)]}'
{"etc/glance-api.conf":[{"author":{"_account_id":6549,"name":"Zhi Yan Liu","email":"lzy.dev@gmail.com","username":"lzy-dev"},"change_message_id":"f347c7066ac70f808509e5e391b7aa6cc6184cfa","unresolved":false,"context_lines":[{"line_number":116,"context_line":"# If a value is specified and the file is not found, then an"},{"line_number":117,"context_line":"# HTTPInternalServerError will be thrown."},{"line_number":118,"context_line":"#property_protection_file \u003d"},{"line_number":119,"context_line":"# Specify whether \u0027roles\u0027 or \u0027policies\u0027 are used in the"},{"line_number":120,"context_line":"# property_protection_file."},{"line_number":121,"context_line":"# The default value for property_protections_use is \u0027roles\u0027."},{"line_number":122,"context_line":"#property_protection_uses \u003d roles"}],"source_content_type":"text/plain","patch_set":6,"id":"AAAATH%2F%2FhL0%3D","line":119,"updated":"2013-10-15 04:23:43.000000000","message":"TBH, I personally prefer change doc/source/configuring.rst also in the change. Maybe you like do it later with a dedicated doc change.","commit_id":"cd8b5fd7f29e5a2f4b6b7201540fd95fb0966e24"},{"author":{"_account_id":4463,"name":"iccha-sethi","email":"iccha.sethi@rackspace.com","username":"iccha-sethi"},"change_message_id":"e94face48bd1977b2a5637d0813f18b23c43dcda","unresolved":false,"context_lines":[{"line_number":116,"context_line":"# If a value is specified and the file is not found, then an"},{"line_number":117,"context_line":"# HTTPInternalServerError will be thrown."},{"line_number":118,"context_line":"#property_protection_file \u003d"},{"line_number":119,"context_line":"# Specify whether \u0027roles\u0027 or \u0027policies\u0027 are used in the"},{"line_number":120,"context_line":"# property_protection_file."},{"line_number":121,"context_line":"# The default value for property_protections_use is \u0027roles\u0027."},{"line_number":122,"context_line":"#property_protection_uses \u003d roles"}],"source_content_type":"text/plain","patch_set":6,"id":"AAAATH%2F%2FfS0%3D","line":119,"in_reply_to":"AAAATH%2F%2FhL0%3D","updated":"2013-10-15 14:27:33.000000000","message":"added the documentation in a dependent patch","commit_id":"cd8b5fd7f29e5a2f4b6b7201540fd95fb0966e24"},{"author":{"_account_id":8158,"name":"Hemanth Makkapati","email":"makstacker+osgerrit@gmail.com","username":"hemanth.makkapati"},"change_message_id":"ea28bc7b8695caba9d206face546d8d27d769023","unresolved":false,"context_lines":[{"line_number":116,"context_line":"# If a value is specified and the file is not found, then an"},{"line_number":117,"context_line":"# HTTPInternalServerError will be thrown."},{"line_number":118,"context_line":"#property_protection_file \u003d"},{"line_number":119,"context_line":"# Specify whether \u0027roles\u0027 or \u0027policies\u0027 are used in the"},{"line_number":120,"context_line":"# property_protection_file."},{"line_number":121,"context_line":"# The default value for property_protections_use is \u0027roles\u0027."},{"line_number":122,"context_line":"#property_protection_uses \u003d roles"}],"source_content_type":"text/plain","patch_set":7,"id":"AAAATH%2F%2FfOk%3D","line":119,"updated":"2013-10-15 15:45:36.000000000","message":"Nits.\n- Maybe a new line at 119?\n- An \u0027s\u0027 is missing in \u0027property_protection_use\u0027 at 121.","commit_id":"35858f61273fe2172444c659c13f0dddf5652a88"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"5cd844440c96cf8c735dce1e295790372d004ebc","unresolved":false,"context_lines":[{"line_number":116,"context_line":"# If a value is specified and the file is not found, then an"},{"line_number":117,"context_line":"# HTTPInternalServerError will be thrown."},{"line_number":118,"context_line":"#property_protection_file \u003d"},{"line_number":119,"context_line":"# Specify whether \u0027roles\u0027 or \u0027policies\u0027 are used in the"},{"line_number":120,"context_line":"# property_protection_file."},{"line_number":121,"context_line":"# The default value for property_protections_use is \u0027roles\u0027."},{"line_number":122,"context_line":"#property_protection_uses \u003d roles"}],"source_content_type":"text/plain","patch_set":7,"id":"AAAATH%2F%2Fe2w%3D","line":119,"in_reply_to":"AAAATH%2F%2FfOk%3D","updated":"2013-10-15 16:13:29.000000000","message":"Well, it\u0027s got the extra \u0027s\u0027 at line 121, just not in the right place!  I think Hemanth\u0027s suggestion of a blank line before 119 is a good one.","commit_id":"35858f61273fe2172444c659c13f0dddf5652a88"},{"author":{"_account_id":6549,"name":"Zhi Yan Liu","email":"lzy.dev@gmail.com","username":"lzy-dev"},"change_message_id":"688ef847619a2f693aab58cffc685e5a50c512e1","unresolved":false,"context_lines":[{"line_number":107,"context_line":"# (string value). This setting needs to be the same for both"},{"line_number":108,"context_line":"# glance-scrubber and glance-api."},{"line_number":109,"context_line":"#lock_path\u003d\u003cNone\u003e"},{"line_number":110,"context_line":"#"},{"line_number":111,"context_line":"# Property Protections config file"},{"line_number":112,"context_line":"# This file contains the rules for property protections and the roles"},{"line_number":113,"context_line":"# associated with it."}],"source_content_type":"text/plain","patch_set":11,"id":"AAAATH%2F%2Fce4%3D","line":110,"updated":"2013-10-16 03:05:09.000000000","message":"Nits, could you pls help remove \u0027#\u0027 but keep this blank line here? this will keep consistent with other options.","commit_id":"3ba1485c19ecd3d638f5ec239bb24a09b12ff434"},{"author":{"_account_id":4463,"name":"iccha-sethi","email":"iccha.sethi@rackspace.com","username":"iccha-sethi"},"change_message_id":"bb4e5fa6e11ffdbc8f82b02886a06cb07d558f93","unresolved":false,"context_lines":[{"line_number":110,"context_line":"#"},{"line_number":111,"context_line":"# Property Protections config file"},{"line_number":112,"context_line":"# This file contains the rules for property protections and the roles"},{"line_number":113,"context_line":"# associated with it."},{"line_number":114,"context_line":"# If this config value is not specified, by default, property protections"},{"line_number":115,"context_line":"# won\u0027t be enforced."},{"line_number":116,"context_line":"# If a value is specified and the file is not found, then an"}],"source_content_type":"text/plain","patch_set":11,"id":"AAAATH%2F%2FZIo%3D","line":113,"updated":"2013-10-16 20:32:33.000000000","message":"Need to change it to roles/policies.","commit_id":"3ba1485c19ecd3d638f5ec239bb24a09b12ff434"},{"author":{"_account_id":6549,"name":"Zhi Yan Liu","email":"lzy.dev@gmail.com","username":"lzy-dev"},"change_message_id":"688ef847619a2f693aab58cffc685e5a50c512e1","unresolved":false,"context_lines":[{"line_number":116,"context_line":"# If a value is specified and the file is not found, then an"},{"line_number":117,"context_line":"# HTTPInternalServerError will be thrown."},{"line_number":118,"context_line":"#property_protection_file \u003d"},{"line_number":119,"context_line":"#"},{"line_number":120,"context_line":"# Specify whether \u0027roles\u0027 or \u0027policies\u0027 are used in the"},{"line_number":121,"context_line":"# property_protection_file."},{"line_number":122,"context_line":"# The default value for property_protection_uses is \u0027roles\u0027."}],"source_content_type":"text/plain","patch_set":11,"id":"AAAATH%2F%2Fce0%3D","line":119,"updated":"2013-10-16 03:05:09.000000000","message":"ditto.","commit_id":"3ba1485c19ecd3d638f5ec239bb24a09b12ff434"},{"author":{"_account_id":6549,"name":"Zhi Yan Liu","email":"lzy.dev@gmail.com","username":"lzy-dev"},"change_message_id":"688ef847619a2f693aab58cffc685e5a50c512e1","unresolved":false,"context_lines":[{"line_number":121,"context_line":"# property_protection_file."},{"line_number":122,"context_line":"# The default value for property_protection_uses is \u0027roles\u0027."},{"line_number":123,"context_line":"#property_protection_uses \u003d roles"},{"line_number":124,"context_line":"#"},{"line_number":125,"context_line":"# Set a system wide quota for every user.  This value is the total number"},{"line_number":126,"context_line":"# of bytes that a user can use across all storage systems.  A value of"},{"line_number":127,"context_line":"# 0 means unlimited."}],"source_content_type":"text/plain","patch_set":11,"id":"AAAATH%2F%2Fces%3D","line":124,"updated":"2013-10-16 03:05:09.000000000","message":"ditto.","commit_id":"3ba1485c19ecd3d638f5ec239bb24a09b12ff434"}],"etc/property-protections-policies.conf.sample":[{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"942a95c72c88fdbc26af13dab14e3f32b091237b","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# property-protections-policies.conf.sample"},{"line_number":2,"context_line":"# Specify regular expression for which properties will be protected in []"},{"line_number":3,"context_line":"# For each section, specify CRUD permissions. You may refer to roles defined"},{"line_number":4,"context_line":"# in policy.json. Instead of roles, policy rules can be used too."},{"line_number":5,"context_line":"# Config value \u0027property_protection_uses\u0027 in glance-api.conf can be set to"},{"line_number":6,"context_line":"# \u0027roles\u0027 or \u0027policies\u0027 to indicate which of the two is used in this file."}],"source_content_type":"application/octet-stream","patch_set":4,"id":"AAAATH%2F%2FjYU%3D","line":3,"updated":"2013-10-14 18:06:26.000000000","message":"You may refer to roles defined -\u003e You may refer to policies defined","commit_id":"d6c7bf601862ba2a7c1c930c47b41ba8cde123fc"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"942a95c72c88fdbc26af13dab14e3f32b091237b","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# property-protections-policies.conf.sample"},{"line_number":2,"context_line":"# Specify regular expression for which properties will be protected in []"},{"line_number":3,"context_line":"# For each section, specify CRUD permissions. You may refer to roles defined"},{"line_number":4,"context_line":"# in policy.json. Instead of roles, policy rules can be used too."},{"line_number":5,"context_line":"# Config value \u0027property_protection_uses\u0027 in glance-api.conf can be set to"},{"line_number":6,"context_line":"# \u0027roles\u0027 or \u0027policies\u0027 to indicate which of the two is used in this file."},{"line_number":7,"context_line":"# But if a policy rule is used, you CANNOT specify any other role for that action."}],"source_content_type":"application/octet-stream","patch_set":4,"id":"AAAATH%2F%2FjYE%3D","line":4,"updated":"2013-10-14 18:06:26.000000000","message":"I\u0027d find it a little clearer if this file which (judging by its name) is policy centric said less about roles. Eg just say this file shows an example config file when \u0027property_protection_uses \u003d policies\u0027 is enabled.","commit_id":"d6c7bf601862ba2a7c1c930c47b41ba8cde123fc"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"942a95c72c88fdbc26af13dab14e3f32b091237b","unresolved":false,"context_lines":[{"line_number":13,"context_line":"# HTTPInternalServerErrors will be thrown. (Guide for reg ex python compiler used:"},{"line_number":14,"context_line":"# http://docs.python.org/2/library/re.html#regular-expression-syntax)"},{"line_number":15,"context_line":"# * If an operation(create, read, update, delete) is not specified or misspelt"},{"line_number":16,"context_line":"# then that operation for the given regex is disabled for all roles."},{"line_number":17,"context_line":"# So, remember, with GREAT POWER comes GREAT RESPONSIBILITY!"},{"line_number":18,"context_line":"#"},{"line_number":19,"context_line":"# NOTE: This file uses policies to protect operations on properties."}],"source_content_type":"application/octet-stream","patch_set":4,"id":"AAAATH%2F%2FjWU%3D","line":16,"updated":"2013-10-14 18:06:26.000000000","message":"is disabled for all roles -\u003e policies","commit_id":"d6c7bf601862ba2a7c1c930c47b41ba8cde123fc"},{"author":{"_account_id":6549,"name":"Zhi Yan Liu","email":"lzy.dev@gmail.com","username":"lzy-dev"},"change_message_id":"f347c7066ac70f808509e5e391b7aa6cc6184cfa","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# property-protections-policies.conf.sample"},{"line_number":2,"context_line":"# "},{"line_number":3,"context_line":"# This file is an example config file for when"},{"line_number":4,"context_line":"# property_protection_uses\u003dpolicies is enabled."