)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"010edea088a8f78bd702b46da0e68fd8d42a3778","unresolved":true,"context_lines":[{"line_number":19,"context_line":"Document the API policy target semantics for contributors. Global"},{"line_number":20,"context_line":"resources should use admin-only policy rules, and ARQ ownership"},{"line_number":21,"context_line":"continues to be enforced in the object and database layers."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"Generated-By: pi gpt-5.5"},{"line_number":24,"context_line":"Change-Id: Ibc97c5bc35be54c06eae71c18bc4d4b3d31bdc54"},{"line_number":25,"context_line":"Signed-off-by: Sean Mooney \u003cwork@seanmooney.info\u003e"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"3daa42b8_f24445c1","line":22,"updated":"2026-06-26 20:46:36.000000000","message":"I think I would have also expected this to have its own bug report, but I\u0027m not totally sure the situation here.","commit_id":"f67f7b6964058fb5505dc86ded6d63ec8e1ca98f"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"556b9810947f3cb7a15cd237958d8cd4f9e35640","unresolved":true,"context_lines":[{"line_number":19,"context_line":"Document the API policy target semantics for contributors. Global"},{"line_number":20,"context_line":"resources should use admin-only policy rules, and ARQ ownership"},{"line_number":21,"context_line":"continues to be enforced in the object and database layers."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"Generated-By: pi gpt-5.5"},{"line_number":24,"context_line":"Change-Id: Ibc97c5bc35be54c06eae71c18bc4d4b3d31bdc54"},{"line_number":25,"context_line":"Signed-off-by: Sean Mooney \u003cwork@seanmooney.info\u003e"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"cf91ffb9_341ef1bd","line":22,"in_reply_to":"3daa42b8_f24445c1","updated":"2026-06-29 12:51:28.000000000","message":"its sort of related to https://bugs.launchpad.net/openstack-cyborg/+bug/2144056\n\ni actully cam across the weirdness with the \"needs_target\" behvairo durign that cve work but changing it was not critical to fixign the bug so this patch is more or less a clean up patch for that, or rather tech debt i found along the way.\n\nduring the cource of fixitng that i found my self addign False to each of the endpoitn\nhttps://review.opendev.org/c/openstack/cyborg/+/987683/1/cyborg/api/controllers/v2/arqs.py\nand i realist i had sset all or nearly all cases to false by the end meanign the defualt was likely incorrect but i left correcting that to the main SRBAC serise.\nhence this patch.\n\ni know the enforcemnt at the object level \n\nhttps://review.opendev.org/c/openstack/cyborg/+/987683/1/cyborg/objects/ext_arq.py#117\n\nis technicalcly also technical debt but i used the nova pattern for correctness and portability but eventfully we will need to figure out how to express the ability to do cross tenant request in both the policy and the api but that would need a new microverion to add a paremter for that so for now admin request are alwasy cross tenant and non admin are always singel tenant.\n\n\nill add related bug and deciend fi this shoudl be backported later.\n\nthe other srbac change i do not wnat to backprot but this cleanup woudl likely be fine.","commit_id":"f67f7b6964058fb5505dc86ded6d63ec8e1ca98f"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"6504fcb162368177447b0c56e73d8b12f9e1525c","unresolved":false,"context_lines":[{"line_number":19,"context_line":"Document the API policy target semantics for contributors. Global"},{"line_number":20,"context_line":"resources should use admin-only policy rules, and ARQ ownership"},{"line_number":21,"context_line":"continues to be enforced in the object and database layers."