)]}'
{"designate/common/policies/blacklist.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"37e07055bfbe9015eadccb07ae8910f9a4415ffc","unresolved":false,"context_lines":[{"line_number":21,"context_line":""},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"rules \u003d ["},{"line_number":24,"context_line":"    policy.RuleDefault("},{"line_number":25,"context_line":"        \"create_blacklist\","},{"line_number":26,"context_line":"        base.RULE_ADMIN),"},{"line_number":27,"context_line":"    policy.RuleDefault("}],"source_content_type":"text/x-python","patch_set":6,"id":"7f515b1d_39efb7b1","line":24,"range":{"start_line":24,"start_character":11,"end_line":24,"end_character":22},"updated":"2017-10-04 16:47:40.000000000","message":"Using the DocumentedRuleDefault gives you the ability to specify descriptions and operations (which consist of urls and method used to access the API). These are strictly for documentation purposes and they are rendered in samples:\n\nhttps://docs.openstack.org/oslo.policy/latest/user/usage.html#how-to-register\n\nSee the following for an example rendering: \n\nhttps://docs.openstack.org/keystone/latest/configuration/samples/policy-yaml.html","commit_id":"6e3932720c0c20ee3f3efdb8b16e184033bcadba"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"fda8e351da23bd8de8db7ec7944795fe948d5d3c","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"rules \u003d ["},{"line_number":22,"context_line":"    policy.RuleDefault("},{"line_number":23,"context_line":"        name\u003d\"create_blacklist\","},{"line_number":24,"context_line":"        check_str\u003dbase.RULE_ADMIN,"},{"line_number":25,"context_line":"        description\u003d\u0027Create blacklist.\u0027),"}],"source_content_type":"text/x-python","patch_set":10,"id":"5f4e5783_42bcca68","line":22,"range":{"start_line":22,"start_character":11,"end_line":22,"end_character":22},"updated":"2017-10-10 14:34:57.000000000","message":"We can actually use DocumentedRuleDefault here to provide even more information to users and deployers. For example: \n\nhttps://github.com/openstack/keystone/blob/master/keystone/common/policies/group.py#L18-L25","commit_id":"6452748476677d18cc8ebc25a32ab1c2994bfcf8"},{"author":{"_account_id":19930,"name":"Dai Dang Van","email":"daidv@omzcloud.vn","username":"daidv"},"change_message_id":"d8a59fdcebe95416112dbb0bf74557f988f909b7","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"rules \u003d ["},{"line_number":22,"context_line":"    policy.RuleDefault("},{"line_number":23,"context_line":"        name\u003d\"create_blacklist\","},{"line_number":24,"context_line":"        check_str\u003dbase.RULE_ADMIN,"},{"line_number":25,"context_line":"        description\u003d\u0027Create blacklist.\u0027),"}],"source_content_type":"text/x-python","patch_set":10,"id":"5f4e5783_4fbf13d0","line":22,"range":{"start_line":22,"start_character":11,"end_line":22,"end_character":22},"in_reply_to":"5f4e5783_2f5a97f2","updated":"2017-10-12 06:54:44.000000000","message":"Ok, I agree that we will use the DocumentedRuleDefault and update it later for some special cases.","commit_id":"6452748476677d18cc8ebc25a32ab1c2994bfcf8"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a47c37b01e7bea63336b574f495b1c12c2323eb2","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"rules \u003d ["},{"line_number":22,"context_line":"    policy.RuleDefault("},{"line_number":23,"context_line":"        name\u003d\"create_blacklist\","},{"line_number":24,"context_line":"        check_str\u003dbase.RULE_ADMIN,"},{"line_number":25,"context_line":"        description\u003d\u0027Create blacklist.