)]}'
{"keystone/api/credentials.py":[{"author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"tag":"autogenerated:zuul:check","change_message_id":"5628d797d5885810a03637826d20f1d2fdd82cd1","unresolved":false,"context_lines":[{"line_number":50,"context_line":"    if not (trust_id or delegation.is_delegated_method(token)):"},{"line_number":51,"context_line":"        return"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"    insecure_cross_project \u003d CONF.security_compliance.allow_insecure_admin_trust_cross_project_credentials_access"},{"line_number":54,"context_line":"    if insecure_cross_project and (credential_type or \u0027\u0027).lower() \u003d\u003d \u0027ec2\u0027:"},{"line_number":55,"context_line":"        # Still restrict to admin-role delegated tokens only. See LP#2150089."},{"line_number":56,"context_line":"        try:"}],"source_content_type":"text/x-python","patch_set":1,"id":"6dffd752_5b29154b","line":53,"updated":"2026-08-26 09:53:02.000000000","message":"pep8: E501 line too long (113 \u003e 79 characters)","commit_id":"0d3b1ea938fbaff0fdabd2292cde94f93a9e893f"}],"keystone/api/users.py":[{"author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"tag":"autogenerated:zuul:check","change_message_id":"5628d797d5885810a03637826d20f1d2fdd82cd1","unresolved":false,"context_lines":[{"line_number":505,"context_line":"                              build_target\u003dfunc)"},{"line_number":506,"context_line":"        PROVIDERS.identity_api.get_user(user_id)"},{"line_number":507,"context_line":"        ec2_cred_id \u003d utils.hash_access_key(credential_id)"},{"line_number":508,"context_line":"        cred \u003d self._get_raw_cred(ec2_cred_id)"},{"line_number":509,"context_line":"        _require_primary_auth_for_ec2("},{"line_number":510,"context_line":"            self.oslo_context, self.auth_context[\u0027token\u0027]"},{"line_number":511,"context_line":"        )"}],"source_content_type":"text/x-python","patch_set":1,"id":"bd7aaab0_7a367d80","line":508,"updated":"2026-08-26 09:53:02.000000000","message":"pep8: F841 local variable \u0027cred\u0027 is assigned to but never used","commit_id":"0d3b1ea938fbaff0fdabd2292cde94f93a9e893f"}],"keystone/tests/unit/test_v3_credential.py":[{"author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"tag":"autogenerated:zuul:check","change_message_id":"5628d797d5885810a03637826d20f1d2fdd82cd1","unresolved":false,"context_lines":[{"line_number":711,"context_line":"        self.assertEqual(self.project_id, stored[\u0027project_id\u0027])"},{"line_number":712,"context_line":""},{"line_number":713,"context_line":"    def test_trust_token_cannot_list_totp_credentials(self):"},{"line_number":714,"context_line":"        \"\"\"Trust-scoped token must not see TOTP/MFA credentials (project_id\u003dNone)."},{"line_number":715,"context_line":""},{"line_number":716,"context_line":"        TOTP credentials have no project anchor. Before this fix the"},{"line_number":717,"context_line":"        project boundary check skipped null-project credentials, allowing a"}],"source_content_type":"text/x-python","patch_set":1,"id":"ea868909_41304018","line":714,"updated":"2026-08-26 09:53:02.000000000","message":"pep8: E501 line too long (82 \u003e 79 characters)","commit_id":"0d3b1ea938fbaff0fdabd2292cde94f93a9e893f"},{"author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"tag":"autogenerated:zuul:check","change_message_id":"5628d797d5885810a03637826d20f1d2fdd82cd1","unresolved":false,"context_lines":[{"line_number":832,"context_line":"        )"},{"line_number":833,"context_line":""},{"line_number":834,"context_line":"    def test_trust_token_cannot_update_totp_credential(self):"},{"line_number":835,"context_line":"        \"\"\"Trust-scoped token must not be able to update a TOTP credential blob.