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"Generated-By: pi gpt-5.5"},{"line_number":24,"context_line":"Change-Id: Ibc97c5bc35be54c06eae71c18bc4d4b3d31bdc54"},{"line_number":25,"context_line":"Signed-off-by: Sean Mooney \u003cwork@seanmooney.info\u003e"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"f47a82c6_0af2b290","line":22,"in_reply_to":"cf91ffb9_341ef1bd","updated":"2026-06-30 11:06:45.000000000","message":"Done","commit_id":"f67f7b6964058fb5505dc86ded6d63ec8e1ca98f"}],"/PATCHSET_LEVEL":[{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"6b404cefeefa6fc8855db42fc28697b903ef72d7","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"2595ba36_21034b27","updated":"2026-06-26 20:37:12.000000000","message":"This looks good to me","commit_id":"f67f7b6964058fb5505dc86ded6d63ec8e1ca98f"},{"author":{"_account_id":12393,"name":"chandan kumar","display_name":"Chandan Kumar","email":"chkumar@redhat.com","username":"chkumar246"},"change_message_id":"b8226496110266d4a690fefa1e883d19b6864e51","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"9ae28e0f_9cc4e9fd","updated":"2026-06-25 06:47:56.000000000","message":"Verified _get_resource is not implemented in any controller (only test_get_resources_from_device_profile_group in tests — different method).\n```\nchandankumar@fedora:~/programming/cyborg$ git checkout master\nSwitched to branch \u0027master\u0027\nYour branch is up to date with \u0027origin/master\u0027.\nchandankumar@fedora:~/programming/cyborg$ git grep _get_resources\ncyborg/tests/unit/objects/test_ext_arq_job.py:    def test_get_resources_from_device_profile_group(self):\n```\n\n```\nchandankumar@fedora:~/programming/cyborg$ git grep authorize_wsgi.authorize_wsgi\ncyborg/api/controllers/v2/arqs.py:    @authorize_wsgi.authorize_wsgi(\"cyborg:arq\", \"create\", False)\ncyborg/api/controllers/v2/arqs.py:    @authorize_wsgi.authorize_wsgi(\"cyborg:arq\", \"get_one\", False)\ncyborg/api/controllers/v2/arqs.py:    @authorize_wsgi.authorize_wsgi(\"cyborg:arq\", \"get_all\", False)\ncyborg/api/controllers/v2/arqs.py:    @authorize_wsgi.authorize_wsgi(\"cyborg:arq\", \"delete\", False)\ncyborg/api/controllers/v2/arqs.py:    @authorize_wsgi.authorize_wsgi(\"cyborg:arq\", \"update\", False)\ncyborg/api/controllers/v2/attributes.py:    @authorize_wsgi.authorize_wsgi(\"cyborg:attribute\", \"get_all\", False)\ncyborg/api/controllers/v2/attributes.py:    @authorize_wsgi.authorize_wsgi(\"cyborg:attribute\", \"get_one\")\ncyborg/api/controllers/v2/attributes.py:    @authorize_wsgi.authorize_wsgi(\"cyborg:attribute\", \"create\", False)\ncyborg/api/controllers/v2/attributes.py:    @authorize_wsgi.authorize_wsgi(\"cyborg:attribute\", \"delete\")\ncyborg/api/controllers/v2/deployables.py:    @authorize_wsgi.authorize_wsgi(\"cyborg:deployable\", \"program\", False)\ncyborg/api/controllers/v2/deployables.py:    @authorize_wsgi.authorize_wsgi(\"cyborg:deployable\", \"get_one\")\ncyborg/api/controllers/v2/deployables.py:    @authorize_wsgi.authorize_wsgi(\"cyborg:deployable\", \"get_all\")\ncyborg/api/controllers/v2/device_profiles.py:    @authorize_wsgi.authorize_wsgi(\"cyborg:device_profile\", \"create\", False)\ncyborg/api/controllers/v2/device_profiles.py:    @authorize_wsgi.authorize_wsgi(\"cyborg:device_profile\", \"get_all\", False)\ncyborg/api/controllers/v2/device_profiles.py:    @authorize_wsgi.authorize_wsgi(\"cyborg:device_profile\", \"get_one\")\ncyborg/api/controllers/v2/device_profiles.py:    @authorize_wsgi.authorize_wsgi(\"cyborg:device_profile\", \"delete\")\ncyborg/api/controllers/v2/devices.py:    @authorize_wsgi.authorize_wsgi(\"cyborg:device\", \"get_one\")\ncyborg/api/controllers/v2/devices.py:    @authorize_wsgi.authorize_wsgi(\"cyborg:device\", \"get_all\", False)\ncyborg/api/controllers/v2/devices.py:    @authorize_wsgi.authorize_wsgi(\"cyborg:device\", \"disable\")\ncyborg/api/controllers/v2/devices.py:    @authorize_wsgi.authorize_wsgi(\"cyborg:device\", \"enable\")\ncyborg/common/authorize_wsgi.py:            @authorize_wsgi.authorize_wsgi(\"cyborg:accelerator\",\nchandankumar@fedora:~/programming/cyborg$ git grep authorize_wsgi.authorize_wsgi | wc -l\n21\nchandankumar@fedora:~/programming/cyborg$ git checkout -\nSwitched to branch \u0027review/sean_mooney/bp/consistent-and-secure-rbac\u0027\nYour branch and \u0027gerrit/master\u0027 have diverged,\nand have 1 and 5 different commits each, respectively.