)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e8eab43397e332337567af228a10a7b71de8b736","unresolved":false,"context_lines":[{"line_number":7,"context_line":"Fix revoking a scoped token from an unscoped token"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"When a scoped token that was created from an unscoped token was"},{"line_number":10,"context_line":"revoked, the original token wound up being revoked. This is because"},{"line_number":11,"context_line":"the scope wasn\u0027t included in the revocation event. By including the"},{"line_number":12,"context_line":"scope in the revocation event only the scoped token is revoked."},{"line_number":13,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"baada198_c4f6df5d","line":10,"updated":"2014-07-25 14:01:46.000000000","message":"s/original/unscoped/","commit_id":"e948973d107da5b453656f0293db0d1283d2398e"}],"keystone/contrib/revoke/core.py":[{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"e6eb318630e401c4d2679877c56576111fa14cce","unresolved":false,"context_lines":[{"line_number":129,"context_line":"        return self.revoke(model.RevokeEvent(user_id\u003duser_id))"},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"    def revoke_by_expiration(self, user_id, expires_at,"},{"line_number":132,"context_line":"                             domain_id\u003dNone, project_id\u003dNone):"},{"line_number":133,"context_line":"        self.revoke("},{"line_number":134,"context_line":"            model.RevokeEvent(user_id\u003duser_id,"},{"line_number":135,"context_line":"                              expires_at\u003dexpires_at,"}],"source_content_type":"text/x-python","patch_set":14,"id":"baada198_3bf12a6a","line":132,"updated":"2014-07-28 23:16:19.000000000","message":"i assume this is xor - but that should be enforced here","commit_id":"ba96cfe510541ac4528921f303ff76134aa3a2b0"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d0be2263f2ce5fd7450640cc5ad7bb8d65b4187c","unresolved":false,"context_lines":[{"line_number":129,"context_line":"        return self.revoke(model.RevokeEvent(user_id\u003duser_id))"},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"    def revoke_by_expiration(self, user_id, expires_at,"},{"line_number":132,"context_line":"                             domain_id\u003dNone, project_id\u003dNone):"},{"line_number":133,"context_line":"        self.revoke("},{"line_number":134,"context_line":"            model.RevokeEvent(user_id\u003duser_id,"},{"line_number":135,"context_line":"                              expires_at\u003dexpires_at,"}],"source_content_type":"text/x-python","patch_set":14,"id":"baada198_e3a280ac","line":132,"in_reply_to":"baada198_3bf12a6a","updated":"2014-07-29 20:41:56.000000000","message":"Done","commit_id":"ba96cfe510541ac4528921f303ff76134aa3a2b0"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"8ec7dd90dcbe30d0e2f7bd9ecf5f2554085068dc","unresolved":false,"context_lines":[{"line_number":135,"context_line":"            msg \u003d _(\u0027The call to keystone.contrib.revoke.Manager \u0027"},{"line_number":136,"context_line":"                    \u0027revoke_by_expiration() must not have both domain_id and \u0027"},{"line_number":137,"context_line":"                    \u0027project_id. This is a bug in the keystone server. The \u0027"},{"line_number":138,"context_line":"                    \u0027current request is aborted.\u0027)"},{"line_number":139,"context_line":"            raise exception.UnexpectedError(exception\u003dmsg)"},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"        self.revoke("}],"source_content_type":"text/x-python","patch_set":15,"id":"baada198_31aaa2d2","line":138,"updated":"2014-07-31 22:02:18.000000000","message":"the last two sentences are a little overkill lol","commit_id":"da00da732d6be0626810fe4ec87d40dab16117de"}],"keystone/tests/test_revoke.py":[{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"e6eb318630e401c4d2679877c56576111fa14cce","unresolved":false,"context_lines":[{"line_number":85,"context_line":"        else:"},{"line_number":86,"context_line":"            return False"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"    # domain_scope_id matches assignment_domain_id in the token."