)]}'
{"ceilometer/api/controllers/v2/events.py":[{"author":{"_account_id":8290,"name":"liusheng","email":"liusheng2048@gmail.com","username":"LiuSheng"},"change_message_id":"941ca1d1f7205dc49b09065d85fd22dae974ff87","unresolved":false,"context_lines":[{"line_number":166,"context_line":"        filters[\u0027t_filter\u0027].append({\"key\": \"project_id\", \"string\": proj_id,"},{"line_number":167,"context_line":"                                    \"op\": \"eq\"})"},{"line_number":168,"context_line":"        filters[\u0027t_filter\u0027].append({\"key\": \"user_id\", \"string\": user_id,"},{"line_number":169,"context_line":"                                    \"op\": \"eq\"})"},{"line_number":170,"context_line":"    elif not user_id and not proj_id:"},{"line_number":171,"context_line":"        filters[\u0027admin_proj\u0027] \u003d pecan.request.headers.get(\u0027X-Project-Id\u0027)"},{"line_number":172,"context_line":"    return filters"}],"source_content_type":"text/x-python","patch_set":7,"id":"da20952f_0f967594","line":169,"updated":"2015-09-02 04:24:03.000000000","message":"I have just considered this situation:\n\n1. user_A has a non-admin role_A in project_A, according this user_A can only query events with user_A of user_id.\n\n2. we have a user_B, then create a trust with user_A as trustor and user_B as trustee, the trust role is the non-admin role_A. So the user_B also has a non-admin role_A in project_A.\n\n3. after above step, we expect the user_B has the access to query the events with user_A of user_id (I am not sure is this we expect?). but here if user_B hasn\u0027t admin role, the user_id returned by rbac.get_limited_to() will be the trustee user_B. as a result the events with user_A as user_id cannot be queried.","commit_id":"a7bc4463a88ced03e5ed7d61d6fc66ef2d3f26d1"},{"author":{"_account_id":6537,"name":"gordon chung","email":"gord@live.ca","username":"chungg"},"change_message_id":"afdcf67dad3804047c6f6f99c1fc932b03fbe207","unresolved":false,"context_lines":[{"line_number":166,"context_line":"        filters[\u0027t_filter\u0027].append({\"key\": \"project_id\", \"string\": proj_id,"},{"line_number":167,"context_line":"                                    \"op\": \"eq\"})"},{"line_number":168,"context_line":"        filters[\u0027t_filter\u0027].append({\"key\": \"user_id\", \"string\": user_id,"},{"line_number":169,"context_line":"                                    \"op\": \"eq\"})"},{"line_number":170,"context_line":"    elif not user_id and not proj_id:"},{"line_number":171,"context_line":"        filters[\u0027admin_proj\u0027] \u003d pecan.request.headers.get(\u0027X-Project-Id\u0027)"},{"line_number":172,"context_line":"    return filters"}],"source_content_type":"text/x-python","patch_set":7,"id":"da20952f_dd16e9a6","line":169,"in_reply_to":"da20952f_0f967594","updated":"2015-09-02 11:45:30.000000000","message":"i don\u0027t think we considered trusts\n\nthe prosposed bp is here: http://specs.openstack.org/openstack/ceilometer-specs/specs/liberty/events-rbac.html\n\nthe basic idea is that if you\u0027re a non-admin, you will only have access to events tagged with your project/user... if you are admin you will have access to all events tagged with your project OR that has no project tag.\n\nis this a usability concern?","commit_id":"a7bc4463a88ced03e5ed7d61d6fc66ef2d3f26d1"},{"author":{"_account_id":8290,"name":"liusheng","email":"liusheng2048@gmail.com","username":"LiuSheng"},"change_message_id":"b6b98376908f49aad27c9d4bb09dd4532ace3203","unresolved":false,"context_lines":[{"line_number":166,"context_line":"        filters[\u0027t_filter\u0027].append({\"key\": \"project_id\", \"string\": proj_id,"},{"line_number":167,"context_line":"                                    \"op\": \"eq\"})"},{"line_number":168,"context_line":"        filters[\u0027t_filter\u0027].append({\"key\": \"user_id\", \"string\": user_id,"},{"line_number":169,"context_line":"                                    \"op\": \"eq\"})"},{"line_number":170,"context_line":"    elif not user_id and not proj_id:"},{"line_number":171,"context_line":"        filters[\u0027admin_proj\u0027] \u003d pecan.request.headers.get(\u0027X-Project-Id\u0027)"},{"line_number":172,"context_line":"    return filters"}],"source_content_type":"text/x-python","patch_set":7,"id":"da20952f_a52517af","line":169,"in_reply_to":"da20952f_6f1fde5b","updated":"2015-09-02 13:38:20.000000000","message":"The Nova looks like has a similar process:\nhttps://github.com/openstack/nova/blob/master/nova/api/openstack/compute/servers.py#L356-L366\n\nI guess some other project also didn\u0027t considered