\n  (use \"git pull\" if you want to integrate the remote branch with yours)\nchandankumar@fedora:~/programming/cyborg$ git grep authorize_wsgi.authorize_wsgi\ncyborg/api/controllers/v2/arqs.py:    @authorize_wsgi.authorize_wsgi(\"cyborg:arq\", \"create\")\ncyborg/api/controllers/v2/arqs.py:    @authorize_wsgi.authorize_wsgi(\"cyborg:arq\", \"get_one\")\ncyborg/api/controllers/v2/arqs.py:    @authorize_wsgi.authorize_wsgi(\"cyborg:arq\", \"get_all\")\ncyborg/api/controllers/v2/arqs.py:    @authorize_wsgi.authorize_wsgi(\"cyborg:arq\", \"delete\")\ncyborg/api/controllers/v2/arqs.py:    @authorize_wsgi.authorize_wsgi(\"cyborg:arq\", \"update\")\ncyborg/api/controllers/v2/attributes.py:    @authorize_wsgi.authorize_wsgi(\"cyborg:attribute\", \"get_all\")\ncyborg/api/controllers/v2/attributes.py:    @authorize_wsgi.authorize_wsgi(\"cyborg:attribute\", \"get_one\")\ncyborg/api/controllers/v2/attributes.py:    @authorize_wsgi.authorize_wsgi(\"cyborg:attribute\", \"create\")\ncyborg/api/controllers/v2/attributes.py:    @authorize_wsgi.authorize_wsgi(\"cyborg:attribute\", \"delete\")\ncyborg/api/controllers/v2/deployables.py:    @authorize_wsgi.authorize_wsgi(\"cyborg:deployable\", \"program\")\ncyborg/api/controllers/v2/deployables.py:    @authorize_wsgi.authorize_wsgi(\"cyborg:deployable\", \"get_one\")\ncyborg/api/controllers/v2/deployables.py:    @authorize_wsgi.authorize_wsgi(\"cyborg:deployable\", \"get_all\")\ncyborg/api/controllers/v2/device_profiles.py:    @authorize_wsgi.authorize_wsgi(\"cyborg:device_profile\", \"create\")\ncyborg/api/controllers/v2/device_profiles.py:    @authorize_wsgi.authorize_wsgi(\"cyborg:device_profile\", \"get_all\")\ncyborg/api/controllers/v2/device_profiles.py:    @authorize_wsgi.authorize_wsgi(\"cyborg:device_profile\", \"get_one\")\ncyborg/api/controllers/v2/device_profiles.py:    @authorize_wsgi.authorize_wsgi(\"cyborg:device_profile\", \"delete\")\ncyborg/api/controllers/v2/devices.py:    @authorize_wsgi.authorize_wsgi(\"cyborg:device\", \"get_one\")\ncyborg/api/controllers/v2/devices.py:    @authorize_wsgi.authorize_wsgi(\"cyborg:device\", \"get_all\")\ncyborg/api/controllers/v2/devices.py:    @authorize_wsgi.authorize_wsgi(\"cyborg:device\", \"disable\")\ncyborg/api/controllers/v2/devices.py:    @authorize_wsgi.authorize_wsgi(\"cyborg:device\", \"enable\")\ncyborg/common/authorize_wsgi.py:            @authorize_wsgi.authorize_wsgi(\"cyborg:accelerator\",\ncyborg/tests/unit/test_authorize_wsgi.py:        wrapped \u003d authorize_wsgi.authorize_wsgi(\u0027cyborg:test\u0027, \u0027get_one\u0027)(\nchandankumar@fedora:~/programming/cyborg$ git grep authorize_wsgi.authorize_wsgi | wc -l\n22\n\n```\nThe 11 callers that already used 2 arguments (e.g., device:get_one) were silently broken — they hit the need_target\u003dTrue default → empty target → non-admin always rejected. This patch fixes them too by making request context the universal target.\n\nNew unit test correctly verifies the policy target is populated from request context and that _get_resource is never called.\n\n+1 to the over all improvement.","commit_id":"f67f7b6964058fb5505dc86ded6d63ec8e1ca98f"},{"author":{"_account_id":34452,"name":"Joan Gilabert","display_name":"jgilaber","email":"jgilaber@redhat.com","username":"jgilaber"},"change_message_id":"4f81ab5f12e83765d617a976f107547447cf6a83","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"53c99176_982fa322","updated":"2026-06-23 16:35:38.000000000","message":"lgtm, and it seems necessary for the RBAC work","commit_id":"f67f7b6964058fb5505dc86ded6d63ec8e1ca98f"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"f6bf8aa86f701a00339cd36507929aae23b0f605","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"16d9e2aa_eb54744e","updated":"2026-06-22 14:00:05.000000000","message":"teim-ci: auto","commit_id":"f67f7b6964058fb5505dc86ded6d63ec8e1ca98f"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"c8feff414cacdb18091ae70605648e9624365f9b","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"bb056b07_e6664e01","updated":"2026-06-22 08:34:21.000000000","message":"teim-ci: auto","commit_id":"f67f7b6964058fb5505dc86ded6d63ec8e1ca98f"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"dc4a627143d644195e8927abde37aec3b0381fd2","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"12ba7b0f_88b5e1bc","updated":"2026-07-02 