)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"d990ac9b4e20accc61659875bb9372476b54e421","unresolved":false,"context_lines":[{"line_number":12,"context_line":"If no service token is present there is no change in current behaviour."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"If a service token is present and successfully validated then additional"},{"line_number":15,"context_line":"wsgi environment variables are set which services may use to allow or"},{"line_number":16,"context_line":"deny actions in conjunction with the existing environment variables."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"For now delayed authentication is not supported for service tokens;"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":12,"id":"fa98f980_959794eb","line":15,"updated":"2014-09-04 03:51:19.000000000","message":"nit: actually we set them in the headers not the envs","commit_id":"d98971d16d3bdf721c99686e9294bc78437b0cc3"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"e1306f30c3b5057185de652d2775060ef134c1cc","unresolved":false,"context_lines":[{"line_number":12,"context_line":"If no service token is present there is no change in current behaviour."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"If a service token is present and successfully validated then additional"},{"line_number":15,"context_line":"wsgi environment variables are set which services may use to allow or"},{"line_number":16,"context_line":"deny actions in conjunction with the existing environment variables."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"For now delayed authentication is not supported for service tokens;"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":12,"id":"fa98f980_e0b355e7","line":15,"in_reply_to":"fa98f980_959794eb","updated":"2014-09-17 04:21:39.000000000","message":"Done","commit_id":"d98971d16d3bdf721c99686e9294bc78437b0cc3"}],"keystonemiddleware/auth_token.py":[{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"6c2fb3c2f6ee819862b6cc420ecc7c2551d6fe5a","unresolved":false,"context_lines":[{"line_number":60,"context_line":""},{"line_number":61,"context_line":"When using composite authentication some additional service headers relating"},{"line_number":62,"context_line":"to the service user can be added. They take the same form as the standard"},{"line_number":63,"context_line":"headers but add \u0027_SERVICE_\u0027."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"HTTP_X_IDENTITY_STATUS"},{"line_number":66,"context_line":"    \u0027Confirmed\u0027 or \u0027Invalid\u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"baada198_37ac0035","line":63,"updated":"2014-07-21 18:41:33.000000000","message":"Do we need these to be set to NONE/Empty if a service-token isn\u0027t passed?","commit_id":"157e5f3157a37d39930d1c39bf53ec20f4938393"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"63798d1a52ada08f85bb96f1c42ae99df8184e12","unresolved":false,"context_lines":[{"line_number":60,"context_line":""},{"line_number":61,"context_line":"When using composite authentication some additional service headers relating"},{"line_number":62,"context_line":"to the service user can be added. They take the same form as the standard"},{"line_number":63,"context_line":"headers but add \u0027_SERVICE_\u0027."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"HTTP_X_IDENTITY_STATUS"},{"line_number":66,"context_line":"    \u0027Confirmed\u0027 or \u0027Invalid\u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"baada198_80181a85","line":63,"in_reply_to":"baada198_37ac0035","updated":"2014-07-28 13:42:59.000000000","message":"As coded, the HTTP_X_SERVICE_*  variables won\u0027t exist in the environment if the service token is absent. That\u0027s fine -- you simply need to say that here.","commit_id":"157e5f3157a37d39930d1c39bf53ec20f4938393"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"b9809ebb79751ba5a003b77b77b56ff15390370a","unresolved":false,"context_lines":[{"line_number":60,"context_line":""},{"line_number":61,"context_line":"When using composite authentication some additional service headers relating"},{"line_number":62,"context_line":"to the service user can be added. They take the same form as the standard"},{"line_number":63,"context_line":"headers but add \u0027_SERVICE_\u0027."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"HTTP_X_IDENTITY_STATUS"},{"line_number":66,"context_line":"    \u0027Confirmed\u0027 or \u0027Invalid\u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"baada198_a6c7ac64","line":63,"in_reply_to":"baada198_80181a85","updated":"2014-07-30 01:10:10.000000000","message":"++","commit_id":"157e5f3157a37d39930d1c39bf53ec20f4938393"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"ff5ba0078ba4df1074376995b797efd112b57097","unresolved":false,"context_lines":[{"line_number":60,"context_line":""},{"line_number":61,"context_line":"When using composite authentication some additional service headers relating"},{"line_number":62,"context_line":"to the service user can be added. They take the same form as the standard"},{"line_number":63,"context_line":"headers but add \u0027_SERVICE_\u0027."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"HTTP_X_IDENTITY_STATUS"},{"line_number":66,"context_line":"    \u0027Confirmed\u0027 or \u0027Invalid\u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"baada198_27746136","line":63,"in_reply_to":"baada198_a6c7ac64","updated":"2014-07-30 15:51:14.000000000","message":"Done (added comment)","commit_id":"157e5f3157a37d39930d1c39bf53ec20f4938393"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"b9809ebb79751ba5a003b77b77b56ff15390370a","unresolved":false,"context_lines":[{"line_number":113,"context_line":"HTTP_X_ROLES, HTTP_X_SERVICE_ROLES"},{"line_number":114,"context_line":"    Comma delimited list of case-sensitive role names"},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"HTTP_X_SERVICE_CATALOG"},{"line_number":117,"context_line":"    json encoded keystone service catalog (optional)."},{"line_number":118,"context_line":"    For compatibility reasons this catalog will always be in the V2 catalog"},{"line_number":119,"context_line":"    format even if it is a v3 token."}],"source_content_type":"text/x-python","patch_set":1,"id":"baada198_c6c4a062","line":116,"updated":"2014-07-30 01:10:10.000000000","message":"We don\u0027t need HTTP_X_SERVICE_SERVICE_CATALOG? Just saying. :)","commit_id":"157e5f3157a37d39930d1c39bf53ec20f4938393"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"ff5ba0078ba4df1074376995b797efd112b57097","unresolved":false,"context_lines":[{"line_number":113,"context_line":"HTTP_X_ROLES, HTTP_X_SERVICE_ROLES"},{"line_number":114,"context_line":"    Comma delimited list of case-sensitive role names"},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"HTTP_X_SERVICE_CATALOG"},{"line_number":117,"context_line":"    json encoded keystone service catalog (optional)."},{"line_number":118,"context_line":"    For compatibility reasons this catalog will always be in the V2 catalog"},{"line_number":119,"context_line":"    format even if it is a v3 token."}],"source_content_type":"text/x-python","patch_set":1,"id":"baada198_a7b6b1d9","line":116,"in_reply_to":"baada198_c6c4a062","updated":"2014-07-30 15:51:14.000000000","message":"We decided that it would be bad to have that in -- the size of headers when the current servicve catalog is present is already causing problems in some cases.\n\nI\u0027ll add a comment explicitly saying that.","commit_id":"157e5f3157a37d39930d1c39bf53ec20f4938393"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"c129a17c5466a2146f80bab4e3018ca569d397e3","unresolved":false,"context_lines":[{"line_number":558,"context_line":""},{"line_number":559,"context_line":"        try:"},{"line_number":560,"context_line":"            self._remove_auth_headers(env)"},{"line_number":561,"context_line":""},{"line_number":562,"context_line":"            user_token \u003d self._get_user_token_from_header(env)"},{"line_number":563,"context_line":"            token_info \u003d self._validate_user_token(user_token, env)"},{"line_number":564,"context_line":"            env[\u0027keystone.token_info\u0027] \u003d token_info"}],"source_content_type":"text/x-python","patch_set":1,"id":"baada198_d732e45c","line":561,"updated":"2014-07-21 18:33:31.000000000","message":"White-space change should be reverted.","commit_id":"157e5f3157a37d39930d1c39bf53ec20f4938393"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"ff5ba0078ba4df1074376995b797efd112b57097","unresolved":false,"context_lines":[{"line_number":558,"context_line":""},{"line_number":559,"context_line":"        try:"},{"line_number":560,"context_line":"            self._remove_auth_headers(env)"},{"line_number":561,"context_line":""},{"line_number":562,"context_line":"            user_token \u003d self._get_user_token_from_header(env)"},{"line_number":563,"context_line":"            token_info \u003d self._validate_user_token(user_token, env)"},{"line_number":564,"context_line":"            env[\u0027keystone.token_info\u0027] \u003d token_info"}],"source_content_type":"text/x-python","patch_set":1,"id":"baada198_4746b5c1","line":561,"in_reply_to":"baada198_d732e45c","updated":"2014-07-30 15:51:14.000000000","message":"Done","commit_id":"157e5f3157a37d39930d1c39bf53ec20f4938393"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"6c2fb3c2f6ee819862b6cc420ecc7c2551d6fe5a","unresolved":false,"context_lines":[{"line_number":566,"context_line":"            self._add_headers(env, user_headers)"},{"line_number":567,"context_line":""},{"line_number":568,"context_line":"            serv_token \u003d self._get_service_token_from_header(env)"},{"line_number":569,"context_line":"            if serv_token is not None:"},{"line_number":570,"context_line":"                serv_token_info \u003d self._validate_user_token(serv_token, env)"},{"line_number":571,"context_line":"                serv_headers \u003d self._build_service_headers(serv_token_info)"},{"line_number":572,"context_line":"                self._add_headers(env, serv_headers)"}],"source_content_type":"text/x-python","patch_set":1,"id":"baada198_091e045f","line":569,"updated":"2014-07-21 18:41:33.000000000","message":"Suggest add:\n\n    self._LOG.debug(\u0027Authenticating service token\u0027)\n\nor a similar verbiage debug log.","commit_id":"157e5f3157a37d39930d1c39bf53ec20f4938393"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"ff5ba0078ba4df1074376995b797efd112b57097","unresolved":false,"context_lines":[{"line_number":566,"context_line":"            self._add_headers(env, user_headers)"},{"line_number":567,"context_line":""},{"line_number":568,"context_line":"            serv_token \u003d self._get_service_token_from_header(env)"},{"line_number":569,"context_line":"            if serv_token is not None:"},{"line_number":570,"context_line":"                serv_token_info \u003d self._validate_user_token(serv_token, env)"},{"line_number":571,"context_line":"                serv_headers \u003d self._build_service_headers(serv_token_info)"},{"line_number":572,"context_line":"                