)]}'
{"cinder/tests/unit/policy.json":[{"author":{"_account_id":4523,"name":"Eric Harney","email":"eharney@redhat.com","username":"eharney"},"change_message_id":"469e4f960775628807c70fbfa6a8ceeec8a5c594","unresolved":false,"context_lines":[{"line_number":42,"context_line":"    \"volume:failover_host\": \"rule:admin_api\","},{"line_number":43,"context_line":"    \"volume:freeze_host\": \"rule:admin_api\","},{"line_number":44,"context_line":"    \"volume:thaw_host\": \"rule:admin_api\","},{"line_number":45,"context_line":"    \"volume:attach\": \"\","},{"line_number":46,"context_line":"    \"volume:detach\": \"\","},{"line_number":47,"context_line":"    \"volume:reserve_volume\": \"\","},{"line_number":48,"context_line":"    \"volume:unreserve_volume\": \"\","}],"source_content_type":"application/json","patch_set":1,"id":"5ff73747_adbc8469","line":45,"updated":"2017-04-24 19:18:24.000000000","message":"Why are all of these empty?","commit_id":"4a00079976fc997ddafe225c4a834bb28dd25815"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"ee7cdc17d02f74d585033b18dc2523f9b345cdcc","unresolved":false,"context_lines":[{"line_number":42,"context_line":"    \"volume:failover_host\": \"rule:admin_api\","},{"line_number":43,"context_line":"    \"volume:freeze_host\": \"rule:admin_api\","},{"line_number":44,"context_line":"    \"volume:thaw_host\": \"rule:admin_api\","},{"line_number":45,"context_line":"    \"volume:attach\": \"\","},{"line_number":46,"context_line":"    \"volume:detach\": \"\","},{"line_number":47,"context_line":"    \"volume:reserve_volume\": \"\","},{"line_number":48,"context_line":"    \"volume:unreserve_volume\": \"\","}],"source_content_type":"application/json","patch_set":1,"id":"5ff73747_23f08590","line":45,"in_reply_to":"5ff73747_adbc8469","updated":"2017-04-24 20:14:33.000000000","message":"Done","commit_id":"4a00079976fc997ddafe225c4a834bb28dd25815"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"c7b780d3fd2035b292f31155237f6cd62fe1b0ca","unresolved":false,"context_lines":[{"line_number":42,"context_line":"    \"volume:failover_host\": \"rule:admin_api\","},{"line_number":43,"context_line":"    \"volume:freeze_host\": \"rule:admin_api\","},{"line_number":44,"context_line":"    \"volume:thaw_host\": \"rule:admin_api\","},{"line_number":45,"context_line":"    \"volume:attach\": \"rule:admin_or_owner\","},{"line_number":46,"context_line":"    \"volume:detach\": \"rule:admin_or_owner\","},{"line_number":47,"context_line":"    \"volume:reserve_volume\": \"rule:admin_or_owner\","},{"line_number":48,"context_line":"    \"volume:unreserve_volume\": \"rule:admin_or_owner\","},{"line_number":49,"context_line":"    \"volume:begin_detaching\": \"rule:admin_or_owner\","},{"line_number":50,"context_line":"    \"volume:roll_detaching\": \"rule:admin_or_owner\","},{"line_number":51,"context_line":"    \"volume:initialize_connection\": \"rule:admin_or_owner\","},{"line_number":52,"context_line":"    \"volume:terminate_connection\": \"rule:admin_or_owner\","},{"line_number":53,"context_line":"    \"volume:accept_transfer\": \"rule:admin_or_owner\","},{"line_number":54,"context_line":"    \"volume:get_volume_image_metadata\": \"rule:admin_or_owner\","},{"line_number":55,"context_line":"    \"volume:copy_volume_to_image\": \"rule:admin_or_owner\","},{"line_number":56,"context_line":"    \"volume:extend\": \"rule:admin_or_owner\","},{"line_number":57,"context_line":"    \"volume:migrate_volume\": \"rule:admin_or_owner\","},{"line_number":58,"context_line":"    \"volume:migrate_volume_completion\": \"rule:admin_or_owner\","},{"line_number":59,"context_line":"    \"volume:attachment_create\": \"rule:admin_or_owner\","},{"line_number":60,"context_line":"    \"volume:attachment_update\": \"rule:admin_or_owner\","},{"line_number":61,"context_line":"    \"volume:attachment_delete\": \"rule:admin_or_owner\","},{"line_number":62,"context_line":"    \"volume_extension:volume_admin_actions:reset_status\": \"rule:admin_api\","},{"line_number":63,"context_line":"    \"volume_extension:snapshot_admin_actions:reset_status\": \"rule:admin_api\","},{"line_number":64,"context_line":"    \"volume_extension:backup_admin_actions:reset_status\": \"rule:admin_api\","}],"source_content_type":"application/json","patch_set":2,"id":"5ff73747_c505e012","line":61,"range":{"start_line":45,"start_character":0,"end_line":61,"end_character":54},"updated":"2017-04-28 02:43:22.000000000","message":"Rather than duplicate all of these in a fake policy file for tests, why not use the real policy file with it\u0027s defaults?\n\nNova uses a fixture for using the real policy in tests:\n\nhttps://github.com/openstack/nova/blob/master/nova/tests/unit/policy_fixture.py#L30\n\nSeems like there should also be some kind of test that scans the code for anything using the wrap_policy_check decorator which checks a policy but doesn\u0027t have one defined in the sample policy.json. But that could maybe be done separately.","commit_id":"9e2f16cb8d02ddcbbe451d4660ef86ee0410a76a"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"30578599f7b36cc2974a6e08c265943bbecaeafe","unresolved":false,"context_lines":[{"line_number":42,"context_line":"    \"volume:failover_host\": \"rule:admin_api\","},{"line_number":43,"context_line":"    \"volume:freeze_host\": \"rule:admin_api\","},{"line_number":44,"context_line":"    \"volume:thaw_host\": \"rule:admin_api\","},{"line_number":45,"context_line":"    \"volume:attach\": \"rule:admin_or_owner\","},{"line_number":46,"context_line":"    \"volume:detach\": \"rule:admin_or_owner\","},{"line_number":47,"context_line":"    \"volume:reserve_volume\": \"rule:admin_or_owner\","},{"line_number":48,"context_line":"    \"volume:unreserve_volume\": \"rule:admin_or_owner\","},{"line_number":49,"context_line":"    \"volume:begin_detaching\": \"rule:admin_or_owner\","},{"line_number":50,"context_line":"    \"volume:roll_detaching\": \"rule:admin_or_owner\","},{"line_number":51,"context_line":"    \"volume:initialize_connection\": \"rule:admin_or_owner\","},{"line_number":52,"context_line":"    \"volume:terminate_connection\": \"rule:admin_or_owner\","},{"line_number":53,"context_line":"    \"volume:accept_transfer\": \"rule:admin_or_owner\","},{"line_number":54,"context_line":"    \"volume:get_volume_image_metadata\": \"rule:admin_or_owner\","},{"line_number":55,"context_line":"    \"volume:copy_volume_to_image\": \"rule:admin_or_owner\","},{"line_number":56,"context_line":"    \"volume:extend\": \"rule:admin_or_owner\","},{"line_number":57,"context_line":"    \"volume:migrate_volume\": \"rule:admin_or_owner\","},{"line_number":58,"context_line":"    \"volume:migrate_volume_completion\": \"rule:admin_or_owner\","},{"line_number":59,"context_line":"    \"volume:attachment_create\": \"rule:admin_or_owner\","},{"line_number":60,"context_line":"    \"volume:attachment_update\": \"rule:admin_or_owner\","},{"line_number":61,"context_line":"    \"volume:attachment_delete\": \"rule:admin_or_owner\","},{"line_number":62,"context_line":"    \"volume_extension:volume_admin_actions:reset_status\": \"rule:admin_api\","},{"line_number":63,"context_line":"    \"volume_extension:snapshot_admin_actions:reset_status\": \"rule:admin_api\","},{"line_number":64,"context_line":"    \"volume_extension:backup_admin_actions:reset_status\": \"rule:admin_api\","}],"source_content_type":"application/json","patch_set":2,"id":"5ff73747_08307de7","line":61,"range":{"start_line":45,"start_character":0,"end_line":61,"end_character":54},"in_reply_to":"5ff73747_c505e012","updated":"2017-04-28 03:41:39.000000000","message":"Makes sense, I\u0027ll address that in a future patch.","commit_id":"9e2f16cb8d02ddcbbe451d4660ef86ee0410a76a"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"838ea423eeb9647cccc885551eb9c89f0174eefd","unresolved":false,"context_lines":[{"line_number":52,"context_line":"    \"volume:terminate_connection\": \"rule:admin_or_owner\","},{"line_number":53,"context_line":"    \"volume:get_volume_image_metadata\": \"rule:admin_or_owner\","},{"line_number":54,"context_line":"    \"volume:copy_volume_to_image\": \"rule:admin_or_owner\","},{"line_number":55,"context_line":"    \"volume:migrate_volume\": \"rule:admin_api\","},{"line_number":56,"context_line":"    \"volume:migrate_volume_completion\": \"rule:admin_api\","},{"line_number":57,"context_line":"    \"volume:attachment_create\": \"rule:admin_or_owner\","},{"line_number":58,"context_line":"    \"volume:attachment_update\": \"rule:admin_or_owner\","},{"line_number":59,"context_line":"    \"volume:attachment_delete\": \"rule:admin_or_owner\","}],"source_content_type":"application/json","patch_set":3,"id":"5ff73747_e838b1a0","line":56,"range":{"start_line":55,"start_character":4,"end_line":56,"end_character":57},"updated":"2017-04-28 03:45:12.000000000","message":"These are also duplicates with L37-38 above (but not the case with the non-test policy.json).","commit_id":"8aae83e2b0d5f2d9a6201abc1c03a0c1f125efb1"}],"etc/cinder/policy.json":[{"author":{"_account_id":4523,"name":"Eric Harney","email":"eharney@redhat.com","username":"eharney"},"change_message_id":"469e4f960775628807c70fbfa6a8ceeec8a5c594","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"admin_or_owner\":  \"is_admin:True or (role:admin and is_admin_project:True) or  project_id:%(project_id)s\","},{"line_number":3,"context_line":"    \"default\": \"rule:admin_or_owner\","},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"    \"admin_api\": \"is_admin:True or (role:admin and is_admin_project:True)\","},{"line_number":6,"context_line":""}],"source_content_type":"application/json","patch_set":1,"id":"5ff73747_8d88a8c6","line":3,"range":{"start_line":3,"start_character":4,"end_line":3,"end_character":36},"updated":"2017-04-24 19:18:24.000000000","message":"Why do we need to add all of the below rules when they are (correctly) using this default?\n\nIMO we should be removing any that are just \"rule:admin_or_owner\".","commit_id":"4a00079976fc997ddafe225c4a834bb28dd25815"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"ee7cdc17d02f74d585033b18dc2523f9b345cdcc","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"admin_or_owner\":  \"is_admin:True or (role:admin and is_admin_project:True) or  project_id:%(project_id)s\","},{"line_number":3,"context_line":"    \"default\": \"rule:admin_or_owner\","},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"    \"admin_api\": \"is_admin:True or (role:admin and is_admin_project:True)\","},{"line_number":6,"context_line":""}],"source_content_type":"application/json","patch_set":1,"id":"5ff73747_a388151f","line":3,"range":{"start_line":3,"start_character":4,"end_line":3,"end_character":36},"in_reply_to":"5ff73747_8d88a8c6","updated":"2017-04-24 20:14:33.000000000","message":"Because it\u0027s extremely difficult for OpenStack non-developers to know which policies they even can override. You have to look at the code to know which policies are valid and therefore available to be overridden.