this situation. I am not sure this is a common problem of resource access control..","commit_id":"a7bc4463a88ced03e5ed7d61d6fc66ef2d3f26d1"},{"author":{"_account_id":13637,"name":"Divya K Konoor","email":"dikonoor@in.ibm.com","username":"dikonoor"},"change_message_id":"994d37397fed82cbf832ea9baa8e3536407901c6","unresolved":false,"context_lines":[{"line_number":166,"context_line":"        filters[\u0027t_filter\u0027].append({\"key\": \"project_id\", \"string\": proj_id,"},{"line_number":167,"context_line":"                                    \"op\": \"eq\"})"},{"line_number":168,"context_line":"        filters[\u0027t_filter\u0027].append({\"key\": \"user_id\", \"string\": user_id,"},{"line_number":169,"context_line":"                                    \"op\": \"eq\"})"},{"line_number":170,"context_line":"    elif not user_id and not proj_id:"},{"line_number":171,"context_line":"        filters[\u0027admin_proj\u0027] \u003d pecan.request.headers.get(\u0027X-Project-Id\u0027)"},{"line_number":172,"context_line":"    return filters"}],"source_content_type":"text/x-python","patch_set":7,"id":"da20952f_203fb526","line":169,"in_reply_to":"da20952f_8c860012","updated":"2015-09-02 14:05:26.000000000","message":"The access here is indeed controlled by the user role. As the BP says, control over what events get returned is completed based on the role of the user. The event trait is used merely to achieve this .","commit_id":"a7bc4463a88ced03e5ed7d61d6fc66ef2d3f26d1"},{"author":{"_account_id":6537,"name":"gordon chung","email":"gord@live.ca","username":"chungg"},"change_message_id":"80562e52e71fdf72aa093a93d1d09298a409498c","unresolved":false,"context_lines":[{"line_number":166,"context_line":"        filters[\u0027t_filter\u0027].append({\"key\": \"project_id\", \"string\": proj_id,"},{"line_number":167,"context_line":"                                    \"op\": \"eq\"})"},{"line_number":168,"context_line":"        filters[\u0027t_filter\u0027].append({\"key\": \"user_id\", \"string\": user_id,"},{"line_number":169,"context_line":"                                    \"op\": \"eq\"})"},{"line_number":170,"context_line":"    elif not user_id and not proj_id:"},{"line_number":171,"context_line":"        filters[\u0027admin_proj\u0027] \u003d pecan.request.headers.get(\u0027X-Project-Id\u0027)"},{"line_number":172,"context_line":"    return filters"}],"source_content_type":"text/x-python","patch_set":7,"id":"da20952f_6f1fde5b","line":169,"in_reply_to":"da20952f_8c860012","updated":"2015-09-02 12:48:22.000000000","message":"the roles will define the scope of what you have access too. if this is a concern. please raise it now. i do not want to break any real world use cases here...","commit_id":"a7bc4463a88ced03e5ed7d61d6fc66ef2d3f26d1"},{"author":{"_account_id":8290,"name":"liusheng","email":"liusheng2048@gmail.com","username":"LiuSheng"},"change_message_id":"4de34931dae4252c5121207ad265513dafd16529","unresolved":false,"context_lines":[{"line_number":166,"context_line":"        filters[\u0027t_filter\u0027].append({\"key\": \"project_id\", \"string\": proj_id,"},{"line_number":167,"context_line":"                                    \"op\": \"eq\"})"},{"line_number":168,"context_line":"        filters[\u0027t_filter\u0027].append({\"key\": \"user_id\", \"string\": user_id,"},{"line_number":169,"context_line":"                                    \"op\": \"eq\"})"},{"line_number":170,"context_line":"    elif not user_id and not proj_id:"},{"line_number":171,"context_line":"        filters[\u0027admin_proj\u0027] \u003d pecan.request.headers.get(\u0027X-Project-Id\u0027)"},{"line_number":172,"context_line":"    return filters"}],"source_content_type":"text/x-python","patch_set":7,"id":"da20952f_c0d7d921","line":169,"in_reply_to":"da20952f_a52517af","updated":"2015-09-02 13:55:40.000000000","message":"according the nova process, both admin users and non-admin users of a project can list all the resources of the project. but users with admin role can list all tenant resource with \u0027all-tenant\u0027 specified.","commit_id":"a7bc4463a88ced03e5ed7d61d6fc66ef2d3f26d1"},{"author":{"_account_id":13637,"name":"Divya K Konoor","email":"dikonoor@in.ibm.com","username":"dikonoor"},"change_message_id":"994d37397fed82cbf832ea9baa8e3536407901c6","unresolved":false,"context_lines":[{"line_number":166,"context_line":"        filters[\u0027t_filter\u0027].append({\"key\": \"project_id\", \"string\": proj_id,"},{"line_number":167,"context_line":"                                    \"op\": \"eq\"})"},{"line_number":168,"context_line":"        