)]}'
{"keystone/assignment/backends/ldap.py":[{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"39206848b2bb2991b12775309c2fcdd73b6b4a03","unresolved":false,"context_lines":[{"line_number":415,"context_line":""},{"line_number":416,"context_line":"            if role_id and assignment[\u0027role_id\u0027] !\u003d role_id:"},{"line_number":417,"context_line":"                continue"},{"line_number":418,"context_line":"            if actors and assignment[\u0027user_id\u0027] not in actors:"},{"line_number":419,"context_line":"                continue"},{"line_number":420,"context_line":"            if targets and assignment[\u0027project_id\u0027] not in targets:"},{"line_number":421,"context_line":"                continue"}],"source_content_type":"text/x-python","patch_set":4,"id":"1abeadc6_71ccaf35","line":418,"updated":"2014-08-29 20:52:45.000000000","message":"so actors is a mixture of users and groups.....so is this check right?","commit_id":"44e2d1f651ca6a48e52e8e44d8bf24c84a0eacdf"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"9bcec86b53b36e069b1ee8c4518902808f99c610","unresolved":false,"context_lines":[{"line_number":415,"context_line":""},{"line_number":416,"context_line":"            if role_id and assignment[\u0027role_id\u0027] !\u003d role_id:"},{"line_number":417,"context_line":"                continue"},{"line_number":418,"context_line":"            if actors and assignment[\u0027user_id\u0027] not in actors:"},{"line_number":419,"context_line":"                continue"},{"line_number":420,"context_line":"            if targets and assignment[\u0027project_id\u0027] not in targets:"},{"line_number":421,"context_line":"                continue"}],"source_content_type":"text/x-python","patch_set":4,"id":"fa98f980_4edb641b","line":418,"in_reply_to":"1abeadc6_71ccaf35","updated":"2014-09-01 14:31:21.000000000","message":"we are only checking by \"user_id\" because the \"DN\" field is always mapped to a \"user_id\".","commit_id":"44e2d1f651ca6a48e52e8e44d8bf24c84a0eacdf"}],"keystone/assignment/backends/sql.py":[{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"6990b20a47d029c1487e6bdeff510a7c6830507f","unresolved":false,"context_lines":[{"line_number":443,"context_line":"                assignment_types.append(AssignmentType.GROUP_DOMAIN)"},{"line_number":444,"context_line":"        else:"},{"line_number":445,"context_line":"            return None"},{"line_number":446,"context_line":""},{"line_number":447,"context_line":"        return assignment_types"},{"line_number":448,"context_line":""},{"line_number":449,"context_line":"    def list_role_assignments(self, role_id\u003dNone,"}],"source_content_type":"text/x-python","patch_set":5,"id":"fa98f980_b2a96adf","line":446,"updated":"2014-09-09 20:42:52.000000000","message":"is this \"return None\" necessary?","commit_id":"074e0b349224a0bc1ffa6f8ba9c42f7f78e485f3"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"57c825e6e7a1098c30f26b4373829aaa1091426b","unresolved":false,"context_lines":[{"line_number":443,"context_line":"                assignment_types.append(AssignmentType.GROUP_DOMAIN)"},{"line_number":444,"context_line":"        else:"},{"line_number":445,"context_line":"            return None"},{"line_number":446,"context_line":""},{"line_number":447,"context_line":"        return assignment_types"},{"line_number":448,"context_line":""},{"line_number":449,"context_line":"    def list_role_assignments(self, role_id\u003dNone,"}],"source_content_type":"text/x-python","patch_set":5,"id":"fa98f980_122cf649","line":446,"in_reply_to":"fa98f980_b2a96adf","updated":"2014-09-09 20:48:50.000000000","message":"If we return empty list instead of None (by removing lines 444-445), we should change line 498 to be\n\n    if assignment_types !\u003d []:","commit_id":"074e0b349224a0bc1ffa6f8ba9c42f7f78e485f3"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"2f5cc14dfadf71057f0eeebd547043bba6e98439","unresolved":false,"context_lines":[{"line_number":274,"context_line":"            domain_ids \u003d set()"},{"line_number":275,"context_line":"            for assignment in assignments:"},{"line_number":276,"context_line":"                if ((assignment.type \u003d\u003d AssignmentType.USER_DOMAIN or"},{"line_number":277,"context_line":"                     assignment.type \u003d\u003d AssignmentType.GROUP_DOMAIN) and"},{"line_number":278,"context_line":"                        assignment.inherited):"},{"line_number":279,"context_line":"                    domain_ids.add(assignment.target_id)"},{"line_number":280,"context_line":""}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_b044b21b","line":277,"updated":"2014-10-24 14:18:41.000000000","message":"This change seems unrelated...","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"74166e8ecadbbab2852f4b0ceba87f31c90e30ea","unresolved":false,"context_lines":[{"line_number":274,"context_line":"            domain_ids \u003d set()"},{"line_number":275,"context_line":"            for assignment in assignments:"},{"line_number":276,"context_line":"                if ((assignment.type \u003d\u003d AssignmentType.USER_DOMAIN or"},{"line_number":277,"context_line":"                     assignment.type \u003d\u003d AssignmentType.GROUP_DOMAIN) and"},{"line_number":278,"context_line":"                        assignment.inherited):"},{"line_number":279,"context_line":"                    