)]}'
{"id":"openstack%2Fkeystone~1002373","triplet_id":"openstack%2Fkeystone~master~I3806cf464d3e40752e1ebffe8cbd5f9e1f5467d0","project":"openstack/keystone","branch":"master","attention_set":{"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-08-25 19:57:43.000000000","reason":"A robot voted negatively on a label"}},"removed_from_attention_set":{},"hashtags":[],"change_id":"I3806cf464d3e40752e1ebffe8cbd5f9e1f5467d0","subject":"credentials: never return a TOTP seed in read responses","status":"NEW","created":"2026-08-25 18:36:25.000000000","updated":"2026-09-01 15:50:54.000000000","submit_type":"MERGE_IF_NECESSARY","mergeable":true,"submittable":false,"total_comment_count":2,"unresolved_comment_count":0,"has_review_started":true,"meta_rev_id":"a1a4d2f63bd012beedcf220289eaed431ad4b7fe","_number":1002373,"virtual_id_number":1002373,"owner":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"actions":{},"labels":{"Verified":{"recommended":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"tag":"autogenerated:zuul:check","value":1,"date":"2026-08-25 23:41:14.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":1,"default_value":0,"optional":true},"Code-Review":{"disliked":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"all":[{"value":-1,"date":"2026-09-01 15:50:54.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","value":-1,"default_value":0,"optional":true},"Workflow":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-08-25 19:57:43.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-08-31 13:51:00.000000000","updated_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"reviewer":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"state":"CC"},{"updated":"2026-09-01 15:50:54.000000000","updated_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"reviewer":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"state":"REVIEWER"}],"messages":[{"id":"55b1a6262089589fd21116c65cb02ce28e1925d3","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 18:36:25.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"4327677e12b25915b60120e06d034694769b2621","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 18:40:22.000000000","message":"Uploaded patch set 2: Patch Set 1 was rebased. Commit message was updated.","accounts_in_message":[],"_revision_number":2},{"id":"9779665af66193f07abbdf22a023e5274d983506","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 18:43:59.000000000","message":"Uploaded patch set 3.","accounts_in_message":[],"_revision_number":3},{"id":"fe9b2c90df0639e7933cd7ddbc6b813725145dfd","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-25 19:57:43.000000000","message":"Patch Set 3: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/599c794d919f4bd39c7932e1d19cff04\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/069871503606437691931a19e4773b64 : SUCCESS in 13m 40s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/261c40e939ac4b13924e26e6e2185312 : FAILURE in 5m 50s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/1ea7ff6232264a578a46169da2d61a8c : SUCCESS in 10m 55s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/0dfe736053754683946c0b19c314ff60 : SUCCESS in 11m 43s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/727d3dae364a42159fa480339515c864 : SUCCESS in 15m 51s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/0ab636688a724ec1bdad0064240c277f : SUCCESS in 7m 22s\n- grenade https://zuul.opendev.org/t/openstack/build/f38e22fb3bd7429ab020be1a8c739ee3 : SUCCESS in 59m 00s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/f91cf11911c340d4938a781522136c46 : SUCCESS in 1h 08m 12s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/d9ffbd7b88004600af826954b76c9186 : SUCCESS in 10m 17s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/b35518c66fe9423390e0dd01a9b163ae : FAILURE in 21m 45s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/168d4c4ba5c94d9293c089985ed409de : SUCCESS in 48m 54s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/b683dddaf7504c14b6c78d1eab2fc12f : FAILURE in 20m 27s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/951af2c7bdad4f4db2cd137216801224 : FAILURE in 25m 10s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/a815a72ae9aa4c8da4ee30f8e9ad8f5a : SUCCESS in 33m 54s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/5684e002b54947e49a120e7ac69ef475 : SUCCESS in 59m 41s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/4366dcb3f1a64b79bafca0d9279dad7d : SUCCESS in 38m 47s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/feb83c4b29bb49c88b1e9f4965e27be9 : SUCCESS in 53m 44s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/2f8a3e54d6854735968eb215cb6b89fa : SUCCESS in 22m 47s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/c077ab7befe3466b8f5c3caf69ec00ef : SUCCESS in 4m 47s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":3},{"id":"732986ff0304a8b687e3b482325462d22e3d13e8","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-25 20:56:10.000000000","message":"Patch Set 3:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/886f2cb12122452c91d8fa288a068bdc\n\n- openstack-tox-py311-arm64 https://zuul.opendev.org/t/openstack/build/08847e20aa2d4811adf303e48005b7a7 : SUCCESS in 15m 17s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/0e155e41fe3b420487feef94c4ee31c6 : SUCCESS in 22m 46s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/1fc377eff22d4a148638afc41a612673 : SUCCESS in 19m 41s (non-voting)","accounts_in_message":[],"_revision_number":3},{"id":"15bbde415da0250f09f26d959b02507302834859","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 22:23:10.000000000","message":"Uploaded patch set 4.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":4},{"id":"873c7af7ef6d481dd152f377f5d7db27fd7953f8","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-25 23:07:40.000000000","message":"Patch Set 4:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/1d73238a755c455193f82aae50401de9\n\n- openstack-tox-py311-arm64 https://zuul.opendev.org/t/openstack/build/10f436f3130145e0beac51158c6fcd78 : SUCCESS in 20m 32s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/eae1b0fa01c04552853963cac60467ed : SUCCESS in 23m 07s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/9970407f727542f68c512a12b98ccd99 : SUCCESS in 33m 53s (non-voting)","accounts_in_message":[],"_revision_number":4},{"id":"6ebcd271c84a1f240196f358f098d87650ee1b20","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-25 23:41:14.000000000","message":"Patch Set 4: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/1ebe07ae22e8451687afa4245cd7ae2b\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/69987e14b0af41f298f79a8e9542f467 : SUCCESS in 15m 53s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/a2e565f315ee48e8b5a5ea1e4d4749ad : SUCCESS in 4m 42s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/510439d5ee34492cbea3f55873d2f166 : SUCCESS in 11m 10s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/9add0dc619ac43b28ba91623a9b157b5 : SUCCESS in 10m 46s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/7abeac634ca74719b4848ccd791f07b0 : SUCCESS in 13m 41s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/3ef3326352f94fcbac6744de0a252008 : SUCCESS in 14m 31s\n- grenade https://zuul.opendev.org/t/openstack/build/d309de20db2e408083f02a10de7ade6a : SUCCESS in 1h 09m 29s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/ac79cb8f657a4c26b9cb03ac2902f63a : SUCCESS in 1h 04m 22s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/787ddabc10d34f46a45fefaa7409b7ca : SUCCESS in 14m 01s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/6dbe64ff26804715a98168b4a66db0d8 : FAILURE in 18m 47s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/b710f35c726949ebac4bc6658fc02bcf : SUCCESS in 37m 56s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/512565cd8d7f43898aa1f6abf4d28f5e : FAILURE in 12m 19s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/db16241741a9404bbff7107bf020fd39 : FAILURE in 25m 52s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/d52e4d22464546d09de83ff486d0fd67 : SUCCESS in 51m 46s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/f2a56a6a18e84f39943679ef6427f1f5 : SUCCESS in 56m 14s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/2d81b65df03c4c8d9d7f22d34a09cf2a : SUCCESS in 33m 18s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/9566fb69855f497c9cdfb6220a29af07 : SUCCESS in 41m 47s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/577cfa642dd648a7a4e5be49757b6832 : SUCCESS in 32m 31s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/574f6436eda04304a13a284e080a404a : SUCCESS in 7m 19s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":4},{"id":"ebc7c79c134cc347c1b004db7326bf163fa1789e","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-08-31 13:51:00.000000000","message":"Patch Set 4:\n\n(1 comment)","accounts_in_message":[],"_revision_number":4},{"id":"a1a4d2f63bd012beedcf220289eaed431ad4b7fe","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-09-01 15:50:54.000000000","message":"Patch Set 4: Code-Review-1\n\n(1 comment)","accounts_in_message":[],"_revision_number":4}],"current_revision_number":4,"current_revision":"4e0650eb16e169856e56a5d85042f5e6546b1dbd","revisions":{"493d799dc8768129770f4a2e6f9fbede2a3979d2":{"kind":"REWORK","_number":1,"created":"2026-08-25 18:36:25.