\"\"\""},{"line_number":836,"context_line":"        totp_ref \u003d {"},{"line_number":837,"context_line":"            \u0027user_id\u0027: self.user_id,"},{"line_number":838,"context_line":"            \u0027type\u0027: \u0027totp\u0027,"}],"source_content_type":"text/x-python","patch_set":1,"id":"4151f0aa_418aa9fc","line":835,"updated":"2026-08-26 09:53:02.000000000","message":"pep8: E501 line too long (83 \u003e 79 characters)","commit_id":"0d3b1ea938fbaff0fdabd2292cde94f93a9e893f"},{"author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"tag":"autogenerated:zuul:check","change_message_id":"5628d797d5885810a03637826d20f1d2fdd82cd1","unresolved":false,"context_lines":[{"line_number":915,"context_line":"            expected_status\u003dhttp.client.OK,"},{"line_number":916,"context_line":"        )"},{"line_number":917,"context_line":"        # The resulting token is scoped to the trust\u0027s project, not to"},{"line_number":918,"context_line":"        # other_project -- the trust mechanism prevents cross-project escalation."},{"line_number":919,"context_line":"        token_project \u003d r.result[\u0027token\u0027][\u0027project\u0027][\u0027id\u0027]"},{"line_number":920,"context_line":"        self.assertEqual(self.project_id, token_project)"},{"line_number":921,"context_line":"        self.assertNotEqual(other_project[\u0027id\u0027], token_project)"}],"source_content_type":"text/x-python","patch_set":1,"id":"9d244703_ad8d3081","line":918,"updated":"2026-08-26 09:53:02.000000000","message":"pep8: E501 line too long (81 \u003e 79 characters)","commit_id":"0d3b1ea938fbaff0fdabd2292cde94f93a9e893f"},{"author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"tag":"autogenerated:zuul:check","change_message_id":"5628d797d5885810a03637826d20f1d2fdd82cd1","unresolved":false,"context_lines":[{"line_number":1321,"context_line":"        )"},{"line_number":1322,"context_line":""},{"line_number":1323,"context_line":"    def test_access_token_cannot_get_credential_via_os_ec2(self):"},{"line_number":1324,"context_line":"        \"\"\"An OAuth1 access token cannot read an EC2 cred via OS-EC2 (LP#2159643).\"\"\""},{"line_number":1325,"context_line":"        uri \u003d f\u0027/users/{self.user_id}/credentials/OS-EC2\u0027"},{"line_number":1326,"context_line":"        ec2_cred \u003d self.post("},{"line_number":1327,"context_line":"            uri, body\u003d{\u0027tenant_id\u0027: self.project_id}"}],"source_content_type":"text/x-python","patch_set":1,"id":"79fb911f_f89cdcf5","line":1324,"updated":"2026-08-26 09:53:02.000000000","message":"pep8: E501 line too long (85 \u003e 79 characters)","commit_id":"0d3b1ea938fbaff0fdabd2292cde94f93a9e893f"},{"author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"tag":"autogenerated:zuul:check","change_message_id":"5628d797d5885810a03637826d20f1d2fdd82cd1","unresolved":false,"context_lines":[{"line_number":1334,"context_line":"        )"},{"line_number":1335,"context_line":""},{"line_number":1336,"context_line":"    def test_access_token_cannot_delete_credential_via_os_ec2(self):"},{"line_number":1337,"context_line":"        \"\"\"An OAuth1 access token cannot delete an EC2 cred via OS-EC2 (LP#2159643).\"\"\""},{"line_number":1338,"context_line":"        uri \u003d f\u0027/users/{self.user_id}/credentials/OS-EC2\u0027"},{"line_number":1339,"context_line":"        ec2_cred \u003d self.post("},{"line_number":1340,"context_line":"            uri, body\u003d{\u0027tenant_id\u0027: self.project_id}"}],"source_content_type":"text/x-python","patch_set":1,"id":"9fde5b9c_c234da4e","line":1337,"updated":"2026-08-26 09:53:02.000000000","message":"pep8: E501 line too long (87 \u003e 79 characters)","commit_id":"0d3b1ea938fbaff0fdabd2292cde94f93a9e893f"},{"author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"tag":"autogenerated:zuul:check","change_message_id":"5628d797d5885810a03637826d20f1d2fdd82cd1","unresolved":false,"context_lines":[{"line_number":1347,"context_line":"        self.get(cred_uri, expected_status\u003dhttp.client.OK)"},{"line_number":1348,"context_line":""},{"line_number":1349,"context_line":"    def test_ec2_auth_access_token_cross_project_blocked(self):"},{"line_number":1350,"context_line":"        \"\"\"OAuth1 access-token-backed EC2 credential must not auth cross-project."