)]}'
{"openstack_dashboard/conf/nova_policy.json":[{"author":{"_account_id":5733,"name":"Kieran Spear","email":"kispear@gmail.com","username":"kspear"},"change_message_id":"bbbb9fd6002a65f4f7e06e771fbe6bb2a39981f3","unresolved":false,"context_lines":[{"line_number":12,"context_line":"    \"compute:get_all\": \"\","},{"line_number":13,"context_line":"    \"compute:get_all_tenants\": \"\","},{"line_number":14,"context_line":"    \"compute:unlock_override\": \"rule:admin_api\","},{"line_number":15,"context_line":"    \"compute:attach_volume\" : \"rule:default\","},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"    \"compute:shelve\": \"\","},{"line_number":18,"context_line":"    \"compute:shelve_offload\": \"\","}],"source_content_type":"application/json","patch_set":1,"id":"AAAATH%2F%2FxnQ%3D","line":15,"updated":"2013-10-10 01:17:27.000000000","message":"compute:detach_volume exists too.","commit_id":"c283e673b2007ba6cd000ef3cdf74db485539824"},{"author":{"_account_id":5623,"name":"David Lyle","email":"dklyle0@gmail.com","username":"david-lyle"},"change_message_id":"8efe2d948f43d7e16ffee38998d4f360bdfefa56","unresolved":false,"context_lines":[{"line_number":12,"context_line":"    \"compute:get_all\": \"\","},{"line_number":13,"context_line":"    \"compute:get_all_tenants\": \"\","},{"line_number":14,"context_line":"    \"compute:unlock_override\": \"rule:admin_api\","},{"line_number":15,"context_line":"    \"compute:attach_volume\" : \"rule:default\","},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"    \"compute:shelve\": \"\","},{"line_number":18,"context_line":"    \"compute:shelve_offload\": \"\","}],"source_content_type":"application/json","patch_set":1,"id":"AAAATH%2F%2FxDc%3D","line":15,"in_reply_to":"AAAATH%2F%2FxnQ%3D","updated":"2013-10-10 05:19:43.000000000","message":"Yes.  Forgot to update when I changed my approach.","commit_id":"c283e673b2007ba6cd000ef3cdf74db485539824"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"c97a3d2a1a25fd127896f980ec18cdf0936083ba","unresolved":false,"context_lines":[{"line_number":13,"context_line":"    \"compute:get_all_tenants\": \"\","},{"line_number":14,"context_line":"    \"compute:unlock_override\": \"rule:admin_api\","},{"line_number":15,"context_line":"    \"compute:attach_volume\" : \"rule:default\","},{"line_number":16,"context_line":"    \"compute:detach_volume\" : \"rule:default\","},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"    \"compute:shelve\": \"\","},{"line_number":19,"context_line":"    \"compute:shelve_offload\": \"\","}],"source_content_type":"application/json","patch_set":5,"id":"AAAATn%2F9%2BXM%3D","line":16,"updated":"2013-12-03 21:26:43.000000000","message":"Question, isn\u0027t this duplicate of the rule in line 90/91: \ncompute_extension:v3:os-extended-volumes:attach\": \"\",\ncompute_extension:v3:os-extended-volumes:detach\": \"\",","commit_id":"67690c6b2ef609055dfe7de5368d36dde92b8271"},{"author":{"_account_id":5623,"name":"David Lyle","email":"dklyle0@gmail.com","username":"david-lyle"},"change_message_id":"5f370439468fa1aa9c0fa16e97a1c966b9010bc6","unresolved":false,"context_lines":[{"line_number":13,"context_line":"    \"compute:get_all_tenants\": \"\","},{"line_number":14,"context_line":"    \"compute:unlock_override\": \"rule:admin_api\","},{"line_number":15,"context_line":"    \"compute:attach_volume\" : \"rule:default\","},{"line_number":16,"context_line":"    \"compute:detach_volume\" : \"rule:default\","},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"    \"compute:shelve\": \"\","},{"line_number":19,"context_line":"    \"compute:shelve_offload\": \"\","}],"source_content_type":"application/json","patch_set":5,"id":"AAAATn%2F9%2BQk%3D","line":16,"in_reply_to":"AAAATn%2F9%2BXM%3D","updated":"2014-01-07 21:50:20.000000000","message":"no, those are v3 specific, instrumenting the nova code shows these are the policy checks