)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"e6dbf0fe3a2d7ada94710eaf75ae7e3056dc3ad1","unresolved":false,"context_lines":[{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Adds new entrypoint to locate the defined policy defaults, so that"},{"line_number":18,"context_line":"policy.json can be generated automatically with:"},{"line_number":19,"context_line":"  oslopolicy-sample-generator --namespace ironic.api"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Updates unit test coverage for the new authorize() method, as well as"},{"line_number":22,"context_line":"more general unit test updates for some of the new rules."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":16,"id":"dada55a8_c95c967f","line":19,"range":{"start_line":19,"start_character":2,"end_line":19,"end_character":52},"updated":"2016-07-26 12:45:01.000000000","message":"Not going to block over this, but this should be in some sort of operator visible documentation or release note.  I don\u0027t presently see it in the documentation patch nor the release note.","commit_id":"34f5f911abc807f60c1808eda0388a06a59dc1f4"},{"author":{"_account_id":5805,"name":"Chris Krelle","email":"nobodycam@gmail.com","username":"nobodycam"},"change_message_id":"0d774490ddb29afa2cc35fc47d6eddbb5a0c8627","unresolved":false,"context_lines":[{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Adds new entrypoint to locate the defined policy defaults, so that"},{"line_number":18,"context_line":"policy.json can be generated automatically with:"},{"line_number":19,"context_line":"  oslopolicy-sample-generator --namespace ironic.api"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Updates unit test coverage for the new authorize() method, as well as"},{"line_number":22,"context_line":"more general unit test updates for some of the new rules."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":16,"id":"dada55a8_42a8618c","line":19,"range":{"start_line":19,"start_character":2,"end_line":19,"end_character":52},"in_reply_to":"dada55a8_c95c967f","updated":"2016-07-26 23:10:26.000000000","message":"+1","commit_id":"34f5f911abc807f60c1808eda0388a06a59dc1f4"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"ff51fda9dcbbedecdecd40041b8102643068f919","unresolved":false,"context_lines":[{"line_number":9,"context_line":"Implements more fine-grained policy support within our API service,"},{"line_number":10,"context_line":"following the oslo policy-in-code spec, while maintaining compatibility"},{"line_number":11,"context_line":"with the previous default policy.json file. An empty policy.json file is"},{"line_number":12,"context_line":"included, along with a sample file listig all supported policy settings"},{"line_number":13,"context_line":"and their default values."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"A new tox target \"genpolicy\" has been added to ease automation of"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":19,"id":"bacf61ea_7f5bb0f6","line":12,"updated":"2016-07-29 18:06:12.000000000","message":"nit: s/listig/listing/","commit_id":"7b2ef3e499c63430c141445f2a9b3726a06bced2"}],"devstack/lib/ironic":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"e05741d3d79172aa9d70928e1c944e3e525b3b64","unresolved":false,"context_lines":[{"line_number":722,"context_line":"            \"$IRONIC_SERVICE_PROTOCOL://$IRONIC_HOSTPORT\""},{"line_number":723,"context_line":""},{"line_number":724,"context_line":"        # Create ironic service user"},{"line_number":725,"context_line":"        # TODO(deva): make this work with the \u0027service\u0027 role"},{"line_number":726,"context_line":"        create_service_user \"ironic\" \"admin\""},{"line_number":727,"context_line":""},{"line_number":728,"context_line":"        # Create additional bare metal tenant and roles"}],"source_content_type":"application/x-shellscript","patch_set":14,"id":"dada55a8_586b37f1","line":725,"updated":"2016-07-21 00:06:48.000000000","message":"Should we file a bug (RFE or otherwise) generally laying out the work needed to make this happen, and reference it here?","commit_id":"2ed1743f13145345f41448d4d625f11a43f98e59"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"7f99f25ebe231638b701788dc4ae31ee20736751","unresolved":false,"context_lines":[{"line_number":722,"context_line":"            \"$IRONIC_SERVICE_PROTOCOL://$IRONIC_HOSTPORT\""},{"line_number":723,"context_line":""},{"line_number":724,"context_line":"        # Create ironic service user"},{"line_number":725,"context_line":"        # TODO(deva): make this work with the \u0027service\u0027 role"},{"line_number":726,"context_line":"        create_service_user \"ironic\" \"admin\""},{"line_number":727,"context_line":""},{"line_number":728,"context_line":"        # Create additional bare metal tenant and roles"}],"source_content_type":"application/x-shellscript","patch_set":14,"id":"dada55a8_4e7a1525","line":725,"in_reply_to":"dada55a8_586b37f1","updated":"2016-07-21 21:15:10.000000000","message":"done\n\nhttps://bugs.launchpad.net/ironic/+bug/1605398","commit_id":"2ed1743f13145345f41448d4d625f11a43f98e59"}],"etc/ironic/policy.json":[{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"7cc616683a04a217d6ff4fcb658865213641993f","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    # Define rules based on keystone roles, projects, or domains"},{"line_number":3,"context_line":"    \"is_cloud_admin\": \"role:admin or role:administrator\","},{"line_number":4,"context_line":"    \"is_admin\": \"rule:is_member and role:baremetal_admin\","},{"line_number":5,"context_line":"    \"is_observer\": \"rule:is_member and role:baremetal_observer\","},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"    # Create a  \"baremetal\" keystone tenant in your deployment"}],"source_content_type":"application/json","patch_set":3,"id":"7aa08908_4a89d074","line":4,"updated":"2016-06-07 18:32:22.000000000","message":"to retain backwards compatibility with current default policy.json, we need to retain an \"is_admin\" rule.\n\nHowever, I\u0027m not sure whether it should check the new \"is_member\" or not. This will work in devstack because the \"admin\" user is a member of the \"demo\" project, but it may not work outside of devstack...","commit_id":"f7188d04314b0666e208bad7cd7db84edb2b06f5"},{"author":{"_account_id":10343,"name":"Jim Rollenhagen","email":"jim@jimrollenhagen.com","username":"jimrollenhagen"},"change_message_id":"717ee9841950faf10105b3dc4a56e404aed90a97","unresolved":false,"context_lines":[{"line_number":50,"context_line":"    \"baremetal:driver:vendor_passthru\": \"rule:is_cloud_admin or rule:is_admin\","},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"    # Special case for DIB ramdisk compatibility"},{"line_number":53,"context_line":"    \"baremetal:node:dib_pass_deploy_info\": \"\","},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"    # Special cases for ironic-python-agent"},{"line_number":56,"context_line":"    \"baremetal:node:ipa_heartbeat\": \"\","}],"source_content_type":"application/json","patch_set":6,"id":"3aaa91ec_f0f1cd6b","line":53,"updated":"2016-06-22 19:06:53.000000000","message":"We can drop this, the endpoint is gone :D","commit_id":"ff0150dec26741756640c884b9a8c25dd25fb131"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"e05741d3d79172aa9d70928e1c944e3e525b3b64","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# Legacy rule for cloud admin access"},{"line_number":2,"context_line":"\"admin_api\": \"role:admin or role:administrator\""},{"line_number":3,"context_line":"# Internal flag for public API routes"},{"line_number":4,"context_line":"\"public_api\": \"is_public_api:True\""}],"source_content_type":"application/json","patch_set":14,"id":"dada55a8_184c1f9d","line":1,"updated":"2016-07-21 00:06:48.000000000","message":"Do we need to do anything to indicate to packagers to not install this policy.json file, since all of these are defined in code?","commit_id":"2ed1743f13145345f41448d4d625f11a43f98e59"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"7f99f25ebe231638b701788dc4ae31ee20736751","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# Legacy rule for cloud admin access"},{"line_number":2,"context_line":"\"admin_api\": \"role:admin or role:administrator\""},{"line_number":3,"context_line":"# Internal flag for public API routes"},{"line_number":4,"context_line":"\"public_api\": \"is_public_api:True\""}],"source_content_type":"application/json","patch_set":14,"id":"dada55a8_eedf890a","line":1,"in_reply_to":"dada55a8_184c1f9d","updated":"2016-07-21 21:15:10.000000000","message":"I could rename the file to .sample?","commit_id":"2ed1743f13145345f41448d4d625f11a43f98e59"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"2b12a4f670410eba89b82b7deead32062cdc1c08","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# Beginning with the Newton release, you may leave this file empty"},{"line_number":2,"context_line":"# to use default policy defined in code."},{"line_number":3,"context_line":"{"},{"line_number":4,"context_line":""}],"source_content_type":"application/json","patch_set":16,"id":"bacf61ea_cdfd163c","line":1,"updated":"2016-07-28 17:00:07.000000000","message":"I believe so, because the file is (basically) JSON","commit_id":"34f5f911abc807f60c1808eda0388a06a59dc1f4"},{"author":{"_account_id":5805,"name":"Chris Krelle","email":"nobodycam@gmail.com","username":"nobodycam"},"change_message_id":"0d774490ddb29afa2cc35fc47d6eddbb5a0c8627","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# Beginning with the Newton release, you may leave this file empty"},{"line_number":2,"context_line":"# to use default policy defined in code."},{"line_number":3,"context_line":"{"},{"line_number":4,"context_line":""}],"source_content_type":"application/json","patch_set":16,"id":"dada55a8_42b18100","line":1,"range":{"start_line":1,"start_character":61,"end_line":1,"end_character":66},"updated":"2016-07-26 23:10:26.000000000","message":"nit: are  { } required in the file?","commit_id":"34f5f911abc807f60c1808eda0388a06a59dc1f4"},{"author":{"_account_id":10343,"name":"Jim Rollenhagen","email":"jim@jimrollenhagen.com","username":"jimrollenhagen"},"change_message_id":"b2cdae8b58c92703a6d4d8b95136f091a1c89e14","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# Beginning with the Newton release, you may leave this file empty"},{"line_number":2,"context_line":"# to use default policy defined in code."},{"line_number":3,"context_line":"{"},{"line_number":4,"context_line":""}],"source_content_type":"application/json","patch_set":16,"id":"bacf61ea_34a54e04","line":1,"range":{"start_line":1,"start_character":61,"end_line":1,"end_character":66},"in_reply_to":"dada55a8_42b18100","updated":"2016-07-27 21:22:13.000000000","message":"IIRC yes","commit_id":"34f5f911abc807f60c1808eda0388a06a59dc1f4"}],"etc/ironic/policy.json.sample":[{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"2b12a4f670410eba89b82b7deead32062cdc1c08","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# Legacy rule for cloud admin access"},{"line_number":2,"context_line":"\"admin_api\": \"role:admin or role:administrator\""},{"line_number":3,"context_line":"# Internal flag for public API routes"},{"line_number":4,"context_line":"\"public_api\": \"is_public_api:True\""}],"source_content_type":"application/octet-stream","patch_set":16,"id":"bacf61ea_4de92680","line":1,"updated":"2016-07-28 17:00:07.000000000","message":"I agree, but this is what the oslo utility creates :-/","commit_id":"34f5f911abc807f60c1808eda0388a06a59dc1f4"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"e6dbf0fe3a2d7ada94710eaf75ae7e3056dc3ad1","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# Legacy rule for cloud admin access"},{"line_number":2,"context_line":"\"admin_api\": \"role:admin or role:administrator\""},{"line_number":3,"context_line":"# Internal flag for public API routes"},{"line_number":4,"context_line":"\"public_api\": \"is_public_api:True\""}],"source_content_type":"application/octet-stream","patch_set":16,"id":"dada55a8_c6b80578","line":1,"updated":"2016-07-26 12:45:01.000000000","message":"I would \u003c3 for this file to be more human readable, but *shrug*","commit_id":"34f5f911abc807f60c1808eda0388a06a59dc1f4"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"e6dbf0fe3a2d7ada94710eaf75ae7e3056dc3ad1","unresolved":false,"context_lines":[{"line_number":2,"context_line":"\"admin_api\": \"role:admin or role:administrator\""},{"line_number":3,"context_line":"# Internal flag for public API routes"},{"line_number":4,"context_line":"\"public_api\": \"is_public_api:True\""},{"line_number":5,"context_line":"# Show or mask passwords in API responses"},{"line_number":6,"context_line":"\"show_password\": \"!\""},{"line_number":7,"context_line":"# Show or mask configdrive contents in API responses"},{"line_number":8,"context_line":"\"show_configdrive\": \"!