)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"ae18ef7e2589f35cdebf281b90093eb7fba20713","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Recursive deletion and project disabling"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This spec proposes two new functionalities to improve the robustness"},{"line_number":10,"context_line":"and usability of the Hierarchical Multitenancy feature: recursive"},{"line_number":11,"context_line":"deletion and recursive disabling. Both actions would require new rules"},{"line_number":12,"context_line":"in the policy.json file along with new API endpoints to"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":10,"id":"7aaa499b_ad297b39","line":9,"updated":"2015-04-14 12:11:12.000000000","message":"s/two new functionalities/new functionality/","commit_id":"2cadd178cb8e59cf165631f6ef0efaeb020804ad"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"524607ff9907e13ffa3ce3b7c362fe823119a688","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Recursive deletion and project disabling"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This spec proposes two new functionalities to improve the robustness"},{"line_number":10,"context_line":"and usability of the Hierarchical Multitenancy feature: recursive"},{"line_number":11,"context_line":"deletion and recursive disabling. Both actions would require new rules"},{"line_number":12,"context_line":"in the policy.json file along with new API endpoints to"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":10,"id":"7aaa499b_585ab751","line":9,"in_reply_to":"7aaa499b_ad297b39","updated":"2015-04-14 12:50:35.000000000","message":"Done","commit_id":"2cadd178cb8e59cf165631f6ef0efaeb020804ad"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"ae18ef7e2589f35cdebf281b90093eb7fba20713","unresolved":false,"context_lines":[{"line_number":12,"context_line":"in the policy.json file along with new API endpoints to"},{"line_number":13,"context_line":"control/represent them."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"It is also covered the case where domains are projects (Reseller use"},{"line_number":16,"context_line":"case)."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"bp recursive-deletion"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":10,"id":"7aaa499b_2d168bf1","line":15,"updated":"2015-04-14 12:11:12.000000000","message":"s/It is also/It also covers/","commit_id":"2cadd178cb8e59cf165631f6ef0efaeb020804ad"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"524607ff9907e13ffa3ce3b7c362fe823119a688","unresolved":false,"context_lines":[{"line_number":12,"context_line":"in the policy.json file along with new API endpoints to"},{"line_number":13,"context_line":"control/represent them."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"It is also covered the case where domains are projects (Reseller use"},{"line_number":16,"context_line":"case)."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"bp recursive-deletion"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":10,"id":"7aaa499b_38592b5b","line":15,"in_reply_to":"7aaa499b_2d168bf1","updated":"2015-04-14 12:50:35.000000000","message":"Done","commit_id":"2cadd178cb8e59cf165631f6ef0efaeb020804ad"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"3d9338f2abb87abee5569b31eb53307f0da37de2","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Recursive deletion and project disabling"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This spec proposes a new functionaly to improve the robustness"},{"line_number":10,"context_line":"and usability of the Hierarchical Multitenancy feature: recursive"},{"line_number":11,"context_line":"deletion and recursive disabling. Both actions would require new rules"},{"line_number":12,"context_line":"in the policy.json file along with new API endpoints to"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":16,"id":"7aaa499b_fa85f058","line":9,"updated":"2015-04-14 15:09:39.000000000","message":"s/a new functionaly/new functionality/","commit_id":"1d05bc4700ad99e130cea24c6946e6836edb0d63"}],"api/v3/identity-api-v3.rst":[{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"0f4ef8f8d03d41e81b2472bfa312b7c8b5bfed19","unresolved":false,"context_lines":[{"line_number":3218,"context_line":"The request block is the same as the one for create domain, except that"},{"line_number":3219,"context_line":"**only** the ``enabled`` attribute can be updated and **must** be included."},{"line_number":3220,"context_line":"This request enables or disables the domains recursively: the target domain"},{"line_number":3221,"context_line":"itself **and** all domains below it in the hierarchy."},{"line_number":3222,"context_line":""},{"line_number":3223,"context_line":"Request:"},{"line_number":3224,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"da86d52c_23bb01c5","line":3221,"updated":"2015-02-19 08:58:22.000000000","message":"Can you also clarify in the specs if it also updates the projects under the domain.","commit_id":"c821ea69261d5e479569bbf458966113b7acdb6e"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"18c7f3b0d93fceae826f470cd44516d0160b47e0","unresolved":false,"context_lines":[{"line_number":3218,"context_line":"The request block is the same as the one for create domain, except that"},{"line_number":3219,"context_line":"**only** the ``enabled`` attribute can be updated and **must** be included."},{"line_number":3220,"context_line":"This request enables or disables the domains recursively: the target domain"},{"line_number":3221,"context_line":"itself **and** all domains below it in the hierarchy."},{"line_number":3222,"context_line":""},{"line_number":3223,"context_line":"Request:"},{"line_number":3224,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"da86d52c_577ed8af","line":3221,"in_reply_to":"da86d52c_23bb01c5","updated":"2015-02-19 19:36:29.000000000","message":"Done","commit_id":"c821ea69261d5e479569bbf458966113b7acdb6e"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"0f4ef8f8d03d41e81b2472bfa312b7c8b5bfed19","unresolved":false,"context_lines":[{"line_number":3284,"context_line":"*New in version 3.4*"},{"line_number":3285,"context_line":""},{"line_number":3286,"context_line":"This request deletes domains recursively: the target domain itself **and**"},{"line_number":3287,"context_line":"all domains below it in the hierarchy."},{"line_number":3288,"context_line":""},{"line_number":3289,"context_line":"Relationship:"},{"line_number":3290,"context_line":"``http://docs.openstack.org/api/openstack-identity/3/rel/domain``"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da86d52c_a32291fe","line":3287,"updated":"2015-02-19 08:58:22.000000000","message":"I guess this should delete all the projects under it too? It would be helpful to the user to mention this in the specs for clarity\n\nWhat if the domain has an enabled child Domain in its hierarchy? might worth mentioning that validation too.","commit_id":"c821ea69261d5e479569bbf458966113b7acdb6e"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"18c7f3b0d93fceae826f470cd44516d0160b47e0","unresolved":false,"context_lines":[{"line_number":3284,"context_line":"*New in version 3.4*"},{"line_number":3285,"context_line":""},{"line_number":3286,"context_line":"This request deletes domains recursively: the target domain itself **and**"},{"line_number":3287,"context_line":"all domains below it in the hierarchy."},{"line_number":3288,"context_line":""},{"line_number":3289,"context_line":"Relationship:"},{"line_number":3290,"context_line":"``http://docs.openstack.org/api/openstack-identity/3/rel/domain``"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da86d52c_1778e0c2","line":3287,"in_reply_to":"da86d52c_a32291fe","updated":"2015-02-19 19:36:29.000000000","message":"Done","commit_id":"c821ea69261d5e479569bbf458966113b7acdb6e"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"0f4ef8f8d03d41e81b2472bfa312b7c8b5bfed19","unresolved":false,"context_lines":[{"line_number":3989,"context_line":"The request block is the same as the one for create project, except that"},{"line_number":3990,"context_line":"**only** the ``enabled`` attribute can be updated and **must** be included."},{"line_number":3991,"context_line":"This request enables or disables the projects recursively: the target project"},{"line_number":3992,"context_line":"itself **and** all projects below it in the hierarchy."},{"line_number":3993,"context_line":""},{"line_number":3994,"context_line":"Request:"},{"line_number":3995,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"da86d52c_037b5df5","line":3992,"updated":"2015-02-19 08:58:22.000000000","message":"\"it\" not necessary","commit_id":"c821ea69261d5e479569bbf458966113b7acdb6e"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"18c7f3b0d93fceae826f470cd44516d0160b47e0","unresolved":false,"context_lines":[{"line_number":3989,"context_line":"The request block is the same as the one for create project, except that"},{"line_number":3990,"context_line":"**only** the ``enabled`` attribute can be updated and **must** be included."},{"line_number":3991,"context_line":"This request enables or disables the projects recursively: the target project"},{"line_number":3992,"context_line":"itself **and** all projects below it in the hierarchy."},{"line_number":3993,"context_line":""},{"line_number":3994,"context_line":"Request:"},{"line_number":3995,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"da86d52c_377324e8","line":3992,"in_reply_to":"da86d52c_037b5df5","updated":"2015-02-19 19:36:29.000000000","message":"Done","commit_id":"c821ea69261d5e479569bbf458966113b7acdb6e"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"0f4ef8f8d03d41e81b2472bfa312b7c8b5bfed19","unresolved":false,"context_lines":[{"line_number":4051,"context_line":"*New in version 3.4*"},{"line_number":4052,"context_line":""},{"line_number":4053,"context_line":"This request deletes projects recursively: the target project itself **and**"},{"line_number":4054,"context_line":"all projects below it in the hierarchy."},{"line_number":4055,"context_line":""},{"line_number":4056,"context_line":"Relationship:"},{"line_number":4057,"context_line":"``http://docs.openstack.org/api/openstack-identity/3/rel/project``"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da86d52c_c39065ef","line":4054,"updated":"2015-02-19 08:58:22.000000000","message":"probably worth mentioning here too that all child projects must be disabled first.","commit_id":"c821ea69261d5e479569bbf458966113b7acdb6e"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"18c7f3b0d93fceae826f470cd44516d0160b47e0","unresolved":false,"context_lines":[{"line_number":4051,"context_line":"*New in version 3.4*"},{"line_number":4052,"context_line":""},{"line_number":4053,"context_line":"This request deletes projects recursively: the target project itself **and**"},{"line_number":4054,"context_line":"all projects below it in the hierarchy."},{"line_number":4055,"context_line":""},{"line_number":4056,"context_line":"Relationship:"},{"line_number":4057,"context_line":"``http://docs.openstack.org/api/openstack-identity/3/rel/project``"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da86d52c_f76d0c04","line":4054,"in_reply_to":"da86d52c_c39065ef","updated":"2015-02-19 19:36:29.000000000","message":"Done","commit_id":"c821ea69261d5e479569bbf458966113b7acdb6e"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"77075ee222fe35f715a4cd9b5328d6f648a429b1","unresolved":false,"context_lines":[{"line_number":29,"context_line":"- Addition of a dual scoped token for a project with the ``ìs_domain`` flag"},{"line_number":30,"context_line":"  active, when a domain scoped token is requested."},{"line_number":31,"context_line":"- Enable or disable a project or domain recursively: enabling or disabling the"},{"line_number":32,"context_line":"  project or domain itself and its subtree."},{"line_number":33,"context_line":"- Delete a project or domain  recursively: deleting the project or domain"},{"line_number":34,"context_line":"  itself and its subtree."},{"line_number":35,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"ba7be1f8_55b012f4","line":32,"updated":"2015-02-23 20:46:04.000000000","message":"How about this?\n\n- Recursively enable or disable a project hierarchy.\n- Recursively delete a project hierarchy.","commit_id":"f313ac276257c65089ac509172a86da3907cbb59"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"77075ee222fe35f715a4cd9b5328d6f648a429b1","unresolved":false,"context_lines":[{"line_number":3211,"context_line":"    PATCH /domains/{domain_id}/cascade"},{"line_number":3212,"context_line":""},{"line_number":3213,"context_line":"Relationship:"},{"line_number":3214,"context_line":"``http://docs.openstack.org/api/openstack-identity/3/rel/domain``"},{"line_number":3215,"context_line":""},{"line_number":3216,"context_line":"*New in version 3.4*"},{"line_number":3217,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"ba7be1f8_b5a06ea0","line":3214,"updated":"2015-02-23 20:46:04.000000000","message":"broken link?","commit_id":"f313ac276257c65089ac509172a86da3907cbb59"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"b798969d6232985ff900eae86ea763d9030f8585","unresolved":false,"context_lines":[{"line_number":3232,"context_line":""},{"line_number":3233,"context_line":"Response:"},{"line_number":3234,"context_line":""},{"line_number":3235,"context_line":"::"},{"line_number":3236,"context_line":""},{"line_number":3237,"context_line":"    Status: 200 OK"},{"line_number":3238,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"ba7be1f8_d6a7de4d","line":3235,"updated":"2015-02-20 23:08:12.000000000","message":"So basically as a response you just get the top level domain and told that it is now enabled or disabled?  And from that you should infer that the cascade occurred? So you only know a cascade occurred by looking at the request URL.  Is that correct?  Is that enough?","commit_id":"f313ac276257c65089ac509172a86da3907cbb59"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"0cfa51dd3f56968cf00f6f4899509fc91bdbb943","unresolved":false,"context_lines":[{"line_number":3232,"context_line":""},{"line_number":3233,"context_line":"Response:"},{"line_number":3234,"context_line":""},{"line_number":3235,"context_line":"::"},{"line_number":3236,"context_line":""},{"line_number":3237,"context_line":"    Status: 200 OK"},{"line_number":3238,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"ba7be1f8_7a899e25","line":3235,"in_reply_to":"ba7be1f8_567afcf1","updated":"2015-02-23 06:43:32.000000000","message":"Doesn\u0027t subtree_as_ids create nested directories of each level of the hierarchy.   If there are large numbers of projects couldn\u0027t this get huge?  My fear is this could be a large performance impact and perhaps we don\u0027t even need this","commit_id":"f313ac276257c65089ac509172a86da3907cbb59"},{"author":{"_account_id":11057,"name":"sajeesh cs","email":"sajeesh.cs@cern.ch","username":"sajeeshcs"},"change_message_id":"117ba24751c950b3de24ab1bb19609907269b9f0","unresolved":false,"context_lines":[{"line_number":3232,"context_line":""},{"line_number":3233,"context_line":"Response:"},{"line_number":3234,"context_line":""},{"line_number":3235,"context_line":"::"},{"line_number":3236,"context_line":""},{"line_number":3237,"context_line":"    Status: 200 OK"},{"line_number":3238,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"ba7be1f8_3673c816","line":3235,"in_reply_to":"ba7be1f8_567afcf1","updated":"2015-02-22 19:38:28.000000000","message":"Yes. I  also think so. subtree_as_ids will be sufficient","commit_id":"f313ac276257c65089ac509172a86da3907cbb59"},{"author":{"_account_id":11057,"name":"sajeesh cs","email":"sajeesh.cs@cern.ch","username":"sajeeshcs"},"change_message_id":"931c0a4cca2aa12c3b200a7bab4d78285abd1a65","unresolved":false,"context_lines":[{"line_number":3232,"context_line":""},{"line_number":3233,"context_line":"Response:"},{"line_number":3234,"context_line":""},{"line_number":3235,"context_line":"::"},{"line_number":3236,"context_line":""},{"line_number":3237,"context_line":"    Status: 200 OK"},{"line_number":3238,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"ba7be1f8_88452519","line":3235,"in_reply_to":"ba7be1f8_7a899e25","updated":"2015-02-23 13:49:01.000000000","message":"I think that information is required. In Nova, we are\nplanning to have a systematic storage of history of actions,\nas it is very  much required in case of nested projects,\nespecially when the number of projects are very high.\n\nI think, such sort of history module will be required in\nkeystone also.If not now,later.\n\nSo when a project is deleted recursively ,it is important\nto have the  list of projects deleted along with it,since we\nlose that information  after that.Rodrigo, am I right ? The \nsubtree info will be lost forever.\n\nI think that the cost for that is not a problem.In any \norganization the  most probable candidates for deletion are\nleaf projects or projects which are one  or two levels above\nit.In that case, subtree list will be smaller.\n\nAs the level of heirarchy goes up,the probability of\ndeletion of projects decreases.It is very unlikely that a \nroot project or a higher level project  is getting\ndeleted frequenty. So IMO, efficiency is not a\nproblem.What do you think ?","commit_id":"f313ac276257c65089ac509172a86da3907cbb59"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"302fc1e2b4fddded1368217b660a0779050fcb26","unresolved":false,"context_lines":[{"line_number":3232,"context_line":""},{"line_number":3233,"context_line":"Response:"},{"line_number":3234,"context_line":""},{"line_number":3235,"context_line":"::"},{"line_number":3236,"context_line":""},{"line_number":3237,"context_line":"    Status: 200 OK"},{"line_number":3238,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"ba7be1f8_cfb55532","line":3235,"in_reply_to":"ba7be1f8_88452519","updated":"2015-02-23 19:15:27.000000000","message":"Sajeesh, so you mean to return the subtree in both actions? Deletion and disabling?","commit_id":"f313ac276257c65089ac509172a86da3907cbb59"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"d470007d965b1b8b513ccdca6181c65d97a1f9f6","unresolved":false,"context_lines":[{"line_number":3232,"context_line":""},{"line_number":3233,"context_line":"Response:"},{"line_number":3234,"context_line":""},{"line_number":3235,"context_line":"::"},{"line_number":3236,"context_line":""},{"line_number":3237,"context_line":"    Status: 200 OK"},{"line_number":3238,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"ba7be1f8_f0186286","line":3235,"in_reply_to":"ba7be1f8_9f6f3992","updated":"2015-02-21 06:37:16.000000000","message":"Couldn\u0027t that get really big?  I was thinking maybe some notice that cascade was used.  But maybe I am being pedantic :-). So just wanted to see what other folks thought","commit_id":"f313ac276257c65089ac509172a86da3907cbb59"},{"author":{"_account_id":11057,"name":"sajeesh cs","email":"sajeesh.cs@cern.ch","username":"sajeeshcs"},"change_message_id":"c69711d9c7bcf4bf6c247f2e9bd01bef46652c19","unresolved":false,"context_lines":[{"line_number":3232,"context_line":""},{"line_number":3233,"context_line":"Response:"},{"line_number":3234,"context_line":""},{"line_number":3235,"context_line":"::"},{"line_number":3236,"context_line":""},{"line_number":3237,"context_line":"    Status: 200 OK"},{"line_number":3238,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"ba7be1f8_bdf9624f","line":3235,"in_reply_to":"ba7be1f8_9f6f3992","updated":"2015-02-21 12:36:42.000000000","message":"subtree_as_list or subtree_as_ids ?","commit_id":"f313ac276257c65089ac509172a86da3907cbb59"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"f8c30014e50d6d0a41c2753e4bd057182d73506f","unresolved":false,"context_lines":[{"line_number":3232,"context_line":""},{"line_number":3233,"context_line":"Response:"},{"line_number":3234,"context_line":""},{"line_number":3235,"context_line":"::"},{"line_number":3236,"context_line":""},{"line_number":3237,"context_line":"    Status: 200 OK"},{"line_number":3238,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"ba7be1f8_567afcf1","line":3235,"in_reply_to":"ba7be1f8_bdf9624f","updated":"2015-02-22 19:30:37.000000000","message":"I think makes sense we return the equivalent of subtree_as_ids call, since changing a branch enabled status is either for the whole branch or to no one.","commit_id":"f313ac276257c65089ac509172a86da3907cbb59"},{"author":{"_account_id":11057,"name":"sajeesh cs","email":"sajeesh.cs@cern.ch","username":"sajeeshcs"},"change_message_id":"d8c756ba517467b0ba51af62cf92b641b1b20d42","unresolved":false,"context_lines":[{"line_number":3232,"context_line":""},{"line_number":3233,"context_line":"Response:"},{"line_number":3234,"context_line":""},{"line_number":3235,"context_line":"::"},{"line_number":3236,"context_line":""},{"line_number":3237,"context_line":"    Status: 200 OK"},{"line_number":3238,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"ba7be1f8_761c3914","line":3235,"in_reply_to":"ba7be1f8_cfb55532","updated":"2015-02-23 23:03:14.000000000","message":"Yes, both. My only concern is that, if George is recursively deleting or disabling a project, whether John will come to know that, which all projects are deleted or disabled by George in that particular recursive disable/delete action.Whether keystone is currently maintaining such sort of \nhistory ?","commit_id":"f313ac276257c65089ac509172a86da3907cbb59"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"8793c10c6544e4ebb3330e7eca47fb246f988696","unresolved":false,"context_lines":[{"line_number":3232,"context_line":""},{"line_number":3233,"context_line":"Response:"},{"line_number":3234,"context_line":""},{"line_number":3235,"context_line":"::"},{"line_number":3236,"context_line":""},{"line_number":3237,"context_line":"    Status: 200 OK"},{"line_number":3238,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"ba7be1f8_9f6f3992","line":3235,"in_reply_to":"ba7be1f8_d6a7de4d","updated":"2015-02-21 00:32:05.000000000","message":"Yeah... While writing the API I thought about returning also the subtree (as when we request subtree_as_list in get_project), makes sense?","commit_id":"f313ac276257c65089ac509172a86da3907cbb59"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"ae18ef7e2589f35cdebf281b90093eb7fba20713","unresolved":false,"context_lines":[{"line_number":3861,"context_line":"  Forbidden``"},{"line_number":3862,"context_line":""},{"line_number":3863,"context_line":"- Disabling a project that has enabled projects in its subtree using this"},{"line_number":3864,"context_line":"  endpoint will fail with a ``403 Forbidden``"},{"line_number":3865,"context_line":""},{"line_number":3866,"context_line":"- Enabling a project that has disabled parents will fail with a ``403"},{"line_number":3867,"context_line":"  Forbidden``"}],"source_content_type":"text/x-rst","patch_set":10,"id":"7aaa499b_6d3b7339","line":3864,"updated":"2015-04-14 12:11:12.000000000","message":"This needs to go in the right section","commit_id":"2cadd178cb8e59cf165631f6ef0efaeb020804ad"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"524607ff9907e13ffa3ce3b7c362fe823119a688","unresolved":false,"context_lines":[{"line_number":3861,"context_line":"  Forbidden``"},{"line_number":3862,"context_line":""},{"line_number":3863,"context_line":"- Disabling a project that has enabled projects in its subtree using this"},{"line_number":3864,"context_line":"  endpoint will fail with a ``403 Forbidden``"},{"line_number":3865,"context_line":""},{"line_number":3866,"context_line":"- Enabling a project that has disabled parents will fail with a ``403"},{"line_number":3867,"context_line":"  Forbidden``"}],"source_content_type":"text/x-rst","patch_set":10,"id":"7aaa499b_f382c451","line":3864,"in_reply_to":"7aaa499b_6d3b7339","updated":"2015-04-14 12:50:35.000000000","message":"isn\u0027t in the correct session?","commit_id":"2cadd178cb8e59cf165631f6ef0efaeb020804ad"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"ae18ef7e2589f35cdebf281b90093eb7fba20713","unresolved":false,"context_lines":[{"line_number":3876,"context_line":"Relationship:"},{"line_number":3877,"context_line":"``http://docs.openstack.org/api/openstack-identity/3/rel/project``"},{"line_number":3878,"context_line":""},{"line_number":3879,"context_line":"*New in version 3.4*"},{"line_number":3880,"context_line":""},{"line_number":3881,"context_line":"Only the ``enabled`` attribute can be updated using this endpoint and **must**"},{"line_number":3882,"context_line":"be the **only** included. This request enables or disables the projects"}],"source_content_type":"text/x-rst","patch_set":10,"id":"7aaa499b_ad385b3e","line":3879,"updated":"2015-04-14 12:11:12.000000000","message":"3.5 I think","commit_id":"2cadd178cb8e59cf165631f6ef0efaeb020804ad"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"524607ff9907e13ffa3ce3b7c362fe823119a688","unresolved":false,"context_lines":[{"line_number":3876,"context_line":"Relationship:"},{"line_number":3877,"context_line":"``http://docs.openstack.org/api/openstack-identity/3/rel/project``"},{"line_number":3878,"context_line":""},{"line_number":3879,"context_line":"*New in version 3.4*"},{"line_number":3880,"context_line":""},{"line_number":3881,"context_line":"Only the ``enabled`` attribute can be updated using this endpoint and **must**"},{"line_number":3882,"context_line":"be the **only** included. This request enables or disables the projects"}],"source_content_type":"text/x-rst","patch_set":10,"id":"7aaa499b_3807eb1d","line":3879,"in_reply_to":"7aaa499b_ad385b3e","updated":"2015-04-14 12:50:35.000000000","message":"Done","commit_id":"2cadd178cb8e59cf165631f6ef0efaeb020804ad"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"ae18ef7e2589f35cdebf281b90093eb7fba20713","unresolved":false,"context_lines":[{"line_number":3911,"context_line":"            \"name\": \"Build Group\","},{"line_number":3912,"context_line":"            \"parent_id\": \"7fa612\""},{"line_number":3913,"context_line":"        }"},{"line_number":3914,"context_line":"    }"},{"line_number":3915,"context_line":""},{"line_number":3916,"context_line":""},{"line_number":3917,"context_line":"Delete project"}],"source_content_type":"text/x-rst","patch_set":10,"id":"7aaa499b_ed7c23ed","line":3914,"updated":"2015-04-14 12:11:12.000000000","message":"so what gets returned?  