\u0027),"}],"source_content_type":"text/x-python","patch_set":10,"id":"5f4e5783_6175e463","line":22,"range":{"start_line":22,"start_character":11,"end_line":22,"end_character":22},"in_reply_to":"5f4e5783_2f5a97f2","updated":"2017-10-16 15:35:47.000000000","message":"We could do that - but it will require another version of oslo.policy inorder to consume those changes. Nova has the actions API that they overload to relay additional information:\n\n  # POST  /servers/{server_id}/action (os-resetState)\n\nWe might be able to do something similar here without requiring a new version of oslo.policy.","commit_id":"6452748476677d18cc8ebc25a32ab1c2994bfcf8"},{"author":{"_account_id":19930,"name":"Dai Dang Van","email":"daidv@omzcloud.vn","username":"daidv"},"change_message_id":"6a1d7c75e5a4f1b31258b2ad929c6d1968af470a","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"rules \u003d ["},{"line_number":22,"context_line":"    policy.RuleDefault("},{"line_number":23,"context_line":"        name\u003d\"create_blacklist\","},{"line_number":24,"context_line":"        check_str\u003dbase.RULE_ADMIN,"},{"line_number":25,"context_line":"        description\u003d\u0027Create blacklist.\u0027),"}],"source_content_type":"text/x-python","patch_set":10,"id":"5f4e5783_4607271e","line":22,"range":{"start_line":22,"start_character":11,"end_line":22,"end_character":22},"in_reply_to":"5f4e5783_42bcca68","updated":"2017-10-11 04:10:12.000000000","message":"I really replied your comment about this thing. Please consider about that Designate will use RuleDefault as init policy in code and will update later.\n\n \u003e \u003e (3 comments)\n \u003e \u003e\n \u003e \u003e Couple suggestions about using DocumentedRuleDefault. Otherwise\n \u003e \u003e this is certainly on the right track!\n \u003e \n \u003e Hi Lance, maybe, we need to keep using RuleDefault class instead of\n \u003e DocumentRuleDefault and update later because we are checking\n \u003e policies in central service, not in API[1].\n \u003e \n \u003e How do you think about this?\n \u003e \n \u003e [1] http://eavesdrop.openstack.org/irclogs/%23openstack-dns/%23openstack-dns.2017-10-05.log.html#t2017-10-05T07:32:41","commit_id":"6452748476677d18cc8ebc25a32ab1c2994bfcf8"},{"author":{"_account_id":19741,"name":"Hieu LE","email":"hieulq2@viettel.com.vn","username":"hieulq"},"change_message_id":"5e758ab5f9e67aa56091b623d2edc742ca1f5392","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"rules \u003d ["},{"line_number":22,"context_line":"    policy.RuleDefault("},{"line_number":23,"context_line":"        name\u003d\"create_blacklist\","},{"line_number":24,"context_line":"        check_str\u003dbase.RULE_ADMIN,"},{"line_number":25,"context_line":"        description\u003d\u0027Create blacklist.\u0027),"}],"source_content_type":"text/x-python","patch_set":10,"id":"5f4e5783_2f5a97f2","line":22,"range":{"start_line":22,"start_character":11,"end_line":22,"end_character":22},"in_reply_to":"5f4e5783_4607271e","updated":"2017-10-12 06:50:08.000000000","message":"Basically we documented which policy would be used for which API calls. This is not related to where you check the policy. Thus I think you should use DocumentedRuleDefault and list all API paths.\n@Lance: I realize that some Designate policies will be checked from RPC call. So do you think we should extend the `operations` variable of DocumentedRuleDefault for such cases. For example:\n\n     policy.DocumentedRuleDefault(\n        name\u003d\"get_pool\",\n        check_str\u003dbase.RULE_ADMIN,\n        description\u003d\u0027Find pool.