\""}],"source_content_type":"application/octet-stream","patch_set":16,"id":"dada55a8_49c38657","line":5,"updated":"2016-07-26 12:45:01.000000000","message":"Out of curiosity, is this generated using the oslo utility mentioned in the commit message?  if so we likely ought to include something in tox.ini like we do for the state diagram, docs, config file, etc.","commit_id":"34f5f911abc807f60c1808eda0388a06a59dc1f4"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"2b12a4f670410eba89b82b7deead32062cdc1c08","unresolved":false,"context_lines":[{"line_number":2,"context_line":"\"admin_api\": \"role:admin or role:administrator\""},{"line_number":3,"context_line":"# Internal flag for public API routes"},{"line_number":4,"context_line":"\"public_api\": \"is_public_api:True\""},{"line_number":5,"context_line":"# Show or mask passwords in API responses"},{"line_number":6,"context_line":"\"show_password\": \"!\""},{"line_number":7,"context_line":"# Show or mask configdrive contents in API responses"},{"line_number":8,"context_line":"\"show_configdrive\": \"!\""}],"source_content_type":"application/octet-stream","patch_set":16,"id":"bacf61ea_2decb28e","line":5,"updated":"2016-07-28 17:00:07.000000000","message":"fair point, I\u0027ll add a tox target.\n\nAs far as the lack of { } ... I just realized it\u0027s also missing commas at the end of lines. There\u0027s no way this is valid JSON :(\n\nIt\u0027s been suggested to remove this file entirely, and just document how to generate it, so I\u0027ll do that - and file a bug against the oslo utility for malformatting.","commit_id":"34f5f911abc807f60c1808eda0388a06a59dc1f4"},{"author":{"_account_id":10343,"name":"Jim Rollenhagen","email":"jim@jimrollenhagen.com","username":"jimrollenhagen"},"change_message_id":"b2cdae8b58c92703a6d4d8b95136f091a1c89e14","unresolved":false,"context_lines":[{"line_number":2,"context_line":"\"admin_api\": \"role:admin or role:administrator\""},{"line_number":3,"context_line":"# Internal flag for public API routes"},{"line_number":4,"context_line":"\"public_api\": \"is_public_api:True\""},{"line_number":5,"context_line":"# Show or mask passwords in API responses"},{"line_number":6,"context_line":"\"show_password\": \"!\""},{"line_number":7,"context_line":"# Show or mask configdrive contents in API responses"},{"line_number":8,"context_line":"\"show_configdrive\": \"!\""}],"source_content_type":"application/octet-stream","patch_set":16,"id":"bacf61ea_94b6ba3b","line":5,"in_reply_to":"dada55a8_49c38657","updated":"2016-07-27 21:22:13.000000000","message":"+1. I\u0027m also curious how this is a valid sample without {} in it :)","commit_id":"34f5f911abc807f60c1808eda0388a06a59dc1f4"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"ff51fda9dcbbedecdecd40041b8102643068f919","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# Legacy rule for cloud admin access"},{"line_number":2,"context_line":"\"admin_api\": \"role:admin or role:administrator\""},{"line_number":3,"context_line":"# Internal flag for public API routes"},{"line_number":4,"context_line":"\"public_api\": \"is_public_api:True\""}],"source_content_type":"application/octet-stream","patch_set":19,"id":"bacf61ea_5f2eac43","line":1,"updated":"2016-07-29 18:06:12.000000000","message":"This still isn\u0027t valid JSON; did you intend to delete this in favor of the policy.yaml.sample?","commit_id":"7b2ef3e499c63430c141445f2a9b3726a06bced2"},{"author":{"_account_id":10343,"name":"Jim Rollenhagen","email":"jim@jimrollenhagen.com","username":"jimrollenhagen"},"change_message_id":"aba80ceb2157d597f34b386d139ac285e4662485","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# Legacy rule for cloud admin access"},{"line_number":2,"context_line":"\"admin_api\": \"role:admin or role:administrator\""},{"line_number":3,"context_line":"# Internal flag for public API routes"},{"line_number":4,"context_line":"\"public_api\": \"is_public_api:True\""}],"source_content_type":"application/octet-stream","patch_set":20,"id":"bacf61ea_ca3f7585","line":1,"updated":"2016-07-29 21:41:05.000000000","message":"... still not JSON?","commit_id":"5f3d506471a997031089255516b23b0357fcaeef"},{"author":{"_account_id":10343,"name":"Jim Rollenhagen","email":"jim@jimrollenhagen.com","username":"jimrollenhagen"},"change_message_id":"27e4ea5d87a20cc4a47b8cbf298ede0d475ab4e9","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# Legacy rule for cloud admin access"},{"line_number":2,"context_line":"\"admin_api\": \"role:admin or role:administrator\""},{"line_number":3,"context_line":"# Internal flag for public API routes"},{"line_number":4,"context_line":"\"public_api\": \"is_public_api:True\""}],"source_content_type":"application/octet-stream","patch_set":20,"id":"bacf61ea_aa8681d8","line":1,"in_reply_to":"bacf61ea_ca3f7585","updated":"2016-07-29 21:57:12.000000000","message":"Apparently, all the policy docs reference JSON, but the generator can only output yaml. Both work. So this kinda is what it is.\n\nJay filed a bug against the generator: https://bugs.launchpad.net/oslo.policy/+bug/1607968","commit_id":"5f3d506471a997031089255516b23b0357fcaeef"}],"ironic/api/app.py":[{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"ebdc507767a381b1eb743d1d1ddbf1e35671748f","unresolved":false,"context_lines":[{"line_number":50,"context_line":"        pecan_config \u003d get_pecan_config()"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"    if pecan_config.app.enable_acl:"},{"line_number":53,"context_line":"        app_hooks.append(hooks.TrustedCallHook())"},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"    pecan.configuration.set_config(dict(pecan_config), overwrite\u003dTrue)"},{"line_number":56,"context_line":""}],"source_content_type":"text/x-python","patch_set":23,"id":"bacf61ea_708968ca","side":"PARENT","line":53,"updated":"2016-08-03 12:28:47.000000000","message":"I\u0027m slightly worried that now all endpoints do not require authorization by default. Is it so? If yes, can we somehow enforce having a policy.authorize call in every endpoint?","commit_id":"49b5027158bb2867d52c5f4126ffb4de6861fdad"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"78d59bdd5e5d001a8663c42c4e82921672b551a1","unresolved":false,"context_lines":[{"line_number":50,"context_line":"        pecan_config \u003d get_pecan_config()"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"    if pecan_config.app.enable_acl:"},{"line_number":53,"context_line":"        app_hooks.append(hooks.TrustedCallHook())"},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"    pecan.configuration.set_config(dict(pecan_config), overwrite\u003dTrue)"},{"line_number":56,"context_line":""}],"source_content_type":"text/x-python","patch_set":23,"id":"bacf61ea_0541be0b","side":"PARENT","line":53,"in_reply_to":"bacf61ea_708968ca","updated":"2016-08-03 18:37:26.000000000","message":"I started working on a unit test to enforce this, but it\u0027s breaking a lot of other assertions in unit tests to do it... I\u0027m going to work on that more today and will incorporate here if it starts passing.\n\nFYI, current WIP of that is here: https://review.openstack.org/#/c/350177/1","commit_id":"49b5027158bb2867d52c5f4126ffb4de6861fdad"}],"ironic/api/controllers/v1/chassis.py":[{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"ebdc507767a381b1eb743d1d1ddbf1e35671748f","unresolved":false,"context_lines":[{"line_number":209,"context_line":"            of the resource to be returned."},{"line_number":210,"context_line":"        \"\"\""},{"line_number":211,"context_line":"        cdict \u003d pecan.request.context.to_dict()"},{"line_number":212,"context_line":"        policy.authorize(\u0027baremetal:chassis:get\u0027, cdict, cdict)"},{"line_number":213,"context_line":""},{"line_number":214,"context_line":"        api_utils.check_allow_specify_fields(fields)"},{"line_number":215,"context_line":"        if fields is None:"}],"source_content_type":"text/x-python","patch_set":23,"id":"bacf61ea_10a2ac4b","line":212,"updated":"2016-08-03 12:28:47.000000000","message":"I think we need a wrapper around this function, so that we can do\n\n ir_policy.authorize(\u0027chassis:get\u0027)","commit_id":"f0ab440b5f55ab5d44dfc6814dc6fb652e31afe5"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"78d59bdd5e5d001a8663c42c4e82921672b551a1","unresolved":false,"context_lines":[{"line_number":209,"context_line":"            of the resource to be returned."},{"line_number":210,"context_line":"        \"\"\""},{"line_number":211,"context_line":"        cdict \u003d pecan.request.context.to_dict()"},{"line_number":212,"context_line":"        policy.authorize(\u0027baremetal:chassis:get\u0027, cdict, cdict)"},{"line_number":213,"context_line":""},{"line_number":214,"context_line":"        api_utils.check_allow_specify_fields(fields)"},{"line_number":215,"context_line":"        if fields is None:"}],"source_content_type":"text/x-python","patch_set":23,"id":"bacf61ea_c5b966ee","line":212,"in_reply_to":"bacf61ea_10a2ac4b","updated":"2016-08-03 18:37:26.000000000","message":"I tried to implement policy.authorize as a @wrapper, but it isn\u0027t possible because we use Pecan. See my note in ironic/common/policy.py","commit_id":"f0ab440b5f55ab5d44dfc6814dc6fb652e31afe5"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"0f463a47b3a566645e731e4fd1fa941226d7b2b2","unresolved":false,"context_lines":[{"line_number":209,"context_line":"            of the resource to be returned."},{"line_number":210,"context_line":"        \"\"\""},{"line_number":211,"context_line":"        cdict \u003d pecan.request.context.to_dict()"},{"line_number":212,"context_line":"        policy.authorize(\u0027baremetal:chassis:get\u0027, cdict, cdict)"},{"line_number":213,"context_line":""},{"line_number":214,"context_line":"        api_utils.check_allow_specify_fields(fields)"},{"line_number":215,"context_line":"        if fields is None:"}],"source_content_type":"text/x-python","patch_set":23,"id":"bacf61ea_bc628714","line":212,"in_reply_to":"bacf61ea_c5b966ee","updated":"2016-08-03 18:41:32.000000000","message":"I see, then a mere helper function would work as well, something like:\n\n def api_authorize(call):\n   cdict \u003d pecan.request.context.to_dict()\n   return policy.authorize(\u0027baremetal:%s\u0027 % call, cdict, cdict)\n\nthis would save us some typing","commit_id":"f0ab440b5f55ab5d44dfc6814dc6fb652e31afe5"}],"ironic/api/controllers/v1/driver.py":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"e05741d3d79172aa9d70928e1c944e3e525b3b64","unresolved":false,"context_lines":[{"line_number":178,"context_line":"        \"\"\""},{"line_number":179,"context_line":"        cdict \u003d pecan.request.context.to_dict()"},{"line_number":180,"context_line":"        if method \u003d\u003d \"lookup\":"},{"line_number":181,"context_line":"            policy.authorize(\u0027baremetal:driver:ipa_lookup\u0027, cdict, cdict)"},{"line_number":182,"context_line":"        else:"},{"line_number":183,"context_line":"            policy.authorize(\u0027baremetal:driver:vendor_passthru\u0027, cdict, cdict)"},{"line_number":184,"context_line":""}],"source_content_type":"text/x-python","patch_set":14,"id":"dada55a8_6c12bc58","line":181,"updated":"2016-07-21 00:06:48.000000000","message":"Is this predictive support for when lookup is an \u0027official\u0027 API endpoint? Maybe a comment here to clarify?","commit_id":"2ed1743f13145345f41448d4d625f11a43f98e59"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"7f99f25ebe231638b701788dc4ae31ee20736751","unresolved":false,"context_lines":[{"line_number":178,"context_line":"        \"\"\""},{"line_number":179,"context_line":"        cdict \u003d pecan.request.context.to_dict()"},{"line_number":180,"context_line":"        if method \u003d\u003d \"lookup\":"},{"line_number":181,"context_line":"            policy.authorize(\u0027baremetal:driver:ipa_lookup\u0027, cdict, cdict)"},{"line_number":182,"context_line":"        else:"},{"line_number":183,"context_line":"            policy.authorize(\u0027baremetal:driver:vendor_passthru\u0027, cdict, cdict)"},{"line_number":184,"context_line":""}],"source_content_type":"text/x-python","patch_set":14,"id":"dada55a8_04065a1f","line":181,"in_reply_to":"dada55a8_6c12bc58","updated":"2016-07-21 21:15:10.000000000","message":"not predictive, this is necessary for IPA to function. \n\n/drivers/*agent/driver_vendor_passthru?method\u003dlookup is a special case today","commit_id":"2ed1743f13145345f41448d4d625f11a43f98e59"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"ebdc507767a381b1eb743d1d1ddbf1e35671748f","unresolved":false,"context_lines":[{"line_number":180,"context_line":"        if method \u003d\u003d \"lookup\":"},{"line_number":181,"context_line":"            policy.authorize(\u0027baremetal:driver:ipa_lookup\u0027, cdict, cdict)"},{"line_number":182,"context_line":"        else:"},{"line_number":183,"context_line":"            policy.authorize(\u0027baremetal:driver:vendor_passthru\u0027, cdict, cdict)"},{"line_number":184,"context_line":""},{"line_number":185,"context_line":"        topic \u003d pecan.request.rpcapi.get_topic_for_driver(driver_name)"},{"line_number":186,"context_line":"        return api_utils.vendor_passthru(driver_name, method, topic, data\u003ddata,"}],"source_content_type":"text/x-python","patch_set":23,"id":"bacf61ea_10ebcc79","line":183,"updated":"2016-08-03 12:28:47.000000000","message":"one more merge conflict for my poor agent API patch... sigh...","commit_id":"f0ab440b5f55ab5d44dfc6814dc6fb652e31afe5"}],"ironic/api/controllers/v1/node.py":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"e05741d3d79172aa9d70928e1c944e3e525b3b64","unresolved":false,"context_lines":[{"line_number":1002,"context_line":""},{"line_number":1003,"context_line":"        \"\"\""},{"line_number":1004,"context_line":"        cdict \u003d pecan.request.context.to_dict()"},{"line_number":1005,"context_line":"        policy.authorize(\u0027baremetal:node:maintenance\u0027, cdict, cdict)"},{"line_number":1006,"context_line":""},{"line_number":1007,"context_line":"        self._set_maintenance(node_ident, False)"},{"line_number":1008,"context_line":""}],"source_content_type":"text/x-python","patch_set":14,"id":"dada55a8_0c4fc06b","line":1005,"updated":"2016-07-21 00:06:48.000000000","message":"Do we want different policies for adding nodes to maintenance vs removing them for maintenance?