one project? all projects in the subtree? maybe nothing?","commit_id":"2cadd178cb8e59cf165631f6ef0efaeb020804ad"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"524607ff9907e13ffa3ce3b7c362fe823119a688","unresolved":false,"context_lines":[{"line_number":3911,"context_line":"            \"name\": \"Build Group\","},{"line_number":3912,"context_line":"            \"parent_id\": \"7fa612\""},{"line_number":3913,"context_line":"        }"},{"line_number":3914,"context_line":"    }"},{"line_number":3915,"context_line":""},{"line_number":3916,"context_line":""},{"line_number":3917,"context_line":"Delete project"}],"source_content_type":"text/x-rst","patch_set":10,"id":"7aaa499b_530f382e","line":3914,"in_reply_to":"7aaa499b_ed7c23ed","updated":"2015-04-14 12:50:35.000000000","message":"++ return nothing is a better approach IMHO","commit_id":"2cadd178cb8e59cf165631f6ef0efaeb020804ad"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"ae18ef7e2589f35cdebf281b90093eb7fba20713","unresolved":false,"context_lines":[{"line_number":3940,"context_line":""},{"line_number":3941,"context_line":"    DELETE /projects/{project_id}/cascade"},{"line_number":3942,"context_line":""},{"line_number":3943,"context_line":"*New in version 3.4*"},{"line_number":3944,"context_line":""},{"line_number":3945,"context_line":"This request deletes projects recursively: the target project itself **and**"},{"line_number":3946,"context_line":"all projects below it in the hierarchy. It is mandatory to first disable the"}],"source_content_type":"text/x-rst","patch_set":10,"id":"7aaa499b_ad0f3b87","line":3943,"updated":"2015-04-14 12:11:12.000000000","message":"3.5","commit_id":"2cadd178cb8e59cf165631f6ef0efaeb020804ad"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"524607ff9907e13ffa3ce3b7c362fe823119a688","unresolved":false,"context_lines":[{"line_number":3940,"context_line":""},{"line_number":3941,"context_line":"    DELETE /projects/{project_id}/cascade"},{"line_number":3942,"context_line":""},{"line_number":3943,"context_line":"*New in version 3.4*"},{"line_number":3944,"context_line":""},{"line_number":3945,"context_line":"This request deletes projects recursively: the target project itself **and**"},{"line_number":3946,"context_line":"all projects below it in the hierarchy. It is mandatory to first disable the"}],"source_content_type":"text/x-rst","patch_set":10,"id":"7aaa499b_1347704c","line":3943,"in_reply_to":"7aaa499b_ad0f3b87","updated":"2015-04-14 12:50:35.000000000","message":"Done","commit_id":"2cadd178cb8e59cf165631f6ef0efaeb020804ad"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"1a93ff2e866775476a55b71b0f991223f5e3dbb8","unresolved":false,"context_lines":[{"line_number":20,"context_line":"  scope in the token request, the token returned will contain both ``domain``"},{"line_number":21,"context_line":"  and ``project`` scopes. This does not change the way the previous domain"},{"line_number":22,"context_line":"  scoped tokens were handled, since there is only the addition of the project"},{"line_number":23,"context_line":"  scope field."},{"line_number":24,"context_line":"- Enable or disable a project or domain recursively: enabling or disabling the"},{"line_number":25,"context_line":"  project or domain itself and its subtree."},{"line_number":26,"context_line":"- Delete a project or domain  recursively: deleting the project or domain"}],"source_content_type":"text/x-rst","patch_set":11,"id":"7aaa499b_9e126708","line":23,"updated":"2015-04-14 13:08:12.000000000","message":"I think this is a hang over from the dependant patch?","commit_id":"3031de42b067ebf789a6a95ee8341f51fc72a086"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"0c528e3f95852309b2c051d4824e7696f3663db2","unresolved":false,"context_lines":[{"line_number":20,"context_line":"  scope in the token request, the token returned will contain both ``domain``"},{"line_number":21,"context_line":"  and ``project`` scopes. This does not change the way the previous domain"},{"line_number":22,"context_line":"  scoped tokens were handled, since there is only the addition of the project"},{"line_number":23,"context_line":"  scope field."},{"line_number":24,"context_line":"- Enable or disable a project or domain recursively: enabling or disabling the"},{"line_number":25,"context_line":"  project or domain itself and its subtree."},{"line_number":26,"context_line":"- Delete a project or domain  recursively: deleting the project or domain"}],"source_content_type":"text/x-rst","patch_set":11,"id":"7aaa499b_7ef9db7f","line":23,"in_reply_to":"7aaa499b_9e126708","updated":"2015-04-14 13:13:06.000000000","message":"++","commit_id":"3031de42b067ebf789a6a95ee8341f51fc72a086"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"1a93ff2e866775476a55b71b0f991223f5e3dbb8","unresolved":false,"context_lines":[{"line_number":3858,"context_line":"  Forbidden``"},{"line_number":3859,"context_line":""},{"line_number":3860,"context_line":"- Disabling a project that has enabled projects in its subtree using this"},{"line_number":3861,"context_line":"  endpoint will fail with a ``403 Forbidden``"},{"line_number":3862,"context_line":""},{"line_number":3863,"context_line":"- Enabling a project that has disabled parents will fail with a ``403"},{"line_number":3864,"context_line":"  Forbidden``"}],"source_content_type":"text/x-rst","patch_set":11,"id":"7aaa499b_bedd2344","line":3861,"updated":"2015-04-14 13:08:12.000000000","message":"is this part of this patch?","commit_id":"3031de42b067ebf789a6a95ee8341f51fc72a086"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"0c528e3f95852309b2c051d4824e7696f3663db2","unresolved":false,"context_lines":[{"line_number":3858,"context_line":"  Forbidden``"},{"line_number":3859,"context_line":""},{"line_number":3860,"context_line":"- Disabling a project that has enabled projects in its subtree using this"},{"line_number":3861,"context_line":"  endpoint will fail with a ``403 Forbidden``"},{"line_number":3862,"context_line":""},{"line_number":3863,"context_line":"- Enabling a project that has disabled parents will fail with a ``403"},{"line_number":3864,"context_line":"  Forbidden``"}],"source_content_type":"text/x-rst","patch_set":11,"id":"7aaa499b_befe4369","line":3861,"in_reply_to":"7aaa499b_bedd2344","updated":"2015-04-14 13:13:06.000000000","message":"yes, we need to make clear that the error is the case if using this endpoint specifically, not if using the one with the /cascade","commit_id":"3031de42b067ebf789a6a95ee8341f51fc72a086"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"1a93ff2e866775476a55b71b0f991223f5e3dbb8","unresolved":false,"context_lines":[{"line_number":3917,"context_line":"*New in version 3.4*"},{"line_number":3918,"context_line":""},{"line_number":3919,"context_line":"- The deletion of a project that is not a leaf in the project hierarchy (does"},{"line_number":3920,"context_line":"  not have children) using this endpoint will fail with a ``403 Forbidden``."},{"line_number":3921,"context_line":""},{"line_number":3922,"context_line":"Delete projects recursively"},{"line_number":3923,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^"}],"source_content_type":"text/x-rst","patch_set":11,"id":"7aaa499b_1ec4175d","line":3920,"updated":"2015-04-14 13:08:12.000000000","message":"??","commit_id":"3031de42b067ebf789a6a95ee8341f51fc72a086"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"0c528e3f95852309b2c051d4824e7696f3663db2","unresolved":false,"context_lines":[{"line_number":3917,"context_line":"*New in version 3.4*"},{"line_number":3918,"context_line":""},{"line_number":3919,"context_line":"- The deletion of a project that is not a leaf in the project hierarchy (does"},{"line_number":3920,"context_line":"  not have children) using this endpoint will fail with a ``403 Forbidden``."},{"line_number":3921,"context_line":""},{"line_number":3922,"context_line":"Delete projects recursively"},{"line_number":3923,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^"}],"source_content_type":"text/x-rst","patch_set":11,"id":"7aaa499b_3e78f3f1","line":3920,"in_reply_to":"7aaa499b_1ec4175d","updated":"2015-04-14 13:13:06.000000000","message":"same case as the update... we need to make clear that this is error is raised when using this endpoint (since we have another endpoint to perform such request)","commit_id":"3031de42b067ebf789a6a95ee8341f51fc72a086"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"d0ec7bcbce1992e1389ab8677afce085df6749c5","unresolved":false,"context_lines":[{"line_number":16,"context_line":"  project to behave as a domain."},{"line_number":17,"context_line":"- Addition of the possibility to request a token for a project with the"},{"line_number":18,"context_line":"  ``is_domain`` flag enabled."},{"line_number":19,"context_line":"- Enable or disable a project or domain recursively: enabling or disabling the"},{"line_number":20,"context_line":"  project or domain itself and its subtree."},{"line_number":21,"context_line":"- Delete a project or domain  recursively: deleting the project or domain"},{"line_number":22,"context_line":"  itself and its subtree."}],"source_content_type":"text/x-rst","patch_set":12,"id":"7aaa499b_3e07d31d","line":19,"updated":"2015-04-14 13:19:01.000000000","message":"are we adding the ability to enable/disable domains recursively?","commit_id":"83fb40f8aeb732be9be9413722ae604630cc6814"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"dd17731e13f3b0c2897c3d98516f1a5939191509","unresolved":false,"context_lines":[{"line_number":16,"context_line":"  project to behave as a domain."},{"line_number":17,"context_line":"- Addition of the possibility to request a token for a project with the"},{"line_number":18,"context_line":"  ``is_domain`` flag enabled."},{"line_number":19,"context_line":"- Enable or disable a project or domain recursively: enabling or disabling the"},{"line_number":20,"context_line":"  project or domain itself and its subtree."},{"line_number":21,"context_line":"- Delete a project or domain  recursively: deleting the project or domain"},{"line_number":22,"context_line":"  itself and its subtree."}],"source_content_type":"text/x-rst","patch_set":12,"id":"7aaa499b_b97c1d73","line":19,"in_reply_to":"7aaa499b_3e07d31d","updated":"2015-04-14 13:24:23.000000000","message":"yes... if we use the project API on is_domain projects, right?","commit_id":"83fb40f8aeb732be9be9413722ae604630cc6814"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"00c04cd1a3d070a4aa01dc23ad285d77c8b5eb26","unresolved":false,"context_lines":[{"line_number":16,"context_line":"  project to behave as a domain."},{"line_number":17,"context_line":"- Addition of the possibility to request a token for a project with the"},{"line_number":18,"context_line":"  ``is_domain`` flag enabled."},{"line_number":19,"context_line":"- Enable or disable a project or domain recursively: enabling or disabling the"},{"line_number":20,"context_line":"  project or domain itself and its subtree."},{"line_number":21,"context_line":"- Delete a project or domain  recursively: deleting the project or domain"},{"line_number":22,"context_line":"  itself and its subtree."}],"source_content_type":"text/x-rst","patch_set":12,"id":"7aaa499b_f97985fd","line":19,"in_reply_to":"7aaa499b_b97c1d73","updated":"2015-04-14 13:31:39.000000000","message":"I agree...but it sounds like you can use the domain API for this from how this is written...I think maybe just drop the \"or domain\" bit from here/","commit_id":"83fb40f8aeb732be9be9413722ae604630cc6814"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"ae7cd3fbefb13f7e758b25374a920c59ee4d5d80","unresolved":false,"context_lines":[{"line_number":16,"context_line":"  project to behave as a domain."},{"line_number":17,"context_line":"- Addition of the possibility to request a token for a project with the"},{"line_number":18,"context_line":"  ``is_domain`` flag enabled."},{"line_number":19,"context_line":"- Enable or disable a project or domain recursively: enabling or disabling the"},{"line_number":20,"context_line":"  project or domain itself and its subtree."},{"line_number":21,"context_line":"- Delete a project or domain  recursively: deleting the project or domain"},{"line_number":22,"context_line":"  itself and its subtree."}],"source_content_type":"text/x-rst","patch_set":12,"id":"7aaa499b_2bde7011","line":19,"in_reply_to":"7aaa499b_f97985fd","updated":"2015-04-14 14:22:57.000000000","message":"yeah, makes sense","commit_id":"83fb40f8aeb732be9be9413722ae604630cc6814"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"d0ec7bcbce1992e1389ab8677afce085df6749c5","unresolved":false,"context_lines":[{"line_number":18,"context_line":"  ``is_domain`` flag enabled."},{"line_number":19,"context_line":"- Enable or disable a project or domain recursively: enabling or disabling the"},{"line_number":20,"context_line":"  project or domain itself and its subtree."},{"line_number":21,"context_line":"- Delete a project or domain  recursively: deleting the project or domain"},{"line_number":22,"context_line":"  itself and its subtree."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"What\u0027s New in Version 3.4"}],"source_content_type":"text/x-rst","patch_set":12,"id":"7aaa499b_1e02d70b","line":21,"updated":"2015-04-14 13:19:01.000000000","message":"same comment as above","commit_id":"83fb40f8aeb732be9be9413722ae604630cc6814"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"dd17731e13f3b0c2897c3d98516f1a5939191509","unresolved":false,"context_lines":[{"line_number":18,"context_line":"  ``is_domain`` flag enabled."},{"line_number":19,"context_line":"- Enable or disable a project or domain recursively: enabling or disabling the"},{"line_number":20,"context_line":"  project or domain itself and its subtree."},{"line_number":21,"context_line":"- Delete a project or domain  recursively: deleting the project or domain"},{"line_number":22,"context_line":"  itself and its subtree."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"What\u0027s New in Version 3.4"}],"source_content_type":"text/x-rst","patch_set":12,"id":"7aaa499b_7997b590","line":21,"in_reply_to":"7aaa499b_1e02d70b","updated":"2015-04-14 13:24:23.000000000","message":"same reply :)","commit_id":"83fb40f8aeb732be9be9413722ae604630cc6814"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"00c04cd1a3d070a4aa01dc23ad285d77c8b5eb26","unresolved":false,"context_lines":[{"line_number":18,"context_line":"  ``is_domain`` flag enabled."},{"line_number":19,"context_line":"- Enable or disable a project or domain recursively: enabling or disabling the"},{"line_number":20,"context_line":"  project or domain itself and its subtree."},{"line_number":21,"context_line":"- Delete a project or domain  recursively: deleting the project or domain"},{"line_number":22,"context_line":"  itself and its subtree."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"What\u0027s New in Version 3.4"}],"source_content_type":"text/x-rst","patch_set":12,"id":"7aaa499b_b983fdcb","line":21,"in_reply_to":"7aaa499b_7997b590","updated":"2015-04-14 13:31:39.000000000","message":"same here","commit_id":"83fb40f8aeb732be9be9413722ae604630cc6814"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"d0ec7bcbce1992e1389ab8677afce085df6749c5","unresolved":false,"context_lines":[{"line_number":3853,"context_line":"  Forbidden``"},{"line_number":3854,"context_line":""},{"line_number":3855,"context_line":"- Disabling a project that has enabled projects in its subtree using this"},{"line_number":3856,"context_line":"  endpoint will fail with a ``403 Forbidden``"},{"line_number":3857,"context_line":""},{"line_number":3858,"context_line":"- Enabling a project that has disabled parents will fail with a ``403"},{"line_number":3859,"context_line":"  Forbidden``"}],"source_content_type":"text/x-rst","patch_set":12,"id":"7aaa499b_391ecd63","line":3856,"updated":"2015-04-14 13:19:01.000000000","message":"using endpoint in this API doc is confusing...since endpoints are entities...","commit_id":"83fb40f8aeb732be9be9413722ae604630cc6814"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"dd17731e13f3b0c2897c3d98516f1a5939191509","unresolved":false,"context_lines":[{"line_number":3853,"context_line":"  Forbidden``"},{"line_number":3854,"context_line":""},{"line_number":3855,"context_line":"- Disabling a project that has enabled projects in its subtree using this"},{"line_number":3856,"context_line":"  endpoint will fail with a ``403 Forbidden``"},{"line_number":3857,"context_line":""},{"line_number":3858,"context_line":"- Enabling a project that has disabled parents will fail with a ``403"},{"line_number":3859,"context_line":"  Forbidden``"}],"source_content_type":"text/x-rst","patch_set":12,"id":"7aaa499b_b9f3fd09","line":3856,"in_reply_to":"7aaa499b_391ecd63","updated":"2015-04-14 13:24:23.000000000","message":"hmm maybe \"operation\"?","commit_id":"83fb40f8aeb732be9be9413722ae604630cc6814"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"00c04cd1a3d070a4aa01dc23ad285d77c8b5eb26","unresolved":false,"context_lines":[{"line_number":3853,"context_line":"  Forbidden``"},{"line_number":3854,"context_line":""},{"line_number":3855,"context_line":"- Disabling a project that has enabled projects in its subtree using this"},{"line_number":3856,"context_line":"  endpoint will fail with a ``403 Forbidden``"},{"line_number":3857,"context_line":""},{"line_number":3858,"context_line":"- Enabling a project that has disabled parents will fail with a ``403"},{"line_number":3859,"context_line":"  Forbidden``"}],"source_content_type":"text/x-rst","patch_set":12,"id":"7aaa499b_f99505e4","line":3856,"in_reply_to":"7aaa499b_b9f3fd09","updated":"2015-04-14 13:31:39.000000000","message":"API? Maybe reference the Api they should be using as well if they really want to delete the whole hierarchy","commit_id":"83fb40f8aeb732be9be9413722ae604630cc6814"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"ae7cd3fbefb13f7e758b25374a920c59ee4d5d80","unresolved":false,"context_lines":[{"line_number":3853,"context_line":"  Forbidden``"},{"line_number":3854,"context_line":""},{"line_number":3855,"context_line":"- Disabling a project that has enabled projects in its subtree using this"},{"line_number":3856,"context_line":"  endpoint will fail with a ``403 Forbidden``"},{"line_number":3857,"context_line":""},{"line_number":3858,"context_line":"- Enabling a project that has disabled parents will fail with a ``403"},{"line_number":3859,"context_line":"  Forbidden``"}],"source_content_type":"text/x-rst","patch_set":12,"id":"7aaa499b_8bcd845f","line":3856,"in_reply_to":"7aaa499b_f99505e4","updated":"2015-04-14 14:22:57.000000000","message":"++","commit_id":"83fb40f8aeb732be9be9413722ae604630cc6814"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"d0ec7bcbce1992e1389ab8677afce085df6749c5","unresolved":false,"context_lines":[{"line_number":3912,"context_line":"*New in version 3.4*"},{"line_number":3913,"context_line":""},{"line_number":3914,"context_line":"- The deletion of a project that is not a leaf in the project hierarchy (does"},{"line_number":3915,"context_line":"  not have children) using this endpoint will fail with a ``403 Forbidden``."},{"line_number":3916,"context_line":""},{"line_number":3917,"context_line":"Delete projects recursively"},{"line_number":3918,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^"}],"source_content_type":"text/x-rst","patch_set":12,"id":"7aaa499b_f92625b9","line":3915,"updated":"2015-04-14 13:19:01.000000000","message":"same comment as above.","commit_id":"83fb40f8aeb732be9be9413722ae604630cc6814"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"7d26c5cd4b858c5f6ef3b49fc1d4aae5359ccf23","unresolved":false,"context_lines":[{"line_number":3858,"context_line":"  Forbidden``"},{"line_number":3859,"context_line":""},{"line_number":3860,"context_line":"- Disabling a project that has enabled projects in its subtree using this"},{"line_number":3861,"context_line":"  API will fail with a ``403 Forbidden``. Check ``Enable or disable projects"},{"line_number":3862,"context_line":"  recursively`` section for the appropriate API for this action."},{"line_number":3863,"context_line":""},{"line_number":3864,"context_line":"- Enabling a project that has disabled parents will fail with a ``403"}],"source_content_type":"text/x-rst","patch_set":14,"id":"7aaa499b_c1700bdf","line":3861,"updated":"2015-04-14 14:39:14.000000000","message":"(nit): s/Check/See/","commit_id":"0c5ef33447bb999084188bb011a074d944c9b265"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"ae8af92be94180dffcfd58e5837811a13da5d5f9","unresolved":false,"context_lines":[{"line_number":3858,"context_line":"  Forbidden``"},{"line_number":3859,"context_line":""},{"line_number":3860,"context_line":"- Disabling a project that has enabled projects in its subtree using this"},{"line_number":3861,"context_line":"  API will fail with a ``403 Forbidden``. Check ``Enable or disable projects"},{"line_number":3862,"context_line":"  recursively`` section for the appropriate API for this action."},{"line_number":3863,"context_line":""},{"line_number":3864,"context_line":"- Enabling a project that has disabled parents will fail with a ``403"}],"source_content_type":"text/x-rst","patch_set":14,"id":"7aaa499b_7f6432e4","line":3861,"in_reply_to":"7aaa499b_c1700bdf","updated":"2015-04-14 15:00:18.000000000","message":"used See when have first written the sentence :(","commit_id":"0c5ef33447bb999084188bb011a074d944c9b265"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"fb04a57789c109302521c4733133a30676fc02f0","unresolved":false,"context_lines":[{"line_number":3879,"context_line":"Only the ``enabled`` attribute can be updated using this API and **must**"},{"line_number":3880,"context_line":"be the **only** included. This request enables or disables the projects"},{"line_number":3881,"context_line":"recursively: the target project itself **and** all projects below in the"},{"line_number":3882,"context_line":"hierarchy."},{"line_number":3883,"context_line":""},{"line_number":3884,"context_line":"Request:"},{"line_number":3885,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"7aaa499b_1f908e42","line":3882,"updated":"2015-04-14 14:57:42.000000000","message":"Suggestion for clarification\n\ns/**must** be the **only** included/it **must** be the **only** one included/","commit_id":"0c5ef33447bb999084188bb011a074d944c9b265"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"ae8af92be94180dffcfd58e5837811a13da5d5f9","unresolved":false,"context_lines":[{"line_number":3879,"context_line":"Only the ``enabled`` attribute can be updated using this API and **must**"},{"line_number":3880,"context_line":"be the **only** included. This request enables or disables the projects"},{"line_number":3881,"context_line":"recursively: the target project itself **and** all projects below in the"},{"line_number":3882,"context_line":"hierarchy."},{"line_number":3883,"context_line":""},{"line_number":3884,"context_line":"Request:"},{"line_number":3885,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"7aaa499b_1f2c0e01","line":3882,"in_reply_to":"7aaa499b_1f908e42","updated":"2015-04-14 15:00:18.000000000","message":"Done","commit_id":"0c5ef33447bb999084188bb011a074d944c9b265"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"7d26c5cd4b858c5f6ef3b49fc1d4aae5359ccf23","unresolved":false,"context_lines":[{"line_number":3920,"context_line":"*New in version 3.4*"},{"line_number":3921,"context_line":""},{"line_number":3922,"context_line":"- The deletion of a project that is not a leaf in the project hierarchy (does"},{"line_number":3923,"context_line":"  not have children) using this API will fail with a ``403 Forbidden``. Check"},{"line_number":3924,"context_line":"  the ``Delete projects recursively`` section for the appropriate API for this"},{"line_number":3925,"context_line":"  action."},{"line_number":3926,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"7aaa499b_815a034f","line":3923,"updated":"2015-04-14 14:39:14.000000000","message":"same nit","commit_id":"0c5ef33447bb999084188bb011a074d944c9b265"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"ae8af92be94180dffcfd58e5837811a13da5d5f9","unresolved":false,"context_lines":[{"line_number":3920,"context_line":"*New in version 3.4*"},{"line_number":3921,"context_line":""},{"line_number":3922,"context_line":"- The deletion of a project that is not a leaf in the project hierarchy (does"},{"line_number":3923,"context_line":"  not have children) using this API will fail with a ``403 Forbidden``. Check"},{"line_number":3924,"context_line":"  the ``Delete projects recursively`` section for the appropriate API for this"},{"line_number":3925,"context_line":"  action."},{"line_number":3926,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"7aaa499b_dfa58604","line":3923,"in_reply_to":"7aaa499b_815a034f","updated":"2015-04-14 15:00:18.000000000","message":"Done","commit_id":"0c5ef33447bb999084188bb011a074d944c9b265"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"0c8338405d9d3d3b8af303b1505d05c8339ad153","unresolved":false,"context_lines":[{"line_number":17,"context_line":"- Addition of the possibility to request a token for a project with the"},{"line_number":18,"context_line":"  ``is_domain`` flag enabled."},{"line_number":19,"context_line":"- Enable or disable a project recursively: enabling or disabling the project"},{"line_number":20,"context_line":"  itself and its subtree."},{"line_number":21,"context_line":"- Delete a project recursively: deleting the project itself and its subtree."