\u0027,\n        operations\u003d[\n            {\n                \u0027path\u0027: \u0027/v2/pools\u0027,\n                \u0027method\u0027: \u0027GET\u0027\n            },\n            {\n                \u0027command\u0027: \u0027designate-manage pool update\u0027\n            }\n        ]),","commit_id":"6452748476677d18cc8ebc25a32ab1c2994bfcf8"},{"author":{"_account_id":19930,"name":"Dai Dang Van","email":"daidv@omzcloud.vn","username":"daidv"},"change_message_id":"df64c80ebe672810e6863d826cee4e743a37e007","unresolved":false,"context_lines":[{"line_number":85,"context_line":"            }"},{"line_number":86,"context_line":"        ]"},{"line_number":87,"context_line":"    ),"},{"line_number":88,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":89,"context_line":"        name\u003d\"use_blacklisted_zone\","},{"line_number":90,"context_line":"        check_str\u003dbase.RULE_ADMIN,"},{"line_number":91,"context_line":"        description\u003d\u0027Allowed bypass the blacklist.\u0027,"},{"line_number":92,"context_line":"        operations\u003d["},{"line_number":93,"context_line":"            {"},{"line_number":94,"context_line":"                \u0027path\u0027: \u0027/v2/zones\u0027,"},{"line_number":95,"context_line":"                \u0027method\u0027: \u0027POST\u0027"},{"line_number":96,"context_line":"            }"},{"line_number":97,"context_line":"        ]"},{"line_number":98,"context_line":"    )"},{"line_number":99,"context_line":"]"},{"line_number":100,"context_line":""},{"line_number":101,"context_line":""}],"source_content_type":"text/x-python","patch_set":12,"id":"5f4e5783_e1090f95","line":98,"range":{"start_line":88,"start_character":4,"end_line":98,"end_character":5},"updated":"2017-10-13 09:25:31.000000000","message":"This rule is using during creating zone, so that is reason I push /v2/zones path here.","commit_id":"6090a34215db520a48593283e5c95de9dba2a15f"}],"designate/common/policies/context.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"37e07055bfbe9015eadccb07ae8910f9a4415ffc","unresolved":false,"context_lines":[{"line_number":21,"context_line":""},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"rules \u003d ["},{"line_number":24,"context_line":"    policy.RuleDefault("},{"line_number":25,"context_line":"        \"all_tenants\","},{"line_number":26,"context_line":"        base.RULE_ADMIN),"},{"line_number":27,"context_line":"    policy.RuleDefault("}],"source_content_type":"text/x-python","patch_set":6,"id":"7f515b1d_594713be","line":24,"range":{"start_line":24,"start_character":11,"end_line":24,"end_character":22},"updated":"2017-10-04 16:47:40.000000000","message":"Same comment can be applied here.","commit_id":"6e3932720c0c20ee3f3efdb8b16e184033bcadba"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"fda8e351da23bd8de8db7ec7944795fe948d5d3c","unresolved":false,"context_lines":[{"line_number":18,"context_line":"from designate.common.policies import base"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"rules \u003d ["},{"line_number":22,"context_line":"    policy.RuleDefault("},{"line_number":23,"context_line":"        name\u003d\"all_tenants\","},{"line_number":24,"context_line":"        check_str\u003dbase.RULE_ADMIN,"},{"line_number":25,"context_line":"        description\u003d\u0027Action on all tenants.\u0027),"},{"line_number":26,"context_line":"    policy.RuleDefault("},{"line_number":27,"context_line":"        name\u003d\"edit_managed_records\","},{"line_number":28,"context_line":"        check_str\u003dbase.RULE_ADMIN,"},{"line_number":29,"context_line":"        description\u003d\u0027Edit managed records.\u0027),"},{"line_number":30,"context_line":"    policy.RuleDefault("},{"line_number":31,"context_line":"        name\u003d\"use_low_ttl\","},{"line_number":32,"context_line":"        check_str\u003dbase.RULE_ADMIN,"},{"line_number":33,"context_line":"        description\u003d\u0027Use low TTL.\u0027),"},{"line_number":34,"context_line":"    policy.RuleDefault("},{"line_number":35,"context_line":"        name\u003d\"use_sudo\","},{"line_number":36,"context_line":"        check_str\u003dbase.RULE_ADMIN,"},{"line_number":37,"context_line":"        description\u003d\u0027Accept sudo from user to tenant.