},{"line_number":1351,"context_line":""},{"line_number":1352,"context_line":"        Auth-time check: if a cross-project EC2 credential backed by an OAuth1"},{"line_number":1353,"context_line":"        access token exists, POST /ec2tokens must reject it when the"}],"source_content_type":"text/x-python","patch_set":1,"id":"b2357df1_e5ca9997","line":1350,"updated":"2026-08-26 09:53:02.000000000","message":"pep8: E501 line too long (81 \u003e 79 characters)","commit_id":"0d3b1ea938fbaff0fdabd2292cde94f93a9e893f"},{"author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"tag":"autogenerated:zuul:check","change_message_id":"5628d797d5885810a03637826d20f1d2fdd82cd1","unresolved":false,"context_lines":[{"line_number":1356,"context_line":"        access_key, _ \u003d self._get_access_token()"},{"line_number":1357,"context_line":""},{"line_number":1358,"context_line":"        # Retrieve the stored access token to get its project_id"},{"line_number":1359,"context_line":"        access_token \u003d PROVIDERS.oauth_api.get_access_token("},{"line_number":1360,"context_line":"            access_key.decode(\u0027utf-8\u0027)"},{"line_number":1361,"context_line":"            if isinstance(access_key, bytes)"},{"line_number":1362,"context_line":"            else access_key"}],"source_content_type":"text/x-python","patch_set":1,"id":"ab2daf85_e3258b81","line":1359,"updated":"2026-08-26 09:53:02.000000000","message":"pep8: F841 local variable \u0027access_token\u0027 is assigned to but never used","commit_id":"0d3b1ea938fbaff0fdabd2292cde94f93a9e893f"},{"author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"tag":"autogenerated:zuul:check","change_message_id":"5628d797d5885810a03637826d20f1d2fdd82cd1","unresolved":false,"context_lines":[{"line_number":1449,"context_line":"                        matchers.EndsWith(uri))"},{"line_number":1450,"context_line":""},{"line_number":1451,"context_line":"    def _get_ec2_token_via_own_credential(self):"},{"line_number":1452,"context_line":"        \"\"\"Create an EC2 credential and exchange it for an ec2credential token.\"\"\""},{"line_number":1453,"context_line":"        ec2_cred \u003d self._get_ec2_cred()"},{"line_number":1454,"context_line":"        blob \u003d {\u0027access\u0027: ec2_cred[\u0027access\u0027], \u0027secret\u0027: ec2_cred[\u0027secret\u0027]}"},{"line_number":1455,"context_line":"        r \u003d self.post("}],"source_content_type":"text/x-python","patch_set":1,"id":"663979c2_0cea01ac","line":1452,"updated":"2026-08-26 09:53:02.000000000","message":"pep8: E501 line too long (82 \u003e 79 characters)","commit_id":"0d3b1ea938fbaff0fdabd2292cde94f93a9e893f"},{"author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"tag":"autogenerated:zuul:check","change_message_id":"5628d797d5885810a03637826d20f1d2fdd82cd1","unresolved":false,"context_lines":[{"line_number":1460,"context_line":"        return ec2_cred, r.headers.get(\u0027X-Subject-Token\u0027)"},{"line_number":1461,"context_line":""},{"line_number":1462,"context_line":"    def test_ec2_token_cannot_list_credentials_via_os_ec2(self):"},{"line_number":1463,"context_line":"        \"\"\"An ec2credential token must not list EC2 creds via OS-EC2 (LP#2159643)."