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"What\u0027s New in Version 3.4"}],"source_content_type":"text/x-rst","patch_set":18,"id":"7aaa499b_ba8c0536","line":20,"updated":"2015-04-14 16:31:16.000000000","message":"I still don\u0027t see the benefit of enabling/disabling a project \"recursively\". Are we trying to optimize future project operations at the expense of a potentially large backend transaction? Therefore, saving us having to walk the tree? Problem is I can\u0027t see how we can ever avoid walking the tree. If user is asking for a given tree, we have to walk it to make sure all its members are enabled.","commit_id":"d02c704fc61a99ede1ac5a3878dbe94f1371cc98"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"1bfbae13abbbbdb3992bc3eec56da1115246ef98","unresolved":false,"context_lines":[{"line_number":17,"context_line":"- Addition of the possibility to request a token for a project with the"},{"line_number":18,"context_line":"  ``is_domain`` flag enabled."},{"line_number":19,"context_line":"- Enable or disable a project recursively: enabling or disabling the project"},{"line_number":20,"context_line":"  itself and its subtree."},{"line_number":21,"context_line":"- Delete a project recursively: deleting the project itself and its subtree."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"What\u0027s New in Version 3.4"}],"source_content_type":"text/x-rst","patch_set":18,"id":"7aaa499b_bd863f63","line":20,"in_reply_to":"7aaa499b_ba8c0536","updated":"2015-04-14 16:37:39.000000000","message":"reply in the spec file","commit_id":"d02c704fc61a99ede1ac5a3878dbe94f1371cc98"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"4e0b7b14cc9bc61fc11ccd727737d75b20e41de8","unresolved":false,"context_lines":[{"line_number":3900,"context_line":""},{"line_number":3901,"context_line":"This request deletes projects recursively: the target project itself **and**"},{"line_number":3902,"context_line":"all projects below it in the hierarchy. It is mandatory to first disable the"},{"line_number":3903,"context_line":"hierarchy branch."},{"line_number":3904,"context_line":""},{"line_number":3905,"context_line":"Relationship:"},{"line_number":3906,"context_line":"``http://docs.openstack.org/api/openstack-identity/3/rel/project``"}],"source_content_type":"text/x-rst","patch_set":21,"id":"5aa745d1_a31d35bf","line":3903,"updated":"2015-04-16 17:41:15.000000000","message":"(nit)It is mandatory to disable the\nhierarchy branch first","commit_id":"8f296128aba27ce7c94cb7d08b9c5edf8823f975"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"ffdeb3812ecaed8e99f2e328caacd13923388906","unresolved":false,"context_lines":[{"line_number":3900,"context_line":""},{"line_number":3901,"context_line":"This request deletes projects recursively: the target project itself **and**"},{"line_number":3902,"context_line":"all projects below it in the hierarchy. It is mandatory to first disable the"},{"line_number":3903,"context_line":"hierarchy branch."},{"line_number":3904,"context_line":""},{"line_number":3905,"context_line":"Relationship:"},{"line_number":3906,"context_line":"``http://docs.openstack.org/api/openstack-identity/3/rel/project``"}],"source_content_type":"text/x-rst","patch_set":21,"id":"3ab451fb_fa0d2c38","line":3903,"in_reply_to":"5aa745d1_a31d35bf","updated":"2015-04-17 14:28:24.000000000","message":"Done","commit_id":"8f296128aba27ce7c94cb7d08b9c5edf8823f975"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"727ab1ecaf0379deee0be99deaa73519739439d4","unresolved":false,"context_lines":[{"line_number":3864,"context_line":"  Forbidden``"},{"line_number":3865,"context_line":""},{"line_number":3866,"context_line":"- Disabling a project that has enabled projects in its subtree using this API"},{"line_number":3867,"context_line":"  will fail with a ``403 Forbidden``. See the ``Enable or disable subtree``"},{"line_number":3868,"context_line":"  section for the appropriate API for this action."},{"line_number":3869,"context_line":""},{"line_number":3870,"context_line":"- Enabling a project that has disabled parents will fail with a ``403"}],"source_content_type":"text/x-rst","patch_set":24,"id":"ba3cc151_949f1450","line":3867,"updated":"2015-07-03 19:32:16.000000000","message":"Response 409 is designed for this case. It is irrelevant to this particular change - just to note.","commit_id":"c25d03dca9f09c468f1a3fb91cece605f7ad1ffd"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"d280a2b5e885f229ab4647714ab36753b9c16694","unresolved":false,"context_lines":[{"line_number":3900,"context_line":""},{"line_number":3901,"context_line":"::"},{"line_number":3902,"context_line":""},{"line_number":3903,"context_line":"    Status: 204 No Content"},{"line_number":3904,"context_line":""},{"line_number":3905,"context_line":"- Only the ``enabled`` attribute is accepted. Including other attributes"},{"line_number":3906,"context_line":"  besides ``enabled`` will fail with a ``400 Bad Request``"}],"source_content_type":"text/x-rst","patch_set":24,"id":"bab921fb_7a0ea335","line":3903,"updated":"2015-04-23 17:36:54.000000000","message":"Should this return 200 like other PATCH operations we have?","commit_id":"c25d03dca9f09c468f1a3fb91cece605f7ad1ffd"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"d95ec8d2d7a0911da7370ca5228398b63cfa1a36","unresolved":false,"context_lines":[{"line_number":3900,"context_line":""},{"line_number":3901,"context_line":"::"},{"line_number":3902,"context_line":""},{"line_number":3903,"context_line":"    Status: 204 No Content"},{"line_number":3904,"context_line":""},{"line_number":3905,"context_line":"- Only the ``enabled`` attribute is accepted. Including other attributes"},{"line_number":3906,"context_line":"  besides ``enabled`` will fail with a ``400 Bad Request``"}],"source_content_type":"text/x-rst","patch_set":24,"id":"9abe1de1_d4ec8d91","line":3903,"in_reply_to":"bab921fb_7a0ea335","updated":"2015-04-27 13:23:57.000000000","message":"the initial idea was to have all projects below it disabled so we\u0027d prefer to return only a status representing the operation went as expected. But since we are going to use the \"effectively\" disabled approach, will change this to return the body of the target of the project.","commit_id":"c25d03dca9f09c468f1a3fb91cece605f7ad1ffd"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"ab31732f204a7af5fb2268675b46bbc0c75c58f3","unresolved":false,"context_lines":[{"line_number":3920,"context_line":"- Only the ``enabled`` attribute is accepted. Including other attributes"},{"line_number":3921,"context_line":"  besides ``enabled`` will fail with a ``400 Bad Request``"},{"line_number":3922,"context_line":"- Triggering the action against a project that has any children with the"},{"line_number":3923,"context_line":"  ``is_domain`` flag enabled will fail with a ``403 Forbidden``"},{"line_number":3924,"context_line":""},{"line_number":3925,"context_line":"Delete project"},{"line_number":3926,"context_line":"^^^^^^^^^^^^^^"}],"source_content_type":"text/x-rst","patch_set":25,"id":"7ad32947_2031430c","line":3923,"updated":"2015-04-27 17:10:16.000000000","message":"Is this possible?  User should not be even able to create domain with its parent as project  (is_domain not enabled).","commit_id":"4e41729f9367bec8e8987467993e6fae10c56d78"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"ab31732f204a7af5fb2268675b46bbc0c75c58f3","unresolved":false,"context_lines":[{"line_number":3963,"context_line":"    Status: 204 No Content"},{"line_number":3964,"context_line":""},{"line_number":3965,"context_line":"- Triggering the action against a project that has any children with the"},{"line_number":3966,"context_line":"  ``is_domain`` flag enabled will fail with a ``403 Forbidden``"},{"line_number":3967,"context_line":""},{"line_number":3968,"context_line":"Users"},{"line_number":3969,"context_line":"~~~~~"}],"source_content_type":"text/x-rst","patch_set":25,"id":"7ad32947_204a6384","line":3966,"updated":"2015-04-27 17:10:16.000000000","message":"Same question here","commit_id":"4e41729f9367bec8e8987467993e6fae10c56d78"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"f026fe26e03f78362b9df439ffd78a5cb849d237","unresolved":false,"context_lines":[{"line_number":3894,"context_line":"            \"name\": \"Build Group\","},{"line_number":3895,"context_line":"            \"parent_id\": \"7fa612\""},{"line_number":3896,"context_line":"        }"},{"line_number":3897,"context_line":"    }"},{"line_number":3898,"context_line":""},{"line_number":3899,"context_line":"- Only the ``enabled`` attribute is accepted. Including other attributes"},{"line_number":3900,"context_line":"  besides ``enabled`` will fail with a ``400 Bad Request``"}],"source_content_type":"text/x-rst","patch_set":33,"id":"ba3cc151_71daa979","line":3897,"updated":"2015-07-09 22:13:26.000000000","message":"usability related question, would it be useful to return all the projects that was updated?","commit_id":"7649299eb5ebb9188c2abd653f3d64ff859cca2b"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"e8ea7e9dbd46da415896a48ded9064fd2013054a","unresolved":false,"context_lines":[{"line_number":3894,"context_line":"            \"name\": \"Build Group\","},{"line_number":3895,"context_line":"            \"parent_id\": \"7fa612\""},{"line_number":3896,"context_line":"        }"},{"line_number":3897,"context_line":"    }"},{"line_number":3898,"context_line":""},{"line_number":3899,"context_line":"- Only the ``enabled`` attribute is accepted. Including other attributes"},{"line_number":3900,"context_line":"  besides ``enabled`` will fail with a ``400 Bad Request``"}],"source_content_type":"text/x-rst","patch_set":33,"id":"ba3cc151_a91d2564","line":3897,"in_reply_to":"ba3cc151_71daa979","updated":"2015-07-10 00:39:05.000000000","message":"the overload doesn\u0027t pay off IMHO, the user should be aware that it is disabling everything - also, the user might not have role_assignments in the other projects","commit_id":"7649299eb5ebb9188c2abd653f3d64ff859cca2b"}],"specs/backlog/recursive-deletion.rst":[{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"d280a2b5e885f229ab4647714ab36753b9c16694","unresolved":false,"context_lines":[{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Recursive Deletion"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp recursive-deletion"}],"source_content_type":"text/x-rst","patch_set":24,"id":"bab921fb_5ae87fe2","line":8,"updated":"2015-04-23 17:36:54.000000000","message":"Should this be more generic?  BP does not only cover Deletion here but update of status as well.","commit_id":"c25d03dca9f09c468f1a3fb91cece605f7ad1ffd"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"d95ec8d2d7a0911da7370ca5228398b63cfa1a36","unresolved":false,"context_lines":[{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Recursive Deletion"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp recursive-deletion"}],"source_content_type":"text/x-rst","patch_set":24,"id":"9abe1de1_d4ba4d6e","line":8,"in_reply_to":"bab921fb_5ae87fe2","updated":"2015-04-27 13:23:57.000000000","message":"the disabling is a consequence from delete, I can change the title if you want, but just \"deletion\" looks ok to me.","commit_id":"c25d03dca9f09c468f1a3fb91cece605f7ad1ffd"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"d280a2b5e885f229ab4647714ab36753b9c16694","unresolved":false,"context_lines":[{"line_number":67,"context_line":""},{"line_number":68,"context_line":"Both features lead to access privileges concerns: a user could have delete and"},{"line_number":69,"context_line":"update privileges for a project in a higher level of the hierarchy and not to"},{"line_number":70,"context_line":"some projects in its subtree. Although we could insist that the caller of a"},{"line_number":71,"context_line":"recursive operation has the delete_project and update_project permissions on"},{"line_number":72,"context_line":"every project, it is more likely that in practice a cloud provider will want to"},{"line_number":73,"context_line":"reserve such operations to a very restricted set up users/roles. For this"}],"source_content_type":"text/x-rst","patch_set":24,"id":"bab921fb_5a7d1f1b","line":70,"updated":"2015-04-23 17:36:54.000000000","message":"What if a user is admin, but does not have inherited_roles, can they still delete the whole subtree?","commit_id":"c25d03dca9f09c468f1a3fb91cece605f7ad1ffd"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"d95ec8d2d7a0911da7370ca5228398b63cfa1a36","unresolved":false,"context_lines":[{"line_number":67,"context_line":""},{"line_number":68,"context_line":"Both features lead to access privileges concerns: a user could have delete and"},{"line_number":69,"context_line":"update privileges for a project in a higher level of the hierarchy and not to"},{"line_number":70,"context_line":"some projects in its subtree. Although we could insist that the caller of a"},{"line_number":71,"context_line":"recursive operation has the delete_project and update_project permissions on"},{"line_number":72,"context_line":"every project, it is more likely that in practice a cloud provider will want to"},{"line_number":73,"context_line":"reserve such operations to a very restricted set up users/roles. For this"}],"source_content_type":"text/x-rst","patch_set":24,"id":"9abe1de1_f46c310a","line":70,"in_reply_to":"bab921fb_5a7d1f1b","updated":"2015-04-27 13:23:57.000000000","message":"the roles inheritance won\u0027t matter for the operation, we are adding a new rule that will check only in the target project.","commit_id":"c25d03dca9f09c468f1a3fb91cece605f7ad1ffd"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"02a71999de8eb0ed8803fedaac303100ac2ecb7f","unresolved":false,"context_lines":[{"line_number":78,"context_line":""},{"line_number":79,"context_line":"* Delete: DELETE projects/\u003cproject_id\u003e/cascade"},{"line_number":80,"context_line":"* Update: PATCH projects/\u003cproject_id\u003e/cascade"},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"Specifying ``cascade`` indicates that the request should also be applied to all"},{"line_number":83,"context_line":"children in the hierarchy.  Note that for the update request, the ``enabled``"},{"line_number":84,"context_line":"field is mandatory and the **only** accepted attribute. Including other"}],"source_content_type":"text/x-rst","patch_set":24,"id":"dac4157f_f1773e38","line":81,"updated":"2015-04-22 07:34:55.000000000","message":"I still think this is going to be confusing.  Imagine the case where you have done this disable of a project up the hierarchy (using PATCH /cascade).  I then do a get project in a project somewhere down the hierarchy?  Do I see it as enabled or not?  If I see it as enabled, I won\u0027t understand why I can\u0027t scope to it.  If  I see it as disabled I might true to update it to enabled it....which would have to fail?  Ouch.\n\nI think the true recursive update to set all the projects to enabled\u003dfalse is more obvious.  Yes, it is less efficient....but I can\u0027t imaging recursive deletion is going to be a common command.","commit_id":"c25d03dca9f09c468f1a3fb91cece605f7ad1ffd"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"ee95f08aa777a666a5c548a328af859200124c24","unresolved":false,"context_lines":[{"line_number":78,"context_line":""},{"line_number":79,"context_line":"* Delete: DELETE projects/\u003cproject_id\u003e/cascade"},{"line_number":80,"context_line":"* Update: PATCH projects/\u003cproject_id\u003e/cascade"},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"Specifying ``cascade`` indicates that the request should also be applied to all"},{"line_number":83,"context_line":"children in the hierarchy.  Note that for the update request, the ``enabled``"},{"line_number":84,"context_line":"field is mandatory and the **only** accepted attribute. Including other"}],"source_content_type":"text/x-rst","patch_set":24,"id":"dac4157f_de1f9106","line":81,"in_reply_to":"dac4157f_4aff4867","updated":"2015-04-22 15:49:11.000000000","message":"That\u0027s correct. This is consistent with the existing behavior. Currently, disabling a domain effectively disabled all resources contained in that domain, namely users, projects, and groups. There are no recursive update because the operation is inherently expensive.\n\nAlternatively, we can replace the \u0027enable\u0027 field dynamically on GET by checking it against the parent hierarchy if it makes it more user friendly.","commit_id":"c25d03dca9f09c468f1a3fb91cece605f7ad1ffd"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"a7b42044571bdbd1131962102c170f9d61fd296e","unresolved":false,"context_lines":[{"line_number":78,"context_line":""},{"line_number":79,"context_line":"* Delete: DELETE projects/\u003cproject_id\u003e/cascade"},{"line_number":80,"context_line":"* Update: PATCH projects/\u003cproject_id\u003e/cascade"},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"Specifying ``cascade`` indicates that the request should also be applied to all"},{"line_number":83,"context_line":"children in the hierarchy.  Note that for the update request, the ``enabled``"},{"line_number":84,"context_line":"field is mandatory and the **only** accepted attribute. Including other"}],"source_content_type":"text/x-rst","patch_set":24,"id":"dac4157f_4aff4867","line":81,"in_reply_to":"dac4157f_f1773e38","updated":"2015-04-22 11:21:41.000000000","message":"Isn\u0027t this behavior the same we have today when we disable a domain? All projects in a domain are \"effectively\" disabled if its domain is disabled, right? But the project refs returned in get_project have enabled: true. (I asked exactly the same question to Guang in IRC, when discussing this approach)","commit_id":"c25d03dca9f09c468f1a3fb91cece605f7ad1ffd"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"d280a2b5e885f229ab4647714ab36753b9c16694","unresolved":false,"context_lines":[{"line_number":82,"context_line":"Specifying ``cascade`` indicates that the request should also be applied to all"},{"line_number":83,"context_line":"children in the hierarchy.  Note that for the update request, the ``enabled``"},{"line_number":84,"context_line":"field is mandatory and the **only** accepted attribute. Including other"},{"line_number":85,"context_line":"attributes will raise an error."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"With the `Reseller \u003chttps://review.openstack.org/#/c/139824/\u003e`_ spec, domains"},{"line_number":88,"context_line":"are projects, in this way we have the following behavior:"}],"source_content_type":"text/x-rst","patch_set":24,"id":"bab921fb_9a5a9782","line":85,"updated":"2015-04-23 17:36:54.000000000","message":"Recursively enabling projects is tricky.  Imagine there is BAD project in the subtree, so the admin disabled it.   If for some reason the Project tree got disabled then enabled. The BAD project is enabled again.\n\nI am not sure how to handle this in our current model, but this is one use case that we hit before.","commit_id":"c25d03dca9f09c468f1a3fb91cece605f7ad1ffd"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"6fc99c6a4198b6310585730bcc2a692f6834deb1","unresolved":false,"context_lines":[{"line_number":82,"context_line":"Specifying ``cascade`` indicates that the request should also be applied to all"},{"line_number":83,"context_line":"children in the hierarchy.  Note that for the update request, the ``enabled``"},{"line_number":84,"context_line":"field is mandatory and the **only** accepted attribute. Including other"},{"line_number":85,"context_line":"attributes will raise an error."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"With the `Reseller \u003chttps://review.openstack.org/#/c/139824/\u003e`_ spec, domains"},{"line_number":88,"context_line":"are projects, in this way we have the following behavior:"}],"source_content_type":"text/x-rst","patch_set":24,"id":"7ad32947_b3024f6e","line":85,"in_reply_to":"9abe1de1_d43fedd4","updated":"2015-04-27 17:09:57.000000000","message":"I don\u0027t get how the proposal solves the problem. If the admin cascade enabled, all projects still get enabled even the previous BAD one.","commit_id":"c25d03dca9f09c468f1a3fb91cece605f7ad1ffd"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"d95ec8d2d7a0911da7370ca5228398b63cfa1a36","unresolved":false,"context_lines":[{"line_number":82,"context_line":"Specifying ``cascade`` indicates that the request should also be applied to all"},{"line_number":83,"context_line":"children in the hierarchy.  Note that for the update request, the ``enabled``"},{"line_number":84,"context_line":"field is mandatory and the **only** accepted attribute. Including other"},{"line_number":85,"context_line":"attributes will raise an error."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"With the `Reseller \u003chttps://review.openstack.org/#/c/139824/\u003e`_ spec, domains"},{"line_number":88,"context_line":"are projects, in this way we have the following behavior:"}],"source_content_type":"text/x-rst","patch_set":24,"id":"9abe1de1_d43fedd4","line":85,"in_reply_to":"bab921fb_9a5a9782","updated":"2015-04-27 13:23:57.000000000","message":"that is one reason why we are prosing to enable/disable the target project and its subtree would be \"effectively\" enabled/disabled","commit_id":"c25d03dca9f09c468f1a3fb91cece605f7ad1ffd"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"d280a2b5e885f229ab4647714ab36753b9c16694","unresolved":false,"context_lines":[{"line_number":101,"context_line":"For **leaf** domains, the ``cascade`` APIs have the same effect as the regular"},{"line_number":102,"context_line":"update and delete domain operations, but they will be enforced by **different**"},{"line_number":103,"context_line":"rules in the policy file."},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"Alternatives"},{"line_number":106,"context_line":"------------"},{"line_number":107,"context_line":""}],"source_content_type":"text/x-rst","patch_set":24,"id":"bab921fb_9a41770e","line":104,"updated":"2015-04-23 17:36:54.000000000","message":"How will this impact the pycadf notification?  Will it generate a notification for each project in the subtree?","commit_id":"c25d03dca9f09c468f1a3fb91cece605f7ad1ffd"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"d95ec8d2d7a0911da7370ca5228398b63cfa1a36","unresolved":false,"context_lines":[{"line_number":101,"context_line":"For **leaf** domains, the ``cascade`` APIs have the same effect as the regular"},{"line_number":102,"context_line":"update and delete domain operations, but they will be enforced by **different**"},{"line_number":103,"context_line":"rules in the policy file."},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"Alternatives"},{"line_number":106,"context_line":"------------"},{"line_number":107,"context_line":""}],"source_content_type":"text/x-rst","patch_set":24,"id":"9abe1de1_742f01a2","line":104,"in_reply_to":"bab921fb_9a41770e","updated":"2015-04-27 13:23:57.000000000","message":"yes!","commit_id":"c25d03dca9f09c468f1a3fb91cece605f7ad1ffd"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"d280a2b5e885f229ab4647714ab36753b9c16694","unresolved":false,"context_lines":[{"line_number":112,"context_line":"  recursively disabled/enabled. This approach follows the current rule applied"},{"line_number":113,"context_line":"  in the project hierarchy, where we can\u0027t have a disabled project with"},{"line_number":114,"context_line":"  enabled children. This approach has the downside of triggering multiple"},{"line_number":115,"context_line":"  writes in the database."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"Don\u0027t add a new rule in the policy file:"},{"line_number":118,"context_line":""}],"source_content_type":"text/x-rst","patch_set":24,"id":"bab921fb_7a034374","line":115,"updated":"2015-04-23 17:36:54.000000000","message":"does the recursive update also require multiple writes in database since each Project status is in their own database row?","commit_id":"c25d03dca9f09c468f1a3fb91cece605f7ad1ffd"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"6fc99c6a4198b6310585730bcc2a692f6834deb1","unresolved":false,"context_lines":[{"line_number":112,"context_line":"  recursively disabled/enabled. This approach follows the current rule applied"},{"line_number":113,"context_line":"  in the project hierarchy, where we can\u0027t have a disabled project with"},{"line_number":114,"context_line":"  enabled children. This approach has the downside of triggering multiple"},{"line_number":115,"context_line":"  writes in the database."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"Don\u0027t add a new rule in the policy file:"},{"line_number":118,"context_line":""}],"source_content_type":"text/x-rst","patch_set":24,"id":"7ad32947_9672a17b","line":115,"in_reply_to":"9abe1de1_34186984","updated":"2015-04-27 17:09:57.000000000","message":"hmm so it is not really a downside, since this and proposed approached both have multiple writes in the DB :)","commit_id":"c25d03dca9f09c468f1a3fb91cece605f7ad1ffd"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"d95ec8d2d7a0911da7370ca5228398b63cfa1a36","unresolved":false,"context_lines":[{"line_number":112,"context_line":"  recursively disabled/enabled. This approach follows the current rule applied"},{"line_number":113,"context_line":"  in the project hierarchy, where we can\u0027t have a disabled project with"},{"line_number":114,"context_line":"  enabled children. This approach has the downside of triggering multiple"},{"line_number":115,"context_line":"  writes in the database."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"Don\u0027t add a new rule in the policy file:"},{"line_number":118,"context_line":""}],"source_content_type":"text/x-rst","patch_set":24,"id":"9abe1de1_34186984","line":115,"in_reply_to":"bab921fb_7a034374","updated":"2015-04-27 13:23:57.000000000","message":"yes","commit_id":"c25d03dca9f09c468f1a3fb91cece605f7ad1ffd"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"ab31732f204a7af5fb2268675b46bbc0c75c58f3","unresolved":false,"context_lines":[{"line_number":18,"context_line":"In the first version of Hierarchical Multitenancy (kilo-1), a project deletion"},{"line_number":19,"context_line":"was allowed only for leaf projects in the hierarchy. With this restriction, it"},{"line_number":20,"context_line":"is necessary to delete projects one by one (starting from the leafs) in order"},{"line_number":21,"context_line":"to delete a whole hierarchy branch."