20:59:44.000000000","message":"Updates look good, thanks","commit_id":"6b516433c40345cad39cd19044e314a0f0773e65"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"cc2628697e01479cfe9fd315508a68cbb4bf4f31","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"219a6233_f2619c9c","updated":"2026-07-20 15:26:02.000000000","message":"Looks good to me, thanks for adding the test coverage","commit_id":"2afb66469506b5a2ddea685e4713fc333eddebc1"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"96153805111507728f8c85b4f9f6203f2ca08fa9","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":4,"id":"fb8e6ce8_ce56c7a3","updated":"2026-07-20 21:09:34.000000000","message":"recheck reboot test is known to be flaky","commit_id":"2afb66469506b5a2ddea685e4713fc333eddebc1"}],"cyborg/tests/unit/api/controllers/v2/test_arqs.py":[{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"8d82a5dc69ac77194869e81f777b0c067538f414","unresolved":false,"context_lines":[{"line_number":282,"context_line":"        response \u003d self.delete(url + args, headers\u003dself.headers)"},{"line_number":283,"context_line":"        self.assertEqual(HTTPStatus.NO_CONTENT, response.status_int)"},{"line_number":284,"context_line":""},{"line_number":285,"context_line":"    @unittest.skip(\"Need more code to implement _get_resource in rbac\")"},{"line_number":286,"context_line":"    def test_delete_with_non_default(self):"},{"line_number":287,"context_line":"        value \u003d {\"is_admin\": False, \"roles\": \"user\", \"is_admin_project\": False}"},{"line_number":288,"context_line":"        ct \u003d self.gen_context(value)"}],"source_content_type":"text/x-python","patch_set":4,"id":"a8964715_a0406cd1","line":285,"updated":"2026-07-20 21:18:41.000000000","message":"The skipped test test_delete_with_non_default has a skip reason of \"Need more code to implement _get_resource in rbac\". This change permanently removes the _get_resource code path from authorize_wsgi, so the skip reason is now permanently invalid and the test should be revisited.\n\n**Severity**: SUGGESTION | **Confidence**: 0.8\n\n**Benefit**: A permanently invalid skip reason obscures whether the test\u0027s underlying concern is still valid. The test may now be un-skippable, or the reason should be updated to reflect the new context-based policy enforcement model.\n\n**Recommendation**:\nEither un-skip test_delete_with_non_default and verify it passes with the new context-based policy target (the original RBAC concern about non-admin ARQ deletion should now be testable via DB-layer isolation), or update the skip reason to explain why it is still skipped under the new model.","commit_id":"2afb66469506b5a2ddea685e4713fc333eddebc1"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"4bb8db6edff180bac17666f025f7d2fe063bbde6","unresolved":false,"context_lines":[{"line_number":282,"context_line":"        response \u003d self.delete(url + args, headers\u003dself.headers)"},{"line_number":283,"context_line":"        self.assertEqual(HTTPStatus.NO_CONTENT, response.status_int)"},{"line_number":284,"context_line":""},{"line_number":285,"context_line":"    @unittest.skip(\"Need more code to implement _get_resource in rbac\")"},{"line_number":286,"context_line":"    def test_delete_with_non_default(self):"},{"line_number":287,"context_line":"        value \u003d {\"is_admin\": False, \"roles\": \"user\", \"is_admin_project\": False}"},{"line_number":288,"context_line":"        ct \u003d self.gen_context(value)"}],"source_content_type":"text/x-python","patch_set":4,"id":"2ce8b0bc_3cbccb67","line":285,"in_reply_to":"49db9077_27c84a09","updated":"2026-07-21 11:05:45.000000000","message":"Done","commit_id":"2afb66469506b5a2ddea685e4713fc333eddebc1"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"1009851251e829026fc3659110e9db6ad4b9c4b9","unresolved":true,"context_lines":[{"line_number":282,"context_line":"        response \u003d self.delete(url + args, headers\u003dself.headers)"},{"line_number":283,"context_line":"        self.assertEqual(HTTPStatus.NO_CONTENT, response.status_int)"},{"line_number":284,"context_line":""},{"line_number":285,"context_line":"    @unittest.skip(\"Need more code to implement _get_resource in rbac\")"},{"line_number":286,"context_line":"    def test_delete_with_non_default(self):"},{"line_number":287,"context_line":"        value \u003d {\"is_admin\": False, \"roles\": \"user\", \"is_admin_project\": False}"},{"line_number":288,"context_line":"        ct \u003d self.gen_context(value)"}],"source_content_type":"text/x-python","patch_set":4,"id":"49db9077_27c84a09","line":285,"in_reply_to":"a8964715_a0406cd1","updated":"2026-07-20 21:29:49.000000000","message":"sign this is valid.