)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"1633324c67d6aa746a76c6466484dbc18c92ff41","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"fix events rbac"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"ensure policy rbac configured configured correctly."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Closes-Bug: #1504495"},{"line_number":12,"context_line":"Change-Id: Id3b1ad71aea46456c6e6c1995776b988017d4786"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"5a2ca52d_8fd1df59","line":9,"updated":"2015-10-15 10:47:50.000000000","message":"s/configured/is/ ?","commit_id":"3cea7893edf5d75af97327f5e78eddfedcc36e4d"},{"author":{"_account_id":9526,"name":"Zi Lian Ji","email":"jizilian@cn.ibm.com","username":"jizilian"},"change_message_id":"3dda19e2367e1302c1c1216ef11a6d4b6c1efde7","unresolved":false,"context_lines":[{"line_number":9,"context_line":"rbac context is limited not by policy but is inherently built in"},{"line_number":10,"context_line":"as we cannot enforce policy on a list."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"thsi patch drops the dummy policy, the invalid context_is_project"},{"line_number":13,"context_line":"and context_is_admin policies, and ensures policy rbac can restrict"},{"line_number":14,"context_line":"on admin appropriately."},{"line_number":15,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":7,"id":"3a7e1126_65da21ea","line":12,"range":{"start_line":12,"start_character":0,"end_line":12,"end_character":4},"updated":"2015-12-21 13:53:28.000000000","message":"s/thsi/this","commit_id":"ac9932cb388bddebebbd13601867f65392a83d0a"}],"ceilometer/api/rbac.py":[{"author":{"_account_id":2813,"name":"Mehdi Abaakouk","email":"sileht@sileht.net","username":"sileht"},"change_message_id":"f6f6134ab70bf4b716c3c7ac5d20c2d6f097484c","unresolved":false,"context_lines":[{"line_number":55,"context_line":"    policy_dict \u003d dict()"},{"line_number":56,"context_line":"    policy_dict[\u0027roles\u0027] \u003d headers.get(\u0027X-Roles\u0027, \"\").split(\",\")"},{"line_number":57,"context_line":"    policy_dict[\u0027target.user_id\u0027] \u003d (headers.get(\u0027X-User-Id\u0027))"},{"line_number":58,"context_line":"    policy_dict[\u0027target.project_id\u0027] \u003d (headers.get(\u0027X-Project-Id\u0027))"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"    # maintain backward compat with Juno and previous by allowing the action if"},{"line_number":61,"context_line":"    # there is no rule defined for it"}],"source_content_type":"text/x-python","patch_set":4,"id":"9a8ffd7b_c0f8b1c5","side":"PARENT","line":58,"updated":"2015-11-27 13:08:17.000000000","message":"Shouldn\u0027t we keep target.user_id and target.project_id for backward compatibility ? Otherwise already deployed configuration with target.XXX inside will be broken ? Or perhaps target.XXX have never works and then I\u0027m good with this change.","commit_id":"400ea6ecb18c8261f2e7c778a78d16cf1813ea27"},{"author":{"_account_id":6537,"name":"gordon chung","email":"gord@live.ca","username":"chungg"},"change_message_id":"622125d887b5d7b3d8f3745538fa5250d120500a","unresolved":false,"context_lines":[{"line_number":55,"context_line":"    policy_dict \u003d dict()"},{"line_number":56,"context_line":"    policy_dict[\u0027roles\u0027] \u003d headers.get(\u0027X-Roles\u0027, \"\").split(\",\")"},{"line_number":57,"context_line":"    policy_dict[\u0027target.user_id\u0027] \u003d (headers.get(\u0027X-User-Id\u0027))"},{"line_number":58,"context_line":"    policy_dict[\u0027target.project_id\u0027] \u003d (headers.get(\u0027X-Project-Id\u0027))"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"    # maintain backward compat with Juno and previous by allowing the action if"},{"line_number":61,"context_line":"    # there is no rule defined for it"}],"source_content_type":"text/x-python","patch_set":4,"id":"9a8ffd7b_f7bed8ac","side":"PARENT","line":58,"in_reply_to":"9a8ffd7b_c0f8b1c5","updated":"2015-11-27 13:37:53.000000000","message":"it never worked... or i don\u0027t know enough about oslo.policy","commit_id":"400ea6ecb18c8261f2e7c778a78d16cf1813ea27"},{"author":{"_account_id":2813,"name":"Mehdi Abaakouk","email":"sileht@sileht.net","username":"sileht"},"change_message_id":"d8413b9c722b84ba509e7725e04c86a5de80bb82","unresolved":false,"context_lines":[{"line_number":55,"context_line":"    