)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"2a2173eb2b8ab44b870d3426fcf59303c1efc0f0","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Add policy style \u0027@\u0027/\u0027!\u0027 rules to prop protections"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"A value of \u0027@\u0027 for an operation means all roles can perform that"},{"line_number":10,"context_line":"operation on a property."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"A value of \u0027!\u0027 for an operation means no roles can perform that"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"AAAASn%2F%2FEe8%3D","line":9,"updated":"2013-09-12 16:59:09.000000000","message":"Really,really, minor nit.... Do we really mean \u0027all roles\u0027 here? \u0027@\u0027 / \u0027!\u0027 are not necessarily concerned with roles per se. How about:\n\n \u0027@\u0027 will always allow the operation, and \u0027!\u0027 will always disallow the operation.","commit_id":"d04e8efefb941109e4170972838bc0f70cdb0f7e"},{"author":{"_account_id":8759,"name":"Arnaud Legendre","email":"arnaudleg@gmail.com","username":"arnaud"},"change_message_id":"323c9a55865e6522526ba2c5759797aac24177fd","unresolved":false,"context_lines":[{"line_number":9,"context_line":"A value of \u0027@\u0027 will always allow the corresponding operation for a"},{"line_number":10,"context_line":"property, and \u0027!\u0027 will always disallow the operation."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Related to bp api-v2-property-protection"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"DocImpact"},{"line_number":15,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":8,"id":"AAAATn%2F%2FabQ%3D","line":12,"updated":"2013-11-06 21:44:40.000000000","message":"Could you fix the link to the blueprint? https://blueprints.launchpad.net/openstack/?searchtext\u003dapi-v2-property-protection\n\nNo feature specifications match your criteria.","commit_id":"8f990340ca3e42f2f2ef6841b5547e864bf65f9e"},{"author":{"_account_id":7817,"name":"Thomas Leaman","email":"thomas.leaman@hp.com","username":"bugsduggan"},"change_message_id":"47a5e6ce6b3438001d4a530f06e8275743badeab","unresolved":false,"context_lines":[{"line_number":9,"context_line":"A value of \u0027@\u0027 will always allow the corresponding operation for a"},{"line_number":10,"context_line":"property, and \u0027!\u0027 will always disallow the operation."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Related to bp api-v2-property-protection"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"DocImpact"},{"line_number":15,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":8,"id":"AAAATn%2F%2FZL0%3D","line":12,"in_reply_to":"AAAATn%2F%2FabQ%3D","updated":"2013-11-07 11:01:03.000000000","message":"The blueprint is available here: https://blueprints.launchpad.net/glance/+spec/api-v2-property-protection\n\nThe commit message matches the syntax and format of other commits for this blueprint, it also matches the format specified in the OpenStack documentation but it seems that gerrit doesn\u0027t want to create the link correctly.\n\nIf I\u0027ve messed up the syntax somehow, please do let me know and I\u0027ll be only too happy to change it but I think this could be a bug in Launchpad/Gerrit interactions.","commit_id":"8f990340ca3e42f2f2ef6841b5547e864bf65f9e"}],"glance/common/property_utils.py":[{"author":{"_account_id":8158,"name":"Hemanth Makkapati","email":"makstacker+osgerrit@gmail.com","username":"hemanth.makkapati"},"change_message_id":"22884a08aae20f30681eb72242c5e51500cea0d5","unresolved":false,"context_lines":[{"line_number":164,"context_line":"                        prop_exp_key \u003d self.prop_exp_mapping[rule_exp]"},{"line_number":165,"context_line":"                        return self._check_policy(prop_exp_key, action,"},{"line_number":166,"context_line":"                                                  context)"},{"line_number":167,"context_line":"                    if \u0027@\u0027 in rule_roles and \u0027!