)]}'
{"etc/heat/policy.json":[{"author":{"_account_id":4328,"name":"Steven Hardy","email":"steven.hardy@suse.com","username":"shardy"},"change_message_id":"8ad913167009ced4e77e00576d1c9b888c71235f","unresolved":false,"context_lines":[{"line_number":27,"context_line":"    \"cloudwatch:PutMetricData\": \"\","},{"line_number":28,"context_line":"    \"cloudwatch:SetAlarmState\": \"rule:deny_stack_user\","},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"    \"management:stack_index\": \"rule:context_is_admin\""},{"line_number":31,"context_line":"}"}],"source_content_type":"application/json","patch_set":1,"id":"AAAATn%2F83Og%3D","line":30,"updated":"2013-12-19 13:21:04.000000000","message":"Using context_is_admin is insufficient, it means anyone who\u0027s an admin on one tenant can access stack_index for *any* tenant.  This is exactly the kind of hole I wanted to avoid with this feature.\n\nWe instead need a new policy rule, something which checks a new role (and possibly project?) e.g role:heat_service_admin and tenant:service_administrators or something.","commit_id":"2909662e9a5d0064a2aaae1efdc91720f1f5538c"},{"author":{"_account_id":4328,"name":"Steven Hardy","email":"steven.hardy@suse.com","username":"shardy"},"change_message_id":"a47265ebda6631173f6f4011114452f24fdaab4b","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"bypass_tenant_scoping\":  \"role:heat_service_admin and tenant:service_administrators\","},{"line_number":3,"context_line":"    \"context_is_admin\":  \"role:admin\","},{"line_number":4,"context_line":"    \"deny_stack_user\": \"not role:heat_stack_user\","},{"line_number":5,"context_line":""}],"source_content_type":"application/json","patch_set":2,"id":"AAAAT3%2F%2F1Nw%3D","line":2,"updated":"2013-12-30 14:54:44.000000000","message":"I\u0027m wondering if we should make this more flexible and generic, as there\u0027s invariably going to be other cloud-admin-ish things you want to add later, right?\n\nLooking at keystone (see policy.v3cloudsample.json), they have a rule like:\n  \"admin_required\": \"role:admin\",\n  \"cloud_admin\": \"rule:admin_required and domain_id:admin_domain_id\",\n\nWe probably need some review from the keystone folks, as dolphm initially suggested a domain scoped token (which I assume is implied in the cloud_admin rule above) was not what we want, but that would provide us a greater degree of separation from the normal users in the default domain.\n\nThen we would just have a context_is_cloud_admin rule, which sets an is_cloud_admin flag in the context, which could be used to defeat project scoping (as is required in this patch), and in future to control action to cloud-admin-only API actions, without the need to add more stuff to the code (just a new policy rule)","commit_id":"e2a10b02be923e18579518562cef14d53ab790ce"},{"author":{"_account_id":8641,"name":"DennyZhang","email":"filebat.mark@gmail.com","username":"dennyzhang"},"change_message_id":"e1a4f8d51ad34785d9ad7d02ca5a6bcd3406c85b","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"admin_required\":  \"role:admin\","},{"line_number":3,"context_line":"    \"cloud_admin\":  \"rule:admin_required and tenant:service_administrators\","},{"line_number":4,"context_line":"    \"context_is_admin\":  \"role:admin\","},{"line_number":5,"context_line":"    \"deny_stack_user\": \"not role:heat_stack_user\","},{"line_number":6,"context_line":""}],"source_content_type":"application/json","patch_set":3,"id":"AAAAT3%2F%2FrAs%3D","line":3,"updated":"2014-01-03 18:23:57.000000000","message":"rename \"cloud_admin\" to context_is_cloud_admin?","commit_id":"1e0367dedbb7e92d2570c95170e17c7ec65b06d2"},{"author":{"_account_id":4328,"name":"Steven