)]}'
{"id":"openstack%2Fkeystone~1002411","triplet_id":"openstack%2Fkeystone~master~Ice4a656e8deefd8538e10ad8d8d1fb12a3e3d12d","project":"openstack/keystone","branch":"master","attention_set":{},"removed_from_attention_set":{"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-08-31 16:01:51.000000000","reason":"Change was submitted"}},"hashtags":[],"change_id":"Ice4a656e8deefd8538e10ad8d8d1fb12a3e3d12d","subject":"Prevent unauthorized project-scoped assignment list","status":"MERGED","created":"2026-08-25 23:26:38.000000000","updated":"2026-08-31 16:03:48.000000000","submitted":"2026-08-31 16:01:51.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"1002411","meta_rev_id":"8068b6cadee8e4a807b148f071f91c46816e1645","_number":1002411,"virtual_id_number":1002411,"owner":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-08-31 16:01:51.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"all":[{"value":2,"date":"2026-08-31 13:47:00.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"all":[{"value":1,"date":"2026-08-31 13:47:00.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-08-25 23:26:38.000000000","updated_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"reviewer":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"state":"CC"},{"updated":"2026-08-26 00:24:09.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-08-31 13:47:00.000000000","updated_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"reviewer":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"state":"REVIEWER"}],"messages":[{"id":"82a79db0b2588fa5410e67db86a8d28398a4d11c","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 23:26:38.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"c63dcc1444280022949b759a8b2c2a75bc3d10dd","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 23:51:09.000000000","message":"Patch Set 1:\n\nThis change is ready for review.","accounts_in_message":[],"_revision_number":1},{"id":"f7b542cdea9522ca846bcef5c300960fb7b33c62","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-26 00:24:09.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/bcc9437477464165ac61d2ac16965b7f\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/f5be8a03248542e48c8352c53a753bf5 : SUCCESS in 19m 45s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/46afc9596ff94663a280bd9e8bdc0c55 : SUCCESS in 4m 33s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/82733ca257ff44868a7a8732f88e9699 : SUCCESS in 9m 44s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/41cc00a897e44253944f2df2d955e841 : SUCCESS in 10m 52s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/42eb03e301c04d68bcf3fb22a2d5a2f2 : SUCCESS in 14m 59s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/56ab5057a3684199a05f8590102258ed : SUCCESS in 15m 22s\n- grenade https://zuul.opendev.org/t/openstack/build/3aebfb5dfea44c73bf56cf1af3daa51c : SUCCESS in 31m 36s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/8ff84b46ca724f84b123d45e8aa6f955 : SUCCESS in 44m 50s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/c0cb620e0d644f2ebcb0dd34eca6942b : SUCCESS in 8m 51s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/bbb837e4c00042bdadb32ad3cbfb4eaf : SUCCESS in 9m 01s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/0ef48e112f174b3e912aa06104791f09 : SUCCESS in 35m 57s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/5f444306900d45908523a4ddf59acf9e : FAILURE in 19m 55s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/999c95f30fc444a68f1003552967574f : FAILURE in 25m 11s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/d71b3585744a43f084b5cf89dd3eb2d1 : SUCCESS in 46m 23s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/c6011568b42c408b884e3e556c1f13e0 : SUCCESS in 23m 16s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/9e5e617ef26840eba3c457a59f3df58d : SUCCESS in 18m 46s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/e90c64856d1840e9825a42bbda7c2dea : SUCCESS in 51m 22s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/e91b3406ef2c4ff19387e3caf55fc646 : SUCCESS in 31m 01s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/1c9d6c0bd9224ab5bf28654d8e343421 : SUCCESS in 8m 24s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":1},{"id":"57dbbef4e91b9c71ff8d0d607217cc19fa1ad0f1","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-26 01:23:03.000000000","message":"Patch Set 1:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/77e7b5beaa1649f791af3af4d2255a4b\n\n- openstack-tox-py311-arm64 https://zuul.opendev.org/t/openstack/build/c3a8d7ec1f444098bc18b3c62bbff1dc : SUCCESS in 22m 16s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/c0feb2438b664786b1333ae918e00c17 : SUCCESS in 21m 