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/73/1002373/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/73/1002373/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/73/1002373/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/73/1002373/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/73/1002373/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/73/1002373/1"}}},"commit":{"parents":[{"commit":"3a1409e4d4ebe0232b72ba2ec52b66bb53ab3b81","subject":"credentials: reject delegated tokens, restrict PATCH to blob only","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/3a1409e4d4ebe0232b72ba2ec52b66bb53ab3b81"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 18:35:27.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 18:35:39.000000000","tz":120},"subject":"credentials: never return a TOTP seed in read responses","message":"credentials: never return a TOTP seed in read responses\n\nGET /v3/credentials and GET /v3/credentials/{credential_id} returned\nthe raw blob for a totp credential to any caller with read access,\nincluding the credential\u0027s own owner using an ordinary primary-auth\ntoken -- the previous commit\u0027s delegated-token guard only blocks\nGET for non-primary-auth tokens, it does not touch what a legitimate\nprimary-auth read returns.\n\nThere is no legitimate reason for a client to read a TOTP seed back\nafter creating it: once written, only the enrolled authenticator app\nneeds it. Returning it on every subsequent read just gives the secret\nanother place to leak (logs, browser history, a session that outlives\nits owner\u0027s trust). Strip `blob` from the response unconditionally for\ntotp-type credentials in both the list and single-item GET handlers.\n\nThis does not change PATCH/DELETE, which the previous commit already\nrestricts to primary-auth tokens only, or POST, which still needs to\naccept the initial blob.\n\nRelated-Bug: #2159643\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nChange-Id: I3806cf464d3e40752e1ebffe8cbd5f9e1f5467d0\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/493d799dc8768129770f4a2e6f9fbede2a3979d2"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/493d799dc8768129770f4a2e6f9fbede2a3979d2"}]},"branch":"refs/heads/master"},"c58f5936db6dbb350d3e1b91efea1d34d5551d9d":{"kind":"TRIVIAL_REBASE_WITH_MESSAGE_UPDATE","_number":2,"created":"2026-08-25 18:40:22.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/73/1002373/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/73/1002373/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/73/1002373/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/73/1002373/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/73/1002373/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/73/1002373/2"}}},"commit":{"parents":[{"commit":"16afc813b7e6de727d8a91e065d7824b06e32925","subject":"Merge \"Abandon server-side paged search cursor when sizelimit is reached\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/16afc813b7e6de727d8a91e065d7824b06e32925"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 18:35:27.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 18:39:44.000000000","tz":120},"subject":"credentials: never return a TOTP seed in read responses","message":"credentials: never return a TOTP seed in read responses\n\nGET /v3/credentials and GET /v3/credentials/{credential_id} return\nthe raw blob for a totp credential to any caller with read access to\nit, including the credential\u0027s own owner using an ordinary\nprimary-auth token. Delegated-token guards on these endpoints (see\nLP#2159643) restrict who can call GET at all, but do not change what\na permitted read returns.\n\nThere is no legitimate reason for a client to read a TOTP seed back\nafter creating it: once written, only the enrolled authenticator app\nneeds it. Returning it on every subsequent read just gives the secret\nanother place to leak (logs, browser history, a session that outlives\nits owner\u0027s trust). Strip `blob` from the response unconditionally for\ntotp-type credentials in both the list and single-item GET handlers.\n\nThis does not change PATCH/DELETE, which are separately restricted to\nprimary-auth tokens (LP#2159643), or POST, which still needs to accept\nthe initial blob.\n\nRelated-Bug: #2159643\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nChange-Id: I3806cf464d3e40752e1ebffe8cbd5f9e1f5467d0\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/c58f5936db6dbb350d3e1b91efea1d34d5551d9d"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/c58f5936db6dbb350d3e1b91efea1d34d5551d9d"}]},"branch":"refs/heads/master"},"220c639824ca572d65c7bf6d5ffd97654e02b079":{"kind":"REWORK","_number":3,"created":"2026-08-25 18:43:59.