Hardy","email":"steven.hardy@suse.com","username":"shardy"},"change_message_id":"500b5c860da7eb2592dea9d0cc70b4c2452e534d","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"admin_required\":  \"role:admin\","},{"line_number":3,"context_line":"    \"context_is_cloud_admin\":  \"rule:admin_required and tenant:service_administrators\","},{"line_number":4,"context_line":"    \"context_is_admin\":  \"role:admin\","},{"line_number":5,"context_line":"    \"deny_stack_user\": \"not role:heat_stack_user\","},{"line_number":6,"context_line":""}],"source_content_type":"application/json","patch_set":4,"id":"AAAAUH%2F%2F3X0%3D","line":3,"updated":"2014-01-07 14:14:18.000000000","message":"I think we may need to consider re-evaluating this in light of:\n\nhttps://review.openstack.org/#/c/61869/\nhttps://blueprints.launchpad.net/keystone/+spec/service-scoped-tokens\n\nMaybe we do it this way for now then switch over to service scoped tokens later?\n\nI need to dig a bit more as I\u0027m not sure what the implementation status is atm, but the spec looks like it will do what we need without this tenant/role (ab)use?","commit_id":"8629a5f1e3b94c4186e6782066dd66dcfe8c2b4f"},{"author":{"_account_id":4257,"name":"Zane Bitter","email":"zbitter@redhat.com","username":"zaneb"},"change_message_id":"477675ad7a2748cdc772d1fce902edb162e80be4","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"admin_required\":  \"role:admin\","},{"line_number":3,"context_line":"    \"context_is_service_admin\":  \"rule:admin_required and tenant:service_administrators\","},{"line_number":4,"context_line":"    \"context_is_admin\":  \"role:admin\","},{"line_number":5,"context_line":"    \"deny_stack_user\": \"not role:heat_stack_user\","},{"line_number":6,"context_line":""}],"source_content_type":"application/json","patch_set":11,"id":"AAAAUH%2F%2Bm0Y%3D","line":3,"updated":"2014-01-23 22:53:53.000000000","message":"Is this a defined thing across OpenStack that all deployments will have by default? Or does the first guy who manages to convince the operator to allocate him a tenant named \"service_administrators\" get access to everything?","commit_id":"8cfd19d430d99c97bbb8fda5b7c585ed7afc4a47"},{"author":{"_account_id":4257,"name":"Zane Bitter","email":"zbitter@redhat.com","username":"zaneb"},"change_message_id":"4e08acf0864a4e976b8935c27c7ae1ade62d12eb","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"admin_required\":  \"role:admin\","},{"line_number":3,"context_line":"    \"context_is_service_admin\":  \"rule:admin_required and tenant:service_administrators\","},{"line_number":4,"context_line":"    \"context_is_admin\":  \"role:admin\","},{"line_number":5,"context_line":"    \"deny_stack_user\": \"not role:heat_stack_user\","},{"line_number":6,"context_line":""}],"source_content_type":"application/json","patch_set":11,"id":"AAAAUH%2F%2BiiM%3D","line":3,"in_reply_to":"AAAAUH%2F%2BkZI%3D","updated":"2014-01-24 16:08:01.000000000","message":"That\u0027s kind of frightening.","commit_id":"8cfd19d430d99c97bbb8fda5b7c585ed7afc4a47"},{"author":{"_account_id":4328,"name":"Steven Hardy","email":"steven.hardy@suse.com","username":"shardy"},"change_message_id":"50c557b5b092204de4e567174351c3b1f6573149","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"admin_required\":  \"role:admin\","},{"line_number":3,"context_line":"    \"context_is_service_admin\":  \"rule:admin_required and tenant:service_administrators\","},{"line_number":4,"context_line":"    \"context_is_admin\":  \"role:admin\","},{"line_number":5,"context_line":"    \"deny_stack_user\": \"not role:heat_stack_user\","},{"line_number":6,"context_line":""}],"source_content_type":"application/json","patch_set":11,"id":"AAAAUH%2F%2BkZI%3D","line":3,"in_reply_to":"AAAAUH%2F%2Bm0Y%3D","updated":"2014-01-24 10:07:14.000000000","message":"It\u0027s the latter...