\n\nIn other words, while functionally this change doesn\u0027t do anything, it sheds light on available policy actions enforced by Cinder. This allows for much easier RBAC testing, for example, as the policy actions can be presumed to exist.","commit_id":"4a00079976fc997ddafe225c4a834bb28dd25815"},{"author":{"_account_id":23276,"name":"Nicholas Jones","email":"nj762h@att.com","username":"nj762h"},"change_message_id":"e975840c4349077695efe0d188e3b8c7903fb4e2","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"admin_or_owner\":  \"is_admin:True or (role:admin and is_admin_project:True) or  project_id:%(project_id)s\","},{"line_number":3,"context_line":"    \"default\": \"rule:admin_or_owner\","},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"    \"admin_api\": \"is_admin:True or (role:admin and is_admin_project:True)\","},{"line_number":6,"context_line":""}],"source_content_type":"application/json","patch_set":1,"id":"5ff73747_a8220ea3","line":3,"range":{"start_line":3,"start_character":4,"end_line":3,"end_character":36},"in_reply_to":"5ff73747_a388151f","updated":"2017-04-25 16:30:04.000000000","message":"This sounds like an opportunity to improve the documentation, rather than a do-nothing code change.","commit_id":"4a00079976fc997ddafe225c4a834bb28dd25815"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"0872bc48f718134f13eb8b437dcc24491adba2fb","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"admin_or_owner\":  \"is_admin:True or (role:admin and is_admin_project:True) or  project_id:%(project_id)s\","},{"line_number":3,"context_line":"    \"default\": \"rule:admin_or_owner\","},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"    \"admin_api\": \"is_admin:True or (role:admin and is_admin_project:True)\","},{"line_number":6,"context_line":""}],"source_content_type":"application/json","patch_set":1,"id":"5ff73747_826fcefa","line":3,"range":{"start_line":3,"start_character":4,"end_line":3,"end_character":36},"in_reply_to":"5ff73747_a8220ea3","updated":"2017-04-28 02:36:22.000000000","message":"@Nicholas, this *is* the documentation for the Cinder policy. That\u0027s why Felipe is trying to fill it in.","commit_id":"4a00079976fc997ddafe225c4a834bb28dd25815"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"a455b8b7388fb771a7f0e341f7139cb64a2fb3a2","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"admin_or_owner\":  \"is_admin:True or (role:admin and is_admin_project:True) or  project_id:%(project_id)s\","},{"line_number":3,"context_line":"    \"default\": \"rule:admin_or_owner\","},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"    \"admin_api\": \"is_admin:True or (role:admin and is_admin_project:True)\","},{"line_number":6,"context_line":""}],"source_content_type":"application/json","patch_set":1,"id":"5ff73747_62b3a299","line":3,"range":{"start_line":3,"start_character":4,"end_line":3,"end_character":36},"in_reply_to":"5ff73747_a8220ea3","updated":"2017-04-28 02:35:21.000000000","message":"Eric, Felipe, check this nova spec out:\n\nhttps://specs.openstack.org/openstack/nova-specs/specs/pike/approved/policy-docs.html\n\nThe nova policy is all in code since the last few releases, like configuration options. That enables us to document the policy rules, which now looks like this:\n\nhttps://docs.openstack.org/developer/nova/sample_policy.html\n\nSo now as an operator you know what the policy rules actually are, which APIs use them, and a description of the operation.