\n\nFor instance; I might want to be able to give a customer-facing support rep the ability to maint a node that is suspected to be broken, without giving them the ability to unmaint that node or other nodes which may be broken in ways they can\u0027t tell.","commit_id":"2ed1743f13145345f41448d4d625f11a43f98e59"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"7f99f25ebe231638b701788dc4ae31ee20736751","unresolved":false,"context_lines":[{"line_number":1002,"context_line":""},{"line_number":1003,"context_line":"        \"\"\""},{"line_number":1004,"context_line":"        cdict \u003d pecan.request.context.to_dict()"},{"line_number":1005,"context_line":"        policy.authorize(\u0027baremetal:node:maintenance\u0027, cdict, cdict)"},{"line_number":1006,"context_line":""},{"line_number":1007,"context_line":"        self._set_maintenance(node_ident, False)"},{"line_number":1008,"context_line":""}],"source_content_type":"text/x-python","patch_set":14,"id":"dada55a8_6b1eec0c","line":1005,"in_reply_to":"dada55a8_0c4fc06b","updated":"2016-07-21 21:15:10.000000000","message":"good point. and this would be consistent with other policies. I\u0027ll update","commit_id":"2ed1743f13145345f41448d4d625f11a43f98e59"},{"author":{"_account_id":10343,"name":"Jim Rollenhagen","email":"jim@jimrollenhagen.com","username":"jimrollenhagen"},"change_message_id":"b2cdae8b58c92703a6d4d8b95136f091a1c89e14","unresolved":false,"context_lines":[{"line_number":197,"context_line":""},{"line_number":198,"context_line":"        \"\"\""},{"line_number":199,"context_line":"        cdict \u003d pecan.request.context.to_dict()"},{"line_number":200,"context_line":"        policy.authorize(\u0027baremetal:node:set_boot_dev\u0027, cdict, cdict)"},{"line_number":201,"context_line":""},{"line_number":202,"context_line":"        rpc_node \u003d api_utils.get_rpc_node(node_ident)"},{"line_number":203,"context_line":"        topic \u003d pecan.request.rpcapi.get_topic_for(rpc_node)"}],"source_content_type":"text/x-python","patch_set":16,"id":"bacf61ea_94e4fa3b","line":200,"updated":"2016-07-27 21:22:13.000000000","message":"Same here, s/dev/device/","commit_id":"34f5f911abc807f60c1808eda0388a06a59dc1f4"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"2b12a4f670410eba89b82b7deead32062cdc1c08","unresolved":false,"context_lines":[{"line_number":197,"context_line":""},{"line_number":198,"context_line":"        \"\"\""},{"line_number":199,"context_line":"        cdict \u003d pecan.request.context.to_dict()"},{"line_number":200,"context_line":"        policy.authorize(\u0027baremetal:node:set_boot_dev\u0027, cdict, cdict)"},{"line_number":201,"context_line":""},{"line_number":202,"context_line":"        rpc_node \u003d api_utils.get_rpc_node(node_ident)"},{"line_number":203,"context_line":"        topic \u003d pecan.request.rpcapi.get_topic_for(rpc_node)"}],"source_content_type":"text/x-python","patch_set":16,"id":"bacf61ea_cde6b6b3","line":200,"updated":"2016-07-28 17:00:07.000000000","message":"done","commit_id":"34f5f911abc807f60c1808eda0388a06a59dc1f4"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"2b12a4f670410eba89b82b7deead32062cdc1c08","unresolved":false,"context_lines":[{"line_number":222,"context_line":""},{"line_number":223,"context_line":"        \"\"\""},{"line_number":224,"context_line":"        cdict \u003d pecan.request.context.to_dict()"},{"line_number":225,"context_line":"        policy.authorize(\u0027baremetal:node:get_boot_dev\u0027, cdict, cdict)"},{"line_number":226,"context_line":""},{"line_number":227,"context_line":"        return self._get_boot_device(node_ident)"},{"line_number":228,"context_line":""}],"source_content_type":"text/x-python","patch_set":16,"id":"bacf61ea_ade1c29c","line":225,"updated":"2016-07-28 17:00:07.000000000","message":"done","commit_id":"34f5f911abc807f60c1808eda0388a06a59dc1f4"},{"author":{"_account_id":10697,"name":"Thiago Paiva Brito","email":"thiagop@lsd.ufcg.edu.br","username":"thiagop","inactive":true},"change_message_id":"6959f31796edffd498be9d7107b045f9f65d61d1","unresolved":false,"context_lines":[{"line_number":222,"context_line":""},{"line_number":223,"context_line":"        \"\"\""},{"line_number":224,"context_line":"        cdict \u003d pecan.request.context.to_dict()"},{"line_number":225,"context_line":"        policy.authorize(\u0027baremetal:node:get_boot_dev\u0027, cdict, cdict)"},{"line_number":226,"context_line":""},{"line_number":227,"context_line":"        return self._get_boot_device(node_ident)"},{"line_number":228,"context_line":""}],"source_content_type":"text/x-python","patch_set":16,"id":"dada55a8_21b14290","line":225,"range":{"start_line":225,"start_character":41,"end_line":225,"end_character":53},"updated":"2016-07-25 15:51:40.000000000","message":"nit: I\u0027d prefer get_boot_device if it doesn\u0027t cause any problem.","commit_id":"34f5f911abc807f60c1808eda0388a06a59dc1f4"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"e6dbf0fe3a2d7ada94710eaf75ae7e3056dc3ad1","unresolved":false,"context_lines":[{"line_number":222,"context_line":""},{"line_number":223,"context_line":"        \"\"\""},{"line_number":224,"context_line":"        cdict \u003d pecan.request.context.to_dict()"},{"line_number":225,"context_line":"        policy.authorize(\u0027baremetal:node:get_boot_dev\u0027, cdict, cdict)"},{"line_number":226,"context_line":""},{"line_number":227,"context_line":"        return self._get_boot_device(node_ident)"},{"line_number":228,"context_line":""}],"source_content_type":"text/x-python","patch_set":16,"id":"dada55a8_c67005a7","line":225,"range":{"start_line":225,"start_character":41,"end_line":225,"end_character":53},"in_reply_to":"dada55a8_21b14290","updated":"2016-07-26 12:45:01.000000000","message":"I\u0027d also kind of like to see device fully spelled out, since we do it elsewhere and the endpoint name is fully spelled out... but just a nit.","commit_id":"34f5f911abc807f60c1808eda0388a06a59dc1f4"},{"author":{"_account_id":10343,"name":"Jim Rollenhagen","email":"jim@jimrollenhagen.com","username":"jimrollenhagen"},"change_message_id":"b2cdae8b58c92703a6d4d8b95136f091a1c89e14","unresolved":false,"context_lines":[{"line_number":222,"context_line":""},{"line_number":223,"context_line":"        \"\"\""},{"line_number":224,"context_line":"        cdict \u003d pecan.request.context.to_dict()"},{"line_number":225,"context_line":"        policy.authorize(\u0027baremetal:node:get_boot_dev\u0027, cdict, cdict)"},{"line_number":226,"context_line":""},{"line_number":227,"context_line":"        return self._get_boot_device(node_ident)"},{"line_number":228,"context_line":""}],"source_content_type":"text/x-python","patch_set":16,"id":"bacf61ea_74dd0670","line":225,"range":{"start_line":225,"start_character":41,"end_line":225,"end_character":53},"in_reply_to":"dada55a8_c67005a7","updated":"2016-07-27 21:22:13.000000000","message":"+1","commit_id":"34f5f911abc807f60c1808eda0388a06a59dc1f4"},{"author":{"_account_id":10697,"name":"Thiago Paiva Brito","email":"thiagop@lsd.ufcg.edu.br","username":"thiagop","inactive":true},"change_message_id":"6959f31796edffd498be9d7107b045f9f65d61d1","unresolved":false,"context_lines":[{"line_number":237,"context_line":""},{"line_number":238,"context_line":"        \"\"\""},{"line_number":239,"context_line":"        cdict \u003d pecan.request.context.to_dict()"},{"line_number":240,"context_line":"        policy.authorize(\u0027baremetal:node:get_boot_dev\u0027, cdict, cdict)"},{"line_number":241,"context_line":""},{"line_number":242,"context_line":"        boot_devices \u003d self._get_boot_device(node_ident, supported\u003dTrue)"},{"line_number":243,"context_line":"        return {\u0027supported_boot_devices\u0027: boot_devices}"}],"source_content_type":"text/x-python","patch_set":16,"id":"dada55a8_e16d6a05","line":240,"range":{"start_line":240,"start_character":41,"end_line":240,"end_character":53},"updated":"2016-07-25 15:51:40.000000000","message":"ditto","commit_id":"34f5f911abc807f60c1808eda0388a06a59dc1f4"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"2b12a4f670410eba89b82b7deead32062cdc1c08","unresolved":false,"context_lines":[{"line_number":237,"context_line":""},{"line_number":238,"context_line":"        \"\"\""},{"line_number":239,"context_line":"        cdict \u003d pecan.request.context.to_dict()"},{"line_number":240,"context_line":"        policy.authorize(\u0027baremetal:node:get_boot_dev\u0027, cdict, cdict)"},{"line_number":241,"context_line":""},{"line_number":242,"context_line":"        boot_devices \u003d self._get_boot_device(node_ident, supported\u003dTrue)"},{"line_number":243,"context_line":"        return {\u0027supported_boot_devices\u0027: boot_devices}"}],"source_content_type":"text/x-python","patch_set":16,"id":"bacf61ea_0def2e88","line":240,"updated":"2016-07-28 17:00:07.000000000","message":"done","commit_id":"34f5f911abc807f60c1808eda0388a06a59dc1f4"},{"author":{"_account_id":10343,"name":"Jim Rollenhagen","email":"jim@jimrollenhagen.com","username":"jimrollenhagen"},"change_message_id":"b2cdae8b58c92703a6d4d8b95136f091a1c89e14","unresolved":false,"context_lines":[{"line_number":950,"context_line":"        cdict \u003d pecan.request.context.to_dict()"},{"line_number":951,"context_line":"        if method \u003d\u003d \u0027heartbeat\u0027:"},{"line_number":952,"context_line":"            policy.authorize(\u0027baremetal:node:ipa_heartbeat\u0027, cdict, cdict)"},{"line_number":953,"context_line":"        elif method in [\u0027pass_deploy_info\u0027, \u0027pass_bootloader_info\u0027]:"},{"line_number":954,"context_line":"            policy.authorize(\u0027baremetal:node:dib_pass_deploy_info\u0027,"},{"line_number":955,"context_line":"                             cdict, cdict)"},{"line_number":956,"context_line":"        else:"}],"source_content_type":"text/x-python","patch_set":16,"id":"bacf61ea_3458aefa","line":953,"updated":"2016-07-27 21:22:13.000000000","message":"These methods don\u0027t exist anymore, we can drop this :)\n\n(but that can be done in a followup)","commit_id":"34f5f911abc807f60c1808eda0388a06a59dc1f4"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"2b12a4f670410eba89b82b7deead32062cdc1c08","unresolved":false,"context_lines":[{"line_number":950,"context_line":"        cdict \u003d pecan.request.context.to_dict()"},{"line_number":951,"context_line":"        if method \u003d\u003d \u0027heartbeat\u0027:"},{"line_number":952,"context_line":"            policy.authorize(\u0027baremetal:node:ipa_heartbeat\u0027, cdict, cdict)"},{"line_number":953,"context_line":"        elif method in [\u0027pass_deploy_info\u0027, \u0027pass_bootloader_info\u0027]:"},{"line_number":954,"context_line":"            policy.authorize(\u0027baremetal:node:dib_pass_deploy_info\u0027,"},{"line_number":955,"context_line":"                             cdict, cdict)"},{"line_number":956,"context_line":"        else:"}],"source_content_type":"text/x-python","patch_set":16,"id":"bacf61ea_edf1fa6b","line":953,"updated":"2016-07-28 17:00:07.000000000","message":"done","commit_id":"34f5f911abc807f60c1808eda0388a06a59dc1f4"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"ebdc507767a381b1eb743d1d1ddbf1e35671748f","unresolved":false,"context_lines":[{"line_number":932,"context_line":"        :raises: NodeNotFound if the node is not found."