\n\nBasically the idea was to use RBAC as a temporary hack to work around the lack of service-scoped tokens in keystone (ref https://review.openstack.org/#/c/61869/), but when we discussed it I thought that:\n(a) The tenantless requests would be limited to just listing all stacks\n(b) The role used would be something other than \"admin\" because then access to the global-list can be granted without the user needing to be a global admin of everything including keystone (ref https://bugs.launchpad.net/keystone/+bug/968696)","commit_id":"8cfd19d430d99c97bbb8fda5b7c585ed7afc4a47"},{"author":{"_account_id":4328,"name":"Steven Hardy","email":"steven.hardy@suse.com","username":"shardy"},"change_message_id":"1c5d24ede500f0ad9c8406a77836991bf61a0b11","unresolved":false,"context_lines":[{"line_number":39,"context_line":"    \"stacks:delete\": \"rule:deny_stack_user\","},{"line_number":40,"context_line":"    \"stacks:detail\": \"rule:deny_stack_user\","},{"line_number":41,"context_line":"    \"stacks:generate_template\": \"rule:deny_stack_user\","},{"line_number":42,"context_line":"    \"stacks:global_index\": \"rule:deny_everybody\","},{"line_number":43,"context_line":"    \"stacks:index\": \"rule:deny_stack_user\","},{"line_number":44,"context_line":"    \"stacks:list_resource_types\": \"rule:deny_stack_user\","},{"line_number":45,"context_line":"    \"stacks:lookup\": \"rule:deny_stack_user\","}],"source_content_type":"application/json","patch_set":13,"id":"AAAAUH%2F91z0%3D","line":42,"updated":"2014-02-03 13:03:26.000000000","message":"This rule isn\u0027t actually defined is it?  So either this will cause a policy parse error, or maybe drop through to the default rule (which is deny everybody) I\u0027m not sure.\n\nSo I think this should either be \"!\" or you should have a rule defined with \"!\" at the top of the policy file.","commit_id":"de86696dcbcadbd0299f9fe13b55639b9e5af057"}],"heat/api/openstack/v1/stacks.py":[{"author":{"_account_id":4328,"name":"Steven Hardy","email":"steven.hardy@suse.com","username":"shardy"},"change_message_id":"8ad913167009ced4e77e00576d1c9b888c71235f","unresolved":false,"context_lines":[{"line_number":158,"context_line":"        Lists summary information for all stacks"},{"line_number":159,"context_line":"        \"\"\""},{"line_number":160,"context_line":"        if self.enforcer.enforce(req.context, \u0027stack_index\u0027, {}):"},{"line_number":161,"context_line":"            req.context.is_admin \u003d True"},{"line_number":162,"context_line":""},{"line_number":163,"context_line":"        filter_whitelist \u003d {"},{"line_number":164,"context_line":"            \u0027status\u0027: \u0027mixed\u0027,"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAATn%2F83Ss%3D","line":161,"updated":"2013-12-19 13:21:04.000000000","message":"This needs to be part of a patch adding policy enforcement to the whole API IMO.  I started looking at that, but if you have bandwidth to pick it up, let me know and you can do it.","commit_id":"2909662e9a5d0064a2aaae1efdc91720f1f5538c"}],"heat/api/openstack/v1/util.py":[{"author":{"_account_id":4328,"name":"Steven Hardy","email":"steven.hardy@suse.com","username":"shardy"},"change_message_id":"a47265ebda6631173f6f4011114452f24fdaab4b","unresolved":false,"context_lines":[{"line_number":27,"context_line":"    @wraps(handler)"},{"line_number":28,"context_line":"    def handle_stack_method(controller, req, tenant_id, **kwargs):"},{"line_number":29,"context_line":"        if req.context.policy.check_bypass_tenant_scoping(req.context):"},{"line_number":30,"context_line":"            req.context.tenant_safe \u003d False"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"        if req.context.tenant_id !