)]}'
{"contrib/designate-dashboard/designatedashboard/dashboards/project/dns_domains/tables.py":[{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"63c5c63b8dd44e78de7f33dbc978ce0f77820339","unresolved":false,"context_lines":[{"line_number":43,"context_line":"    verbose_name \u003d _(\"Create Domain\")"},{"line_number":44,"context_line":"    url \u003d \"horizon:project:dns_domains:create_domain\""},{"line_number":45,"context_line":"    classes \u003d (\"ajax-modal\", \"btn-create\")"},{"line_number":46,"context_line":"    policy_rules \u003d ((\u0027dns\u0027, \"create_domain\"),)"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"class EditDomain(tables.LinkAction):"}],"source_content_type":"text/x-python","patch_set":3,"id":"9aa53dc9_a69f704f","line":46,"updated":"2015-04-07 19:44:59.000000000","message":"nit: use single quote and double quote consistently","commit_id":"c75630d9f00e90548e435c6b7aa1ddc034685f0d"},{"author":{"_account_id":8099,"name":"Graham Hayes","email":"gr@ham.ie","username":"graham"},"change_message_id":"eec86b2aa2a8b22566ce3e03d36d4acee3b5a595","unresolved":false,"context_lines":[{"line_number":87,"context_line":"    name \u003d \"create_record\""},{"line_number":88,"context_line":"    verbose_name \u003d _(\"Create Record\")"},{"line_number":89,"context_line":"    classes \u003d (\"ajax-modal\", \"btn-create\")"},{"line_number":90,"context_line":"    policy_rules \u003d ((\"dns\", \"create_record\"),)"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"    def get_link_url(self, datum\u003dNone):"},{"line_number":93,"context_line":"        url \u003d \"horizon:project:dns_domains:create_record\""}],"source_content_type":"text/x-python","patch_set":4,"id":"5aa745d1_ff43e96a","line":90,"updated":"2015-04-16 09:02:52.000000000","message":"In relation to my previous question - how does the domain object get passed into the policy check here? our check relies on checking the ownership of the domain before we create a record in that domain.","commit_id":"db985440d6014d8a65ba7853601d7cf66ca54d00"},{"author":{"_account_id":6650,"name":"Eric Peterson","email":"ejpetey@gmail.com","username":"ericpeterson-l"},"change_message_id":"aab61cc706ec0353df6fad8ab13713fc325a752a","unresolved":false,"context_lines":[{"line_number":87,"context_line":"    name \u003d \"create_record\""},{"line_number":88,"context_line":"    verbose_name \u003d _(\"Create Record\")"},{"line_number":89,"context_line":"    classes \u003d (\"ajax-modal\", \"btn-create\")"},{"line_number":90,"context_line":"    policy_rules \u003d ((\"dns\", \"create_record\"),)"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"    def get_link_url(self, datum\u003dNone):"},{"line_number":93,"context_line":"        url \u003d \"horizon:project:dns_domains:create_record\""}],"source_content_type":"text/x-python","patch_set":4,"id":"5aa745d1_a418a885","line":90,"in_reply_to":"5aa745d1_ff43e96a","updated":"2015-04-16 14:10:39.000000000","message":"So there are two domains in play - the keystone domain and the designate domain.  \n\nWhat horizon passes in, are all the keystone centric attributes, such as project_id, user_id, and domain_id:\nhttps://github.com/openstack/horizon/blob/master/openstack_dashboard/policy.py#L41\n\nOur policy file we use looks like:\n{\n    \"admin\": \"role:admin or is_admin:True\",\n    \"owner\": \"project_id:%(project_id)s\",\n    \"enabled_owner\": \"rule:owner and role:designate_admin\",\n    \"admin_or_owner\": \"rule:admin or rule:enabled_owner\",\n....\n\nSo we essentially check if they are scoped to the same project and contain the role designate_admin.","commit_id":"db985440d6014d8a65ba7853601d7cf66ca54d00"}]}