},{"line_number":5,"context_line":"#"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"AAAATH%2F%2FhLk%3D","line":2,"updated":"2013-10-15 04:23:43.000000000","message":"pep8 violation. and Line #19.","commit_id":"cd8b5fd7f29e5a2f4b6b7201540fd95fb0966e24"},{"author":{"_account_id":177,"name":"Alex Meade","email":"mr.alex.meade@gmail.com","username":"alex-meade"},"change_message_id":"431a35caa1d79bf9fe1931bd820d6901ec0fa9f6","unresolved":false,"context_lines":[{"line_number":7,"context_line":"# For each section, specify CRUD permissions. You may refer to policies defined"},{"line_number":8,"context_line":"# in policy.json."},{"line_number":9,"context_line":"# The property rules will be applied in the order specified below. Once"},{"line_number":10,"context_line":"# a match is found the remaining property rules will not be traversed through."},{"line_number":11,"context_line":"#"},{"line_number":12,"context_line":"# WARNING:"},{"line_number":13,"context_line":"# * If the reg ex specified below does not compile, then"}],"source_content_type":"application/octet-stream","patch_set":11,"id":"AAAATH%2F%2Fd3o%3D","line":10,"updated":"2013-10-15 20:31:16.000000000","message":"Maybe this could be a little clearer. At first glance (heh) it\u0027s not obvious what this means, but it seems to mean the first matching set of rules will be applied and all other matches ignored. top to bottom","commit_id":"3ba1485c19ecd3d638f5ec239bb24a09b12ff434"},{"author":{"_account_id":177,"name":"Alex Meade","email":"mr.alex.meade@gmail.com","username":"alex-meade"},"change_message_id":"77c6e1f9d0d0d2dbeb2280760e66ea4aadf67000","unresolved":false,"context_lines":[{"line_number":7,"context_line":"# For each section, specify CRUD permissions. You may refer to policies defined"},{"line_number":8,"context_line":"# in policy.json."},{"line_number":9,"context_line":"# The property rules will be applied in the order specified below. Once"},{"line_number":10,"context_line":"# a match is found the remaining property rules will not be traversed through."},{"line_number":11,"context_line":"#"},{"line_number":12,"context_line":"# WARNING:"},{"line_number":13,"context_line":"# * If the reg ex specified below does not compile, then"}],"source_content_type":"application/octet-stream","patch_set":11,"id":"AAAATH%2F%2FdsQ%3D","line":10,"in_reply_to":"AAAATH%2F%2Fd3o%3D","updated":"2013-10-15 20:56:16.000000000","message":"Is it intended that if no matches are found then the property is not protected at all? If yes or no we could mention it here.\n\nAlso it seems that if this file is blank and the service is restarted, no property protection takes place.","commit_id":"3ba1485c19ecd3d638f5ec239bb24a09b12ff434"},{"author":{"_account_id":177,"name":"Alex Meade","email":"mr.alex.meade@gmail.com","username":"alex-meade"},"change_message_id":"431a35caa1d79bf9fe1931bd820d6901ec0fa9f6","unresolved":false,"context_lines":[{"line_number":11,"context_line":"#"},{"line_number":12,"context_line":"# WARNING:"},{"line_number":13,"context_line":"# * If the reg ex specified below does not compile, then"},{"line_number":14,"context_line":"# HTTPInternalServerErrors will be thrown. (Guide for reg ex python compiler used:"},{"line_number":15,"context_line":"# http://docs.python.org/2/library/re.html#regular-expression-syntax)"},{"line_number":16,"context_line":"# * If an operation(create, read, update, delete) is not specified or misspelt"},{"line_number":17,"context_line":"# then that operation for the given regex is disabled for all roles."}],"source_content_type":"application/octet-stream","patch_set":11,"id":"AAAATH%2F%2Fd74%3D","line":14,"updated":"2013-10-15 20:31:16.000000000","message":"Is this true? If so I think it should instead fail to start the service. Another question, is intended to be able to change these configs without restarting the service?","commit_id":"3ba1485c19ecd3d638f5ec239bb24a09b12ff434"},{"author":{"_account_id":177,"name":"Alex Meade","email":"mr.alex.meade@gmail.com","username":"alex-meade"},"change_message_id":"431a35caa1d79bf9fe1931bd820d6901ec0fa9f6","unresolved":false,"context_lines":[{"line_number":13,"context_line":"# * If the reg ex specified below does not compile, then"},{"line_number":14,"context_line":"# HTTPInternalServerErrors will be thrown. (Guide for reg ex python compiler used:"},{"line_number":15,"context_line":"# http://docs.python.org/2/library/re.html#regular-expression-syntax)"},{"line_number":16,"context_line":"# * If an operation(create, read, update, delete) is not specified or misspelt"},{"line_number":17,"context_line":"# then that operation for the given regex is disabled for all roles."},{"line_number":18,"context_line":"# So, remember, with GREAT POWER comes GREAT RESPONSIBILITY!"},{"line_number":19,"context_line":"#"}],"source_content_type":"application/octet-stream","patch_set":11,"id":"AAAATH%2F%2Fd4k%3D","line":16,"updated":"2013-10-15 20:31:16.000000000","message":"It currently fails to start the service if it does not have each of these defined","commit_id":"3ba1485c19ecd3d638f5ec239bb24a09b12ff434"},{"author":{"_account_id":177,"name":"Alex Meade","email":"mr.alex.meade@gmail.com","username":"alex-meade"},"change_message_id":"431a35caa1d79bf9fe1931bd820d6901ec0fa9f6","unresolved":false,"context_lines":[{"line_number":18,"context_line":"# So, remember, with GREAT POWER comes GREAT RESPONSIBILITY!"},{"line_number":19,"context_line":"#"},{"line_number":20,"context_line":"# NOTE: Only one policy can be specified per action. If multiple policies are"},{"line_number":21,"context_line":"# specified, then a HTTPInternalServer is raised."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"[^x_.*]"},{"line_number":24,"context_line":"create \u003d default"}],"source_content_type":"application/octet-stream","patch_set":11,"id":"AAAATH%2F%2Fd0A%3D","line":21,"updated":"2013-10-15 20:31:16.000000000","message":"Same here, the service fails to start","commit_id":"3ba1485c19ecd3d638f5ec239bb24a09b12ff434"}],"etc/property-protections-roles.conf.sample":[{"author":{"_account_id":6549,"name":"Zhi Yan Liu","email":"lzy.dev@gmail.com","username":"lzy-dev"},"change_message_id":"f347c7066ac70f808509e5e391b7aa6cc6184cfa","unresolved":false,"context_lines":[{"line_number":5,"context_line":"#"},{"line_number":6,"context_line":"# Specify regular expression for which properties will be protected in []"},{"line_number":7,"context_line":"# For each section, specify CRUD permissions. You may refer to roles defined"},{"line_number":8,"context_line":"# in policy.json. "},{"line_number":9,"context_line":"#"},{"line_number":10,"context_line":"# The property rules will be applied in the order specified below. Once"},{"line_number":11,"context_line":"# a match is found the remaining property rules will not be traversed through."}],"source_content_type":"application/octet-stream","patch_set":6,"id":"AAAATH%2F%2FhLg%3D","line":8,"updated":"2013-10-15 04:23:43.000000000","message":"pep8 violation.","commit_id":"cd8b5fd7f29e5a2f4b6b7201540fd95fb0966e24"},{"author":{"_account_id":8158,"name":"Hemanth Makkapati","email":"makstacker+osgerrit@gmail.com","username":"hemanth.makkapati"},"change_message_id":"ea28bc7b8695caba9d206face546d8d27d769023","unresolved":false,"context_lines":[{"line_number":4,"context_line":"# property_protection_uses\u003droles is enabled."},{"line_number":5,"context_line":"#"},{"line_number":6,"context_line":"# Specify regular expression for which properties will be protected in []"},{"line_number":7,"context_line":"# For each section, specify CRUD permissions. You may refer to roles defined"},{"line_number":8,"context_line":"# in policy.json."},{"line_number":9,"context_line":"#"},{"line_number":10,"context_line":"# The property rules will be applied in the order specified below. Once"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"AAAATH%2F%2FfMc%3D","line":7,"updated":"2013-10-15 15:45:36.000000000","message":"Another nit maybe.\nDid you mean roles \u0027used/referred\u0027 in policy.json instead of \u0027defined\u0027?","commit_id":"35858f61273fe2172444c659c13f0dddf5652a88"}],"etc/property-protections.conf.sample":[{"author":{"_account_id":6549,"name":"Zhi Yan Liu","email":"lzy.dev@gmail.com","username":"lzy-dev"},"change_message_id":"422650900d676f4926ac8d7d79f2eee2d0a63d7a","unresolved":false,"context_lines":[{"line_number":22,"context_line":""},{"line_number":23,"context_line":"[^y_.*]"},{"line_number":24,"context_line":"create \u003d __policy__:context_is_admin"},{"line_number":25,"context_line":"read \u003d __policy__:context_is_admin"},{"line_number":26,"context_line":"update \u003d admin,member"},{"line_number":27,"context_line":"delete \u003d admin,member"},{"line_number":28,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":3,"id":"AAAAS3%2F%2FXic%3D","line":25,"updated":"2013-09-28 03:06:30.000000000","message":"TBH, \u0027__\u0027 is too harsh and a bit strange to me @iccha.","commit_id":"f23e0e2a35511f44dfb177f8bc9706d22d078629"},{"author":{"_account_id":6549,"name":"Zhi Yan Liu","email":"lzy.dev@gmail.com","username":"lzy-dev"},"change_message_id":"28314e4c1704ebc78d58af7a5d06770b904b253e","unresolved":false,"context_lines":[{"line_number":22,"context_line":""},{"line_number":23,"context_line":"[^y_.*]"},{"line_number":24,"context_line":"create \u003d __policy__:context_is_admin"},{"line_number":25,"context_line":"read \u003d __policy__:context_is_admin"},{"line_number":26,"context_line":"update \u003d admin,member"},{"line_number":27,"context_line":"delete \u003d admin,member"},{"line_number":28,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":3,"id":"AAAAS3%2F%2FVRo%3D","line":25,"in_reply_to":"AAAAS3%2F%2FV5A%3D","updated":"2013-09-30 02:52:49.000000000","message":"1. I just don\u0027t think \u0027__\u0027 prefix is a good choice TBH, actually if I\u0027m end user I think \u0027policy\u0027 (without prefix and suffix) is enough clear. I just put my thoughts here, it\u0027s not a blocker.\n\n2. I prefer not allow PP support mix policy and role, that say one action will just allow one policy rule OR a role list, this will prevent clash and make things clear.\n\n3. I\u0027m not sure \u0027policy:*\u0027 meaning in your above comment, does it just a wildcards in your comment just like \u0027policy:glance_creator\u0027? I prefer PP code will not support \u0027*\u0027 policy rule right, (you think so right?) and it will not appear in sample configuration file really right?","commit_id":"f23e0e2a35511f44dfb177f8bc9706d22d078629"},{"author":{"_account_id":4463,"name":"iccha-sethi","email":"iccha.sethi@rackspace.com","username":"iccha-sethi"},"change_message_id":"9fc2a91e2929db23a848bf851a97a27ccc64bed8","unresolved":false,"context_lines":[{"line_number":22,"context_line":""},{"line_number":23,"context_line":"[^y_.*]"},{"line_number":24,"context_line":"create \u003d __policy__:context_is_admin"},{"line_number":25,"context_line":"read \u003d __policy__:context_is_admin"},{"line_number":26,"context_line":"update \u003d admin,member"},{"line_number":27,"context_line":"delete \u003d admin,member"},{"line_number":28,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":3,"id":"AAAAS3%2F%2FT8A%3D","line":25,"in_reply_to":"AAAAS3%2F%2FVRo%3D","updated":"2013-09-30 13:50:11.000000000","message":"Ya I agree with not mixing up roles and policiies. That is my intent too.","commit_id":"f23e0e2a35511f44dfb177f8bc9706d22d078629"},{"author":{"_account_id":4463,"name":"iccha-sethi","email":"iccha.sethi@rackspace.com","username":"iccha-sethi"},"change_message_id":"d182e9f60b9f4e680a6d95f85b1872a11928034d","unresolved":false,"context_lines":[{"line_number":22,"context_line":""},{"line_number":23,"context_line":"[^y_.