\n\ni kind of want to do this as a follow up but i need to respine the patch that enable the new testing in the ci job so i will proably adress this inline and respine all the patches on top.","commit_id":"2afb66469506b5a2ddea685e4713fc333eddebc1"}],"cyborg/tests/unit/test_authorize_wsgi.py":[{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"d0e2c489b7b31eb861dadf99f8d982c948bdc5fb","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"class TestAuthorizeWSGI(base.TestCase):"},{"line_number":23,"context_line":"    def test_authorize_wsgi_uses_request_context_target(self):"},{"line_number":24,"context_line":"        context \u003d mock.Mock()"},{"line_number":25,"context_line":"        context.project_id \u003d \u0027project-id\u0027"},{"line_number":26,"context_line":"        context.user_id \u003d \u0027user-id\u0027"}],"source_content_type":"text/x-python","patch_set":2,"id":"fb143e20_153339b3","line":23,"updated":"2026-06-22 14:28:34.000000000","message":"The new test only covers the authorize-passes happy path (authorize is mocked). There is no test asserting that when authorize() raises PolicyNotAuthorized the decorator returns a 403 error via return_error(). The 403 denial branch survives but is now untested at this layer.\n\n**Severity**: WARNING | **Confidence**: 0.8\n\n**Impact**: A regression that breaks the 403 mapping (e.g. someone re-wrapping the decorator or changing the except clause) would not be caught by this unit test. For an authorization change this is a meaningful coverage gap.\n\n**Suggestion**:\nAdd a companion test that patches authorize to raise oslo_policy.policy.PolicyNotAuthorized (or the cyborg HTTPForbidden wrapper) and asserts that wrapped() returns the return_error(403) payload and sets pecan.response.status to 403. Optionally also assert behavior when context.is_admin short-circuits via credentials.","commit_id":"f67f7b6964058fb5505dc86ded6d63ec8e1ca98f"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"6b404cefeefa6fc8855db42fc28697b903ef72d7","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"class TestAuthorizeWSGI(base.TestCase):"},{"line_number":23,"context_line":"    def test_authorize_wsgi_uses_request_context_target(self):"},{"line_number":24,"context_line":"        context \u003d mock.Mock()"},{"line_number":25,"context_line":"        context.project_id \u003d \u0027project-id\u0027"},{"line_number":26,"context_line":"        context.user_id \u003d \u0027user-id\u0027"}],"source_content_type":"text/x-python","patch_set":2,"id":"c26291f1_4917a1a2","line":23,"in_reply_to":"fb143e20_153339b3","updated":"2026-06-26 20:37:12.000000000","message":"This AI review comment seems worth addressing, but I can see that it is not really related to the logical objective in this patch.","commit_id":"f67f7b6964058fb5505dc86ded6d63ec8e1ca98f"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"0d743dbb654f3559d6180e9b5dbae203ed773490","unresolved":false,"context_lines":[{"line_number":30,"context_line":"            roles\u003d[\u0027reader\u0027],"},{"line_number":31,"context_line":"            is_admin\u003dFalse,"},{"line_number":32,"context_line":"        )"},{"line_number":33,"context_line":"        request \u003d authorize_wsgi.pecan.Request.blank(\u0027/v2/test\u0027)"},{"line_number":34,"context_line":"        request.context \u003d context"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"        class TestController:"}],"source_content_type":"text/x-python","patch_set":3,"id":"1a3de951_320c8514","line":33,"updated":"2026-06-30 11:21:53.000000000","message":"The test_uses_request_context_target test defines an inner TestController._get_resource that raises AssertionError to prove _get_resource is no longer called. The intent is only evident from the assertion; a comment would clarify it asserts dead-code removal.