\n\nTelling operators to dig through the code to figure out how to define their policy file is the wrong direction.","commit_id":"4a00079976fc997ddafe225c4a834bb28dd25815"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"c7b780d3fd2035b292f31155237f6cd62fe1b0ca","unresolved":false,"context_lines":[{"line_number":24,"context_line":"    \"volume:get_snapshot_metadata\": \"rule:admin_or_owner\","},{"line_number":25,"context_line":"    \"volume:delete_snapshot_metadata\": \"rule:admin_or_owner\","},{"line_number":26,"context_line":"    \"volume:update_snapshot_metadata\": \"rule:admin_or_owner\","},{"line_number":27,"context_line":"    \"volume:extend\": \"rule:admin_or_owner\","},{"line_number":28,"context_line":"    \"volume:update_readonly_flag\": \"rule:admin_or_owner\","},{"line_number":29,"context_line":"    \"volume:retype\": \"rule:admin_or_owner\","},{"line_number":30,"context_line":"    \"volume:update\": \"rule:admin_or_owner\","}],"source_content_type":"application/json","patch_set":2,"id":"5ff73747_823d8ede","line":27,"updated":"2017-04-28 02:43:22.000000000","message":"This is already defined.","commit_id":"9e2f16cb8d02ddcbbe451d4660ef86ee0410a76a"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"30578599f7b36cc2974a6e08c265943bbecaeafe","unresolved":false,"context_lines":[{"line_number":24,"context_line":"    \"volume:get_snapshot_metadata\": \"rule:admin_or_owner\","},{"line_number":25,"context_line":"    \"volume:delete_snapshot_metadata\": \"rule:admin_or_owner\","},{"line_number":26,"context_line":"    \"volume:update_snapshot_metadata\": \"rule:admin_or_owner\","},{"line_number":27,"context_line":"    \"volume:extend\": \"rule:admin_or_owner\","},{"line_number":28,"context_line":"    \"volume:update_readonly_flag\": \"rule:admin_or_owner\","},{"line_number":29,"context_line":"    \"volume:retype\": \"rule:admin_or_owner\","},{"line_number":30,"context_line":"    \"volume:update\": \"rule:admin_or_owner\","}],"source_content_type":"application/json","patch_set":2,"id":"5ff73747_a543f46b","line":27,"in_reply_to":"5ff73747_823d8ede","updated":"2017-04-28 03:41:39.000000000","message":"Done","commit_id":"9e2f16cb8d02ddcbbe451d4660ef86ee0410a76a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"c7b780d3fd2035b292f31155237f6cd62fe1b0ca","unresolved":false,"context_lines":[{"line_number":36,"context_line":"    \"volume:roll_detaching\": \"rule:admin_or_owner\","},{"line_number":37,"context_line":"    \"volume:initialize_connection\": \"rule:admin_or_owner\","},{"line_number":38,"context_line":"    \"volume:terminate_connection\": \"rule:admin_or_owner\","},{"line_number":39,"context_line":"    \"volume:accept_transfer\": \"rule:admin_or_owner\","},{"line_number":40,"context_line":"    \"volume:get_volume_image_metadata\": \"rule:admin_or_owner\","},{"line_number":41,"context_line":"    \"volume:copy_volume_to_image\": \"rule:admin_or_owner\","},{"line_number":42,"context_line":"    \"volume:extend\": \"rule:admin_or_owner\","}],"source_content_type":"application/json","patch_set":2,"id":"5ff73747_422306be","line":39,"updated":"2017-04-28 02:43:22.000000000","message":"This is a duplicate.","commit_id":"9e2f16cb8d02ddcbbe451d4660ef86ee0410a76a"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"30578599f7b36cc2974a6e08c265943bbecaeafe","unresolved":false,"context_lines":[{"line_number":36,"context_line":"    \"volume:roll_detaching\": \"rule:admin_or_owner\","},{"line_number":37,"context_line":"    \"volume:initialize_connection\": \"rule:admin_or_owner\","},{"line_number":38,"context_line":"    \"volume:terminate_connection\": \"rule:admin_or_owner\","},{"line_number":39,"context_line":"    \"volume:accept_transfer\": \"rule:admin_or_owner\","},{"line_number":40,"context_line":"    \"volume:get_volume_image_metadata\": \"rule:admin_or_owner\","},{"line_number":41,"context_line":"    \"volume:copy_volume_to_image\": \"rule:admin_or_owner\","},{"line_number":42,"context_line":"    \"volume:extend\": \"rule:admin_or_owner\","}],"source_content_type":"application/json","patch_set":2,"id":"5ff73747_c552803b","line":39,"in_reply_to":"5ff73747_422306be","updated":"2017-04-28 03:41:39.000000000","message":"Done","commit_id":"9e2f16cb8d02ddcbbe451d4660ef86ee0410a76a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"c7b780d3fd2035b292f31155237f6cd62fe1b0ca","unresolved":false,"context_lines":[{"line_number":39,"context_line":"    \"volume:accept_transfer\": \"rule:admin_or_owner\","},{"line_number":40,"context_line":"    \"volume:get_volume_image_metadata\": \"rule:admin_or_owner\","},{"line_number":41,"context_line":"    \"volume:copy_volume_to_image\": \"rule:admin_or_owner\","},{"line_number":42,"context_line":"    \"volume:extend\": \"rule:admin_or_owner\","},{"line_number":43,"context_line":"    \"volume:migrate_volume\": \"rule:admin_or_owner\","},{"line_number":44,"context_line":"    \"volume:migrate_volume_completion\": \"rule:admin_or_owner\","},{"line_number":45,"context_line":"    \"volume:attachment_create\": \"rule:admin_or_owner\","}],"source_content_type":"application/json","patch_set":2,"id":"5ff73747_222c7aaa","line":42,"updated":"2017-04-28 02:43:22.000000000","message":"Duplicate.","commit_id":"9e2f16cb8d02ddcbbe451d4660ef86ee0410a76a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"c7b780d3fd2035b292f31155237f6cd62fe1b0ca","unresolved":false,"context_lines":[{"line_number":40,"context_line":"    \"volume:get_volume_image_metadata\": \"rule:admin_or_owner\","},{"line_number":41,"context_line":"    \"volume:copy_volume_to_image\": \"rule:admin_or_owner\","},{"line_number":42,"context_line":"    \"volume:extend\": \"rule:admin_or_owner\","},{"line_number":43,"context_line":"    \"volume:migrate_volume\": \"rule:admin_or_owner\","},{"line_number":44,"context_line":"    \"volume:migrate_volume_completion\": \"rule:admin_or_owner\","},{"line_number":45,"context_line":"    \"volume:attachment_create\": \"rule:admin_or_owner\","},{"line_number":46,"context_line":"    \"volume:attachment_update\": \"rule:admin_or_owner\","}],"source_content_type":"application/json","patch_set":2,"id":"5ff73747_02297e99","line":43,"range":{"start_line":43,"start_character":12,"end_line":43,"end_character":26},"updated":"2017-04-28 02:43:22.000000000","message":"This is defined below and is admin-only by default.","commit_id":"9e2f16cb8d02ddcbbe451d4660ef86ee0410a76a"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"30578599f7b36cc2974a6e08c265943bbecaeafe","unresolved":false,"context_lines":[{"line_number":40,"context_line":"    \"volume:get_volume_image_metadata\": \"rule:admin_or_owner\","},{"line_number":41,"context_line":"    \"volume:copy_volume_to_image\": \"rule:admin_or_owner\","},{"line_number":42,"context_line":"    \"volume:extend\": \"rule:admin_or_owner\","},{"line_number":43,"context_line":"    \"volume:migrate_volume\": \"rule:admin_or_owner\","},{"line_number":44,"context_line":"    \"volume:migrate_volume_completion\": \"rule:admin_or_owner\","},{"line_number":45,"context_line":"    \"volume:attachment_create\": \"rule:admin_or_owner\","},{"line_number":46,"context_line":"    \"volume:attachment_update\": \"rule:admin_or_owner\","}],"source_content_type":"application/json","patch_set":2,"id":"5ff73747_457550ca","line":43,"range":{"start_line":43,"start_character":12,"end_line":43,"end_character":26},"in_reply_to":"5ff73747_02297e99","updated":"2017-04-28 03:41:39.000000000","message":"I have two thoughts here:\n\n1) I\u0027m guessing it\u0027s admin_api because of [0].