\u0027 in rule_roles:"},{"line_number":168,"context_line":"                        msg \u003d _(\"Malformed property protection rule \u0027%s\u0027: \u0027@\u0027 \""},{"line_number":169,"context_line":"                                \"and \u0027!\u0027 are mutually exclusive\""},{"line_number":170,"context_line":"                                % property_name)"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAATn%2F%2Fu8I%3D","line":167,"updated":"2013-10-29 18:47:21.000000000","message":"IIUC, the operators \u0027@\u0027 and \u0027!\u0027 should be applicable regardless of the rule format (policies and roles) used. So maybe check for \u0027@\u0027 and \u0027!\u0027 before we do the policies check at L163?\n\nAlso, I am guessing this calls for adding more tests that use the \u0027@\u0027 and \u0027!\u0027 operators with policies as the rule format?","commit_id":"5011c1749fe517b820a69d90adb6b61393826ee9"},{"author":{"_account_id":6549,"name":"Zhi Yan Liu","email":"lzy.dev@gmail.com","username":"lzy-dev"},"change_message_id":"d827029103ac2f5be6b02a8c18d2d97da31db3fc","unresolved":false,"context_lines":[{"line_number":164,"context_line":"                        prop_exp_key \u003d self.prop_exp_mapping[rule_exp]"},{"line_number":165,"context_line":"                        return self._check_policy(prop_exp_key, action,"},{"line_number":166,"context_line":"                                                  context)"},{"line_number":167,"context_line":"                    if \u0027@\u0027 in rule_roles and \u0027!\u0027 in rule_roles:"},{"line_number":168,"context_line":"                        msg \u003d _(\"Malformed property protection rule \u0027%s\u0027: \u0027@\u0027 \""},{"line_number":169,"context_line":"                                \"and \u0027!\u0027 are mutually exclusive\""},{"line_number":170,"context_line":"                                % property_name)"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAATn%2F%2Foqo%3D","line":167,"in_reply_to":"AAAATn%2F%2Fu8I%3D","updated":"2013-10-31 05:09:38.000000000","message":"+1","commit_id":"5011c1749fe517b820a69d90adb6b61393826ee9"},{"author":{"_account_id":4463,"name":"iccha-sethi","email":"iccha.sethi@rackspace.com","username":"iccha-sethi"},"change_message_id":"cf0b9f8c50b0167a4c266c45483f18d5fa1f2768","unresolved":false,"context_lines":[{"line_number":100,"context_line":"                            LOG.error(msg)"},{"line_number":101,"context_line":"                            raise exception.\\"},{"line_number":102,"context_line":"                                InvalidPropertyProtectionConfiguration()"},{"line_number":103,"context_line":"                        self.prop_exp_mapping[compiled_rule] \u003d property_exp"},{"line_number":104,"context_line":"                        self._add_policy_rules(property_exp, operation,"},{"line_number":105,"context_line":"                                               permissions)"},{"line_number":106,"context_line":"                        permissions \u003d [permissions]"}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAATn%2F%2FYyI%3D","line":103,"updated":"2013-11-07 14:32:35.000000000","message":"what will happen if the permissions here is @ for rule_format policy?","commit_id":"db76efee723a8fde92bf942bf18f087022f1b709"},{"author":{"_account_id":6549,"name":"Zhi Yan Liu","email":"lzy.dev@gmail.com","username":"lzy-dev"},"change_message_id":"e7a2d53372b554552d7c4d9188a10fbea91fe924","unresolved":false,"context_lines":[{"line_number":174,"context_line":"                        return True"},{"line_number":175,"context_line":"                    elif \u0027!