\u003d tenant_id:"},{"line_number":33,"context_line":"            raise exc.HTTPForbidden()"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAT3%2F%2F1NI%3D","line":30,"updated":"2013-12-30 14:54:44.000000000","message":"As mentioned in context.py, I think this is in the wrong place - we should check and evaluate this rule whenever we create a policy object which doesn\u0027t explicitly specify a value - so the policy check should happen in context.py and this should be removed, IMO","commit_id":"e2a10b02be923e18579518562cef14d53ab790ce"}],"heat/common/context.py":[{"author":{"_account_id":4328,"name":"Steven Hardy","email":"steven.hardy@suse.com","username":"shardy"},"change_message_id":"a47265ebda6631173f6f4011114452f24fdaab4b","unresolved":false,"context_lines":[{"line_number":66,"context_line":"        self.trust_id \u003d trust_id"},{"line_number":67,"context_line":"        self.trustor_user_id \u003d trustor_user_id"},{"line_number":68,"context_line":"        self.policy \u003d policy.Enforcer()"},{"line_number":69,"context_line":"        self.tenant_safe \u003d tenant_safe"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"        if is_admin is None:"},{"line_number":72,"context_line":"            self.is_admin \u003d self.policy.check_is_admin(self)"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAT3%2F%2F1Rk%3D","line":69,"updated":"2013-12-30 14:54:44.000000000","message":"I\u0027m wondering if following the same pattern I used for is_admin may make sense here - where we default it to None, and check the policy in that case, but allow explicit override where needed.\n\nThis would also remove the need for all the additional mocking in the tests, as you can just add one line to tests/utils.py::dummy_context","commit_id":"e2a10b02be923e18579518562cef14d53ab790ce"},{"author":{"_account_id":8641,"name":"DennyZhang","email":"filebat.mark@gmail.com","username":"dennyzhang"},"change_message_id":"8669ddc90d1a4fad937fcca959c606ca811903bd","unresolved":false,"context_lines":[{"line_number":45,"context_line":"            copy of the index is not overwritten."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"         :param kwargs: Extra arguments that might be present, but we ignore"},{"line_number":48,"context_line":"            because they possibly came in from older rpc messages."},{"line_number":49,"context_line":"        \"\"\""},{"line_number":50,"context_line":"        super(RequestContext, self).__init__(auth_token\u003dauth_token,"},{"line_number":51,"context_line":"                                             user\u003dusername, tenant\u003dtenant,"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAT3%2F%2FrFk%3D","line":48,"updated":"2014-01-03 17:54:40.000000000","message":"What\u0027s the difference between is_admin and is_cloud_admin?\n\nCould we add some comment here?","commit_id":"1e0367dedbb7e92d2570c95170e17c7ec65b06d2"}],"heat/common/policy.py":[{"author":{"_account_id":8641,"name":"DennyZhang","email":"filebat.mark@gmail.com","username":"dennyzhang"},"change_message_id":"e1a4f8d51ad34785d9ad7d02ca5a6bcd3406c85b","unresolved":false,"context_lines":[{"line_number":110,"context_line":"           :returns: A non-False value if tenant scoping should be bypassed"},{"line_number":111,"context_line":"        \"\"\""},{"line_number":112,"context_line":"        rule \u003d \u0027cloud_admin\u0027"},{"line_number":113,"context_line":"        return self._check(context, rule, target\u003d{}, exc\u003dNone)"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"    def clear(self):"},{"line_number":116,"context_line":"        self.enforcer.clear()"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAT3%2F%2FrAk%3D","line":113,"updated":"2014-01-03 18:23:57.000000000","message":"why not \"return self._check(context, \u0027cloud_admin\u0027, target\u003d{}, exc\u003dNone)\"","commit_id":"1e0367dedbb7e92d2570c95170e17c7ec65b06d2"}],"heat/db/sqlalchemy/api.py":[{"author":{"_account_id":4328,"name":"Steven Hardy","email":"steven.hardy@suse.com","username":"shardy"},"change_message_id":"7e4606d2ff27a386948c9d2424d642e12b475103","unresolved":false,"context_lines":[{"line_number":273,"context_line":"            and context is not None"},{"line_number":274,"context_line":"            and not context.is_service_admin"},{"line_number":275,"context_line":"            and result.tenant !