made.","commit_id":"67690c6b2ef609055dfe7de5368d36dde92b8271"}],"openstack_dashboard/dashboards/project/images_and_snapshots/volume_snapshots/tables.py":[{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"704e66eb356f0015613ad4774d3ee0a3b3b333a1","unresolved":false,"context_lines":[{"line_number":43,"context_line":"    verbose_name \u003d _(\"Create Volume\")"},{"line_number":44,"context_line":"    url \u003d \"horizon:project:volumes:create\""},{"line_number":45,"context_line":"    classes \u003d (\"ajax-modal\", \"btn-camera\")"},{"line_number":46,"context_line":"    policy_rules \u003d ((\"volume\", \"volume:create\"),)"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"    def get_link_url(self, datum):"},{"line_number":49,"context_line":"        base_url \u003d reverse(self.url)"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAATH%2F%2Fsco%3D","line":46,"updated":"2013-10-11 03:37:02.000000000","message":"and \"volume:get_all_snapshots\" ?","commit_id":"f003e88f2c242d325f7f85fabeea9e051267070b"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"32accf109afbf221d5b5c3b2b6d4672e540e8de3","unresolved":false,"context_lines":[{"line_number":43,"context_line":"    verbose_name \u003d _(\"Create Volume\")"},{"line_number":44,"context_line":"    url \u003d \"horizon:project:volumes:create\""},{"line_number":45,"context_line":"    classes \u003d (\"ajax-modal\", \"btn-camera\")"},{"line_number":46,"context_line":"    policy_rules \u003d ((\"volume\", \"volume:create\"),)"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"    def get_link_url(self, datum):"},{"line_number":49,"context_line":"        base_url \u003d reverse(self.url)"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAATH%2F%2FoV0%3D","line":46,"in_reply_to":"AAAATH%2F%2Fp1k%3D","updated":"2013-10-12 04:24:49.000000000","message":"Ah, didn\u0027t notice that the snapshot id is already from the table data. Nevermind","commit_id":"f003e88f2c242d325f7f85fabeea9e051267070b"},{"author":{"_account_id":5623,"name":"David Lyle","email":"dklyle0@gmail.com","username":"david-lyle"},"change_message_id":"9331bd98d2f9f999f7eaba9d0f8a408e1b616ac9","unresolved":false,"context_lines":[{"line_number":43,"context_line":"    verbose_name \u003d _(\"Create Volume\")"},{"line_number":44,"context_line":"    url \u003d \"horizon:project:volumes:create\""},{"line_number":45,"context_line":"    classes \u003d (\"ajax-modal\", \"btn-camera\")"},{"line_number":46,"context_line":"    policy_rules \u003d ((\"volume\", \"volume:create\"),)"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"    def get_link_url(self, datum):"},{"line_number":49,"context_line":"        base_url \u003d reverse(self.url)"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAATH%2F%2Fp1k%3D","line":46,"in_reply_to":"AAAATH%2F%2Fsco%3D","updated":"2013-10-11 17:12:52.000000000","message":"I don\u0027t believe that gets called in the volume create form.","commit_id":"f003e88f2c242d325f7f85fabeea9e051267070b"}],"openstack_dashboard/dashboards/project/volumes/tables.py":[{"author":{"_account_id":5733,"name":"Kieran Spear","email":"kispear@gmail.com","username":"kspear"},"change_message_id":"bbbb9fd6002a65f4f7e06e771fbe6bb2a39981f3","unresolved":false,"context_lines":[{"line_number":41,"context_line":"    policy_rules \u003d ((\"volume\", \"volume:delete\"),)"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"    def get_policy_target(self, request, volume):"},{"line_number":44,"context_line":"        return {\"user_id\": request.user.id,"},{"line_number":45,"context_line":"                \"project_id\": request.user.project_id}"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"    def delete(self, request, obj_id):"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAATH%2F%2FxnY%3D","line":44,"updated":"2013-10-10 01:17:27.000000000","message":"I think these values should be provided by the base class so they\u0027re always available.