self._add_headers(env, serv_headers)"}],"source_content_type":"text/x-python","patch_set":1,"id":"baada198_6abc60b6","line":569,"in_reply_to":"baada198_091e045f","updated":"2014-07-30 15:51:14.000000000","message":"Done","commit_id":"157e5f3157a37d39930d1c39bf53ec20f4938393"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"c129a17c5466a2146f80bab4e3018ca569d397e3","unresolved":false,"context_lines":[{"line_number":567,"context_line":""},{"line_number":568,"context_line":"            serv_token \u003d self._get_service_token_from_header(env)"},{"line_number":569,"context_line":"            if serv_token is not None:"},{"line_number":570,"context_line":"                serv_token_info \u003d self._validate_user_token(serv_token, env)"},{"line_number":571,"context_line":"                serv_headers \u003d self._build_service_headers(serv_token_info)"},{"line_number":572,"context_line":"                self._add_headers(env, serv_headers)"},{"line_number":573,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"baada198_b7649049","line":570,"updated":"2014-07-21 18:33:31.000000000","message":"Do we need to handle a service token differently than the x-auth-token, as in if the x-service-token is invalid, do we set the service token headers to None or do we bounce it out with a 401 just like if x-auth-token is invalid? \n\nI don\u0027t know which would be a better case.","commit_id":"157e5f3157a37d39930d1c39bf53ec20f4938393"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"63798d1a52ada08f85bb96f1c42ae99df8184e12","unresolved":false,"context_lines":[{"line_number":567,"context_line":""},{"line_number":568,"context_line":"            serv_token \u003d self._get_service_token_from_header(env)"},{"line_number":569,"context_line":"            if serv_token is not None:"},{"line_number":570,"context_line":"                serv_token_info \u003d self._validate_user_token(serv_token, env)"},{"line_number":571,"context_line":"                serv_headers \u003d self._build_service_headers(serv_token_info)"},{"line_number":572,"context_line":"                self._add_headers(env, serv_headers)"},{"line_number":573,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"baada198_c054d2c7","line":570,"in_reply_to":"baada198_b7649049","updated":"2014-07-28 13:42:59.000000000","message":"Assuming the calling service (e.g.. glance) caches its service token, a 401 now is better. It would handle a 401 by asking for a new token and re-trying.\n\nIf you allow the request to proceed, the receiving service (e.g. Swift) might return 403","commit_id":"157e5f3157a37d39930d1c39bf53ec20f4938393"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"ff5ba0078ba4df1074376995b797efd112b57097","unresolved":false,"context_lines":[{"line_number":567,"context_line":""},{"line_number":568,"context_line":"            serv_token \u003d self._get_service_token_from_header(env)"},{"line_number":569,"context_line":"            if serv_token is not None:"},{"line_number":570,"context_line":"                serv_token_info \u003d self._validate_user_token(serv_token, env)"},{"line_number":571,"context_line":"                serv_headers \u003d self._build_service_headers(serv_token_info)"},{"line_number":572,"context_line":"                self._add_headers(env, serv_headers)"},{"line_number":573,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"baada198_27d381d4","line":570,"in_reply_to":"baada198_c054d2c7","updated":"2014-07-30 15:51:14.000000000","message":"Yes, I thought about this for a while. I decided, the same as Donagh, that it was better if the service could assume that the service token had been previously authenticated. Otherwise I think the logic gets trickier. (I\u0027m open to other thoughts here.)","commit_id":"157e5f3157a37d39930d1c39bf53ec20f4938393"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"b9809ebb79751ba5a003b77b77b56ff15390370a","unresolved":false,"context_lines":[{"line_number":629,"context_line":"                        \u0027,\u0027.join(auth_headers))"},{"line_number":630,"context_line":"        self._remove_headers(env, auth_headers)"},{"line_number":631,"context_line":""},{"line_number":632,"context_line":"    def _remove_service_auth_headers(self, env):"},{"line_number":633,"context_line":"        \"\"\"Remove service headers so a user can\u0027t fake authentication."},{"line_number":634,"context_line":""},{"line_number":635,"context_line":"        :param env: wsgi request environment"}],"source_content_type":"text/x-python","patch_set":1,"id":"baada198_66b674fb","line":632,"updated":"2014-07-30 01:10:10.000000000","message":"can we make it generic so it can be used by both auth and service token?\n\ndef _remove_auth_headers(self, env, prefix\u003d\u0027X-\u0027):\n\nfor service token we just call it like this\n\n_remove_auth_headers(env, prefix\u003d\u0027X-Service-\u0027)","commit_id":"157e5f3157a37d39930d1c39bf53ec20f4938393"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"ff5ba0078ba4df1074376995b797efd112b57097","unresolved":false,"context_lines":[{"line_number":629,"context_line":"                        \u0027,\u0027.join(auth_headers))"},{"line_number":630,"context_line":"        self._remove_headers(env, auth_headers)"},{"line_number":631,"context_line":""},{"line_number":632,"context_line":"    def _remove_service_auth_headers(self, env):"},{"line_number":633,"context_line":"        \"\"\"Remove service headers so a user can\u0027t fake authentication."},{"line_number":634,"context_line":""},{"line_number":635,"context_line":"        :param env: wsgi request environment"}],"source_content_type":"text/x-python","patch_set":1,"id":"baada198_2ac26835","line":632,"in_reply_to":"baada198_66b674fb","updated":"2014-07-30 15:51:14.000000000","message":"See reply to similar comment from Morgan below.","commit_id":"157e5f3157a37d39930d1c39bf53ec20f4938393"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"30bc569aea876370d86d4eb461a53ddd15c3a0e8","unresolved":false,"context_lines":[{"line_number":636,"context_line":""},{"line_number":637,"context_line":"        \"\"\""},{"line_number":638,"context_line":"        service_headers \u003d ("},{"line_number":639,"context_line":"            \u0027X-Service-Domain-Id\u0027,"},{"line_number":640,"context_line":"            \u0027X-Service-Domain-Name\u0027,"},{"line_number":641,"context_line":"            \u0027X-Service-Project-Id\u0027,"},{"line_number":642,"context_line":"            \u0027X-Service-Project-Name\u0027,"}],"source_content_type":"text/x-python","patch_set":1,"id":"baada198_a126f664","line":639,"updated":"2014-07-22 05:17:55.000000000","message":"Just curious. Why do we need  X-Service-Domain-Id and X-Service-Domain-Name?  Services tokens are always tenant scoped and not domain scoped?","commit_id":"157e5f3157a37d39930d1c39bf53ec20f4938393"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"b9809ebb79751ba5a003b77b77b56ff15390370a","unresolved":false,"context_lines":[{"line_number":796,"context_line":""},{"line_number":797,"context_line":"        return rval"},{"line_number":798,"context_line":""},{"line_number":799,"context_line":"    def _build_service_headers(self, token_info):"},{"line_number":800,"context_line":"        \"\"\"Convert token object into service headers."},{"line_number":801,"context_line":""},{"line_number":802,"context_line":"        Build headers that represent authenticated user - see main"}],"source_content_type":"text/x-python","patch_set":1,"id":"baada198_66df543b","line":799,"updated":"2014-07-30 01:10:10.000000000","message":"seem like this can be a generic method\n\ndef _build_headers(self, token_info, prefix):\n\nfor example\n\n_build_headers(service_token_info, prefix\u003d\u0027X-Service-\u0027)\n\nThat way we can use the same code for both tokens.","commit_id":"157e5f3157a37d39930d1c39bf53ec20f4938393"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"ff5ba0078ba4df1074376995b797efd112b57097","unresolved":false,"context_lines":[{"line_number":796,"context_line":""},{"line_number":797,"context_line":"        return rval"},{"line_number":798,"context_line":""},{"line_number":799,"context_line":"    def _build_service_headers(self, token_info):"},{"line_number":800,"context_line":"        \"\"\"Convert token object into service headers."},{"line_number":801,"context_line":""},{"line_number":802,"context_line":"        Build headers that represent authenticated user - see main"}],"source_content_type":"text/x-python","patch_set":1,"id":"baada198_0af5a483","line":799,"in_reply_to":"baada198_66df543b","updated":"2014-07-30 15:51:14.000000000","message":"See reply to Morgan\u0027s similar comment below.","commit_id":"157e5f3157a37d39930d1c39bf53ec20f4938393"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"6c2fb3c2f6ee819862b6cc420ecc7c2551d6fe5a","unresolved":false,"context_lines":[{"line_number":810,"context_line":"        roles \u003d \u0027,\u0027.join(auth_ref.role_names)"},{"line_number":811,"context_line":""},{"line_number":812,"context_line":"        if _token_is_v2(token_info) and not auth_ref.project_id:"},{"line_number":813,"context_line":"            raise InvalidUserToken(\u0027Unable to determine tenancy.\u0027)"},{"line_number":814,"context_line":""},{"line_number":815,"context_line":"        rval \u003d {"},{"line_number":816,"context_line":"            \u0027X-Service-Domain-Id\u0027: auth_ref.domain_id,"}],"source_content_type":"text/x-python","patch_set":1,"id":"baada198_b73570f8","line":813,"updated":"2014-07-21 18:41:33.000000000","message":"I am unsure if this verbiage is correct on the exception. I do not have better verbiage to contribute though at the moment.","commit_id":"157e5f3157a37d39930d1c39bf53ec20f4938393"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"ff5ba0078ba4df1074376995b797efd112b57097","unresolved":false,"context_lines":[{"line_number":810,"context_line":"        roles \u003d \u0027,\u0027.join(auth_ref.role_names)"},{"line_number":811,"context_line":""},{"line_number":812,"context_line":"        if _token_is_v2(token_info) and not auth_ref.project_id:"},{"line_number":813,"context_line":"            raise InvalidUserToken(\u0027Unable to determine tenancy.\u0027)"},{"line_number":814,"context_line":""},{"line_number":815,"context_line":"        rval \u003d {"},{"line_number":816,"context_line":"            \u0027X-Service-Domain-Id\u0027: auth_ref.domain_id,"}],"source_content_type":"text/x-python","patch_set":1,"id":"baada198_aa5e78e6","line":813,"in_reply_to":"baada198_606306ab","updated":"2014-07-30 15:51:14.000000000","message":"I took this verbatim from line 764 above.\nI\u0027ll add \u0027service\u0027 into the string to disambiguate the two messages.","commit_id":"157e5f3157a37d39930d1c39bf53ec20f4938393"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"63798d1a52ada08f85bb96f1c42ae99df8184e12","unresolved":false,"context_lines":[{"line_number":810,"context_line":"        roles \u003d \u0027,\u0027.join(auth_ref.role_names)"},{"line_number":811,"context_line":""},{"line_number":812,"context_line":"        if _token_is_v2(token_info) and not auth_ref.project_id:"},{"line_number":813,"context_line":"            raise InvalidUserToken(\u0027Unable to determine tenancy.