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"For example, considering the following hierarchy::"},{"line_number":24,"context_line":""}],"source_content_type":"text/x-rst","patch_set":25,"id":"7ad32947_d3402b0a","line":21,"updated":"2015-04-27 17:10:16.000000000","message":"Actually, been thinking about this. At first I thought it would be nice to have this feature, but later I realized this would be really dangerous to use in production.  Because deleting a project should involve cleaning up resources, and keystone don\u0027t do that.\n\nI wonder what other reviewers thought on this.","commit_id":"4e41729f9367bec8e8987467993e6fae10c56d78"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"ab31732f204a7af5fb2268675b46bbc0c75c58f3","unresolved":false,"context_lines":[{"line_number":89,"context_line":""},{"line_number":90,"context_line":"* We will be able to have a hierarchy of domains. In this hierarchy, we won\u0027t"},{"line_number":91,"context_line":"  have domains under projects, but only domains under domains;"},{"line_number":92,"context_line":"* We will only allow the recursive behavior to affect \"pure\" projects. If we"},{"line_number":93,"context_line":"  trigger the recursive actions on a \"pure\" project we are certain it will"},{"line_number":94,"context_line":"  never hit a domain as per consequence of the previous point."},{"line_number":95,"context_line":""}],"source_content_type":"text/x-rst","patch_set":25,"id":"7ad32947_d37b8b7a","line":92,"updated":"2015-04-27 17:10:16.000000000","message":"If we are merging project and domain concept,  why not support the cascade for domains too?\n\nIt would be confusing that the project API can be used to create \"is_domain\" project, but not all API works.","commit_id":"4e41729f9367bec8e8987467993e6fae10c56d78"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"9c045a9d87438a5659408348ec6926935fdb8307","unresolved":false,"context_lines":[{"line_number":82,"context_line":"Specifying ``cascade`` indicates that the request should also be applied to all"},{"line_number":83,"context_line":"children in the hierarchy.  Note that for the update request, the ``enabled``"},{"line_number":84,"context_line":"field is mandatory and the **only** accepted attribute. Including other"},{"line_number":85,"context_line":"attributes will raise an error."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"With the `Reseller \u003chttps://review.openstack.org/#/c/139824/\u003e`_ spec, domains"},{"line_number":88,"context_line":"are projects, in this way we have the following behavior:"}],"source_content_type":"text/x-rst","patch_set":26,"id":"7ad32947_319517e4","line":85,"updated":"2015-04-27 17:45:01.000000000","message":"So I\u0027m still struggling with this. If I am reading this right,\n\n PATCH projects/\u003cproject_id\u003e/cascade\n PATCH projects/\u003cproject_id\u003e\n\ndo different things (and are controlled by different policy entries). Are the \"different  enabled flags\" encoded differently in the entity? If so, how do I determine this by inspection?  I.e. if I read back the project and look at the enabled flag, how will I know if the cascade option was used (in which case a delete/cascade will work) or whether just the project itself had been disabled (in which case I assume a delete/cascade wouldn\u0027t work)?\n\nThe reason the above works for existing domains....is that the domain enabled flag is a different flag to the project enabled flag.","commit_id":"688ee2966f352630ef359d6efc84c99e8f7fc250"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"6a998d881811ee791a66e7bea9357883230ed253","unresolved":false,"context_lines":[{"line_number":82,"context_line":"Specifying ``cascade`` indicates that the request should also be applied to all"},{"line_number":83,"context_line":"children in the hierarchy.  Note that for the update request, the ``enabled``"},{"line_number":84,"context_line":"field is mandatory and the **only** accepted attribute. Including other"},{"line_number":85,"context_line":"attributes will raise an error."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"With the `Reseller \u003chttps://review.openstack.org/#/c/139824/\u003e`_ spec, domains"},{"line_number":88,"context_line":"are projects, in this way we have the following behavior:"}],"source_content_type":"text/x-rst","patch_set":26,"id":"fa32b979_800fd537","line":85,"in_reply_to":"7ad32947_319517e4","updated":"2015-06-25 18:08:52.000000000","message":"You are right, but I imagine this as being an additional controller method (not update()). The regular update stays checking if the project has any children we don\u0027t allow to disable the project.\n\nIn the new disable_tree() (or something similar) we allow to update a project with children.","commit_id":"688ee2966f352630ef359d6efc84c99e8f7fc250"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"0b5050bf36ed9213e335b9c5a021dc392b0b42db","unresolved":false,"context_lines":[{"line_number":82,"context_line":"Specifying ``cascade`` indicates that the request should also be applied to all"},{"line_number":83,"context_line":"children in the hierarchy.  Note that for the update request, the ``enabled``"},{"line_number":84,"context_line":"field is mandatory and the **only** accepted attribute. Including other"},{"line_number":85,"context_line":"attributes will raise an error."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"With the `Reseller \u003chttps://review.openstack.org/#/c/139824/\u003e`_ spec, domains"},{"line_number":88,"context_line":"are projects, in this way we have the following behavior:"}],"source_content_type":"text/x-rst","patch_set":27,"id":"7ad32947_08b7693a","line":85,"updated":"2015-04-28 14:34:30.000000000","message":"Please address henry-nash\u0027s comment in patch 26.","commit_id":"5c3300978d158be8698828aef95a1e436c376df7"}],"specs/backlog/tree-deletion.rst":[{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"ec7564b853342655b9caa6ebe80c44ed487ae8be","unresolved":false,"context_lines":[{"line_number":97,"context_line":"* By default we will only allow the recursive behavior to affect \"pure\""},{"line_number":98,"context_line":"  projects (``is_domain \u003d false``). If we trigger the recursive actions on a"},{"line_number":99,"context_line":"  \"pure\" project we are certain it will never hit a domain as per consequence"},{"line_number":100,"context_line":"  of the point above. This behavior can be changed by updating the rule in"},{"line_number":101,"context_line":"  keystone\u0027s policy file."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"For **leaf** domains, the ``cascade`` APIs have the same effect as the regular"}],"source_content_type":"text/x-rst","patch_set":31,"id":"ba3cc151_e344da4a","line":100,"updated":"2015-07-02 17:41:59.000000000","message":"So what are examples of how this behavior can be changed by updating the rule in the policy file? You need to give examples here to make it clear what the other valid options are.","commit_id":"a58e3595a85c66546e8b3d7c3173bfbe97106d19"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"46d1273f4716453ab23197a3694f0841a21c339c","unresolved":false,"context_lines":[{"line_number":97,"context_line":"* By default we will only allow the recursive behavior to affect \"pure\""},{"line_number":98,"context_line":"  projects (``is_domain \u003d false``). If we trigger the recursive actions on a"},{"line_number":99,"context_line":"  \"pure\" project we are certain it will never hit a domain as per consequence"},{"line_number":100,"context_line":"  of the point above. This behavior can be changed by updating the rule in"},{"line_number":101,"context_line":"  keystone\u0027s policy file."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"For **leaf** domains, the ``cascade`` APIs have the same effect as the regular"}],"source_content_type":"text/x-rst","patch_set":31,"id":"ba3cc151_119ebd62","line":100,"in_reply_to":"ba3cc151_b342790d","updated":"2015-07-03 14:38:32.000000000","message":"rephrased this, noticed some incosistencies with this paragraph. Please let me know if an example is still required :)","commit_id":"a58e3595a85c66546e8b3d7c3173bfbe97106d19"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"d7dfa75490921e46cfcae4e16e2edf9acdc89631","unresolved":false,"context_lines":[{"line_number":97,"context_line":"* By default we will only allow the recursive behavior to affect \"pure\""},{"line_number":98,"context_line":"  projects (``is_domain \u003d false``). If we trigger the recursive actions on a"},{"line_number":99,"context_line":"  \"pure\" project we are certain it will never hit a domain as per consequence"},{"line_number":100,"context_line":"  of the point above. This behavior can be changed by updating the rule in"},{"line_number":101,"context_line":"  keystone\u0027s policy file."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"For **leaf** domains, the ``cascade`` APIs have the same effect as the regular"}],"source_content_type":"text/x-rst","patch_set":31,"id":"ba3cc151_b342790d","line":100,"in_reply_to":"ba3cc151_e344da4a","updated":"2015-07-03 13:46:12.000000000","message":"++ will rephrase this and add an example","commit_id":"a58e3595a85c66546e8b3d7c3173bfbe97106d19"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"f026fe26e03f78362b9df439ffd78a5cb849d237","unresolved":false,"context_lines":[{"line_number":124,"context_line":"---------------"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"New rules in the policy.json file to control the access to the recursive"},{"line_number":127,"context_line":"deletion and disabling of projects/domains."},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"Notifications Impact"},{"line_number":130,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":33,"id":"ba3cc151_6cce525b","line":127,"updated":"2015-07-09 22:13:26.000000000","message":"I like that it has a new policy for this feature","commit_id":"7649299eb5ebb9188c2abd653f3d64ff859cca2b"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"f026fe26e03f78362b9df439ffd78a5cb849d237","unresolved":false,"context_lines":[{"line_number":130,"context_line":"--------------------"},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"A pycadf notification should be triggered for each project that is deleted or"},{"line_number":133,"context_line":"**effectively** disabled/enabled."},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"Other End User Impact"},{"line_number":136,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":33,"id":"ba3cc151_ece102d1","line":133,"updated":"2015-07-09 22:13:26.000000000","message":"we probably need to send out the notification in sequence, from child to parent.  This way the quota driver in other service can process the notification properly when free-ing the quota to its parent project.\n\nMaybe note it down in the specs?","commit_id":"7649299eb5ebb9188c2abd653f3d64ff859cca2b"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"e8ea7e9dbd46da415896a48ded9064fd2013054a","unresolved":false,"context_lines":[{"line_number":130,"context_line":"--------------------"},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"A pycadf notification should be triggered for each project that is deleted or"},{"line_number":133,"context_line":"**effectively** disabled/enabled."},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"Other End User Impact"},{"line_number":136,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":33,"id":"ba3cc151_492fb988","line":133,"in_reply_to":"ba3cc151_ece102d1","updated":"2015-07-10 00:39:05.000000000","message":"++ will add this details","commit_id":"7649299eb5ebb9188c2abd653f3d64ff859cca2b"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"e461cf3acd1b6c6d1bc24ced661b37fda5befcf1","unresolved":false,"context_lines":[{"line_number":92,"context_line":"are projects, in this way we have the following behavior:"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"* We will be able to have a hierarchy of projects that behaves as domains."},{"line_number":95,"context_line":"  In this hierarchy, we won\u0027t have projects that behaves as domains under"},{"line_number":96,"context_line":"  \"pure\" projects, but only domains under domains;"},{"line_number":97,"context_line":"* By default we will only allow the recursive behavior to affect \"pure\""},{"line_number":98,"context_line":"  projects (``is_domain \u003d false``). If we trigger the recursive actions on a"}],"source_content_type":"text/x-rst","patch_set":34,"id":"9a41bdd9_5e31a4eb","line":95,"updated":"2015-07-11 12:31:58.000000000","message":"s/behaves/behave/","commit_id":"7d874b3260bb048a53fe280d3e6346d06d68c976"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"b83d37d326774849e5dcb8212d0e35f3644a29c9","unresolved":false,"context_lines":[{"line_number":92,"context_line":"are projects, in this way we have the following behavior:"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"* We will be able to have a hierarchy of projects that behaves as domains."},{"line_number":95,"context_line":"  In this hierarchy, we won\u0027t have projects that behaves as domains under"},{"line_number":96,"context_line":"  \"pure\" projects, but only domains under domains;"},{"line_number":97,"context_line":"* By default we will only allow the recursive behavior to affect \"pure\""},{"line_number":98,"context_line":"  projects (``is_domain \u003d false``). If we trigger the recursive actions on a"}],"source_content_type":"text/x-rst","patch_set":34,"id":"9a41bdd9_3a32fa5f","line":95,"in_reply_to":"9a41bdd9_5e31a4eb","updated":"2015-07-15 12:46:30.000000000","message":"Done","commit_id":"7d874b3260bb048a53fe280d3e6346d06d68c976"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"e461cf3acd1b6c6d1bc24ced661b37fda5befcf1","unresolved":false,"context_lines":[{"line_number":93,"context_line":""},{"line_number":94,"context_line":"* We will be able to have a hierarchy of projects that behaves as domains."},{"line_number":95,"context_line":"  In this hierarchy, we won\u0027t have projects that behaves as domains under"},{"line_number":96,"context_line":"  \"pure\" projects, but only domains under domains;"},{"line_number":97,"context_line":"* By default we will only allow the recursive behavior to affect \"pure\""},{"line_number":98,"context_line":"  projects (``is_domain \u003d false``). If we trigger the recursive actions on a"},{"line_number":99,"context_line":"  \"pure\" project we are certain it will never hit a domain as per consequence"}],"source_content_type":"text/x-rst","patch_set":34,"id":"9a41bdd9_9e65ece2","line":96,"updated":"2015-07-11 12:31:58.000000000","message":"This second sentence is rather confusing given the first one.  Is this what you are trying to say:\n\nSince a project acting as domain can only appear as the root of a hierarchy of regular projects (and never in the middle), the update and delete options on the hierarchy will now operate like their domain API equivalent.","commit_id":"7d874b3260bb048a53fe280d3e6346d06d68c976"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"b83d37d326774849e5dcb8212d0e35f3644a29c9","unresolved":false,"context_lines":[{"line_number":93,"context_line":""},{"line_number":94,"context_line":"* We will be able to have a hierarchy of projects that behaves as domains."},{"line_number":95,"context_line":"  In this hierarchy, we won\u0027t have projects that behaves as domains under"},{"line_number":96,"context_line":"  \"pure\" projects, but only domains under domains;"},{"line_number":97,"context_line":"* By default we will only allow the recursive behavior to affect \"pure\""},{"line_number":98,"context_line":"  projects (``is_domain \u003d false``). If we trigger the recursive actions on a"},{"line_number":99,"context_line":"  \"pure\" project we are certain it will never hit a domain as per consequence"}],"source_content_type":"text/x-rst","patch_set":34,"id":"9a41bdd9_3a199ad7","line":96,"in_reply_to":"9a41bdd9_9e65ece2","updated":"2015-07-15 12:46:30.000000000","message":"Done","commit_id":"7d874b3260bb048a53fe280d3e6346d06d68c976"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"e461cf3acd1b6c6d1bc24ced661b37fda5befcf1","unresolved":false,"context_lines":[{"line_number":98,"context_line":"  projects (``is_domain \u003d false``). If we trigger the recursive actions on a"},{"line_number":99,"context_line":"  \"pure\" project we are certain it will never hit a domain as per consequence"},{"line_number":100,"context_line":"  of the point above. This behavior can be changed by updating the rule in"},{"line_number":101,"context_line":"  keystone\u0027s policy file."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"For **leaf** domains, the ``cascade`` APIs have the same effect as the regular"},{"line_number":104,"context_line":"update and delete domain operations, but they will be enforced by **different**"}],"source_content_type":"text/x-rst","patch_set":34,"id":"9a41bdd9_1eeebc22","line":101,"updated":"2015-07-11 12:31:58.000000000","message":"not sure what can be changed via the policy file here...do you mean we allow we can allow it to affect non pure projects?","commit_id":"7d874b3260bb048a53fe280d3e6346d06d68c976"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"b83d37d326774849e5dcb8212d0e35f3644a29c9","unresolved":false,"context_lines":[{"line_number":98,"context_line":"  projects (``is_domain \u003d false``). If we trigger the recursive actions on a"},{"line_number":99,"context_line":"  \"pure\" project we are certain it will never hit a domain as per consequence"},{"line_number":100,"context_line":"  of the point above. This behavior can be changed by updating the rule in"},{"line_number":101,"context_line":"  keystone\u0027s policy file."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"For **leaf** domains, the ``cascade`` APIs have the same effect as the regular"},{"line_number":104,"context_line":"update and delete domain operations, but they will be enforced by **different**"}],"source_content_type":"text/x-rst","patch_set":34,"id":"9a41bdd9_5549d15e","line":101,"in_reply_to":"9a41bdd9_1eeebc22","updated":"2015-07-15 12:46:30.000000000","message":"yes, if we put is_domain\u003dtrue in the rule, it could affect non pure projects, right?","commit_id":"7d874b3260bb048a53fe280d3e6346d06d68c976"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"a4ec0f550fe408998dd653f7d14ce49af3238efe","unresolved":false,"context_lines":[{"line_number":136,"context_line":"**effectively** disabled/enabled - they will be triggered from child to parent,"},{"line_number":137,"context_line":"this way the quota driver in other service can process the notification"},{"line_number":138,"context_line":"properly when free-ing the quota to its parent project."},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"Other End User Impact"},{"line_number":141,"context_line":"---------------------"},{"line_number":142,"context_line":""}],"source_content_type":"text/x-rst","patch_set":34,"id":"9a41bdd9_c63b5dea","line":139,"updated":"2015-07-13 21:24:16.000000000","message":"nit: s/free-ing/freeing/","commit_id":"7d874b3260bb048a53fe280d3e6346d06d68c976"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"b83d37d326774849e5dcb8212d0e35f3644a29c9","unresolved":false,"context_lines":[{"line_number":136,"context_line":"**effectively** disabled/enabled - they will be triggered from child to parent,"},{"line_number":137,"context_line":"this way the quota driver in other service can process the notification"},{"line_number":138,"context_line":"properly when free-ing the quota to its parent project."},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"Other End User Impact"},{"line_number":141,"context_line":"---------------------"},{"line_number":142,"context_line":""}],"source_content_type":"text/x-rst","patch_set":34,"id":"9a41bdd9_1576e9a3","line":139,"in_reply_to":"9a41bdd9_c63b5dea","updated":"2015-07-15 12:46:30.000000000","message":"Done","commit_id":"7d874b3260bb048a53fe280d3e6346d06d68c976"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"a4ec0f550fe408998dd653f7d14ce49af3238efe","unresolved":false,"context_lines":[{"line_number":196,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":197,"context_line":""},{"line_number":198,"context_line":"* `HM Kilo Summit \u003chttps://etherpad.openstack.org/p/hierarchical-multitenancy-kilo-summit\u003e`_"},{"line_number":199,"context_line":"* `Reseller`"},{"line_number":200,"context_line":""}],"source_content_type":"text/x-rst","patch_set":34,"id":"9a41bdd9_a6fe5936","line":199,"updated":"2015-07-13 21:24:16.000000000","message":"Recommend adding PyCADF to the references above, and this link http://docs.openstack.org/developer/pycadf/","commit_id":"7d874b3260bb048a53fe280d3e6346d06d68c976"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"b83d37d326774849e5dcb8212d0e35f3644a29c9","unresolved":false,"context_lines":[{"line_number":196,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":197,"context_line":""},{"line_number":198,"context_line":"* `HM Kilo Summit \u003chttps://etherpad.openstack.org/p/hierarchical-multitenancy-kilo-summit\u003e`_"},{"line_number":199,"context_line":"* `Reseller`"},{"line_number":200,"context_line":""}],"source_content_type":"text/x-rst","patch_set":34,"id":"9a41bdd9_d56ba1b7","line":199,"in_reply_to":"9a41bdd9_a6fe5936","updated":"2015-07-15 12:46:30.000000000","message":"Done","commit_id":"7d874b3260bb048a53fe280d3e6346d06d68c976"}],"specs/kilo/recursive-deletion.rst":[{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"34743d418bd627254f7710c587c6a07a36b4de7a","unresolved":false,"context_lines":[{"line_number":18,"context_line":"In the first version of Hierarchical Multitenancy (kilo-1), a project deletion"},{"line_number":19,"context_line":"was allowed only for leaf projects in the hierarchy. In this way, it is"},{"line_number":20,"context_line":"necessary to delete projects one by one (starting from the leafs) in order to"},{"line_number":21,"context_line":"delete a whole hierarchy branch."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"For example, considering the following hierarchy::"},{"line_number":24,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a930d6b_e33196a3","line":21,"updated":"2015-01-21 17:16:27.000000000","message":"Great problem description!","commit_id":"2043dc7b7faa95c202f01056e2b10dc68d3525fc"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"34743d418bd627254f7710c587c6a07a36b4de7a","unresolved":false,"context_lines":[{"line_number":62,"context_line":"The new endpoints can have the following format:"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"* DELETE projects/\u003cproject_id\u003e/cascade"},{"line_number":65,"context_line":"* PUT projects/\u003cproject_id\u003e/cascade"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"Where ``cascade`` represents that the request would have effect to lower levels"},{"line_number":68,"context_line":"of the hierarchy. Note that for the PUT request, other fields could be changed"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a930d6b_c3bc9a6f","line":65,"updated":"2015-01-21 17:16:27.000000000","message":"Can you please be more descriptive on what the PUT projects/\u003cproject_id\u003e does and how PUT projects/\u003cproject_id\u003e/cascade would differ.   The DELETE was very self evident but explaining the PUT a little more would help","commit_id":"2043dc7b7faa95c202f01056e2b10dc68d3525fc"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"7c2a23f273388ca40c330ac69b9806e58006a5ef","unresolved":false,"context_lines":[{"line_number":62,"context_line":"The new endpoints can have the following format:"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"* DELETE projects/\u003cproject_id\u003e/cascade"},{"line_number":65,"context_line":"* PUT projects/\u003cproject_id\u003e/cascade"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"Where ``cascade`` represents that the request would have effect to lower levels"},{"line_number":68,"context_line":"of the hierarchy. Note that for the PUT request, other fields could be changed"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a930d6b_beeec189","line":65,"in_reply_to":"1a930d6b_c3bc9a6f","updated":"2015-01-21 17:38:08.000000000","message":"++\n\nWill make clear what each request represents.","commit_id":"2043dc7b7faa95c202f01056e2b10dc68d3525fc"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"d394e23a1cfdaa3bcfac8a33f32d40f1f430b36e","unresolved":false,"context_lines":[{"line_number":47,"context_line":"the user to specify a project that is not a leaf in the hierarchy for removal."},{"line_number":48,"context_line":"In this way, the project itself along with its whole subtree will be deleted."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"In order to delete a project, it should be first disabled. Currently, this"},{"line_number":51,"context_line":"follows the same behavior as the project deletion: the user would have to"},{"line_number":52,"context_line":"manually disable the project\u0027s children to disable a project that is in a"},{"line_number":53,"context_line":"higher level of the hierarchy. Thus, this spec also proposes the possibility to"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa81d914_306870f5","line":50,"updated":"2015-01-27 19:37:09.000000000","message":"\"it must be first disabled.\"","commit_id":"13c14d22d119fa42d6e47ce1743f939bc75b6f07"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"a80923ad9b6779c72997b46fcdfcd95f068fe337","unresolved":false,"context_lines":[{"line_number":47,"context_line":"the user to specify a project that is not a leaf in the hierarchy for removal."},{"line_number":48,"context_line":"In this way, the project itself along with its whole subtree will be deleted."