\u003d context.tenant_id):"},{"line_number":276,"context_line":"        return None"},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"    return result"},{"line_number":279,"context_line":""}],"source_content_type":"text/x-python","patch_set":11,"id":"AAAAUH%2F%2BpHo%3D","line":276,"updated":"2014-01-23 16:44:08.000000000","message":"Doesn\u0027t this change mean that the EngineService._get_stack will be able to get a stack from any tenant for service admins, so they won\u0027t only be able to list all stacks, they\u0027ll be able to do anything to any user\u0027s stack in any tenant..\n\nThis seems dangerous to me, and is well beyond the scope of what I thought the change was going to be.","commit_id":"8cfd19d430d99c97bbb8fda5b7c585ed7afc4a47"},{"author":{"_account_id":4328,"name":"Steven Hardy","email":"steven.hardy@suse.com","username":"shardy"},"change_message_id":"48e7f62a96c781da0552cf8d098b482835af1599","unresolved":false,"context_lines":[{"line_number":273,"context_line":"            and context is not None"},{"line_number":274,"context_line":"            and not context.is_service_admin"},{"line_number":275,"context_line":"            and result.tenant !\u003d context.tenant_id):"},{"line_number":276,"context_line":"        return None"},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"    return result"},{"line_number":279,"context_line":""}],"source_content_type":"text/x-python","patch_set":11,"id":"AAAAUH%2F%2Bodo%3D","line":276,"in_reply_to":"AAAAUH%2F%2Bon8%3D","updated":"2014-01-23 18:09:06.000000000","message":"@jasond: Yeah I expected it to be \"Unscoped List Stacks\", not unscoped back-door into everything.\n\nI think we should review the use-case if the latter is what your really want, as I think some sort of local temporary project membership workflow is really way safer, and could use functionality which already exists in keystone and heat with probably zero modifications.","commit_id":"8cfd19d430d99c97bbb8fda5b7c585ed7afc4a47"},{"author":{"_account_id":9189,"name":"Anderson Mesquita","email":"andersonvom@gmail.com","username":"andersonvom"},"change_message_id":"1b64a38ae26e5def882d39244945e313d84188d4","unresolved":false,"context_lines":[{"line_number":273,"context_line":"            and context is not None"},{"line_number":274,"context_line":"            and not context.is_service_admin"},{"line_number":275,"context_line":"            and result.tenant !\u003d context.tenant_id):"},{"line_number":276,"context_line":"        return None"},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"    return result"},{"line_number":279,"context_line":""}],"source_content_type":"text/x-python","patch_set":11,"id":"AAAAUH%2F%2Bon8%3D","line":276,"in_reply_to":"AAAAUH%2F%2BouE%3D","updated":"2014-01-23 17:40:26.000000000","message":"Also, even to list stacks right now, we need stack_get to be available to service_admins because of https://github.com/openstack/heat/blob/master/heat/engine/parser.py#L60\n\nMaybe Randall\u0027s suggestion is the way to go on this: either leaving it as it is since it\u0027s policy controlled and can even be disabled by default;  Or just whitelisting (or blacklisting) admin actions.","commit_id":"8cfd19d430d99c97bbb8fda5b7c585ed7afc4a47"},{"author":{"_account_id":7253,"name":"Jason Dunsmore","email":"jasondunsmore@gmail.com","username":"jbd"},"change_message_id":"a800de8ca6f067390f8598243d0f53e5946681b0","unresolved":false,"context_lines":[{"line_number":273,"context_line":"            and context is not None"},{"line_number":274,"context_line":"            and not context.is_service_admin"},{"line_number":275,"context_line":"            and result.tenant !