*]"},{"line_number":24,"context_line":"create \u003d __policy__:context_is_admin"},{"line_number":25,"context_line":"read \u003d __policy__:context_is_admin"},{"line_number":26,"context_line":"update \u003d admin,member"},{"line_number":27,"context_line":"delete \u003d admin,member"},{"line_number":28,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":3,"id":"AAAAS3%2F%2FV5A%3D","line":25,"in_reply_to":"AAAAS3%2F%2FXic%3D","updated":"2013-09-29 12:03:05.000000000","message":"One of the previous comments Stuart mentioned a good point that what is someone had a role policy:* . So was trying to think of a prefix to prevent name space collision. Hence the __. Alternative suggestions are welcome","commit_id":"f23e0e2a35511f44dfb177f8bc9706d22d078629"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"942a95c72c88fdbc26af13dab14e3f32b091237b","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# property-protections.conf.sample"},{"line_number":2,"context_line":"# Specify regular expression for which properties will be protected in []"},{"line_number":3,"context_line":"# For each section, specify CRUD permissions. You may refer to roles defined"},{"line_number":4,"context_line":"# in policy.json. Instead of roles, policy rules can be used too."}],"source_content_type":"application/octet-stream","patch_set":4,"id":"AAAATH%2F%2FjWA%3D","line":1,"updated":"2013-10-14 18:06:26.000000000","message":"should we rename to property-protections-roles.conf.sample?","commit_id":"d6c7bf601862ba2a7c1c930c47b41ba8cde123fc"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"942a95c72c88fdbc26af13dab14e3f32b091237b","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# property-protections.conf.sample"},{"line_number":2,"context_line":"# Specify regular expression for which properties will be protected in []"},{"line_number":3,"context_line":"# For each section, specify CRUD permissions. You may refer to roles defined"},{"line_number":4,"context_line":"# in policy.json. Instead of roles, policy rules can be used too."},{"line_number":5,"context_line":"# Config value \u0027property_protection_uses\u0027 in glance-api.conf can be set to"},{"line_number":6,"context_line":"# \u0027roles\u0027 or \u0027policies\u0027 to indicate which of the two is used in this file."},{"line_number":7,"context_line":"# But if a policy rule is used, you CANNOT specify any other role for that action."}],"source_content_type":"application/octet-stream","patch_set":4,"id":"AAAATH%2F%2FjVo%3D","line":4,"updated":"2013-10-14 18:06:26.000000000","message":"Seeing as we now also have property-protections-policies.conf.sample we can probably take out references to policies here","commit_id":"d6c7bf601862ba2a7c1c930c47b41ba8cde123fc"}],"glance/api/policy.py":[{"author":{"_account_id":6549,"name":"Zhi Yan Liu","email":"lzy.dev@gmail.com","username":"lzy-dev"},"change_message_id":"422650900d676f4926ac8d7d79f2eee2d0a63d7a","unresolved":false,"context_lines":[{"line_number":66,"context_line":"        \"\"\"Add new rules to the Rules object\"\"\""},{"line_number":67,"context_line":"        if policy._rules:"},{"line_number":68,"context_line":"            rules_obj \u003d policy.Rules(rules)"},{"line_number":69,"context_line":"            policy._rules.update(rules_obj)"},{"line_number":70,"context_line":"        else:"},{"line_number":71,"context_line":"            self.set_rules(rules)"},{"line_number":72,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAS3%2F%2FXh4%3D","line":69,"updated":"2013-09-28 03:06:30.000000000","message":"Seems we\u0027d better give policy an interface to allow consumer side update internal rules (\u0027_rules\u0027) directly. Of cause it\u0027s a dedicated change but this. It\u0027s just my real thoughts when I looking here.","commit_id":"f23e0e2a35511f44dfb177f8bc9706d22d078629"},{"author":{"_account_id":6549,"name":"Zhi Yan Liu","email":"lzy.dev@gmail.com","username":"lzy-dev"},"change_message_id":"28314e4c1704ebc78d58af7a5d06770b904b253e","unresolved":false,"context_lines":[{"line_number":66,"context_line":"        \"\"\"Add new rules to the Rules object\"\"\""},{"line_number":67,"context_line":"        if policy._rules:"},{"line_number":68,"context_line":"            rules_obj \u003d policy.Rules(rules)"},{"line_number":69,"context_line":"            policy._rules.update(rules_obj)"},{"line_number":70,"context_line":"        else:"},{"line_number":71,"context_line":"            self.set_rules(rules)"},{"line_number":72,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAS3%2F%2FVRM%3D","line":69,"in_reply_to":"AAAAS3%2F%2FV44%3D","updated":"2013-09-30 02:52:49.000000000","message":"Yes, so i think it will be better if we add an interface to openstack/common/policy to wrap rule set updating logic into it, of cause by a dedicated patch.","commit_id":"f23e0e2a35511f44dfb177f8bc9706d22d078629"},{"author":{"_account_id":4463,"name":"iccha-sethi","email":"iccha.sethi@rackspace.com","username":"iccha-sethi"},"change_message_id":"d182e9f60b9f4e680a6d95f85b1872a11928034d","unresolved":false,"context_lines":[{"line_number":66,"context_line":"        \"\"\"Add new rules to the Rules object\"\"\""},{"line_number":67,"context_line":"        if policy._rules:"},{"line_number":68,"context_line":"            rules_obj \u003d policy.Rules(rules)"},{"line_number":69,"context_line":"            policy._rules.update(rules_obj)"},{"line_number":70,"context_line":"        else:"},{"line_number":71,"context_line":"            self.set_rules(rules)"},{"line_number":72,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAS3%2F%2FV44%3D","line":69,"in_reply_to":"AAAAS3%2F%2FXh4%3D","updated":"2013-09-29 12:03:05.000000000","message":"I feel the same way. But in openstack/common/policy there is no way to just add policy rules. You can only set them or reset them.","commit_id":"f23e0e2a35511f44dfb177f8bc9706d22d078629"}],"glance/api/v1/images.py":[{"author":{"_account_id":5347,"name":"Eddie Sheffield","email":"eddie.sheffield@rackspace.com","username":"eddie-sheffield"},"change_message_id":"ba2d53faffc1397a370b8edd86837c562c90d907","unresolved":false,"context_lines":[{"line_number":731,"context_line":""},{"line_number":732,"context_line":"        :retval Returns the updated image information as a mapping"},{"line_number":733,"context_line":"        \"\"\""},{"line_number":734,"context_line":"        LOG.info(\"before\")"},{"line_number":735,"context_line":"        self._enforce(req, \u0027modify_image\u0027)"},{"line_number":736,"context_line":"        LOG.info(\"after\")"},{"line_number":737,"context_line":"        is_public \u003d image_meta.get(\u0027is_public\u0027)"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAS3%2F%2FYPI%3D","line":734,"updated":"2013-09-27 20:04:07.000000000","message":"I don\u0027t think you meant to leave this in","commit_id":"bb99cda533a24284ae28f1b6b6397e36e0a98e15"},{"author":{"_account_id":5347,"name":"Eddie Sheffield","email":"eddie.sheffield@rackspace.com","username":"eddie-sheffield"},"change_message_id":"ba2d53faffc1397a370b8edd86837c562c90d907","unresolved":false,"context_lines":[{"line_number":733,"context_line":"        \"\"\""},{"line_number":734,"context_line":"        LOG.info(\"before\")"},{"line_number":735,"context_line":"        self._enforce(req, \u0027modify_image\u0027)"},{"line_number":736,"context_line":"        LOG.info(\"after\")"},{"line_number":737,"context_line":"        is_public \u003d image_meta.get(\u0027is_public\u0027)"},{"line_number":738,"context_line":"        if is_public:"},{"line_number":739,"context_line":"            self._enforce(req, \u0027publicize_image\u0027)"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAS3%2F%2FYPE%3D","line":736,"updated":"2013-09-27 20:04:07.000000000","message":"...nor this.","commit_id":"bb99cda533a24284ae28f1b6b6397e36e0a98e15"}],"glance/common/property_utils.py":[{"author":{"_account_id":6549,"name":"Zhi Yan Liu","email":"lzy.dev@gmail.com","username":"lzy-dev"},"change_message_id":"65f2c1f9b549f47d34013e30cf4f89123804a339","unresolved":false,"context_lines":[{"line_number":47,"context_line":"    def __init__(self, policy_enforcer\u003dNone):"},{"line_number":48,"context_line":"        self.rules \u003d {}"},{"line_number":49,"context_line":"        self.policies \u003d []"},{"line_number":50,"context_line":"        self.policy_enforcer \u003d policy_enforcer"},{"line_number":51,"context_line":"        self._load_rules()"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"    def _load_rules(self):"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAS3%2F%2FiHQ%3D","line":50,"updated":"2013-09-25 05:41:45.000000000","message":"IMO in follow code we need make sure \u0027self.policy_enforcer\u0027 is not a None value before use it, like Line #120\u0026125. Or we can do this like \u0027self.policy_enforcer \u003d policy_enforcer or policy.Enforcer()\u0027.","commit_id":"b55821290902e4e926d307c44a9096bb794ba55f"},{"author":{"_account_id":6484,"name":"Feilong Wang","email":"hustemb@gmail.com","username":"flwang"},"change_message_id":"db33d942c8b4a70c2836014a01291d4ac09365b2","unresolved":false,"context_lines":[{"line_number":69,"context_line":"            for operation in operations:"},{"line_number":70,"context_line":"                roles \u003d CONFIG.get(property_exp, operation)"},{"line_number":71,"context_line":"                if roles:"},{"line_number":72,"context_line":"                    if roles.startswith(\"policy:\"):"},{"line_number":73,"context_line":"                        policy_rule \u003d role[len(\"policy:\"):]"},{"line_number":74,"context_line":"                        self._add_policy(str(compiled_rule), operation,"},{"line_number":75,"context_line":"                                         policy_rule)"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAS3%2F%2FgaI%3D","line":72,"updated":"2013-09-25 15:20:27.000000000","message":"What happened if the rule is like below?\n\ncreate \u003d policy:creator, admin","commit_id":"b55821290902e4e926d307c44a9096bb794ba55f"},{"author":{"_account_id":6484,"name":"Feilong Wang","email":"hustemb@gmail.com","username":"flwang"},"change_message_id":"db33d942c8b4a70c2836014a01291d4ac09365b2","unresolved":false,"context_lines":[{"line_number":70,"context_line":"                roles \u003d CONFIG.get(property_exp, operation)"},{"line_number":71,"context_line":"                if roles:"},{"line_number":72,"context_line":"                    if roles.startswith(\"policy:\"):"},{"line_number":73,"context_line":"                        policy_rule \u003d role[len(\"policy:\"):]"},{"line_number":74,"context_line":"                        self._add_policy(str(compiled_rule), operation,"},{"line_number":75,"context_line":"                                         policy_rule)"},{"line_number":76,"context_line":"                        roles \u003d [roles]"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAS3%2F%2FgYY%3D","line":73,"updated":"2013-09-25 15:20:27.000000000","message":"+1, but I think it depends my above question","commit_id":"b55821290902e4e926d307c44a9096bb794ba55f"},{"author":{"_account_id":8158,"name":"Hemanth Makkapati","email":"makstacker+osgerrit@gmail.com","username":"hemanth.makkapati"},"change_message_id":"60690443d108c12263cb966dc94e2174af56fdab","unresolved":false,"context_lines":[{"line_number":70,"context_line":"                roles \u003d CONFIG.get(property_exp, operation)"},{"line_number":71,"context_line":"                if roles:"},{"line_number":72,"context_line":"                    if roles.startswith(\"policy:\"):"},{"line_number":73,"context_line":"                        policy_rule \u003d role[len(\"policy:\"):]"},{"line_number":74,"context_line":"                        self._add_policy(str(compiled_rule), operation,"},{"line_number":75,"context_line":"                                         policy_rule)"},{"line_number":76,"context_line":"                        roles \u003d [roles]"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAS3%2F%2Fju4%3D","line":73,"updated":"2013-09-24 23:02:22.000000000","message":"Looks like there is a typo here. \nShouldn\u0027t the RHS be \"roles[len(\"policy:\"):]\" ?","commit_id":"b55821290902e4e926d307c44a9096bb794ba55f"},{"author":{"_account_id":6549,"name":"Zhi Yan Liu","email":"lzy.dev@gmail.com","username":"lzy-dev"},"change_message_id":"65f2c1f9b549f47d34013e30cf4f89123804a339","unresolved":false,"context_lines":[{"line_number":70,"context_line":"                