},{"line_number":1464,"context_line":""},{"line_number":1465,"context_line":"        The OS-EC2 compat endpoint has its own, separate delegation check"},{"line_number":1466,"context_line":"        from /v3/credentials, and it never recognized ec2credential tokens"}],"source_content_type":"text/x-python","patch_set":1,"id":"4336ac58_8dabe3bf","line":1463,"updated":"2026-08-26 09:53:02.000000000","message":"pep8: E501 line too long (82 \u003e 79 characters)","commit_id":"0d3b1ea938fbaff0fdabd2292cde94f93a9e893f"},{"author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"tag":"autogenerated:zuul:check","change_message_id":"5628d797d5885810a03637826d20f1d2fdd82cd1","unresolved":false,"context_lines":[{"line_number":1475,"context_line":"        )"},{"line_number":1476,"context_line":""},{"line_number":1477,"context_line":"    def test_ec2_token_cannot_get_credential_via_os_ec2(self):"},{"line_number":1478,"context_line":"        \"\"\"An ec2credential token must not read an EC2 cred via OS-EC2 (LP#2159643).\"\"\""},{"line_number":1479,"context_line":"        ec2_cred, ec2_token \u003d self._get_ec2_token_via_own_credential()"},{"line_number":1480,"context_line":"        uri \u003d \u0027/\u0027.join([self._get_ec2_cred_uri(), ec2_cred[\u0027access\u0027]])"},{"line_number":1481,"context_line":"        self.get(uri, token\u003dec2_token, expected_status\u003dhttp.client.FORBIDDEN)"}],"source_content_type":"text/x-python","patch_set":1,"id":"d61db7dd_4fb12527","line":1478,"updated":"2026-08-26 09:53:02.000000000","message":"pep8: E501 line too long (87 \u003e 79 characters)","commit_id":"0d3b1ea938fbaff0fdabd2292cde94f93a9e893f"},{"author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"tag":"autogenerated:zuul:check","change_message_id":"5628d797d5885810a03637826d20f1d2fdd82cd1","unresolved":false,"context_lines":[{"line_number":1481,"context_line":"        self.get(uri, token\u003dec2_token, expected_status\u003dhttp.client.FORBIDDEN)"},{"line_number":1482,"context_line":""},{"line_number":1483,"context_line":"    def test_ec2_token_cannot_delete_credential_via_os_ec2(self):"},{"line_number":1484,"context_line":"        \"\"\"An ec2credential token must not delete an EC2 cred via OS-EC2 (LP#2159643).\"\"\""},{"line_number":1485,"context_line":"        ec2_cred, ec2_token \u003d self._get_ec2_token_via_own_credential()"},{"line_number":1486,"context_line":"        uri \u003d \u0027/\u0027.join([self._get_ec2_cred_uri(), ec2_cred[\u0027access\u0027]])"},{"line_number":1487,"context_line":"        self.delete(uri, token\u003dec2_token, expected_status\u003dhttp.client.FORBIDDEN)"}],"source_content_type":"text/x-python","patch_set":1,"id":"c3d09348_80990759","line":1484,"updated":"2026-08-26 09:53:02.000000000","message":"pep8: E501 line too long (89 \u003e 79 characters)","commit_id":"0d3b1ea938fbaff0fdabd2292cde94f93a9e893f"},{"author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"tag":"autogenerated:zuul:check","change_message_id":"5628d797d5885810a03637826d20f1d2fdd82cd1","unresolved":false,"context_lines":[{"line_number":1484,"context_line":"        \"\"\"An ec2credential token must not delete an EC2 cred via OS-EC2 (LP#2159643).\"\"\""},{"line_number":1485,"context_line":"        ec2_cred, ec2_token \u003d self._get_ec2_token_via_own_credential()"},{"line_number":1486,"context_line":"        uri \u003d \u0027/\u0027.join([self._get_ec2_cred_uri(), ec2_cred[\u0027access\u0027]])"},{"line_number":1487,"context_line":"        self.delete(uri, token\u003dec2_token, expected_status\u003dhttp.client.FORBIDDEN)"},{"line_number":1488,"context_line":"        # the credential must still exist afterwards"},{"line_number":1489,"context_line":"        self.get(uri, expected_status\u003dhttp.client.OK)"},{"line_number":1490,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"1c47f5ed_c6136186","line":1487,"updated":"2026-08-26 09:53:02.000000000","message":"pep8: E501 line too long (80 \u003e 79 characters)","commit_id":"0d3b1ea938fbaff0fdabd2292cde94f93a9e893f"},{"author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"tag":"autogenerated:zuul:check","change_message_id":"5628d797d5885810a03637826d20f1d2fdd82cd1","unresolved":false,"context_lines":[{"line_number":1596,"context_line":"        )"},{"line_number":1597,"context_line":""},{"line_number":1598,"context_line":"    def test_unrestricted_app_cred_cannot_create_ec2_credential(self):"},{"line_number":1599,"context_line":"        \"\"\"An unrestricted app cred cannot create EC2 creds either (LP#2159643)."