\u0027 in rule_roles:"},{"line_number":176,"context_line":"                        return False"},{"line_number":177,"context_line":"                    elif set(roles).intersection(set(rule_roles)):"},{"line_number":178,"context_line":"                        return True"},{"line_number":179,"context_line":"                    if self.prop_prot_rule_format \u003d\u003d \u0027policies\u0027:"},{"line_number":180,"context_line":"                        prop_exp_key \u003d self.prop_exp_mapping[rule_exp]"}],"source_content_type":"text/x-python","patch_set":10,"id":"AAAATn%2F%2FQdo%3D","line":177,"updated":"2013-11-12 06:43:54.000000000","message":"Nit: we don\u0027t need to put/change this check into the same if-elif-group with !@ checking, they are non-related. The original code is fine to me.","commit_id":"05be09fcae10c33e83d9ee1945e302869b587894"}],"glance/tests/functional/v2/test_images.py":[{"author":{"_account_id":7817,"name":"Thomas Leaman","email":"thomas.leaman@hp.com","username":"bugsduggan"},"change_message_id":"54771d763e1330dea3b1ec2ca727839919ddfd92","unresolved":false,"context_lines":[{"line_number":829,"context_line":"            \u0027x_none_read\u0027: \u00271\u0027"},{"line_number":830,"context_line":"        })"},{"line_number":831,"context_line":"        response \u003d requests.post(path, headers\u003dheaders, data\u003ddata)"},{"line_number":832,"context_line":"        self.assertEqual(201, response.status_code)"},{"line_number":833,"context_line":"        image \u003d json.loads(response.text)"},{"line_number":834,"context_line":"        image_id \u003d image[\u0027id\u0027]"},{"line_number":835,"context_line":"        self.assertNotIn(\u0027x_none_read\u0027, image.keys())"}],"source_content_type":"text/x-python","patch_set":8,"id":"AAAATn%2F%2FayU%3D","line":832,"updated":"2013-11-07 10:53:27.000000000","message":"This assertion does *not* fail, only the \u0027x_none_read\u0027 attribute is dropped from the request.","commit_id":"8f990340ca3e42f2f2ef6841b5547e864bf65f9e"},{"author":{"_account_id":7817,"name":"Thomas Leaman","email":"thomas.leaman@hp.com","username":"bugsduggan"},"change_message_id":"54771d763e1330dea3b1ec2ca727839919ddfd92","unresolved":false,"context_lines":[{"line_number":1106,"context_line":"            \u0027x_none_read\u0027: \u00271\u0027"},{"line_number":1107,"context_line":"        })"},{"line_number":1108,"context_line":"        response \u003d requests.post(path, headers\u003dheaders, data\u003ddata)"},{"line_number":1109,"context_line":"        self.assertEqual(201, response.status_code)"},{"line_number":1110,"context_line":"        image \u003d json.loads(response.text)"},{"line_number":1111,"context_line":"        image_id \u003d image[\u0027id\u0027]"},{"line_number":1112,"context_line":"        self.assertNotIn(\u0027x_none_read\u0027, image.keys())"}],"source_content_type":"text/x-python","patch_set":8,"id":"AAAATn%2F%2Fayw%3D","line":1109,"updated":"2013-11-07 10:53:27.000000000","message":"This will fail as the actual response code is 403.\n\nI believe that the policy-based property-protections code is marking the entire request as not allowed when I think it should only drop the \u0027x_none_read\u0027 property and process the rest of the request as normal.","commit_id":"8f990340ca3e42f2f2ef6841b5547e864bf65f9e"},{"author":{"_account_id":4463,"name":"iccha-sethi","email":"iccha.sethi@rackspace.com","username":"iccha-sethi"},"change_message_id":"65ad6185bea27ed1cb168d114211a3e0d8195cdc","unresolved":false,"context_lines":[{"line_number":924,"context_line":"    def test_property_protections_special_chars_policies(self):"},{"line_number":925,"context_line":"        # Enable property protection"},{"line_number":926,"context_line":"        self.api_server.property_protection_file \u003d self.property_file_policies"},{"line_number":927,"context_line":"        self.api_server.property_protection_rul_format \u003d \u0027policies\u0027"},{"line_number":928,"context_line":"        self.start_servers(**self.