},{"line_number":933,"context_line":"        \"\"\""},{"line_number":934,"context_line":"        cdict \u003d pecan.request.context.to_dict()"},{"line_number":935,"context_line":"        policy.authorize(\u0027baremetal:node:vendor_passthru\u0027, cdict, cdict)"},{"line_number":936,"context_line":""},{"line_number":937,"context_line":"        # Raise an exception if node is not found"},{"line_number":938,"context_line":"        rpc_node \u003d api_utils.get_rpc_node(node_ident)"}],"source_content_type":"text/x-python","patch_set":23,"id":"bacf61ea_309ff004","line":935,"updated":"2016-08-03 12:28:47.000000000","message":"I\u0027m not sure it\u0027s a good idea to have the same policy for listing methods and running them. The former could potentially be seen by an observer..\n\nProbably the same comment goes to driver vendor passthru.","commit_id":"f0ab440b5f55ab5d44dfc6814dc6fb652e31afe5"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"78d59bdd5e5d001a8663c42c4e82921672b551a1","unresolved":false,"context_lines":[{"line_number":932,"context_line":"        :raises: NodeNotFound if the node is not found."},{"line_number":933,"context_line":"        \"\"\""},{"line_number":934,"context_line":"        cdict \u003d pecan.request.context.to_dict()"},{"line_number":935,"context_line":"        policy.authorize(\u0027baremetal:node:vendor_passthru\u0027, cdict, cdict)"},{"line_number":936,"context_line":""},{"line_number":937,"context_line":"        # Raise an exception if node is not found"},{"line_number":938,"context_line":"        rpc_node \u003d api_utils.get_rpc_node(node_ident)"}],"source_content_type":"text/x-python","patch_set":23,"id":"bacf61ea_859f6e5e","line":935,"in_reply_to":"bacf61ea_309ff004","updated":"2016-08-03 18:37:26.000000000","message":"we can add more fine grained policies on this endpoint if we want to in a follow-on patch.","commit_id":"f0ab440b5f55ab5d44dfc6814dc6fb652e31afe5"}],"ironic/api/controllers/v1/port.py":[{"author":{"_account_id":5805,"name":"Chris Krelle","email":"nobodycam@gmail.com","username":"nobodycam"},"change_message_id":"0d774490ddb29afa2cc35fc47d6eddbb5a0c8627","unresolved":false,"context_lines":[{"line_number":307,"context_line":"        :param sort_dir: direction to sort. \"asc\" or \"desc\". Default: asc."},{"line_number":308,"context_line":"        :param fields: Optional, a list with a specified set of fields"},{"line_number":309,"context_line":"            of the resource to be returned."},{"line_number":310,"context_line":"        :raises: NotAcceptable"},{"line_number":311,"context_line":"        \"\"\""},{"line_number":312,"context_line":"        cdict \u003d pecan.request.context.to_dict()"},{"line_number":313,"context_line":"        policy.authorize(\u0027baremetal:port:get\u0027, cdict, cdict)"}],"source_content_type":"text/x-python","patch_set":16,"id":"dada55a8_e23cf594","line":310,"range":{"start_line":310,"start_character":17,"end_line":310,"end_character":30},"updated":"2016-07-26 23:10:26.000000000","message":"Nit: I think we may now also raise NotAuthorized","commit_id":"34f5f911abc807f60c1808eda0388a06a59dc1f4"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"2b12a4f670410eba89b82b7deead32062cdc1c08","unresolved":false,"context_lines":[{"line_number":307,"context_line":"        :param sort_dir: direction to sort. \"asc\" or \"desc\". Default: asc."},{"line_number":308,"context_line":"        :param fields: Optional, a list with a specified set of fields"},{"line_number":309,"context_line":"            of the resource to be returned."},{"line_number":310,"context_line":"        :raises: NotAcceptable"},{"line_number":311,"context_line":"        \"\"\""},{"line_number":312,"context_line":"        cdict \u003d pecan.request.context.to_dict()"},{"line_number":313,"context_line":"        policy.authorize(\u0027baremetal:port:get\u0027, cdict, cdict)"}],"source_content_type":"text/x-python","patch_set":16,"id":"bacf61ea_6dd7cabf","line":310,"updated":"2016-07-28 17:00:07.000000000","message":"all methods could raise NotAuthorized -- and they always could have done that, at a layer above this. I don\u0027t think it needs to be stated explicitly in every method...","commit_id":"34f5f911abc807f60c1808eda0388a06a59dc1f4"}],"ironic/common/exception.py":[{"author":{"_account_id":12356,"name":"Vladyslav Drok","email":"vdrok@mirantis.com","username":"vdrok"},"change_message_id":"a47d8a6d1b9b189e32af3879cf2218190f37579c","unresolved":false,"context_lines":[{"line_number":426,"context_line":"    _msg_fmt \u003d _(\"Unable to communicate with the server.\")"},{"line_number":427,"context_line":""},{"line_number":428,"context_line":""},{"line_number":429,"context_line":"class HTTPForbidden(NotAuthorized):"},{"line_number":430,"context_line":"    _msg_fmt \u003d _(\"Access was denied to the following resource: %(resource)s\")"},{"line_number":431,"context_line":""},{"line_number":432,"context_line":""}],"source_content_type":"text/x-python","patch_set":20,"id":"bacf61ea_c3561005","line":429,"updated":"2016-08-01 12:11:51.000000000","message":"Hm, this changes base class and status code, might need to provide some backwards compatibility?","commit_id":"5f3d506471a997031089255516b23b0357fcaeef"},{"author":{"_account_id":12356,"name":"Vladyslav Drok","email":"vdrok@mirantis.com","username":"vdrok"},"change_message_id":"76bc8009d6bb12ed4fedcf3a0118d460c61163d9","unresolved":false,"context_lines":[{"line_number":426,"context_line":"    _msg_fmt \u003d _(\"Unable to communicate with the server.\")"},{"line_number":427,"context_line":""},{"line_number":428,"context_line":""},{"line_number":429,"context_line":"class HTTPForbidden(NotAuthorized):"},{"line_number":430,"context_line":"    _msg_fmt \u003d _(\"Access was denied to the following resource: %(resource)s\")"},{"line_number":431,"context_line":""},{"line_number":432,"context_line":""}],"source_content_type":"text/x-python","patch_set":20,"id":"bacf61ea_6cb621fa","line":429,"in_reply_to":"bacf61ea_2188b270","updated":"2016-08-01 17:07:31.000000000","message":"Yep, OTOH it does not seem likely that someone is catching only Forbidden exception.","commit_id":"5f3d506471a997031089255516b23b0357fcaeef"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"9b8b4c16579ccb0f57763839c22bfc9c631ca209","unresolved":false,"context_lines":[{"line_number":426,"context_line":"    _msg_fmt \u003d _(\"Unable to communicate with the server.\")"},{"line_number":427,"context_line":""},{"line_number":428,"context_line":""},{"line_number":429,"context_line":"class HTTPForbidden(NotAuthorized):"},{"line_number":430,"context_line":"    _msg_fmt \u003d _(\"Access was denied to the following resource: %(resource)s\")"},{"line_number":431,"context_line":""},{"line_number":432,"context_line":""}],"source_content_type":"text/x-python","patch_set":20,"id":"bacf61ea_2188b270","line":429,"in_reply_to":"bacf61ea_c3561005","updated":"2016-08-01 16:54:44.000000000","message":"This class wasn\u0027t used anywhere in our code, so this change seems safe to me.\n\nAre you concerned about out-of-tree uses of this exception class?","commit_id":"5f3d506471a997031089255516b23b0357fcaeef"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"ebdc507767a381b1eb743d1d1ddbf1e35671748f","unresolved":false,"context_lines":[{"line_number":430,"context_line":"    _msg_fmt \u003d _(\"Unable to communicate with the server.\")"},{"line_number":431,"context_line":""},{"line_number":432,"context_line":""},{"line_number":433,"context_line":"class HTTPForbidden(NotAuthorized):"},{"line_number":434,"context_line":"    _msg_fmt \u003d _(\"Access was denied to the following resource: %(resource)s\")"},{"line_number":435,"context_line":""},{"line_number":436,"context_line":""}],"source_content_type":"text/x-python","patch_set":23,"id":"bacf61ea_d09774e9","line":433,"updated":"2016-08-03 12:28:47.000000000","message":"looks like this changes the HTTP code from the default (400?) in Forbidden to 403 in NotAuthorized. Is it acceptable?","commit_id":"f0ab440b5f55ab5d44dfc6814dc6fb652e31afe5"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"78d59bdd5e5d001a8663c42c4e82921672b551a1","unresolved":false,"context_lines":[{"line_number":430,"context_line":"    _msg_fmt \u003d _(\"Unable to communicate with the server.\")"},{"line_number":431,"context_line":""},{"line_number":432,"context_line":""},{"line_number":433,"context_line":"class HTTPForbidden(NotAuthorized):"},{"line_number":434,"context_line":"    _msg_fmt \u003d _(\"Access was denied to the following resource: %(resource)s\")"},{"line_number":435,"context_line":""},{"line_number":436,"context_line":""}],"source_content_type":"text/x-python","patch_set":23,"id":"bacf61ea_e59bca64","line":433,"in_reply_to":"bacf61ea_d09774e9","updated":"2016-08-03 18:37:26.000000000","message":"see comments on prior patch set.\n\nthis exception was not raised anywhere, so changing it has no impact on the API.","commit_id":"f0ab440b5f55ab5d44dfc6814dc6fb652e31afe5"}],"ironic/common/policy.py":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"00e00a7a655b714300de61dff70b5b3204ae4e40","unresolved":false,"context_lines":[{"line_number":47,"context_line":"                       \u0027tenant:demo or tenant:baremetal\u0027,"},{"line_number":48,"context_line":"                       description\u003d\u0027May be used to restrict access to specific tenants\u0027),  # noqa"},{"line_number":49,"context_line":"    policy.RuleDefault(\u0027is_observer\u0027,"},{"line_number":50,"context_line":"                       \u0027rule:is_member and role:baremetal_observer\u0027,"},{"line_number":51,"context_line":"                       description\u003d\u0027Read-only API access\u0027),"},{"line_number":52,"context_line":"    policy.RuleDefault(\u0027is_admin\u0027,"},{"line_number":53,"context_line":"                       \u0027rule:admin_api or (rule:is_member and role:baremetal_admin)\u0027,  # noqa"}],"source_content_type":"text/x-python","patch_set":12,"id":"dada55a8_feb82977","line":50,"updated":"2016-07-20 16:05:28.000000000","message":"Should we ship a rule honoring the older \"observer\" role (not namespaced to Ironic). Proposed, but not landed spec on consistent policy in OpenStack says we should.","commit_id":"bd5d4272b7f00883f50d8a1fedc1d0cd5a3cda15"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"10679f5d5657e9f85c99c8c7770143dab2dc8ea9","unresolved":false,"context_lines":[{"line_number":240,"context_line":"        raise exception.HTTPForbidden(resource\u003drule)"},{"line_number":241,"context_line":""},{"line_number":242,"context_line":""},{"line_number":243,"context_line":"def check(rule, target, creds, *args, **kwargs):"},{"line_number":244,"context_line":"    \"\"\"A shortcut for policy.Enforcer.enforce()"},{"line_number":245,"context_line":""},{"line_number":246,"context_line":"    Checks authorization of a rule against the target and credentials"}],"source_content_type":"text/x-python","patch_set":12,"id":"dada55a8_2f10c958","line":243,"updated":"2016-07-20 16:53:41.000000000","message":"Is there a reason this is being added since it\u0027s mostly the same as enforce below?","commit_id":"bd5d4272b7f00883f50d8a1fedc1d0cd5a3cda15"},{"author":{"_account_id":10343,"name":"Jim Rollenhagen","email":"jim@jimrollenhagen.com","username":"jimrollenhagen"},"change_message_id":"b2cdae8b58c92703a6d4d8b95136f091a1c89e14","unresolved":false,"context_lines":[{"line_number":44,"context_line":"                       description\u003d\u0027Show or mask passwords in API responses\u0027),"},{"line_number":45,"context_line":"    # Roles likely to be overriden by operator"},{"line_number":46,"context_line":"    policy.RuleDefault(\u0027is_member\u0027,"},{"line_number":47,"context_line":"                       \u0027tenant:demo or tenant:baremetal\u0027,"},{"line_number":48,"context_line":"                       description\u003d\u0027May be used to restrict access to specific tenants\u0027),  # noqa"},{"line_number":49,"context_line":"    policy.RuleDefault(\u0027is_observer\u0027,"},{"line_number":50,"context_line":"                       \u0027rule:is_member and (role:observer or role:baremetal_observer)\u0027,  # noqa"}],"source_content_type":"text/x-python","patch_set":16,"id":"bacf61ea_34ab8e8b","line":47,"updated":"2016-07-27 21:22:13.000000000","message":"I\u0027m not sure this is a useful default, but I\u0027m not sure I have a better suggestion.","commit_id":"34f5f911abc807f60c1808eda0388a06a59dc1f4"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"2b12a4f670410eba89b82b7deead32062cdc1c08","unresolved":false,"context_lines":[{"line_number":44,"context_line":"                       description\u003d\u0027Show or mask passwords in API responses\u0027),"},{"line_number":45,"context_line":"    # Roles likely to be overriden by operator"},{"line_number":46,"context_line":"    policy.RuleDefault(\u0027is_member\u0027,"},{"line_number":47,"context_line":"                       \u0027tenant:demo or tenant:baremetal\u0027,"},{"line_number":48,"context_line":"                       description\u003d\u0027May be used to restrict access to specific tenants\u0027),  # noqa"},{"line_number":49,"context_line":"    policy.RuleDefault(\u0027is_observer\u0027,"},{"line_number":50,"context_line":"                       \u0027rule:is_member and (role:observer or role:baremetal_observer)\u0027,  # noqa"}],"source_content_type":"text/x-python","patch_set":16,"id":"bacf61ea_4dd2c6d3","line":47,"updated":"2016-07-28 17:00:07.000000000","message":"tenant:demo is needed for devstack, so I think it\u0027s a useful default.