\n\nThe default policy of some of these actions might not require user_id or project_id, but the actual policy content is up to the deployer. E.g., Keystone always provides user_id, project_id, domain_id and roles.","commit_id":"c283e673b2007ba6cd000ef3cdf74db485539824"},{"author":{"_account_id":5623,"name":"David Lyle","email":"dklyle0@gmail.com","username":"david-lyle"},"change_message_id":"8efe2d948f43d7e16ffee38998d4f360bdfefa56","unresolved":false,"context_lines":[{"line_number":41,"context_line":"    policy_rules \u003d ((\"volume\", \"volume:delete\"),)"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"    def get_policy_target(self, request, volume):"},{"line_number":44,"context_line":"        return {\"user_id\": request.user.id,"},{"line_number":45,"context_line":"                \"project_id\": request.user.project_id}"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"    def delete(self, request, obj_id):"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAATH%2F%2FxFU%3D","line":44,"in_reply_to":"AAAATH%2F%2FxnY%3D","updated":"2013-10-10 05:19:43.000000000","message":"Yeah, I need to rethink this a little.  I\u0027m going to change how the default rules are handled by the policy engine in general.","commit_id":"c283e673b2007ba6cd000ef3cdf74db485539824"},{"author":{"_account_id":5733,"name":"Kieran Spear","email":"kispear@gmail.com","username":"kspear"},"change_message_id":"bbbb9fd6002a65f4f7e06e771fbe6bb2a39981f3","unresolved":false,"context_lines":[{"line_number":232,"context_line":"    data_type_singular \u003d _(\"Volume\")"},{"line_number":233,"context_line":"    data_type_plural \u003d _(\"Volumes\")"},{"line_number":234,"context_line":"    classes \u003d (\u0027btn-danger\u0027, \u0027btn-detach\u0027)"},{"line_number":235,"context_line":"    policy_rules \u003d ((\"volume\", \"default\"),)"},{"line_number":236,"context_line":""},{"line_number":237,"context_line":"    def get_policy_target(self, request, volume):"},{"line_number":238,"context_line":"        return {\"user_id\": request.user.id,"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAATH%2F%2FxnM%3D","line":235,"updated":"2013-10-10 01:17:27.000000000","message":"((\"compute\", \"detach_volume\"),)","commit_id":"c283e673b2007ba6cd000ef3cdf74db485539824"},{"author":{"_account_id":5623,"name":"David Lyle","email":"dklyle0@gmail.com","username":"david-lyle"},"change_message_id":"8efe2d948f43d7e16ffee38998d4f360bdfefa56","unresolved":false,"context_lines":[{"line_number":232,"context_line":"    data_type_singular \u003d _(\"Volume\")"},{"line_number":233,"context_line":"    data_type_plural \u003d _(\"Volumes\")"},{"line_number":234,"context_line":"    classes \u003d (\u0027btn-danger\u0027, \u0027btn-detach\u0027)"},{"line_number":235,"context_line":"    policy_rules \u003d ((\"volume\", \"default\"),)"},{"line_number":236,"context_line":""},{"line_number":237,"context_line":"    def get_policy_target(self, request, volume):"},{"line_number":238,"context_line":"        return {\"user_id\": request.user.id,"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAATH%2F%2FxFo%3D","line":235,"in_reply_to":"AAAATH%2F%2FxnM%3D","updated":"2013-10-10 05:19:43.000000000","message":"Good catch.  Forgot to update.","commit_id":"c283e673b2007ba6cd000ef3cdf74db485539824"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"c97a3d2a1a25fd127896f980ec18cdf0936083ba","unresolved":false,"context_lines":[{"line_number":90,"context_line":"    verbose_name \u003d _(\"Edit Attachments\")"},{"line_number":91,"context_line":"    url \u003d \"horizon:project:volumes:attach\""},{"line_number":92,"context_line":"    classes \u003d (\"ajax-modal\", \"btn-edit\")"},{"line_number":93,"context_line":"    policy_rules \u003d ((\"compute\", \"compute:attach_volume\"),)"},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"    def get_policy_target(self, request, datum\u003dNone):"},{"line_number":96,"context_line":"        project_id \u003d None"}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAATn%2F9%2BUk%3D","line":93,"updated":"2013-12-03 21:26:43.000000000","message":"The user must be able to click on \"Edit Attachments\" to open the modal that has \"Detach Volume\" button.  \n\nThis probably need to be an OR with detach_volume policy.","commit_id":"67690c6b2ef609055dfe7de5368d36dde92b8271"},{"author":{"_account_id":5623,"name":"David Lyle","email":"dklyle0@gmail.com","username":"david-lyle"},"change_message_id":"fbc30bdc262a45494de350fede68fa6c0d66c24d","unresolved":false,"context_lines":[{"line_number":90,"context_line":"    verbose_name \u003d _(\"Edit Attachments\")"},{"line_number":91,"context_line":"    url \u003d \"horizon:project:volumes:attach\""},{"line_number":92,"context_line":"    classes \u003d (\"ajax-modal\", \"btn-edit\")"},{"line_number":93,"context_line":"    policy_rules \u003d ((\"compute\", \"compute:attach_volume\"),)"},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"    def get_policy_target(self, request, datum\u003dNone):"},{"line_number":96,"context_line":"        project_id \u003d None"}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAAUH%2F%2Fk1Y%3D","line":93,"in_reply_to":"AAAATn%2F9%2BUk%3D","updated":"2014-01-10 21:37:58.000000000","message":"Done","commit_id":"67690c6b2ef609055dfe7de5368d36dde92b8271"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"c97a3d2a1a25fd127896f980ec18cdf0936083ba","unresolved":false,"context_lines":[{"line_number":109,"context_line":"    classes \u003d (\"ajax-modal\", \"btn-camera\")"},{"line_number":110,"context_line":"    policy_rules \u003d ((\"volume\", \"volume:create_snapshot\"),)"},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"    def get_policy_target(self, request, datum\u003dNone):"},{"line_number":113,"context_line":"        project_id \u003d None"},{"line_number":114,"context_line":"        if datum:"},{"line_number":115,"context_line":"            project_id \u003d getattr(datum, \"os-vol-tenant-attr:tenant_id\", None)"}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAATn%2F9%2BbE%3D","line":112,"updated":"2013-12-03 21:26:43.000000000","message":"Snapshot can only be created for Volume that belong to the user\u0027s project scope. Is that intention here? \n\nShouldn\u0027t the user be allowed to create snapshot for any volume visible?","commit_id":"67690c6b2ef609055dfe7de5368d36dde92b8271"},{"author":{"_account_id":5623,"name":"David Lyle","email":"dklyle0@gmail.com","username":"david-lyle"},"change_message_id":"fbc30bdc262a45494de350fede68fa6c0d66c24d","unresolved":false,"context_lines":[{"line_number":109,"context_line":"    classes \u003d (\"ajax-modal\", \"btn-camera\")"},{"line_number":110,"context_line":"    policy_rules \u003d ((\"volume\", \"volume:create_snapshot\"),)"},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"    def get_policy_target(self, request, datum\u003dNone):"},{"line_number":113,"context_line":"        project_id \u003d None"},{"line_number":114,"context_line":"        if datum:"},{"line_number":115,"context_line":"            project_id \u003d getattr(datum, \"os-vol-tenant-attr:tenant_id\", None)"}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAAUH%2F%2Fk6s%3D","line":112,"in_reply_to":"AAAATn%2F9%2BbE%3D","updated":"2014-01-10 21:37:58.000000000","message":"will only see based on project scope anyway","commit_id":"67690c6b2ef609055dfe7de5368d36dde92b8271"},{"author":{"_account_id":6966,"name":"Jeffrey J. Walls","email":"jeff.walls@hpe.com","username":"ftcjeff"},"change_message_id":"6b938abd46eccafa7ff917193d5a775d38c2baa8","unresolved":false,"context_lines":[{"line_number":102,"context_line":"                                      {\"project_id\": project_id})"},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"        if attach_allowed or detach_allowed:"},{"line_number":105,"context_line":"            if volume:"},{"line_number":106,"context_line":"                return volume.status in (\"available\", \"in-use\")"},{"line_number":107,"context_line":"        return False"},{"line_number":108,"context_line":""}],"source_content_type":"text/x-python","patch_set":6,"id":"AAAAUH%2F%2Fksw%3D","line":105,"updated":"2014-01-10 21:43:45.000000000","message":"Why don\u0027t you do the volume check up on line 96?  