roles \u003d CONFIG.get(property_exp, operation)"},{"line_number":71,"context_line":"                if roles:"},{"line_number":72,"context_line":"                    if roles.startswith(\"policy:\"):"},{"line_number":73,"context_line":"                        policy_rule \u003d role[len(\"policy:\"):]"},{"line_number":74,"context_line":"                        self._add_policy(str(compiled_rule), operation,"},{"line_number":75,"context_line":"                                         policy_rule)"},{"line_number":76,"context_line":"                        roles \u003d [roles]"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAS3%2F%2FiLU%3D","line":73,"in_reply_to":"AAAAS3%2F%2Fju4%3D","updated":"2013-09-25 05:41:45.000000000","message":"+1, seems it miss one \u0027s\u0027.","commit_id":"b55821290902e4e926d307c44a9096bb794ba55f"},{"author":{"_account_id":6484,"name":"Feilong Wang","email":"hustemb@gmail.com","username":"flwang"},"change_message_id":"db33d942c8b4a70c2836014a01291d4ac09365b2","unresolved":false,"context_lines":[{"line_number":110,"context_line":"        \"glance:creator\": \"role:admin or role:glance_create_user\""},{"line_number":111,"context_line":"        \"\"\""},{"line_number":112,"context_line":"        rule_name \u003d \"\\\"%s:%s\\\"\" % (property_exp, action)"},{"line_number":113,"context_line":"        property_rule \u003d \": \\\"%s\\\"\" % (rule)"},{"line_number":114,"context_line":"        policy_rule \u003d rule_name + property_rule"},{"line_number":115,"context_line":"        self.policies.append(policy_rule)"},{"line_number":116,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAS3%2F%2FgYM%3D","line":113,"updated":"2013-09-25 15:20:27.000000000","message":"Based on above doc string, I have the same question as Zhi Yan.","commit_id":"b55821290902e4e926d307c44a9096bb794ba55f"},{"author":{"_account_id":6549,"name":"Zhi Yan Liu","email":"lzy.dev@gmail.com","username":"lzy-dev"},"change_message_id":"65f2c1f9b549f47d34013e30cf4f89123804a339","unresolved":false,"context_lines":[{"line_number":110,"context_line":"        \"glance:creator\": \"role:admin or role:glance_create_user\""},{"line_number":111,"context_line":"        \"\"\""},{"line_number":112,"context_line":"        rule_name \u003d \"\\\"%s:%s\\\"\" % (property_exp, action)"},{"line_number":113,"context_line":"        property_rule \u003d \": \\\"%s\\\"\" % (rule)"},{"line_number":114,"context_line":"        policy_rule \u003d rule_name + property_rule"},{"line_number":115,"context_line":"        self.policies.append(policy_rule)"},{"line_number":116,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAS3%2F%2FiJ4%3D","line":113,"updated":"2013-09-25 05:41:45.000000000","message":"I\u0027m not sure do you think here miss a \u0027rule\u0027 prefix here?","commit_id":"b55821290902e4e926d307c44a9096bb794ba55f"},{"author":{"_account_id":4463,"name":"iccha-sethi","email":"iccha.sethi@rackspace.com","username":"iccha-sethi"},"change_message_id":"6e7ce24cd86e6f2bc96cad25f246992b10bb3fdd","unresolved":false,"context_lines":[{"line_number":115,"context_line":"        self.policies.append(policy_rule)"},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"    def _load_policies(self):"},{"line_number":118,"context_line":"        LOG.info(\"Reloading policy rules for property protection\")"},{"line_number":119,"context_line":"        policy_dict \u003d \"{\" + \",\".join(self.policies) + \"}\""},{"line_number":120,"context_line":"        self.policy_enforcer.load_rules(policy_dict)"},{"line_number":121,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAS3%2F%2FjUA%3D","line":118,"updated":"2013-09-24 19:24:33.000000000","message":"Spoke to laski and got some ideas of doing this without reloading the policy file","commit_id":"b55821290902e4e926d307c44a9096bb794ba55f"},{"author":{"_account_id":6549,"name":"Zhi Yan Liu","email":"lzy.dev@gmail.com","username":"lzy-dev"},"change_message_id":"65f2c1f9b549f47d34013e30cf4f89123804a339","unresolved":false,"context_lines":[{"line_number":121,"context_line":""},{"line_number":122,"context_line":"    def _check_policy(self, property_exp, action, context):"},{"line_number":123,"context_line":"        try:"},{"line_number":124,"context_line":"            self.target \u003d \":\".join([property_exp, action])"},{"line_number":125,"context_line":"            self.policy_enforcer.enforce(context, self.target, {})"},{"line_number":126,"context_line":"        except exception.Forbidden:"},{"line_number":127,"context_line":"            return False"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAS3%2F%2FiKA%3D","line":124,"updated":"2013-09-25 05:41:45.000000000","message":"Can we just use a local variable here for \u0027target\u0027?","commit_id":"b55821290902e4e926d307c44a9096bb794ba55f"},{"author":{"_account_id":8158,"name":"Hemanth Makkapati","email":"makstacker+osgerrit@gmail.com","username":"hemanth.makkapati"},"change_message_id":"60690443d108c12263cb966dc94e2174af56fdab","unresolved":false,"context_lines":[{"line_number":142,"context_line":"                    if rule_roles[0].startswith(\"policy:\"):"},{"line_number":143,"context_line":"                        return self._check_policy(str(rule_exp), action,"},{"line_number":144,"context_line":"                                                  context)"},{"line_number":145,"context_line":"                if set(roles).intersection(set(rule_roles)):"},{"line_number":146,"context_line":"                    return True"},{"line_number":147,"context_line":"        return False"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAS3%2F%2FjAo%3D","line":145,"updated":"2013-09-24 23:02:22.000000000","message":"Tiny nit.\nMaybe move this \u0027if\u0027 under \u0027if rule_roles\u0027?\nIt doesn\u0027t really harm the way it is but it reduces an operation when rule_roles is indeed None.","commit_id":"b55821290902e4e926d307c44a9096bb794ba55f"},{"author":{"_account_id":6549,"name":"Zhi Yan Liu","email":"lzy.dev@gmail.com","username":"lzy-dev"},"change_message_id":"422650900d676f4926ac8d7d79f2eee2d0a63d7a","unresolved":false,"context_lines":[{"line_number":78,"context_line":"                if roles:"},{"line_number":79,"context_line":"                    if roles.startswith(\"__policy__:\"):"},{"line_number":80,"context_line":"                        self.rule_key_mapping[compiled_rule] \u003d property_exp"},{"line_number":81,"context_line":"                        policy_rule \u003d roles[len(\"__policy__:\"):]"},{"line_number":82,"context_line":"                        self._add_policy(property_exp, operation,"},{"line_number":83,"context_line":"                                         policy_rule)"},{"line_number":84,"context_line":"                        roles \u003d [roles]"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAS3%2F%2FXec%3D","line":81,"updated":"2013-09-28 03:06:30.000000000","message":"strip() ?","commit_id":"f23e0e2a35511f44dfb177f8bc9706d22d078629"},{"author":{"_account_id":6549,"name":"Zhi Yan Liu","email":"lzy.dev@gmail.com","username":"lzy-dev"},"change_message_id":"422650900d676f4926ac8d7d79f2eee2d0a63d7a","unresolved":false,"context_lines":[{"line_number":123,"context_line":"    def _check_policy(self, property_exp, action, context):"},{"line_number":124,"context_line":"        try:"},{"line_number":125,"context_line":"            target \u003d \":\".join([property_exp, action])"},{"line_number":126,"context_line":"            self.policy_enforcer.enforce(context, target, {})"},{"line_number":127,"context_line":"        except exception.Forbidden:"},{"line_number":128,"context_line":"            return False"},{"line_number":129,"context_line":"        return True"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAS3%2F%2FXeM%3D","line":126,"updated":"2013-09-28 03:06:30.000000000","message":"One question here is that what will happen if admin give a wrong policy name to property-protections.conf, which policy name does not exists in policy.josn? enforce() will return failure also right?","commit_id":"f23e0e2a35511f44dfb177f8bc9706d22d078629"},{"author":{"_account_id":6549,"name":"Zhi Yan Liu","email":"lzy.dev@gmail.com","username":"lzy-dev"},"change_message_id":"28314e4c1704ebc78d58af7a5d06770b904b253e","unresolved":false,"context_lines":[{"line_number":123,"context_line":"    def _check_policy(self, property_exp, action, context):"},{"line_number":124,"context_line":"        try:"},{"line_number":125,"context_line":"            target \u003d \":\".join([property_exp, action])"},{"line_number":126,"context_line":"            self.policy_enforcer.enforce(context, target, {})"},{"line_number":127,"context_line":"        except exception.Forbidden:"},{"line_number":128,"context_line":"            return False"},{"line_number":129,"context_line":"        return True"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAS3%2F%2FVQc%3D","line":126,"in_reply_to":"AAAAS3%2F%2FV4o%3D","updated":"2013-09-30 02:52:49.000000000","message":"Yes, I think at lest we can give a warn log to help end user know this wrong.","commit_id":"f23e0e2a35511f44dfb177f8bc9706d22d078629"},{"author":{"_account_id":4463,"name":"iccha-sethi","email":"iccha.sethi@rackspace.com","username":"iccha-sethi"},"change_message_id":"d182e9f60b9f4e680a6d95f85b1872a11928034d","unresolved":false,"context_lines":[{"line_number":123,"context_line":"    def _check_policy(self, property_exp, action, context):"},{"line_number":124,"context_line":"        try:"},{"line_number":125,"context_line":"            target \u003d \":\".join([property_exp, action])"},{"line_number":126,"context_line":"            self.policy_enforcer.enforce(context, target, {})"},{"line_number":127,"context_line":"        except exception.Forbidden:"},{"line_number":128,"context_line":"            return False"},{"line_number":129,"context_line":"        return True"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAS3%2F%2FV4o%3D","line":126,"in_reply_to":"AAAAS3%2F%2FXeM%3D","updated":"2013-09-29 12:03:05.000000000","message":"Yes that is handled in the policy. It might be a good idea to handle that exception here. Good suggestion. Maybe we should return False and have a warning log?","commit_id":"f23e0e2a35511f44dfb177f8bc9706d22d078629"},{"author":{"_account_id":6549,"name":"Zhi Yan Liu","email":"lzy.dev@gmail.com","username":"lzy-dev"},"change_message_id":"422650900d676f4926ac8d7d79f2eee2d0a63d7a","unresolved":false,"context_lines":[{"line_number":141,"context_line":"                rule_roles \u003d rule.get(action)"},{"line_number":142,"context_line":"                if rule_roles:"},{"line_number":143,"context_line":"                    if rule_roles[0].startswith(\"__policy__:\"):"},{"line_number":144,"context_line":"                        rule_key \u003d self.rule_key_mapping[rule_exp]"},{"line_number":145,"context_line":"                        return self._check_policy(rule_key, action,"},{"line_number":146,"context_line":"                                                  context)"},{"line_number":147,"context_line":"                    if set(roles).intersection(set(rule_roles)):"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAS3%2F%2FXfs%3D","line":144,"updated":"2013-09-28 03:06:30.000000000","message":"IMO change \u0027rule_key\u0027 variable name to \u0027property_exp\u0027 will be better for keep consistent in whole context.","commit_id":"f23e0e2a35511f44dfb177f8bc9706d22d078629"},{"author":{"_account_id":6549,"name":"Zhi Yan Liu","email":"lzy.dev@gmail.com","username":"lzy-dev"},"change_message_id":"0265abb69ab1331f7a3b546c98cdb00b00194937","unresolved":false,"context_lines":[{"line_number":92,"context_line":"                        self.rule_key_mapping[compiled_rule] \u003d property_exp"},{"line_number":93,"context_line":"                        self._add_policy(property_exp, operation,"},{"line_number":94,"context_line":"                                         permissions)"},{"line_number":95,"context_line":"                        permissions \u003d [permissions]"},{"line_number":96,"context_line":"                    else:"},{"line_number":97,"context_line":"                        permissions \u003d [permission.strip() for permission in"},{"line_number":98,"context_line":"                                       permissions.split(\u0027,\u0027)]"}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAATH%2F%2FoYg%3D","line":95,"updated":"2013-10-12 04:59:41.000000000","message":"IMO we\u0027d better add a warning log at 92 line (and skip this invalid configure item) if policy rule name (\u0027permissions\u0027 variable) has \u0027,\u0027, since end user maybe not notice we don\u0027t allow add more then one rule for one operation of particular property expression.