filters[\u0027t_filter\u0027].append({\"key\": \"user_id\", \"string\": user_id,"},{"line_number":169,"context_line":"                                    \"op\": \"eq\"})"},{"line_number":170,"context_line":"    elif not user_id and not proj_id:"},{"line_number":171,"context_line":"        filters[\u0027admin_proj\u0027] \u003d pecan.request.headers.get(\u0027X-Project-Id\u0027)"},{"line_number":172,"context_line":"    return filters"}],"source_content_type":"text/x-python","patch_set":7,"id":"da20952f_c0f2796f","line":169,"in_reply_to":"da20952f_c0d7d921","updated":"2015-09-02 14:05:26.000000000","message":"The nova servers example given here is for a user who has cloud admin or super-user role (who can see servers across projects by passing the all_tenants parameter as part of the REST api) which is not covered as part of this BP. If we want to support such a scenario for events, then that has to be taken up separately.","commit_id":"a7bc4463a88ced03e5ed7d61d6fc66ef2d3f26d1"},{"author":{"_account_id":8290,"name":"liusheng","email":"liusheng2048@gmail.com","username":"LiuSheng"},"change_message_id":"9196fd67a75d44df6c2710f7ed4a06ddecbebdea","unresolved":false,"context_lines":[{"line_number":166,"context_line":"        filters[\u0027t_filter\u0027].append({\"key\": \"project_id\", \"string\": proj_id,"},{"line_number":167,"context_line":"                                    \"op\": \"eq\"})"},{"line_number":168,"context_line":"        filters[\u0027t_filter\u0027].append({\"key\": \"user_id\", \"string\": user_id,"},{"line_number":169,"context_line":"                                    \"op\": \"eq\"})"},{"line_number":170,"context_line":"    elif not user_id and not proj_id:"},{"line_number":171,"context_line":"        filters[\u0027admin_proj\u0027] \u003d pecan.request.headers.get(\u0027X-Project-Id\u0027)"},{"line_number":172,"context_line":"    return filters"}],"source_content_type":"text/x-python","patch_set":7,"id":"da20952f_8c860012","line":169,"in_reply_to":"da20952f_dd16e9a6","updated":"2015-09-02 12:39:35.000000000","message":"I have rethought the situation, seems it is not a series problem. agree with you, the role of a user only effect the access of resource. in this proposal, it is not quite same with the access control. the trust is roles transmission between users, it is relate to the RABC, but according the proposal, the access is controlled by the traits of events, not the roles.","commit_id":"a7bc4463a88ced03e5ed7d61d6fc66ef2d3f26d1"}],"ceilometer/storage/__init__.py":[{"author":{"_account_id":1894,"name":"Ryota MIBU","email":"r-mibu@cq.jp.nec.com","username":"r-mibu"},"change_message_id":"d94ca52eb65314b5a91e62c920130b78cf03eb5e","unresolved":false,"context_lines":[{"line_number":208,"context_line":"    :param end_timestamp: UTC end datetime (mandatory)"},{"line_number":209,"context_line":"    :param event_type: the name of the event. None for all."},{"line_number":210,"context_line":"    :param message_id: the message_id of the event. None for all."},{"line_number":211,"context_line":"    :param traits_filter: the trait filter dicts, all of which are optional."},{"line_number":212,"context_line":"      This parameter is a list of dictionaries that specify trait values:"},{"line_number":213,"context_line":""},{"line_number":214,"context_line":"    .. code-block:: python"}],"source_content_type":"text/x-python","patch_set":6,"id":"da20952f_da504661","line":211,"updated":"2015-09-02 00:14:05.000000000","message":"Adding description for \u0027admin_proj\u0027 might be better.","commit_id":"c450a85270d9f0c5eb696bcf334b0c099aff9753"},{"author":{"_account_id":6537,"name":"gordon chung","email":"gord@live.ca","username":"chungg"},"change_message_id":"ae7bd21e7f5f880dd364503cf6ccbcca8a19f1ba","unresolved":false,"context_lines":[{"line_number":208,"context_line":"    :param end_timestamp: UTC end datetime (mandatory)"},{"line_number":209,"context_line":"    :param event_type: the name of the event. None for all."},{"line_number":210,"context_line":"    :param message_id: the message_id of the event. None for all."},{"line_number":211,"context_line":"    :param traits_filter: the trait filter dicts, all of which are optional."},{"line_number":212,"context_line":"      This parameter is a list of dictionaries that specify trait values:"},{"line_number":213,"context_line":""},{"line_number":214,"context_line":"    .. code-block:: python"}],"source_content_type":"text/x-python","patch_set":6,"id":"da20952f_e98c6181","line":211,"in_reply_to":"da20952f_da504661","updated":"2015-09-02 03:09:30.000000000","message":"will do","commit_id":"c450a85270d9f0c5eb696bcf334b0c099aff9753"}]}