might as well skip all the other code if volume is None.","commit_id":"99c69d4a7f46fdf80c4631909f21309a52c1a18b"},{"author":{"_account_id":5623,"name":"David Lyle","email":"dklyle0@gmail.com","username":"david-lyle"},"change_message_id":"bcccb4a5aa3e81c758b85a02451bf602fe192862","unresolved":false,"context_lines":[{"line_number":102,"context_line":"                                      {\"project_id\": project_id})"},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"        if attach_allowed or detach_allowed:"},{"line_number":105,"context_line":"            if volume:"},{"line_number":106,"context_line":"                return volume.status in (\"available\", \"in-use\")"},{"line_number":107,"context_line":"        return False"},{"line_number":108,"context_line":""}],"source_content_type":"text/x-python","patch_set":6,"id":"AAAAUH%2F%2FkmQ%3D","line":105,"in_reply_to":"AAAAUH%2F%2Fksw%3D","updated":"2014-01-10 22:04:15.000000000","message":"sure","commit_id":"99c69d4a7f46fdf80c4631909f21309a52c1a18b"}],"openstack_dashboard/policy.py":[{"author":{"_account_id":5733,"name":"Kieran Spear","email":"kispear@gmail.com","username":"kspear"},"change_message_id":"68c3534123ef0f34e764c3dda33464b7a8927117","unresolved":false,"context_lines":[{"line_number":95,"context_line":"    # ownership. To reduce duplicate code and since the user is already"},{"line_number":96,"context_line":"    # scoped to a project, if a different project id has not been"},{"line_number":97,"context_line":"    # specified use the currently scoped project\u0027s id."},{"line_number":98,"context_line":"    if \u0027project_id\u0027 not in target:"},{"line_number":99,"context_line":"        target[\u0027project_id\u0027] \u003d user.project_id"},{"line_number":100,"context_line":"    # same for user_id"},{"line_number":101,"context_line":"    if \u0027user_id\u0027 not in target:"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAATH%2F%2Fs5k%3D","line":98,"updated":"2013-10-11 00:25:46.000000000","message":"Ahhh... my memory of how this works is coming back to me. I think we\u0027re both confused :)\n\nThe values in target should describe the object rather than the user. So I think the project_id here needs to be the project_id of the *object* that is changing. E.g., in the case of a volume this would be volume.project_id. I guess that\u0027s why the get_policy_target() exists. There\u0027s probably a way to include sensible defaults for this anyway though in the table base class.\n\nAll the relevant user information is already populated by the _user_to_credentials call below.","commit_id":"f003e88f2c242d325f7f85fabeea9e051267070b"},{"author":{"_account_id":5623,"name":"David Lyle","email":"dklyle0@gmail.com","username":"david-lyle"},"change_message_id":"9331bd98d2f9f999f7eaba9d0f8a408e1b616ac9","unresolved":false,"context_lines":[{"line_number":95,"context_line":"    # ownership. To reduce duplicate code and since the user is already"},{"line_number":96,"context_line":"    # scoped to a project, if a different project id has not been"},{"line_number":97,"context_line":"    # specified use the currently scoped project\u0027s id."},{"line_number":98,"context_line":"    if \u0027project_id\u0027 not in target:"},{"line_number":99,"context_line":"        target[\u0027project_id\u0027] \u003d user.project_id"},{"line_number":100,"context_line":"    # same for user_id"},{"line_number":101,"context_line":"    if \u0027user_id\u0027 not in target:"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAATH%2F%2Fp6A%3D","line":98,"in_reply_to":"AAAATH%2F%2Fs5k%3D","updated":"2013-10-11 17:12:52.000000000","message":"I\u0027m not exactly sure what the right answer is...