policy_dict \u003d dict()"},{"line_number":56,"context_line":"    policy_dict[\u0027roles\u0027] \u003d headers.get(\u0027X-Roles\u0027, \"\").split(\",\")"},{"line_number":57,"context_line":"    policy_dict[\u0027target.user_id\u0027] \u003d (headers.get(\u0027X-User-Id\u0027))"},{"line_number":58,"context_line":"    policy_dict[\u0027target.project_id\u0027] \u003d (headers.get(\u0027X-Project-Id\u0027))"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"    # maintain backward compat with Juno and previous by allowing the action if"},{"line_number":61,"context_line":"    # there is no rule defined for it"}],"source_content_type":"text/x-python","patch_set":4,"id":"9a8ffd7b_9d076b81","side":"PARENT","line":58,"in_reply_to":"9a8ffd7b_f7bed8ac","updated":"2015-11-27 14:14:45.000000000","message":"The enforce method should be used like this:\n\n_ENFORCER.enforce(\"rule/action name\", \"object that come from a DB\", \"context (usually creds)\")\n\nso if we put the policy_dict in second and third argument, the enforce method will always succeed.\n\nThe second arguments must be the resource, sample or the event returned.\n\nAlso rule like \"project_id:%(target.project_id)s\" can\u0027t be used with a action that return a list.\n\nI\u0027m ok to rename target.XXXX in XXXX in all case.\n\nBut we also need to pass the event/sample/resource to this method when we can, or just drop \"context_is_project\" and \"context_is_owner\" from the policy files.\nInstead of letting people thinking that our rbac system can do a per user/project filtering for sample/resource/event.","commit_id":"400ea6ecb18c8261f2e7c778a78d16cf1813ea27"},{"author":{"_account_id":2813,"name":"Mehdi Abaakouk","email":"sileht@sileht.net","username":"sileht"},"change_message_id":"f6f6134ab70bf4b716c3c7ac5d20c2d6f097484c","unresolved":false,"context_lines":[{"line_number":83,"context_line":"    policy_dict \u003d dict()"},{"line_number":84,"context_line":"    policy_dict[\u0027roles\u0027] \u003d headers.get(\u0027X-Roles\u0027, \"\").split(\",\")"},{"line_number":85,"context_line":"    policy_dict[\u0027target.user_id\u0027] \u003d (headers.get(\u0027X-User-Id\u0027))"},{"line_number":86,"context_line":"    policy_dict[\u0027target.project_id\u0027] \u003d (headers.get(\u0027X-Project-Id\u0027))"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"    # maintain backward compat with Juno and previous by using context_is_admin"},{"line_number":89,"context_line":"    # rule if the segregation rule (added in Kilo) is not defined"}],"source_content_type":"text/x-python","patch_set":4,"id":"9a8ffd7b_6001c5ae","side":"PARENT","line":86,"updated":"2015-11-27 13:08:17.000000000","message":"Same here.","commit_id":"400ea6ecb18c8261f2e7c778a78d16cf1813ea27"},{"author":{"_account_id":2813,"name":"Mehdi Abaakouk","email":"sileht@sileht.net","username":"sileht"},"change_message_id":"6a43edae8c196673b58d64776e6dd4cbe49511ec","unresolved":false,"context_lines":[{"line_number":35,"context_line":"def _has_rule(name):"},{"line_number":36,"context_line":"    return name in _ENFORCER.rules.keys()"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"def enforce(policy_name, request):"},{"line_number":40,"context_line":"    \"\"\"Return the user and project the request should be limited to."},{"line_number":41,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"7a740942_22bd1ab7","line":38,"updated":"2015-12-07 21:36:58.000000000","message":"I think you can completely drop this method.","commit_id":"1d1f35f63fc92c47c7b6eb5a52c819e70a615dfd"},{"author":{"_account_id":6537,"name":"gordon chung","email":"gord@live.ca","username":"chungg"},"change_message_id":"6268cb496f45911d97fd5548d748d2b5730767b0","unresolved":false,"context_lines":[{"line_number":35,"context_line":"def _has_rule(name):"},{"line_number":36,"context_line":"    return name in _ENFORCER.rules.keys()"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"def enforce(policy_name, request):"},{"line_number":40,"context_line":"    \"\"\"Return the user and project the request should be limited to."},{"line_number":41,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"7a740942_eb0e0d8b","line":38,"in_reply_to":"7a740942_22bd1ab7","updated":"2015-12-07 23:02:27.000000000","message":"def enforce? we can still enforce admin or not","commit_id":"1d1f35f63fc92c47c7b6eb5a52c819e70a615dfd"}]}