},{"line_number":1600,"context_line":""},{"line_number":1601,"context_line":"        \"unrestricted\" only ever governed app-cred management, not this."},{"line_number":1602,"context_line":"        \"\"\""}],"source_content_type":"text/x-python","patch_set":1,"id":"ab348ef7_6bebd1d5","line":1599,"updated":"2026-08-26 09:53:02.000000000","message":"pep8: E501 line too long (80 \u003e 79 characters)","commit_id":"0d3b1ea938fbaff0fdabd2292cde94f93a9e893f"},{"author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"tag":"autogenerated:zuul:check","change_message_id":"5628d797d5885810a03637826d20f1d2fdd82cd1","unresolved":false,"context_lines":[{"line_number":1634,"context_line":"        return r.headers.get(\u0027X-Subject-Token\u0027)"},{"line_number":1635,"context_line":""},{"line_number":1636,"context_line":"    def test_trust_scoped_token_cannot_create_ec2_credential(self):"},{"line_number":1637,"context_line":"        \"\"\"A trust-scoped token cannot create an EC2 cred via OS-EC2 (LP#2159643)."},{"line_number":1638,"context_line":""},{"line_number":1639,"context_line":"        Previously only checked project scope, so same-project access"},{"line_number":1640,"context_line":"        was allowed. Now rejected outright, regardless of project."}],"source_content_type":"text/x-python","patch_set":1,"id":"1f18cbd6_43e6d296","line":1637,"updated":"2026-08-26 09:53:02.000000000","message":"pep8: E501 line too long (82 \u003e 79 characters)","commit_id":"0d3b1ea938fbaff0fdabd2292cde94f93a9e893f"},{"author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"tag":"autogenerated:zuul:check","change_message_id":"5628d797d5885810a03637826d20f1d2fdd82cd1","unresolved":false,"context_lines":[{"line_number":1702,"context_line":"        )"},{"line_number":1703,"context_line":""},{"line_number":1704,"context_line":"    def test_require_primary_auth_allows_custom_method_via_config(self):"},{"line_number":1705,"context_line":"        \"\"\"An operator-registered custom auth plugin is not mistaken for a"},{"line_number":1706,"context_line":"        delegated credential once listed in"},{"line_number":1707,"context_line":"        [auth] additional_primary_auth_methods."},{"line_number":1708,"context_line":"        \"\"\""}],"source_content_type":"text/x-python","patch_set":1,"id":"2ff5f646_db1da2ea","line":1705,"updated":"2026-08-26 09:53:02.000000000","message":"pep8: D205 1 blank line required between summary line and description","commit_id":"0d3b1ea938fbaff0fdabd2292cde94f93a9e893f"},{"author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"tag":"autogenerated:zuul:check","change_message_id":"5628d797d5885810a03637826d20f1d2fdd82cd1","unresolved":false,"context_lines":[{"line_number":1702,"context_line":"        )"},{"line_number":1703,"context_line":""},{"line_number":1704,"context_line":"    def test_require_primary_auth_allows_custom_method_via_config(self):"},{"line_number":1705,"context_line":"        \"\"\"An operator-registered custom auth plugin is not mistaken for a"},{"line_number":1706,"context_line":"        delegated credential once listed in"},{"line_number":1707,"context_line":"        [auth] additional_primary_auth_methods."