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"In order to delete a project, it should be first disabled. Currently, this"},{"line_number":51,"context_line":"follows the same behavior as the project deletion: the user would have to"},{"line_number":52,"context_line":"manually disable the project\u0027s children to disable a project that is in a"},{"line_number":53,"context_line":"higher level of the hierarchy. Thus, this spec also proposes the possibility to"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa81d914_1ea1bda9","line":50,"in_reply_to":"fa81d914_306870f5","updated":"2015-01-27 20:18:38.000000000","message":"Done","commit_id":"13c14d22d119fa42d6e47ce1743f939bc75b6f07"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"d394e23a1cfdaa3bcfac8a33f32d40f1f430b36e","unresolved":false,"context_lines":[{"line_number":50,"context_line":"In order to delete a project, it should be first disabled. Currently, this"},{"line_number":51,"context_line":"follows the same behavior as the project deletion: the user would have to"},{"line_number":52,"context_line":"manually disable the project\u0027s children to disable a project that is in a"},{"line_number":53,"context_line":"higher level of the hierarchy. Thus, this spec also proposes the possibility to"},{"line_number":54,"context_line":"disable a project along with its subtree."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"Both features lead to access privileges concerns: a user could have delete and"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa81d914_f07df8b2","line":53,"updated":"2015-01-27 19:37:09.000000000","message":"Not sure if I understand this sentence. Are you implying that a project can only be disabled if all its children are disabled? Like disabling a domain today, all its resources (i.e. users, groups, and projects) are effectively disabled because we can get a token associated with these resources.","commit_id":"13c14d22d119fa42d6e47ce1743f939bc75b6f07"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"a80923ad9b6779c72997b46fcdfcd95f068fe337","unresolved":false,"context_lines":[{"line_number":50,"context_line":"In order to delete a project, it should be first disabled. Currently, this"},{"line_number":51,"context_line":"follows the same behavior as the project deletion: the user would have to"},{"line_number":52,"context_line":"manually disable the project\u0027s children to disable a project that is in a"},{"line_number":53,"context_line":"higher level of the hierarchy. Thus, this spec also proposes the possibility to"},{"line_number":54,"context_line":"disable a project along with its subtree."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"Both features lead to access privileges concerns: a user could have delete and"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa81d914_be919154","line":53,"in_reply_to":"fa81d914_f07df8b2","updated":"2015-01-27 20:18:38.000000000","message":"yes, right now the project disabling doesn\u0027t have this cascade behaviour","commit_id":"13c14d22d119fa42d6e47ce1743f939bc75b6f07"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"d394e23a1cfdaa3bcfac8a33f32d40f1f430b36e","unresolved":false,"context_lines":[{"line_number":53,"context_line":"higher level of the hierarchy. Thus, this spec also proposes the possibility to"},{"line_number":54,"context_line":"disable a project along with its subtree."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"Both features lead to access privileges concerns: a user could have delete and"},{"line_number":57,"context_line":"update privileges for a project in a higher level of the hierarchy and not to"},{"line_number":58,"context_line":"some projects in its subtree. For this reason, there is the need for new rules"},{"line_number":59,"context_line":"in the keystone ``policy.json`` file and, therefore, new API endpoints to"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa81d914_1018cc83","line":56,"updated":"2015-01-27 19:37:09.000000000","message":"could have deleted and updated","commit_id":"13c14d22d119fa42d6e47ce1743f939bc75b6f07"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"a80923ad9b6779c72997b46fcdfcd95f068fe337","unresolved":false,"context_lines":[{"line_number":53,"context_line":"higher level of the hierarchy. Thus, this spec also proposes the possibility to"},{"line_number":54,"context_line":"disable a project along with its subtree."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"Both features lead to access privileges concerns: a user could have delete and"},{"line_number":57,"context_line":"update privileges for a project in a higher level of the hierarchy and not to"},{"line_number":58,"context_line":"some projects in its subtree. For this reason, there is the need for new rules"},{"line_number":59,"context_line":"in the keystone ``policy.json`` file and, therefore, new API endpoints to"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa81d914_de9e4563","line":56,"in_reply_to":"fa81d914_1018cc83","updated":"2015-01-27 20:18:38.000000000","message":"Done","commit_id":"13c14d22d119fa42d6e47ce1743f939bc75b6f07"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"d394e23a1cfdaa3bcfac8a33f32d40f1f430b36e","unresolved":false,"context_lines":[{"line_number":57,"context_line":"update privileges for a project in a higher level of the hierarchy and not to"},{"line_number":58,"context_line":"some projects in its subtree. For this reason, there is the need for new rules"},{"line_number":59,"context_line":"in the keystone ``policy.json`` file and, therefore, new API endpoints to"},{"line_number":60,"context_line":"represent these actions."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"The new endpoints for the delete and update requests can have the following"},{"line_number":63,"context_line":"format:"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa81d914_7373d2b1","line":60,"updated":"2015-01-27 19:37:09.000000000","message":"Not sure if I understand this entire paragraph. Can you please provide an example?","commit_id":"13c14d22d119fa42d6e47ce1743f939bc75b6f07"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"a80923ad9b6779c72997b46fcdfcd95f068fe337","unresolved":false,"context_lines":[{"line_number":57,"context_line":"update privileges for a project in a higher level of the hierarchy and not to"},{"line_number":58,"context_line":"some projects in its subtree. For this reason, there is the need for new rules"},{"line_number":59,"context_line":"in the keystone ``policy.json`` file and, therefore, new API endpoints to"},{"line_number":60,"context_line":"represent these actions."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"The new endpoints for the delete and update requests can have the following"},{"line_number":63,"context_line":"format:"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa81d914_1e88dd21","line":60,"in_reply_to":"fa81d914_7373d2b1","updated":"2015-01-27 20:18:38.000000000","message":"++","commit_id":"13c14d22d119fa42d6e47ce1743f939bc75b6f07"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"d394e23a1cfdaa3bcfac8a33f32d40f1f430b36e","unresolved":false,"context_lines":[{"line_number":63,"context_line":"format:"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"* Delete: DELETE projects/\u003cproject_id\u003e/cascade"},{"line_number":66,"context_line":"* Update: PATCH projects/\u003cproject_id\u003e/cascade"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"Where ``cascade`` represents that the request would have effect to lower levels"},{"line_number":69,"context_line":"of the hierarchy. Note that for the update request, other fields could be"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa81d914_730e7236","line":66,"updated":"2015-01-27 19:37:09.000000000","message":"shouldn\u0027t \u0027cascade\u0027 be a parameter?\n\nDELETE projects/\u003cproject_id\u003e?cascade","commit_id":"13c14d22d119fa42d6e47ce1743f939bc75b6f07"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"a80923ad9b6779c72997b46fcdfcd95f068fe337","unresolved":false,"context_lines":[{"line_number":63,"context_line":"format:"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"* Delete: DELETE projects/\u003cproject_id\u003e/cascade"},{"line_number":66,"context_line":"* Update: PATCH projects/\u003cproject_id\u003e/cascade"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"Where ``cascade`` represents that the request would have effect to lower levels"},{"line_number":69,"context_line":"of the hierarchy. Note that for the update request, other fields could be"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa81d914_de756533","line":66,"in_reply_to":"fa81d914_730e7236","updated":"2015-01-27 20:18:38.000000000","message":"we only have query params for GET and HEAD calls in REST APIs","commit_id":"13c14d22d119fa42d6e47ce1743f939bc75b6f07"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"7205c4278422cf3c38f3eeebc90c6cc1cc0b19f5","unresolved":false,"context_lines":[{"line_number":63,"context_line":"format:"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"* Delete: DELETE projects/\u003cproject_id\u003e/cascade"},{"line_number":66,"context_line":"* Update: PATCH projects/\u003cproject_id\u003e/cascade"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"Where ``cascade`` represents that the request would have effect to lower levels"},{"line_number":69,"context_line":"of the hierarchy. Note that for the update request, other fields could be"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa81d914_87171951","line":66,"in_reply_to":"fa81d914_de756533","updated":"2015-01-27 23:22:32.000000000","message":"I see. Yikes!","commit_id":"13c14d22d119fa42d6e47ce1743f939bc75b6f07"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"b3a47d9f045a6c35009e51447a2cbf417cdf5de1","unresolved":false,"context_lines":[{"line_number":158,"context_line":"Documentation Impact"},{"line_number":159,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"We must update the API Documentation (Identity API v3) according to these"},{"line_number":162,"context_line":"changes."},{"line_number":163,"context_line":""},{"line_number":164,"context_line":"References"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa81d914_72bba10e","line":161,"updated":"2015-01-28 15:52:09.000000000","message":"This should be listed as a work item. Also this change is nasty enough that you should include what the API changes are going to be so they can be reviewed along with this spec. In other words please submit the API changes along with this spec or reference it if it is in another patch","commit_id":"4ceb820c2eb535825009cf4a310c901d4f8c49d0"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"ff38eb1ef457e0bdbf9e4885eb323f2730978c8b","unresolved":false,"context_lines":[{"line_number":158,"context_line":"Documentation Impact"},{"line_number":159,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"We must update the API Documentation (Identity API v3) according to these"},{"line_number":162,"context_line":"changes."},{"line_number":163,"context_line":""},{"line_number":164,"context_line":"References"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa81d914_34d2f6d2","line":161,"in_reply_to":"fa81d914_72bba10e","updated":"2015-01-28 16:22:27.000000000","message":"++\n\nwas waiting for more eyes in the spec itself so I could propose API changes that could be easiest to maintain and wouldn\u0027t be rejected. Since the changes proposed here seems to make sense, will propose the API spec changes :)","commit_id":"4ceb820c2eb535825009cf4a310c901d4f8c49d0"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"78f4af9807f609f87fc1f70c1ae89c55e3187700","unresolved":false,"context_lines":[{"line_number":158,"context_line":"Documentation Impact"},{"line_number":159,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"We must update the API Documentation (Identity API v3) according to these"},{"line_number":162,"context_line":"changes."},{"line_number":163,"context_line":""},{"line_number":164,"context_line":"References"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa81d914_54604a32","line":161,"in_reply_to":"fa81d914_72bba10e","updated":"2015-01-28 16:21:12.000000000","message":"I concur, this one needs the API changes either as the direct follow-on or in the patchset.","commit_id":"4ceb820c2eb535825009cf4a310c901d4f8c49d0"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"0f4ef8f8d03d41e81b2472bfa312b7c8b5bfed19","unresolved":false,"context_lines":[{"line_number":52,"context_line":"manually disable the project\u0027s children to disable a project that is in a"},{"line_number":53,"context_line":"higher level of the hierarchy (the project hierarchy doesn\u0027t follow the same"},{"line_number":54,"context_line":"behavior as disabling domains, which has cascade effect by default). Thus, this"},{"line_number":55,"context_line":"spec also proposes the possibility to disable a project along with its subtree."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"Both features lead to access privileges concerns: a user could have deleted and"},{"line_number":58,"context_line":"updated privileges for a project in a higher level of the hierarchy and not to"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da86d52c_436b95f0","line":55,"updated":"2015-02-19 08:58:22.000000000","message":"++ I like the intermediate step of disabling all child domain and project first before allowing delete!","commit_id":"c821ea69261d5e479569bbf458966113b7acdb6e"},{"author":{"_account_id":11057,"name":"sajeesh cs","email":"sajeesh.cs@cern.ch","username":"sajeeshcs"},"change_message_id":"e93e01c2c627770c5e246d437e2657bf925e6d50","unresolved":false,"context_lines":[{"line_number":19,"context_line":"was allowed only for leaf projects in the hierarchy. In this way, it is"},{"line_number":20,"context_line":"necessary to delete projects one by one (starting from the leafs) in order to"},{"line_number":21,"context_line":"delete a whole hierarchy branch."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"For example, considering the following hierarchy::"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"    +------------------------+"}],"source_content_type":"text/x-rst","patch_set":8,"id":"ba7be1f8_dae8e67e","line":22,"updated":"2015-02-20 21:48:45.000000000","message":"++1 Nice feature !!!","commit_id":"f313ac276257c65089ac509172a86da3907cbb59"},{"author":{"_account_id":11057,"name":"sajeesh cs","email":"sajeesh.cs@cern.ch","username":"sajeeshcs"},"change_message_id":"e93e01c2c627770c5e246d437e2657bf925e6d50","unresolved":false,"context_lines":[{"line_number":47,"context_line":"the user to specify a project that is not a leaf in the hierarchy for removal."},{"line_number":48,"context_line":"In this way, the project itself along with its whole subtree will be deleted."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"In order to delete a project, it must be first disabled. Currently, this"},{"line_number":51,"context_line":"follows the same behavior as the project deletion: the user would have to"},{"line_number":52,"context_line":"manually disable the project\u0027s children to disable a project that is in a"},{"line_number":53,"context_line":"higher level of the hierarchy (the project hierarchy doesn\u0027t follow the same"}],"source_content_type":"text/x-rst","patch_set":8,"id":"ba7be1f8_9a958ee6","line":50,"updated":"2015-02-20 21:48:45.000000000","message":"what is the exact difference between \"disable\" and \"delete\" a project?","commit_id":"f313ac276257c65089ac509172a86da3907cbb59"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"959a271ddcc6c7ba7281fc7b0ab6af484bcde11a","unresolved":false,"context_lines":[{"line_number":47,"context_line":"the user to specify a project that is not a leaf in the hierarchy for removal."},{"line_number":48,"context_line":"In this way, the project itself along with its whole subtree will be deleted."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"In order to delete a project, it must be first disabled. Currently, this"},{"line_number":51,"context_line":"follows the same behavior as the project deletion: the user would have to"},{"line_number":52,"context_line":"manually disable the project\u0027s children to disable a project that is in a"},{"line_number":53,"context_line":"higher level of the hierarchy (the project hierarchy doesn\u0027t follow the same"}],"source_content_type":"text/x-rst","patch_set":8,"id":"ba7be1f8_b0d500bb","line":50,"in_reply_to":"ba7be1f8_9a958ee6","updated":"2015-02-22 13:50:22.000000000","message":"in keystone, projects have the \"enabled\" flag. If a project is disabled you can\u0027t use it to get a token for it, for example. But you can enable the project again.\n\ndelete a project is a more permanent action, after a project is deleted all assignments and resources of this project should be removed.","commit_id":"f313ac276257c65089ac509172a86da3907cbb59"},{"author":{"_account_id":11057,"name":"sajeesh cs","email":"sajeesh.cs@cern.ch","username":"sajeeshcs"},"change_message_id":"dd4e31b118c98ced3a8b5c4edf116c36c7bebff8","unresolved":false,"context_lines":[{"line_number":47,"context_line":"the user to specify a project that is not a leaf in the hierarchy for removal."},{"line_number":48,"context_line":"In this way, the project itself along with its whole subtree will be deleted."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"In order to delete a project, it must be first disabled. Currently, this"},{"line_number":51,"context_line":"follows the same behavior as the project deletion: the user would have to"},{"line_number":52,"context_line":"manually disable the project\u0027s children to disable a project that is in a"},{"line_number":53,"context_line":"higher level of the hierarchy (the project hierarchy doesn\u0027t follow the same"}],"source_content_type":"text/x-rst","patch_set":8,"id":"ba7be1f8_b3ceeab2","line":50,"in_reply_to":"ba7be1f8_b0d500bb","updated":"2015-02-22 15:31:58.000000000","message":"ok....so you can\u0027t get a token for that . Suppose,if I am disabling E, whether it  will appear in the \"sub_tree_as_list\" api call for  A ?","commit_id":"f313ac276257c65089ac509172a86da3907cbb59"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"b16baa5141794b2297c828c1bff44cbb64cc5e1d","unresolved":false,"context_lines":[{"line_number":47,"context_line":"the user to specify a project that is not a leaf in the hierarchy for removal."},{"line_number":48,"context_line":"In this way, the project itself along with its whole subtree will be deleted."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"In order to delete a project, it must be first disabled. Currently, this"},{"line_number":51,"context_line":"follows the same behavior as the project deletion: the user would have to"},{"line_number":52,"context_line":"manually disable the project\u0027s children to disable a project that is in a"},{"line_number":53,"context_line":"higher level of the hierarchy (the project hierarchy doesn\u0027t follow the same"}],"source_content_type":"text/x-rst","patch_set":8,"id":"ba7be1f8_369bc873","line":50,"in_reply_to":"ba7be1f8_b3ceeab2","updated":"2015-02-22 19:04:49.000000000","message":"yes... it will appear.","commit_id":"f313ac276257c65089ac509172a86da3907cbb59"},{"author":{"_account_id":11057,"name":"sajeesh cs","email":"sajeesh.cs@cern.ch","username":"sajeeshcs"},"change_message_id":"e93e01c2c627770c5e246d437e2657bf925e6d50","unresolved":false,"context_lines":[{"line_number":60,"context_line":"in the keystone ``policy.json`` file and, therefore, new API endpoints to"},{"line_number":61,"context_line":"represent these actions. See Alternatives session for a further description of"},{"line_number":62,"context_line":"this issue."},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"The new endpoints for the delete and update requests can have the following"},{"line_number":65,"context_line":"format:"},{"line_number":66,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"ba7be1f8_d509972d","line":63,"updated":"2015-02-20 21:48:45.000000000","message":"For example,suppose Adam is having a role,\"project_admin\" in project \"A\" which can delete a project as defined by the policy file. If the role is not inherited ,ie if he is not having any role in any of the sub-projects, will he be able to delete \"A\" ?","commit_id":"f313ac276257c65089ac509172a86da3907cbb59"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"d7d5bebeea6177cca38520a86adcd49bdb82bea9","unresolved":false,"context_lines":[{"line_number":60,"context_line":"in the keystone ``policy.json`` file and, therefore, new API endpoints to"},{"line_number":61,"context_line":"represent these actions. See Alternatives session for a further description of"},{"line_number":62,"context_line":"this issue."},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"The new endpoints for the delete and update requests can have the following"},{"line_number":65,"context_line":"format:"},{"line_number":66,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"ba7be1f8_737d52e7","line":63,"in_reply_to":"ba7be1f8_13bfb6fc","updated":"2015-02-22 16:47:12.000000000","message":"We are going do *add* two *new* rules.","commit_id":"f313ac276257c65089ac509172a86da3907cbb59"},{"author":{"_account_id":11057,"name":"sajeesh cs","email":"sajeesh.cs@cern.ch","username":"sajeeshcs"},"change_message_id":"6a78d68f7ce8b861bca2f40597b8fa4c570f30c1","unresolved":false,"context_lines":[{"line_number":60,"context_line":"in the keystone ``policy.json`` file and, therefore, new API endpoints to"},{"line_number":61,"context_line":"represent these actions. See Alternatives session for a further description of"},{"line_number":62,"context_line":"this issue."},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"The new endpoints for the delete and update requests can have the following"},{"line_number":65,"context_line":"format:"},{"line_number":66,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"ba7be1f8_96de343e","line":63,"in_reply_to":"ba7be1f8_737d52e7","updated":"2015-02-22 18:54:27.000000000","message":"ok","commit_id":"f313ac276257c65089ac509172a86da3907cbb59"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"959a271ddcc6c7ba7281fc7b0ab6af484bcde11a","unresolved":false,"context_lines":[{"line_number":60,"context_line":"in the keystone ``policy.json`` file and, therefore, new API endpoints to"},{"line_number":61,"context_line":"represent these actions. See Alternatives session for a further description of"},{"line_number":62,"context_line":"this issue."},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"The new endpoints for the delete and update requests can have the following"},{"line_number":65,"context_line":"format:"},{"line_number":66,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"ba7be1f8_f0d698c2","line":63,"in_reply_to":"ba7be1f8_d509972d","updated":"2015-02-22 13:50:22.000000000","message":"if in the policy file the rule says that he can delete the whole hierarchy, yes.","commit_id":"f313ac276257c65089ac509172a86da3907cbb59"},{"author":{"_account_id":11057,"name":"sajeesh cs","email":"sajeesh.cs@cern.ch","username":"sajeeshcs"},"change_message_id":"dd4e31b118c98ced3a8b5c4edf116c36c7bebff8","unresolved":false,"context_lines":[{"line_number":60,"context_line":"in the keystone ``policy.json`` file and, therefore, new API endpoints to"},{"line_number":61,"context_line":"represent these actions. See Alternatives session for a further description of"},{"line_number":62,"context_line":"this issue."},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"The new endpoints for the delete and update requests can have the following"},{"line_number":65,"context_line":"format:"},{"line_number":66,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"ba7be1f8_13bfb6fc","line":63,"in_reply_to":"ba7be1f8_f0d698c2","updated":"2015-02-22 15:31:58.000000000","message":"The partial policy file is as follows  \n\n    \"admin_required\": \"role:admin or is_admin:1\",\n    \"service_role\": \"role:service\",\n    \"service_or_admin\": \"rule:admin_required or rule:service_role\",\n    \"owner\" : \"user_id:%(user_id)s\",\n    \"admin_or_owner\": \"rule:admin_required or rule:owner\",\n    \"default\": \"rule:admin_required\",\n     ............\n     ............\n     \"identity:update_project\": \"rule:admin_required\",\n     \"identity:delete_project\": \"rule:admin_required\"\nGeorge is having admin role in A. But not inherited(inherited flag\u003d0).  \nThat is ,he is not having any role in any of the sub projects of A.