)]}'
{"id":"openstack%2Fglance~800175","triplet_id":"openstack%2Fglance~master~Ibf3c8a6ab3e64dee4bbacd1a2572ab439be2d961","project":"openstack/glance","branch":"master","topic":"secure-rbac-error-handling","hashtags":[],"change_id":"Ibf3c8a6ab3e64dee4bbacd1a2572ab439be2d961","subject":"Raise 403 instead 404 for get metadef namespace","status":"ABANDONED","created":"2021-07-09 10:08:35.000000000","updated":"2022-07-07 13:56:15.000000000","total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"meta_rev_id":"c8e7660b2ca05fc824c036db9c0f0dee68c77420","_number":800175,"virtual_id_number":800175,"owner":{"_account_id":19138,"name":"Pranali Deore","email":"pdeore@redhat.com","username":"PranaliD"},"actions":{},"labels":{"Verified":{"disliked":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},{"_account_id":19138,"name":"Pranali Deore","email":"pdeore@redhat.com","username":"PranaliD"},{"tag":"autogenerated:zuul:check","value":-1,"date":"2021-07-09 11:46:55.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":-1,"default_value":0,"optional":true},"Code-Review":{"rejected":{"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},"all":[{"value":-2,"date":"2021-07-16 11:08:05.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":19138,"name":"Pranali Deore","email":"pdeore@redhat.com","username":"PranaliD"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"rejected":{"_account_id":19138,"name":"Pranali Deore","email":"pdeore@redhat.com","username":"PranaliD"},"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},{"value":-1,"date":"2021-07-09 10:41:44.000000000","permitted_voting_range":{"min":-1,"max":0},"_account_id":19138,"name":"Pranali Deore","email":"pdeore@redhat.com","username":"PranaliD"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true},"Review-Priority":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":2},"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},{"_account_id":19138,"name":"Pranali Deore","email":"pdeore@redhat.com","username":"PranaliD"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Branch Freeze"," 0":"No Priority","+1":"Important Change","+2":"Top Priority / Holds Gate"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"CC":[{"_account_id":9008,"name":"VMware NSX CI","username":"vmwareminesweeper","tags":["SERVICE_USER"]}],"REVIEWER":[{"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},{"_account_id":19138,"name":"Pranali Deore","email":"pdeore@redhat.com","username":"PranaliD"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2021-07-09 10:49:01.000000000","updated_by":{"_account_id":9008,"name":"VMware NSX CI","username":"vmwareminesweeper","tags":["SERVICE_USER"]},"reviewer":{"_account_id":9008,"name":"VMware NSX CI","username":"vmwareminesweeper","tags":["SERVICE_USER"]},"state":"CC"},{"updated":"2021-07-09 11:46:55.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2021-07-16 11:07:58.000000000","updated_by":{"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},"reviewer":{"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},"state":"CC"},{"updated":"2021-07-16 11:08:05.000000000","updated_by":{"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},"reviewer":{"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},"state":"REVIEWER"}],"messages":[{"id":"4d89e536f2496668740c57f5f63f21905252fd53","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":19138,"name":"Pranali Deore","email":"pdeore@redhat.com","username":"PranaliD"},"date":"2021-07-09 10:08:35.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"e93f618db0710642a838f99929a4223403823622","author":{"_account_id":19138,"name":"Pranali Deore","email":"pdeore@redhat.com","username":"PranaliD"},"date":"2021-07-09 10:41:44.000000000","message":"Patch Set 1: Workflow-1","accounts_in_message":[],"_revision_number":1},{"id":"207897f67a1d4df8e195fa7ecbb195656c3a4db7","author":{"_account_id":9008,"name":"VMware NSX CI","username":"vmwareminesweeper","tags":["SERVICE_USER"]},"date":"2021-07-09 10:49:01.000000000","message":"Patch Set 1:\n\nBuild failed\n\n- dsvm-glance http://207.189.188.190/logs/800175/800175/1/check-not-vote/ext-glance-zuul/f28fab1 : FAILURE in 39m 48s","accounts_in_message":[],"_revision_number":1},{"id":"61706f10f9dbe109c12418966ecdd7d4e87a75a7","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2021-07-09 11:46:55.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\n\n\n- grenade https://zuul.opendev.org/t/openstack/build/acd0099fdd554d698508bcec6cdc1db8 : SUCCESS in 1h 08m 12s\n- tempest-integrated-storage https://zuul.opendev.org/t/openstack/build/579fb65b7c17490995c60fba92f98e3e : FAILURE in 1h 00m 13s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/557a8d0e762349a2b78339772ea58b2c : SUCCESS in 5m 17s\n- openstack-tox-py36 https://zuul.opendev.org/t/openstack/build/e3ecf82b651547969f8d5f11b3977595 : FAILURE in 6m 01s\n- openstack-tox-py38 https://zuul.opendev.org/t/openstack/build/372b8cd4676544479990b5826d3cc4eb : FAILURE in 5m 43s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/5178bf5c03c3412697d5070d6663d827 : FAILURE in 6m 41s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/76e0c9e83344493b9f338a026748608e : SUCCESS in 6m 40s\n- openstack-tox-functional-py36 https://zuul.opendev.org/t/openstack/build/c57bd217424048a2984e33b9b14e2e91 : FAILURE in 8m 05s\n- openstack-tox-functional-py38 https://zuul.opendev.org/t/openstack/build/836a4dca72ca4996b77d98d55a25cd83 : FAILURE in 8m 25s\n- glance-tox-functional-py38-rbac-defaults https://zuul.opendev.org/t/openstack/build/fa9b64fbd9ec4693833538a8bb146add : FAILURE in 7m 01s (non-voting)\n- glance-code-constants-check https://zuul.opendev.org/t/openstack/build/6a5bba4196534c3b903d617a6fc19ad8 : SUCCESS in 5m 10s\n- glance-ceph-thin-provisioning https://zuul.opendev.org/t/openstack/build/32713264559d47da8dfa0bc951a91d94 : FAILURE in 1h 12m 40s (non-voting)\n- tempest-integrated-storage-import https://zuul.opendev.org/t/openstack/build/999b151160a14ae7b10a186b4ae85aee : FAILURE in 1h 04m 15s\n- tempest-integrated-storage-import-standalone https://zuul.opendev.org/t/openstack/build/57c830d3cf654779a8e8fcd9c9a7d07e : FAILURE in 1h 01m 15s\n- glance-multistore-cinder-import https://zuul.opendev.org/t/openstack/build/b7826d9f7239448fa64e551f120e3340 : FAILURE in 58m 14s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/31d795e876b84dfbb286c53aa90aedd4 : SUCCESS in 52m 38s\n- nova-ceph-multistore https://zuul.opendev.org/t/openstack/build/c3adf0dbbe1b42a1924481ef9cf7b42c : FAILURE in 1h 18m 17s\n- glance-secure-rbac-protection-functional https://zuul.opendev.org/t/openstack/build/68d14b872fc7480d94952fb7d647bec7 : SUCCESS in 30m 56s","accounts_in_message":[],"_revision_number":1},{"id":"7781cbfa597b2fdf3d5dbf33922d2ea7769f3ea7","author":{"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},"date":"2021-07-16 11:07:58.000000000","message":"Patch Set 1:\n\nThe current behaviour is correct. If resource does not exist or the user has no rights to it, we do return 404 Not Found intentionally across the API to not leak the information about said resource. On top of that, after this change, we would also raise 403 Forbidden in a case where the namespace really does not exist.","accounts_in_message":[],"_revision_number":1},{"id":"04026002f15d00826c187a07dfbf1cf23405ee46","author":{"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},"date":"2021-07-16 11:08:05.000000000","message":"Patch Set 1: Code-Review-2","accounts_in_message":[],"_revision_number":1},{"id":"7dd644d320a4e3eee0be317a1487c9ffaa9307df","author":{"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},"date":"2021-07-16 11:13:10.000000000","message":"Patch Set 1:\n\n\u003e Patch Set 1:\n\u003e \n\u003e The current behaviour is correct. If resource does not exist or the user has no rights to it, we do return 404 Not Found intentionally across the API to not leak the information about said resource. On top of that, after this change, we would also raise 403 Forbidden in a case where the namespace really does not exist.\n\nMissed the very same incoherence between commit message and the code. The db layer actually does not raise HTTP exception at all, but glance exception. So if we have code above this that would benefit us knowing if it exists vs. user is not allowed to it we could split the except there and reraise accurately, but the we would need to do this same dance somewhere above where it\u0027s converted to actual http return code. The API is actually behaving correctly returning 404 Not Found, but do we need more granular information somewhere in between?","accounts_in_message":[],"_revision_number":1},{"id":"c8e7660b2ca05fc824c036db9c0f0dee68c77420","tag":"autogenerated:gerrit:abandon","author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"date":"2022-07-07 13:56:15.000000000","message":"Abandoned\n\nNot required any more","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"eeb8b7ff0dc89fa364234b75dfd567061be9b169","revisions":{"eeb8b7ff0dc89fa364234b75dfd567061be9b169":{"kind":"REWORK","_number":1,"created":"2021-07-09 10:08:35.000000000","uploader":{"_account_id":19138,"name":"Pranali Deore","email":"pdeore@redhat.com","username":"PranaliD"},"ref":"refs/changes/75/800175/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/glance","ref":"refs/changes/75/800175/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/glance refs/changes/75/800175/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/glance refs/changes/75/800175/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/glance refs/changes/75/800175/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/glance refs/changes/75/800175/1"}}},"commit":{"parents":[{"commit":"77be0e3e230aa0087a4fec64565b71aff16df9bb","subject":"Merge \"Revert \"Remove all usage of keystoneclient\"\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/glance/commit/77be0e3e230aa0087a4fec64565b71aff16df9bb"}]}],"author":{"name":"Pranali Deore","email":"pdeore@redhat.com","date":"2021-07-09 09:46:44.000000000","tz":0},"committer":{"name":"Pranali Deore","email":"pdeore@redhat.com","date":"2021-07-09 10:01:56.000000000","tz":0},"subject":"Raise 403 instead 404 for get metadef namespace","message":"Raise 403 instead 404 for get metadef namespace\n\nCurrently HTTP 404 is being raised from db layer when private\nnamespace is accessed by other tenant. Ideally it should raise\nHTTP 403 since the namespace is available but just not authorized\nto be accessed.\n\nRaising Forbidden instead of Notfound.\n\nChange-Id: Ibf3c8a6ab3e64dee4bbacd1a2572ab439be2d961\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/glance/commit/eeb8b7ff0dc89fa364234b75dfd567061be9b169"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/glance/commit/eeb8b7ff0dc89fa364234b75dfd567061be9b169"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[],"submit_requirements":[]}