\n\nother hand, maybe we and multi-rule support.","commit_id":"d6c7bf601862ba2a7c1c930c47b41ba8cde123fc"},{"author":{"_account_id":4463,"name":"iccha-sethi","email":"iccha.sethi@rackspace.com","username":"iccha-sethi"},"change_message_id":"438246c256253d5f97226314830ecf93a320da8a","unresolved":false,"context_lines":[{"line_number":92,"context_line":"                        self.rule_key_mapping[compiled_rule] \u003d property_exp"},{"line_number":93,"context_line":"                        self._add_policy(property_exp, operation,"},{"line_number":94,"context_line":"                                         permissions)"},{"line_number":95,"context_line":"                        permissions \u003d [permissions]"},{"line_number":96,"context_line":"                    else:"},{"line_number":97,"context_line":"                        permissions \u003d [permission.strip() for permission in"},{"line_number":98,"context_line":"                                       permissions.split(\u0027,\u0027)]"}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAATH%2F%2FjPQ%3D","line":95,"in_reply_to":"AAAATH%2F%2FoYg%3D","updated":"2013-10-14 16:44:11.000000000","message":"Ya thats a good point Zhi","commit_id":"d6c7bf601862ba2a7c1c930c47b41ba8cde123fc"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"942a95c72c88fdbc26af13dab14e3f32b091237b","unresolved":false,"context_lines":[{"line_number":116,"context_line":"            LOG.error(msg)"},{"line_number":117,"context_line":"            raise webob.exc.HTTPInternalServerError(explanation\u003dmsg)"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"    def _add_policy(self, property_exp, action, rule):"},{"line_number":120,"context_line":"        \"\"\" Add policy rules to the policy enforcer."},{"line_number":121,"context_line":"        For example, if property-protections.conf has a config:"},{"line_number":122,"context_line":"        [prop_a]"}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAATH%2F%2Fi9w%3D","line":119,"updated":"2013-10-14 18:06:26.000000000","message":"Should this be called _add_policy_rules rather than _add_policy?","commit_id":"d6c7bf601862ba2a7c1c930c47b41ba8cde123fc"},{"author":{"_account_id":6549,"name":"Zhi Yan Liu","email":"lzy.dev@gmail.com","username":"lzy-dev"},"change_message_id":"0265abb69ab1331f7a3b546c98cdb00b00194937","unresolved":false,"context_lines":[{"line_number":118,"context_line":""},{"line_number":119,"context_line":"    def _add_policy(self, property_exp, action, rule):"},{"line_number":120,"context_line":"        \"\"\" Add policy rules to the policy enforcer."},{"line_number":121,"context_line":"        For example, if property-protections.conf has a config:"},{"line_number":122,"context_line":"        [prop_a]"},{"line_number":123,"context_line":"        create \u003d policy:glance_creator"},{"line_number":124,"context_line":"        then the corresponding policy rule would be:"}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAATH%2F%2FoY4%3D","line":121,"updated":"2013-10-12 04:59:41.000000000","message":"update conf filename to property-protections-policies.conf will be better. nit.","commit_id":"d6c7bf601862ba2a7c1c930c47b41ba8cde123fc"},{"author":{"_account_id":4463,"name":"iccha-sethi","email":"iccha.sethi@rackspace.com","username":"iccha-sethi"},"change_message_id":"438246c256253d5f97226314830ecf93a320da8a","unresolved":false,"context_lines":[{"line_number":118,"context_line":""},{"line_number":119,"context_line":"    def _add_policy(self, property_exp, action, rule):"},{"line_number":120,"context_line":"        \"\"\" Add policy rules to the policy enforcer."},{"line_number":121,"context_line":"        For example, if property-protections.conf has a config:"},{"line_number":122,"context_line":"        [prop_a]"},{"line_number":123,"context_line":"        create \u003d policy:glance_creator"},{"line_number":124,"context_line":"        then the corresponding policy rule would be:"}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAATH%2F%2FjPM%3D","line":121,"in_reply_to":"AAAATH%2F%2FoY4%3D","updated":"2013-10-14 16:44:11.000000000","message":"maybe i should just say \" property protections file\" instead of a file name","commit_id":"d6c7bf601862ba2a7c1c930c47b41ba8cde123fc"},{"author":{"_account_id":6549,"name":"Zhi Yan Liu","email":"lzy.dev@gmail.com","username":"lzy-dev"},"change_message_id":"0265abb69ab1331f7a3b546c98cdb00b00194937","unresolved":false,"context_lines":[{"line_number":120,"context_line":"        \"\"\" Add policy rules to the policy enforcer."},{"line_number":121,"context_line":"        For example, if property-protections.conf has a config:"},{"line_number":122,"context_line":"        [prop_a]"},{"line_number":123,"context_line":"        create \u003d policy:glance_creator"},{"line_number":124,"context_line":"        then the corresponding policy rule would be:"},{"line_number":125,"context_line":"        \"prop_a:create\": \"rule:glance_creator\""},{"line_number":126,"context_line":"        where glance_creator is defined in policy.json. For example:"}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAATH%2F%2FoZE%3D","line":123,"updated":"2013-10-12 04:59:41.000000000","message":"wrong doc for current design, pls update.","commit_id":"d6c7bf601862ba2a7c1c930c47b41ba8cde123fc"},{"author":{"_account_id":4463,"name":"iccha-sethi","email":"iccha.sethi@rackspace.com","username":"iccha-sethi"},"change_message_id":"438246c256253d5f97226314830ecf93a320da8a","unresolved":false,"context_lines":[{"line_number":120,"context_line":"        \"\"\" Add policy rules to the policy enforcer."},{"line_number":121,"context_line":"        For example, if property-protections.conf has a config:"},{"line_number":122,"context_line":"        [prop_a]"},{"line_number":123,"context_line":"        create \u003d policy:glance_creator"},{"line_number":124,"context_line":"        then the corresponding policy rule would be:"},{"line_number":125,"context_line":"        \"prop_a:create\": \"rule:glance_creator\""},{"line_number":126,"context_line":"        where glance_creator is defined in policy.json. For example:"}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAATH%2F%2FjPI%3D","line":123,"in_reply_to":"AAAATH%2F%2FoZE%3D","updated":"2013-10-14 16:44:11.000000000","message":"good catch!","commit_id":"d6c7bf601862ba2a7c1c930c47b41ba8cde123fc"},{"author":{"_account_id":6549,"name":"Zhi Yan Liu","email":"lzy.dev@gmail.com","username":"lzy-dev"},"change_message_id":"0265abb69ab1331f7a3b546c98cdb00b00194937","unresolved":false,"context_lines":[{"line_number":135,"context_line":"    def _check_policy(self, property_exp, action, context):"},{"line_number":136,"context_line":"        try:"},{"line_number":137,"context_line":"            target \u003d \":\".join([property_exp, action])"},{"line_number":138,"context_line":"            self.policy_enforcer.enforce(context, target, {})"},{"line_number":139,"context_line":"        except exception.Forbidden:"},{"line_number":140,"context_line":"            return False"},{"line_number":141,"context_line":"        return True"}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAATH%2F%2FoWQ%3D","line":138,"updated":"2013-10-12 04:59:41.000000000","message":"I still have the same suggestion at here, sorry. https://review.openstack.org/#/c/48076/3/glance/common/property_utils.py Line #126","commit_id":"d6c7bf601862ba2a7c1c930c47b41ba8cde123fc"},{"author":{"_account_id":4463,"name":"iccha-sethi","email":"iccha.sethi@rackspace.com","username":"iccha-sethi"},"change_message_id":"7df6f96183dc27a2ebdf52bd1feb7119fe3fb135","unresolved":false,"context_lines":[{"line_number":135,"context_line":"    def _check_policy(self, property_exp, action, context):"},{"line_number":136,"context_line":"        try:"},{"line_number":137,"context_line":"            target \u003d \":\".join([property_exp, action])"},{"line_number":138,"context_line":"            self.policy_enforcer.enforce(context, target, {})"},{"line_number":139,"context_line":"        except exception.Forbidden:"},{"line_number":140,"context_line":"            return False"},{"line_number":141,"context_line":"        return True"}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAATH%2F%2Ffco%3D","line":138,"in_reply_to":"AAAATH%2F%2FhMQ%3D","updated":"2013-10-15 13:52:35.000000000","message":"There is no way for us to distinguish between wrong configuration and what is not present. I may be mistaken but please correct me if I am wrong.","commit_id":"d6c7bf601862ba2a7c1c930c47b41ba8cde123fc"},{"author":{"_account_id":6549,"name":"Zhi Yan Liu","email":"lzy.dev@gmail.com","username":"lzy-dev"},"change_message_id":"00203c8ca54c1089ca3e5a04c02e37a441595980","unresolved":false,"context_lines":[{"line_number":135,"context_line":"    def _check_policy(self, property_exp, action, context):"},{"line_number":136,"context_line":"        try:"},{"line_number":137,"context_line":"            target \u003d \":\".join([property_exp, action])"},{"line_number":138,"context_line":"            self.policy_enforcer.enforce(context, target, {})"},{"line_number":139,"context_line":"        except exception.Forbidden:"},{"line_number":140,"context_line":"            return False"},{"line_number":141,"context_line":"        return True"}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAATH%2F%2FhMQ%3D","line":138,"in_reply_to":"AAAATH%2F%2FjNk%3D","updated":"2013-10-15 04:00:11.000000000","message":"Cool and thanks for explain. How about we give a warn log here for end user to ask them aware the wrong configuration they added? IMO it will be better.","commit_id":"d6c7bf601862ba2a7c1c930c47b41ba8cde123fc"},{"author":{"_account_id":4463,"name":"iccha-sethi","email":"iccha.sethi@rackspace.com","username":"iccha-sethi"},"change_message_id":"438246c256253d5f97226314830ecf93a320da8a","unresolved":false,"context_lines":[{"line_number":135,"context_line":"    def _check_policy(self, property_exp, action, context):"},{"line_number":136,"context_line":"        try:"},{"line_number":137,"context_line":"            target \u003d \":\".join([property_exp, action])"},{"line_number":138,"context_line":"            self.policy_enforcer.enforce(context, target, {})"},{"line_number":139,"context_line":"        except exception.Forbidden:"},{"line_number":140,"context_line":"            return False"},{"line_number":141,"context_line":"        return True"}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAATH%2F%2FjNk%3D","line":138,"in_reply_to":"AAAATH%2F%2FoWQ%3D","updated":"2013-10-14 16:44:11.000000000","message":"If rule is not found or is forbidden it is treated the same:\nhttps://github.com/openstack/glance/blob/master/glance/openstack/common/policy.py#L179\n\nso there is no way to distinuguish the two. Please correct me if I am mistaken.","commit_id":"d6c7bf601862ba2a7c1c930c47b41ba8cde123fc"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"942a95c72c88fdbc26af13dab14e3f32b091237b","unresolved":false,"context_lines":[{"line_number":152,"context_line":"            if rule_exp.search(str(property_name)):"},{"line_number":153,"context_line":"                rule_roles \u003d rule.get(action)"},{"line_number":154,"context_line":"                if rule_roles:"},{"line_number":155,"context_line":"                    if self.prop_prot_uses \u003d\u003d \u0027policies\u0027:"},{"line_number":156,"context_line":"                        rule_key \u003d self.rule_key_mapping[rule_exp]"},{"line_number":157,"context_line":"                        return