\u003d context.tenant_id):"},{"line_number":276,"context_line":"        return None"},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"    return result"},{"line_number":279,"context_line":""}],"source_content_type":"text/x-python","patch_set":11,"id":"AAAAUH%2F%2Bous%3D","line":276,"in_reply_to":"AAAAUH%2F%2BoxY%3D","updated":"2014-01-23 17:23:44.000000000","message":"Nevermind, I see in your non-inline comment that you expected this to be limited to stack-list.","commit_id":"8cfd19d430d99c97bbb8fda5b7c585ed7afc4a47"},{"author":{"_account_id":7256,"name":"Randall Burt","email":"randall.burt@rackspace.com","username":"randall-burt"},"change_message_id":"5dd4d93bc28e3f84e0f7e72686d6f58e411378d0","unresolved":false,"context_lines":[{"line_number":273,"context_line":"            and context is not None"},{"line_number":274,"context_line":"            and not context.is_service_admin"},{"line_number":275,"context_line":"            and result.tenant !\u003d context.tenant_id):"},{"line_number":276,"context_line":"        return None"},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"    return result"},{"line_number":279,"context_line":""}],"source_content_type":"text/x-python","patch_set":11,"id":"AAAAUH%2F%2BouE%3D","line":276,"in_reply_to":"AAAAUH%2F%2BpHo%3D","updated":"2014-01-23 17:32:04.000000000","message":"Doesn\u0027t the operator still have the option of turning this stuff off with policy? Perhaps we can just update the policy file to deny access to stack modification if you\u0027re an admin and let service providers decide who they trust with such things?","commit_id":"8cfd19d430d99c97bbb8fda5b7c585ed7afc4a47"},{"author":{"_account_id":7253,"name":"Jason Dunsmore","email":"jasondunsmore@gmail.com","username":"jbd"},"change_message_id":"89d6d9839aa6702a8eb0fde27bc5562fc1f667fd","unresolved":false,"context_lines":[{"line_number":273,"context_line":"            and context is not None"},{"line_number":274,"context_line":"            and not context.is_service_admin"},{"line_number":275,"context_line":"            and result.tenant !\u003d context.tenant_id):"},{"line_number":276,"context_line":"        return None"},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"    return result"},{"line_number":279,"context_line":""}],"source_content_type":"text/x-python","patch_set":11,"id":"AAAAUH%2F%2BoxY%3D","line":276,"in_reply_to":"AAAAUH%2F%2BpHo%3D","updated":"2014-01-23 17:17:52.000000000","message":"Steven,\n\nWhat did you think the change was going to be?  That might help us find a way to move forward.","commit_id":"8cfd19d430d99c97bbb8fda5b7c585ed7afc4a47"}],"heat/engine/service.py":[{"author":{"_account_id":4328,"name":"Steven Hardy","email":"steven.hardy@suse.com","username":"shardy"},"change_message_id":"8ad913167009ced4e77e00576d1c9b888c71235f","unresolved":false,"context_lines":[{"line_number":279,"context_line":"                else:"},{"line_number":280,"context_line":"                    yield api.format_stack(stack)"},{"line_number":281,"context_line":""},{"line_number":282,"context_line":"        if cnxt.is_admin:"},{"line_number":283,"context_line":"            stacks \u003d db_api.stack_get_all(cnxt, limit, sort_keys, marker,"},{"line_number":284,"context_line":"                                          sort_dir, filters) or []"},{"line_number":285,"context_line":"        else:"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAATn%2F83Ns%3D","line":282,"updated":"2013-12-19 13:21:04.000000000","message":"Noooo!