30s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/55441731c6e04d209924a59514357c5e : SUCCESS in 23m 00s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"904fca8eaf8f7f7ea5bb8b2142565513d5928f21","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-08-31 13:47:00.000000000","message":"Patch Set 1: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":1},{"id":"4e2464a94a478059e31ed481ca9c96092df4fc62","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-31 13:47:28.000000000","message":"Patch Set 1: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":1},{"id":"caec47d6af3306f36c2e4e9a4212bceacf0cda3b","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-31 16:01:51.000000000","message":"Patch Set 1: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/40e0db5036bc44f0a2044d2e7de327ba\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/a86f1b5723234869afa3bfc16d4d280b : SUCCESS in 3m 12s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/0c919693fcac4bd18eb4feca4caf2d03 : SUCCESS in 7m 14s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/0aa22d94ad834ba0803fbd6e06fc08c4 : SUCCESS in 7m 41s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/e9f6da4c7cbd43b996090823fe7fabc1 : SUCCESS in 12m 53s\n- grenade https://zuul.opendev.org/t/openstack/build/390f98bc69b84ad2a489b82f2a17b0a6 : SUCCESS in 1h 06m 37s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/6b7c0648398e41288c76fa89de201e03 : SUCCESS in 52m 09s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/6957aaf0b3234b7f9c87040c34d1dc9c : SUCCESS in 5m 51s\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/15f44d7af0cf42889bc3c02fb17fdb2e : SUCCESS in 48m 20s\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/5734601d73c84b5695a918d4d2d01f0e : SUCCESS in 48m 23s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/1419ff3ab83147a7a0997178499d4553 : SUCCESS in 28m 15s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/eeb51392567b4bedb05b91f0d9d0d28e : SUCCESS in 50m 00s","accounts_in_message":[],"_revision_number":1},{"id":"ab5c16c997f1a6d84575e97180641d4b32f86ce9","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-31 16:01:51.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":1},{"id":"8068b6cadee8e4a807b148f071f91c46816e1645","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-31 16:03:48.000000000","message":"Patch Set 1:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/65ae9bf159294807a678c04c3b1935c8\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/0c491171fd404e61b65a9ac5c14397da : SUCCESS in 1m 08s\n- promote-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/0da62e8f64a3444e8c1a81149e85750b : SUCCESS in 52s","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"eb27f4e309708746a8e7a5f0ad7e9a510e47ff0b","revisions":{"eb27f4e309708746a8e7a5f0ad7e9a510e47ff0b":{"kind":"REWORK","_number":1,"created":"2026-08-25 23:26:38.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/11/1002411/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/11/1002411/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/11/1002411/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/11/1002411/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/11/1002411/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/11/1002411/1"}}},"commit":{"parents":[{"commit":"16afc813b7e6de727d8a91e065d7824b06e32925","subject":"Merge \"Abandon server-side paged search cursor when sizelimit is reached\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/16afc813b7e6de727d8a91e065d7824b06e32925"}]}],"author":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-08-04 11:51:03.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 23:26:23.000000000","tz":120},"subject":"Prevent unauthorized project-scoped assignment list","message":"Prevent unauthorized project-scoped assignment list\n\nAny user holding `role:reader` on any project could list all role\nassignments under any domain by passing a domain ID as\n`scope.project.id` to `GET /v3/role_assignments?include_subtree`.\nDomain projects store `domain_id\u003dnull`, which matched the `null`\n`domain_id` of any project-scoped token in the oslo.policy string\ncomparison, bypassing the domain-reader restriction.  An explicit `not\nNone:%(target.domain_id)s` guard has been added to the affected policy\nrules.\n\nCloses-Bug: #2154645\nChange-Id: Ice4a656e8deefd8538e10ad8d8d1fb12a3e3d12d\nCo-Authored-By: Grzegorz Grasza \u003cxek@redhat.com\u003e\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/eb27f4e309708746a8e7a5f0ad7e9a510e47ff0b"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/eb27f4e309708746a8e7a5f0ad7e9a510e47ff0b"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}