\n2) However, I do not believe it\u0027s a duplicate with the admin_actions version you commented under with \"duplicate?\" \n\nI believe this is true because [1] enforces \"volume:migrate_volume\" (if you trace up to [2] to see that policy enforcement is done for func.__name__ which in this case is migrate_volume). However, the admin_actions version is enforced here [3] and if you trace to [4] you\u0027ll see that the policy being enforced is the admin_actions variety.\n\n[0] https://github.com/openstack/cinder/blob/686b11be242b1bccd42fd16e74c29d6b7367f95b/cinder/tests/unit/policy.json#L37\n[1] https://github.com/openstack/cinder/blob/master/cinder/volume/api.py#L1371\n[2] https://github.com/openstack/cinder/blob/master/cinder/volume/api.py#L92\n[3] https://github.com/openstack/cinder/blob/6fff3565211b10a86c46f64d3a180024f5c80bde/cinder/api/contrib/admin_actions.py#L242\n[4] https://github.com/openstack/cinder/blob/6fff3565211b10a86c46f64d3a180024f5c80bde/cinder/api/contrib/admin_actions.py#L80","commit_id":"9e2f16cb8d02ddcbbe451d4660ef86ee0410a76a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"c7b780d3fd2035b292f31155237f6cd62fe1b0ca","unresolved":false,"context_lines":[{"line_number":41,"context_line":"    \"volume:copy_volume_to_image\": \"rule:admin_or_owner\","},{"line_number":42,"context_line":"    \"volume:extend\": \"rule:admin_or_owner\","},{"line_number":43,"context_line":"    \"volume:migrate_volume\": \"rule:admin_or_owner\","},{"line_number":44,"context_line":"    \"volume:migrate_volume_completion\": \"rule:admin_or_owner\","},{"line_number":45,"context_line":"    \"volume:attachment_create\": \"rule:admin_or_owner\","},{"line_number":46,"context_line":"    \"volume:attachment_update\": \"rule:admin_or_owner\","},{"line_number":47,"context_line":"    \"volume:attachment_delete\": \"rule:admin_or_owner\","}],"source_content_type":"application/json","patch_set":2,"id":"5ff73747_c23716ff","line":44,"updated":"2017-04-28 02:43:22.000000000","message":"This one should be an admin only by default, see below.","commit_id":"9e2f16cb8d02ddcbbe451d4660ef86ee0410a76a"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"30578599f7b36cc2974a6e08c265943bbecaeafe","unresolved":false,"context_lines":[{"line_number":41,"context_line":"    \"volume:copy_volume_to_image\": \"rule:admin_or_owner\","},{"line_number":42,"context_line":"    \"volume:extend\": \"rule:admin_or_owner\","},{"line_number":43,"context_line":"    \"volume:migrate_volume\": \"rule:admin_or_owner\","},{"line_number":44,"context_line":"    \"volume:migrate_volume_completion\": \"rule:admin_or_owner\","},{"line_number":45,"context_line":"    \"volume:attachment_create\": \"rule:admin_or_owner\","},{"line_number":46,"context_line":"    \"volume:attachment_update\": \"rule:admin_or_owner\","},{"line_number":47,"context_line":"    \"volume:attachment_delete\": \"rule:admin_or_owner\","}],"source_content_type":"application/json","patch_set":2,"id":"5ff73747_65616c05","line":44,"in_reply_to":"5ff73747_c23716ff","updated":"2017-04-28 03:41:39.000000000","message":"Done","commit_id":"9e2f16cb8d02ddcbbe451d4660ef86ee0410a76a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"c7b780d3fd2035b292f31155237f6cd62fe1b0ca","unresolved":false,"context_lines":[{"line_number":72,"context_line":"    \"volume_extension:snapshot_admin_actions:force_delete\": \"rule:admin_api\","},{"line_number":73,"context_line":"    \"volume_extension:backup_admin_actions:force_delete\": \"rule:admin_api\","},{"line_number":74,"context_line":"    \"volume_extension:volume_admin_actions:migrate_volume\": \"rule:admin_api\","},{"line_number":75,"context_line":"    \"volume_extension:volume_admin_actions:migrate_volume_completion\": \"rule:admin_api\","},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"    \"volume_extension:volume_actions:upload_public\": \"rule:admin_api\","},{"line_number":78,"context_line":"    \"volume_extension:volume_actions:upload_image\": \"rule:admin_or_owner\","}],"source_content_type":"application/json","patch_set":2,"id":"5ff73747_2257da28","line":75,"range":{"start_line":75,"start_character":43,"end_line":75,"end_character":68},"updated":"2017-04-28 02:43:22.000000000","message":"duplicate?","commit_id":"9e2f16cb8d02ddcbbe451d4660ef86ee0410a76a"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"30578599f7b36cc2974a6e08c265943bbecaeafe","unresolved":false,"context_lines":[{"line_number":72,"context_line":"    \"volume_extension:snapshot_admin_actions:force_delete\": \"rule:admin_api\","},{"line_number":73,"context_line":"    \"volume_extension:backup_admin_actions:force_delete\": \"rule:admin_api\","},{"line_number":74,"context_line":"    \"volume_extension:volume_admin_actions:migrate_volume\": \"rule:admin_api\","},{"line_number":75,"context_line":"    \"volume_extension:volume_admin_actions:migrate_volume_completion\": \"rule:admin_api\","},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"    \"volume_extension:volume_actions:upload_public\": \"rule:admin_api\","},{"line_number":78,"context_line":"    \"volume_extension:volume_actions:upload_image\": \"rule:admin_or_owner\","}],"source_content_type":"application/json","patch_set":2,"id":"5ff73747_0554e81f","line":75,"range":{"start_line":75,"start_character":43,"end_line":75,"end_character":68},"in_reply_to":"5ff73747_2257da28","updated":"2017-04-28 03:41:39.000000000","message":"Addressed above.","commit_id":"9e2f16cb8d02ddcbbe451d4660ef86ee0410a76a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"c7b780d3fd2035b292f31155237f6cd62fe1b0ca","unresolved":false,"context_lines":[{"line_number":91,"context_line":"    \"volume_extension:capabilities\": \"rule:admin_api\","},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"    \"volume:create_transfer\": \"rule:admin_or_owner\","},{"line_number":94,"context_line":"    \"volume:accept_transfer\": \"\","},{"line_number":95,"context_line":"    \"volume:delete_transfer\": \"rule:admin_or_owner\","},{"line_number":96,"context_line":"    \"volume:get_transfer\": \"rule:admin_or_owner\","},{"line_number":97,"context_line":"    \"volume:get_all_transfers\": \"rule:admin_or_owner\","}],"source_content_type":"application/json","patch_set":2,"id":"5ff73747_622602d1","line":94,"updated":"2017-04-28 02:43:22.000000000","message":"This is already defined.","commit_id":"9e2f16cb8d02ddcbbe451d4660ef86ee0410a76a"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"30578599f7b36cc2974a6e08c265943bbecaeafe","unresolved":false,"context_lines":[{"line_number":91,"context_line":"    \"volume_extension:capabilities\": \"rule:admin_api\","},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"    \"volume:create_transfer\": \"rule:admin_or_owner\","},{"line_number":94,"context_line":"    \"volume:accept_transfer\": \"\","},{"line_number":95,"context_line":"    \"volume:delete_transfer\": \"rule:admin_or_owner\","},{"line_number":96,"context_line":"    \"volume:get_transfer\": \"rule:admin_or_owner\","},{"line_number":97,"context_line":"    \"volume:get_all_transfers\": \"rule:admin_or_owner\","}],"source_content_type":"application/json","patch_set":2,"id":"5ff73747_e5321c10","line":94,"in_reply_to":"5ff73747_622602d1","updated":"2017-04-28 03:41:39.000000000","message":"Done","commit_id":"9e2f16cb8d02ddcbbe451d4660ef86ee0410a76a"}]}