\u0027)"},{"line_number":814,"context_line":""},{"line_number":815,"context_line":"        rval \u003d {"},{"line_number":816,"context_line":"            \u0027X-Service-Domain-Id\u0027: auth_ref.domain_id,"}],"source_content_type":"text/x-python","patch_set":1,"id":"baada198_606306ab","line":813,"in_reply_to":"baada198_b73570f8","updated":"2014-07-28 13:42:59.000000000","message":"How about \"X-Service-Token must be scoped to a project\" ?","commit_id":"157e5f3157a37d39930d1c39bf53ec20f4938393"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"6c2fb3c2f6ee819862b6cc420ecc7c2551d6fe5a","unresolved":false,"context_lines":[{"line_number":823,"context_line":"            \u0027X-Service-User-Name\u0027: auth_ref.username,"},{"line_number":824,"context_line":"            \u0027X-Service-User-Domain-Id\u0027: auth_ref.user_domain_id,"},{"line_number":825,"context_line":"            \u0027X-Service-User-Domain-Name\u0027: auth_ref.user_domain_name,"},{"line_number":826,"context_line":"            \u0027X-Service-Roles\u0027: roles,"},{"line_number":827,"context_line":"        }"},{"line_number":828,"context_line":""},{"line_number":829,"context_line":"        self._LOG.debug(\u0027Received request from user: %s with service \u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"baada198_898db47e","line":826,"updated":"2014-07-21 18:41:33.000000000","message":"Maybe we should make the mapping of \"Name\" to location in the ref something we can update one location and get both here and in build_user_headers\n\nMaybe a structure like:\n\n    HEADER_TEMPLATE \u003d \n        {\u0027X-%s-Domain-Id\u0027: \u0027domain_id\u0027,\n         ...\n        }\n\n    ...\n\n    header_type \u003d \u0027Service\u0027\n\n    for header_tmplt, attr in six.iteritems(HEADER_TEMPLATE):\n        rval[header_tmplt % header_type] \u003d getattr(ref, attr)\n\nThat means we don\u0027t need to remember to update both locations (provided the headers stay the same between both build methods)","commit_id":"157e5f3157a37d39930d1c39bf53ec20f4938393"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"ff5ba0078ba4df1074376995b797efd112b57097","unresolved":false,"context_lines":[{"line_number":823,"context_line":"            \u0027X-Service-User-Name\u0027: auth_ref.username,"},{"line_number":824,"context_line":"            \u0027X-Service-User-Domain-Id\u0027: auth_ref.user_domain_id,"},{"line_number":825,"context_line":"            \u0027X-Service-User-Domain-Name\u0027: auth_ref.user_domain_name,"},{"line_number":826,"context_line":"            \u0027X-Service-Roles\u0027: roles,"},{"line_number":827,"context_line":"        }"},{"line_number":828,"context_line":""},{"line_number":829,"context_line":"        self._LOG.debug(\u0027Received request from user: %s with service \u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"baada198_eab070de","line":826,"in_reply_to":"baada198_898db47e","updated":"2014-07-30 15:51:14.000000000","message":"Guang had similar feedback above.\n\nThe code as-is doesn\u0027t have the same (root) headers in both places (for this case and build_user_headers). I am open to having a common template and a dict of user specific properties and service specific properties, and then populating them. Do people think that is worthwhile, or just adding complexity/making the code trickier to read?","commit_id":"157e5f3157a37d39930d1c39bf53ec20f4938393"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"eac67969d486b34c3863f919bfbfb90fc41deaf1","unresolved":false,"context_lines":[{"line_number":70,"context_line":"HTTP_X_DOMAIN_ID, HTTP_X_SERVICE_DOMAIN_ID"},{"line_number":71,"context_line":"    Identity service managed unique identifier, string. Only present if"},{"line_number":72,"context_line":"    this is a domain-scoped v3 token."},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"HTTP_X_DOMAIN_NAME, HTTP_X_SERVICE_DOMAIN_NAME,"},{"line_number":75,"context_line":"    Unique domain name, string. Only present if this is a domain-scoped"},{"line_number":76,"context_line":"    v3 token."}],"source_content_type":"text/x-python","patch_set":3,"id":"baada198_74da881e","line":73,"updated":"2014-07-30 13:43:02.000000000","message":"extraneous comma after HTTP_X_SERVICE_DOMAIN_NAME","commit_id":"47d68f87e0b0ffaded5d9de2361c5603baa5717e"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"dd517d70ca85945653568b1216f22bdb3802b29b","unresolved":false,"context_lines":[{"line_number":70,"context_line":"HTTP_X_DOMAIN_ID, HTTP_X_SERVICE_DOMAIN_ID"},{"line_number":71,"context_line":"    Identity service managed unique identifier, string. Only present if"},{"line_number":72,"context_line":"    this is a domain-scoped v3 token."},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"HTTP_X_DOMAIN_NAME, HTTP_X_SERVICE_DOMAIN_NAME,"},{"line_number":75,"context_line":"    Unique domain name, string. Only present if this is a domain-scoped"},{"line_number":76,"context_line":"    v3 token."}],"source_content_type":"text/x-python","patch_set":3,"id":"baada198_8a0ff48a","line":73,"in_reply_to":"baada198_74da881e","updated":"2014-07-30 15:51:46.000000000","message":"yes","commit_id":"47d68f87e0b0ffaded5d9de2361c5603baa5717e"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"eac67969d486b34c3863f919bfbfb90fc41deaf1","unresolved":false,"context_lines":[{"line_number":82,"context_line":"HTTP_X_PROJECT_NAME, HTTP_X_SERVICE_PROJECT_NAME"},{"line_number":83,"context_line":"    Project name, unique within owning domain, string. Only present if"},{"line_number":84,"context_line":"    this is a project-scoped v3 token, or a tenant-scoped v2 token."},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"HTTP_X_PROJECT_DOMAIN_ID, HTTP_X_SERVICE_PROJECT_DOMAIN_ID,"},{"line_number":87,"context_line":"    Identity service managed unique identifier of owning domain of"},{"line_number":88,"context_line":"    project, string.  Only present if this is a project-scoped v3 token. If"}],"source_content_type":"text/x-python","patch_set":3,"id":"baada198_b4e420e1","line":85,"updated":"2014-07-30 13:43:02.000000000","message":"Dito","commit_id":"47d68f87e0b0ffaded5d9de2361c5603baa5717e"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"dd517d70ca85945653568b1216f22bdb3802b29b","unresolved":false,"context_lines":[{"line_number":82,"context_line":"HTTP_X_PROJECT_NAME, HTTP_X_SERVICE_PROJECT_NAME"},{"line_number":83,"context_line":"    Project name, unique within owning domain, string. Only present if"},{"line_number":84,"context_line":"    this is a project-scoped v3 token, or a tenant-scoped v2 token."},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"HTTP_X_PROJECT_DOMAIN_ID, HTTP_X_SERVICE_PROJECT_DOMAIN_ID,"},{"line_number":87,"context_line":"    Identity service managed unique identifier of owning domain of"},{"line_number":88,"context_line":"    project, string.  Only present if this is a project-scoped v3 token. If"}],"source_content_type":"text/x-python","patch_set":3,"id":"baada198_ca09ec85","line":85,"in_reply_to":"baada198_b4e420e1","updated":"2014-07-30 15:51:46.000000000","message":"yes","commit_id":"47d68f87e0b0ffaded5d9de2361c5603baa5717e"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"c7d0985fe2dbbdc9f941dc945c4ff21c5af23ab7","unresolved":false,"context_lines":[{"line_number":41,"context_line":"HTTP_X_AUTH_TOKEN"},{"line_number":42,"context_line":"    The client token being passed in."},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"HTTP_X_SERVICE_AUTH_TOKEN"},{"line_number":45,"context_line":"    A service token being passed in."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"HTTP_X_STORAGE_TOKEN"}],"source_content_type":"text/x-python","patch_set":4,"id":"baada198_2ef415f0","line":44,"updated":"2014-07-31 13:11:38.000000000","message":"Is the name \"X-Service-Auth-Token\" or \"X-Service-Token\"? (the latter used by http://git.openstack.org/cgit/openstack/keystone-specs/plain/specs/keystonemiddleware/service-tokens.rst)","commit_id":"7918d15822763eba8c8c87b521b2b43e619579f1"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"c7d0985fe2dbbdc9f941dc945c4ff21c5af23ab7","unresolved":false,"context_lines":[{"line_number":57,"context_line":""},{"line_number":58,"context_line":"What we add to the request for use by the OpenStack service"},{"line_number":59,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"When using composite authentication some additional service headers relating"},{"line_number":62,"context_line":"to the service user can be added. They take the same form as the standard"},{"line_number":63,"context_line":"headers but add \u0027_SERVICE_\u0027. These headers will not exist in the environment"}],"source_content_type":"text/x-python","patch_set":4,"id":"baada198_43b5a9eb","line":60,"updated":"2014-07-31 13:11:38.000000000","message":"You mention \"composite authentication\" here -- but the term is not defined. It would be simpler just to say \"When a service token is present some additional...\" (where \"service token\" has been defined above)","commit_id":"7918d15822763eba8c8c87b521b2b43e619579f1"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"c7d0985fe2dbbdc9f941dc945c4ff21c5af23ab7","unresolved":false,"context_lines":[{"line_number":569,"context_line":"            self._add_headers(env, user_headers)"},{"line_number":570,"context_line":""},{"line_number":571,"context_line":"            serv_token \u003d self._get_service_token_from_header(env)"},{"line_number":572,"context_line":"            if serv_token is not None:"},{"line_number":573,"context_line":"                self._LOG.debug(\u0027Authenticating service token\u0027)"},{"line_number":574,"context_line":"                serv_token_info \u003d self._validate_user_token(serv_token, env)"},{"line_number":575,"context_line":"                serv_headers \u003d self._build_service_headers(serv_token_info)"}],"source_content_type":"text/x-python","patch_set":4,"id":"baada198_e3479d78","line":572,"updated":"2014-07-31 13:11:38.000000000","message":"Should this be (simply):\n\n     if serv_token:\n         self._LOG....\n\nOR is the \"is not None\" needed to handle a case where X-Service-Token is given but is an empty string...and you want to call _validate_user_token() anyway?","commit_id":"7918d15822763eba8c8c87b521b2b43e619579f1"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"c7d0985fe2dbbdc9f941dc945c4ff21c5af23ab7","unresolved":false,"context_lines":[{"line_number":578,"context_line":"            return self._app(env, start_response)"},{"line_number":579,"context_line":""},{"line_number":580,"context_line":"        except InvalidUserToken:"},{"line_number":581,"context_line":"            if self._delay_auth_decision:"},{"line_number":582,"context_line":"                self._LOG.info("},{"line_number":583,"context_line":"                    \u0027Invalid user token - deferring reject downstream\u0027)"},{"line_number":584,"context_line":"                self._add_headers(env, {\u0027X-Identity-Status\u0027: \u0027Invalid\u0027})"}],"source_content_type":"text/x-python","patch_set":4,"id":"baada198_8d328af1","line":581,"updated":"2014-07-31 13:11:38.000000000","message":"For the invalid-user-token case, Swift currently will deny with a 401 i.e., it handles the interaction of delay_auth_decision and invalid token. Hence, arguably, it should be up to the downstream service (Swift) to also do the right thing when the service token is invalid.