","line":1886,"updated":"2014-11-07 13:53:33.000000000","message":"Could you clarify why do we need such changes here from admin_project to None","commit_id":"eb5d5a21f6e9921fb05c48b6cbc561f61c7710d6"}],"etc/ceilometer/rbac_policy.json":[{"author":{"_account_id":2284,"name":"Eoghan Glynn","email":"eglynn@redhat.com","username":"eglynn"},"change_message_id":"f19e75c20598540831d5272fa8e9d0c45554fafb","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"context_is_admin\": \"role:admin\","},{"line_number":3,"context_line":"    \"service_role\": \"role:service\","},{"line_number":4,"context_line":"    \"iaas_role\": \"role:iaas\","},{"line_number":5,"context_line":"    \"project_user\": \"role:user\","},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"    \"telemetry:get_samples\": \"rule:context_is_admin\","}],"source_content_type":"application/json","patch_set":13,"id":"5a890539_1e002733","line":4,"updated":"2014-11-24 19:43:05.000000000","message":"I don\u0027t understand the purpose of the iaas role. Can you explain?","commit_id":"fde42a19db337b124b99860757436e31e8bcedc7"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"0b32be1aeb91062f40302b870f892b59f503b1e0","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"context_is_admin\": \"role:admin\","},{"line_number":3,"context_line":"    \"service_role\": \"role:service\","},{"line_number":4,"context_line":"    \"iaas_role\": \"role:iaas\","},{"line_number":5,"context_line":"    \"project_user\": \"role:user\","},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"    \"telemetry:get_samples\": \"rule:context_is_admin\","}],"source_content_type":"application/json","patch_set":13,"id":"5a890539_c2cf7427","line":4,"in_reply_to":"5a890539_1e002733","updated":"2014-11-25 21:17:35.000000000","message":"This file is just an example. I need to keep the original policy file for backward compatibility. So I wanted to provide a composite example with an end for users to understand how to create more complex rules...","commit_id":"fde42a19db337b124b99860757436e31e8bcedc7"},{"author":{"_account_id":2284,"name":"Eoghan Glynn","email":"eglynn@redhat.com","username":"eglynn"},"change_message_id":"f19e75c20598540831d5272fa8e9d0c45554fafb","unresolved":false,"context_lines":[{"line_number":13,"context_line":"    \"telemetry:get_meters\": \"rule:context_is_admin\","},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"    \"telemetry:get_resource\": \"rule:context_is_admin\","},{"line_number":16,"context_line":"    \"telemetry:get_resources\": \"rule:context_is_admin\","},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"    \"telemetry:get_alarm\": \"rule:context_is_admin\","},{"line_number":19,"context_line":"    \"telemetry:query_alarm\": \"rule:context_is_admin\","}],"source_content_type":"application/json","patch_set":13,"id":"5a890539_bee553a5","line":16,"updated":"2014-11-24 19:43:05.000000000","message":"With the exception of create_samples, the above methods don\u0027t seem like candidates for requiring the admin role - and if they are, this would be a fundamental change from the current policy (of allowing these methods to be called by non-admin users, but restricting visibility to their owned resources).","commit_id":"fde42a19db337b124b99860757436e31e8bcedc7"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"0b32be1aeb91062f40302b870f892b59f503b1e0","unresolved":false,"context_lines":[{"line_number":13,"context_line":"    \"telemetry:get_meters\": \"rule:context_is_admin\","},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"    \"telemetry:get_resource\": \"rule:context_is_admin\","},{"line_number":16,"context_line":"    \"telemetry:get_resources\": \"rule:context_is_admin\","},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"    \"telemetry:get_alarm\": \"rule:context_is_admin\","},{"line_number":19,"context_line":"    \"telemetry:query_alarm\": \"rule:context_is_admin\","}],"source_content_type":"application/json","patch_set":13,"id":"5a890539_42e384a3","line":16,"in_reply_to":"5a890539_bee553a5","updated":"2014-11-25 21:17:35.000000000","message":"Again this is just an example. I can make the file with no rules if you think it confuses people ...","commit_id":"fde42a19db337b124b99860757436e31e8bcedc7"},{"author":{"_account_id":3012,"name":"Dina Belova","email":"dbelova@mirantis.com","username":"dbelova"},"change_message_id":"7799a371c59fe2cc27b658441a6a60041be94479","unresolved":false,"context_lines":[{"line_number":19,"context_line":"    \"telemetry:query_alarm\": \"rule:context_is_admin\","},{"line_number":20,"context_line":"    \"telemetry:get_alarm_state\": \"rule:project_user\","},{"line_number":21,"context_line":"    \"telemetry:get_alarms\": \"rule:context_is_admin\","},{"line_number":22,"context_line":"    \"telemetry:create_alarm\": \"rule:service_role and rule:iaas_role\","},{"line_number":23,"context_line":"    \"telemetry:set_alarm\": \"rule:service_role\","},{"line_number":24,"context_line":"    \"telemetry:delete_alarm\": \"rule:context_is_admin\","},{"line_number":25,"context_line":""}],"source_content_type":"application/json","patch_set":13,"id":"5a890539_2d7a24f1","line":22,"updated":"2014-11-24 13:39:44.000000000","message":"I\u0027m not sure, but OR (instead of AND) looks logically better here for me. May you explain why did you use AND?","commit_id":"fde42a19db337b124b99860757436e31e8bcedc7"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"0b32be1aeb91062f40302b870f892b59f503b1e0","unresolved":false,"context_lines":[{"line_number":19,"context_line":"    \"telemetry:query_alarm\": \"rule:context_is_admin\","},{"line_number":20,"context_line":"    \"telemetry:get_alarm_state\": \"rule:project_user\","},{"line_number":21,"context_line":"    \"telemetry:get_alarms\": \"rule:context_is_admin\","},{"line_number":22,"context_line":"    \"telemetry:create_alarm\": \"rule:service_role and rule:iaas_role\","},{"line_number":23,"context_line":"    \"telemetry:set_alarm\": \"rule:service_role\","},{"line_number":24,"context_line":"    \"telemetry:delete_alarm\": \"rule:context_is_admin\","},{"line_number":25,"context_line":""}],"source_content_type":"application/json","patch_set":13,"id":"5a890539_62f5e04f","line":22,"in_reply_to":"5a890539_2d7a24f1","updated":"2014-11-25 21:17:35.000000000","message":"This is an example of compound rule, so you can use either or/and. The difference of course is that with the and you need both roles to access the method rather than just one.","commit_id":"fde42a19db337b124b99860757436e31e8bcedc7"},{"author":{"_account_id":2284,"name":"Eoghan Glynn","email":"eglynn@redhat.com","username":"eglynn"},"change_message_id":"f19e75c20598540831d5272fa8e9d0c45554fafb","unresolved":false,"context_lines":[{"line_number":23,"context_line":"    \"telemetry:set_alarm\": \"rule:service_role\","},{"line_number":24,"context_line":"    \"telemetry:delete_alarm\": \"rule:context_is_admin\","},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"    \"telemetry:alarm_history\": \"rule:context_is_admin\","},{"line_number":27,"context_line":"    \"telemetry:change_alarm_state\": \"rule:context_is_admin\","},{"line_number":28,"context_line":"    \"telemetry:query_alarm_history\": \"rule:context_is_admin\""},{"line_number":29,"context_line":"}"}],"source_content_type":"application/json","patch_set":13,"id":"5a890539_5ef62f5e","line":26,"updated":"2014-11-24 19:43:05.000000000","message":"If the project_user can get the current alarm state, why restrict them from the alarm history?","commit_id":"fde42a19db337b124b99860757436e31e8bcedc7"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"0b32be1aeb91062f40302b870f892b59f503b1e0","unresolved":false,"context_lines":[{"line_number":23,"context_line":"    \"telemetry:set_alarm\": \"rule:service_role\","},{"line_number":24,"context_line":"    \"telemetry:delete_alarm\": \"rule:context_is_admin\","},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"    \"telemetry:alarm_history\": \"rule:context_is_admin\","},{"line_number":27,"context_line":"    \"telemetry:change_alarm_state\": \"rule:context_is_admin\","},{"line_number":28,"context_line":"    \"telemetry:query_alarm_history\": \"rule:context_is_admin\""},{"line_number":29,"context_line":"}"}],"source_content_type":"application/json","patch_set":13,"id":"5a890539_228678b9","line":26,"in_reply_to":"5a890539_5ef62f5e","updated":"2014-11-25 21:17:35.000000000","message":"Again it is just an example file ... Users will need to write their own policy against these methods.","commit_id":"fde42a19db337b124b99860757436e31e8bcedc7"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"da867dbe964fdbb7027537b87ff25cb86a2a6b5a","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"context_is_admin\": \"role:admin\","},{"line_number":3,"context_line":"    \"service_role\": \"role:service\","},{"line_number":4,"context_line":"    \"iaas_role\": \"role:iaas\","},{"line_number":5,"context_line":"    \"project_user\": \"role:user\","},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"    \"telemetry:get_samples\": \"rule:context_is_admin\","}],"source_content_type":"application/json","patch_set":14,"id":"5a890539_616bfef1","line":4,"updated":"2014-11-26 17:39:40.000000000","message":"I don\u0027t see what the need is for an example file like this. Whether that is needed or not, you\u0027re missing changes to the non-example policy.json file, which are a must. The existing non-example policy.json does not define any restrictions, so the implementation of RBAC support via policy.json needs to include updating that file to add necessary restrictions that will no longer be hardcoded.","commit_id":"3a989bcc9c1c6081b0f4f2593fe38ff91efa1628"},{"author":{"_account_id":2284,"name":"Eoghan Glynn","email":"eglynn@redhat.com","username":"eglynn"},"change_message_id":"db5bd32c001e5178748f38a79651ba53e616791f","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"context_is_admin\": \"role:admin\","},{"line_number":3,"context_line":"    \"service_role\": \"role:service\","},{"line_number":4,"context_line":"    \"iaas_role\": \"role:iaas\","}],"source_content_type":"application/json","patch_set":15,"id":"3a961159_8415c141","line":1,"updated":"2014-12-11 14:57:03.000000000","message":"Is the intent of this file to act as a illustrative sample of how the RBAC rules could be set up?\n\nIf so, would it make sense to call it something a bit more explicit, like policy.json.sample?","commit_id":"e9d8b6df63772086db77e95ab20d99949fea5623"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"7fc7f8023fca30dc970e6d953f57b459705ff284","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"context_is_admin\": \"role:admin\","},{"line_number":3,"context_line":"    \"service_role\": \"role:service\","},{"line_number":4,"context_line":"    \"iaas_role\": \"role:iaas\","}],"source_content_type":"application/json","patch_set":15,"id":"3a961159_643ff5d6","line":1,"in_reply_to":"3a961159_8415c141","updated":"2014-12-11 15:14:02.000000000","message":"Ok good point I will do that. I will call it policy.json.sample","commit_id":"e9d8b6df63772086db77e95ab20d99949fea5623"},{"author":{"_account_id":2284,"name":"Eoghan Glynn","email":"eglynn@redhat.com","username":"eglynn"},"change_message_id":"db5bd32c001e5178748f38a79651ba53e616791f","unresolved":false,"context_lines":[{"line_number":17,"context_line":""},{"line_number":18,"context_line":"    \"telemetry:get_alarm\": \"rule:context_is_admin\","},{"line_number":19,"context_line":"    \"telemetry:query_alarm\": \"rule:context_is_admin\","},{"line_number":20,"context_line":"    \"telemetry:get_alarm_state\": \"rule:project_user\","},{"line_number":21,"context_line":"    \"telemetry:get_alarms\": \"rule:context_is_admin\","},{"line_number":22,"context_line":"    \"telemetry:create_alarm\": \"rule:service_role and rule:iaas_role\","},{"line_number":23,"context_line":"    \"telemetry:set_alarm\": \"rule:service_role\","}],"source_content_type":"application/json","patch_set":15,"id":"3a961159_e4b4c536","line":20,"updated":"2014-12-11 14:57:03.000000000","message":"This rule slightly contradicts the tight restrictions on compute_statistics and get_samples.\n\ni.e. a non-admin user can create an alarm with a threshold and then check it\u0027s state, which would allow the user figure out if the statistics trend has crossed a threshold and get the latest value via the alarm notification (effectively bypassing the admin-only restriction on compute_statistics/get_samples).","commit_id":"e9d8b6df63772086db77e95ab20d99949fea5623"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"7fc7f8023fca30dc970e6d953f57b459705ff284","unresolved":false,"context_lines":[{"line_number":17,"context_line":""},{"line_number":18,"context_line":"    \"telemetry:get_alarm\": \"rule:context_is_admin\","},{"line_number":19,"context_line":"    \"telemetry:query_alarm\": \"rule:context_is_admin\","},{"line_number":20,"context_line":"    \"telemetry:get_alarm_state\": \"rule:project_user\","},{"line_number":21,"context_line":"    \"telemetry:get_alarms\": \"rule:context_is_admin\","},{"line_number":22,"context_line":"    \"telemetry:create_alarm\": \"rule:service_role and rule:iaas_role\","},{"line_number":23,"context_line":"    \"telemetry:set_alarm\": \"rule:service_role\","}],"source_content_type":"application/json","patch_set":15,"id":"3a961159_7f6a1eb4","line":20,"in_reply_to":"3a961159_e4b4c536","updated":"2014-12-11 15:14:02.000000000","message":"I will move the \"example\" to a different method to avoid confusion. Also when it is renamed poliocy.json.sample it will be clearer.