\n\n**Severity**: SUGGESTION | **Confidence**: 0.6\n\n**Benefit**: Improves readability and prevents a future contributor from \u0027fixing\u0027 the seemingly broken _get_resource stub.\n\n**Recommendation**:\nAdd a brief comment above _get_resource noting it asserts the removed need_target path is never invoked, e.g. \u0027# _get_resource is intentionally broken: the decorator must not call it.\u0027","commit_id":"6b516433c40345cad39cd19044e314a0f0773e65"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"0d743dbb654f3559d6180e9b5dbae203ed773490","unresolved":false,"context_lines":[{"line_number":64,"context_line":""},{"line_number":65,"context_line":"    def test_authorize_wsgi_returns_403_when_policy_denied(self):"},{"line_number":66,"context_line":"        context \u003d cyborg_context.RequestContext("},{"line_number":67,"context_line":"            user_id\u003d\u0027user-id\u0027,"},{"line_number":68,"context_line":"            project_id\u003d\u0027project-id\u0027,"},{"line_number":69,"context_line":"            roles\u003d[\u0027reader\u0027],"},{"line_number":70,"context_line":"            is_admin\u003dFalse,"}],"source_content_type":"text/x-python","patch_set":3,"id":"f3f4516d_d5acb703","line":67,"updated":"2026-06-30 11:21:53.000000000","message":"The 403-denial test mutates the module global authorize_wsgi._ENFORCER \u003d None and rebuilds it with use_conf\u003dFalse. addCleanup resets it, but the test still runs against the shared global enforcer, so state can leak if test ordering or parallelism changes within TestAuthorizeWSGI.\n\n**Severity**: SUGGESTION | **Confidence**: 0.7\n\n**Benefit**: Makes the policy-denial test hermetic and order-independent, preventing flaky failures when new tests are added to the same class.\n\n**Recommendation**:\nUse a dedicated policy fixture that snapshots and restores _ENFORCER unconditionally in setUp/addCleanup, or mock authorize at the module level (as the passing-context test does) for determinism rather than rebuilding the real enforcer.","commit_id":"6b516433c40345cad39cd19044e314a0f0773e65"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"21f7043e691a10be999393fcde6312db0b89d736","unresolved":false,"context_lines":[{"line_number":64,"context_line":""},{"line_number":65,"context_line":"    def test_authorize_wsgi_returns_403_when_policy_denied(self):"},{"line_number":66,"context_line":"        context \u003d cyborg_context.RequestContext("},{"line_number":67,"context_line":"            user_id\u003d\u0027user-id\u0027,"},{"line_number":68,"context_line":"            project_id\u003d\u0027project-id\u0027,"},{"line_number":69,"context_line":"            roles\u003d[\u0027reader\u0027],"},{"line_number":70,"context_line":"            is_admin\u003dFalse,"}],"source_content_type":"text/x-python","patch_set":3,"id":"8c3866bb_4ea26847","line":67,"in_reply_to":"d09d4c5d_b99653ab","updated":"2026-07-20 14:47:35.000000000","message":"Done","commit_id":"6b516433c40345cad39cd19044e314a0f0773e65"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"5735e05f47f1ab972b841787b843199f89b99a91","unresolved":true,"context_lines":[{"line_number":64,"context_line":""},{"line_number":65,"context_line":"    def test_authorize_wsgi_returns_403_when_policy_denied(self):"},{"line_number":66,"context_line":"        context \u003d cyborg_context.RequestContext("},{"line_number":67,"context_line":"            user_id\u003d\u0027user-id\u0027,"},{"line_number":68,"context_line":"            project_id\u003d\u0027project-id\u0027,"},{"line_number":69,"context_line":"            roles\u003d[\u0027reader\u0027],"},{"line_number":70,"context_line":"            is_admin\u003dFalse,"}],"source_content_type":"text/x-python","patch_set":3,"id":"d09d4c5d_b99653ab","line":67,"in_reply_to":"f3f4516d_d5acb703","updated":"2026-07-06 22:10:31.000000000","message":"yep this is a bug we shoudl never assign to a mole level constant like that\n\nthat causes cross test sharign of the gloabl obje3ct ro other hard to debug interactions.