)]}'
{"etc/policy.v3cloudsample.json":[{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"2d25375028910a618f65d270eb73b216513ea9ac","unresolved":false,"context_lines":[{"line_number":66,"context_line":"    \"identity:check_user_in_group\": \"rule:cloud_admin or rule:admin_and_matching_target_group_domain_id\","},{"line_number":67,"context_line":"    \"identity:add_user_to_group\": \"rule:cloud_admin or rule:admin_and_matching_target_group_domain_id\","},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"    \"identity:get_credential\": \"rule:admin_required\","},{"line_number":70,"context_line":"    \"identity:list_credentials\": \"rule:admin_required or rule:owner\","},{"line_number":71,"context_line":"    \"identity:create_credential\": \"rule:admin_required\","},{"line_number":72,"context_line":"    \"identity:update_credential\": \"rule:admin_required\","}],"source_content_type":"application/json","patch_set":3,"id":"baada198_914b1c5e","line":69,"updated":"2014-08-11 20:00:56.000000000","message":"Although out of scope of this change, I\u0027m not sure admin_required is correct  for any of these APIs (or below in ec2 credentials).  since that means that that if I had an admin role on any project or domain, I would get full access (including delete) for all credentials system-wide.  I would think that cloud_admin would be more appropriate.  If you agree, perhaps raise a separate bug for this.","commit_id":"640d0ae40e02f239fe68f698215546a99cda8780"},{"author":{"_account_id":12215,"name":"Alexey Miroshkin","email":"alexey.miroshkin@ru.ibm.com","username":"amirosh"},"change_message_id":"4455cbbb51d5810e19edded1792371cd5577d653","unresolved":false,"context_lines":[{"line_number":66,"context_line":"    \"identity:check_user_in_group\": \"rule:cloud_admin or rule:admin_and_matching_target_group_domain_id\","},{"line_number":67,"context_line":"    \"identity:add_user_to_group\": \"rule:cloud_admin or rule:admin_and_matching_target_group_domain_id\","},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"    \"identity:get_credential\": \"rule:admin_required\","},{"line_number":70,"context_line":"    \"identity:list_credentials\": \"rule:admin_required or rule:owner\","},{"line_number":71,"context_line":"    \"identity:create_credential\": \"rule:admin_required\","},{"line_number":72,"context_line":"    \"identity:update_credential\": \"rule:admin_required\","}],"source_content_type":"application/json","patch_set":3,"id":"baada198_294ad623","line":69,"in_reply_to":"baada198_914b1c5e","updated":"2014-08-12 09:17:47.000000000","message":"Ok, will check it and raise a separate bug if needed.","commit_id":"640d0ae40e02f239fe68f698215546a99cda8780"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"2d25375028910a618f65d270eb73b216513ea9ac","unresolved":false,"context_lines":[{"line_number":67,"context_line":"    \"identity:add_user_to_group\": \"rule:cloud_admin or rule:admin_and_matching_target_group_domain_id\","},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"    \"identity:get_credential\": \"rule:admin_required\","},{"line_number":70,"context_line":"    \"identity:list_credentials\": \"rule:admin_required or rule:owner\","},{"line_number":71,"context_line":"    \"identity:create_credential\": \"rule:admin_required\","},{"line_number":72,"context_line":"    \"identity:update_credential\": \"rule:admin_required\","},{"line_number":73,"context_line":"    \"identity:delete_credential\": \"rule:admin_required\","}],"source_content_type":"application/json","patch_set":3,"id":"baada198_7624bec2","line":70,"updated":"2014-08-11 20:00:56.000000000","message":"although I realise this has been copied from the ec2_credentials below, in their rule:owner is too liberal.  We should not include the target in the rule for list_credentials.  In fact, given our code I think it is benign, but to be strict it should just be user_id:%(user_id)s - which should match the filter.","commit_id":"640d0ae40e02f239fe68f698215546a99cda8780"},{"author":{"_account_id":12215,"name":"Alexey Miroshkin","email":"alexey.miroshkin@ru.ibm.com","username":"amirosh"},"change_message_id":"4455cbbb51d5810e19edded1792371cd5577d653","unresolved":false,"context_lines":[{"line_number":67,"context_line":"    \"identity:add_user_to_group\": \"rule:cloud_admin or rule:admin_and_matching_target_group_domain_id\","},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"    \"identity:get_credential\": \"rule:admin_required\","},{"line_number":70,"context_line":"    \"identity:list_credentials\": \"rule:admin_required or rule:owner\","},{"line_number":71,"context_line":"    \"identity:create_credential\": \"rule:admin_required\","},{"line_number":72,"context_line":"    \"identity:update_credential\": \"rule:admin_required\","},{"line_number":73,"context_line":"    \"identity:delete_credential\": \"rule:admin_required\","}],"source_content_type":"application/json","patch_set":3,"id":"baada198_c96f9a91","line":70,"in_reply_to":"baada198_7624bec2","updated":"2014-08-12 09:17:47.000000000","message":"Done","commit_id":"640d0ae40e02f239fe68f698215546a99cda8780"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"3ffb81aafd5d3a959afc0c1c80dbb7d783ce8809","unresolved":false,"context_lines":[{"line_number":67,"context_line":"    \"identity:add_user_to_group\": \"rule:cloud_admin or rule:admin_and_matching_target_group_domain_id\","},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"    \"identity:get_credential\": \"rule:admin_required\","},{"line_number":70,"context_line":"    \"identity:list_credentials\": \"rule:admin_required or user_id:%(user_id)s\","},{"line_number":71,"context_line":"    \"identity:create_credential\": \"rule:admin_required\","},{"line_number":72,"context_line":"    \"identity:update_credential\": \"rule:admin_required\","},{"line_number":73,"context_line":"    \"identity:delete_credential\": \"rule:admin_required\","}],"source_content_type":"application/json","patch_set":6,"id":"1abeadc6_70b524ed","line":70,"updated":"2014-08-19 14:15:26.000000000","message":"Is there any reason you are not using rule:admin_or_owner? (I\u0027m not saying you need to...I\u0027m just looking to learn)","commit_id":"fa88255c11bab00795b7b0caa3b76ed959b5e2f3"},{"author":{"_account_id":12215,"name":"Alexey Miroshkin","email":"alexey.miroshkin@ru.ibm.com","username":"amirosh"},"change_message_id":"65457ba479a9eb780b5dd9097888dbd068a4fd57","unresolved":false,"context_lines":[{"line_number":67,"context_line":"    \"identity:add_user_to_group\": \"rule:cloud_admin or rule:admin_and_matching_target_group_domain_id\","},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"    \"identity:get_credential\": \"rule:admin_required\","},{"line_number":70,"context_line":"    \"identity:list_credentials\": \"rule:admin_required or user_id:%(user_id)s\","},{"line_number":71,"context_line":"    \"identity:create_credential\": \"rule:admin_required\","},{"line_number":72,"context_line":"    \"identity:update_credential\": \"rule:admin_required\","},{"line_number":73,"context_line":"    \"identity:delete_credential\": \"rule:admin_required\","}],"source_content_type":"application/json","patch_set":6,"id":"1abeadc6_d6c9907a","line":70,"in_reply_to":"1abeadc6_70b524ed","updated":"2014-08-19 14:26:42.000000000","message":"I did it, then I learnt from Henry that \"rule:owner is too liberal. We should not include the target in the rule for list_credentials\".","commit_id":"fa88255c11bab00795b7b0caa3b76ed959b5e2f3"}],"keystone/tests/test_v3_credential.py":[{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"2d25375028910a618f65d270eb73b216513ea9ac","unresolved":false,"context_lines":[{"line_number":92,"context_line":""},{"line_number":93,"context_line":"    def test_list_credentials_filtered_by_user_id(self):"},{"line_number":94,"context_line":"        \"\"\"Call ``GET  /credentials?user_id\u003d{user_id}``.\"\"\""},{"line_number":95,"context_line":"        # a credential for self.user already exists"},{"line_number":96,"context_line":"        credential \u003d self.new_credential_ref("},{"line_number":97,"context_line":"            user_id\u003duuid.uuid4().hex)"},{"line_number":98,"context_line":"        self.credential_api.create_credential("}],"source_content_type":"text/x-python","patch_set":3,"id":"baada198_166b821f","line":95,"updated":"2014-08-11 20:00:56.000000000","message":"nit: so while this is a true statement...on its own it\u0027s a bit confusing - I think what you mean is that a credential for self.user already exists so first create a spoiler to test that we only get back credentials that match self.user","commit_id":"640d0ae40e02f239fe68f698215546a99cda8780"},{"author":{"_account_id":12215,"name":"Alexey Miroshkin","email":"alexey.miroshkin@ru.ibm.com","username":"amirosh"},"change_message_id":"4455cbbb51d5810e19edded1792371cd5577d653","unresolved":false,"context_lines":[{"line_number":92,"context_line":""},{"line_number":93,"context_line":"    def test_list_credentials_filtered_by_user_id(self):"},{"line_number":94,"context_line":"        \"\"\"Call ``GET  /credentials?user_id\u003d{user_id}``.