},{"line_number":1708,"context_line":"        \"\"\""}],"source_content_type":"text/x-python","patch_set":1,"id":"0845af76_93fd87b7","line":1705,"updated":"2026-08-26 09:53:02.000000000","message":"pep8: D400 First line should end with a period","commit_id":"0d3b1ea938fbaff0fdabd2292cde94f93a9e893f"},{"author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"tag":"autogenerated:zuul:check","change_message_id":"5628d797d5885810a03637826d20f1d2fdd82cd1","unresolved":false,"context_lines":[{"line_number":1702,"context_line":"        )"},{"line_number":1703,"context_line":""},{"line_number":1704,"context_line":"    def test_require_primary_auth_allows_custom_method_via_config(self):"},{"line_number":1705,"context_line":"        \"\"\"An operator-registered custom auth plugin is not mistaken for a"},{"line_number":1706,"context_line":"        delegated credential once listed in"},{"line_number":1707,"context_line":"        [auth] additional_primary_auth_methods."},{"line_number":1708,"context_line":"        \"\"\""}],"source_content_type":"text/x-python","patch_set":1,"id":"d51cf6f4_3df18347","line":1705,"updated":"2026-08-26 09:53:02.000000000","message":"pep8: H405: multi line docstring summary not separated with an empty line","commit_id":"0d3b1ea938fbaff0fdabd2292cde94f93a9e893f"},{"author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"tag":"autogenerated:zuul:check","change_message_id":"5628d797d5885810a03637826d20f1d2fdd82cd1","unresolved":false,"context_lines":[{"line_number":1703,"context_line":""},{"line_number":1704,"context_line":"    def test_require_primary_auth_allows_custom_method_via_config(self):"},{"line_number":1705,"context_line":"        \"\"\"An operator-registered custom auth plugin is not mistaken for a"},{"line_number":1706,"context_line":"        delegated credential once listed in"},{"line_number":1707,"context_line":"        [auth] additional_primary_auth_methods."},{"line_number":1708,"context_line":"        \"\"\""},{"line_number":1709,"context_line":"        credentials_api.CONF.set_override("}],"source_content_type":"text/x-python","patch_set":1,"id":"99037da9_ee008a45","line":1706,"updated":"2026-08-26 09:53:02.000000000","message":"pep8: H405: multi line docstring summary not separated with an empty line","commit_id":"0d3b1ea938fbaff0fdabd2292cde94f93a9e893f"},{"author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"tag":"autogenerated:zuul:check","change_message_id":"5628d797d5885810a03637826d20f1d2fdd82cd1","unresolved":false,"context_lines":[{"line_number":1704,"context_line":"    def test_require_primary_auth_allows_custom_method_via_config(self):"},{"line_number":1705,"context_line":"        \"\"\"An operator-registered custom auth plugin is not mistaken for a"},{"line_number":1706,"context_line":"        delegated credential once listed in"},{"line_number":1707,"context_line":"        [auth] additional_primary_auth_methods."},{"line_number":1708,"context_line":"        \"\"\""},{"line_number":1709,"context_line":"        credentials_api.CONF.set_override("},{"line_number":1710,"context_line":"            \u0027additional_primary_auth_methods\u0027, [\u0027sso\u0027], group\u003d\u0027auth\u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"fb08abb6_6e2eb8da","line":1707,"updated":"2026-08-26 09:53:02.000000000","message":"pep8: H405: multi line docstring summary not separated with an empty line","commit_id":"0d3b1ea938fbaff0fdabd2292cde94f93a9e893f"},{"author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"tag":"autogenerated:zuul:check","change_message_id":"5628d797d5885810a03637826d20f1d2fdd82cd1","unresolved":false,"context_lines":[{"line_number":1705,"context_line":"        \"\"\"An operator-registered custom auth plugin is not mistaken for a"},{"line_number":1706,"context_line":"        delegated credential once listed in"},{"line_number":1707,"context_line":"        [auth] additional_primary_auth_methods."