\n\n````\n        authorize_wsgi._ENFORCER \u003d None\n\n        def reset_enforcer():\n            if authorize_wsgi._ENFORCER is not None:\n                authorize_wsgi._ENFORCER.clear()\n            authorize_wsgi._ENFORCER \u003d None\n\n        self.addCleanup(reset_enforcer)\n```\nkind fo trys to  do this safely but that not correct.","commit_id":"6b516433c40345cad39cd19044e314a0f0773e65"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"0d743dbb654f3559d6180e9b5dbae203ed773490","unresolved":false,"context_lines":[{"line_number":81,"context_line":"                authorize_wsgi._ENFORCER.clear()"},{"line_number":82,"context_line":"            authorize_wsgi._ENFORCER \u003d None"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"        self.addCleanup(reset_enforcer)"},{"line_number":85,"context_line":"        authorize_wsgi.init_enforcer("},{"line_number":86,"context_line":"            use_conf\u003dFalse, suppress_deprecation_warnings\u003dTrue"},{"line_number":87,"context_line":"        )"}],"source_content_type":"text/x-python","patch_set":3,"id":"80166265_ac9755eb","line":84,"updated":"2026-06-30 11:21:53.000000000","message":"The denial test monkeypatches pecan.conf with a plain dict via mock.patch.object(pecan, \u0027conf\u0027, {...}); return_error calls pecan.conf.get(\u0027wsme\u0027, {}).get(\u0027debug\u0027, False). Real oslo_config cfg.CONF is not a dict, so this stub masks a behaviour mismatch with production.\n\n**Severity**: WARNING | **Confidence**: 0.7\n\n**Impact**: The 403-path test passes against a dict stub, but in production pecan.conf is a ConfigOpts object. If the conf access pattern changes, the test will not catch it, giving false confidence in the error-rendering branch.\n\n**Suggestion**:\nUse a cfg.ConfigOpts fixture or pecan\u0027s actual conf in the test instead of substituting a raw dict, so return_error exercises the same conf lookup path used at runtime. At minimum assert the conf access works against a ConfigOpts-like object.","commit_id":"6b516433c40345cad39cd19044e314a0f0773e65"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"5735e05f47f1ab972b841787b843199f89b99a91","unresolved":true,"context_lines":[{"line_number":81,"context_line":"                authorize_wsgi._ENFORCER.clear()"},{"line_number":82,"context_line":"            authorize_wsgi._ENFORCER \u003d None"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"        self.addCleanup(reset_enforcer)"},{"line_number":85,"context_line":"        authorize_wsgi.init_enforcer("},{"line_number":86,"context_line":"            use_conf\u003dFalse, suppress_deprecation_warnings\u003dTrue"},{"line_number":87,"context_line":"        )"}],"source_content_type":"text/x-python","patch_set":3,"id":"f61c01a6_bccd1e3d","line":84,"in_reply_to":"80166265_ac9755eb","updated":"2026-07-06 22:10:31.000000000","message":"this is off by a few lines but yes\n```\n            mock.patch.object(\n                authorize_wsgi.pecan, \u0027conf\u0027, {\u0027wsme\u0027: {\u0027debug\u0027: False}}\n            )\n```\nis not really correct.\n\ni dont really need to disabel debug.","commit_id":"6b516433c40345cad39cd19044e314a0f0773e65"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"21f7043e691a10be999393fcde6312db0b89d736","unresolved":false,"context_lines":[{"line_number":81,"context_line":"                authorize_wsgi._ENFORCER.clear()"},{"line_number":82,"context_line":"            authorize_wsgi._ENFORCER \u003d None"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"        self.addCleanup(reset_enforcer)"},{"line_number":85,"context_line":"        authorize_wsgi.init_enforcer("},{"line_number":86,"context_line":"            use_conf\u003dFalse, suppress_deprecation_warnings\u003dTrue"},{"line_number":87,"context_line":"        )"}],"source_content_type":"text/x-python","patch_set":3,"id":"362df767_610e7643","line":84,"in_reply_to":"f61c01a6_bccd1e3d","updated":"2026-07-20 14:47:35.000000000","message":"Done","commit_id":"6b516433c40345cad39cd19044e314a0f0773e65"}],"doc/source/contributor/contributing.rst":[{"author":{"_account_id":12393,"name":"chandan kumar","display_name":"Chandan Kumar","email":"chkumar@redhat.com","username":"chkumar246"},"change_message_id":"b8226496110266d4a690fefa1e883d19b6864e51","unresolved":false,"context_lines":[{"line_number":87,"context_line":"All common PTL duties are enumerated in the `PTL guide"},{"line_number":88,"context_line":"\u003chttps://docs.openstack.org/project-team-guide/ptl.html\u003e`_."