self._check_policy(rule_key, action,"},{"line_number":158,"context_line":"                                                  context)"}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAATH%2F%2FjDw%3D","line":155,"updated":"2013-10-14 18:06:26.000000000","message":"Would it be better to explicitly have an equivalent \u0027if self.prop_prot_uses \u003d\u003d \u0027roles\u0027 below (with an exception if we match neither)? Or are we confident enough that it will always match one or the other?","commit_id":"d6c7bf601862ba2a7c1c930c47b41ba8cde123fc"},{"author":{"_account_id":4463,"name":"iccha-sethi","email":"iccha.sethi@rackspace.com","username":"iccha-sethi"},"change_message_id":"7a902947423d6a567a699c456e2da780108884d1","unresolved":false,"context_lines":[{"line_number":152,"context_line":"            if rule_exp.search(str(property_name)):"},{"line_number":153,"context_line":"                rule_roles \u003d rule.get(action)"},{"line_number":154,"context_line":"                if rule_roles:"},{"line_number":155,"context_line":"                    if self.prop_prot_uses \u003d\u003d \u0027policies\u0027:"},{"line_number":156,"context_line":"                        rule_key \u003d self.rule_key_mapping[rule_exp]"},{"line_number":157,"context_line":"                        return self._check_policy(rule_key, action,"},{"line_number":158,"context_line":"                                                  context)"}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAATH%2F%2FibA%3D","line":155,"in_reply_to":"AAAATH%2F%2FjDw%3D","updated":"2013-10-14 20:20:12.000000000","message":"There is a check in line 75 which throws a 500 if its neither","commit_id":"d6c7bf601862ba2a7c1c930c47b41ba8cde123fc"},{"author":{"_account_id":6549,"name":"Zhi Yan Liu","email":"lzy.dev@gmail.com","username":"lzy-dev"},"change_message_id":"0265abb69ab1331f7a3b546c98cdb00b00194937","unresolved":false,"context_lines":[{"line_number":153,"context_line":"                rule_roles \u003d rule.get(action)"},{"line_number":154,"context_line":"                if rule_roles:"},{"line_number":155,"context_line":"                    if self.prop_prot_uses \u003d\u003d \u0027policies\u0027:"},{"line_number":156,"context_line":"                        rule_key \u003d self.rule_key_mapping[rule_exp]"},{"line_number":157,"context_line":"                        return self._check_policy(rule_key, action,"},{"line_number":158,"context_line":"                                                  context)"},{"line_number":159,"context_line":"                    if set(roles).intersection(set(rule_roles)):"}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAATH%2F%2FoWE%3D","line":156,"updated":"2013-10-12 04:59:41.000000000","message":"I still have the same suggestion at here, sorry. https://review.openstack.org/#/c/48076/3/glance/common/property_utils.py Line #144","commit_id":"d6c7bf601862ba2a7c1c930c47b41ba8cde123fc"},{"author":{"_account_id":4463,"name":"iccha-sethi","email":"iccha.sethi@rackspace.com","username":"iccha-sethi"},"change_message_id":"438246c256253d5f97226314830ecf93a320da8a","unresolved":false,"context_lines":[{"line_number":153,"context_line":"                rule_roles \u003d rule.get(action)"},{"line_number":154,"context_line":"                if rule_roles:"},{"line_number":155,"context_line":"                    if self.prop_prot_uses \u003d\u003d \u0027policies\u0027:"},{"line_number":156,"context_line":"                        rule_key \u003d self.rule_key_mapping[rule_exp]"},{"line_number":157,"context_line":"                        return self._check_policy(rule_key, action,"},{"line_number":158,"context_line":"                                                  context)"},{"line_number":159,"context_line":"                    if set(roles).intersection(set(rule_roles)):"}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAATH%2F%2FjNY%3D","line":156,"in_reply_to":"AAAATH%2F%2FoWE%3D","updated":"2013-10-14 16:44:11.000000000","message":"Will change var name","commit_id":"d6c7bf601862ba2a7c1c930c47b41ba8cde123fc"},{"author":{"_account_id":616,"name":"Mark Washenberger","email":"mark.washenberger@markwash.net","username":"markwash"},"change_message_id":"45b91a6fb61c5e455d8ce11ec322d8c32495569e","unresolved":false,"context_lines":[{"line_number":15,"context_line":"#    under the License."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"import ConfigParser"},{"line_number":18,"context_line":"import json"},{"line_number":19,"context_line":"import re"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"from oslo.config import cfg"}],"source_content_type":"text/x-python","patch_set":10,"id":"AAAATH%2F%2Fd%2FU%3D","line":18,"updated":"2013-10-15 19:33:59.000000000","message":"Is this import used?","commit_id":"30d54c7f8c5a2acc1fb7605c1486c991b693c331"},{"author":{"_account_id":177,"name":"Alex Meade","email":"mr.alex.meade@gmail.com","username":"alex-meade"},"change_message_id":"431a35caa1d79bf9fe1931bd820d6901ec0fa9f6","unresolved":false,"context_lines":[{"line_number":35,"context_line":"    cfg.StrOpt(\u0027property_protection_file\u0027,"},{"line_number":36,"context_line":"               default\u003dNone,"},{"line_number":37,"context_line":"               help\u003d_(\u0027The location of the property protection file.\u0027)),"},{"line_number":38,"context_line":"    cfg.StrOpt(\u0027property_protection_uses\u0027,"},{"line_number":39,"context_line":"               default\u003d\u0027roles\u0027,"},{"line_number":40,"context_line":"               help\u003d_(\u0027This config value indicates whether \"roles\" or \u0027"},{"line_number":41,"context_line":"                      \u0027\"policies\" are used in the property protection file.\u0027)),"}],"source_content_type":"text/x-python","patch_set":11,"id":"AAAATH%2F%2Fdzg%3D","line":38,"updated":"2013-10-15 20:31:16.000000000","message":"Would property_protection_rule_type make more sense? Perhaps something even more descriptive?","commit_id":"3ba1485c19ecd3d638f5ec239bb24a09b12ff434"},{"author":{"_account_id":616,"name":"Mark Washenberger","email":"mark.washenberger@markwash.net","username":"markwash"},"change_message_id":"96187aee282720a556c43009169253a928d8e3d6","unresolved":false,"context_lines":[{"line_number":35,"context_line":"    cfg.StrOpt(\u0027property_protection_file\u0027,"},{"line_number":36,"context_line":"               default\u003dNone,"},{"line_number":37,"context_line":"               help\u003d_(\u0027The location of the property protection file.\u0027)),"},{"line_number":38,"context_line":"    cfg.StrOpt(\u0027property_protection_uses\u0027,"},{"line_number":39,"context_line":"               default\u003d\u0027roles\u0027,"},{"line_number":40,"context_line":"               help\u003d_(\u0027This config value indicates whether \"roles\" or \u0027"},{"line_number":41,"context_line":"                      \u0027\"policies\" are used in the property protection file.\u0027)),"}],"source_content_type":"text/x-python","patch_set":11,"id":"AAAATH%2F%2FYnE%3D","line":38,"in_reply_to":"AAAATH%2F%2FYoM%3D","updated":"2013-10-16 20:50:25.000000000","message":"Or maybe even \"rule_format\", and keep the pluralization. Thoughts?","commit_id":"3ba1485c19ecd3d638f5ec239bb24a09b12ff434"},{"author":{"_account_id":616,"name":"Mark Washenberger","email":"mark.washenberger@markwash.net","username":"markwash"},"change_message_id":"7c7d47d6f6f677f65a734a5c79a1c7b263a90fec","unresolved":false,"context_lines":[{"line_number":35,"context_line":"    cfg.StrOpt(\u0027property_protection_file\u0027,"},{"line_number":36,"context_line":"               default\u003dNone,"},{"line_number":37,"context_line":"               help\u003d_(\u0027The location of the property protection file.\u0027)),"},{"line_number":38,"context_line":"    cfg.StrOpt(\u0027property_protection_uses\u0027,"},{"line_number":39,"context_line":"               default\u003d\u0027roles\u0027,"},{"line_number":40,"context_line":"               help\u003d_(\u0027This config value indicates whether \"roles\" or \u0027"},{"line_number":41,"context_line":"                      \u0027\"policies\" are used in the property protection file.\u0027)),"}],"source_content_type":"text/x-python","patch_set":11,"id":"AAAATH%2F%2FYoM%3D","line":38,"in_reply_to":"AAAATH%2F%2FZOg%3D","updated":"2013-10-16 20:45:30.000000000","message":"Hmm, I kind of like \u0027rule_type\u0027. But then should the values be singular instead of plural. E.g. \"role\" and \"policy\" vs. \"roles\" and \"policies\" ?","commit_id":"3ba1485c19ecd3d638f5ec239bb24a09b12ff434"},{"author":{"_account_id":177,"name":"Alex Meade","email":"mr.alex.meade@gmail.com","username":"alex-meade"},"change_message_id":"9ba06bfa6b26702999cf800a38183fa56919c636","unresolved":false,"context_lines":[{"line_number":35,"context_line":"    cfg.StrOpt(\u0027property_protection_file\u0027,"},{"line_number":36,"context_line":"               default\u003dNone,"},{"line_number":37,"context_line":"               help\u003d_(\u0027The location of the property protection file.\u0027)),"},{"line_number":38,"context_line":"    cfg.StrOpt(\u0027property_protection_uses\u0027,"},{"line_number":39,"context_line":"               default\u003d\u0027roles\u0027,"},{"line_number":40,"context_line":"               help\u003d_(\u0027This config value indicates whether \"roles\" or \u0027"},{"line_number":41,"context_line":"                      \u0027\"policies\" are used in the property protection file.\u0027)),"}],"source_content_type":"text/x-python","patch_set":11,"id":"AAAATH%2F%2FZOg%3D","line":38,"in_reply_to":"AAAATH%2F%2Faac%3D","updated":"2013-10-16 18:50:10.000000000","message":"rule_type is kind of growing on me but whatever works.","commit_id":"3ba1485c19ecd3d638f5ec239bb24a09b12ff434"},{"author":{"_account_id":4463,"name":"iccha-sethi","email":"iccha.sethi@rackspace.com","username":"iccha-sethi"},"change_message_id":"7942d10032219e8812828b9ccfa6846aeac9968b","unresolved":false,"context_lines":[{"line_number":35,"context_line":"    cfg.StrOpt(\u0027property_protection_file\u0027,"},{"line_number":36,"context_line":"               default\u003dNone,"},{"line_number":37,"context_line":"               help\u003d_(\u0027The location of the property protection file.\u0027)),"},{"line_number":38,"context_line":"    cfg.StrOpt(\u0027property_protection_uses\u0027,"},{"line_number":39,"context_line":"               default\u003d\u0027roles\u0027,"},{"line_number":40,"context_line":"               help\u003d_(\u0027This config value indicates whether \"roles\" or \u0027"},{"line_number":41,"context_line":"                      \u0027\"policies\" are used in the property protection file.