},{"line_number":1708,"context_line":"        \"\"\""},{"line_number":1709,"context_line":"        credentials_api.CONF.set_override("},{"line_number":1710,"context_line":"            \u0027additional_primary_auth_methods\u0027, [\u0027sso\u0027], group\u003d\u0027auth\u0027"},{"line_number":1711,"context_line":"        )"}],"source_content_type":"text/x-python","patch_set":1,"id":"bc1c07cd_3555bba1","line":1708,"updated":"2026-08-26 09:53:02.000000000","message":"pep8: H405: multi line docstring summary not separated with an empty line","commit_id":"0d3b1ea938fbaff0fdabd2292cde94f93a9e893f"},{"author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"tag":"autogenerated:zuul:check","change_message_id":"60d4c3615da9b68e1cf08aa3cf5f0a7111b42b11","unresolved":false,"context_lines":[{"line_number":711,"context_line":"        self.assertEqual(self.project_id, stored[\u0027project_id\u0027])"},{"line_number":712,"context_line":""},{"line_number":713,"context_line":"    def test_trust_token_cannot_list_totp_credentials(self):"},{"line_number":714,"context_line":"        \"\"\"Trust-scoped token must not see TOTP/MFA credentials (project_id\u003dNone)."},{"line_number":715,"context_line":""},{"line_number":716,"context_line":"        TOTP credentials have no project anchor. Before this fix the"},{"line_number":717,"context_line":"        project boundary check skipped null-project credentials, allowing a"}],"source_content_type":"text/x-python","patch_set":2,"id":"561c78a7_906f7a6a","line":714,"updated":"2026-08-26 22:32:48.000000000","message":"pep8: E501 line too long (82 \u003e 79 characters)","commit_id":"64f8ffb5994ed5770b1e9452e0b234d0574b5ab7"},{"author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"tag":"autogenerated:zuul:check","change_message_id":"60d4c3615da9b68e1cf08aa3cf5f0a7111b42b11","unresolved":false,"context_lines":[{"line_number":832,"context_line":"        )"},{"line_number":833,"context_line":""},{"line_number":834,"context_line":"    def test_trust_token_cannot_update_totp_credential(self):"},{"line_number":835,"context_line":"        \"\"\"Trust-scoped token must not be able to update a TOTP credential blob.\"\"\""},{"line_number":836,"context_line":"        totp_ref \u003d {"},{"line_number":837,"context_line":"            \u0027user_id\u0027: self.user_id,"},{"line_number":838,"context_line":"            \u0027type\u0027: \u0027totp\u0027,"}],"source_content_type":"text/x-python","patch_set":2,"id":"dacf3e32_a1f80d9b","line":835,"updated":"2026-08-26 22:32:48.000000000","message":"pep8: E501 line too long (83 \u003e 79 characters)","commit_id":"64f8ffb5994ed5770b1e9452e0b234d0574b5ab7"},{"author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"tag":"autogenerated:zuul:check","change_message_id":"60d4c3615da9b68e1cf08aa3cf5f0a7111b42b11","unresolved":false,"context_lines":[{"line_number":915,"context_line":"            expected_status\u003dhttp.client.OK,"},{"line_number":916,"context_line":"        )"},{"line_number":917,"context_line":"        # The resulting token is scoped to the trust\u0027s project, not to"},{"line_number":918,"context_line":"        # other_project -- the trust mechanism prevents cross-project escalation."},{"line_number":919,"context_line":"        token_project \u003d r.result[\u0027token\u0027][\u0027project\u0027][\u0027id\u0027]"},{"line_number":920,"context_line":"        self.assertEqual(self.project_id, token_project)"},{"line_number":921,"context_line":"        self.assertNotEqual(other_project[\u0027id\u0027], token_project)"}],"source_content_type":"text/x-python","patch_set":2,"id":"1cebc3f4_b050b623","line":918,"updated":"2026-08-26 22:32:48.000000000","message":"pep8: E501 line too long (81 \u003e 79 characters)","commit_id":"64f8ffb5994ed5770b1e9452e0b234d0574b5ab7"},{"author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"tag":"autogenerated:zuul:check","change_message_id":"60d4c3615da9b68e1cf08aa3cf5f0a7111b42b11","unresolved":false,"context_lines":[{"line_number":1377,"context_line":"        self.get(cred_uri, expected_status\u003dhttp.client.OK)"},{"line_number":1378,"context_line":""},{"line_number":1379,"context_line":"    def test_ec2_auth_access_token_cross_project_blocked(self):"},{"line_number":1380,"context_line":"        \"\"\"OAuth1 access-token-backed EC2 credential must not auth cross-project."