\n\nHowever, I\u0027ve spent over a hour trying to work through different scenarios (e..g, Glance/Keystonemiddleware s/w is updated, but you are are still rolling out a Swift s/w update). It would make life easier if we simply decided now that delay_auth_decision does not apply to service token. Who else besides Swift use delay_auth_decision?\n\nAlso, if delay_auth_decision applies to service token, you need to add HTTP_X_SERVICE_IDENTITY_STATUS, otherwise the downstream can\u0027t make the right decision.","commit_id":"7918d15822763eba8c8c87b521b2b43e619579f1"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"8da9d53dad7eeb1bdf4a58d14d222758ef053a4d","unresolved":false,"context_lines":[{"line_number":578,"context_line":"            return self._app(env, start_response)"},{"line_number":579,"context_line":""},{"line_number":580,"context_line":"        except InvalidUserToken:"},{"line_number":581,"context_line":"            if self._delay_auth_decision:"},{"line_number":582,"context_line":"                self._LOG.info("},{"line_number":583,"context_line":"                    \u0027Invalid user token - deferring reject downstream\u0027)"},{"line_number":584,"context_line":"                self._add_headers(env, {\u0027X-Identity-Status\u0027: \u0027Invalid\u0027})"}],"source_content_type":"text/x-python","patch_set":4,"id":"baada198_beb42ff2","line":581,"in_reply_to":"baada198_8d328af1","updated":"2014-08-05 17:56:11.000000000","message":"Ideally everyone should be using delay auth decision. but that is a different topic and we can address that in K if we go down that path.","commit_id":"7918d15822763eba8c8c87b521b2b43e619579f1"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"c7d0985fe2dbbdc9f941dc945c4ff21c5af23ab7","unresolved":false,"context_lines":[{"line_number":579,"context_line":""},{"line_number":580,"context_line":"        except InvalidUserToken:"},{"line_number":581,"context_line":"            if self._delay_auth_decision:"},{"line_number":582,"context_line":"                self._LOG.info("},{"line_number":583,"context_line":"                    \u0027Invalid user token - deferring reject downstream\u0027)"},{"line_number":584,"context_line":"                self._add_headers(env, {\u0027X-Identity-Status\u0027: \u0027Invalid\u0027})"},{"line_number":585,"context_line":"                return self._app(env, start_response)"}],"source_content_type":"text/x-python","patch_set":4,"id":"baada198_0d759a96","line":582,"updated":"2014-07-31 13:11:38.000000000","message":"This message should be modified depending on the daly_auth_decision outcome --- it might not be a \"user token\"","commit_id":"7918d15822763eba8c8c87b521b2b43e619579f1"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"c7d0985fe2dbbdc9f941dc945c4ff21c5af23ab7","unresolved":false,"context_lines":[{"line_number":598,"context_line":""},{"line_number":599,"context_line":"        :param env: wsgi request environment"},{"line_number":600,"context_line":""},{"line_number":601,"context_line":"        \"\"\""},{"line_number":602,"context_line":"        self._remove_user_auth_headers(env)"},{"line_number":603,"context_line":"        self._remove_service_auth_headers(env)"},{"line_number":604,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"baada198_3ccb72a5","line":601,"updated":"2014-07-31 13:11:38.000000000","message":"I think you should have one function to remove all headers -- it\u0027s better that it match the list in  \"What we add to the request for use by the OpenStack service\" than it match some functional division between X-Auth-Token and X-Service-Token. It\u0027s easier to inspect that the list is complete. So you end up with:\n\n    auth_headers \u003d (\n        \u0027X-Identity-Status\u0027,\n        \u0027X-Domain-Id\u0027, \u0027X--Service-Domain-Id\u0027,\n        ...etc\n\n\nHowever, I would not give a -1 if you leave as-is","commit_id":"7918d15822763eba8c8c87b521b2b43e619579f1"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"c7d0985fe2dbbdc9f941dc945c4ff21c5af23ab7","unresolved":false,"context_lines":[{"line_number":652,"context_line":"            \u0027X-Service-User-Domain-Name\u0027,"},{"line_number":653,"context_line":"            \u0027X-Service-Roles\u0027,"},{"line_number":654,"context_line":"            # No Service Catalog"},{"line_number":655,"context_line":"            # Deprecated"},{"line_number":656,"context_line":"            \u0027X-Service-Tenant-Id\u0027,"},{"line_number":657,"context_line":"            \u0027X-Service-Tenant-Name\u0027,"},{"line_number":658,"context_line":"        )"}],"source_content_type":"text/x-python","patch_set":4,"id":"baada198_bc4dc23d","line":655,"updated":"2014-07-31 13:11:38.000000000","message":"Strictly speaking, these never existed and are not used so they can\u0027t be \"depreciated\". See my comment below about never creating them.","commit_id":"7918d15822763eba8c8c87b521b2b43e619579f1"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"c7d0985fe2dbbdc9f941dc945c4ff21c5af23ab7","unresolved":false,"context_lines":[{"line_number":831,"context_line":"            \u0027X-Service-User-Domain-Id\u0027: auth_ref.user_domain_id,"},{"line_number":832,"context_line":"            \u0027X-Service-User-Domain-Name\u0027: auth_ref.user_domain_name,"},{"line_number":833,"context_line":"            \u0027X-Service-Roles\u0027: roles,"},{"line_number":834,"context_line":"            # Deprecated"},{"line_number":835,"context_line":"            \u0027X-Service-Tenant-Id\u0027: auth_ref.project_id,"},{"line_number":836,"context_line":"            \u0027X-Service-Tenant-Name\u0027: auth_ref.project_name,"},{"line_number":837,"context_line":"        }"}],"source_content_type":"text/x-python","patch_set":4,"id":"baada198_48b78085","line":834,"updated":"2014-07-31 13:11:38.000000000","message":"I suggest you don\u0027t create these.It does not matter whether a service token is a v2 or v3 token, just use HTTP_X_SERVICE_PROJECT_*, not the *TENANT* variable. In any case, they are not documented at the top if this file.","commit_id":"7918d15822763eba8c8c87b521b2b43e619579f1"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"939dead026ab9e84adc9b64aab89a357665068e7","unresolved":false,"context_lines":[{"line_number":59,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"When using composite authentication (a user and service token are"},{"line_number":62,"context_line":"present) some additional service headers relating to the service user"},{"line_number":63,"context_line":"can be added. They take the same form as the standard headers but add"},{"line_number":64,"context_line":"\u0027_SERVICE_\u0027. These headers will not exist in the environment if no"},{"line_number":65,"context_line":"service token is present."}],"source_content_type":"text/x-python","patch_set":5,"id":"baada198_a3e4eca8","line":62,"updated":"2014-08-06 18:03:03.000000000","message":"Suggest removing \"some\".","commit_id":"33869c5ed023f024fecb34d1b1be881bca455896"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"45418a4d5b45f90c7c86302b3dd963dd69002c07","unresolved":false,"context_lines":[{"line_number":59,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"When using composite authentication (a user and service token are"},{"line_number":62,"context_line":"present) some additional service headers relating to the service user"},{"line_number":63,"context_line":"can be added. They take the same form as the standard headers but add"},{"line_number":64,"context_line":"\u0027_SERVICE_\u0027. These headers will not exist in the environment if no"},{"line_number":65,"context_line":"service token is present."}],"source_content_type":"text/x-python","patch_set":5,"id":"baada198_28409ea1","line":62,"in_reply_to":"baada198_a3e4eca8","updated":"2014-08-07 12:15:28.000000000","message":"ok","commit_id":"33869c5ed023f024fecb34d1b1be881bca455896"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"939dead026ab9e84adc9b64aab89a357665068e7","unresolved":false,"context_lines":[{"line_number":60,"context_line":""},{"line_number":61,"context_line":"When using composite authentication (a user and service token are"},{"line_number":62,"context_line":"present) some additional service headers relating to the service user"},{"line_number":63,"context_line":"can be added. They take the same form as the standard headers but add"},{"line_number":64,"context_line":"\u0027_SERVICE_\u0027. These headers will not exist in the environment if no"},{"line_number":65,"context_line":"service token is present."},{"line_number":66,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"baada198_e3fd043e","line":63,"updated":"2014-08-06 18:03:03.000000000","message":"suggest change \"can\" to \"will\"","commit_id":"33869c5ed023f024fecb34d1b1be881bca455896"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"45418a4d5b45f90c7c86302b3dd963dd69002c07","unresolved":false,"context_lines":[{"line_number":60,"context_line":""},{"line_number":61,"context_line":"When using composite authentication (a user and service token are"},{"line_number":62,"context_line":"present) some additional service headers relating to the service user"},{"line_number":63,"context_line":"can be added. They take the same form as the standard headers but add"},{"line_number":64,"context_line":"\u0027_SERVICE_\u0027. These headers will not exist in the environment if no"},{"line_number":65,"context_line":"service token is present."