\n\nLet\u0027s talk about the regular user case because admin has blanket access and is trivial.\nHorizon operates on a model where we take the token scope and limit the users view of the data based on that.  So once we are to the point where we are operating on data, e.g. a table action, then essentially the project_id check has already taken place.  So these action checks are really to make sure that the cloud operator hasn\u0027t decided to make the action an admin only action. At least that\u0027s how I see it.\n\nThe service teams don\u0027t have that data view limitation when the API call is made and thus need to make sure the project_id for the token has access to the target.\n\nThere is another stage in the whole RBAC enablement effort which will tackle the data load aspect.  That is where I see the values for project_id and user_id possibly getting overridden.\n\nThoughts?","commit_id":"f003e88f2c242d325f7f85fabeea9e051267070b"},{"author":{"_account_id":5733,"name":"Kieran Spear","email":"kispear@gmail.com","username":"kspear"},"change_message_id":"68c3534123ef0f34e764c3dda33464b7a8927117","unresolved":false,"context_lines":[{"line_number":118,"context_line":"                   not enforcer[scope].enforce(\u0027default\u0027, target, credentials):"},{"line_number":119,"context_line":"                    return False"},{"line_number":120,"context_line":"                else:"},{"line_number":121,"context_line":"                    return False"},{"line_number":122,"context_line":"        # if no policy for scope, allow action, underlying API will"},{"line_number":123,"context_line":"        # ultimately block the action if not permitted, treat as though"},{"line_number":124,"context_line":"        # allowed"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAATH%2F%2Fs%2BM%3D","line":121,"updated":"2013-10-11 00:25:46.000000000","message":"Both clauses here return false?","commit_id":"f003e88f2c242d325f7f85fabeea9e051267070b"},{"author":{"_account_id":5623,"name":"David Lyle","email":"dklyle0@gmail.com","username":"david-lyle"},"change_message_id":"9331bd98d2f9f999f7eaba9d0f8a408e1b616ac9","unresolved":false,"context_lines":[{"line_number":118,"context_line":"                   not enforcer[scope].enforce(\u0027default\u0027, target, credentials):"},{"line_number":119,"context_line":"                    return False"},{"line_number":120,"context_line":"                else:"},{"line_number":121,"context_line":"                    return False"},{"line_number":122,"context_line":"        # if no policy for scope, allow action, underlying API will"},{"line_number":123,"context_line":"        # ultimately block the action if not permitted, treat as though"},{"line_number":124,"context_line":"        # allowed"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAATH%2F%2Fscw%3D","line":121,"in_reply_to":"AAAATH%2F%2Fs%2BM%3D","updated":"2013-10-11 17:12:52.000000000","message":"Argh, I\u0027m an idiot. The \u0027and\u0027 should have stayed a nested if.","commit_id":"f003e88f2c242d325f7f85fabeea9e051267070b"},{"author":{"_account_id":4978,"name":"Julie Pichon","email":"jpichon@redhat.com","username":"jpichon"},"change_message_id":"13067f2da283f43a6e9220ab112dd960c3846535","unresolved":false,"context_lines":[{"line_number":99,"context_line":"        target[\u0027project_id\u0027] \u003d user.project_id"},{"line_number":100,"context_line":"    # same for user_id"},{"line_number":101,"context_line":"    if \u0027user_id\u0027 not in target:"},{"line_number":102,"context_line":"        target[\u0027user_id\u0027] \u003d user.id"},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"    credentials \u003d _user_to_credentials(request, user)"},{"line_number":105,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAATn%2F%2BfCc%3D","line":102,"updated":"2013-11-25 16:07:57.000000000","message":"I\u0027ve been thinking about the discussion between you and Kieran a couple of patchsets higher. I\u0027m not deeply familiar with the policy engine and rules enforcement, but it seems to me it would be safer to default the target ids to the objects being evaluated, like the services do, as Horizon may still show data one cannot perform certain actions on.