\n\ntenant:baremetal is something I\u0027d like to add to our deployer docs and use in examples of how to secure access to the service. I expect operators will change these.","commit_id":"34f5f911abc807f60c1808eda0388a06a59dc1f4"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"2b12a4f670410eba89b82b7deead32062cdc1c08","unresolved":false,"context_lines":[{"line_number":45,"context_line":"    # Roles likely to be overriden by operator"},{"line_number":46,"context_line":"    policy.RuleDefault(\u0027is_member\u0027,"},{"line_number":47,"context_line":"                       \u0027tenant:demo or tenant:baremetal\u0027,"},{"line_number":48,"context_line":"                       description\u003d\u0027May be used to restrict access to specific tenants\u0027),  # noqa"},{"line_number":49,"context_line":"    policy.RuleDefault(\u0027is_observer\u0027,"},{"line_number":50,"context_line":"                       \u0027rule:is_member and (role:observer or role:baremetal_observer)\u0027,  # noqa"},{"line_number":51,"context_line":"                       description\u003d\u0027Read-only API access\u0027),"}],"source_content_type":"text/x-python","patch_set":16,"id":"bacf61ea_2dd5d2b8","line":48,"updated":"2016-07-28 17:00:07.000000000","message":"line is a bit longer than 80 chars, and wrapping just the last word isn\u0027t as reasable IMHO, so I #noqa\u0027d these to avoid the pep8 error","commit_id":"34f5f911abc807f60c1808eda0388a06a59dc1f4"},{"author":{"_account_id":10343,"name":"Jim Rollenhagen","email":"jim@jimrollenhagen.com","username":"jimrollenhagen"},"change_message_id":"b2cdae8b58c92703a6d4d8b95136f091a1c89e14","unresolved":false,"context_lines":[{"line_number":45,"context_line":"    # Roles likely to be overriden by operator"},{"line_number":46,"context_line":"    policy.RuleDefault(\u0027is_member\u0027,"},{"line_number":47,"context_line":"                       \u0027tenant:demo or tenant:baremetal\u0027,"},{"line_number":48,"context_line":"                       description\u003d\u0027May be used to restrict access to specific tenants\u0027),  # noqa"},{"line_number":49,"context_line":"    policy.RuleDefault(\u0027is_observer\u0027,"},{"line_number":50,"context_line":"                       \u0027rule:is_member and (role:observer or role:baremetal_observer)\u0027,  # noqa"},{"line_number":51,"context_line":"                       description\u003d\u0027Read-only API access\u0027),"}],"source_content_type":"text/x-python","patch_set":16,"id":"bacf61ea_149e4a56","line":48,"updated":"2016-07-27 21:22:13.000000000","message":"noqa seems weird here (and below), why is that needed?","commit_id":"34f5f911abc807f60c1808eda0388a06a59dc1f4"},{"author":{"_account_id":10343,"name":"Jim Rollenhagen","email":"jim@jimrollenhagen.com","username":"jimrollenhagen"},"change_message_id":"b2cdae8b58c92703a6d4d8b95136f091a1c89e14","unresolved":false,"context_lines":[{"line_number":156,"context_line":"                       description\u003d\u0027Access vendor-specific Driver functions\u0027),"},{"line_number":157,"context_line":"    policy.RuleDefault(\u0027baremetal:node:dib_pass_deploy_info\u0027,"},{"line_number":158,"context_line":"                       \u0027rule:public_api\u0027,"},{"line_number":159,"context_line":"                       description\u003d\u0027Access legacy bash ramdisk functions\u0027),"},{"line_number":160,"context_line":"    policy.RuleDefault(\u0027baremetal:node:ipa_heartbeat\u0027,"},{"line_number":161,"context_line":"                       \u0027rule:public_api\u0027,"},{"line_number":162,"context_line":"                       description\u003d\u0027Send heartbeats from IPA ramdisk\u0027),"}],"source_content_type":"text/x-python","patch_set":16,"id":"bacf61ea_f403b674","line":159,"updated":"2016-07-27 21:22:13.000000000","message":"Can drop this too along with the check for it I mentioned earlier.","commit_id":"34f5f911abc807f60c1808eda0388a06a59dc1f4"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"2b12a4f670410eba89b82b7deead32062cdc1c08","unresolved":false,"context_lines":[{"line_number":156,"context_line":"                       description\u003d\u0027Access vendor-specific Driver functions\u0027),"},{"line_number":157,"context_line":"    policy.RuleDefault(\u0027baremetal:node:dib_pass_deploy_info\u0027,"},{"line_number":158,"context_line":"                       \u0027rule:public_api\u0027,"},{"line_number":159,"context_line":"                       description\u003d\u0027Access legacy bash ramdisk functions\u0027),"},{"line_number":160,"context_line":"    policy.RuleDefault(\u0027baremetal:node:ipa_heartbeat\u0027,"},{"line_number":161,"context_line":"                       \u0027rule:public_api\u0027,"},{"line_number":162,"context_line":"                       description\u003d\u0027Send heartbeats from IPA ramdisk\u0027),"}],"source_content_type":"text/x-python","patch_set":16,"id":"bacf61ea_8ddcbee5","line":159,"updated":"2016-07-28 17:00:07.000000000","message":"done","commit_id":"34f5f911abc807f60c1808eda0388a06a59dc1f4"},{"author":{"_account_id":10697,"name":"Thiago Paiva Brito","email":"thiagop@lsd.ufcg.edu.br","username":"thiagop","inactive":true},"change_message_id":"6959f31796edffd498be9d7107b045f9f65d61d1","unresolved":false,"context_lines":[{"line_number":245,"context_line":"    except policy.PolicyNotAuthorized:"},{"line_number":246,"context_line":"        raise exception.HTTPForbidden(resource\u003drule)"},{"line_number":247,"context_line":""},{"line_number":248,"context_line":""},{"line_number":249,"context_line":"def check(rule, target, creds, *args, **kwargs):"},{"line_number":250,"context_line":"    \"\"\"A shortcut for policy.Enforcer.enforce()"},{"line_number":251,"context_line":""},{"line_number":252,"context_line":"    Checks authorization of a rule against the target and credentials"},{"line_number":253,"context_line":"    and returns True or False."},{"line_number":254,"context_line":"    \"\"\""},{"line_number":255,"context_line":"    enforcer \u003d get_enforcer()"},{"line_number":256,"context_line":"    return enforcer.enforce(rule, target, creds, *args, **kwargs)"},{"line_number":257,"context_line":""},{"line_number":258,"context_line":""},{"line_number":259,"context_line":"def enforce(rule, target, creds, do_raise\u003dFalse, exc\u003dNone, *args, **kwargs):"},{"line_number":260,"context_line":"    \"\"\"A shortcut for policy.Enforcer.enforce()"},{"line_number":261,"context_line":""},{"line_number":262,"context_line":"    Checks authorization of a rule against the target and credentials."},{"line_number":263,"context_line":"    Always returns true if CONF.auth_strategy \u003d\u003d noath."}],"source_content_type":"text/x-python","patch_set":16,"id":"dada55a8_dc0f6ddf","line":260,"range":{"start_line":248,"start_character":0,"end_line":260,"end_character":47},"updated":"2016-07-25 15:51:40.000000000","message":"We have two shortcuts here? Can we stick to only one of them so users don\u0027t get confused? If you want to stick to this design, you can only \"privatize\" enforce().","commit_id":"34f5f911abc807f60c1808eda0388a06a59dc1f4"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"e520bcfcd0e54261c7746a12cebbaf703337b0b2","unresolved":false,"context_lines":[{"line_number":245,"context_line":"    except policy.PolicyNotAuthorized:"},{"line_number":246,"context_line":"        raise exception.HTTPForbidden(resource\u003drule)"},{"line_number":247,"context_line":""},{"line_number":248,"context_line":""},{"line_number":249,"context_line":"def check(rule, target, creds, *args, **kwargs):"},{"line_number":250,"context_line":"    \"\"\"A shortcut for policy.Enforcer.enforce()"},{"line_number":251,"context_line":""},{"line_number":252,"context_line":"    Checks authorization of a rule against the target and credentials"},{"line_number":253,"context_line":"    and returns True or False."},{"line_number":254,"context_line":"    \"\"\""},{"line_number":255,"context_line":"    enforcer \u003d get_enforcer()"},{"line_number":256,"context_line":"    return enforcer.enforce(rule, target, creds, *args, **kwargs)"},{"line_number":257,"context_line":""},{"line_number":258,"context_line":""},{"line_number":259,"context_line":"def enforce(rule, target, creds, do_raise\u003dFalse, exc\u003dNone, *args, **kwargs):"},{"line_number":260,"context_line":"    \"\"\"A shortcut for policy.Enforcer.enforce()"},{"line_number":261,"context_line":""},{"line_number":262,"context_line":"    Checks authorization of a rule against the target and credentials."},{"line_number":263,"context_line":"    Always returns true if CONF.auth_strategy \u003d\u003d noath."}],"source_content_type":"text/x-python","patch_set":16,"id":"dada55a8_827c6cec","line":260,"range":{"start_line":248,"start_character":0,"end_line":260,"end_character":47},"in_reply_to":"dada55a8_dc0f6ddf","updated":"2016-07-25 17:57:45.000000000","message":"I want to remove it in the next cycle, so I have added a deprecation warning to the method.  But I can\u0027t remove or rename enforce() right now - I consider it part of an undocumented API (because it\u0027s in ironic/common) that anyone downstream may have used in their drivers.\n\nThat is why there are two shortcuts now, rather than one.","commit_id":"34f5f911abc807f60c1808eda0388a06a59dc1f4"},{"author":{"_account_id":14525,"name":"Vasyl Saienko","email":"vsaienko@mirantis.com","username":"vsaienko"},"change_message_id":"1f99f39f1855df6367f52e48daf040556ec432fe","unresolved":false,"context_lines":[{"line_number":33,"context_line":"    # This gets rolled into the new \"is_admin\" rule below."},{"line_number":34,"context_line":"    policy.RuleDefault(\u0027admin_api\u0027,"},{"line_number":35,"context_line":"                       \u0027role:admin or role:administrator\u0027,"},{"line_number":36,"context_line":"                       description\u003d\u0027Legacy rule for cloud admin access\u0027),"},{"line_number":37,"context_line":"    # is_public_api is set in the environment from AuthTokenMiddleware"},{"line_number":38,"context_line":"    policy.RuleDefault(\u0027public_api\u0027,"},{"line_number":39,"context_line":"                       \u0027is_public_api:True\u0027,"}],"source_content_type":"text/x-python","patch_set":20,"id":"bacf61ea_802418c5","line":36,"updated":"2016-08-01 08:10:57.000000000","message":"Not sure if we should add a dot at the end of description.","commit_id":"5f3d506471a997031089255516b23b0357fcaeef"},{"author":{"_account_id":12356,"name":"Vladyslav Drok","email":"vdrok@mirantis.com","username":"vdrok"},"change_message_id":"a47d8a6d1b9b189e32af3879cf2218190f37579c","unresolved":false,"context_lines":[{"line_number":83,"context_line":"                       description\u003d\u0027Request active validation of Nodes\u0027),"},{"line_number":84,"context_line":"    policy.RuleDefault(\u0027baremetal:node:maintenance\u0027,"},{"line_number":85,"context_line":"                       \u0027rule:is_admin\u0027,"},{"line_number":86,"context_line":"                       description\u003d\u0027Create Node records\u0027),"},{"line_number":87,"context_line":"    policy.RuleDefault(\u0027baremetal:node:set_boot_device\u0027,"},{"line_number":88,"context_line":"                       \u0027rule:is_admin\u0027,"},{"line_number":89,"context_line":"                       description\u003d\u0027Change Node Boot device\u0027),"}],"source_content_type":"text/x-python","patch_set":20,"id":"bacf61ea_86638641","line":86,"updated":"2016-08-01 12:11:51.000000000","message":"Incorrect description :) Also I see Jay\u0027s comment regarding two separate rules for setting and deleting maintenance, was it decided to leave it as is?","commit_id":"5f3d506471a997031089255516b23b0357fcaeef"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"9b8b4c16579ccb0f57763839c22bfc9c631ca209","unresolved":false,"context_lines":[{"line_number":83,"context_line":"                       description\u003d\u0027Request active validation of Nodes\u0027),"},{"line_number":84,"context_line":"    policy.RuleDefault(\u0027baremetal:node:maintenance\u0027,"},{"line_number":85,"context_line":"                       \u0027rule:is_admin\u0027,"},{"line_number":86,"context_line":"                       description\u003d\u0027Create Node records\u0027),"},{"line_number":87,"context_line":"    policy.RuleDefault(\u0027baremetal:node:set_boot_device\u0027,"},{"line_number":88,"context_line":"                       \u0027rule:is_admin\u0027,"},{"line_number":89,"context_line":"                       description\u003d\u0027Change Node Boot device\u0027),"}],"source_content_type":"text/x-python","patch_set":20,"id":"bacf61ea_81c99eae","line":86,"in_reply_to":"bacf61ea_86638641","updated":"2016-08-01 16:54:44.000000000","message":"Done","commit_id":"5f3d506471a997031089255516b23b0357fcaeef"},{"author":{"_account_id":14525,"name":"Vasyl Saienko","email":"vsaienko@mirantis.com","username":"vsaienko"},"change_message_id":"1f99f39f1855df6367f52e48daf040556ec432fe","unresolved":false,"context_lines":[{"line_number":95,"context_line":"                       description\u003d\u0027Change Node Provision Status\u0027),"},{"line_number":96,"context_line":"    policy.RuleDefault(\u0027baremetal:node:set_raid_state\u0027,"},{"line_number":97,"context_line":"                       \u0027rule:is_admin\u0027,"},{"line_number":98,"context_line":"                       description\u003d\u0027Change Node RAID status\u0027),"},{"line_number":99,"context_line":"    policy.RuleDefault(\u0027baremetal:node:get_console\u0027,"},{"line_number":100,"context_line":"                       \u0027rule:is_admin\u0027,"},{"line_number":101,"context_line":"                       description\u003d\u0027Get Node Console connection information\u0027),"}],"source_content_type":"text/x-python","patch_set":20,"id":"bacf61ea_bb8b4d67","line":98,"updated":"2016-08-01 08:10:57.000000000","message":"s/status/Status to be consistent with L95 and L92","commit_id":"5f3d506471a997031089255516b23b0357fcaeef"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"9b8b4c16579ccb0f57763839c22bfc9c631ca209","unresolved":false,"context_lines":[{"line_number":95,"context_line":"                       description\u003d\u0027Change Node Provision Status\u0027),"},{"line_number":96,"context_line":"    policy.RuleDefault(\u0027baremetal:node:set_raid_state\u0027,"},{"line_number":97,"context_line":"                       \u0027rule:is_admin\u0027,"},{"line_number":98,"context_line":"                       description\u003d\u0027Change Node RAID status\u0027),"},{"line_number":99,"context_line":"    policy.RuleDefault(\u0027baremetal:node:get_console\u0027,"},{"line_number":100,"context_line":"                       \u0027rule:is_admin\u0027,"},{"line_number":101,"context_line":"                       description\u003d\u0027Get Node Console connection information\u0027),"}],"source_content_type":"text/x-python","patch_set":20,"id":"bacf61ea_e1e17a2b","line":98,"in_reply_to":"bacf61ea_bb8b4d67","updated":"2016-08-01 16:54:44.000000000","message":"Done","commit_id":"5f3d506471a997031089255516b23b0357fcaeef"},{"author":{"_account_id":14525,"name":"Vasyl Saienko","email":"vsaienko@mirantis.com","username":"vsaienko"},"change_message_id":"1f99f39f1855df6367f52e48daf040556ec432fe","unresolved":false,"context_lines":[{"line_number":97,"context_line":"                       \u0027rule:is_admin\u0027,"},{"line_number":98,"context_line":"                       description\u003d\u0027Change Node RAID status\u0027),"},{"line_number":99,"context_line":"    policy.RuleDefault(\u0027baremetal:node:get_console\u0027,"},{"line_number":100,"context_line":"                       \u0027rule:is_admin\u0027,"},{"line_number":101,"context_line":"                       description\u003d\u0027Get Node Console connection information\u0027),"},{"line_number":102,"context_line":"    policy.RuleDefault(\u0027baremetal:node:set_console_state\u0027,"},{"line_number":103,"context_line":"                       \u0027rule:is_admin\u0027,"}],"source_content_type":"text/x-python","patch_set":20,"id":"bacf61ea_5b7a1178","line":100,"updated":"2016-08-01 08:10:57.000000000","message":"should this be available for observer by default also?","commit_id":"5f3d506471a997031089255516b23b0357fcaeef"},{"author":{"_account_id":12356,"name":"Vladyslav Drok","email":"vdrok@mirantis.com","username":"vdrok"},"change_message_id":"a47d8a6d1b9b189e32af3879cf2218190f37579c","unresolved":false,"context_lines":[{"line_number":97,"context_line":"                       \u0027rule:is_admin\u0027,"},{"line_number":98,"context_line":"                       description\u003d\u0027Change Node RAID status\u0027),"},{"line_number":99,"context_line":"    policy.RuleDefault(\u0027baremetal:node:get_console\u0027,"},{"line_number":100,"context_line":"                       \u0027rule:is_admin\u0027,"},{"line_number":101,"context_line":"                       description\u003d\u0027Get Node Console connection information\u0027),"},{"line_number":102,"context_line":"    policy.RuleDefault(\u0027baremetal:node:set_console_state\u0027,"},{"line_number":103,"context_line":"                       \u0027rule:is_admin\u0027,"}],"source_content_type":"text/x-python","patch_set":20,"id":"bacf61ea_a66faafa","line":100,"in_reply_to":"bacf61ea_5b7a1178","updated":"2016-08-01 12:11:51.000000000","message":"++ seems logical","commit_id":"5f3d506471a997031089255516b23b0357fcaeef"},{"author":{"_account_id":12356,"name":"Vladyslav Drok","email":"vdrok@mirantis.com","username":"vdrok"},"change_message_id":"76bc8009d6bb12ed4fedcf3a0118d460c61163d9","unresolved":false,"context_lines":[{"line_number":97,"context_line":"                       \u0027rule:is_admin\u0027,"},{"line_number":98,"context_line":"                       description\u003d\u0027Change Node RAID status\u0027),"},{"line_number":99,"context_line":"    policy.RuleDefault(\u0027baremetal:node:get_console\u0027,"},{"line_number":100,"context_line":"                       \u0027rule:is_admin\u0027,"},{"line_number":101,"context_line":"                       description\u003d\u0027Get Node Console connection information\u0027),"},{"line_number":102,"context_line":"    policy.RuleDefault(\u0027baremetal:node:set_console_state\u0027,"},{"line_number":103,"context_line":"                       \u0027rule:is_admin\u0027,"}],"source_content_type":"text/x-python","patch_set":20,"id":"bacf61ea_ecc21152","line":100,"in_reply_to":"bacf61ea_a1db027b","updated":"2016-08-01 17:07:31.000000000","message":"Hm, I thought it just returns url? Which consists of the console port that is visible in driver_info and conductor ip.","commit_id":"5f3d506471a997031089255516b23b0357fcaeef"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"9b8b4c16579ccb0f57763839c22bfc9c631ca209","unresolved":false,"context_lines":[{"line_number":97,"context_line":"                       \u0027rule:is_admin\u0027,"},{"line_number":98,"context_line":"                       description\u003d\u0027Change Node RAID status\u0027),"},{"line_number":99,"context_line":"    policy.RuleDefault(\u0027baremetal:node:get_console\u0027,"},{"line_number":100,"context_line":"                       \u0027rule:is_admin\u0027,"},{"line_number":101,"context_line":"                       description\u003d\u0027Get Node Console connection information\u0027),"},{"line_number":102,"context_line":"    policy.RuleDefault(\u0027baremetal:node:set_console_state\u0027,"},{"line_number":103,"context_line":"                       \u0027rule:is_admin\u0027,"}],"source_content_type":"text/x-python","patch_set":20,"id":"bacf61ea_a1db027b","line":100,"in_reply_to":"bacf61ea_a66faafa","updated":"2016-08-01 16:54:44.000000000","message":"no, I do not believe it should be.\n\nget_console returns the access credentials for the console -- iow, the response to this call gives someone admin access to the machine.","commit_id":"5f3d506471a997031089255516b23b0357fcaeef"},{"author":{"_account_id":12356,"name":"Vladyslav Drok","email":"vdrok@mirantis.com","username":"vdrok"},"change_message_id":"a47d8a6d1b9b189e32af3879cf2218190f37579c","unresolved":false,"context_lines":[{"line_number":201,"context_line":"    # loaded exactly once - when this module-global is initialized."},{"line_number":202,"context_line":"    # Defining these in the relevant API modules won\u0027t work"},{"line_number":203,"context_line":"    # because API classes lack singletons and don\u0027t use globals."},{"line_number":204,"context_line":"    _ENFORCER.register_defaults(default_policies)"},{"line_number":205,"context_line":"    _ENFORCER.register_defaults(node_policies)"},{"line_number":206,"context_line":"    _ENFORCER.register_defaults(port_policies)"},{"line_number":207,"context_line":"    _ENFORCER.register_defaults(chassis_policies)"}],"source_content_type":"text/x-python","patch_set":20,"id":"bacf61ea_432060f7","line":204,"range":{"start_line":204,"start_character":32,"end_line":204,"end_character":48},"updated":"2016-08-01 12:11:51.000000000","message":"Why not just list_policies()?","commit_id":"5f3d506471a997031089255516b23b0357fcaeef"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"9b8b4c16579ccb0f57763839c22bfc9c631ca209","unresolved":false,"context_lines":[{"line_number":201,"context_line":"    # loaded exactly once - when this module-global is initialized."},{"line_number":202,"context_line":"    # Defining these in the relevant API modules won\u0027t work"},{"line_number":203,"context_line":"    # because API classes lack singletons and don\u0027t use globals."},{"line_number":204,"context_line":"    _ENFORCER.register_defaults(default_policies)"},{"line_number":205,"context_line":"    _ENFORCER.register_defaults(node_policies)"},{"line_number":206,"context_line":"    _ENFORCER.register_defaults(port_policies)"},{"line_number":207,"context_line":"    _ENFORCER.register_defaults(chassis_policies)"}],"source_content_type":"text/x-python","patch_set":20,"id":"bacf61ea_21c272e9","line":204,"range":{"start_line":204,"start_character":32,"end_line":204,"end_character":48},"in_reply_to":"bacf61ea_432060f7","updated":"2016-08-01 16:54:44.000000000","message":"Done","commit_id":"5f3d506471a997031089255516b23b0357fcaeef"},{"author":{"_account_id":12356,"name":"Vladyslav Drok","email":"vdrok@mirantis.com","username":"vdrok"},"change_message_id":"a47d8a6d1b9b189e32af3879cf2218190f37579c","unresolved":false,"context_lines":[{"line_number":229,"context_line":""},{"line_number":230,"context_line":"    Checks authorization of a rule against the target and credentials, and"},{"line_number":231,"context_line":"    raises an exception if the rule is not defined."},{"line_number":232,"context_line":"    Always returns true if CONF.auth_strategy \u003d\u003d noath."},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"    Beginning with the Newton cycle, this should be used in place of \u0027enforce\u0027."},{"line_number":235,"context_line":"    \"\"\""}],"source_content_type":"text/x-python","patch_set":20,"id":"bacf61ea_6331245a","line":232,"range":{"start_line":232,"start_character":49,"end_line":232,"end_character":54},"updated":"2016-08-01 12:11:51.000000000","message":"noauth","commit_id":"5f3d506471a997031089255516b23b0357fcaeef"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"9b8b4c16579ccb0f57763839c22bfc9c631ca209","unresolved":false,"context_lines":[{"line_number":229,"context_line":""},{"line_number":230,"context_line":"    Checks authorization of a rule against the target and credentials, and"},{"line_number":231,"context_line":"    raises an exception if the rule is not defined."},{"line_number":232,"context_line":"    Always returns true if CONF.auth_strategy \u003d\u003d noath."},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"    Beginning with the Newton cycle, this should be used in place of \u0027enforce\u0027."},{"line_number":235,"context_line":"    \"\"\""}],"source_content_type":"text/x-python","patch_set":20,"id":"bacf61ea_01200ef6","line":232,"range":{"start_line":232,"start_character":49,"end_line":232,"end_character":54},"in_reply_to":"bacf61ea_6331245a","updated":"2016-08-01 16:54:44.000000000","message":"Done","commit_id":"5f3d506471a997031089255516b23b0357fcaeef"},{"author":{"_account_id":12356,"name":"Vladyslav Drok","email":"vdrok@mirantis.com","username":"vdrok"},"change_message_id":"a47d8a6d1b9b189e32af3879cf2218190f37579c","unresolved":false,"context_lines":[{"line_number":257,"context_line":"    \"\"\"A shortcut for policy.Enforcer.enforce()"},{"line_number":258,"context_line":""},{"line_number":259,"context_line":"    Checks authorization of a rule against the target and credentials."},{"line_number":260,"context_line":"    Always returns true if CONF.auth_strategy \u003d\u003d noath."},{"line_number":261,"context_line":""},{"line_number":262,"context_line":"    \"\"\""},{"line_number":263,"context_line":"    # NOTE(deva): this method is obsoleted by authorize(), but retained for"}],"source_content_type":"text/x-python","patch_set":20,"id":"bacf61ea_e35cf44c","line":260,"range":{"start_line":260,"start_character":49,"end_line":260,"end_character":54},"updated":"2016-08-01 12:11:51.000000000","message":"noauth","commit_id":"5f3d506471a997031089255516b23b0357fcaeef"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"9b8b4c16579ccb0f57763839c22bfc9c631ca209","unresolved":false,"context_lines":[{"line_number":257,"context_line":"    \"\"\"A shortcut for policy.Enforcer.enforce()"},{"line_number":258,"context_line":""},{"line_number":259,"context_line":"    Checks authorization of a rule against the target and credentials."