},{"line_number":89,"context_line":"    if event.domain_scope_id is not None:"},{"line_number":90,"context_line":"        if event.domain_scope_id !\u003d token_values[\u0027assignment_domain_id\u0027]:"},{"line_number":91,"context_line":"            return False"}],"source_content_type":"text/x-python","patch_set":14,"id":"baada198_be3b68c6","line":88,"updated":"2014-07-28 23:16:19.000000000","message":"not sure this adds anything","commit_id":"ba96cfe510541ac4528921f303ff76134aa3a2b0"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d0be2263f2ce5fd7450640cc5ad7bb8d65b4187c","unresolved":false,"context_lines":[{"line_number":85,"context_line":"        else:"},{"line_number":86,"context_line":"            return False"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"    # domain_scope_id matches assignment_domain_id in the token."},{"line_number":89,"context_line":"    if event.domain_scope_id is not None:"},{"line_number":90,"context_line":"        if event.domain_scope_id !\u003d token_values[\u0027assignment_domain_id\u0027]:"},{"line_number":91,"context_line":"            return False"}],"source_content_type":"text/x-python","patch_set":14,"id":"baada198_e389a026","line":88,"in_reply_to":"baada198_be3b68c6","updated":"2014-07-29 20:41:56.000000000","message":"Removed it. I was copying the style of other checks (for example at line 80).","commit_id":"ba96cfe510541ac4528921f303ff76134aa3a2b0"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"8ec7dd90dcbe30d0e2f7bd9ecf5f2554085068dc","unresolved":false,"context_lines":[{"line_number":180,"context_line":"            lambda: self.revoke_api.revoke_by_expiration("},{"line_number":181,"context_line":"                user_id, expires_at, domain_id\u003ddomain_id,"},{"line_number":182,"context_line":"                project_id\u003dproject_id),"},{"line_number":183,"context_line":"            matchers.raises(exception.UnexpectedError))"},{"line_number":184,"context_line":""},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"class SqlRevokeTests(test_backend_sql.SqlTests, RevokeTests):"}],"source_content_type":"text/x-python","patch_set":15,"id":"baada198_110afe26","line":183,"updated":"2014-07-31 22:02:18.000000000","message":"++","commit_id":"da00da732d6be0626810fe4ec87d40dab16117de"}],"keystone/token/providers/common.py":[{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"31f05ee773e31c79ed4429a97698b8e5d18a9558","unresolved":false,"context_lines":[{"line_number":520,"context_line":"            if version \u003d\u003d provider.V3:"},{"line_number":521,"context_line":"                user_id \u003d token[\u0027user\u0027][\u0027id\u0027]"},{"line_number":522,"context_line":"                expires_at \u003d token[\u0027expires\u0027]"},{"line_number":523,"context_line":"                project_id \u003d (token.get(\u0027tenant\u0027) or {}).get(\u0027id\u0027)"},{"line_number":524,"context_line":""},{"line_number":525,"context_line":"                token_data \u003d token[\u0027token_data\u0027][\u0027token\u0027]"},{"line_number":526,"context_line":"                domain_id \u003d token_data.get(\u0027domain\u0027, {}).get(\u0027id\u0027)"}],"source_content_type":"text/x-python","patch_set":13,"id":"baada198_e8536a37","line":523,"updated":"2014-07-28 22:37:56.000000000","message":"why is this trying to get a tenant from a v3 token? token.get(\u0027scope\u0027, {}).get(\u0027project\u0027, {}).get(\u0027id\u0027) ?","commit_id":"382a00bfd984a27fa8f8d6bf5e77d0b51f22c847"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"0e250bad5643b140eb7491c2a161a51ebdb42949","unresolved":false,"context_lines":[{"line_number":520,"context_line":"            if version \u003d\u003d provider.V3:"},{"line_number":521,"context_line":"                user_id \u003d token[\u0027user\u0027][\u0027id\u0027]"},{"line_number":522,"context_line":"                expires_at \u003d token[\u0027expires\u0027]"},{"line_number":523,"context_line":"                project_id \u003d (token.get(\u0027tenant\u0027) or {}).get(\u0027id\u0027)"},{"line_number":524,"context_line":""},{"line_number":525,"context_line":"                