\n\nFor instance, for the user_id I think I can think up of a case I saw in a deployment, where everyone could see and create new instances in the project, but only the instance owner was allowed to delete it. It seems if we default the user_id to the current user\u0027s credentials, it would defeat this kind of check.\n\nI suspect a similar case may apply to the project_id, e.g. one may see an image because it\u0027s public or they\u0027ve been added as a member, but it doesn\u0027t actually belong to the current project or a project the current user belongs to.","commit_id":"8850fe780d768ba28d99024519a5177ebf0dd8e9"},{"author":{"_account_id":5623,"name":"David Lyle","email":"dklyle0@gmail.com","username":"david-lyle"},"change_message_id":"d7f710373f1c8e7b3bdd8da0666845c6cd060403","unresolved":false,"context_lines":[{"line_number":99,"context_line":"        target[\u0027project_id\u0027] \u003d user.project_id"},{"line_number":100,"context_line":"    # same for user_id"},{"line_number":101,"context_line":"    if \u0027user_id\u0027 not in target:"},{"line_number":102,"context_line":"        target[\u0027user_id\u0027] \u003d user.id"},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"    credentials \u003d _user_to_credentials(request, user)"},{"line_number":105,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAATn%2F%2Bckk%3D","line":102,"in_reply_to":"AAAATn%2F%2BfCc%3D","updated":"2013-11-25 23:32:17.000000000","message":"You make a valid point.  My main concern is the operator changing the policy rules used on cinder_policy.json and either removing the rule definition, or changing it to the default rule which requires a project_id match.  This now blocks all actions related to that rule.  The benefit we have is the underlying service API will block us when we are being too permissive.","commit_id":"8850fe780d768ba28d99024519a5177ebf0dd8e9"},{"author":{"_account_id":4978,"name":"Julie Pichon","email":"jpichon@redhat.com","username":"jpichon"},"change_message_id":"13067f2da283f43a6e9220ab112dd960c3846535","unresolved":false,"context_lines":[{"line_number":113,"context_line":"                # to match service implementations, if a rule is not found,"},{"line_number":114,"context_line":"                # use the default rule for that service policy"},{"line_number":115,"context_line":"                # waiting to make the check because the first call to"},{"line_number":116,"context_line":"                # enforce loads the rules"},{"line_number":117,"context_line":"                if action not in enforcer[scope].rules:"},{"line_number":118,"context_line":"                    if not enforcer[scope].enforce(\u0027default\u0027,"},{"line_number":119,"context_line":"                                                   target, credentials):"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAATn%2F%2BfM4%3D","line":116,"updated":"2013-11-25 16:07:57.000000000","message":"I think it would beneficial to rephrase the comment a bit to make it less confusing and more useful - it sounds like it\u0027s actually 2 separate sentences.","commit_id":"8850fe780d768ba28d99024519a5177ebf0dd8e9"},{"author":{"_account_id":5623,"name":"David Lyle","email":"dklyle0@gmail.com","username":"david-lyle"},"change_message_id":"d7f710373f1c8e7b3bdd8da0666845c6cd060403","unresolved":false,"context_lines":[{"line_number":113,"context_line":"                # to match service implementations, if a rule is not found,"},{"line_number":114,"context_line":"                # use the default rule for that service policy"},{"line_number":115,"context_line":"                # waiting to make the check because the first call to"},{"line_number":116,"context_line":"                # enforce loads the rules"},{"line_number":117,"context_line":"                if action not in enforcer[scope].rules:"},{"line_number":118,"context_line":"                    if not enforcer[scope].enforce(\u0027default\u0027,"},{"line_number":119,"context_line":"                                                   target, credentials):"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAATn%2F%2BcjY%3D","line":116,"in_reply_to":"AAAATn%2F%2BfM4%3D","updated":"2013-11-25 23:32:17.000000000","message":"Good point, two separate thoughts added at two different times.\n\nDone","commit_id":"8850fe780d768ba28d99024519a5177ebf0dd8e9"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"c97a3d2a1a25fd127896f980ec18cdf0936083ba","unresolved":false,"context_lines":[{"line_number":104,"context_line":"    # the service APIs will correct us if we are too permissive."},{"line_number":105,"context_line":"    if \u0027project_id\u0027 not in target:"},{"line_number":106,"context_line":"        target[\u0027project_id\u0027] \u003d user.project_id"},{"line_number":107,"context_line":"        LOG.debug(\"Using default user project_id, not specified otherwise\")"},{"line_number":108,"context_line":"    # same for user_id"},{"line_number":109,"context_line":"    if \u0027user_id\u0027 not in target:"},{"line_number":110,"context_line":"        target[\u0027user_id\u0027] \u003d user.id"}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAATn%2F9%2Bh0%3D","line":107,"updated":"2013-12-03 21:26:43.000000000","message":"I think this will be just noise in the debug log, most of the time the project_id/user_id won\u0027t be set and there will just too much of this entries in the log.","commit_id":"67690c6b2ef609055dfe7de5368d36dde92b8271"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"c97a3d2a1a25fd127896f980ec18cdf0936083ba","unresolved":false,"context_lines":[{"line_number":108,"context_line":"    # same for user_id"},{"line_number":109,"context_line":"    if \u0027user_id\u0027 not in target:"},{"line_number":110,"context_line":"        target[\u0027user_id\u0027] \u003d user.id"},{"line_number":111,"context_line":"        LOG.debug(\"Using default user user_id, not specified otherwise\")"},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"    credentials \u003d _user_to_credentials(request, user)"},{"line_number":114,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAATn%2F9%2Bho%3D","line":111,"updated":"2013-12-03 21:26:43.000000000","message":"Same here","commit_id":"67690c6b2ef609055dfe7de5368d36dde92b8271"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"c97a3d2a1a25fd127896f980ec18cdf0936083ba","unresolved":false,"context_lines":[{"line_number":123,"context_line":"                # use the default rule for that service policy"},{"line_number":124,"context_line":"                #"},{"line_number":125,"context_line":"                # waiting to make the check because the first call to"},{"line_number":126,"context_line":"                # enforce loads the rules"},{"line_number":127,"context_line":"                if action not in enforcer[scope].rules:"},{"line_number":128,"context_line":"                    if not enforcer[scope].enforce(\u0027default\u0027,"},{"line_number":129,"context_line":"                                                   target, credentials):"}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAATn%2F9%2Bfs%3D","line":126,"updated":"2013-12-03 21:26:43.000000000","message":"Logic sounds reasonable to me.","commit_id":"67690c6b2ef609055dfe7de5368d36dde92b8271"}]}