},{"line_number":260,"context_line":"    Always returns true if CONF.auth_strategy \u003d\u003d noath."},{"line_number":261,"context_line":""},{"line_number":262,"context_line":"    \"\"\""},{"line_number":263,"context_line":"    # NOTE(deva): this method is obsoleted by authorize(), but retained for"}],"source_content_type":"text/x-python","patch_set":20,"id":"bacf61ea_e11a1ac5","line":260,"range":{"start_line":260,"start_character":49,"end_line":260,"end_character":54},"in_reply_to":"bacf61ea_e35cf44c","updated":"2016-08-01 16:54:44.000000000","message":"Done","commit_id":"5f3d506471a997031089255516b23b0357fcaeef"},{"author":{"_account_id":14525,"name":"Vasyl Saienko","email":"vsaienko@mirantis.com","username":"vsaienko"},"change_message_id":"c8added86a01383580404dad2e74c10c414e6ab1","unresolved":false,"context_lines":[{"line_number":86,"context_line":"                       description\u003d\u0027Set maintenance flag, taking a Node \u0027"},{"line_number":87,"context_line":"                                   \u0027out of service\u0027),"},{"line_number":88,"context_line":"    policy.RuleDefault(\u0027baremetal:node:clear_maintenance\u0027,"},{"line_number":89,"context_line":"                       \u0027role:is_admin\u0027,"},{"line_number":90,"context_line":"                       description\u003d\u0027Clear maintenance flag, placing the Node \u0027"},{"line_number":91,"context_line":"                                   \u0027into service again\u0027),"},{"line_number":92,"context_line":"    policy.RuleDefault(\u0027baremetal:node:set_boot_device\u0027,"}],"source_content_type":"text/x-python","patch_set":21,"id":"bacf61ea_88988879","line":89,"range":{"start_line":89,"start_character":25,"end_line":89,"end_character":26},"updated":"2016-08-02 06:17:23.000000000","message":"s/role/rule","commit_id":"dbd64fe6dad6b8de615d6b5ecb61a50d6b1c6d29"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"ebdc507767a381b1eb743d1d1ddbf1e35671748f","unresolved":false,"context_lines":[{"line_number":40,"context_line":"                       description\u003d\u0027Internal flag for public API routes\u0027),"},{"line_number":41,"context_line":"    # Generic default to hide passwords"},{"line_number":42,"context_line":"    policy.RuleDefault(\u0027show_password\u0027,"},{"line_number":43,"context_line":"                       \u0027!\u0027,"},{"line_number":44,"context_line":"                       description\u003d\u0027Show or mask passwords in API responses\u0027),"},{"line_number":45,"context_line":"    # Roles likely to be overriden by operator"},{"line_number":46,"context_line":"    policy.RuleDefault(\u0027is_member\u0027,"}],"source_content_type":"text/x-python","patch_set":23,"id":"bacf61ea_50fd443a","line":43,"updated":"2016-08-03 12:28:47.000000000","message":"I assume this means \"False\"...","commit_id":"f0ab440b5f55ab5d44dfc6814dc6fb652e31afe5"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"78d59bdd5e5d001a8663c42c4e82921672b551a1","unresolved":false,"context_lines":[{"line_number":40,"context_line":"                       description\u003d\u0027Internal flag for public API routes\u0027),"},{"line_number":41,"context_line":"    # Generic default to hide passwords"},{"line_number":42,"context_line":"    policy.RuleDefault(\u0027show_password\u0027,"},{"line_number":43,"context_line":"                       \u0027!\u0027,"},{"line_number":44,"context_line":"                       description\u003d\u0027Show or mask passwords in API responses\u0027),"},{"line_number":45,"context_line":"    # Roles likely to be overriden by operator"},{"line_number":46,"context_line":"    policy.RuleDefault(\u0027is_member\u0027,"}],"source_content_type":"text/x-python","patch_set":23,"id":"bacf61ea_a5b8b2c8","line":43,"in_reply_to":"bacf61ea_50fd443a","updated":"2016-08-03 18:37:26.000000000","message":"correct.","commit_id":"f0ab440b5f55ab5d44dfc6814dc6fb652e31afe5"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"ebdc507767a381b1eb743d1d1ddbf1e35671748f","unresolved":false,"context_lines":[{"line_number":45,"context_line":"    # Roles likely to be overriden by operator"},{"line_number":46,"context_line":"    policy.RuleDefault(\u0027is_member\u0027,"},{"line_number":47,"context_line":"                       \u0027tenant:demo or tenant:baremetal\u0027,"},{"line_number":48,"context_line":"                       description\u003d\u0027May be used to restrict access to specific tenants\u0027),  # noqa"},{"line_number":49,"context_line":"    policy.RuleDefault(\u0027is_observer\u0027,"},{"line_number":50,"context_line":"                       \u0027rule:is_member and (role:observer or role:baremetal_observer)\u0027,  # noqa"},{"line_number":51,"context_line":"                       description\u003d\u0027Read-only API access\u0027),"}],"source_content_type":"text/x-python","patch_set":23,"id":"bacf61ea_b0fc803f","line":48,"updated":"2016-08-03 12:28:47.000000000","message":"I\u0027d prefer we don\u0027t use \"noqa\" here","commit_id":"f0ab440b5f55ab5d44dfc6814dc6fb652e31afe5"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"78d59bdd5e5d001a8663c42c4e82921672b551a1","unresolved":false,"context_lines":[{"line_number":45,"context_line":"    # Roles likely to be overriden by operator"},{"line_number":46,"context_line":"    policy.RuleDefault(\u0027is_member\u0027,"},{"line_number":47,"context_line":"                       \u0027tenant:demo or tenant:baremetal\u0027,"},{"line_number":48,"context_line":"                       description\u003d\u0027May be used to restrict access to specific tenants\u0027),  # noqa"},{"line_number":49,"context_line":"    policy.RuleDefault(\u0027is_observer\u0027,"},{"line_number":50,"context_line":"                       \u0027rule:is_member and (role:observer or role:baremetal_observer)\u0027,  # noqa"},{"line_number":51,"context_line":"                       description\u003d\u0027Read-only API access\u0027),"}],"source_content_type":"text/x-python","patch_set":23,"id":"bacf61ea_c5dcc61a","line":48,"in_reply_to":"bacf61ea_b0fc803f","updated":"2016-08-03 18:37:26.000000000","message":"why? wrapping this line doesn\u0027t make it more readable IMO.","commit_id":"f0ab440b5f55ab5d44dfc6814dc6fb652e31afe5"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"0f463a47b3a566645e731e4fd1fa941226d7b2b2","unresolved":false,"context_lines":[{"line_number":45,"context_line":"    # Roles likely to be overriden by operator"},{"line_number":46,"context_line":"    policy.RuleDefault(\u0027is_member\u0027,"},{"line_number":47,"context_line":"                       \u0027tenant:demo or tenant:baremetal\u0027,"},{"line_number":48,"context_line":"                       description\u003d\u0027May be used to restrict access to specific tenants\u0027),  # noqa"},{"line_number":49,"context_line":"    policy.RuleDefault(\u0027is_observer\u0027,"},{"line_number":50,"context_line":"                       \u0027rule:is_member and (role:observer or role:baremetal_observer)\u0027,  # noqa"},{"line_number":51,"context_line":"                       description\u003d\u0027Read-only API access\u0027),"}],"source_content_type":"text/x-python","patch_set":23,"id":"bacf61ea_9c4ce39e","line":48,"in_reply_to":"bacf61ea_c5dcc61a","updated":"2016-08-03 18:41:32.000000000","message":"It makes life harder for everyone dealing with hard wrapping, e.g. gertty users.","commit_id":"f0ab440b5f55ab5d44dfc6814dc6fb652e31afe5"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"ebdc507767a381b1eb743d1d1ddbf1e35671748f","unresolved":false,"context_lines":[{"line_number":47,"context_line":"                       \u0027tenant:demo or tenant:baremetal\u0027,"},{"line_number":48,"context_line":"                       description\u003d\u0027May be used to restrict access to specific tenants\u0027),  # noqa"},{"line_number":49,"context_line":"    policy.RuleDefault(\u0027is_observer\u0027,"},{"line_number":50,"context_line":"                       \u0027rule:is_member and (role:observer or role:baremetal_observer)\u0027,  # noqa"},{"line_number":51,"context_line":"                       description\u003d\u0027Read-only API access\u0027),"},{"line_number":52,"context_line":"    policy.RuleDefault(\u0027is_admin\u0027,"},{"line_number":53,"context_line":"                       \u0027rule:admin_api or (rule:is_member and role:baremetal_admin)\u0027,  # noqa"}],"source_content_type":"text/x-python","patch_set":23,"id":"bacf61ea_90f7bc58","line":50,"updated":"2016-08-03 12:28:47.000000000","message":"ditto","commit_id":"f0ab440b5f55ab5d44dfc6814dc6fb652e31afe5"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"ebdc507767a381b1eb743d1d1ddbf1e35671748f","unresolved":false,"context_lines":[{"line_number":50,"context_line":"                       \u0027rule:is_member and (role:observer or role:baremetal_observer)\u0027,  # noqa"},{"line_number":51,"context_line":"                       description\u003d\u0027Read-only API access\u0027),"},{"line_number":52,"context_line":"    policy.RuleDefault(\u0027is_admin\u0027,"},{"line_number":53,"context_line":"                       \u0027rule:admin_api or (rule:is_member and role:baremetal_admin)\u0027,  # noqa"},{"line_number":54,"context_line":"                       description\u003d\u0027Full read/write API access\u0027),"},{"line_number":55,"context_line":"]"},{"line_number":56,"context_line":""}],"source_content_type":"text/x-python","patch_set":23,"id":"bacf61ea_f09438e9","line":53,"updated":"2016-08-03 12:28:47.000000000","message":"ditto","commit_id":"f0ab440b5f55ab5d44dfc6814dc6fb652e31afe5"}],"ironic/tests/unit/api/base.py":[{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"ebdc507767a381b1eb743d1d1ddbf1e35671748f","unresolved":false,"context_lines":[{"line_number":45,"context_line":""},{"line_number":46,"context_line":"    def setUp(self):"},{"line_number":47,"context_line":"        super(BaseApiTest, self).setUp()"},{"line_number":48,"context_line":"        cfg.CONF.set_override(\"auth_version\", \"v3\","},{"line_number":49,"context_line":"                              group\u003d\u0027keystone_authtoken\u0027)"},{"line_number":50,"context_line":"        cfg.CONF.set_override(\"admin_user\", \"admin\","},{"line_number":51,"context_line":"                              group\u003d\u0027keystone_authtoken\u0027)"}],"source_content_type":"text/x-python","patch_set":23,"id":"bacf61ea_70020840","line":48,"updated":"2016-08-03 12:28:47.000000000","message":"note that we don\u0027t fully support keystone v3, so this change is a bit unrealistic","commit_id":"f0ab440b5f55ab5d44dfc6814dc6fb652e31afe5"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"0f463a47b3a566645e731e4fd1fa941226d7b2b2","unresolved":false,"context_lines":[{"line_number":45,"context_line":""},{"line_number":46,"context_line":"    def setUp(self):"},{"line_number":47,"context_line":"        super(BaseApiTest, self).setUp()"},{"line_number":48,"context_line":"        cfg.CONF.set_override(\"auth_version\", \"v3\","},{"line_number":49,"context_line":"                              group\u003d\u0027keystone_authtoken\u0027)"},{"line_number":50,"context_line":"        cfg.CONF.set_override(\"admin_user\", \"admin\","},{"line_number":51,"context_line":"                              group\u003d\u0027keystone_authtoken\u0027)"}],"source_content_type":"text/x-python","patch_set":23,"id":"bacf61ea_bc30c708","line":48,"in_reply_to":"bacf61ea_05fede6a","updated":"2016-08-03 18:41:32.000000000","message":"Well, I\u0027ve got reports that the way we invoke neutronclient is incompatible with keystone v3 and that the only way to fix it is pas-ha\u0027s patch to move to sessions.. Can undig the bug if you\u0027re interested.","commit_id":"f0ab440b5f55ab5d44dfc6814dc6fb652e31afe5"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"78d59bdd5e5d001a8663c42c4e82921672b551a1","unresolved":false,"context_lines":[{"line_number":45,"context_line":""},{"line_number":46,"context_line":"    def setUp(self):"},{"line_number":47,"context_line":"        super(BaseApiTest, self).setUp()"},{"line_number":48,"context_line":"        cfg.CONF.set_override(\"auth_version\", \"v3\","},{"line_number":49,"context_line":"                              group\u003d\u0027keystone_authtoken\u0027)"},{"line_number":50,"context_line":"        cfg.CONF.set_override(\"admin_user\", \"admin\","},{"line_number":51,"context_line":"                              group\u003d\u0027keystone_authtoken\u0027)"}],"source_content_type":"text/x-python","patch_set":23,"id":"bacf61ea_05fede6a","line":48,"in_reply_to":"bacf61ea_70020840","updated":"2016-08-03 18:37:26.000000000","message":"in what way do we not support v3?