},{"line_number":66,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"baada198_480eb290","line":63,"in_reply_to":"baada198_e3fd043e","updated":"2014-08-07 12:15:28.000000000","message":"ok","commit_id":"33869c5ed023f024fecb34d1b1be881bca455896"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"939dead026ab9e84adc9b64aab89a357665068e7","unresolved":false,"context_lines":[{"line_number":353,"context_line":""},{"line_number":354,"context_line":"_LIST_OF_VERSIONS_TO_ATTEMPT \u003d [\u0027v3.0\u0027, \u0027v2.0\u0027]"},{"line_number":355,"context_line":""},{"line_number":356,"context_line":"HEADER_TEMPLATE \u003d {"},{"line_number":357,"context_line":"    \u0027X%s-Domain-Id\u0027: \u0027domain_id\u0027,"},{"line_number":358,"context_line":"    \u0027X%s-Domain-Name\u0027: \u0027domain_name\u0027,"},{"line_number":359,"context_line":"    \u0027X%s-Project-Id\u0027: \u0027project_id\u0027,"}],"source_content_type":"text/x-python","patch_set":5,"id":"baada198_2351bcd9","line":356,"updated":"2014-08-06 18:03:03.000000000","message":"This should be private, prefixed with a \"_\"","commit_id":"33869c5ed023f024fecb34d1b1be881bca455896"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"45418a4d5b45f90c7c86302b3dd963dd69002c07","unresolved":false,"context_lines":[{"line_number":353,"context_line":""},{"line_number":354,"context_line":"_LIST_OF_VERSIONS_TO_ATTEMPT \u003d [\u0027v3.0\u0027, \u0027v2.0\u0027]"},{"line_number":355,"context_line":""},{"line_number":356,"context_line":"HEADER_TEMPLATE \u003d {"},{"line_number":357,"context_line":"    \u0027X%s-Domain-Id\u0027: \u0027domain_id\u0027,"},{"line_number":358,"context_line":"    \u0027X%s-Domain-Name\u0027: \u0027domain_name\u0027,"},{"line_number":359,"context_line":"    \u0027X%s-Project-Id\u0027: \u0027project_id\u0027,"}],"source_content_type":"text/x-python","patch_set":5,"id":"baada198_887feade","line":356,"in_reply_to":"baada198_2351bcd9","updated":"2014-08-07 12:15:28.000000000","message":"ok","commit_id":"33869c5ed023f024fecb34d1b1be881bca455896"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"939dead026ab9e84adc9b64aab89a357665068e7","unresolved":false,"context_lines":[{"line_number":366,"context_line":"    \u0027X%s-User-Domain-Name\u0027: \u0027user_domain_name\u0027,"},{"line_number":367,"context_line":"}"},{"line_number":368,"context_line":""},{"line_number":369,"context_line":"DEPRECATED_HEADER_TEMPLATE \u003d {"},{"line_number":370,"context_line":"    \u0027X-User\u0027: \u0027username\u0027,"},{"line_number":371,"context_line":"    \u0027X-Tenant-Id\u0027: \u0027project_id\u0027,"},{"line_number":372,"context_line":"    \u0027X-Tenant-Name\u0027: \u0027project_name\u0027,"}],"source_content_type":"text/x-python","patch_set":5,"id":"baada198_635ad4f6","line":369,"updated":"2014-08-06 18:03:03.000000000","message":"Same as above","commit_id":"33869c5ed023f024fecb34d1b1be881bca455896"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"45418a4d5b45f90c7c86302b3dd963dd69002c07","unresolved":false,"context_lines":[{"line_number":366,"context_line":"    \u0027X%s-User-Domain-Name\u0027: \u0027user_domain_name\u0027,"},{"line_number":367,"context_line":"}"},{"line_number":368,"context_line":""},{"line_number":369,"context_line":"DEPRECATED_HEADER_TEMPLATE \u003d {"},{"line_number":370,"context_line":"    \u0027X-User\u0027: \u0027username\u0027,"},{"line_number":371,"context_line":"    \u0027X-Tenant-Id\u0027: \u0027project_id\u0027,"},{"line_number":372,"context_line":"    \u0027X-Tenant-Name\u0027: \u0027project_name\u0027,"}],"source_content_type":"text/x-python","patch_set":5,"id":"baada198_a882eec4","line":369,"in_reply_to":"baada198_635ad4f6","updated":"2014-08-07 12:15:28.000000000","message":"ok","commit_id":"33869c5ed023f024fecb34d1b1be881bca455896"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"939dead026ab9e84adc9b64aab89a357665068e7","unresolved":false,"context_lines":[{"line_number":620,"context_line":"                self._add_headers(env, serv_headers)"},{"line_number":621,"context_line":""},{"line_number":622,"context_line":"        except InvalidUserToken:"},{"line_number":623,"context_line":"            # delayed auth not supported for service tokens"},{"line_number":624,"context_line":"            self._LOG.info(\u0027Invalid service token - rejecting request\u0027)"},{"line_number":625,"context_line":"            return self._reject_request(env, start_response)"},{"line_number":626,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"baada198_23e1bc9b","line":623,"updated":"2014-08-06 18:03:03.000000000","message":"Is this something we want to support in the future? If so, please indicate.","commit_id":"33869c5ed023f024fecb34d1b1be881bca455896"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"45418a4d5b45f90c7c86302b3dd963dd69002c07","unresolved":false,"context_lines":[{"line_number":620,"context_line":"                self._add_headers(env, serv_headers)"},{"line_number":621,"context_line":""},{"line_number":622,"context_line":"        except InvalidUserToken:"},{"line_number":623,"context_line":"            # delayed auth not supported for service tokens"},{"line_number":624,"context_line":"            self._LOG.info(\u0027Invalid service token - rejecting request\u0027)"},{"line_number":625,"context_line":"            return self._reject_request(env, start_response)"},{"line_number":626,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"baada198_e8630643","line":623,"in_reply_to":"baada198_23e1bc9b","updated":"2014-08-07 12:15:28.000000000","message":"We didn\u0027t think it was needed for now. It can be added in future if a use case is found. Will add to comment.","commit_id":"33869c5ed023f024fecb34d1b1be881bca455896"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"939dead026ab9e84adc9b64aab89a357665068e7","unresolved":false,"context_lines":[{"line_number":628,"context_line":"            self._LOG.critical(\u0027Unable to obtain admin token: %s\u0027, e)"},{"line_number":629,"context_line":"            resp \u003d _MiniResp(\u0027Service unavailable\u0027, env)"},{"line_number":630,"context_line":"            start_response(\u0027503 Service Unavailable\u0027, resp.headers)"},{"line_number":631,"context_line":"            return resp.body"},{"line_number":632,"context_line":""},{"line_number":633,"context_line":"        return self._app(env, start_response)"},{"line_number":634,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"baada198_4345d099","line":631,"updated":"2014-08-06 18:03:03.000000000","message":"Suggest combining the ServiceError exception handling from both tokens (Service and Auth), this would however, require a nested try-block (may be harder to read, which case you can ignore this comment)","commit_id":"33869c5ed023f024fecb34d1b1be881bca455896"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"45418a4d5b45f90c7c86302b3dd963dd69002c07","unresolved":false,"context_lines":[{"line_number":628,"context_line":"            self._LOG.critical(\u0027Unable to obtain admin token: %s\u0027, e)"},{"line_number":629,"context_line":"            resp \u003d _MiniResp(\u0027Service unavailable\u0027, env)"},{"line_number":630,"context_line":"            start_response(\u0027503 Service Unavailable\u0027, resp.headers)"},{"line_number":631,"context_line":"            return resp.body"},{"line_number":632,"context_line":""},{"line_number":633,"context_line":"        return self._app(env, start_response)"},{"line_number":634,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"baada198_485cf280","line":631,"in_reply_to":"baada198_4345d099","updated":"2014-08-07 12:15:28.000000000","message":"Yeah, I was in two minds here. I\u0027ll see if nested is readable","commit_id":"33869c5ed023f024fecb34d1b1be881bca455896"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"5a73b3e86e34f7726aca47c07f5ba98cfac0cf5f","unresolved":false,"context_lines":[{"line_number":610,"context_line":"                self._LOG.debug(\u0027Authenticating service token\u0027)"},{"line_number":611,"context_line":"                serv_token \u003d self._get_service_token_from_header(env)"},{"line_number":612,"context_line":"                if serv_token is not None:"},{"line_number":613,"context_line":"                    serv_token_info \u003d self._validate_user_token("},{"line_number":614,"context_line":"                        serv_token, env)"},{"line_number":615,"context_line":"                    serv_headers \u003d self._build_service_headers(serv_token_info)"},{"line_number":616,"context_line":"                    self._add_headers(env, serv_headers)"}],"source_content_type":"text/x-python","patch_set":8,"id":"1abeadc6_68957de3","line":613,"updated":"2014-08-21 06:13:55.000000000","message":"if this function validates both kind of tokens then it should be renamed.","commit_id":"43af77aec85ab6b8f738ab7044bdd8d317596f62"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"1d4eea77798ac5bd50c0cb16bdcc09c797b6cf76","unresolved":false,"context_lines":[{"line_number":610,"context_line":"                self._LOG.debug(\u0027Authenticating service token\u0027)"},{"line_number":611,"context_line":"                serv_token \u003d self._get_service_token_from_header(env)"},{"line_number":612,"context_line":"                if serv_token is not None:"},{"line_number":613,"context_line":"                    serv_token_info \u003d self._validate_user_token("},{"line_number":614,"context_line":"                        serv_token, env)"},{"line_number":615,"context_line":"                    serv_headers \u003d self._build_service_headers(serv_token_info)"},{"line_number":616,"context_line":"                    self._add_headers(env, serv_headers)"}],"source_content_type":"text/x-python","patch_set":8,"id":"1abeadc6_7f6ba884","line":613,"in_reply_to":"1abeadc6_68957de3","updated":"2014-08-25 11:11:13.000000000","message":"Can do.","commit_id":"43af77aec85ab6b8f738ab7044bdd8d317596f62"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"5a73b3e86e34f7726aca47c07f5ba98cfac0cf5f","unresolved":false,"context_lines":[{"line_number":667,"context_line":"        service_headers \u003d [\u0027X-Service-Roles\u0027]"},{"line_number":668,"context_line":"        header_type \u003d \u0027-Service\u0027"},{"line_number":669,"context_line":"        for key in six.iterkeys(_HEADER_TEMPLATE):"},{"line_number":670,"context_line":"            service_headers.append(key % header_type)"},{"line_number":671,"context_line":""},{"line_number":672,"context_line":"        self._LOG.debug(\u0027Removing service headers from request \u0027"},{"line_number":673,"context_line":"                        \u0027environment: %s\u0027, \u0027,\u0027.join(service_headers))"}],"source_content_type":"text/x-python","patch_set":8,"id":"1abeadc6_671efe60","line":670,"updated":"2014-08-21 06:13:55.000000000","message":"you cut out at least one loop through this dictionary by combining this with the remove user headers function","commit_id":"43af77aec85ab6b8f738ab7044bdd8d317596f62"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"1d4eea77798ac5bd50c0cb16bdcc09c797b6cf76","unresolved":false,"context_lines":[{"line_number":667,"context_line":"        service_headers \u003d [\u0027X-Service-Roles\u0027]"},{"line_number":668,"context_line":"        header_type \u003d \u0027-Service\u0027"},{"line_number":669,"context_line":"        for key in six.iterkeys(_HEADER_TEMPLATE):"},{"line_number":670,"context_line":"            service_headers.append(key % header_type)"},{"line_number":671,"context_line":""},{"line_number":672,"context_line":"        self._LOG.debug(\u0027Removing service headers from request \u0027"},{"line_number":673,"context_line":"                        \u0027environment: %s\u0027, \u0027,\u0027.join(service_headers))"}],"source_content_type":"text/x-python","patch_set":8,"id":"1abeadc6_5f7a6c24","line":670,"in_reply_to":"1abeadc6_671efe60","updated":"2014-08-25 11:11:13.000000000","message":"Sure, I can update to be more efficient.","commit_id":"43af77aec85ab6b8f738ab7044bdd8d317596f62"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"40309b9f42636d7edcb19069b7c5ad3751ec1f28","unresolved":false,"context_lines":[{"line_number":669,"context_line":"        for key in six.iterkeys(_HEADER_TEMPLATE):"},{"line_number":670,"context_line":"            service_headers.append(key % header_type)"},{"line_number":671,"context_line":""},{"line_number":672,"context_line":"        self._LOG.debug(\u0027Removing service headers from request \u0027"},{"line_number":673,"context_line":"                        \u0027environment: %s\u0027, \u0027,\u0027.join(service_headers))"},{"line_number":674,"context_line":"        self._remove_headers(env, service_headers)"},{"line_number":675,"context_line":""}],"source_content_type":"text/x-python","patch_set":8,"id":"1abeadc6_49d3e303","line":672,"updated":"2014-08-20 