\n In that case, will he able to delete A recursively? . \n\"admin\" role is just an example. \nThe point is, George is having role in A and , no role in any\nof the sub projects.will he able to delete A recursively?","commit_id":"f313ac276257c65089ac509172a86da3907cbb59"},{"author":{"_account_id":11057,"name":"sajeesh cs","email":"sajeesh.cs@cern.ch","username":"sajeeshcs"},"change_message_id":"e93e01c2c627770c5e246d437e2657bf925e6d50","unresolved":false,"context_lines":[{"line_number":66,"context_line":""},{"line_number":67,"context_line":"* Delete: DELETE projects/\u003cproject_id\u003e/cascade"},{"line_number":68,"context_line":"* Update: PATCH projects/\u003cproject_id\u003e/cascade"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"Where ``cascade`` represents that the request would have effect to lower levels"},{"line_number":71,"context_line":"of the hierarchy. Note that for the update request, other fields could be"},{"line_number":72,"context_line":"changed in the project, but only the ``enabled`` field would have effect to"}],"source_content_type":"text/x-rst","patch_set":8,"id":"ba7be1f8_b53c2395","line":69,"updated":"2015-02-20 21:48:45.000000000","message":"Can you please tell what Update request does","commit_id":"f313ac276257c65089ac509172a86da3907cbb59"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"959a271ddcc6c7ba7281fc7b0ab6af484bcde11a","unresolved":false,"context_lines":[{"line_number":66,"context_line":""},{"line_number":67,"context_line":"* Delete: DELETE projects/\u003cproject_id\u003e/cascade"},{"line_number":68,"context_line":"* Update: PATCH projects/\u003cproject_id\u003e/cascade"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"Where ``cascade`` represents that the request would have effect to lower levels"},{"line_number":71,"context_line":"of the hierarchy. Note that for the update request, other fields could be"},{"line_number":72,"context_line":"changed in the project, but only the ``enabled`` field would have effect to"}],"source_content_type":"text/x-rst","patch_set":8,"id":"ba7be1f8_d0db54eb","line":69,"in_reply_to":"ba7be1f8_b53c2395","updated":"2015-02-22 13:50:22.000000000","message":"we disable a project via the Update action (since it is changing to false the enabled field)","commit_id":"f313ac276257c65089ac509172a86da3907cbb59"},{"author":{"_account_id":11057,"name":"sajeesh cs","email":"sajeesh.cs@cern.ch","username":"sajeeshcs"},"change_message_id":"dd4e31b118c98ced3a8b5c4edf116c36c7bebff8","unresolved":false,"context_lines":[{"line_number":66,"context_line":""},{"line_number":67,"context_line":"* Delete: DELETE projects/\u003cproject_id\u003e/cascade"},{"line_number":68,"context_line":"* Update: PATCH projects/\u003cproject_id\u003e/cascade"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"Where ``cascade`` represents that the request would have effect to lower levels"},{"line_number":71,"context_line":"of the hierarchy. Note that for the update request, other fields could be"},{"line_number":72,"context_line":"changed in the project, but only the ``enabled`` field would have effect to"}],"source_content_type":"text/x-rst","patch_set":8,"id":"ba7be1f8_733b929c","line":69,"in_reply_to":"ba7be1f8_d0db54eb","updated":"2015-02-22 15:31:58.000000000","message":"ok","commit_id":"f313ac276257c65089ac509172a86da3907cbb59"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"dae5550b35fd5f985ca9d2003e15fd92801ab2b1","unresolved":false,"context_lines":[{"line_number":65,"context_line":"format:"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"* Delete: DELETE projects/\u003cproject_id\u003e/cascade"},{"line_number":68,"context_line":"* Update: PATCH projects/\u003cproject_id\u003e/cascade"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"Where ``cascade`` represents that the request would have effect to lower levels"},{"line_number":71,"context_line":"of the hierarchy. Note that for the update request, other fields could be"}],"source_content_type":"text/x-rst","patch_set":9,"id":"9aa53dc9_52dfcc0c","line":68,"updated":"2015-04-10 09:16:03.000000000","message":"nice!","commit_id":"08eda522b2dc396e7832b257ded2745a610f5f85"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"dae5550b35fd5f985ca9d2003e15fd92801ab2b1","unresolved":false,"context_lines":[{"line_number":69,"context_line":""},{"line_number":70,"context_line":"Where ``cascade`` represents that the request would have effect to lower levels"},{"line_number":71,"context_line":"of the hierarchy. Note that for the update request, other fields could be"},{"line_number":72,"context_line":"changed in the project, but only the ``enabled`` field would have effect to"},{"line_number":73,"context_line":"lower levels of the hierarchy."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"With the `Reseller \u003chttps://review.openstack.org/#/c/139824/\u003e`_ spec, domains"}],"source_content_type":"text/x-rst","patch_set":9,"id":"9aa53dc9_320b2890","line":72,"updated":"2015-04-10 09:16:03.000000000","message":"not sure we should allow the mix, very confusing...I\u0027d say if cascade is used on an update, ONLY the enabled flag can be specified.","commit_id":"08eda522b2dc396e7832b257ded2745a610f5f85"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"c7da45d667cdc65688f944166c5e09e01df9634d","unresolved":false,"context_lines":[{"line_number":69,"context_line":""},{"line_number":70,"context_line":"Where ``cascade`` represents that the request would have effect to lower levels"},{"line_number":71,"context_line":"of the hierarchy. Note that for the update request, other fields could be"},{"line_number":72,"context_line":"changed in the project, but only the ``enabled`` field would have effect to"},{"line_number":73,"context_line":"lower levels of the hierarchy."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"With the `Reseller \u003chttps://review.openstack.org/#/c/139824/\u003e`_ spec, domains"}],"source_content_type":"text/x-rst","patch_set":9,"id":"7aaa499b_c29f1b5e","line":72,"in_reply_to":"9aa53dc9_320b2890","updated":"2015-04-13 13:58:59.000000000","message":"++","commit_id":"08eda522b2dc396e7832b257ded2745a610f5f85"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"dae5550b35fd5f985ca9d2003e15fd92801ab2b1","unresolved":false,"context_lines":[{"line_number":85,"context_line":"the cascade requests for projects:"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"* Delete: DELETE domains/\u003cdomain_id\u003e/cascade"},{"line_number":88,"context_line":"* Update: PATCH domains/\u003cdomain_id\u003e/cascade"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"Alternatives"},{"line_number":91,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"9aa53dc9_7272d012","line":88,"updated":"2015-04-10 09:16:03.000000000","message":"I\u0027d have thought we want to freeze the domain API as is, and do this still via the project API, on a project that has the is_domain flag set to True.  Is there a reason we need the support on domains as well?","commit_id":"08eda522b2dc396e7832b257ded2745a610f5f85"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"c7da45d667cdc65688f944166c5e09e01df9634d","unresolved":false,"context_lines":[{"line_number":85,"context_line":"the cascade requests for projects:"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"* Delete: DELETE domains/\u003cdomain_id\u003e/cascade"},{"line_number":88,"context_line":"* Update: PATCH domains/\u003cdomain_id\u003e/cascade"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"Alternatives"},{"line_number":91,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"7aaa499b_a2ef6faf","line":88,"in_reply_to":"9aa53dc9_7272d012","updated":"2015-04-13 13:58:59.000000000","message":"++","commit_id":"08eda522b2dc396e7832b257ded2745a610f5f85"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"dbd674466893138a3cceff9d657c85cb2f2d051d","unresolved":false,"context_lines":[{"line_number":111,"context_line":""},{"line_number":112,"context_line":"New behavior when deleting/disabling a project along with new rules in the"},{"line_number":113,"context_line":"policy.json file."},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"Performance Impact"},{"line_number":116,"context_line":"------------------"},{"line_number":117,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"9a80dd14_eb0ca9ee","line":114,"updated":"2015-03-12 20:00:26.000000000","message":"Since many projects can be quite easily deleted using this new scheme, I\u0027d recommend that this spec include the following after the user enters the command:\n- User notification that provides feedback listing the projects that are about to be deleted, and\n- Verification from the user prior to deleting them","commit_id":"08eda522b2dc396e7832b257ded2745a610f5f85"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"c7da45d667cdc65688f944166c5e09e01df9634d","unresolved":false,"context_lines":[{"line_number":111,"context_line":""},{"line_number":112,"context_line":"New behavior when deleting/disabling a project along with new rules in the"},{"line_number":113,"context_line":"policy.json file."},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"Performance Impact"},{"line_number":116,"context_line":"------------------"},{"line_number":117,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"7aaa499b_0255034f","line":114,"in_reply_to":"9a80dd14_eb0ca9ee","updated":"2015-04-13 13:58:59.000000000","message":"agree with your concern, but I think this is more a client side issue. For example, if the client detects that this is going to be the operation, it prompts a \"are you sure?\" message along with the entities that are going to be affected by the request.","commit_id":"08eda522b2dc396e7832b257ded2745a610f5f85"}],"specs/liberty/recursive-deletion.rst":[{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"ae18ef7e2589f35cdebf281b90093eb7fba20713","unresolved":false,"context_lines":[{"line_number":58,"context_line":"behavior as disabling domains, which has cascade effect by default). Thus, this"},{"line_number":59,"context_line":"spec also proposes the possibility to disable a project along with its subtree."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"Both features lead to access privileges concerns: a user could have deleted and"},{"line_number":62,"context_line":"updated privileges for a project in a higher level of the hierarchy and not to"},{"line_number":63,"context_line":"some projects in its subtree. For this reason, there is the need for new rules"},{"line_number":64,"context_line":"in the keystone ``policy.json`` file and, therefore, new API endpoints to"}],"source_content_type":"text/x-rst","patch_set":10,"id":"7aaa499b_6d78132c","line":61,"updated":"2015-04-14 12:11:12.000000000","message":"s/deleted/delete/ and s/updated/update/","commit_id":"2cadd178cb8e59cf165631f6ef0efaeb020804ad"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"524607ff9907e13ffa3ce3b7c362fe823119a688","unresolved":false,"context_lines":[{"line_number":58,"context_line":"behavior as disabling domains, which has cascade effect by default). Thus, this"},{"line_number":59,"context_line":"spec also proposes the possibility to disable a project along with its subtree."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"Both features lead to access privileges concerns: a user could have deleted and"},{"line_number":62,"context_line":"updated privileges for a project in a higher level of the hierarchy and not to"},{"line_number":63,"context_line":"some projects in its subtree. For this reason, there is the need for new rules"},{"line_number":64,"context_line":"in the keystone ``policy.json`` file and, therefore, new API endpoints to"}],"source_content_type":"text/x-rst","patch_set":10,"id":"7aaa499b_53f5f8c8","line":61,"in_reply_to":"7aaa499b_6d78132c","updated":"2015-04-14 12:50:35.000000000","message":"Done","commit_id":"2cadd178cb8e59cf165631f6ef0efaeb020804ad"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"ae18ef7e2589f35cdebf281b90093eb7fba20713","unresolved":false,"context_lines":[{"line_number":73,"context_line":""},{"line_number":74,"context_line":"Where ``cascade`` represents that the request would have effect to lower levels"},{"line_number":75,"context_line":"of the hierarchy. Note that for the update request, the ``enabled`` field is"},{"line_number":76,"context_line":"mandatory and the **only** accepted."},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"With the `Reseller \u003chttps://review.openstack.org/#/c/139824/\u003e`_ spec, domains"},{"line_number":79,"context_line":"are projects, in this way we have the following behavior:"}],"source_content_type":"text/x-rst","patch_set":10,"id":"7aaa499b_adb73bf4","line":76,"updated":"2015-04-14 12:11:12.000000000","message":"s/the **only** accepted/the **only** accepted attribute/.\n\nmaybe add that an error will be thrown if any other attribute is passed","commit_id":"2cadd178cb8e59cf165631f6ef0efaeb020804ad"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"524607ff9907e13ffa3ce3b7c362fe823119a688","unresolved":false,"context_lines":[{"line_number":73,"context_line":""},{"line_number":74,"context_line":"Where ``cascade`` represents that the request would have effect to lower levels"},{"line_number":75,"context_line":"of the hierarchy. Note that for the update request, the ``enabled`` field is"},{"line_number":76,"context_line":"mandatory and the **only** accepted."},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"With the `Reseller \u003chttps://review.openstack.org/#/c/139824/\u003e`_ spec, domains"},{"line_number":79,"context_line":"are projects, in this way we have the following behavior:"}],"source_content_type":"text/x-rst","patch_set":10,"id":"7aaa499b_b3dd5c44","line":76,"in_reply_to":"7aaa499b_adb73bf4","updated":"2015-04-14 12:50:35.000000000","message":"Done","commit_id":"2cadd178cb8e59cf165631f6ef0efaeb020804ad"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"ae18ef7e2589f35cdebf281b90093eb7fba20713","unresolved":false,"context_lines":[{"line_number":80,"context_line":""},{"line_number":81,"context_line":"* We will be able to have a hierarchy of domains. In this hierarchy, we won\u0027t"},{"line_number":82,"context_line":"  have domains under projects, but only domains under domains;"},{"line_number":83,"context_line":"* As consequence of the previous point, deleting a project subtree will never"},{"line_number":84,"context_line":"  hit a domain."},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"Thus, we need extra rules defined in the ``policy.json`` file to handle the"}],"source_content_type":"text/x-rst","patch_set":10,"id":"7aaa499b_0dde2f11","line":83,"updated":"2015-04-14 12:11:12.000000000","message":"well, we might have projects with the is_domain flag set with other projects with the is_domain flag set below them...so deleting a project with cascade might run into this issue.","commit_id":"2cadd178cb8e59cf165631f6ef0efaeb020804ad"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"524607ff9907e13ffa3ce3b7c362fe823119a688","unresolved":false,"context_lines":[{"line_number":80,"context_line":""},{"line_number":81,"context_line":"* We will be able to have a hierarchy of domains. In this hierarchy, we won\u0027t"},{"line_number":82,"context_line":"  have domains under projects, but only domains under domains;"},{"line_number":83,"context_line":"* As consequence of the previous point, deleting a project subtree will never"},{"line_number":84,"context_line":"  hit a domain."},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"Thus, we need extra rules defined in the ``policy.json`` file to handle the"}],"source_content_type":"text/x-rst","patch_set":10,"id":"7aaa499b_13c4105d","line":83,"in_reply_to":"7aaa499b_0dde2f11","updated":"2015-04-14 12:50:35.000000000","message":"I\u0027m considering here only projects with the is_domain flag disabled. Should I make it clear?","commit_id":"2cadd178cb8e59cf165631f6ef0efaeb020804ad"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"ae18ef7e2589f35cdebf281b90093eb7fba20713","unresolved":false,"context_lines":[{"line_number":85,"context_line":""},{"line_number":86,"context_line":"Thus, we need extra rules defined in the ``policy.json`` file to handle the"},{"line_number":87,"context_line":"cascade deletion and disabling of domains. We won\u0027t change the domain\u0027s API,"},{"line_number":88,"context_line":"meaning that to perform such actions, the project\u0027s API must be used."},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"Alternatives"},{"line_number":91,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":10,"id":"7aaa499b_2dee8bb4","line":88,"updated":"2015-04-14 12:11:12.000000000","message":"so I assume you mean well have more than one entry the policy file for delete project?","commit_id":"2cadd178cb8e59cf165631f6ef0efaeb020804ad"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"524607ff9907e13ffa3ce3b7c362fe823119a688","unresolved":false,"context_lines":[{"line_number":85,"context_line":""},{"line_number":86,"context_line":"Thus, we need extra rules defined in the ``policy.json`` file to handle the"},{"line_number":87,"context_line":"cascade deletion and disabling of domains. We won\u0027t change the domain\u0027s API,"},{"line_number":88,"context_line":"meaning that to perform such actions, the project\u0027s API must be used."},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"Alternatives"},{"line_number":91,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":10,"id":"7aaa499b_5378582b","line":88,"in_reply_to":"7aaa499b_2dee8bb4","updated":"2015-04-14 12:50:35.000000000","message":"yes... delete domains and delete projects should be different rules","commit_id":"2cadd178cb8e59cf165631f6ef0efaeb020804ad"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"dbbfcd6f0f0f727bbaba0b5cab29ff9a99e29de2","unresolved":false,"context_lines":[{"line_number":65,"context_line":"represent these actions. See Alternatives session for a further description of"},{"line_number":66,"context_line":"this issue."},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"The new endpoints for the delete and update requests can have the following"},{"line_number":69,"context_line":"format:"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"* Delete: DELETE projects/\u003cproject_id\u003e/cascade"}],"source_content_type":"text/x-rst","patch_set":11,"id":"7aaa499b_bee763e3","line":68,"updated":"2015-04-14 13:15:52.000000000","message":"nit: is \u0027endpoints\u0027 the right term here? API ?","commit_id":"3031de42b067ebf789a6a95ee8341f51fc72a086"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"0ae99bcf882230e28271a6645f051c912636ea84","unresolved":false,"context_lines":[{"line_number":65,"context_line":"represent these actions. See Alternatives session for a further description of"},{"line_number":66,"context_line":"this issue."},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"The new endpoints for the delete and update requests can have the following"},{"line_number":69,"context_line":"format:"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"* Delete: DELETE projects/\u003cproject_id\u003e/cascade"}],"source_content_type":"text/x-rst","patch_set":11,"id":"7aaa499b_99cde1b9","line":68,"in_reply_to":"7aaa499b_bee763e3","updated":"2015-04-14 13:24:16.000000000","message":"will use \"URLs\"","commit_id":"3031de42b067ebf789a6a95ee8341f51fc72a086"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"dbbfcd6f0f0f727bbaba0b5cab29ff9a99e29de2","unresolved":false,"context_lines":[{"line_number":71,"context_line":"* Delete: DELETE projects/\u003cproject_id\u003e/cascade"},{"line_number":72,"context_line":"* Update: PATCH projects/\u003cproject_id\u003e/cascade"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"Where ``cascade`` represents that the request would have effect to lower levels"},{"line_number":75,"context_line":"of the hierarchy. Note that for the update request, the ``enabled`` field is"},{"line_number":76,"context_line":"mandatory and the **only** accepted attribute. Including other attributes will"},{"line_number":77,"context_line":"raise an error."}],"source_content_type":"text/x-rst","patch_set":11,"id":"7aaa499b_7e6e7b30","line":74,"updated":"2015-04-14 13:15:52.000000000","message":"This isn\u0027t a complete sentence, maybe\n\nSpecifying ``cascade`` indicates that the request should also be applied to all children in the hierarchy.","commit_id":"3031de42b067ebf789a6a95ee8341f51fc72a086"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"0ae99bcf882230e28271a6645f051c912636ea84","unresolved":false,"context_lines":[{"line_number":71,"context_line":"* Delete: DELETE projects/\u003cproject_id\u003e/cascade"},{"line_number":72,"context_line":"* Update: PATCH projects/\u003cproject_id\u003e/cascade"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"Where ``cascade`` represents that the request would have effect to lower levels"},{"line_number":75,"context_line":"of the hierarchy. Note that for the update request, the ``enabled`` field is"},{"line_number":76,"context_line":"mandatory and the **only** accepted attribute. Including other attributes will"},{"line_number":77,"context_line":"raise an error."}],"source_content_type":"text/x-rst","patch_set":11,"id":"7aaa499b_f93745ae","line":74,"in_reply_to":"7aaa499b_7e6e7b30","updated":"2015-04-14 13:24:16.000000000","message":"++","commit_id":"3031de42b067ebf789a6a95ee8341f51fc72a086"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"dbbfcd6f0f0f727bbaba0b5cab29ff9a99e29de2","unresolved":false,"context_lines":[{"line_number":82,"context_line":"* We will be able to have a hierarchy of domains. In this hierarchy, we won\u0027t"},{"line_number":83,"context_line":"  have domains under projects, but only domains under domains;"},{"line_number":84,"context_line":"* As consequence of the previous point, deleting a project subtree will never"},{"line_number":85,"context_line":"  hit a domain."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"Thus, we need extra rules defined in the ``policy.json`` file to handle the"},{"line_number":88,"context_line":"cascade deletion and disabling of domains. We won\u0027t change the domain\u0027s API,"}],"source_content_type":"text/x-rst","patch_set":11,"id":"7aaa499b_3efd933a","line":85,"updated":"2015-04-14 13:15:52.000000000","message":"I think my previous point is still valid...I assume you should only be able to issue such a cascade request on a leaf project that is acting as a domain?","commit_id":"3031de42b067ebf789a6a95ee8341f51fc72a086"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"0ae99bcf882230e28271a6645f051c912636ea84","unresolved":false,"context_lines":[{"line_number":82,"context_line":"* We will be able to have a hierarchy of domains. In this hierarchy, we won\u0027t"},{"line_number":83,"context_line":"  have domains under projects, but only domains under domains;"},{"line_number":84,"context_line":"* As consequence of the previous point, deleting a project subtree will never"},{"line_number":85,"context_line":"  hit a domain."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"Thus, we need extra rules defined in the ``policy.json`` file to handle the"},{"line_number":88,"context_line":"cascade deletion and disabling of domains. We won\u0027t change the domain\u0027s API,"}],"source_content_type":"text/x-rst","patch_set":11,"id":"7aaa499b_1951d1d8","line":85,"in_reply_to":"7aaa499b_3efd933a","updated":"2015-04-14 13:24:16.000000000","message":"hmm now I get it...","commit_id":"3031de42b067ebf789a6a95ee8341f51fc72a086"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"dbbfcd6f0f0f727bbaba0b5cab29ff9a99e29de2","unresolved":false,"context_lines":[{"line_number":84,"context_line":"* As consequence of the previous point, deleting a project subtree will never"},{"line_number":85,"context_line":"  hit a domain."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"Thus, we need extra rules defined in the ``policy.json`` file to handle the"},{"line_number":88,"context_line":"cascade deletion and disabling of domains. We won\u0027t change the domain\u0027s API,"},{"line_number":89,"context_line":"meaning that to perform such actions, the project\u0027s API must be used."},{"line_number":90,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"7aaa499b_be6d2306","line":87,"updated":"2015-04-14 13:15:52.000000000","message":"well, we don\u0027t need them..but we are proposing for security reasons to have this....","commit_id":"3031de42b067ebf789a6a95ee8341f51fc72a086"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"0ae99bcf882230e28271a6645f051c912636ea84","unresolved":false,"context_lines":[{"line_number":84,"context_line":"* As consequence of the previous point, deleting a project subtree will never"},{"line_number":85,"context_line":"  hit a domain."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"Thus, we need extra rules defined in the ``policy.json`` file to handle the"},{"line_number":88,"context_line":"cascade deletion and disabling of domains. We won\u0027t change the domain\u0027s API,"},{"line_number":89,"context_line":"meaning that to perform such actions, the project\u0027s API must be used."},{"line_number":90,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"7aaa499b_79fa15bf","line":87,"in_reply_to":"7aaa499b_be6d2306","updated":"2015-04-14 13:24:16.000000000","message":"it is to follow our current rules: delete_project !\u003d delete_domain, so as a user I\u0027d expect the same for delete_project_recursively and delete_domain_recursively (or something similar)","commit_id":"3031de42b067ebf789a6a95ee8341f51fc72a086"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"7d26c5cd4b858c5f6ef3b49fc1d4aae5359ccf23","unresolved":false,"context_lines":[{"line_number":16,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"In the first version of Hierarchical Multitenancy (kilo-1), a project deletion"},{"line_number":19,"context_line":"was allowed only for leaf projects in the hierarchy. In this way, it is"},{"line_number":20,"context_line":"necessary to delete projects one by one (starting from the leafs) in order to"},{"line_number":21,"context_line":"delete a whole hierarchy branch."},{"line_number":22,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"7aaa499b_011cb375","line":19,"updated":"2015-04-14 14:39:14.000000000","message":"nit: s/In this way/With this restrcition/","commit_id":"0c5ef33447bb999084188bb011a074d944c9b265"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"ae8af92be94180dffcfd58e5837811a13da5d5f9","unresolved":false,"context_lines":[{"line_number":16,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"In the first version of Hierarchical Multitenancy (kilo-1), a project deletion"},{"line_number":19,"context_line":"was allowed only for leaf projects in the hierarchy. In this way, it is"},{"line_number":20,"context_line":"necessary to delete projects one by one (starting from the leafs) in order to"},{"line_number":21,"context_line":"delete a whole hierarchy branch."},{"line_number":22,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"7aaa499b_9f401ea7","line":19,"in_reply_to":"7aaa499b_011cb375","updated":"2015-04-14 15:00:18.000000000","message":"Done","commit_id":"0c5ef33447bb999084188bb011a074d944c9b265"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"7d26c5cd4b858c5f6ef3b49fc1d4aae5359ccf23","unresolved":false,"context_lines":[{"line_number":55,"context_line":"follows the same behavior as the project deletion: the user would have to"},{"line_number":56,"context_line":"manually disable the project\u0027s children to disable a project that is in a"},{"line_number":57,"context_line":"higher level of the hierarchy (the project hierarchy doesn\u0027t follow the same"},{"line_number":58,"context_line":"behavior as disabling domains, which has cascade effect by default). Thus, this"},{"line_number":59,"context_line":"spec also proposes the possibility to disable a project along with its subtree."