\"\"\""},{"line_number":95,"context_line":"        # a credential for self.user already exists"},{"line_number":96,"context_line":"        credential \u003d self.new_credential_ref("},{"line_number":97,"context_line":"            user_id\u003duuid.uuid4().hex)"},{"line_number":98,"context_line":"        self.credential_api.create_credential("}],"source_content_type":"text/x-python","patch_set":3,"id":"baada198_bb52afd7","line":95,"in_reply_to":"baada198_166b821f","updated":"2014-08-12 09:17:47.000000000","message":"Right, it was a comment for myself, should remove it.","commit_id":"640d0ae40e02f239fe68f698215546a99cda8780"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"3ffb81aafd5d3a959afc0c1c80dbb7d783ce8809","unresolved":false,"context_lines":[{"line_number":99,"context_line":""},{"line_number":100,"context_line":"        r \u003d self.get(\u0027/credentials?user_id\u003d%s\u0027 % self.user[\u0027id\u0027])"},{"line_number":101,"context_line":"        self.assertValidCredentialListResponse(r, ref\u003dself.credential)"},{"line_number":102,"context_line":"        for c in r.result[\u0027credentials\u0027]:"},{"line_number":103,"context_line":"            self.assertEqual(self.user[\u0027id\u0027], c[\u0027user_id\u0027])"},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"    def test_create_credential(self):"}],"source_content_type":"text/x-python","patch_set":6,"id":"1abeadc6_b3f986ca","line":102,"updated":"2014-08-19 14:15:26.000000000","message":"(nit) Rename c to something a little more expressive. I\u0027m assuming it\u0027s a credential.","commit_id":"fa88255c11bab00795b7b0caa3b76ed959b5e2f3"},{"author":{"_account_id":12215,"name":"Alexey Miroshkin","email":"alexey.miroshkin@ru.ibm.com","username":"amirosh"},"change_message_id":"65457ba479a9eb780b5dd9097888dbd068a4fd57","unresolved":false,"context_lines":[{"line_number":99,"context_line":""},{"line_number":100,"context_line":"        r \u003d self.get(\u0027/credentials?user_id\u003d%s\u0027 % self.user[\u0027id\u0027])"},{"line_number":101,"context_line":"        self.assertValidCredentialListResponse(r, ref\u003dself.credential)"},{"line_number":102,"context_line":"        for c in r.result[\u0027credentials\u0027]:"},{"line_number":103,"context_line":"            self.assertEqual(self.user[\u0027id\u0027], c[\u0027user_id\u0027])"},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"    def test_create_credential(self):"}],"source_content_type":"text/x-python","patch_set":6,"id":"1abeadc6_9613980c","line":102,"in_reply_to":"1abeadc6_b3f986ca","updated":"2014-08-19 14:26:42.000000000","message":"Done","commit_id":"fa88255c11bab00795b7b0caa3b76ed959b5e2f3"}],"keystone/tests/test_v3_protection.py":[{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"771d4998bbb53b0dd2321b0a4b4ea6baae614a49","unresolved":false,"context_lines":[{"line_number":445,"context_line":"                                         user_id\u003dself.just_a_user[\u0027id\u0027],"},{"line_number":446,"context_line":"                                         project_id\u003dself.project[\u0027id\u0027])"},{"line_number":447,"context_line":""},{"line_number":448,"context_line":"        # Create credentials"},{"line_number":449,"context_line":"        self.credential_user \u003d self.new_credential_ref(self.just_a_user[\u0027id\u0027])"},{"line_number":450,"context_line":"        self.credential_api.create_credential(self.credential_user[\u0027id\u0027],"},{"line_number":451,"context_line":"                                              self.credential_user)"}],"source_content_type":"text/x-python","patch_set":5,"id":"baada198_93e5c0a4","line":448,"updated":"2014-08-12 14:51:58.000000000","message":"Is there any reason this has to be added here instead of in the new test? Since no other tests need this data setup it would be preferable to me to not create this data in each of the other tests.","commit_id":"35de0fa694b8c06e1009f30b60000dc7e48ba539"},{"author":{"_account_id":12215,"name":"Alexey Miroshkin","email":"alexey.miroshkin@ru.ibm.com","username":"amirosh"},"change_message_id":"454eaaf9490ea290dbd672f10ecda95143167def","unresolved":false,"context_lines":[{"line_number":445,"context_line":"                                         user_id\u003dself.just_a_user[\u0027id\u0027],"},{"line_number":446,"context_line":"                                         project_id\u003dself.project[\u0027id\u0027])"},{"line_number":447,"context_line":""},{"line_number":448,"context_line":"        # Create credentials"},{"line_number":449,"context_line":"        self.credential_user \u003d self.new_credential_ref(self.just_a_user[\u0027id\u0027])"},{"line_number":450,"context_line":"        self.credential_api.create_credential(self.credential_user[\u0027id\u0027],"},{"line_number":451,"context_line":"                                              self.credential_user)"}],"source_content_type":"text/x-python","patch_set":5,"id":"baada198_9bc30f3a","line":448,"in_reply_to":"baada198_93e5c0a4","updated":"2014-08-12 18:54:11.000000000","message":"Done","commit_id":"35de0fa694b8c06e1009f30b60000dc7e48ba539"}]}