21:56:56.000000000","message":"this seems unnecessary to log twice for a request... how about rather than having separate functions for removing user and service headers have functions to return user header names and service header names and then remove all those headers in 1 call.","commit_id":"43af77aec85ab6b8f738ab7044bdd8d317596f62"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"1d4eea77798ac5bd50c0cb16bdcc09c797b6cf76","unresolved":false,"context_lines":[{"line_number":669,"context_line":"        for key in six.iterkeys(_HEADER_TEMPLATE):"},{"line_number":670,"context_line":"            service_headers.append(key % header_type)"},{"line_number":671,"context_line":""},{"line_number":672,"context_line":"        self._LOG.debug(\u0027Removing service headers from request \u0027"},{"line_number":673,"context_line":"                        \u0027environment: %s\u0027, \u0027,\u0027.join(service_headers))"},{"line_number":674,"context_line":"        self._remove_headers(env, service_headers)"},{"line_number":675,"context_line":""}],"source_content_type":"text/x-python","patch_set":8,"id":"1abeadc6_bf070081","line":672,"in_reply_to":"1abeadc6_49d3e303","updated":"2014-08-25 11:11:13.000000000","message":"I think this and Jamie\u0027s comment above are consistent ... can do.","commit_id":"43af77aec85ab6b8f738ab7044bdd8d317596f62"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"40309b9f42636d7edcb19069b7c5ad3751ec1f28","unresolved":false,"context_lines":[{"line_number":782,"context_line":"        if _token_is_v2(token_info) and not auth_ref.project_id:"},{"line_number":783,"context_line":"            raise InvalidUserToken(\u0027Unable to determine tenancy.\u0027)"},{"line_number":784,"context_line":""},{"line_number":785,"context_line":"        roles \u003d \u0027,\u0027.join(auth_ref.role_names)"},{"line_number":786,"context_line":"        rval \u003d {"},{"line_number":787,"context_line":"            \u0027X-Identity-Status\u0027: \u0027Confirmed\u0027,"},{"line_number":788,"context_line":"            \u0027X-Roles\u0027: roles,"}],"source_content_type":"text/x-python","patch_set":8,"id":"1abeadc6_89d97b24","line":785,"updated":"2014-08-20 21:56:56.000000000","message":"revert this change since it\u0027s unrelated.","commit_id":"43af77aec85ab6b8f738ab7044bdd8d317596f62"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"1d4eea77798ac5bd50c0cb16bdcc09c797b6cf76","unresolved":false,"context_lines":[{"line_number":782,"context_line":"        if _token_is_v2(token_info) and not auth_ref.project_id:"},{"line_number":783,"context_line":"            raise InvalidUserToken(\u0027Unable to determine tenancy.\u0027)"},{"line_number":784,"context_line":""},{"line_number":785,"context_line":"        roles \u003d \u0027,\u0027.join(auth_ref.role_names)"},{"line_number":786,"context_line":"        rval \u003d {"},{"line_number":787,"context_line":"            \u0027X-Identity-Status\u0027: \u0027Confirmed\u0027,"},{"line_number":788,"context_line":"            \u0027X-Roles\u0027: roles,"}],"source_content_type":"text/x-python","patch_set":8,"id":"1abeadc6_df7f5cde","line":785,"in_reply_to":"1abeadc6_89d97b24","updated":"2014-08-25 11:11:13.000000000","message":"The idea here was that populating roles doesn\u0027t make sense until we know we have a valid token. Do you mean the change is not good, or just that it doesn\u0027t belong as part of this patch? Thanks.","commit_id":"43af77aec85ab6b8f738ab7044bdd8d317596f62"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"5a73b3e86e34f7726aca47c07f5ba98cfac0cf5f","unresolved":false,"context_lines":[{"line_number":808,"context_line":""},{"line_number":809,"context_line":"        return rval"},{"line_number":810,"context_line":""},{"line_number":811,"context_line":"    def _build_service_headers(self, token_info):"},{"line_number":812,"context_line":"        \"\"\"Convert token object into service headers."},{"line_number":813,"context_line":""},{"line_number":814,"context_line":"        Build headers that represent authenticated user - see main"}],"source_content_type":"text/x-python","patch_set":8,"id":"1abeadc6_a797368f","line":811,"updated":"2014-08-21 06:13:55.000000000","message":"if include_service_catalog was a parameter rather than from self then I think you could make this one function.","commit_id":"43af77aec85ab6b8f738ab7044bdd8d317596f62"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"1d4eea77798ac5bd50c0cb16bdcc09c797b6cf76","unresolved":false,"context_lines":[{"line_number":808,"context_line":""},{"line_number":809,"context_line":"        return rval"},{"line_number":810,"context_line":""},{"line_number":811,"context_line":"    def _build_service_headers(self, token_info):"},{"line_number":812,"context_line":"        \"\"\"Convert token object into service headers."},{"line_number":813,"context_line":""},{"line_number":814,"context_line":"        Build headers that represent authenticated user - see main"}],"source_content_type":"text/x-python","patch_set":8,"id":"1abeadc6_3f8cd0d9","line":811,"in_reply_to":"1abeadc6_a797368f","updated":"2014-08-25 11:11:13.000000000","message":"Yeah, I thought about that, but felt two functions read more clearly (fewer if statements etc). Is this something you really want to see? If so I can update accordingly.","commit_id":"43af77aec85ab6b8f738ab7044bdd8d317596f62"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"40309b9f42636d7edcb19069b7c5ad3751ec1f28","unresolved":false,"context_lines":[{"line_number":814,"context_line":"        Build headers that represent authenticated user - see main"},{"line_number":815,"context_line":"        doc info at start of file for details of headers to be defined."},{"line_number":816,"context_line":""},{"line_number":817,"context_line":"        :param token_info: token object returned by keystone on authentication"},{"line_number":818,"context_line":"        :raise InvalidUserToken when unable to parse token object"},{"line_number":819,"context_line":""},{"line_number":820,"context_line":"        \"\"\""}],"source_content_type":"text/x-python","patch_set":8,"id":"1abeadc6_8947bbbb","line":817,"updated":"2014-08-20 21:56:56.000000000","message":"change \"keystone\" to \"identity server\"","commit_id":"43af77aec85ab6b8f738ab7044bdd8d317596f62"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"1d4eea77798ac5bd50c0cb16bdcc09c797b6cf76","unresolved":false,"context_lines":[{"line_number":814,"context_line":"        Build headers that represent authenticated user - see main"},{"line_number":815,"context_line":"        doc info at start of file for details of headers to be defined."},{"line_number":816,"context_line":""},{"line_number":817,"context_line":"        :param token_info: token object returned by keystone on authentication"},{"line_number":818,"context_line":"        :raise InvalidUserToken when unable to parse token object"},{"line_number":819,"context_line":""},{"line_number":820,"context_line":"        \"\"\""}],"source_content_type":"text/x-python","patch_set":8,"id":"1abeadc6_da3daa90","line":817,"in_reply_to":"1abeadc6_8947bbbb","updated":"2014-08-25 11:11:13.000000000","message":"ok","commit_id":"43af77aec85ab6b8f738ab7044bdd8d317596f62"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"40309b9f42636d7edcb19069b7c5ad3751ec1f28","unresolved":false,"context_lines":[{"line_number":815,"context_line":"        doc info at start of file for details of headers to be defined."},{"line_number":816,"context_line":""},{"line_number":817,"context_line":"        :param token_info: token object returned by keystone on authentication"},{"line_number":818,"context_line":"        :raise InvalidUserToken when unable to parse token object"},{"line_number":819,"context_line":""},{"line_number":820,"context_line":"        \"\"\""},{"line_number":821,"context_line":"        auth_ref \u003d access.AccessInfo.factory(body\u003dtoken_info)"}],"source_content_type":"text/x-python","patch_set":8,"id":"1abeadc6_291067a7","line":818,"updated":"2014-08-20 21:56:56.000000000","message":"this is missing a : after \"InvalidUserToken\"","commit_id":"43af77aec85ab6b8f738ab7044bdd8d317596f62"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"1d4eea77798ac5bd50c0cb16bdcc09c797b6cf76","unresolved":false,"context_lines":[{"line_number":815,"context_line":"        doc info at start of file for details of headers to be defined."},{"line_number":816,"context_line":""},{"line_number":817,"context_line":"        :param token_info: token object returned by keystone on authentication"},{"line_number":818,"context_line":"        :raise InvalidUserToken when unable to parse token object"},{"line_number":819,"context_line":""},{"line_number":820,"context_line":"        \"\"\""},{"line_number":821,"context_line":"        auth_ref \u003d access.AccessInfo.factory(body\u003dtoken_info)"}],"source_content_type":"text/x-python","patch_set":8,"id":"1abeadc6_1a448219","line":818,"in_reply_to":"1abeadc6_291067a7","updated":"2014-08-25 11:11:13.000000000","message":"ok","commit_id":"43af77aec85ab6b8f738ab7044bdd8d317596f62"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"40309b9f42636d7edcb19069b7c5ad3751ec1f28","unresolved":false,"context_lines":[{"line_number":832,"context_line":"        for header_tmplt, attr in six.iteritems(_HEADER_TEMPLATE):"},{"line_number":833,"context_line":"            rval[header_tmplt % header_type] \u003d getattr(auth_ref, attr)"},{"line_number":834,"context_line":""},{"line_number":835,"context_line":"        self._LOG.debug(\u0027Received request from user: %s with service \u0027"},{"line_number":836,"context_line":"                        \u0027project_id : %s and service roles: %s \u0027,"},{"line_number":837,"context_line":"                        auth_ref.user_id, auth_ref.project_id, roles)"},{"line_number":838,"context_line":""}],"source_content_type":"text/x-python","patch_set":8,"id":"1abeadc6_4956835d","line":835,"updated":"2014-08-20 21:56:56.000000000","message":"this should be service user","commit_id":"43af77aec85ab6b8f738ab7044bdd8d317596f62"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"1d4eea77798ac5bd50c0cb16bdcc09c797b6cf76","unresolved":false,"context_lines":[{"line_number":832,"context_line":"        for header_tmplt, attr in six.iteritems(_HEADER_TEMPLATE):"},{"line_number":833,"context_line":"            rval[header_tmplt % header_type] \u003d getattr(auth_ref, attr)"},{"line_number":834,"context_line":""},{"line_number":835,"context_line":"        self._LOG.debug(\u0027Received request from user: %s with service \u0027"},{"line_number":836,"context_line":"                        \u0027project_id : %s and service roles: %s \u0027,"},{"line_number":837,"context_line":"                        auth_ref.user_id, auth_ref.project_id, roles)"},{"line_number":838,"context_line":""}],"source_content_type":"text/x-python","patch_set":8,"id":"1abeadc6_3a4e9e3b","line":835,"in_reply_to":"1abeadc6_4956835d","updated":"2014-08-25 11:11:13.000000000","message":"ok","commit_id":"43af77aec85ab6b8f738ab7044bdd8d317596f62"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"40309b9f42636d7edcb19069b7c5ad3751ec1f28","unresolved":false,"context_lines":[{"line_number":834,"context_line":""},{"line_number":835,"context_line":"        