__dict__.copy())"},{"line_number":929,"context_line":""},{"line_number":930,"context_line":"        # Verify both admin and unknown role can create properties marked with"}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAATn%2F%2FYu4%3D","line":927,"updated":"2013-11-07 15:00:39.000000000","message":"rule instead of rul?\n\nhttps://github.com/openstack/glance/blob/master/glance/tests/functional/__init__.py#L313","commit_id":"db76efee723a8fde92bf942bf18f087022f1b709"}],"glance/tests/integration/legacy_functional/test_v1_api.py":[{"author":{"_account_id":6549,"name":"Zhi Yan Liu","email":"lzy.dev@gmail.com","username":"lzy-dev"},"change_message_id":"e7a2d53372b554552d7c4d9188a10fbea91fe924","unresolved":false,"context_lines":[{"line_number":1435,"context_line":"            \u0027X-Image-Meta-Property-spl_update_prop\u0027: \u0027u\u0027,"},{"line_number":1436,"context_line":"            \u0027X-Glance-Registry-Purge-Props\u0027: \u0027True\u0027"},{"line_number":1437,"context_line":"        }"},{"line_number":1438,"context_line":"        auth_headers.update(auth_headers)"},{"line_number":1439,"context_line":"        auth_headers.update(custom_props)"},{"line_number":1440,"context_line":"        path \u003d \"/v1/images/%s\" % image_id"},{"line_number":1441,"context_line":"        response, content \u003d self.http.request(path, \u0027PUT\u0027,"}],"source_content_type":"text/x-python","patch_set":10,"id":"AAAATn%2F%2FQbc%3D","side":"PARENT","line":1438,"updated":"2013-11-12 06:43:54.000000000","message":"Nit: TBH I don\u0027t think this is a good hobbit since the change isn\u0027t related with this patch. Think about cherrypick for portback, we\u0027d better keep change self-contain.","commit_id":"6ba3ebbf8d55ea2619da50f68b435936e6ad7e51"}],"glance/tests/unit/common/test_property_utils.py":[{"author":{"_account_id":6549,"name":"Zhi Yan Liu","email":"lzy.dev@gmail.com","username":"lzy-dev"},"change_message_id":"be53a87a43f6680b2a698f34132af643e92f0c1c","unresolved":false,"context_lines":[{"line_number":31,"context_line":"    \u0027x_invalid_all_and_none\u0027,"},{"line_number":32,"context_line":"    \u0027x_none_read\u0027,"},{"line_number":33,"context_line":"    \u0027x_none_update\u0027,"},{"line_number":34,"context_line":"    \u0027x_none_delete\u0027,"},{"line_number":35,"context_line":"    \u0027.*\u0027"},{"line_number":36,"context_line":"]"},{"line_number":37,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAAS3%2F%2FazY%3D","line":34,"updated":"2013-09-27 04:20:51.000000000","message":"I can\u0027t found test cases in this level for \u0027x_none_read\u0027, \u0027x_none_update\u0027, and \u0027x_none_delete\u0027 three rules, do you think add them will be better?","commit_id":"b5d76b972d7ecd200cf229855c9aad8e12a23bb0"},{"author":{"_account_id":6549,"name":"Zhi Yan Liu","email":"lzy.dev@gmail.com","username":"lzy-dev"},"change_message_id":"f29b0f8d6eab4ff007af14768fe101ebe608baf6","unresolved":false,"context_lines":[{"line_number":31,"context_line":"    \u0027x_invalid_all_and_none\u0027,"},{"line_number":32,"context_line":"    \u0027x_none_read\u0027,"},{"line_number":33,"context_line":"    \u0027x_none_update\u0027,"},{"line_number":34,"context_line":"    \u0027x_none_delete\u0027,"},{"line_number":35,"context_line":"    \u0027.*\u0027"},{"line_number":36,"context_line":"]"},{"line_number":37,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAAS3%2F%2FXjA%3D","line":34,"in_reply_to":"AAAAS3%2F%2FZBE%3D","updated":"2013-09-28 01:29:11.000000000","message":"Thanks for your explaining, I totally understand the reason why they are there.\n\nActually I\u0027d like to see a sections be tested which contains different rules for the same property but not \u0027all_permitted\u0027 or \u0027none_permitted\u0027. That say one action can pass but other one will be failed but not all pass or all fail. In your below added cases, you tested \u0027all_permitted\u0027 and \u0027none_permitted\u0027, but there\u0027s no partial_permitted.