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/73/1002373/3","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/73/1002373/3","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/73/1002373/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/73/1002373/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/73/1002373/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/73/1002373/3"}}},"commit":{"parents":[{"commit":"16afc813b7e6de727d8a91e065d7824b06e32925","subject":"Merge \"Abandon server-side paged search cursor when sizelimit is reached\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/16afc813b7e6de727d8a91e065d7824b06e32925"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 18:35:27.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 18:43:26.000000000","tz":120},"subject":"credentials: never return a TOTP seed in read responses","message":"credentials: never return a TOTP seed in read responses\n\nGET /v3/credentials and GET /v3/credentials/{credential_id} return\nthe raw blob for a totp credential to any caller with read access to\nit, including the credential\u0027s own owner using an ordinary\nprimary-auth token. Delegated-token guards on these endpoints (see\nLP#2159643) restrict who can call GET at all, but do not change what\na permitted read returns.\n\nReading a TOTP seed back defeats the MFA protection it exists to\nprovide: whoever obtains it can compute valid passcodes indefinitely\nand impersonate the second factor, silently bypassing MFA without the\naccount owner ever noticing. Strip `blob` from the response\nunconditionally for totp-type credentials in both the list and\nsingle-item GET handlers.\n\nThis does not change PATCH/DELETE, which are separately restricted to\nprimary-auth tokens (LP#2159643), or POST, which still needs to accept\nthe initial blob.\n\nRelated-Bug: #2159643\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nChange-Id: I3806cf464d3e40752e1ebffe8cbd5f9e1f5467d0\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/220c639824ca572d65c7bf6d5ffd97654e02b079"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/220c639824ca572d65c7bf6d5ffd97654e02b079"}]},"branch":"refs/heads/master"},"4e0650eb16e169856e56a5d85042f5e6546b1dbd":{"kind":"REWORK","_number":4,"created":"2026-08-25 22:23:10.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/73/1002373/4","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/73/1002373/4","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/73/1002373/4 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/73/1002373/4 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/73/1002373/4 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/73/1002373/4"}}},"commit":{"parents":[{"commit":"16afc813b7e6de727d8a91e065d7824b06e32925","subject":"Merge \"Abandon server-side paged search cursor when sizelimit is reached\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/16afc813b7e6de727d8a91e065d7824b06e32925"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 18:35:27.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 22:22:27.000000000","tz":120},"subject":"credentials: never return a TOTP seed in read responses","message":"credentials: never return a TOTP seed in read responses\n\nGET /v3/credentials and GET /v3/credentials/{credential_id} return\nthe raw blob for a totp credential to any caller with read access to\nit, including the credential\u0027s own owner using an ordinary\nprimary-auth token. Delegated-token guards on these endpoints (see\nLP#2159643) restrict who can call GET at all, but do not change what\na permitted read returns.\n\nReading a TOTP seed back defeats the MFA protection it exists to\nprovide: whoever obtains it can compute valid passcodes indefinitely\nand impersonate the second factor, silently bypassing MFA without the\naccount owner ever noticing. Strip `blob` from the response\nunconditionally for totp-type credentials in both the list and\nsingle-item GET handlers.\n\nThis does not change PATCH/DELETE, which are separately restricted to\nprimary-auth tokens (LP#2159643), or POST, which still needs to accept\nthe initial blob.\n\nRelated-Bug: #2159643\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nChange-Id: I3806cf464d3e40752e1ebffe8cbd5f9e1f5467d0\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/4e0650eb16e169856e56a5d85042f5e6546b1dbd"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/4e0650eb16e169856e56a5d85042f5e6546b1dbd"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"OK","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}},{"label":"Workflow","status":"MAY"}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Verified\u003dMAX","label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Code-Review\u003dMAX","label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Workflow\u003dMAX","label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}