self._LOG.debug(\u0027Received request from user: %s with service \u0027"},{"line_number":836,"context_line":"                        \u0027project_id : %s and service roles: %s \u0027,"},{"line_number":837,"context_line":"                        auth_ref.user_id, auth_ref.project_id, roles)"},{"line_number":838,"context_line":""},{"line_number":839,"context_line":"        return rval"},{"line_number":840,"context_line":""}],"source_content_type":"text/x-python","patch_set":8,"id":"1abeadc6_e9ce6f2d","line":837,"updated":"2014-08-20 21:56:56.000000000","message":"I\u0027d prefer it if the user and service user info was all logged together rather than separately.","commit_id":"43af77aec85ab6b8f738ab7044bdd8d317596f62"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"1d4eea77798ac5bd50c0cb16bdcc09c797b6cf76","unresolved":false,"context_lines":[{"line_number":834,"context_line":""},{"line_number":835,"context_line":"        self._LOG.debug(\u0027Received request from user: %s with service \u0027"},{"line_number":836,"context_line":"                        \u0027project_id : %s and service roles: %s \u0027,"},{"line_number":837,"context_line":"                        auth_ref.user_id, auth_ref.project_id, roles)"},{"line_number":838,"context_line":""},{"line_number":839,"context_line":"        return rval"},{"line_number":840,"context_line":""}],"source_content_type":"text/x-python","patch_set":8,"id":"1abeadc6_7a9e5664","line":837,"in_reply_to":"1abeadc6_e9ce6f2d","updated":"2014-08-25 11:11:13.000000000","message":"Can you give a reason for your preference Brant? Thanks","commit_id":"43af77aec85ab6b8f738ab7044bdd8d317596f62"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d4638446649fbfb8f75e605c79fd9986c085de3f","unresolved":false,"context_lines":[{"line_number":641,"context_line":"                        \u0027X-Roles\u0027,"},{"line_number":642,"context_line":"                        \u0027X-Service-Roles\u0027]"},{"line_number":643,"context_line":"        for key in six.iterkeys(_HEADER_TEMPLATE):"},{"line_number":644,"context_line":"            auth_headers.append(key % \u0027\u0027)"},{"line_number":645,"context_line":"            # Service headers"},{"line_number":646,"context_line":"            auth_headers.append(key % \u0027-Service\u0027)"},{"line_number":647,"context_line":""}],"source_content_type":"text/x-python","patch_set":10,"id":"1abeadc6_afb9127b","line":644,"updated":"2014-08-27 00:10:05.000000000","message":"suggestion -- rather than build this every time the function is called it should be built once.","commit_id":"eeb12cbb26bdae2ccaf46074957bf864f5d73994"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"6bcf07b4e97d476ac620081f92fe00aaaa3e4caa","unresolved":false,"context_lines":[{"line_number":641,"context_line":"                        \u0027X-Roles\u0027,"},{"line_number":642,"context_line":"                        \u0027X-Service-Roles\u0027]"},{"line_number":643,"context_line":"        for key in six.iterkeys(_HEADER_TEMPLATE):"},{"line_number":644,"context_line":"            auth_headers.append(key % \u0027\u0027)"},{"line_number":645,"context_line":"            # Service headers"},{"line_number":646,"context_line":"            auth_headers.append(key % \u0027-Service\u0027)"},{"line_number":647,"context_line":""}],"source_content_type":"text/x-python","patch_set":10,"id":"1abeadc6_3aa36750","line":644,"in_reply_to":"1abeadc6_afb9127b","updated":"2014-08-27 12:34:24.000000000","message":"Yes, that makes sense -- thanks.","commit_id":"eeb12cbb26bdae2ccaf46074957bf864f5d73994"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d4638446649fbfb8f75e605c79fd9986c085de3f","unresolved":false,"context_lines":[{"line_number":754,"context_line":"        Build headers that represent authenticated user - see main"},{"line_number":755,"context_line":"        doc info at start of file for details of headers to be defined."},{"line_number":756,"context_line":""},{"line_number":757,"context_line":"        :param token_info: token object returned by identity"},{"line_number":758,"context_line":"                           server on authentication"},{"line_number":759,"context_line":"        :raise InvalidToken: when unable to parse token object"},{"line_number":760,"context_line":""}],"source_content_type":"text/x-python","patch_set":10,"id":"1abeadc6_ef1f8a6e","line":757,"updated":"2014-08-27 00:10:05.000000000","message":"revert this change it\u0027s unrelated.","commit_id":"eeb12cbb26bdae2ccaf46074957bf864f5d73994"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"6bcf07b4e97d476ac620081f92fe00aaaa3e4caa","unresolved":false,"context_lines":[{"line_number":754,"context_line":"        Build headers that represent authenticated user - see main"},{"line_number":755,"context_line":"        doc info at start of file for details of headers to be defined."},{"line_number":756,"context_line":""},{"line_number":757,"context_line":"        :param token_info: token object returned by identity"},{"line_number":758,"context_line":"                           server on authentication"},{"line_number":759,"context_line":"        :raise InvalidToken: when unable to parse token object"},{"line_number":760,"context_line":""}],"source_content_type":"text/x-python","patch_set":10,"id":"1abeadc6_fa4d6f9a","line":757,"in_reply_to":"1abeadc6_ef1f8a6e","updated":"2014-08-27 12:34:24.000000000","message":"Don\u0027t we want the param documentation for _build_user_headers and _build_service_headers to be consistent?","commit_id":"eeb12cbb26bdae2ccaf46074957bf864f5d73994"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d4638446649fbfb8f75e605c79fd9986c085de3f","unresolved":false,"context_lines":[{"line_number":764,"context_line":"        if _token_is_v2(token_info) and not auth_ref.project_id:"},{"line_number":765,"context_line":"            raise InvalidToken(\u0027Unable to determine tenancy.\u0027)"},{"line_number":766,"context_line":""},{"line_number":767,"context_line":"        roles \u003d \u0027,\u0027.join(auth_ref.role_names)"},{"line_number":768,"context_line":"        rval \u003d {"},{"line_number":769,"context_line":"            \u0027X-Identity-Status\u0027: \u0027Confirmed\u0027,"},{"line_number":770,"context_line":"            \u0027X-Roles\u0027: roles,"}],"source_content_type":"text/x-python","patch_set":10,"id":"1abeadc6_0f2f66a2","line":767,"updated":"2014-08-27 00:10:05.000000000","message":"revert this change it\u0027s unrelated.","commit_id":"eeb12cbb26bdae2ccaf46074957bf864f5d73994"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"6bcf07b4e97d476ac620081f92fe00aaaa3e4caa","unresolved":false,"context_lines":[{"line_number":764,"context_line":"        if _token_is_v2(token_info) and not auth_ref.project_id:"},{"line_number":765,"context_line":"            raise InvalidToken(\u0027Unable to determine tenancy.\u0027)"},{"line_number":766,"context_line":""},{"line_number":767,"context_line":"        roles \u003d \u0027,\u0027.join(auth_ref.role_names)"},{"line_number":768,"context_line":"        rval \u003d {"},{"line_number":769,"context_line":"            \u0027X-Identity-Status\u0027: \u0027Confirmed\u0027,"},{"line_number":770,"context_line":"            \u0027X-Roles\u0027: roles,"}],"source_content_type":"text/x-python","patch_set":10,"id":"1abeadc6_ba53f737","line":767,"in_reply_to":"1abeadc6_0f2f66a2","updated":"2014-08-27 12:34:24.000000000","message":"ok","commit_id":"eeb12cbb26bdae2ccaf46074957bf864f5d73994"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d4638446649fbfb8f75e605c79fd9986c085de3f","unresolved":false,"context_lines":[{"line_number":817,"context_line":""},{"line_number":818,"context_line":"        self._LOG.debug(\u0027Received request from service user: %s with service \u0027"},{"line_number":819,"context_line":"                        \u0027project_id : %s and service roles: %s \u0027,"},{"line_number":820,"context_line":"                        auth_ref.user_id, auth_ref.project_id, roles)"},{"line_number":821,"context_line":""},{"line_number":822,"context_line":"        return rval"},{"line_number":823,"context_line":""}],"source_content_type":"text/x-python","patch_set":10,"id":"1abeadc6_4f123eb5","line":820,"updated":"2014-08-27 00:10:05.000000000","message":"I was asked why I prefered the service user info was logged together rather than separately. This is because when it\u0027s split across multiple log records it\u0027s more difficult to correlate, since there may be other messages in between. Also, it makes the log file longer.","commit_id":"eeb12cbb26bdae2ccaf46074957bf864f5d73994"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"6bcf07b4e97d476ac620081f92fe00aaaa3e4caa","unresolved":false,"context_lines":[{"line_number":817,"context_line":""},{"line_number":818,"context_line":"        self._LOG.debug(\u0027Received request from service user: %s with service \u0027"},{"line_number":819,"context_line":"                        \u0027project_id : %s and service roles: %s \u0027,"},{"line_number":820,"context_line":"                        auth_ref.user_id, auth_ref.project_id, roles)"},{"line_number":821,"context_line":""},{"line_number":822,"context_line":"        return rval"},{"line_number":823,"context_line":""}],"source_content_type":"text/x-python","patch_set":10,"id":"1abeadc6_1ab78b87","line":820,"in_reply_to":"1abeadc6_4f123eb5","updated":"2014-08-27 12:34:24.000000000","message":"Ok, I\u0027ll see if I can do that without major restructuring.","commit_id":"eeb12cbb26bdae2ccaf46074957bf864f5d73994"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"26bb70e22470f16a867be5d5c0ddbb19d2794e72","unresolved":false,"context_lines":[{"line_number":675,"context_line":"            return msg"},{"line_number":676,"context_line":""},{"line_number":677,"context_line":"        self._token_cache.initialize(env)"},{"line_number":678,"context_line":"        self._remove_auth_headers(env)"},{"line_number":679,"context_line":""},{"line_number":680,"context_line":"        try:"},{"line_number":681,"context_line":"            self._LOG.debug(\u0027Authenticating user token\u0027)"}],"source_content_type":"text/x-python","patch_set":13,"id":"fa98f980_93b39e09","line":678,"updated":"2014-09-18 11:12:54.000000000","message":"This is called below, so not needed here I think.","commit_id":"195171a0a4f001e27b126aa535210fb1952133de"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"26bb70e22470f16a867be5d5c0ddbb19d2794e72","unresolved":false,"context_lines":[{"line_number":687,"context_line":"            env[\u0027keystone.token_auth\u0027] \u003d _UserAuthPlugin(user_token, auth_ref)"},{"line_number":688,"context_line":"            user_headers \u003d self._build_user_headers(auth_ref, token_info)"},{"line_number":689,"context_line":"            self._add_headers(env, user_headers)"},{"line_number":690,"context_line":"        except InvalidUserToken:"},{"line_number":691,"context_line":"            if self._delay_auth_decision:"},{"line_number":692,"context_line":"                self._LOG.info("},{"line_number":693,"context_line":"                    \u0027Invalid user token - deferring reject