)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":12393,"name":"chandan kumar","display_name":"Chandan Kumar","email":"chkumar@redhat.com","username":"chkumar246"},"change_message_id":"5dc19acb193083dde3bb5986242c6108ec63be9e","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"7761a6cc_b2b54105","updated":"2026-06-29 09:38:14.000000000","message":"Looks good,\n\n-get_one and get_all are now using project manager scope while program is using admin scope.\n\nAll of them have deprecated rule pointing to admin_api.","commit_id":"5422d1ca421b2ce779f6707dfec44970c1d5515e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8b93f1968f216ac9138232ba23d07dd8d26bc5e2","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"3fdbd710_2de32aba","updated":"2026-06-22 08:35:20.000000000","message":"teim-ci: auto","commit_id":"5422d1ca421b2ce779f6707dfec44970c1d5515e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"4b7d53265db051b0fcbdcd1b60fd6a8b75b255a6","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"91c0c7f1_553426e7","updated":"2026-06-22 23:45:48.000000000","message":"teim-ci: auto","commit_id":"5422d1ca421b2ce779f6707dfec44970c1d5515e"},{"author":{"_account_id":12393,"name":"chandan kumar","display_name":"Chandan Kumar","email":"chkumar@redhat.com","username":"chkumar246"},"change_message_id":"c8e8f9e14c3668f898d7e52a705a55d95bfd303f","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"c9f7974c_adab5d82","in_reply_to":"7761a6cc_b2b54105","updated":"2026-06-29 10:10:17.000000000","message":"Tempest results from cyborg-tempest-srbac https://review.opendev.org/c/openstack/cyborg/+/992332 \nhttps://5126e99bb555fcd10074-f8d3aa66ce3962c6e3c5c35044bdfdd4.ssl.cf1.rackcdn.com/openstack/21ccea317c924406b12ce9ab3cc22cc5/job-output.txt\n```\n  SRBAC tests for deployables:\n  - test_admin_can_read_deployables — ok (admin via implied manager)\n  - test_reader_cannot_list_deployables — ok (reader lacks manager)\n  - test_member_cannot_list_deployables — ok (member lacks manager)\n\n```","commit_id":"5422d1ca421b2ce779f6707dfec44970c1d5515e"}],"cyborg/policies/deployables.py":[{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"277888c1c1e013646a6544f6803ca6ec22280030","unresolved":false,"context_lines":[{"line_number":40,"context_line":"    name\u003d\u0027cyborg:deployable:program\u0027,"},{"line_number":41,"context_line":"    check_str\u003d\u0027rule:admin_api\u0027,"},{"line_number":42,"context_line":"    deprecated_reason\u003d("},{"line_number":43,"context_line":"        \u0027rule:admin_api is retained as the default for deployable \u0027"},{"line_number":44,"context_line":"        \u0027program as FPGA bitstream reprogramming affects shared \u0027"},{"line_number":45,"context_line":"        \u0027physical infrastructure\u0027"},{"line_number":46,"context_line":"    ),"}],"source_content_type":"text/x-python","patch_set":4,"id":"a5c79680_ec74fba4","line":43,"updated":"2026-06-23 00:42:16.000000000","message":"The program deprecated_reason says rule:admin_api is retained, but since the new check_str (base.ADMIN) equals the deprecated check_str (rule:admin_api), the DeprecatedRule is a functional no-op. The reason text is misleading about what transition is occurring.\n\n**Severity**: SUGGESTION | **Confidence**: 0.9\n\n**Benefit**: Clarity for operators reading deprecation warnings. The current text implies the old rule is being replaced, but the effective check string is unchanged. A clearer reason would explain the format migration while noting admin-only access is retained.\n\n**Recommendation**:\nConsider rewording the deprecated_reason to clarify that the policy format is migrating to DocumentedRuleDefault but the access requirement (admin-only) is unchanged, e.g., The deployable program policy is migrated to DocumentedRuleDefault format and admin-only access is retained since FPGA bitstream reprogramming affects shared physical infrastructure.","commit_id":"5422d1ca421b2ce779f6707dfec44970c1d5515e"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"b98b807acc70198330f9e097640235b35f02afc9","unresolved":false,"context_lines":[{"line_number":37,"context_line":"    ),"},{"line_number":38,"context_line":"    deprecated_since\u003dversionutils.deprecated.GAZPACHO,"},{"line_number":39,"context_line":")"},{"line_number":40,"context_line":"deprecated_program \u003d policy.DeprecatedRule("},{"line_number":41,"context_line":"    name\u003d\u0027cyborg:deployable:program\u0027,"},{"line_number":42,"context_line":"    check_str\u003d\u0027rule:admin_api\u0027,"},{"line_number":43,"context_line":"    deprecated_reason\u003d("}],"source_content_type":"text/x-python","patch_set":7,"id":"7a046840_6e6ec0c8","line":40,"updated":"2026-07-21 11:32:50.000000000","message":"The deprecated_program DeprecatedRule has check_str\u003d\u0027rule:admin_api\u0027 and the new DocumentedRuleDefault for program also uses base.ADMIN which is \u0027rule:admin_api\u0027. Both strings are identical, so the bridge produces \u0027rule:admin_api OR rule:admin_api\u0027. The deprecated_reason text describes why admin_...\n\n**Severity**: SUGGESTION | **Confidence**: 0.8\n\n**Benefit**: The redundant DeprecatedRule does not cause incorrect behavior or security issues. It adds minor code complexity and the deprecated_reason text is semantically inaccurate for a rule whose check string has not changed. Future maintainers may be confused about why a deprecation bridge exists when t...