\u0027)"},{"line_number":38,"context_line":"]"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"def list_rules():"}],"source_content_type":"text/x-python","patch_set":10,"id":"5f4e5783_82676226","line":38,"range":{"start_line":21,"start_character":0,"end_line":38,"end_character":1},"updated":"2017-10-10 14:34:57.000000000","message":"What separates these policies from the ones in base?","commit_id":"6452748476677d18cc8ebc25a32ab1c2994bfcf8"},{"author":{"_account_id":19930,"name":"Dai Dang Van","email":"daidv@omzcloud.vn","username":"daidv"},"change_message_id":"6a1d7c75e5a4f1b31258b2ad929c6d1968af470a","unresolved":false,"context_lines":[{"line_number":18,"context_line":"from designate.common.policies import base"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"rules \u003d ["},{"line_number":22,"context_line":"    policy.RuleDefault("},{"line_number":23,"context_line":"        name\u003d\"all_tenants\","},{"line_number":24,"context_line":"        check_str\u003dbase.RULE_ADMIN,"},{"line_number":25,"context_line":"        description\u003d\u0027Action on all tenants.\u0027),"},{"line_number":26,"context_line":"    policy.RuleDefault("},{"line_number":27,"context_line":"        name\u003d\"edit_managed_records\","},{"line_number":28,"context_line":"        check_str\u003dbase.RULE_ADMIN,"},{"line_number":29,"context_line":"        description\u003d\u0027Edit managed records.\u0027),"},{"line_number":30,"context_line":"    policy.RuleDefault("},{"line_number":31,"context_line":"        name\u003d\"use_low_ttl\","},{"line_number":32,"context_line":"        check_str\u003dbase.RULE_ADMIN,"},{"line_number":33,"context_line":"        description\u003d\u0027Use low TTL.\u0027),"},{"line_number":34,"context_line":"    policy.RuleDefault("},{"line_number":35,"context_line":"        name\u003d\"use_sudo\","},{"line_number":36,"context_line":"        check_str\u003dbase.RULE_ADMIN,"},{"line_number":37,"context_line":"        description\u003d\u0027Accept sudo from user to tenant.\u0027)"},{"line_number":38,"context_line":"]"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"def list_rules():"}],"source_content_type":"text/x-python","patch_set":10,"id":"5f4e5783_66aea32f","line":38,"range":{"start_line":21,"start_character":0,"end_line":38,"end_character":1},"in_reply_to":"5f4e5783_82676226","updated":"2017-10-11 04:10:12.000000000","message":"I just follow the location which are using these rules.","commit_id":"6452748476677d18cc8ebc25a32ab1c2994bfcf8"},{"author":{"_account_id":19930,"name":"Dai Dang Van","email":"daidv@omzcloud.vn","username":"daidv"},"change_message_id":"df64c80ebe672810e6863d826cee4e743a37e007","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"rules \u003d ["},{"line_number":22,"context_line":"    policy.RuleDefault("},{"line_number":23,"context_line":"        name\u003d\"all_tenants\","},{"line_number":24,"context_line":"        check_str\u003dbase.RULE_ADMIN,"},{"line_number":25,"context_line":"        description\u003d\u0027Action on all tenants.\u0027),"},{"line_number":26,"context_line":"    policy.RuleDefault("},{"line_number":27,"context_line":"        name\u003d\"edit_managed_records\","},{"line_number":28,"context_line":"        check_str\u003dbase.RULE_ADMIN,"},{"line_number":29,"context_line":"        description\u003d\u0027Edit managed records.\u0027),"},{"line_number":30,"context_line":"    policy.RuleDefault("},{"line_number":31,"context_line":"        name\u003d\"use_low_ttl\","},{"line_number":32,"context_line":"        check_str\u003dbase.RULE_ADMIN,"},{"line_number":33,"context_line":"        description\u003d\u0027Use low TTL.