},{"line_number":1381,"context_line":""},{"line_number":1382,"context_line":"        Auth-time check: if a cross-project EC2 credential backed by an OAuth1"},{"line_number":1383,"context_line":"        access token exists, POST /ec2tokens must reject it when the"}],"source_content_type":"text/x-python","patch_set":2,"id":"a936778f_84ac8f17","line":1380,"updated":"2026-08-26 22:32:48.000000000","message":"pep8: E501 line too long (81 \u003e 79 characters)","commit_id":"64f8ffb5994ed5770b1e9452e0b234d0574b5ab7"},{"author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"tag":"autogenerated:zuul:check","change_message_id":"60d4c3615da9b68e1cf08aa3cf5f0a7111b42b11","unresolved":false,"context_lines":[{"line_number":1386,"context_line":"        access_key, _ \u003d self._get_access_token()"},{"line_number":1387,"context_line":""},{"line_number":1388,"context_line":"        # Retrieve the stored access token to get its project_id"},{"line_number":1389,"context_line":"        access_token \u003d PROVIDERS.oauth_api.get_access_token("},{"line_number":1390,"context_line":"            access_key.decode(\u0027utf-8\u0027)"},{"line_number":1391,"context_line":"            if isinstance(access_key, bytes)"},{"line_number":1392,"context_line":"            else access_key"}],"source_content_type":"text/x-python","patch_set":2,"id":"45c7e605_9b3275b1","line":1389,"updated":"2026-08-26 22:32:48.000000000","message":"pep8: F841 local variable \u0027access_token\u0027 is assigned to but never used","commit_id":"64f8ffb5994ed5770b1e9452e0b234d0574b5ab7"},{"author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"tag":"autogenerated:zuul:check","change_message_id":"60d4c3615da9b68e1cf08aa3cf5f0a7111b42b11","unresolved":false,"context_lines":[{"line_number":1628,"context_line":"        )"},{"line_number":1629,"context_line":""},{"line_number":1630,"context_line":"    def test_unrestricted_app_cred_cannot_create_ec2_credential(self):"},{"line_number":1631,"context_line":"        \"\"\"An unrestricted app cred cannot create EC2 creds either (LP#2159643)."},{"line_number":1632,"context_line":""},{"line_number":1633,"context_line":"        \"unrestricted\" only ever governed app-cred management, not this."},{"line_number":1634,"context_line":"        \"\"\""}],"source_content_type":"text/x-python","patch_set":2,"id":"3064e863_4f7c1bef","line":1631,"updated":"2026-08-26 22:32:48.000000000","message":"pep8: E501 line too long (80 \u003e 79 characters)","commit_id":"64f8ffb5994ed5770b1e9452e0b234d0574b5ab7"},{"author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"tag":"autogenerated:zuul:check","change_message_id":"60d4c3615da9b68e1cf08aa3cf5f0a7111b42b11","unresolved":false,"context_lines":[{"line_number":1666,"context_line":"        return r.headers.get(\u0027X-Subject-Token\u0027)"},{"line_number":1667,"context_line":""},{"line_number":1668,"context_line":"    def test_trust_scoped_token_cannot_create_ec2_credential(self):"},{"line_number":1669,"context_line":"        \"\"\"A trust-scoped token cannot create an EC2 cred via OS-EC2 (LP#2159643)."},{"line_number":1670,"context_line":""},{"line_number":1671,"context_line":"        Previously only checked project scope, so same-project access"},{"line_number":1672,"context_line":"        was allowed. Now rejected outright, regardless of project."}],"source_content_type":"text/x-python","patch_set":2,"id":"a9c71180_0003778e","line":1669,"updated":"2026-08-26 22:32:48.000000000","message":"pep8: E501 line too long (82 \u003e 79 characters)","commit_id":"64f8ffb5994ed5770b1e9452e0b234d0574b5ab7"}]}