\n\n**Recommendation**:\nConsider either removing the deprecated_rule parameter from the program DocumentedRuleDefault (since the check string is unchanged there is nothing to bridge), or adding a brief code comment explaining that the DeprecatedRule is included for structural consistency with the other operations even though the check string is identical. Either approach is acceptable.","commit_id":"06d95fcd1f2def9b45b5527109f85d4f394adc68"}],"cyborg/tests/unit/policies/test_deployables.py":[{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"277888c1c1e013646a6544f6803ca6ec22280030","unresolved":false,"context_lines":[{"line_number":55,"context_line":""},{"line_number":56,"context_line":"        # New default for reads: project_manager_or_admin."},{"line_number":57,"context_line":"        # New default for program: admin_api."},{"line_number":58,"context_line":"        # get_one and get_all use need_target\u003dFalse, so the target"},{"line_number":59,"context_line":"        # project_id equals the caller\u0027s project_id. With"},{"line_number":60,"context_line":"        # enforce_new_defaults\u003dFalse, the deprecated bridge on"},{"line_number":61,"context_line":"        # project_manager_or_admin (project_id:%(project_id)s)"}],"source_content_type":"text/x-python","patch_set":4,"id":"2798af51_5ca73ba2","line":58,"updated":"2026-06-23 00:42:16.000000000","message":"Test comments reference need_target\u003dFalse as if it is a parameter on authorize_wsgi, but that decorator has no need_target parameter. The decorator always builds the policy target from caller context. The described behavior is correct but the terminology is misleading.\n\n**Severity**: WARNING | **Confidence**: 0.8\n\n**Impact**: Future developers may search for a need_target parameter that does not exist, or assume the decorator supports target-based authorization. The same inaccurate reference appears in DeployablePolicyNewDefaultsTest at lines 213-215.\n\n**Suggestion**:\nRewrite the comments to describe the actual mechanism: the authorize_wsgi decorator constructs the policy target as the caller project_id and user_id from context, so the target always reflects the caller identity rather than the resource owner. Remove all references to the non-existent need_target parameter.","commit_id":"5422d1ca421b2ce779f6707dfec44970c1d5515e"},{"author":{"_account_id":12393,"name":"chandan kumar","display_name":"Chandan Kumar","email":"chkumar@redhat.com","username":"chkumar246"},"change_message_id":"5dc19acb193083dde3bb5986242c6108ec63be9e","unresolved":false,"context_lines":[{"line_number":141,"context_line":"        dep_uuid \u003d self.fake_dep[\u0027uuid\u0027]"},{"line_number":142,"context_line":"        mock_dep_get.return_value \u003d self.fake_dep"},{"line_number":143,"context_line":"        mock_dev_get.return_value \u003d self.fake_dev"},{"line_number":144,"context_line":"        # Use side_effect so a fresh dict copy is returned on every call;"},{"line_number":145,"context_line":"        # the controller mutates cpid_list[0][\u0027cpid_info\u0027] in-place and a"},{"line_number":146,"context_line":"        # shared return_value would be corrupted on the second iteration."},{"line_number":147,"context_line":"        mock_cpid.side_effect \u003d lambda *args: [dict(self.cpid)]"},{"line_number":148,"context_line":"        mock_program.return_value \u003d True"},{"line_number":149,"context_line":"        body \u003d [{\u0027image_uuid\u0027: self.image_uuid}]"},{"line_number":150,"context_line":"        for context in self.program_authorized_contexts:"}],"source_content_type":"text/x-python","patch_set":4,"id":"5c00eb5b_629611a8","line":147,"range":{"start_line":144,"start_character":7,"end_line":147,"end_character":63},"updated":"2026-06-29 09:38:14.000000000","message":"Interesting use case of lmabda","commit_id":"5422d1ca421b2ce779f6707dfec44970c1d5515e"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"ddf0255354653bcc8470a74b44cf4704ea4fe18f","unresolved":false,"context_lines":[{"line_number":53,"context_line":"        }"},{"line_number":54,"context_line":"        self.image_uuid \u003d \u00279a17439a-85d0-4c53-a3d3-0f68a2eac896\u0027"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"        # New default for reads: project_manager_or_admin."},{"line_number":57,"context_line":"        # New default for program: admin_api."},{"line_number":58,"context_line":"        # Policy checks use the request context as target, so the target"},{"line_number":59,"context_line":"        # project_id equals the caller\u0027s project_id. With"}],"source_content_type":"text/x-python","patch_set":5,"id":"b228ecfb_953ccd3f","line":56,"updated":"2026-06-30 12:50:42.000000000","message":"The legacy-mode comment in DeployablePolicyTest.setUp describes the deprecated bridge imprecisely and diverges in clarity from the equivalent comment in the sibling test_devices.py migration. It attributes the widening to \u0027the deprecated bridge on project_manager_or_admin\u0027 without distinguishing the two oslo.policy OR levels.\n\n**Severity**: SUGGESTION | **Confidence**: 0.8\n\n**Benefit**: Aligning the explanatory comment with the more accurate two-level description already present in test_devices.py keeps the SRBAC migration series internally consistent and makes the subtle enforce_new_defaults\u003dFalse behavior easier for future maintainers to audit.\n\n**Recommendation**:\nMirror the test_devices.py comment structure: clarify that (1) the DocumentedRuleDefault ORs its new check_str with the rule:admin_api deprecated bridge, and (2) the project_manager_or_admin RuleDefault itself carries deprecated_rule\u003dDEPRECATED_ADMIN_OR_OWNER, so oslo.policy also ORs in \u0027is_admin:True or project_id:%(project_id)s\u0027, which is the rule that widens read access to all project-scoped contexts.","commit_id":"f6401c96823cb9e6ce19eeac3a8d55b154859539"}]}