\u0027),"},{"line_number":34,"context_line":"    policy.RuleDefault("},{"line_number":35,"context_line":"        name\u003d\"use_sudo\","},{"line_number":36,"context_line":"        check_str\u003dbase.RULE_ADMIN,"},{"line_number":37,"context_line":"        description\u003d\u0027Accept sudo from user to tenant.\u0027)"},{"line_number":38,"context_line":"]"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":""}],"source_content_type":"text/x-python","patch_set":12,"id":"5f4e5783_414903ce","line":37,"range":{"start_line":22,"start_character":0,"end_line":37,"end_character":55},"updated":"2017-10-13 09:25:31.000000000","message":"These rules are using at many points, I don\u0027t know that shoud we list all of APIs in *operations* of DocumentedRuleDefault or no need to do that?","commit_id":"6090a34215db520a48593283e5c95de9dba2a15f"},{"author":{"_account_id":19930,"name":"Dai Dang Van","email":"daidv@omzcloud.vn","username":"daidv"},"change_message_id":"267078a3ffe7a70519d7abb4c9446cf7cbb20d63","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"rules \u003d ["},{"line_number":22,"context_line":"    policy.RuleDefault("},{"line_number":23,"context_line":"        name\u003d\"all_tenants\","},{"line_number":24,"context_line":"        check_str\u003dbase.RULE_ADMIN,"},{"line_number":25,"context_line":"        description\u003d\u0027Action on all tenants.\u0027),"},{"line_number":26,"context_line":"    policy.RuleDefault("},{"line_number":27,"context_line":"        name\u003d\"edit_managed_records\","},{"line_number":28,"context_line":"        check_str\u003dbase.RULE_ADMIN,"},{"line_number":29,"context_line":"        description\u003d\u0027Edit managed records.\u0027),"},{"line_number":30,"context_line":"    policy.RuleDefault("},{"line_number":31,"context_line":"        name\u003d\"use_low_ttl\","},{"line_number":32,"context_line":"        check_str\u003dbase.RULE_ADMIN,"},{"line_number":33,"context_line":"        description\u003d\u0027Use low TTL.\u0027),"},{"line_number":34,"context_line":"    policy.RuleDefault("},{"line_number":35,"context_line":"        name\u003d\"use_sudo\","},{"line_number":36,"context_line":"        check_str\u003dbase.RULE_ADMIN,"},{"line_number":37,"context_line":"        description\u003d\u0027Accept sudo from user to tenant.\u0027)"},{"line_number":38,"context_line":"]"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":""}],"source_content_type":"text/x-python","patch_set":12,"id":"5f4e5783_63a5de46","line":37,"range":{"start_line":22,"start_character":0,"end_line":37,"end_character":55},"in_reply_to":"5f4e5783_4120a848","updated":"2017-10-17 01:50:38.000000000","message":"Sure, but we need to have a little bit more time to describe them. For now, I think we should migrate to \"Policy in code\" first.","commit_id":"6090a34215db520a48593283e5c95de9dba2a15f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"3945a63687eeb3c9ab7bd8b7b38b900d3b4d5d5c","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"rules \u003d ["},{"line_number":22,"context_line":"    policy.RuleDefault("},{"line_number":23,"context_line":"        name\u003d\"all_tenants\","},{"line_number":24,"context_line":"        check_str\u003dbase.RULE_ADMIN,"},{"line_number":25,"context_line":"        description\u003d\u0027Action on all tenants.\u0027),"},{"line_number":26,"context_line":"    policy.RuleDefault("},{"line_number":27,"context_line":"        name\u003d\"edit_managed_records\","},{"line_number":28,"context_line":"        check_str\u003dbase.RULE_ADMIN,"},{"line_number":29,"context_line":"        description\u003d\u0027Edit managed records.\u0027),"},{"line_number":30,"context_line":"    policy.RuleDefault("},{"line_number":31,"context_line":"        name\u003d\"use_low_ttl\","},{"line_number":32,"context_line":"        check_str\u003dbase.RULE_ADMIN,"},{"line_number":33,"context_line":"        description\u003d\u0027Use low TTL.