token_data \u003d token[\u0027token_data\u0027][\u0027token\u0027]"},{"line_number":526,"context_line":"                domain_id \u003d token_data.get(\u0027domain\u0027, {}).get(\u0027id\u0027)"}],"source_content_type":"text/x-python","patch_set":13,"id":"baada198_5bb09efc","line":523,"in_reply_to":"baada198_e8536a37","updated":"2014-07-28 22:47:48.000000000","message":"Here\u0027s what token looks like: http://paste.openstack.org/show/88787/\n\nSo I could extract the project_id using:\n\n token[\u0027token_data\u0027][\u0027token\u0027][\u0027project\u0027][\u0027id\u0027]\n\nto get the project_id:\n\n token_data \u003d token[\u0027token_data\u0027][\u0027token\u0027]\n project_id \u003d token_data.get(\u0027project\u0027, {}).get(\u0027id\u0027)","commit_id":"382a00bfd984a27fa8f8d6bf5e77d0b51f22c847"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"e6eb318630e401c4d2679877c56576111fa14cce","unresolved":false,"context_lines":[{"line_number":528,"context_line":"                user_id \u003d token[\u0027user_id\u0027]"},{"line_number":529,"context_line":"                expires_at \u003d token[\u0027expires\u0027]"},{"line_number":530,"context_line":"                project_id \u003d (token.get(\u0027tenant\u0027) or {}).get(\u0027id\u0027)"},{"line_number":531,"context_line":"                domain_id \u003d None  # A V2 token can\u0027t be scoped to a domain."},{"line_number":532,"context_line":"            self.revoke_api.revoke_by_expiration(user_id, expires_at,"},{"line_number":533,"context_line":"                                                 project_id\u003dproject_id,"},{"line_number":534,"context_line":"                                                 domain_id\u003ddomain_id)"}],"source_content_type":"text/x-python","patch_set":14,"id":"baada198_1ee9b419","line":531,"updated":"2014-07-28 23:16:19.000000000","message":"but a V2 token is implicitly scoped to the default domain; given this is being exposed on the v3 API, i\u0027m wondering if it makes sense to convey that here?","commit_id":"ba96cfe510541ac4528921f303ff76134aa3a2b0"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d0be2263f2ce5fd7450640cc5ad7bb8d65b4187c","unresolved":false,"context_lines":[{"line_number":528,"context_line":"                user_id \u003d token[\u0027user_id\u0027]"},{"line_number":529,"context_line":"                expires_at \u003d token[\u0027expires\u0027]"},{"line_number":530,"context_line":"                project_id \u003d (token.get(\u0027tenant\u0027) or {}).get(\u0027id\u0027)"},{"line_number":531,"context_line":"                domain_id \u003d None  # A V2 token can\u0027t be scoped to a domain."},{"line_number":532,"context_line":"            self.revoke_api.revoke_by_expiration(user_id, expires_at,"},{"line_number":533,"context_line":"                                                 project_id\u003dproject_id,"},{"line_number":534,"context_line":"                                                 domain_id\u003ddomain_id)"}],"source_content_type":"text/x-python","patch_set":14,"id":"baada198_236f18fe","line":531,"in_reply_to":"baada198_1ee9b419","updated":"2014-07-29 20:41:56.000000000","message":"This code is handling the case where a token is revoked and we generate revocation event data for it. We store in the revocation event the user ID, when the token expires, and the scope (either project or domain). V2 tokens aren\u0027t going to be domain-scoped.\n\nLater on, the server will get a request to validate a token. From the token it gets the user, the user\u0027s domain, and the token\u0027s scope (project ID and project domain ID or just domain ID). This is done in http://git.openstack.org/cgit/openstack/keystone/tree/keystone/contrib/revoke/model.py#n226 .\n\nLet\u0027s say there\u0027s a revocation event for the default domain, and then a V2 token comes in for validation. The token data would have the user domain ID as the default so it would be revoked.\n\nSo I don\u0027t think anything needs to be changed here. The code is here figuring out what to store for a revoked token.","commit_id":"ba96cfe510541ac4528921f303ff76134aa3a2b0"}]}