\nThe problem is that JSON does not support comments otherwise it would be easily solved.","commit_id":"e9d8b6df63772086db77e95ab20d99949fea5623"},{"author":{"_account_id":2284,"name":"Eoghan Glynn","email":"eglynn@redhat.com","username":"eglynn"},"change_message_id":"db5bd32c001e5178748f38a79651ba53e616791f","unresolved":false,"context_lines":[{"line_number":19,"context_line":"    \"telemetry:query_alarm\": \"rule:context_is_admin\","},{"line_number":20,"context_line":"    \"telemetry:get_alarm_state\": \"rule:project_user\","},{"line_number":21,"context_line":"    \"telemetry:get_alarms\": \"rule:context_is_admin\","},{"line_number":22,"context_line":"    \"telemetry:create_alarm\": \"rule:service_role and rule:iaas_role\","},{"line_number":23,"context_line":"    \"telemetry:set_alarm\": \"rule:service_role\","},{"line_number":24,"context_line":"    \"telemetry:delete_alarm\": \"rule:context_is_admin\","},{"line_number":25,"context_line":""}],"source_content_type":"application/json","patch_set":15,"id":"3a961159_243fad89","line":22,"updated":"2014-12-11 14:57:03.000000000","message":"How would this rule line up with the segregation rule?\n\ni.e. if segregation is set to admin-only, then a user with the server or iaas role supposedly can create an alarm on behalf of another user, but that alarm can\u0027t be evaluated since the other user\u0027s statistics are out-of-scope?\n\ni.e. would fall foul of this check:\n\n  https://github.com/openstack/ceilometer/blob/master/ceilometer/api/controllers/v2.py#L2172\n\nAlso should there be a note that this role would be required by any users creating autoscaled Heat stacks?\n\nFinally, is this rule missing an \"*or* rule:context_is_admin\" clause?","commit_id":"e9d8b6df63772086db77e95ab20d99949fea5623"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"7fc7f8023fca30dc970e6d953f57b459705ff284","unresolved":false,"context_lines":[{"line_number":19,"context_line":"    \"telemetry:query_alarm\": \"rule:context_is_admin\","},{"line_number":20,"context_line":"    \"telemetry:get_alarm_state\": \"rule:project_user\","},{"line_number":21,"context_line":"    \"telemetry:get_alarms\": \"rule:context_is_admin\","},{"line_number":22,"context_line":"    \"telemetry:create_alarm\": \"rule:service_role and rule:iaas_role\","},{"line_number":23,"context_line":"    \"telemetry:set_alarm\": \"rule:service_role\","},{"line_number":24,"context_line":"    \"telemetry:delete_alarm\": \"rule:context_is_admin\","},{"line_number":25,"context_line":""}],"source_content_type":"application/json","patch_set":15,"id":"3a961159_bf49e661","line":22,"in_reply_to":"3a961159_243fad89","updated":"2014-12-11 15:14:02.000000000","message":"To avoid all this confusion I will remove specific rules from alarms and change only get samples or get resources. You can have either a or/and or both. I will create two examples. I was trying to illustrate folks how to use this stuff ...","commit_id":"e9d8b6df63772086db77e95ab20d99949fea5623"},{"author":{"_account_id":2284,"name":"Eoghan Glynn","email":"eglynn@redhat.com","username":"eglynn"},"change_message_id":"db5bd32c001e5178748f38a79651ba53e616791f","unresolved":false,"context_lines":[{"line_number":26,"context_line":"    \"telemetry:alarm_history\": \"rule:context_is_admin\","},{"line_number":27,"context_line":"    \"telemetry:change_alarm_state\": \"rule:context_is_admin\","},{"line_number":28,"context_line":"    \"telemetry:query_alarm_history\": \"rule:context_is_admin\""},{"line_number":29,"context_line":"}"}],"source_content_type":"application/json","patch_set":15,"id":"3a961159_c41b4971","line":29,"updated":"2014-12-11 14:57:03.000000000","message":"Should the segregation rule be included also in this file?","commit_id":"e9d8b6df63772086db77e95ab20d99949fea5623"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"7fc7f8023fca30dc970e6d953f57b459705ff284","unresolved":false,"context_lines":[{"line_number":26,"context_line":"    \"telemetry:alarm_history\": \"rule:context_is_admin\","},{"line_number":27,"context_line":"    \"telemetry:change_alarm_state\": \"rule:context_is_admin\","},{"line_number":28,"context_line":"    \"telemetry:query_alarm_history\": \"rule:context_is_admin\""},{"line_number":29,"context_line":"}"}],"source_content_type":"application/json","patch_set":15,"id":"3a961159_5f0d6236","line":29,"in_reply_to":"3a961159_c41b4971","updated":"2014-12-11 15:14:02.000000000","message":"No. Because that is legacy. They should move away from that and use the new format where they can be specific for the different methods","commit_id":"e9d8b6df63772086db77e95ab20d99949fea5623"}]}