\u0027),"},{"line_number":34,"context_line":"    policy.RuleDefault("},{"line_number":35,"context_line":"        name\u003d\"use_sudo\","},{"line_number":36,"context_line":"        check_str\u003dbase.RULE_ADMIN,"},{"line_number":37,"context_line":"        description\u003d\u0027Accept sudo from user to tenant.\u0027)"},{"line_number":38,"context_line":"]"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":""}],"source_content_type":"text/x-python","patch_set":12,"id":"5f4e5783_4120a848","line":37,"range":{"start_line":22,"start_character":0,"end_line":37,"end_character":55},"in_reply_to":"5f4e5783_414903ce","updated":"2017-10-16 15:42:01.000000000","message":"I doubt it needs to be redundant or at every usage point. The main reason for including this is to make sure operators can easily find what a rule means, without having to dig into the code. So long as that\u0027s possible, then we\u0027re in a better place.","commit_id":"6090a34215db520a48593283e5c95de9dba2a15f"}],"designate/common/policies/diagnostics.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"37e07055bfbe9015eadccb07ae8910f9a4415ffc","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"rules \u003d ["},{"line_number":23,"context_line":"    policy.RuleDefault("},{"line_number":24,"context_line":"        \"diagnostics_ping\","},{"line_number":25,"context_line":"        base.RULE_ADMIN),"},{"line_number":26,"context_line":"    policy.RuleDefault("}],"source_content_type":"text/x-python","patch_set":6,"id":"7f515b1d_1913dbba","line":23,"range":{"start_line":23,"start_character":11,"end_line":23,"end_character":22},"updated":"2017-10-04 16:47:40.000000000","message":"Same comment about DocumentedRuleDefault can be applied here.","commit_id":"6e3932720c0c20ee3f3efdb8b16e184033bcadba"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"fda8e351da23bd8de8db7ec7944795fe948d5d3c","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"rules \u003d ["},{"line_number":22,"context_line":"    policy.RuleDefault("},{"line_number":23,"context_line":"        name\u003d\"diagnostics_ping\","},{"line_number":24,"context_line":"        check_str\u003dbase.RULE_ADMIN,"},{"line_number":25,"context_line":"        description\u003d\u0027Diagnose ping.\u0027),"}],"source_content_type":"text/x-python","patch_set":10,"id":"5f4e5783_42716ae0","line":22,"range":{"start_line":22,"start_character":11,"end_line":22,"end_character":22},"updated":"2017-10-10 14:34:57.000000000","message":"Same comment here about using DocumentedRuleDefault.","commit_id":"6452748476677d18cc8ebc25a32ab1c2994bfcf8"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"3945a63687eeb3c9ab7bd8b7b38b900d3b4d5d5c","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"rules \u003d ["},{"line_number":22,"context_line":"    policy.RuleDefault("},{"line_number":23,"context_line":"        name\u003d\"diagnostics_ping\","},{"line_number":24,"context_line":"        check_str\u003dbase.RULE_ADMIN,"},{"line_number":25,"context_line":"        description\u003d\u0027Diagnose ping.\u0027),"}],"source_content_type":"text/x-python","patch_set":12,"id":"5f4e5783_a1dabc47","line":22,"range":{"start_line":22,"start_character":11,"end_line":22,"end_character":22},"updated":"2017-10-16 15:42:01.000000000","message":"Just to recap, these aren\u0027t using DocumentedRuleDefault because they are policies that are checked via RPC calls? Are these invoked frequently by multiple APIs?