\n\nI\u0027ve been testing this patch locally with v3 without any problems.","commit_id":"f0ab440b5f55ab5d44dfc6814dc6fb652e31afe5"}],"ironic/tests/unit/api/test_hooks.py":[{"author":{"_account_id":10343,"name":"Jim Rollenhagen","email":"jim@jimrollenhagen.com","username":"jimrollenhagen"},"change_message_id":"b2cdae8b58c92703a6d4d8b95136f091a1c89e14","unresolved":false,"context_lines":[{"line_number":215,"context_line":"class TestContextHook(base.BaseApiTest):"},{"line_number":216,"context_line":"    @mock.patch.object(context, \u0027RequestContext\u0027)"},{"line_number":217,"context_line":"    def test_context_hook_not_admin(self, mock_ctx):"},{"line_number":218,"context_line":"        cfg.CONF.set_override(\u0027auth_strategy\u0027, \u0027keystone\u0027)"},{"line_number":219,"context_line":"        headers \u003d fake_headers(admin\u003dFalse)"},{"line_number":220,"context_line":"        reqstate \u003d FakeRequestState(headers\u003dheaders)"},{"line_number":221,"context_line":"        context_hook \u003d hooks.ContextHook(None)"}],"source_content_type":"text/x-python","patch_set":16,"id":"bacf61ea_548602ba","line":218,"updated":"2016-07-27 21:22:13.000000000","message":"Might be worth refactoring out the tests that use keystone and doing this in setUp(), but no big deal","commit_id":"34f5f911abc807f60c1808eda0388a06a59dc1f4"}],"ironic/tests/unit/common/test_policy.py":[{"author":{"_account_id":10343,"name":"Jim Rollenhagen","email":"jim@jimrollenhagen.com","username":"jimrollenhagen"},"change_message_id":"b2cdae8b58c92703a6d4d8b95136f091a1c89e14","unresolved":false,"context_lines":[{"line_number":98,"context_line":"    def test_authorize_policy_not_registered(self):"},{"line_number":99,"context_line":"        creds \u003d {\u0027roles\u0027: [\u0027foo\u0027]}"},{"line_number":100,"context_line":"        self.assertRaises("},{"line_number":101,"context_line":"            oslo_policy.PolicyNotRegistered,"},{"line_number":102,"context_line":"            policy.authorize, \u0027has_bar_role\u0027, creds, creds)"},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"    def test_enforce_existing_rule_passes(self):"}],"source_content_type":"text/x-python","patch_set":16,"id":"bacf61ea_547442ce","line":101,"updated":"2016-07-27 21:22:13.000000000","message":"Hm, do we want to wrap that exception somehow? I guess we\u0027ll only see it in a programming error situation, so it\u0027s probably fine.","commit_id":"34f5f911abc807f60c1808eda0388a06a59dc1f4"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"2b12a4f670410eba89b82b7deead32062cdc1c08","unresolved":false,"context_lines":[{"line_number":98,"context_line":"    def test_authorize_policy_not_registered(self):"},{"line_number":99,"context_line":"        creds \u003d {\u0027roles\u0027: [\u0027foo\u0027]}"},{"line_number":100,"context_line":"        self.assertRaises("},{"line_number":101,"context_line":"            oslo_policy.PolicyNotRegistered,"},{"line_number":102,"context_line":"            policy.authorize, \u0027has_bar_role\u0027, creds, creds)"},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"    def test_enforce_existing_rule_passes(self):"}],"source_content_type":"text/x-python","patch_set":16,"id":"bacf61ea_6dfeaa39","line":101,"updated":"2016-07-28 17:00:07.000000000","message":"yea - it should be a service failure that we catch in testing, and anything raising this should never land ... so I don\u0027t want to wrap it.","commit_id":"34f5f911abc807f60c1808eda0388a06a59dc1f4"}],"releasenotes/notes/implement-policy-in-code-cbb0216ef5f8224f.yaml":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"e05741d3d79172aa9d70928e1c944e3e525b3b64","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":14,"id":"dada55a8_8c229050","line":13,"updated":"2016-07-21 00:06:48.000000000","message":"Can you add a note about the known issue that Ironic can\u0027t run solely with the service admin yet?","commit_id":"2ed1743f13145345f41448d4d625f11a43f98e59"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"7f99f25ebe231638b701788dc4ae31ee20736751","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":14,"id":"dada55a8_2e0b617e","line":13,"in_reply_to":"dada55a8_8c229050","updated":"2016-07-21 21:15:10.000000000","message":"actually, I\u0027m not changing anything related to the service user now, so I don\u0027t think it needs to be mentioned in the release note","commit_id":"2ed1743f13145345f41448d4d625f11a43f98e59"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"2b12a4f670410eba89b82b7deead32062cdc1c08","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"features:"},{"line_number":3,"context_line":"  - RESTful access to every API resources may now be controlled by adjusting"},{"line_number":4,"context_line":"    policy settings. Defaults are set in code, and remain backwards compatible"},{"line_number":5,"context_line":"    with the previously-included policy.json file.  Two new roles are checked"},{"line_number":6,"context_line":"    by default, \"baremetal_admin\" and \"baremetal_observer\", though these may be"}],"source_content_type":"text/x-yaml","patch_set":16,"id":"bacf61ea_8d031e42","line":3,"updated":"2016-07-28 17:00:07.000000000","message":"done","commit_id":"34f5f911abc807f60c1808eda0388a06a59dc1f4"},{"author":{"_account_id":10343,"name":"Jim Rollenhagen","email":"jim@jimrollenhagen.com","username":"jimrollenhagen"},"change_message_id":"b2cdae8b58c92703a6d4d8b95136f091a1c89e14","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"features:"},{"line_number":3,"context_line":"  - RESTful access to every API resources may now be controlled by adjusting"},{"line_number":4,"context_line":"    policy settings. Defaults are set in code, and remain backwards compatible"},{"line_number":5,"context_line":"    with the previously-included policy.json file.  Two new roles are checked"},{"line_number":6,"context_line":"    by default, \"baremetal_admin\" and \"baremetal_observer\", though these may be"}],"source_content_type":"text/x-yaml","patch_set":16,"id":"bacf61ea_b42f7ea0","line":3,"updated":"2016-07-27 21:22:13.000000000","message":"nit: s/resources/resource/","commit_id":"34f5f911abc807f60c1808eda0388a06a59dc1f4"},{"author":{"_account_id":10343,"name":"Jim Rollenhagen","email":"jim@jimrollenhagen.com","username":"jimrollenhagen"},"change_message_id":"b2cdae8b58c92703a6d4d8b95136f091a1c89e14","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":16,"id":"bacf61ea_cf037f0c","line":13,"updated":"2016-07-27 21:22:13.000000000","message":"Should we add an upgrade: stanza for operators to review their policy? It isn\u0027t strictly necessary, but I would argue it\u0027s necessary to make sure there\u0027s nobody out there with a baremetal_admin or baremetal_observer role that shouldn\u0027t have ironic access...","commit_id":"34f5f911abc807f60c1808eda0388a06a59dc1f4"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"ff51fda9dcbbedecdecd40041b8102643068f919","unresolved":false,"context_lines":[{"line_number":18,"context_line":"    settings in their /etc/ironic/policy.json file. This file should now be"},{"line_number":19,"context_line":"    used only to override default configuration, such as by limiting access to"},{"line_number":20,"context_line":"    the Bare Metal service to specific tenants or restricting access to"},{"line_number":21,"context_line":"    specific API endpoints. A policy.json.sample file is provided that lists"},{"line_number":22,"context_line":"    all supported policies."}],"source_content_type":"text/x-yaml","patch_set":19,"id":"bacf61ea_df229c51","line":21,"updated":"2016-07-29 18:06:12.000000000","message":".yaml.sample since it\u0027s not valid json?\n\nAlso should we make a note here about needing a policy file at all?","commit_id":"7b2ef3e499c63430c141445f2a9b3726a06bced2"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"a6c3681459349794939b72c0b55620315308d912","unresolved":false,"context_lines":[{"line_number":18,"context_line":"    settings in their /etc/ironic/policy.json file. This file should now be"},{"line_number":19,"context_line":"    used only to override default configuration, such as by limiting access to"},{"line_number":20,"context_line":"    the Bare Metal service to specific tenants or restricting access to"},{"line_number":21,"context_line":"    specific API endpoints. A policy.json.sample file is provided that lists"},{"line_number":22,"context_line":"    all supported policies."}],"source_content_type":"text/x-yaml","patch_set":19,"id":"bacf61ea_ae8178c5","line":21,"updated":"2016-07-29 20:15:56.000000000","message":"yaml file was included by mistake. this correctly says json","commit_id":"7b2ef3e499c63430c141445f2a9b3726a06bced2"}],"tox.ini":[{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"10679f5d5657e9f85c99c8c7770143dab2dc8ea9","unresolved":false,"context_lines":[{"line_number":15,"context_line":"commands \u003d ostestr {posargs}"},{"line_number":16,"context_line":"passenv \u003d http_proxy HTTP_PROXY https_proxy HTTPS_PROXY no_proxy NO_PROXY"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"[testenv:py34]"},{"line_number":19,"context_line":"# NOTE(mriedem): If py34 fails with \"db type could not be determined\", delete"},{"line_number":20,"context_line":"# .testrepository and try again. Running py34 before py27 is OK, but not the"},{"line_number":21,"context_line":"# other way around. See: https://bugs.launchpad.net/testrepository/+bug/1212909"}],"source_content_type":"text/x-properties","patch_set":12,"id":"dada55a8_4ac36b89","line":18,"updated":"2016-07-20 16:53:41.000000000","message":"This is an unrelated change right?","commit_id":"bd5d4272b7f00883f50d8a1fedc1d0cd5a3cda15"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"a6c3681459349794939b72c0b55620315308d912","unresolved":false,"context_lines":[{"line_number":61,"context_line":"[testenv:genpolicy]"},{"line_number":62,"context_line":"sitepackages \u003d False"},{"line_number":63,"context_line":"envdir \u003d {toxworkdir}/venv"},{"line_number":64,"context_line":"commands \u003d "},{"line_number":65,"context_line":"  oslopolicy-sample-generator --namespace\u003dironic.api --output-file\u003detc/ironic/policy.json.sample"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"[testenv:debug]"}],"source_content_type":"text/x-properties","patch_set":19,"id":"bacf61ea_8e8634d9","line":64,"updated":"2016-07-29 20:15:56.000000000","message":"fixed","commit_id":"7b2ef3e499c63430c141445f2a9b3726a06bced2"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"ff51fda9dcbbedecdecd40041b8102643068f919","unresolved":false,"context_lines":[{"line_number":61,"context_line":"[testenv:genpolicy]"},{"line_number":62,"context_line":"sitepackages \u003d False"},{"line_number":63,"context_line":"envdir \u003d {toxworkdir}/venv"},{"line_number":64,"context_line":"commands \u003d "},{"line_number":65,"context_line":"  oslopolicy-sample-generator --namespace\u003dironic.api --output-file\u003detc/ironic/policy.json.sample"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"[testenv:debug]"}],"source_content_type":"text/x-properties","patch_set":19,"id":"bacf61ea_9fdb044f","line":64,"updated":"2016-07-29 18:06:12.000000000","message":"nit: whitespace","commit_id":"7b2ef3e499c63430c141445f2a9b3726a06bced2"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"a6c3681459349794939b72c0b55620315308d912","unresolved":false,"context_lines":[{"line_number":62,"context_line":"sitepackages \u003d False"},{"line_number":63,"context_line":"envdir \u003d {toxworkdir}/venv"},{"line_number":64,"context_line":"commands \u003d "},{"line_number":65,"context_line":"  oslopolicy-sample-generator --namespace\u003dironic.api --output-file\u003detc/ironic/policy.json.sample"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"[testenv:debug]"},{"line_number":68,"context_line":"commands \u003d oslo_debug_helper -t ironic/tests/unit {posargs}"}],"source_content_type":"text/x-properties","patch_set":19,"id":"bacf61ea_ee6ff028","line":65,"updated":"2016-07-29 20:15:56.000000000","message":"nope","commit_id":"7b2ef3e499c63430c141445f2a9b3726a06bced2"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"76702cbec084d7c8848320df3aa9366fcf4182d3","unresolved":false,"context_lines":[{"line_number":62,"context_line":"sitepackages \u003d False"},{"line_number":63,"context_line":"envdir \u003d {toxworkdir}/venv"},{"line_number":64,"context_line":"commands \u003d "},{"line_number":65,"context_line":"  oslopolicy-sample-generator --namespace\u003dironic.api --output-file\u003detc/ironic/policy.json.sample"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"[testenv:debug]"},{"line_number":68,"context_line":"commands \u003d oslo_debug_helper -t ironic/tests/unit {posargs}"}],"source_content_type":"text/x-properties","patch_set":19,"id":"bacf61ea_7fae1099","line":65,"updated":"2016-07-29 18:07:03.000000000","message":"should this be policy.yaml.sample?","commit_id":"7b2ef3e499c63430c141445f2a9b3726a06bced2"}]}