\n\nIf you think test them three all is a little duplicating, you can just test one such as \u0027x_none_read\u0027, that means, action [\u0027create\u0027, \u0027update\u0027, \u0027delete\u0027] can pass but \u0027read\u0027 will be failed, you can write those assertions in one test function.","commit_id":"b5d76b972d7ecd200cf229855c9aad8e12a23bb0"},{"author":{"_account_id":7817,"name":"Thomas Leaman","email":"thomas.leaman@hp.com","username":"bugsduggan"},"change_message_id":"6445404de6d510f2a99aa51917df6a12019ea745","unresolved":false,"context_lines":[{"line_number":31,"context_line":"    \u0027x_invalid_all_and_none\u0027,"},{"line_number":32,"context_line":"    \u0027x_none_read\u0027,"},{"line_number":33,"context_line":"    \u0027x_none_update\u0027,"},{"line_number":34,"context_line":"    \u0027x_none_delete\u0027,"},{"line_number":35,"context_line":"    \u0027.*\u0027"},{"line_number":36,"context_line":"]"},{"line_number":37,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAAS3%2F%2FZBE%3D","line":34,"in_reply_to":"AAAAS3%2F%2FZHo%3D","updated":"2013-09-27 16:19:26.000000000","message":"(you\u0027re more than welcome to nit-pick, I actively encourage it!)\n\nThe reason these are included in CONFIG_SECTIONS (as far as I can tell) is that the config file in glance/tests/etc/ needs these sections for the functional tests and test_property_rules_loaded_in_order is a lot simpler if we can just compare the array above with the section headers in the file.\n\nI\u0027m slightly uncomfortable with duplicating tests (they take long enough to run as it is!). But maybe a comment explaining why they\u0027re there would be a reasonable compromise?","commit_id":"b5d76b972d7ecd200cf229855c9aad8e12a23bb0"},{"author":{"_account_id":6549,"name":"Zhi Yan Liu","email":"lzy.dev@gmail.com","username":"lzy-dev"},"change_message_id":"760498643cd38e548e56e7cf0aff75c49498cc1a","unresolved":false,"context_lines":[{"line_number":31,"context_line":"    \u0027x_invalid_all_and_none\u0027,"},{"line_number":32,"context_line":"    \u0027x_none_read\u0027,"},{"line_number":33,"context_line":"    \u0027x_none_update\u0027,"},{"line_number":34,"context_line":"    \u0027x_none_delete\u0027,"},{"line_number":35,"context_line":"    \u0027.*\u0027"},{"line_number":36,"context_line":"]"},{"line_number":37,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAAS3%2F%2FZHo%3D","line":34,"in_reply_to":"AAAAS3%2F%2FZTw%3D","updated":"2013-09-27 16:12:16.000000000","message":"The reason is that in this property_utils ut test you only covered above three rules but no one for x_none_read\u0027, \u0027x_none_update\u0027, and \u0027x_none_delete\u0027. Your function test cases have covered them all.\n\nI\u0027m not nit-picking sorry, actually this is not a blocker to me, already +1 you know? but I think it will be better to make the ut complete.","commit_id":"b5d76b972d7ecd200cf229855c9aad8e12a23bb0"},{"author":{"_account_id":7817,"name":"Thomas Leaman","email":"thomas.leaman@hp.com","username":"bugsduggan"},"change_message_id":"7f8a56a81ab59cfe8c68a3e44184596c6290e129","unresolved":false,"context_lines":[{"line_number":31,"context_line":"    \u0027x_invalid_all_and_none\u0027,"},{"line_number":32,"context_line":"    \u0027x_none_read\u0027,"},{"line_number":33,"context_line":"    \u0027x_none_update\u0027,"},{"line_number":34,"context_line":"    \u0027x_none_delete\u0027,"},{"line_number":35,"context_line":"    \u0027.*\u0027"},{"line_number":36,"context_line":"]"},{"line_number":37,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAAS3%2F%2FZTw%3D","line":34,"in_reply_to":"AAAAS3%2F%2FazY%3D","updated":"2013-09-27 15:25:29.000000000","message":"I don\u0027t think that they will add much value at this level but I\u0027m open to discussion on it if you feel something is really lacking.","commit_id":"b5d76b972d7ecd200cf229855c9aad8e12a23bb0"}]}