downstream\u0027)"}],"source_content_type":"text/x-python","patch_set":13,"id":"fa98f980_f38eaa31","line":690,"updated":"2014-09-18 11:12:54.000000000","message":"IIRC I changed InvalidUserToken to InvalidToken since it can refer to a user or service token","commit_id":"195171a0a4f001e27b126aa535210fb1952133de"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"26bb70e22470f16a867be5d5c0ddbb19d2794e72","unresolved":false,"context_lines":[{"line_number":710,"context_line":"            self._LOG.info(\u0027Invalid service token - rejecting request\u0027)"},{"line_number":711,"context_line":"            return self._reject_request(env, start_response)"},{"line_number":712,"context_line":""},{"line_number":713,"context_line":"        except ServiceError as e:"},{"line_number":714,"context_line":"            self._LOG.critical(\u0027Unable to obtain admin token: %s\u0027, e)"},{"line_number":715,"context_line":"            resp \u003d _MiniResp(\u0027Service unavailable\u0027, env)"},{"line_number":716,"context_line":"            start_response(\u0027503 Service Unavailable\u0027, resp.headers)"}],"source_content_type":"text/x-python","patch_set":13,"id":"fa98f980_93b55e80","line":713,"updated":"2014-09-18 11:12:54.000000000","message":"Indentation issue? This ServiceError should be catching both the user and service token cases I think","commit_id":"195171a0a4f001e27b126aa535210fb1952133de"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"28cb42f33315424dec3ecd99a1058016f1ede43f","unresolved":false,"context_lines":[{"line_number":889,"context_line":"        }"},{"line_number":890,"context_line":""},{"line_number":891,"context_line":"        for header_tmplt, attr in six.iteritems(_HEADER_TEMPLATE):"},{"line_number":892,"context_line":"            rval[header_tmplt % \u0027\u0027] \u003d getattr(auth_ref, attr)"},{"line_number":893,"context_line":""},{"line_number":894,"context_line":"        # Deprecated headers"},{"line_number":895,"context_line":"        rval[\u0027X-Role\u0027] \u003d roles"}],"source_content_type":"text/x-python","patch_set":14,"id":"da9df570_2e463ec0","line":892,"updated":"2014-09-21 01:39:25.000000000","message":"nice","commit_id":"e850258cfcdf097c469ed4a2262a5ea4d68ba381"}],"keystonemiddleware/tests/test_auth_token_middleware.py":[{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"c7d0985fe2dbbdc9f941dc945c4ff21c5af23ab7","unresolved":false,"context_lines":[{"line_number":2093,"context_line":"        body \u003d self.middleware(req.environ, self.start_fake_response)"},{"line_number":2094,"context_line":"        self.assertEqual(self.response_status, 401)"},{"line_number":2095,"context_line":"        self.assertEqual(body, [\u0027Authentication required\u0027])"},{"line_number":2096,"context_line":""},{"line_number":2097,"context_line":""},{"line_number":2098,"context_line":"class v2CompositeAuthTests(BaseAuthTokenMiddlewareTest,"},{"line_number":2099,"context_line":"                           CommonCompositeAuthTests,"}],"source_content_type":"text/x-python","patch_set":4,"id":"baada198_4ecb0973","line":2096,"updated":"2014-07-31 13:11:38.000000000","message":"Can you test that where no X-Service-Token is presented that the HTTP_X_SERVICE* variables don\u0027t exist in the environment. You could double this up with a test where the user sets X-Service-Project_Id, etc, and make sure they don\u0027t make it down the pipeline.","commit_id":"7918d15822763eba8c8c87b521b2b43e619579f1"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"40309b9f42636d7edcb19069b7c5ad3751ec1f28","unresolved":false,"context_lines":[{"line_number":205,"context_line":"        resp \u003d webob.Response()"},{"line_number":206,"context_line":""},{"line_number":207,"context_line":"        if env[\u0027HTTP_X_IDENTITY_STATUS\u0027] \u003d\u003d \u0027Invalid\u0027:"},{"line_number":208,"context_line":"            # Simulate delayed auth forbidding access"},{"line_number":209,"context_line":"            resp.status \u003d 403"},{"line_number":210,"context_line":"            resp.body \u003d FakeApp.FORBIDDEN"},{"line_number":211,"context_line":"        elif (self.need_service_token is True and"}],"source_content_type":"text/x-python","patch_set":8,"id":"1abeadc6_89917bf3","line":208,"updated":"2014-08-20 21:56:56.000000000","message":"403 Forbidden doesn\u0027t mean that access was rejected. See http://tools.ietf.org/html/rfc2616#section-10.4.4 -- \"Authorization will not help and the request SHOULD NOT be repeated.\"","commit_id":"43af77aec85ab6b8f738ab7044bdd8d317596f62"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"1d4eea77798ac5bd50c0cb16bdcc09c797b6cf76","unresolved":false,"context_lines":[{"line_number":205,"context_line":"        resp \u003d webob.Response()"},{"line_number":206,"context_line":""},{"line_number":207,"context_line":"        if env[\u0027HTTP_X_IDENTITY_STATUS\u0027] \u003d\u003d \u0027Invalid\u0027:"},{"line_number":208,"context_line":"            # Simulate delayed auth forbidding access"},{"line_number":209,"context_line":"            resp.status \u003d 403"},{"line_number":210,"context_line":"            resp.body \u003d FakeApp.FORBIDDEN"},{"line_number":211,"context_line":"        elif (self.need_service_token is True and"}],"source_content_type":"text/x-python","patch_set":8,"id":"1abeadc6_0b5408c9","line":208,"in_reply_to":"1abeadc6_89917bf3","updated":"2014-08-25 11:11:13.000000000","message":"I think I\u0027m missing something subtle here.\n\n\"Status code 403 responses are the result of the web server being configured to deny access, for some reason, to the requested resource.\" (http://en.wikipedia.org/wiki/HTTP_403)\n\nDo you mean that it would be more \u0027correct\u0027 to return 401 here?\nThe problem with that is the tests couldn\u0027t distinguish between this and the other 401 test cases.\n\nIs a re-wording the comment above a suitable way forward? If so, can you suggest some verbiage? Thanks!","commit_id":"43af77aec85ab6b8f738ab7044bdd8d317596f62"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"9d21bedb1623b9f95e3f48f09bc66f28af6fc476","unresolved":false,"context_lines":[{"line_number":212,"context_line":"                env.get(\u0027HTTP_X_SERVICE_TOKEN\u0027) is None):"},{"line_number":213,"context_line":"            # Simulate requiring composite auth"},{"line_number":214,"context_line":"            # Arbitrary value to allow checking this code path"},{"line_number":215,"context_line":"            resp.status \u003d 418"},{"line_number":216,"context_line":"            resp.body \u003d FakeApp.FORBIDDEN"},{"line_number":217,"context_line":"        else:"},{"line_number":218,"context_line":"            resp.body \u003d FakeApp.SUCCESS"}],"source_content_type":"text/x-python","patch_set":8,"id":"1abeadc6_c14535b4","line":215,"updated":"2014-08-19 23:56:34.000000000","message":"clever!","commit_id":"43af77aec85ab6b8f738ab7044bdd8d317596f62"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"40309b9f42636d7edcb19069b7c5ad3751ec1f28","unresolved":false,"context_lines":[{"line_number":228,"context_line":"        # with v3 additions, these are for the DEFAULT TOKEN"},{"line_number":229,"context_line":"        v3_default_env_additions \u003d dict(EXPECTED_V3_DEFAULT_ENV_ADDITIONS)"},{"line_number":230,"context_line":"        if expected_env:"},{"line_number":231,"context_line":"            v3_default_env_additions.update(expected_env)"},{"line_number":232,"context_line":"        v3_default_env_additions.update(self.expected_env)"},{"line_number":233,"context_line":"        super(v3FakeApp, self).__init__(v3_default_env_additions,"},{"line_number":234,"context_line":"                                        need_service_token\u003dneed_service_token)"}],"source_content_type":"text/x-python","patch_set":8,"id":"1abeadc6_c965331f","line":231,"updated":"2014-08-20 21:56:56.000000000","message":"shouldn\u0027t the expected env passed in to the constructor take precedence over the class default?","commit_id":"43af77aec85ab6b8f738ab7044bdd8d317596f62"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"1d4eea77798ac5bd50c0cb16bdcc09c797b6cf76","unresolved":false,"context_lines":[{"line_number":228,"context_line":"        # with v3 additions, these are for the DEFAULT TOKEN"},{"line_number":229,"context_line":"        v3_default_env_additions \u003d dict(EXPECTED_V3_DEFAULT_ENV_ADDITIONS)"},{"line_number":230,"context_line":"        if expected_env:"},{"line_number":231,"context_line":"            v3_default_env_additions.update(expected_env)"},{"line_number":232,"context_line":"        v3_default_env_additions.update(self.expected_env)"},{"line_number":233,"context_line":"        super(v3FakeApp, self).__init__(v3_default_env_additions,"},{"line_number":234,"context_line":"                                        need_service_token\u003dneed_service_token)"}],"source_content_type":"text/x-python","patch_set":8,"id":"1abeadc6_a557c0c9","line":231,"in_reply_to":"1abeadc6_c965331f","updated":"2014-08-25 11:11:13.000000000","message":"Ok, I can tweak","commit_id":"43af77aec85ab6b8f738ab7044bdd8d317596f62"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"40309b9f42636d7edcb19069b7c5ad3751ec1f28","unresolved":false,"context_lines":[{"line_number":2067,"context_line":"        req.headers[\u0027X-Auth-Token\u0027] \u003d token"},{"line_number":2068,"context_line":"        req.headers[\u0027X-Service-Token\u0027] \u003d service_token"},{"line_number":2069,"context_line":"        body \u003d self.middleware(req.environ, self.start_fake_response)"},{"line_number":2070,"context_line":"        self.assertEqual(self.response_status, 200)"},{"line_number":2071,"context_line":"        self.assertEqual(body, [FakeApp.SUCCESS])"},{"line_number":2072,"context_line":""},{"line_number":2073,"context_line":"    def test_composite_auth_invalid_service_token(self):"}],"source_content_type":"text/x-python","patch_set":8,"id":"1abeadc6_c9337312","line":2070,"updated":"2014-08-20 21:56:56.000000000","message":"the arguments are reversed, it should be expected then observed. The error message will be confusing the way these are. This applies to all the assertEquals in this change.","commit_id":"43af77aec85ab6b8f738ab7044bdd8d317596f62"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"1d4eea77798ac5bd50c0cb16bdcc09c797b6cf76","unresolved":false,"context_lines":[{"line_number":2067,"context_line":"        req.headers[\u0027X-Auth-Token\u0027] \u003d token"},{"line_number":2068,"context_line":"        req.headers[\u0027X-Service-Token\u0027] \u003d service_token"},{"line_number":2069,"context_line":"        body \u003d self.middleware(req.environ, self.start_fake_response)"},{"line_number":2070,"context_line":"        self.assertEqual(self.response_status, 200)"},{"line_number":2071,"context_line":"        self.assertEqual(body, [FakeApp.SUCCESS])"},{"line_number":2072,"context_line":""},{"line_number":2073,"context_line":"    def test_composite_auth_invalid_service_token(self):"}],"source_content_type":"text/x-python","patch_set":8,"id":"1abeadc6_068f9f76","line":2070,"in_reply_to":"1abeadc6_c9337312","updated":"2014-08-25 11:11:13.000000000","message":"good spot -- thanks!","commit_id":"43af77aec85ab6b8f738ab7044bdd8d317596f62"}]}