\n\nThis seems like an internal thing that needs to work in order for designate to do what it needs to do. If that is correct, is there any value in exposing these policies to operators?","commit_id":"6090a34215db520a48593283e5c95de9dba2a15f"},{"author":{"_account_id":19930,"name":"Dai Dang Van","email":"daidv@omzcloud.vn","username":"daidv"},"change_message_id":"267078a3ffe7a70519d7abb4c9446cf7cbb20d63","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"rules \u003d ["},{"line_number":22,"context_line":"    policy.RuleDefault("},{"line_number":23,"context_line":"        name\u003d\"diagnostics_ping\","},{"line_number":24,"context_line":"        check_str\u003dbase.RULE_ADMIN,"},{"line_number":25,"context_line":"        description\u003d\u0027Diagnose ping.\u0027),"}],"source_content_type":"text/x-python","patch_set":12,"id":"5f4e5783_2368061b","line":22,"range":{"start_line":22,"start_character":11,"end_line":22,"end_character":22},"in_reply_to":"5f4e5783_a1dabc47","updated":"2017-10-17 01:50:38.000000000","message":"For now, most of Designate rules is checked under RPC servers.\n\nAt some points which I used DocumentedRuleDefault, because we can map between API call and RPC call. With other rules, I\u0027m thinking about how to describe more information for them, but first of all, we just migrate them into codebase.\n\nAnd IMO, the exposing these policies to operators will help them easier to know which permission is required for each action not only via API but also RPC.","commit_id":"6090a34215db520a48593283e5c95de9dba2a15f"}],"designate/common/policies/pool.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"3945a63687eeb3c9ab7bd8b7b38b900d3b4d5d5c","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"rules \u003d ["},{"line_number":22,"context_line":"    policy.RuleDefault("},{"line_number":23,"context_line":"        name\u003d\"create_pool\","},{"line_number":24,"context_line":"        check_str\u003dbase.RULE_ADMIN,"},{"line_number":25,"context_line":"        description\u003d\u0027Create pool.\u0027),"}],"source_content_type":"text/x-python","patch_set":12,"id":"5f4e5783_c1c25859","line":22,"range":{"start_line":22,"start_character":11,"end_line":22,"end_character":22},"updated":"2017-10-16 15:42:01.000000000","message":"Same comment here as in the previous module","commit_id":"6090a34215db520a48593283e5c95de9dba2a15f"},{"author":{"_account_id":19930,"name":"Dai Dang Van","email":"daidv@omzcloud.vn","username":"daidv"},"change_message_id":"df64c80ebe672810e6863d826cee4e743a37e007","unresolved":false,"context_lines":[{"line_number":65,"context_line":"        check_str\u003dbase.RULE_ADMIN,"},{"line_number":66,"context_line":"        description\u003d\u0027Delete pool.\u0027"},{"line_number":67,"context_line":"    ),"},{"line_number":68,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":69,"context_line":"        name\u003d\"zone_create_forced_pool\","},{"line_number":70,"context_line":"        check_str\u003dbase.RULE_ADMIN,"},{"line_number":71,"context_line":"        description\u003d\u0027load and set the pool to the one provided in the Zone attributes.\u0027,  # noqa"},{"line_number":72,"context_line":"        operations\u003d["},{"line_number":73,"context_line":"            {"},{"line_number":74,"context_line":"                \u0027path\u0027: \u0027/v2/zones\u0027,"},{"line_number":75,"context_line":"                \u0027method\u0027: \u0027POST\u0027"},{"line_number":76,"context_line":"            }"},{"line_number":77,"context_line":"        ]"},{"line_number":78,"context_line":"    )"},{"line_number":79,"context_line":"]"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":""}],"source_content_type":"text/x-python","patch_set":12,"id":"5f4e5783_211de7bc","line":78,"range":{"start_line":68,"start_character":3,"end_line":78,"end_character":5},"updated":"2017-10-13 09:25:31.000000000","message":"The same thing related to location of zone_create_forced_pool in source code.","commit_id":"6090a34215db520a48593283e5c95de9dba2a15f"}]}