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"Both features lead to access privileges concerns: a user could have delete and"}],"source_content_type":"text/x-rst","patch_set":14,"id":"7aaa499b_64e82511","line":58,"updated":"2015-04-14 14:39:14.000000000","message":"...so what will happen if we issue a (real) delete_domain on a project set with is_domain\u003dTrue, with a nice big hierarchy underneath us? Will we support that?","commit_id":"0c5ef33447bb999084188bb011a074d944c9b265"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"ae8af92be94180dffcfd58e5837811a13da5d5f9","unresolved":false,"context_lines":[{"line_number":55,"context_line":"follows the same behavior as the project deletion: the user would have to"},{"line_number":56,"context_line":"manually disable the project\u0027s children to disable a project that is in a"},{"line_number":57,"context_line":"higher level of the hierarchy (the project hierarchy doesn\u0027t follow the same"},{"line_number":58,"context_line":"behavior as disabling domains, which has cascade effect by default). Thus, this"},{"line_number":59,"context_line":"spec also proposes the possibility to disable a project along with its subtree."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"Both features lead to access privileges concerns: a user could have delete and"}],"source_content_type":"text/x-rst","patch_set":14,"id":"7aaa499b_dfca26a1","line":58,"in_reply_to":"7aaa499b_64e82511","updated":"2015-04-14 15:00:18.000000000","message":"the delete_domain will check if it is a leaf, will add the restriction in the API spec.","commit_id":"0c5ef33447bb999084188bb011a074d944c9b265"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"7d26c5cd4b858c5f6ef3b49fc1d4aae5359ccf23","unresolved":false,"context_lines":[{"line_number":85,"context_line":"  trigger the recursive actions on a \"pure\" project we are certain it will"},{"line_number":86,"context_line":"  never hit a domain as per consequence of the previous point;"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"Deleting a project that behaves as a domain will keep the current"},{"line_number":89,"context_line":"behavior: only **leaf domains** will be deleted (which may trigger the"},{"line_number":90,"context_line":"deletion of its \"pure\" project subtree) - the **/cascade** API will be"},{"line_number":91,"context_line":"available **only** to pure projects."}],"source_content_type":"text/x-rst","patch_set":14,"id":"7aaa499b_04be01d4","line":88,"updated":"2015-04-14 14:39:14.000000000","message":"what is the current behaviour? You mean it requires you to delete all the project underneath it first?  That would suck a bit if I had 100 projects one level down!","commit_id":"0c5ef33447bb999084188bb011a074d944c9b265"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"ae8af92be94180dffcfd58e5837811a13da5d5f9","unresolved":false,"context_lines":[{"line_number":85,"context_line":"  trigger the recursive actions on a \"pure\" project we are certain it will"},{"line_number":86,"context_line":"  never hit a domain as per consequence of the previous point;"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"Deleting a project that behaves as a domain will keep the current"},{"line_number":89,"context_line":"behavior: only **leaf domains** will be deleted (which may trigger the"},{"line_number":90,"context_line":"deletion of its \"pure\" project subtree) - the **/cascade** API will be"},{"line_number":91,"context_line":"available **only** to pure projects."}],"source_content_type":"text/x-rst","patch_set":14,"id":"7aaa499b_9fdede6b","line":88,"in_reply_to":"7aaa499b_04be01d4","updated":"2015-04-14 15:00:18.000000000","message":"the current delete_domain behavior... the whole hierarchy is deleted.","commit_id":"0c5ef33447bb999084188bb011a074d944c9b265"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"3d9338f2abb87abee5569b31eb53307f0da37de2","unresolved":false,"context_lines":[{"line_number":55,"context_line":"follows the same behavior as the project deletion: the user would have to"},{"line_number":56,"context_line":"manually disable the project\u0027s children to disable a project that is in a"},{"line_number":57,"context_line":"higher level of the hierarchy (the project hierarchy doesn\u0027t follow the same"},{"line_number":58,"context_line":"behavior as disabling domains, which has cascade effect by default). Thus, this"},{"line_number":59,"context_line":"spec also proposes the possibility to disable a project along with its subtree."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"Both features lead to access privileges concerns: a user could have delete and"}],"source_content_type":"text/x-rst","patch_set":16,"id":"7aaa499b_ba5ac828","line":58,"updated":"2015-04-14 15:09:39.000000000","message":"I don\u0027t think disabling domain cascades...but the delete does?","commit_id":"1d05bc4700ad99e130cea24c6946e6836edb0d63"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"bfdcc6fcf3723e30d2c835bccfb772cbfc1ce901","unresolved":false,"context_lines":[{"line_number":55,"context_line":"follows the same behavior as the project deletion: the user would have to"},{"line_number":56,"context_line":"manually disable the project\u0027s children to disable a project that is in a"},{"line_number":57,"context_line":"higher level of the hierarchy (the project hierarchy doesn\u0027t follow the same"},{"line_number":58,"context_line":"behavior as disabling domains, which has cascade effect by default). Thus, this"},{"line_number":59,"context_line":"spec also proposes the possibility to disable a project along with its subtree."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"Both features lead to access privileges concerns: a user could have delete and"}],"source_content_type":"text/x-rst","patch_set":16,"id":"7aaa499b_155f4de6","line":58,"in_reply_to":"7aaa499b_ba5ac828","updated":"2015-04-14 16:14:21.000000000","message":"true, so will specify this is going to be the behavior by default when disabling a domain","commit_id":"1d05bc4700ad99e130cea24c6946e6836edb0d63"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"3d9338f2abb87abee5569b31eb53307f0da37de2","unresolved":false,"context_lines":[{"line_number":86,"context_line":"  never hit a domain as per consequence of the previous point;"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"Deleting a project that behaves as a domain will keep the current"},{"line_number":89,"context_line":"behavior, meaning that only **leaf domains** will be deleted (which may trigger"},{"line_number":90,"context_line":"the deletion of its \"pure\" project subtree) - the **/cascade** API will be"},{"line_number":91,"context_line":"available **only** to pure projects."},{"line_number":92,"context_line":""}],"source_content_type":"text/x-rst","patch_set":16,"id":"7aaa499b_3f2b4a96","line":89,"updated":"2015-04-14 15:09:39.000000000","message":"as per my previous comment, I think we need t make this clearer...I\u0027m still not sure what we are saying... do we mean:\n\n 1) You can only issue a delete_domain call?\n 2) You can issue a non-cascaded delete_project call on a leaf project-domain and it will have the effect of cascade?\n 3) You can (must?) use /cascade to delete a project-domain and its hierarchy?","commit_id":"1d05bc4700ad99e130cea24c6946e6836edb0d63"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"0c8338405d9d3d3b8af303b1505d05c8339ad153","unresolved":false,"context_lines":[{"line_number":42,"context_line":""},{"line_number":43,"context_line":"In order to keep the atomicity of the operation: delete all or none entities,"},{"line_number":44,"context_line":"the implementation must list first all entities that are going to be affected"},{"line_number":45,"context_line":"and then perform a **single** query in the backend."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"Proposed Change"},{"line_number":48,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":18,"id":"7aaa499b_1aaf7982","line":45,"updated":"2015-04-14 16:31:16.000000000","message":"This paragraph is too backend-specific, like select-for-delete SQL. You may want to remove this paragraph altogether. You just need to mention that for recursive deletion, the operation needs to be atomic.","commit_id":"d02c704fc61a99ede1ac5a3878dbe94f1371cc98"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"1bfbae13abbbbdb3992bc3eec56da1115246ef98","unresolved":false,"context_lines":[{"line_number":42,"context_line":""},{"line_number":43,"context_line":"In order to keep the atomicity of the operation: delete all or none entities,"},{"line_number":44,"context_line":"the implementation must list first all entities that are going to be affected"},{"line_number":45,"context_line":"and then perform a **single** query in the backend."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"Proposed Change"},{"line_number":48,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":18,"id":"7aaa499b_dd834b55","line":45,"in_reply_to":"7aaa499b_1aaf7982","updated":"2015-04-14 16:37:39.000000000","message":"ok","commit_id":"d02c704fc61a99ede1ac5a3878dbe94f1371cc98"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"0c8338405d9d3d3b8af303b1505d05c8339ad153","unresolved":false,"context_lines":[{"line_number":56,"context_line":"manually disable the project\u0027s children to disable a project that is in a"},{"line_number":57,"context_line":"higher level of the hierarchy (the project hierarchy doesn\u0027t follow the same"},{"line_number":58,"context_line":"behavior as deleting domains, which has cascade effect by default). Thus, this"},{"line_number":59,"context_line":"spec also proposes the possibility to disable a project along with its subtree."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"Both features lead to access privileges concerns: a user could have delete and"},{"line_number":62,"context_line":"update privileges for a project in a higher level of the hierarchy and not to"}],"source_content_type":"text/x-rst","patch_set":18,"id":"7aaa499b_ba1645a5","line":59,"updated":"2015-04-14 16:31:16.000000000","message":"The child project is effectively disabled if its parent is disabled. You just need to walk to the tree to find out. There\u0027s really no need for recursive disable.","commit_id":"d02c704fc61a99ede1ac5a3878dbe94f1371cc98"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"1bfbae13abbbbdb3992bc3eec56da1115246ef98","unresolved":false,"context_lines":[{"line_number":56,"context_line":"manually disable the project\u0027s children to disable a project that is in a"},{"line_number":57,"context_line":"higher level of the hierarchy (the project hierarchy doesn\u0027t follow the same"},{"line_number":58,"context_line":"behavior as deleting domains, which has cascade effect by default). Thus, this"},{"line_number":59,"context_line":"spec also proposes the possibility to disable a project along with its subtree."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"Both features lead to access privileges concerns: a user could have delete and"},{"line_number":62,"context_line":"update privileges for a project in a higher level of the hierarchy and not to"}],"source_content_type":"text/x-rst","patch_set":18,"id":"7aaa499b_fdb5e730","line":59,"in_reply_to":"7aaa499b_ba1645a5","updated":"2015-04-14 16:37:39.000000000","message":"disable has the same use case... to delete, it must be first disabled. If we do not add the possibility to disable recursively, we are not adding a helpful API with the recursive deletion: the same algorithm that disables the projects from the leafs to the root project of the branch to be disabled, could be used to delete the projects as it goes up.","commit_id":"d02c704fc61a99ede1ac5a3878dbe94f1371cc98"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"0c8338405d9d3d3b8af303b1505d05c8339ad153","unresolved":false,"context_lines":[{"line_number":83,"context_line":"  have domains under projects, but only domains under domains;"},{"line_number":84,"context_line":"* We will only allow the recursive behavior to affect \"pure\" projects. If we"},{"line_number":85,"context_line":"  trigger the recursive actions on a \"pure\" project we are certain it will"},{"line_number":86,"context_line":"  never hit a domain as per consequence of the previous point;"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"In addition, disabling a project with the is_domain flag enabled will disable"},{"line_number":89,"context_line":"its \"pure\" project subtree **only** if it is a **leaf domain** (doesn\u0027t have"}],"source_content_type":"text/x-rst","patch_set":18,"id":"7aaa499b_3a86b5b9","line":86,"updated":"2015-04-14 16:31:16.000000000","message":"Domains under projects should never be allowed. There\u0027s really  no use case for this behavior. For V3 APIs, this will break compatibility.","commit_id":"d02c704fc61a99ede1ac5a3878dbe94f1371cc98"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"1bfbae13abbbbdb3992bc3eec56da1115246ef98","unresolved":false,"context_lines":[{"line_number":83,"context_line":"  have domains under projects, but only domains under domains;"},{"line_number":84,"context_line":"* We will only allow the recursive behavior to affect \"pure\" projects. If we"},{"line_number":85,"context_line":"  trigger the recursive actions on a \"pure\" project we are certain it will"},{"line_number":86,"context_line":"  never hit a domain as per consequence of the previous point;"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"In addition, disabling a project with the is_domain flag enabled will disable"},{"line_number":89,"context_line":"its \"pure\" project subtree **only** if it is a **leaf domain** (doesn\u0027t have"}],"source_content_type":"text/x-rst","patch_set":18,"id":"7aaa499b_dd4eab6e","line":86,"in_reply_to":"7aaa499b_3a86b5b9","updated":"2015-04-14 16:37:39.000000000","message":"yes, but I believe that we need to make this (redundant) affirmation in this spec","commit_id":"d02c704fc61a99ede1ac5a3878dbe94f1371cc98"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"20286694ca7d724a19ff10552e3c97f951cfe176","unresolved":false,"context_lines":[{"line_number":53,"context_line":"follows the same behavior as the project deletion: the user would have to"},{"line_number":54,"context_line":"manually disable the project\u0027s children to disable a project that is in a"},{"line_number":55,"context_line":"higher level of the hierarchy (the project hierarchy doesn\u0027t follow the same"},{"line_number":56,"context_line":"behavior as deleting domains, which has cascade effect by default).Thus, this"},{"line_number":57,"context_line":"spec also proposes changes to allow the disabling of a whole hierarchy branch"},{"line_number":58,"context_line":"within a single operation:"},{"line_number":59,"context_line":""}],"source_content_type":"text/x-rst","patch_set":20,"id":"7aaa499b_287f6767","line":56,"updated":"2015-04-15 14:25:23.000000000","message":"nit: Space after fullstop","commit_id":"9ff5cbc0fc66007d995743fcc66eebba1639f7b7"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"49482451990edd31927e53e8ed50bb25065fe8f6","unresolved":false,"context_lines":[{"line_number":53,"context_line":"follows the same behavior as the project deletion: the user would have to"},{"line_number":54,"context_line":"manually disable the project\u0027s children to disable a project that is in a"},{"line_number":55,"context_line":"higher level of the hierarchy (the project hierarchy doesn\u0027t follow the same"},{"line_number":56,"context_line":"behavior as deleting domains, which has cascade effect by default).Thus, this"},{"line_number":57,"context_line":"spec also proposes changes to allow the disabling of a whole hierarchy branch"},{"line_number":58,"context_line":"within a single operation:"},{"line_number":59,"context_line":""}],"source_content_type":"text/x-rst","patch_set":20,"id":"7aaa499b_235b08f8","line":56,"in_reply_to":"7aaa499b_287f6767","updated":"2015-04-15 14:51:04.000000000","message":"will fix","commit_id":"9ff5cbc0fc66007d995743fcc66eebba1639f7b7"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"b2b4f9de7a55af1ba212dbbd796498404b2c5585","unresolved":false,"context_lines":[{"line_number":64,"context_line":"   enabled children. This approach has the downside of triggering multiple"},{"line_number":65,"context_line":"   writes in the database."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"2. Consider a whole branch as being disabled once a project in a higher level"},{"line_number":68,"context_line":"   of the hierarchy is disabled. Using this approach we avoid to perform"},{"line_number":69,"context_line":"   multiple writes in the database but we rely that revocation events are going"},{"line_number":70,"context_line":"   to carry the information about the whole branch for token validation. When"}],"source_content_type":"text/x-rst","patch_set":20,"id":"7aaa499b_483f5387","line":67,"updated":"2015-04-15 14:33:00.000000000","message":"So these are two options being considered?  That isn\u0027t immediately clear as you read this.","commit_id":"9ff5cbc0fc66007d995743fcc66eebba1639f7b7"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"4b502ef384267206297b244bb25d662b160c1d6d","unresolved":false,"context_lines":[{"line_number":64,"context_line":"   enabled children. This approach has the downside of triggering multiple"},{"line_number":65,"context_line":"   writes in the database."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"2. Consider a whole branch as being disabled once a project in a higher level"},{"line_number":68,"context_line":"   of the hierarchy is disabled. Using this approach we avoid to perform"},{"line_number":69,"context_line":"   multiple writes in the database but we rely that revocation events are going"},{"line_number":70,"context_line":"   to carry the information about the whole branch for token validation. When"}],"source_content_type":"text/x-rst","patch_set":20,"id":"7aaa499b_4b9d0a09","line":67,"in_reply_to":"7aaa499b_435614cf","updated":"2015-04-15 16:11:39.000000000","message":"I think we need to say which one we are proposing...and if necessary list other as alternative.","commit_id":"9ff5cbc0fc66007d995743fcc66eebba1639f7b7"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"49482451990edd31927e53e8ed50bb25065fe8f6","unresolved":false,"context_lines":[{"line_number":64,"context_line":"   enabled children. This approach has the downside of triggering multiple"},{"line_number":65,"context_line":"   writes in the database."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"2. Consider a whole branch as being disabled once a project in a higher level"},{"line_number":68,"context_line":"   of the hierarchy is disabled. Using this approach we avoid to perform"},{"line_number":69,"context_line":"   multiple writes in the database but we rely that revocation events are going"},{"line_number":70,"context_line":"   to carry the information about the whole branch for token validation. When"}],"source_content_type":"text/x-rst","patch_set":20,"id":"7aaa499b_435614cf","line":67,"in_reply_to":"7aaa499b_483f5387","updated":"2015-04-15 14:51:04.000000000","message":"yeah, we need to consider both options.","commit_id":"9ff5cbc0fc66007d995743fcc66eebba1639f7b7"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"aa0bae2b694f6cb0f546796d4c0e915c7b84a111","unresolved":false,"context_lines":[{"line_number":64,"context_line":"   enabled children. This approach has the downside of triggering multiple"},{"line_number":65,"context_line":"   writes in the database."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"2. Consider a whole branch as being disabled once a project in a higher level"},{"line_number":68,"context_line":"   of the hierarchy is disabled. Using this approach we avoid to perform"},{"line_number":69,"context_line":"   multiple writes in the database but we rely that revocation events are going"},{"line_number":70,"context_line":"   to carry the information about the whole branch for token validation. When"}],"source_content_type":"text/x-rst","patch_set":20,"id":"7aaa499b_84dadf4a","line":67,"in_reply_to":"7aaa499b_4b9d0a09","updated":"2015-04-15 17:30:11.000000000","message":"ok... but can we implement alternatives if we decide to?","commit_id":"9ff5cbc0fc66007d995743fcc66eebba1639f7b7"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"dac80f4724e5b78cc51e05cc0a80e45af30417f0","unresolved":false,"context_lines":[{"line_number":64,"context_line":"   enabled children. This approach has the downside of triggering multiple"},{"line_number":65,"context_line":"   writes in the database."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"2. Consider a whole branch as being disabled once a project in a higher level"},{"line_number":68,"context_line":"   of the hierarchy is disabled. Using this approach we avoid to perform"},{"line_number":69,"context_line":"   multiple writes in the database but we rely that revocation events are going"},{"line_number":70,"context_line":"   to carry the information about the whole branch for token validation. When"}],"source_content_type":"text/x-rst","patch_set":20,"id":"5aa745d1_002c0849","line":67,"in_reply_to":"7aaa499b_84dadf4a","updated":"2015-04-15 18:56:22.000000000","message":"sure...although I\u0027d suggest we\u0027d have to update the spec for that, but that\u0027s OK","commit_id":"9ff5cbc0fc66007d995743fcc66eebba1639f7b7"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"b2b4f9de7a55af1ba212dbbd796498404b2c5585","unresolved":false,"context_lines":[{"line_number":74,"context_line":""},{"line_number":75,"context_line":"Recursive deletion leads to access privileges concerns: a user could have"},{"line_number":76,"context_line":"delete privilege for a project in a higher level of the hierarchy and not to"},{"line_number":77,"context_line":"some projects in its subtree. For this reason, there is the need for a new rule"},{"line_number":78,"context_line":"in the keystone ``policy.json`` file and, therefore, a new API to represent"},{"line_number":79,"context_line":"this action. See Alternatives session for a further description of this issue."},{"line_number":80,"context_line":""}],"source_content_type":"text/x-rst","patch_set":20,"id":"7aaa499b_e8f85fc5","line":77,"updated":"2015-04-15 14:33:00.000000000","message":"I think the point here is that although we *could* insist that the caller of a cascade operation has the delete_project permission on every project, it is more likely that in practice a cloud provider will want to reserve such operations to a very restricted set up users/roles - so having a separate policy rule for these matches more closely what will be required in practice.","commit_id":"9ff5cbc0fc66007d995743fcc66eebba1639f7b7"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"4b502ef384267206297b244bb25d662b160c1d6d","unresolved":false,"context_lines":[{"line_number":74,"context_line":""},{"line_number":75,"context_line":"Recursive deletion leads to access privileges concerns: a user could have"},{"line_number":76,"context_line":"delete privilege for a project in a higher level of the hierarchy and not to"},{"line_number":77,"context_line":"some projects in its subtree. For this reason, there is the need for a new rule"},{"line_number":78,"context_line":"in the keystone ``policy.json`` file and, therefore, a new API to represent"},{"line_number":79,"context_line":"this action. See Alternatives session for a further description of this issue."},{"line_number":80,"context_line":""}],"source_content_type":"text/x-rst","patch_set":20,"id":"7aaa499b_ebda96e7","line":77,"in_reply_to":"7aaa499b_83609ca6","updated":"2015-04-15 16:11:39.000000000","message":"I think it could be clearer....as to why you are proposing new rules...","commit_id":"9ff5cbc0fc66007d995743fcc66eebba1639f7b7"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"49482451990edd31927e53e8ed50bb25065fe8f6","unresolved":false,"context_lines":[{"line_number":74,"context_line":""},{"line_number":75,"context_line":"Recursive deletion leads to access privileges concerns: a user could have"},{"line_number":76,"context_line":"delete privilege for a project in a higher level of the hierarchy and not to"},{"line_number":77,"context_line":"some projects in its subtree. For this reason, there is the need for a new rule"},{"line_number":78,"context_line":"in the keystone ``policy.json`` file and, therefore, a new API to represent"},{"line_number":79,"context_line":"this action. See Alternatives session for a further description of this issue."},{"line_number":80,"context_line":""}],"source_content_type":"text/x-rst","patch_set":20,"id":"7aaa499b_83609ca6","line":77,"in_reply_to":"7aaa499b_e8f85fc5","updated":"2015-04-15 14:51:04.000000000","message":"exactly! do you think the text is not clear enough?","commit_id":"9ff5cbc0fc66007d995743fcc66eebba1639f7b7"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"aa0bae2b694f6cb0f546796d4c0e915c7b84a111","unresolved":false,"context_lines":[{"line_number":74,"context_line":""},{"line_number":75,"context_line":"Recursive deletion leads to access privileges concerns: a user could have"},{"line_number":76,"context_line":"delete privilege for a project in a higher level of the hierarchy and not to"},{"line_number":77,"context_line":"some projects in its subtree. For this reason, there is the need for a new rule"},{"line_number":78,"context_line":"in the keystone ``policy.json`` file and, therefore, a new API to represent"},{"line_number":79,"context_line":"this action. See Alternatives session for a further description of this issue."},{"line_number":80,"context_line":""}],"source_content_type":"text/x-rst","patch_set":20,"id":"7aaa499b_e4188320","line":77,"in_reply_to":"7aaa499b_ebda96e7","updated":"2015-04-15 17:30:11.000000000","message":"will try to make it clearer","commit_id":"9ff5cbc0fc66007d995743fcc66eebba1639f7b7"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"6f047b218309bff99bcf452fcbc08c36870e46d1","unresolved":false,"context_lines":[{"line_number":75,"context_line":"Recursive deletion leads to access privileges concerns: a user could have"},{"line_number":76,"context_line":"delete privilege for a project in a higher level of the hierarchy and not to"},{"line_number":77,"context_line":"some projects in its subtree. For this reason, there is the need for a new rule"},{"line_number":78,"context_line":"in the keystone ``policy.json`` file and, therefore, a new API to represent"},{"line_number":79,"context_line":"this action. See Alternatives session for a further description of this issue."