\n\nAs mentioned elsewhere, we need to restrict this very carefully - doing this is repeating the keystone \"admin means admin everywhere\" mistake - we need a policy rule which defines the characteristics of the \"super admin\" service provider folks, and that can be used to set a tenant_safe flag in the context (which must default to True)","commit_id":"2909662e9a5d0064a2aaae1efdc91720f1f5538c"},{"author":{"_account_id":4328,"name":"Steven Hardy","email":"steven.hardy@suse.com","username":"shardy"},"change_message_id":"a47265ebda6631173f6f4011114452f24fdaab4b","unresolved":false,"context_lines":[{"line_number":61,"context_line":"            kwargs[\u0027filters\u0027] \u003d {}"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"        if ctx.tenant_safe:"},{"line_number":64,"context_line":"            kwargs[\u0027filters\u0027][\u0027tenant\u0027] \u003d ctx.tenant_id"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"        return func(self, ctx, *args, **kwargs)"},{"line_number":67,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAT3%2F%2F1S0%3D","line":64,"updated":"2013-12-30 14:54:44.000000000","message":"I think this is happening in the wrong place.  The plan I had when I started the request-scoping-policy was to have tenant scoping enforced by default at the db_api level, then for a flag in the context to allow policy driven override of that.\n\nI think you\u0027ve captured most of what\u0027s needed, but I think things may be cleaner if we can push the tenant scoping/filtering into the db_api, then we can kill all of the *_by_tenant stuff in the db/sqlalchemy/api.py, and avoid the need for any additional annotations here in the top level service code.","commit_id":"e2a10b02be923e18579518562cef14d53ab790ce"},{"author":{"_account_id":7253,"name":"Jason Dunsmore","email":"jasondunsmore@gmail.com","username":"jbd"},"change_message_id":"9d2790ed3a3f90b3fe25cd9fb543d34abc77faa7","unresolved":false,"context_lines":[{"line_number":236,"context_line":""},{"line_number":237,"context_line":"        # Create a periodic_watcher_task per-stack"},{"line_number":238,"context_line":"        admin_context \u003d context.get_admin_context()"},{"line_number":239,"context_line":"        stacks \u003d db_api.stack_get_all(admin_context, tenant_safe\u003dFalse)"},{"line_number":240,"context_line":"        for s in stacks:"},{"line_number":241,"context_line":"            self._start_watch_task(s.id, admin_context)"},{"line_number":242,"context_line":""}],"source_content_type":"text/x-python","patch_set":18,"id":"AAAAUX%2F%2BVe0%3D","line":239,"updated":"2014-02-21 19:32:43.000000000","message":"Why was this line changed?","commit_id":"3fd2666f6afff8f8654660212c6e7ed177140b64"}],"heat/tests/test_api_openstack_v1.py":[{"author":{"_account_id":4328,"name":"Steven Hardy","email":"steven.hardy@suse.com","username":"shardy"},"change_message_id":"a47265ebda6631173f6f4011114452f24fdaab4b","unresolved":false,"context_lines":[{"line_number":333,"context_line":""},{"line_number":334,"context_line":"    # def tearDown(self):"},{"line_number":335,"context_line":"    #     super(StackControllerTest, self).tearDown()"},{"line_number":336,"context_line":"    #     self.mock_bypass.stop()"},{"line_number":337,"context_line":""},{"line_number":338,"context_line":"    @mock.patch.object(rpc, \u0027call\u0027)"},{"line_number":339,"context_line":"    def test_index(self, mock_call, mock_enforce):"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAT3%2F%2F1Zk%3D","line":336,"updated":"2013-12-30 14:54:44.000000000","message":"Remove commented code, not needed as you\u0027re using the class decorator","commit_id":"e2a10b02be923e18579518562cef14d53ab790ce"}]}