\u0027)),"}],"source_content_type":"text/x-python","patch_set":11,"id":"AAAATH%2F%2Faac%3D","line":38,"in_reply_to":"AAAATH%2F%2Fdzg%3D","updated":"2013-10-16 14:38:32.000000000","message":"Eddie was also suggesting property_protection_format , any thoughts?","commit_id":"3ba1485c19ecd3d638f5ec239bb24a09b12ff434"},{"author":{"_account_id":177,"name":"Alex Meade","email":"mr.alex.meade@gmail.com","username":"alex-meade"},"change_message_id":"431a35caa1d79bf9fe1931bd820d6901ec0fa9f6","unresolved":false,"context_lines":[{"line_number":74,"context_line":"        if self.prop_prot_uses not in [\u0027policies\u0027, \u0027roles\u0027]:"},{"line_number":75,"context_line":"            msg \u003d _(\"Invalid value \u0027%s\u0027 for \u0027property_protection_uses\u0027. The \""},{"line_number":76,"context_line":"                    \"permitted values are \u0027roles\u0027 and \u0027policies\u0027\" %"},{"line_number":77,"context_line":"                    prop_prot_uses)"},{"line_number":78,"context_line":"            LOG.error(msg)"},{"line_number":79,"context_line":"            raise webob.exc.HTTPInternalServerError(explanation\u003dmsg)"},{"line_number":80,"context_line":""}],"source_content_type":"text/x-python","patch_set":11,"id":"AAAATH%2F%2FdxE%3D","line":77,"updated":"2013-10-15 20:31:16.000000000","message":"This should be self.prop_prot_uses. Maybe there could be a test case for this?","commit_id":"3ba1485c19ecd3d638f5ec239bb24a09b12ff434"},{"author":{"_account_id":4463,"name":"iccha-sethi","email":"iccha.sethi@rackspace.com","username":"iccha-sethi"},"change_message_id":"e7476fdfb5a00a4970ec82943d829e1a62fbb18d","unresolved":false,"context_lines":[{"line_number":74,"context_line":"        if self.prop_prot_uses not in [\u0027policies\u0027, \u0027roles\u0027]:"},{"line_number":75,"context_line":"            msg \u003d _(\"Invalid value \u0027%s\u0027 for \u0027property_protection_uses\u0027. The \""},{"line_number":76,"context_line":"                    \"permitted values are \u0027roles\u0027 and \u0027policies\u0027\" %"},{"line_number":77,"context_line":"                    prop_prot_uses)"},{"line_number":78,"context_line":"            LOG.error(msg)"},{"line_number":79,"context_line":"            raise webob.exc.HTTPInternalServerError(explanation\u003dmsg)"},{"line_number":80,"context_line":""}],"source_content_type":"text/x-python","patch_set":11,"id":"AAAATH%2F%2FaPo%3D","line":77,"in_reply_to":"AAAATH%2F%2FdxE%3D","updated":"2013-10-16 15:03:36.000000000","message":"Good catch.","commit_id":"3ba1485c19ecd3d638f5ec239bb24a09b12ff434"},{"author":{"_account_id":177,"name":"Alex Meade","email":"mr.alex.meade@gmail.com","username":"alex-meade"},"change_message_id":"431a35caa1d79bf9fe1931bd820d6901ec0fa9f6","unresolved":false,"context_lines":[{"line_number":76,"context_line":"                    \"permitted values are \u0027roles\u0027 and \u0027policies\u0027\" %"},{"line_number":77,"context_line":"                    prop_prot_uses)"},{"line_number":78,"context_line":"            LOG.error(msg)"},{"line_number":79,"context_line":"            raise webob.exc.HTTPInternalServerError(explanation\u003dmsg)"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"        operations \u003d [\u0027create\u0027, \u0027read\u0027, \u0027update\u0027, \u0027delete\u0027]"},{"line_number":82,"context_line":"        properties \u003d CONFIG.sections()"}],"source_content_type":"text/x-python","patch_set":11,"id":"AAAATH%2F%2Fdws%3D","line":79,"updated":"2013-10-15 20:31:16.000000000","message":"Should these raises be doing HTTP exceptions?","commit_id":"3ba1485c19ecd3d638f5ec239bb24a09b12ff434"},{"author":{"_account_id":177,"name":"Alex Meade","email":"mr.alex.meade@gmail.com","username":"alex-meade"},"change_message_id":"9ba06bfa6b26702999cf800a38183fa56919c636","unresolved":false,"context_lines":[{"line_number":76,"context_line":"                    \"permitted values are \u0027roles\u0027 and \u0027policies\u0027\" %"},{"line_number":77,"context_line":"                    prop_prot_uses)"},{"line_number":78,"context_line":"            LOG.error(msg)"},{"line_number":79,"context_line":"            raise webob.exc.HTTPInternalServerError(explanation\u003dmsg)"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"        operations \u003d [\u0027create\u0027, \u0027read\u0027, \u0027update\u0027, \u0027delete\u0027]"},{"line_number":82,"context_line":"        properties \u003d CONFIG.sections()"}],"source_content_type":"text/x-python","patch_set":11,"id":"AAAATH%2F%2FZOY%3D","line":79,"in_reply_to":"AAAATH%2F%2FaPs%3D","updated":"2013-10-16 18:50:10.000000000","message":"Yeah that makes sense","commit_id":"3ba1485c19ecd3d638f5ec239bb24a09b12ff434"},{"author":{"_account_id":4463,"name":"iccha-sethi","email":"iccha.sethi@rackspace.com","username":"iccha-sethi"},"change_message_id":"e7476fdfb5a00a4970ec82943d829e1a62fbb18d","unresolved":false,"context_lines":[{"line_number":76,"context_line":"                    \"permitted values are \u0027roles\u0027 and \u0027policies\u0027\" %"},{"line_number":77,"context_line":"                    prop_prot_uses)"},{"line_number":78,"context_line":"            LOG.error(msg)"},{"line_number":79,"context_line":"            raise webob.exc.HTTPInternalServerError(explanation\u003dmsg)"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"        operations \u003d [\u0027create\u0027, \u0027read\u0027, \u0027update\u0027, \u0027delete\u0027]"},{"line_number":82,"context_line":"        properties \u003d CONFIG.sections()"}],"source_content_type":"text/x-python","patch_set":11,"id":"AAAATH%2F%2FaPs%3D","line":79,"in_reply_to":"AAAATH%2F%2Fdws%3D","updated":"2013-10-16 15:03:36.000000000","message":"We re thinking of throwing a Glance exception here, does that sound good?","commit_id":"3ba1485c19ecd3d638f5ec239bb24a09b12ff434"},{"author":{"_account_id":4463,"name":"iccha-sethi","email":"iccha.sethi@rackspace.com","username":"iccha-sethi"},"change_message_id":"2f82016651da6b86e78d63484c4abe80a80ac039","unresolved":false,"context_lines":[{"line_number":37,"context_line":"               help\u003d_(\u0027The location of the property protection file.\u0027)),"},{"line_number":38,"context_line":"    cfg.StrOpt(\u0027property_protection_rule_format\u0027,"},{"line_number":39,"context_line":"               default\u003d\u0027roles\u0027,"},{"line_number":40,"context_line":"               help\u003d_(\u0027This config value indicates whether \"roles\" or \u0027"},{"line_number":41,"context_line":"                      \u0027\"policies\" are used in the property protection file.\u0027)),"},{"line_number":42,"context_line":"]"},{"line_number":43,"context_line":""}],"source_content_type":"text/x-python","patch_set":12,"id":"AAAATH%2F%2FVvY%3D","line":40,"updated":"2013-10-17 15:02:16.000000000","message":"Zhi the default is applied here.","commit_id":"eb87f1fae8f13c7ab09c9fec56bbfa1fdfdf17fc"},{"author":{"_account_id":6549,"name":"Zhi Yan Liu","email":"lzy.dev@gmail.com","username":"lzy-dev"},"change_message_id":"41f88887be9214668bc42ed9eb6a2004ec96fc9e","unresolved":false,"context_lines":[{"line_number":59,"context_line":"        self.policies \u003d []"},{"line_number":60,"context_line":"        self.policy_enforcer \u003d policy_enforcer or glance.api.policy.Enforcer()"},{"line_number":61,"context_line":"        self.prop_prot_rule_format \u003d CONF.property_protection_rule_format"},{"line_number":62,"context_line":"        self.prop_prot_rule_format \u003d self.prop_prot_rule_format.lower()"},{"line_number":63,"context_line":"        self._load_rules()"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"    def _load_rules(self):"}],"source_content_type":"text/x-python","patch_set":12,"id":"AAAATH%2F%2FXqc%3D","line":62,"updated":"2013-10-17 04:02:19.000000000","message":"iccha, can you educate me what will happen here if admin explicit set \u0027property_protection_rule_format\u003dNone\u0027 in glance-api? CONF.property_protection_rule_format variable will be None value or \u0027roles\u0027 (default) value? thanks.","commit_id":"eb87f1fae8f13c7ab09c9fec56bbfa1fdfdf17fc"},{"author":{"_account_id":4463,"name":"iccha-sethi","email":"iccha.sethi@rackspace.com","username":"iccha-sethi"},"change_message_id":"2f82016651da6b86e78d63484c4abe80a80ac039","unresolved":false,"context_lines":[{"line_number":72,"context_line":"            LOG.error(msg)"},{"line_number":73,"context_line":"            raise exception.InvalidPropertyProtectionConfiguration()"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"        if self.prop_prot_rule_format not in [\u0027policies\u0027, \u0027roles\u0027]:"},{"line_number":76,"context_line":"            msg \u003d _(\"Invalid value \u0027%s\u0027 for \u0027property_protection_rule_format\u0027\""},{"line_number":77,"context_line":"                    \". The permitted values are \u0027roles\u0027 and \u0027policies\u0027\" %"},{"line_number":78,"context_line":"                    self.prop_prot_rule_format)"}],"source_content_type":"text/x-python","patch_set":12,"id":"AAAATH%2F%2FVvU%3D","line":75,"updated":"2013-10-17 15:02:16.000000000","message":"Zhi explicit check is done here","commit_id":"eb87f1fae8f13c7ab09c9fec56bbfa1fdfdf17fc"}],"glance/tests/etc/property-protections.conf":[{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"7872b484573ed9f9172a79050d32e7a750f33b62","unresolved":false,"context_lines":[{"line_number":4,"context_line":"update \u003d admin,member"},{"line_number":5,"context_line":"delete \u003d admin,member"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"[spl_create_prop_policy]"},{"line_number":8,"context_line":"create \u003d policy:glance_creator"},{"line_number":9,"context_line":"read \u003d policy:glance_creator"},{"line_number":10,"context_line":"update \u003d admin"}],"source_content_type":"text/plain","patch_set":1,"id":"AAAAS3%2F%2Fdfs%3D","line":7,"updated":"2013-09-26 10:49:24.000000000","message":"Are we using the same \u0027create\u0027 specification for roles and policies here, eg if we happened to have a role called \u0027policy:*\u0027 could we potentially get a clash?\n\nWould there be value in separating these out explicitly? eg\n\n [regex] \n create.roles \u003d rolea,roleA \n create.policies \u003d policyw,policyW\n read.roles \u003d roleb,roleB\n read.policies \u003d policyx,policyX\n update.roles \u003d rolec,roleC\n update.policies \u003d policyy,policyY\n delete.roles \u003d roled,roleD\n delete.policies \u003d policyz,policyZ\n\nif we do this we could also formalize the ordering, eg check roles first and check policies second. For backwards compatability we could parse create as create.roles.","commit_id":"b55821290902e4e926d307c44a9096bb794ba55f"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"6894342a530ec577413f7edb89d5933afe25bb5e","unresolved":false,"context_lines":[{"line_number":4,"context_line":"update \u003d admin,member"},{"line_number":5,"context_line":"delete \u003d admin,member"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"[spl_create_prop_policy]"},{"line_number":8,"context_line":"create \u003d policy:glance_creator"},{"line_number":9,"context_line":"read \u003d policy:glance_creator"},{"line_number":10,"context_line":"update \u003d admin"}],"source_content_type":"text/plain","patch_set":1,"id":"AAAAS3%2F%2FUkQ%3D","line":7,"in_reply_to":"AAAAS3%2F%2FYLM%3D","updated":"2013-09-30 09:03:13.000000000","message":"Hi Iccha,\n\nThat probably helps a little, but tbh, my preference would be to have them completely independent. I think its cleaner, and easier to understand, and avoids collisions completely.","commit_id":"b55821290902e4e926d307c44a9096bb794ba55f"},{"author":{"_account_id":4463,"name":"iccha-sethi","email":"iccha.sethi@rackspace.com","username":"iccha-sethi"},"change_message_id":"a5356c11fb0252b8e1e88621d2d955306d7b61c2","unresolved":false,"context_lines":[{"line_number":4,"context_line":"update \u003d admin,member"},{"line_number":5,"context_line":"delete \u003d admin,member"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"[spl_create_prop_policy]"},{"line_number":8,"context_line":"create \u003d policy:glance_creator"},{"line_number":9,"context_line":"read \u003d policy:glance_creator"},{"line_number":10,"context_line":"update \u003d admin"}],"source_content_type":"text/plain","patch_set":1,"id":"AAAAS3%2F%2FYLM%3D","line":7,"in_reply_to":"AAAAS3%2F%2Fdfs%3D","updated":"2013-09-27 20:14:17.000000000","message":"Brian has a suggestions that we use __policy__ as a prefix instead of policy, in order to minimize conflicts with role name\n\n[regex]\ncreate \u003d __policy__:glance_creator\nread \u003d roleA,policy:roleB\n\nWhat are your thoughts?","commit_id":"b55821290902e4e926d307c44a9096bb794ba55f"}],"glance/tests/integration/legacy_functional/test_v1_api.py":[{"author":{"_account_id":6549,"name":"Zhi Yan Liu","email":"lzy.dev@gmail.com","username":"lzy-dev"},"change_message_id":"0265abb69ab1331f7a3b546c98cdb00b00194937","unresolved":false,"context_lines":[{"line_number":1431,"context_line":"        }"},{"line_number":1432,"context_line":"        custom_props \u003d {"},{"line_number":1433,"context_line":"            \u0027X-Image-Meta-Property-spl_create_prop\u0027: \u0027create_bar\u0027,"},{"line_number":1434,"context_line":"            \u0027X-Image-Meta-Property-spl_create_prop_policy\u0027: \u0027create_bar\u0027,"},{"line_number":1435,"context_line":"            \u0027X-Image-Meta-Property-spl_read_prop\u0027: \u0027read_bar\u0027,"},{"line_number":1436,"context_line":"            \u0027X-Image-Meta-Property-spl_update_prop\u0027: \u0027u\u0027,"},{"line_number":1437,"context_line":"            \u0027X-Glance-Registry-Purge-Props\u0027: \u0027True\u0027"}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAATH%2F%2FoUM%3D","line":1434,"updated":"2013-10-12 04:59:41.000000000","message":"Seems we can remove this change since we have separated the policy rule and role permission for PP, and current server using \u0027role\u0027 mode.","commit_id":"d6c7bf601862ba2a7c1c930c47b41ba8cde123fc"},{"author":{"_account_id":4463,"name":"iccha-sethi","email":"iccha.sethi@rackspace.com","username":"iccha-sethi"},"change_message_id":"438246c256253d5f97226314830ecf93a320da8a","unresolved":false,"context_lines":[{"line_number":1431,"context_line":"        }"},{"line_number":1432,"context_line":"        custom_props \u003d {"},{"line_number":1433,"context_line":"            \u0027X-Image-Meta-Property-spl_create_prop\u0027: \u0027create_bar\u0027,"},{"line_number":1434,"context_line":"            \u0027X-Image-Meta-Property-spl_create_prop_policy\u0027: \u0027create_bar\u0027,"},{"line_number":1435,"context_line":"            \u0027X-Image-Meta-Property-spl_read_prop\u0027: \u0027read_bar\u0027,"},{"line_number":1436,"context_line":"            \u0027X-Image-Meta-Property-spl_update_prop\u0027: \u0027u\u0027,"},{"line_number":1437,"context_line":"            \u0027X-Glance-Registry-Purge-Props\u0027: \u0027True\u0027"}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAATH%2F%2FjNM%3D","line":1434,"in_reply_to":"AAAATH%2F%2FoUM%3D","updated":"2013-10-14 16:44:11.000000000","message":"good point","commit_id":"d6c7bf601862ba2a7c1c930c47b41ba8cde123fc"}],"glance/tests/unit/api/test_property_protections.py":[{"author":{"_account_id":8158,"name":"Hemanth Makkapati","email":"makstacker+osgerrit@gmail.com","username":"hemanth.makkapati"},"change_message_id":"60690443d108c12263cb966dc94e2174af56fdab","unresolved":false,"context_lines":[{"line_number":161,"context_line":"                          extra_prop_proxy.__setitem__,"},{"line_number":162,"context_line":"                          \u0027spl_read_prop\u0027, \u0027par\u0027)"},{"line_number":163,"context_line":""},{"line_number":164,"context_line":"    def test_update_reserved_extra_property_as_permitted_role(self):"},{"line_number":165,"context_line":"        extra_properties \u003d {\u0027spl_create_prop\u0027: \u0027bar\u0027}"},{"line_number":166,"context_line":"        context \u003d glance.context.RequestContext(roles\u003d[\u0027spl_role\u0027])"},{"line_number":167,"context_line":"        extra_prop_proxy \u003d property_protections.ExtraPropertiesProxy("}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAS3%2F%2FiuY%3D","line":164,"updated":"2013-09-24 23:02:22.000000000","message":"This comment probably has nothing to do with the change introduced in this patch, but looks like the test name is a misnomer. While the test name suggests that it is using a permitted role, it seems like \u0027spl_role\u0027 is an unpermitted role for \u0027update\u0027 operation on \u0027spl_create_prop\u0027 property. And, the test actually expects to see an exception. So, just a rename would suffice, I guess?","commit_id":"b55821290902e4e926d307c44a9096bb794ba55f"},{"author":{"_account_id":8158,"name":"Hemanth Makkapati","email":"makstacker+osgerrit@gmail.com","username":"hemanth.makkapati"},"change_message_id":"60690443d108c12263cb966dc94e2174af56fdab","unresolved":false,"context_lines":[{"line_number":178,"context_line":"        extra_prop_proxy[\u0027boo\u0027] \u003d \u0027doo\u0027"},{"line_number":179,"context_line":"        self.assertEqual(extra_prop_proxy[\u0027boo\u0027], \u0027doo\u0027)"},{"line_number":180,"context_line":""},{"line_number":181,"context_line":"    def test_create_reserved_extra_property_as_permitted_role(self):"},{"line_number":182,"context_line":"        extra_properties \u003d {}"},{"line_number":183,"context_line":"        context \u003d glance.context.RequestContext(roles\u003d[\u0027spl_role\u0027])"},{"line_number":184,"context_line":"        extra_prop_proxy \u003d property_protections.ExtraPropertiesProxy("}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAS3%2F%2FiuM%3D","line":181,"updated":"2013-09-24 23:02:22.000000000","message":"A similar concern as above.","commit_id":"b55821290902e4e926d307c44a9096bb794ba55f"},{"author":{"_account_id":8158,"name":"Hemanth Makkapati","email":"makstacker+osgerrit@gmail.com","username":"hemanth.makkapati"},"change_message_id":"60690443d108c12263cb966dc94e2174af56fdab","unresolved":false,"context_lines":[{"line_number":202,"context_line":"                                context, extra_properties, self.property_rules)"},{"line_number":203,"context_line":"        self.assertRaises(KeyError, extra_prop_proxy.__delitem__, \u0027foo\u0027)"},{"line_number":204,"context_line":""},{"line_number":205,"context_line":"    def test_delete_reserved_extra_property_as_permitted_role(self):"},{"line_number":206,"context_line":"        extra_properties \u003d {\u0027spl_read_prop\u0027: \u0027r\u0027}"},{"line_number":207,"context_line":"        context \u003d glance.context.RequestContext(roles\u003d[\u0027spl_role\u0027])"},{"line_number":208,"context_line":"        extra_prop_proxy \u003d property_protections.ExtraPropertiesProxy("}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAS3%2F%2FiuA%3D","line":205,"updated":"2013-09-24 23:02:22.000000000","message":"A similar concern as above.","commit_id":"b55821290902e4e926d307c44a9096bb794ba55f"}],"glance/tests/unit/common/test_property_utils.py":[{"author":{"_account_id":8158,"name":"Hemanth Makkapati","email":"makstacker+osgerrit@gmail.com","username":"hemanth.makkapati"},"change_message_id":"60690443d108c12263cb966dc94e2174af56fdab","unresolved":false,"context_lines":[{"line_number":85,"context_line":"        self.rules_checker \u003d property_utils.PropertyRules()"},{"line_number":86,"context_line":"        self.assertTrue(self.rules_checker.check_property_rules(\u0027test_prop_1\u0027,"},{"line_number":87,"context_line":"                        \u0027read\u0027,"},{"line_number":88,"context_line":"                        glance.context.RequestContext(roles\u003d[\u0027member\u0027])))"},{"line_number":89,"context_line":"        self.assertTrue(self.rules_checker.check_property_rules(\u0027test_prop_1\u0027,"},{"line_number":90,"context_line":"                        \u0027read\u0027,"},{"line_number":91,"context_line":"                        glance.context.RequestContext(roles\u003d[\u0027fake-role\u0027])))"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAS3%2F%2FitU%3D","line":88,"updated":"2013-09-24 23:02:22.000000000","message":"Minor nit.\nMaybe direct \u0027glance.context.RequestContext(roles\u003d[\u0027member\u0027])\u0027 into a variable and use that variable instead?\n\nEx: \nctxt \u003d glance.context.RequestContext(roles\u003d[\u0027member\u0027])\nself.assertTrue(self.rules_checker.check_property_rules(\u0027test_prop_1\u0027,\n                       \u0027read\u0027, ctxt);\n\nFeel free to ignore this comment :)","commit_id":"b55821290902e4e926d307c44a9096bb794ba55f"},{"author":{"_account_id":6549,"name":"Zhi Yan Liu","email":"lzy.dev@gmail.com","username":"lzy-dev"},"change_message_id":"422650900d676f4926ac8d7d79f2eee2d0a63d7a","unresolved":false,"context_lines":[{"line_number":102,"context_line":"        self.assertTrue(self.rules_checker.check_property_rules(\u0027test_prop_1\u0027,"},{"line_number":103,"context_line":"                        \u0027read\u0027, self._create_context([\u0027member\u0027])))"},{"line_number":104,"context_line":"        self.assertTrue(self.rules_checker.check_property_rules(\u0027test_prop_1\u0027,"},{"line_number":105,"context_line":"                        \u0027read\u0027, self._create_context([\u0027member\u0027])))"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"    def test_check_property_rules_invalid_action(self):"},{"line_number":108,"context_line":"        self.rules_checker \u003d property_utils.PropertyRules(self.policy)"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAS3%2F%2FXfQ%3D","line":105,"updated":"2013-09-28 03:06:30.000000000","message":"\u0027fake-role\u0027","commit_id":"f23e0e2a35511f44dfb177f8bc9706d22d078629"}],"glance/tests/unit/utils.py":[{"author":{"_account_id":7703,"name":"Venkatesh Sampath","email":"venkatesh.sampath@outlook.com","username":"venkateshsampath"},"change_message_id":"d10e48ce25c146bc7aa8b1d600d6fc3a76c78b84","unresolved":false,"context_lines":[{"line_number":177,"context_line":"        self.rules \u003d rules"},{"line_number":178,"context_line":""},{"line_number":179,"context_line":"    def load_rules(self, rules\u003dNone):"},{"line_number":180,"context_line":"        print rules"},{"line_number":181,"context_line":"        self.rules \u003d rules"},{"line_number":182,"context_line":""},{"line_number":183,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAS3%2F%2FjUk%3D","line":180,"updated":"2013-09-24 19:25:25.000000000","message":"Is this print stmt to be removed or changed to log(msg). Also I do not see any difference between set_rules and load_rules. Please correct me if I am missing something.","commit_id":"b55821290902e4e926d307c44a9096bb794ba55f"}],"glance/tests/unit/v1/test_api.py":[{"author":{"_account_id":5347,"name":"Eddie Sheffield","email":"eddie.sheffield@rackspace.com","username":"eddie-sheffield"},"change_message_id":"ba2d53faffc1397a370b8edd86837c562c90d907","unresolved":false,"context_lines":[{"line_number":2482,"context_line":""},{"line_number":2483,"context_line":"    def test_prop_protection_with_permitted_policy_config(self):"},{"line_number":2484,"context_line":"        \"\"\""},{"line_number":2485,"context_line":"        As admin role, create and image and verify permitted role \u0027member\u0027 can"},{"line_number":2486,"context_line":"        create a protected property"},{"line_number":2487,"context_line":"        \"\"\""},{"line_number":2488,"context_line":"        image_id \u003d self._create_admin_image()"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAS3%2F%2FYMs%3D","line":2485,"updated":"2013-09-27 20:04:07.000000000","message":"...create AN image...","commit_id":"bb99cda533a24284ae28f1b6b6397e36e0a98e15"},{"author":{"_account_id":6549,"name":"Zhi Yan Liu","email":"lzy.dev@gmail.com","username":"lzy-dev"},"change_message_id":"0265abb69ab1331f7a3b546c98cdb00b00194937","unresolved":false,"context_lines":[{"line_number":2515,"context_line":"        for k, v in headers.iteritems():"},{"line_number":2516,"context_line":"            another_request.headers[k] \u003d v"},{"line_number":2517,"context_line":"        output \u003d another_request.get_response(self.api)"},{"line_number":2518,"context_line":"        res_body \u003d json.loads(output.body)[\u0027image\u0027]"},{"line_number":2519,"context_line":"        self.assertEqual(res_body[\u0027properties\u0027][\u0027spl_create_prop_policy\u0027],"},{"line_number":2520,"context_line":"                         \u0027bar\u0027)"},{"line_number":2521,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAATH%2F%2FoTA%3D","line":2518,"updated":"2013-10-12 04:59:41.000000000","message":"self.assertEqual(output.status_int, 200)","commit_id":"d6c7bf601862ba2a7c1c930c47b41ba8cde123fc"},{"author":{"_account_id":4463,"name":"iccha-sethi","email":"iccha.sethi@rackspace.com","username":"iccha-sethi"},"change_message_id":"438246c256253d5f97226314830ecf93a320da8a","unresolved":false,"context_lines":[{"line_number":2515,"context_line":"        for k, v in headers.iteritems():"},{"line_number":2516,"context_line":"            another_request.headers[k] \u003d v"},{"line_number":2517,"context_line":"        output \u003d another_request.get_response(self.api)"},{"line_number":2518,"context_line":"        res_body \u003d json.loads(output.body)[\u0027image\u0027]"},{"line_number":2519,"context_line":"        self.assertEqual(res_body[\u0027properties\u0027][\u0027spl_create_prop_policy\u0027],"},{"line_number":2520,"context_line":"                         \u0027bar\u0027)"},{"line_number":2521,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAATH%2F%2FjNI%3D","line":2518,"in_reply_to":"AAAATH%2F%2FoTA%3D","updated":"2013-10-14 16:44:11.000000000","message":"will include it","commit_id":"d6c7bf601862ba2a7c1c930c47b41ba8cde123fc"}]}