},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"API Policy Targets"},{"line_number":91,"context_line":"~~~~~~~~~~~~~~~~~~"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"Cyborg API controllers use the request context as the policy target."}],"source_content_type":"text/x-rst","patch_set":2,"id":"65b3e64d_23868301","line":90,"updated":"2026-06-25 06:47:56.000000000","message":"+1 for documenting the  new policy target semantics","commit_id":"f67f7b6964058fb5505dc86ded6d63ec8e1ca98f"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"0d743dbb654f3559d6180e9b5dbae203ed773490","unresolved":false,"context_lines":[{"line_number":97,"context_line":"  {"},{"line_number":98,"context_line":"      \u0027project_id\u0027: context.project_id,"},{"line_number":99,"context_line":"      \u0027user_id\u0027: context.user_id,"},{"line_number":100,"context_line":"  }"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"This is important for project-scoped persona rules such as"},{"line_number":103,"context_line":"``project_id:%(project_id)s``. Passing an empty target would make those"}],"source_content_type":"text/x-rst","patch_set":3,"id":"eb772d4b_b572f341","line":100,"updated":"2026-06-30 11:21:53.000000000","message":"The new contributing.rst section documents API policy target semantics but omits the requirement that @authorize_wsgi MUST be the outermost decorator. That rule lives only in an in-code comment, exactly where new contributors will not look.\n\n**Severity**: WARNING | **Confidence**: 0.7\n\n**Impact**: A contributor following the docs could place @authorize_wsgi below @expose, which silently breaks policy enforcement because the decorator must wrap before pecan dispatch, leading to mis-evaluated endpoints.\n\n**Suggestion**:\nAdd a one-line note to the new \u0027API Policy Targets\u0027 section stating that @authorize_wsgi.authorize_wsgi must always be the outermost (first) decorator on an API method, matching the existing comment in authorize_wsgi.py.","commit_id":"6b516433c40345cad39cd19044e314a0f0773e65"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"21f7043e691a10be999393fcde6312db0b89d736","unresolved":false,"context_lines":[{"line_number":97,"context_line":"  {"},{"line_number":98,"context_line":"      \u0027project_id\u0027: context.project_id,"},{"line_number":99,"context_line":"      \u0027user_id\u0027: context.user_id,"},{"line_number":100,"context_line":"  }"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"This is important for project-scoped persona rules such as"},{"line_number":103,"context_line":"``project_id:%(project_id)s``. Passing an empty target would make those"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7015b23b_6e174423","line":100,"in_reply_to":"a664bc53_8b28ae48","updated":"2026-07-20 14:47:35.000000000","message":"Done","commit_id":"6b516433c40345cad39cd19044e314a0f0773e65"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"5735e05f47f1ab972b841787b843199f89b99a91","unresolved":true,"context_lines":[{"line_number":97,"context_line":"  {"},{"line_number":98,"context_line":"      \u0027project_id\u0027: context.project_id,"},{"line_number":99,"context_line":"      \u0027user_id\u0027: context.user_id,"},{"line_number":100,"context_line":"  }"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"This is important for project-scoped persona rules such as"},{"line_number":103,"context_line":"``project_id:%(project_id)s``. Passing an empty target would make those"}],"source_content_type":"text/x-rst","patch_set":3,"id":"a664bc53_8b28ae48","line":100,"in_reply_to":"eb772d4b_b572f341","updated":"2026-07-06 22:10:31.000000000","message":"that is a good point","commit_id":"6b516433c40345cad39cd19044e314a0f0773e65"}]}