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"The new API for the recursive deletion request can have the following format:"}],"source_content_type":"text/x-rst","patch_set":20,"id":"9a68dd71_e0f8dfc6","line":78,"updated":"2016-01-26 20:15:05.000000000","message":"I don;t think so.  Instead, the existing policy rule should be evaluated on each level of the tree, and if, it fails, the whole operation should fail.","commit_id":"9ff5cbc0fc66007d995743fcc66eebba1639f7b7"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"6f047b218309bff99bcf452fcbc08c36870e46d1","unresolved":false,"context_lines":[{"line_number":80,"context_line":""},{"line_number":81,"context_line":"The new API for the recursive deletion request can have the following format:"},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"* DELETE projects/\u003cproject_id\u003e/cascade"},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"Specifying ``cascade`` indicates that the request should also be applied to all"},{"line_number":86,"context_line":"children in the hierarchy."}],"source_content_type":"text/x-rst","patch_set":20,"id":"9a68dd71_c0ffdba8","line":83,"updated":"2016-01-26 20:15:05.000000000","message":"?cascade\u003dtrue  will give us much more flexibility in the future.","commit_id":"9ff5cbc0fc66007d995743fcc66eebba1639f7b7"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"b2b4f9de7a55af1ba212dbbd796498404b2c5585","unresolved":false,"context_lines":[{"line_number":105,"context_line":""},{"line_number":106,"context_line":"Recursive deletion of a project with the is_domain flag enabled won\u0027t be"},{"line_number":107,"context_line":"available: domain deletion is **only** possible for **leaf** domains (domains"},{"line_number":108,"context_line":"without any other children that is also a domain)."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"Alternatives"},{"line_number":111,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":20,"id":"7aaa499b_8891db49","line":108,"updated":"2015-04-15 14:33:00.000000000","message":"I\u0027m not sure why we are making this restriction.  Why not allow it on lead project-domains?","commit_id":"9ff5cbc0fc66007d995743fcc66eebba1639f7b7"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"19a132c781d87d233a76144f2b41999707a905a6","unresolved":false,"context_lines":[{"line_number":105,"context_line":""},{"line_number":106,"context_line":"Recursive deletion of a project with the is_domain flag enabled won\u0027t be"},{"line_number":107,"context_line":"available: domain deletion is **only** possible for **leaf** domains (domains"},{"line_number":108,"context_line":"without any other children that is also a domain)."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"Alternatives"},{"line_number":111,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":20,"id":"5aa745d1_c3fd0a70","line":108,"in_reply_to":"5aa745d1_20eee4ec","updated":"2015-04-15 19:35:08.000000000","message":"ahhh, true... now i get it :) we need /cascade","commit_id":"9ff5cbc0fc66007d995743fcc66eebba1639f7b7"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"dac80f4724e5b78cc51e05cc0a80e45af30417f0","unresolved":false,"context_lines":[{"line_number":105,"context_line":""},{"line_number":106,"context_line":"Recursive deletion of a project with the is_domain flag enabled won\u0027t be"},{"line_number":107,"context_line":"available: domain deletion is **only** possible for **leaf** domains (domains"},{"line_number":108,"context_line":"without any other children that is also a domain)."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"Alternatives"},{"line_number":111,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":20,"id":"5aa745d1_20eee4ec","line":108,"in_reply_to":"7aaa499b_04200f47","updated":"2015-04-15 18:56:22.000000000","message":"So not sure we are seeing eye-to-eye....let\u0027s take an example:\n\n 1) Create a project that acts as a domain by POST /project with is_domain\u003dTrue\n 2) I add 100 sub-projects to this project-domain\n 3) I then want to delete the whole hierarchy and project-domain....how can I do this?  Sure I can use DELETE /domain...but I\u0027d want to use the project API...how can I do that (easily)?","commit_id":"9ff5cbc0fc66007d995743fcc66eebba1639f7b7"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"4b502ef384267206297b244bb25d662b160c1d6d","unresolved":false,"context_lines":[{"line_number":105,"context_line":""},{"line_number":106,"context_line":"Recursive deletion of a project with the is_domain flag enabled won\u0027t be"},{"line_number":107,"context_line":"available: domain deletion is **only** possible for **leaf** domains (domains"},{"line_number":108,"context_line":"without any other children that is also a domain)."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"Alternatives"},{"line_number":111,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":20,"id":"7aaa499b_ae181c76","line":108,"in_reply_to":"7aaa499b_8339bca6","updated":"2015-04-15 16:11:39.000000000","message":"so are you saying that you should use delete_domain for this, then?  I guess that\u0027s OK....but I\u0027d much rather that you could also issue the same delete_project on the leaf-project domain.  Other wise this is the sequence:\n\n 1) Create a project that acts as a domain by POST /project with is_domain\u003dTrue\n 2) Use the project as a domain, create projects etc.\n 3) When I want to delete it....I would expect to be able to call DEL /project/cascade on it....but no, I have to use DEL /domain\n\nIf we allow delete project on project-domain leaf nodes, then you never need to use the domain API...without it...you have to use it only for delete","commit_id":"9ff5cbc0fc66007d995743fcc66eebba1639f7b7"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"49482451990edd31927e53e8ed50bb25065fe8f6","unresolved":false,"context_lines":[{"line_number":105,"context_line":""},{"line_number":106,"context_line":"Recursive deletion of a project with the is_domain flag enabled won\u0027t be"},{"line_number":107,"context_line":"available: domain deletion is **only** possible for **leaf** domains (domains"},{"line_number":108,"context_line":"without any other children that is also a domain)."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"Alternatives"},{"line_number":111,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":20,"id":"7aaa499b_8339bca6","line":108,"in_reply_to":"7aaa499b_8891db49","updated":"2015-04-15 14:51:04.000000000","message":"didn\u0027t understand the question?\n\nif we have A (domain) -\u003e B -\u003e C, once we delete A we also delete B and C, this is how domain deletion current works.\n\ntried to say in this paragraph that if we have X (domain) -\u003e A (domain) -\u003e B -\u003e C, we can\u0027t trigger /cascade deletion for X and we can only delete X if A is previously deleted in a separate request.","commit_id":"9ff5cbc0fc66007d995743fcc66eebba1639f7b7"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"aa0bae2b694f6cb0f546796d4c0e915c7b84a111","unresolved":false,"context_lines":[{"line_number":105,"context_line":""},{"line_number":106,"context_line":"Recursive deletion of a project with the is_domain flag enabled won\u0027t be"},{"line_number":107,"context_line":"available: domain deletion is **only** possible for **leaf** domains (domains"},{"line_number":108,"context_line":"without any other children that is also a domain)."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"Alternatives"},{"line_number":111,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":20,"id":"7aaa499b_04200f47","line":108,"in_reply_to":"7aaa499b_ae181c76","updated":"2015-04-15 17:30:11.000000000","message":"The idea is to use both DELETE /projects and DELETE /domains to delete a is_domain project, but to restrict the use of DELETE /projects/cascade.","commit_id":"9ff5cbc0fc66007d995743fcc66eebba1639f7b7"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"3096103bd4dd6a64e6a2cd7b39dc689778df8385","unresolved":false,"context_lines":[{"line_number":58,"context_line":"within a single operation:"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"* Consider a whole branch as being disabled once a project in a higher level"},{"line_number":61,"context_line":"  of the hierarchy is disabled. By using this approach we avoid to perform"},{"line_number":62,"context_line":"  multiple writes in the database but we rely that revocation events are going"},{"line_number":63,"context_line":"  to carry the information about the whole branch for token validation. In"},{"line_number":64,"context_line":"  addition, when providing a token we need to check if the target has any"}],"source_content_type":"text/x-rst","patch_set":21,"id":"3ab451fb_710030ab","line":61,"updated":"2015-04-17 08:14:26.000000000","message":"nit: s/avoid to/avoid having to/","commit_id":"8f296128aba27ce7c94cb7d08b9c5edf8823f975"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"ffdeb3812ecaed8e99f2e328caacd13923388906","unresolved":false,"context_lines":[{"line_number":58,"context_line":"within a single operation:"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"* Consider a whole branch as being disabled once a project in a higher level"},{"line_number":61,"context_line":"  of the hierarchy is disabled. By using this approach we avoid to perform"},{"line_number":62,"context_line":"  multiple writes in the database but we rely that revocation events are going"},{"line_number":63,"context_line":"  to carry the information about the whole branch for token validation. In"},{"line_number":64,"context_line":"  addition, when providing a token we need to check if the target has any"}],"source_content_type":"text/x-rst","patch_set":21,"id":"3ab451fb_9a2068f9","line":61,"in_reply_to":"3ab451fb_710030ab","updated":"2015-04-17 14:28:24.000000000","message":"Done","commit_id":"8f296128aba27ce7c94cb7d08b9c5edf8823f975"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"3096103bd4dd6a64e6a2cd7b39dc689778df8385","unresolved":false,"context_lines":[{"line_number":62,"context_line":"  multiple writes in the database but we rely that revocation events are going"},{"line_number":63,"context_line":"  to carry the information about the whole branch for token validation. In"},{"line_number":64,"context_line":"  addition, when providing a token we need to check if the target has any"},{"line_number":65,"context_line":"  disabled parents in the hierarchy."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"Both features lead to access privileges concerns: a user could have delete and"},{"line_number":68,"context_line":"update privileges for a project in a higher level of the hierarchy and not to"}],"source_content_type":"text/x-rst","patch_set":21,"id":"3ab451fb_313188a3","line":65,"updated":"2015-04-17 08:14:26.000000000","message":"I must admit, I thought the case already? If it isn\u0027t, then I worry about the fact that this would be changing existing behaviour.","commit_id":"8f296128aba27ce7c94cb7d08b9c5edf8823f975"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"ffdeb3812ecaed8e99f2e328caacd13923388906","unresolved":false,"context_lines":[{"line_number":62,"context_line":"  multiple writes in the database but we rely that revocation events are going"},{"line_number":63,"context_line":"  to carry the information about the whole branch for token validation. In"},{"line_number":64,"context_line":"  addition, when providing a token we need to check if the target has any"},{"line_number":65,"context_line":"  disabled parents in the hierarchy."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"Both features lead to access privileges concerns: a user could have delete and"},{"line_number":68,"context_line":"update privileges for a project in a higher level of the hierarchy and not to"}],"source_content_type":"text/x-rst","patch_set":21,"id":"3ab451fb_da26f015","line":65,"in_reply_to":"3ab451fb_313188a3","updated":"2015-04-17 14:28:24.000000000","message":"yes, me too (even added a question in a previous patch set). we need to 2x check this","commit_id":"8f296128aba27ce7c94cb7d08b9c5edf8823f975"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"d35c3c9cf88538dee52c82e0ef8825310a2ff62b","unresolved":false,"context_lines":[{"line_number":62,"context_line":"  multiple writes in the database but we rely that revocation events are going"},{"line_number":63,"context_line":"  to carry the information about the whole branch for token validation. In"},{"line_number":64,"context_line":"  addition, when providing a token we need to check if the target has any"},{"line_number":65,"context_line":"  disabled parents in the hierarchy."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"Both features lead to access privileges concerns: a user could have delete and"},{"line_number":68,"context_line":"update privileges for a project in a higher level of the hierarchy and not to"}],"source_content_type":"text/x-rst","patch_set":21,"id":"3ab451fb_35739e82","line":65,"in_reply_to":"3ab451fb_5ab099f4","updated":"2015-04-17 17:08:00.000000000","message":"I think henry-nash is talking about the fact that today the API return an error if we try to disable a project with enabled children, so we\u0027d need to change this behavior","commit_id":"8f296128aba27ce7c94cb7d08b9c5edf8823f975"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"22f4ce0c6058b09fb69d981306fe16ba3a8041e8","unresolved":false,"context_lines":[{"line_number":62,"context_line":"  multiple writes in the database but we rely that revocation events are going"},{"line_number":63,"context_line":"  to carry the information about the whole branch for token validation. In"},{"line_number":64,"context_line":"  addition, when providing a token we need to check if the target has any"},{"line_number":65,"context_line":"  disabled parents in the hierarchy."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"Both features lead to access privileges concerns: a user could have delete and"},{"line_number":68,"context_line":"update privileges for a project in a higher level of the hierarchy and not to"}],"source_content_type":"text/x-rst","patch_set":21,"id":"3ab451fb_5ab099f4","line":65,"in_reply_to":"3ab451fb_da26f015","updated":"2015-04-17 16:55:03.000000000","message":"On token validate, we check the revocation events. That\u0027s consistent with the existing behavior.\n\nOn new token creation, we\u0027ll have to walk the tree. But if are storing the materialized path for the tree look up should be much easier.\n\nhttps://review.openstack.org/#/c/173424/","commit_id":"8f296128aba27ce7c94cb7d08b9c5edf8823f975"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"3096103bd4dd6a64e6a2cd7b39dc689778df8385","unresolved":false,"context_lines":[{"line_number":64,"context_line":"  addition, when providing a token we need to check if the target has any"},{"line_number":65,"context_line":"  disabled parents in the hierarchy."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"Both features lead to access privileges concerns: a user could have delete and"},{"line_number":68,"context_line":"update privileges for a project in a higher level of the hierarchy and not to"},{"line_number":69,"context_line":"some projects in its subtree. Although we could insist that the caller of a"},{"line_number":70,"context_line":"recursive operation has the delete_project and update_project permissions on"}],"source_content_type":"text/x-rst","patch_set":21,"id":"3ab451fb_b1a0f891","line":67,"updated":"2015-04-17 08:14:26.000000000","message":"on the update.....seems to me that if today we allow you to update project X even if there is a subproject for which you have no permissions, then we can\u0027t take that way (unless we want to do that generally for all update operations)","commit_id":"8f296128aba27ce7c94cb7d08b9c5edf8823f975"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"d35c3c9cf88538dee52c82e0ef8825310a2ff62b","unresolved":false,"context_lines":[{"line_number":64,"context_line":"  addition, when providing a token we need to check if the target has any"},{"line_number":65,"context_line":"  disabled parents in the hierarchy."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"Both features lead to access privileges concerns: a user could have delete and"},{"line_number":68,"context_line":"update privileges for a project in a higher level of the hierarchy and not to"},{"line_number":69,"context_line":"some projects in its subtree. Although we could insist that the caller of a"},{"line_number":70,"context_line":"recursive operation has the delete_project and update_project permissions on"}],"source_content_type":"text/x-rst","patch_set":21,"id":"3ab451fb_55b98ae8","line":67,"in_reply_to":"3ab451fb_3adcade3","updated":"2015-04-17 17:08:00.000000000","message":"but we allow a more customized ownership model, like using or not inherited roles. so we need to check this","commit_id":"8f296128aba27ce7c94cb7d08b9c5edf8823f975"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"22f4ce0c6058b09fb69d981306fe16ba3a8041e8","unresolved":false,"context_lines":[{"line_number":64,"context_line":"  addition, when providing a token we need to check if the target has any"},{"line_number":65,"context_line":"  disabled parents in the hierarchy."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"Both features lead to access privileges concerns: a user could have delete and"},{"line_number":68,"context_line":"update privileges for a project in a higher level of the hierarchy and not to"},{"line_number":69,"context_line":"some projects in its subtree. Although we could insist that the caller of a"},{"line_number":70,"context_line":"recursive operation has the delete_project and update_project permissions on"}],"source_content_type":"text/x-rst","patch_set":21,"id":"3ab451fb_3adcade3","line":67,"in_reply_to":"3ab451fb_7af91c4d","updated":"2015-04-17 16:55:03.000000000","message":"This is really a question about \"ownership\". That\u0027s exactly what project hierarchy was designed to address at the beginning. In other words, if you own project X, you own the entire subtree under project X.","commit_id":"8f296128aba27ce7c94cb7d08b9c5edf8823f975"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"ffdeb3812ecaed8e99f2e328caacd13923388906","unresolved":false,"context_lines":[{"line_number":64,"context_line":"  addition, when providing a token we need to check if the target has any"},{"line_number":65,"context_line":"  disabled parents in the hierarchy."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"Both features lead to access privileges concerns: a user could have delete and"},{"line_number":68,"context_line":"update privileges for a project in a higher level of the hierarchy and not to"},{"line_number":69,"context_line":"some projects in its subtree. Although we could insist that the caller of a"},{"line_number":70,"context_line":"recursive operation has the delete_project and update_project permissions on"}],"source_content_type":"text/x-rst","patch_set":21,"id":"3ab451fb_7af91c4d","line":67,"in_reply_to":"3ab451fb_b1a0f891","updated":"2015-04-17 14:28:24.000000000","message":"yes, how can we say here that is not a \"single\" update? but from a whole subtree.","commit_id":"8f296128aba27ce7c94cb7d08b9c5edf8823f975"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"3096103bd4dd6a64e6a2cd7b39dc689778df8385","unresolved":false,"context_lines":[{"line_number":76,"context_line":"The new APIs for the delete and update requests can have the following format:"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"* Delete: DELETE projects/\u003cproject_id\u003e/cascade"},{"line_number":79,"context_line":"* Update: PATCH projects/\u003cproject_id\u003e/cascade"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"Specifying ``cascade`` indicates that the request should also be applied to all"},{"line_number":82,"context_line":"children in the hierarchy.  Note that for the update request, the ``enabled``"}],"source_content_type":"text/x-rst","patch_set":21,"id":"3ab451fb_11820c01","line":79,"updated":"2015-04-17 08:14:26.000000000","message":"why would we need a separate update if we are going for the \"disable a top project and everything underneath it should be considered disabled\"?  Are you saying we keep \"state on the update of the enabled flag\" as to whether it was done with a /cascade API or regular one (sounds confusing)","commit_id":"8f296128aba27ce7c94cb7d08b9c5edf8823f975"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"ffdeb3812ecaed8e99f2e328caacd13923388906","unresolved":false,"context_lines":[{"line_number":76,"context_line":"The new APIs for the delete and update requests can have the following format:"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"* Delete: DELETE projects/\u003cproject_id\u003e/cascade"},{"line_number":79,"context_line":"* Update: PATCH projects/\u003cproject_id\u003e/cascade"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"Specifying ``cascade`` indicates that the request should also be applied to all"},{"line_number":82,"context_line":"children in the hierarchy.  Note that for the update request, the ``enabled``"}],"source_content_type":"text/x-rst","patch_set":21,"id":"3ab451fb_20148642","line":79,"in_reply_to":"3ab451fb_11820c01","updated":"2015-04-17 14:28:24.000000000","message":"actually the confusing part is the difference between API and implementation. We are \"effectively\" disabling all projects in the subtree, but the implementation only disables the target project, like we do when we disable domains, for example.","commit_id":"8f296128aba27ce7c94cb7d08b9c5edf8823f975"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"22f4ce0c6058b09fb69d981306fe16ba3a8041e8","unresolved":false,"context_lines":[{"line_number":76,"context_line":"The new APIs for the delete and update requests can have the following format:"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"* Delete: DELETE projects/\u003cproject_id\u003e/cascade"},{"line_number":79,"context_line":"* Update: PATCH projects/\u003cproject_id\u003e/cascade"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"Specifying ``cascade`` indicates that the request should also be applied to all"},{"line_number":82,"context_line":"children in the hierarchy.  Note that for the update request, the ``enabled``"}],"source_content_type":"text/x-rst","patch_set":21,"id":"3ab451fb_3a038d44","line":79,"in_reply_to":"3ab451fb_20148642","updated":"2015-04-17 16:55:03.000000000","message":"What other updates besides enabling/disabling? If none, then this is not needed.","commit_id":"8f296128aba27ce7c94cb7d08b9c5edf8823f975"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"d35c3c9cf88538dee52c82e0ef8825310a2ff62b","unresolved":false,"context_lines":[{"line_number":76,"context_line":"The new APIs for the delete and update requests can have the following format:"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"* Delete: DELETE projects/\u003cproject_id\u003e/cascade"},{"line_number":79,"context_line":"* Update: PATCH projects/\u003cproject_id\u003e/cascade"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"Specifying ``cascade`` indicates that the request should also be applied to all"},{"line_number":82,"context_line":"children in the hierarchy.  Note that for the update request, the ``enabled``"}],"source_content_type":"text/x-rst","patch_set":21,"id":"3ab451fb_f5e7763e","line":79,"in_reply_to":"3ab451fb_3a038d44","updated":"2015-04-17 17:08:00.000000000","message":"we need the policy rule... otherwise we\u0027d check every project in the subtree to verify if the user has update privileges, as consequence of this, we also need the API, right?","commit_id":"8f296128aba27ce7c94cb7d08b9c5edf8823f975"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"3096103bd4dd6a64e6a2cd7b39dc689778df8385","unresolved":false,"context_lines":[{"line_number":88,"context_line":""},{"line_number":89,"context_line":"* We will be able to have a hierarchy of domains. In this hierarchy, we won\u0027t"},{"line_number":90,"context_line":"  have domains under projects, but only domains under domains;"},{"line_number":91,"context_line":"* We will only allow the recursive behavior to affect \"pure\" projects. If we"},{"line_number":92,"context_line":"  trigger the recursive actions on a \"pure\" project we are certain it will"},{"line_number":93,"context_line":"  never hit a domain as per consequence of the previous point."},{"line_number":94,"context_line":""}],"source_content_type":"text/x-rst","patch_set":21,"id":"3ab451fb_31bbc8c6","line":91,"updated":"2015-04-17 08:14:26.000000000","message":"this sentence seems to contradict the next paragraph....","commit_id":"8f296128aba27ce7c94cb7d08b9c5edf8823f975"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"ffdeb3812ecaed8e99f2e328caacd13923388906","unresolved":false,"context_lines":[{"line_number":88,"context_line":""},{"line_number":89,"context_line":"* We will be able to have a hierarchy of domains. In this hierarchy, we won\u0027t"},{"line_number":90,"context_line":"  have domains under projects, but only domains under domains;"},{"line_number":91,"context_line":"* We will only allow the recursive behavior to affect \"pure\" projects. If we"},{"line_number":92,"context_line":"  trigger the recursive actions on a \"pure\" project we are certain it will"},{"line_number":93,"context_line":"  never hit a domain as per consequence of the previous point."},{"line_number":94,"context_line":""}],"source_content_type":"text/x-rst","patch_set":21,"id":"3ab451fb_203b66d3","line":91,"in_reply_to":"3ab451fb_31bbc8c6","updated":"2015-04-17 14:28:24.000000000","message":"true will rewrite it","commit_id":"8f296128aba27ce7c94cb7d08b9c5edf8823f975"}]}