domain_ids.add(assignment.target_id)"},{"line_number":280,"context_line":""}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_51a28c4b","line":277,"in_reply_to":"9aa7fdbe_b044b21b","updated":"2014-10-27 14:11:08.000000000","message":"Done","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"1804cd624828d4af83e288dabc9a882e49d00570","unresolved":false,"context_lines":[{"line_number":406,"context_line":"                    \u0027Cannot remove role that has not been granted, %s\u0027) %"},{"line_number":407,"context_line":"                    role_id)"},{"line_number":408,"context_line":""},{"line_number":409,"context_line":"    def _build_role_assignment_filter("},{"line_number":410,"context_line":"            self, actors, target, inherited_to_projects, assignment_types):"},{"line_number":411,"context_line":""},{"line_number":412,"context_line":"        f \u003d sqlalchemy.and_("}],"source_content_type":"text/x-python","patch_set":11,"id":"baa201ad_ca1a327c","line":409,"updated":"2014-10-17 15:49:36.000000000","message":"is this called from anywhere?","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"ec6ea53f7e4fb7a144a559119b52142031c844c5","unresolved":false,"context_lines":[{"line_number":406,"context_line":"                    \u0027Cannot remove role that has not been granted, %s\u0027) %"},{"line_number":407,"context_line":"                    role_id)"},{"line_number":408,"context_line":""},{"line_number":409,"context_line":"    def _build_role_assignment_filter("},{"line_number":410,"context_line":"            self, actors, target, inherited_to_projects, assignment_types):"},{"line_number":411,"context_line":""},{"line_number":412,"context_line":"        f \u003d sqlalchemy.and_("}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_13696725","line":409,"in_reply_to":"baa201ad_ca1a327c","updated":"2014-10-21 21:32:57.000000000","message":"Well... not anymore !\nRemoving this. :-)","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"effffcc028666765e5ce82648592d5027140fba8","unresolved":false,"context_lines":[{"line_number":423,"context_line":""},{"line_number":424,"context_line":"        return f"},{"line_number":425,"context_line":""},{"line_number":426,"context_line":"    def _get_assignment_types(self, user_id, group_ids, project_id, domain_id):"},{"line_number":427,"context_line":"        assignment_types \u003d []"},{"line_number":428,"context_line":"        if user_id:"},{"line_number":429,"context_line":"            if project_id:"}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_7a0ebb3c","line":426,"updated":"2014-10-23 19:46:17.000000000","message":"In addition, I am not sure that we still need to return a list of assignment types.\nAs for now, we call the backend by passing just one actor and one target.\n\n--\n\nWe could keep this logic if you prefer.\n\nThe advantage would be to do a single backend call on _list_effective_assignments_for_groups_and_project(..) by passing project_id and project\u0027s domain_id, for example, and not one for group direct roles on project + another for group inherited roles on that project\u0027s domain.","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"41aa383627825df026580db3c2c57a36dd0652da","unresolved":false,"context_lines":[{"line_number":495,"context_line":"                query \u003d query.filter_by(target_id\u003dtarget)"},{"line_number":496,"context_line":"            if assignment_types:"},{"line_number":497,"context_line":"                query \u003d query.filter(RoleAssignment.type.in_(assignment_types))"},{"line_number":498,"context_line":"            if inherited_to_projects:"},{"line_number":499,"context_line":"                query \u003d query.filter_by(inherited\u003dinherited_to_projects)"},{"line_number":500,"context_line":""},{"line_number":501,"context_line":"            return [denormalize_role(ref) for ref in query.all()]"}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_bb67d2e9","line":498,"updated":"2014-10-19 07:58:54.000000000","message":"The way inherited_to_projects is used here means that it is impossible to  just list all the assignments that are NOT inherited....that may be OK....but is probably not an obvious result of calling the API with inherited_to_projects \u003d False.","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"effffcc028666765e5ce82648592d5027140fba8","unresolved":false,"context_lines":[{"line_number":495,"context_line":"                query \u003d query.filter_by(target_id\u003dtarget)"},{"line_number":496,"context_line":"            if assignment_types:"},{"line_number":497,"context_line":"                query \u003d query.filter(RoleAssignment.type.in_(assignment_types))"},{"line_number":498,"context_line":"            if inherited_to_projects:"},{"line_number":499,"context_line":"                query \u003d query.filter_by(inherited\u003dinherited_to_projects)"},{"line_number":500,"context_line":""},{"line_number":501,"context_line":"            return [denormalize_role(ref) for ref in query.all()]"}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_b7fafe40","line":498,"in_reply_to":"9aa7fdbe_51f2f56f","updated":"2014-10-23 19:46:17.000000000","message":"+1\nWould suggest True/False/None. None means we don\u0027t wanna consider this field when filtering results.","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"ec6ea53f7e4fb7a144a559119b52142031c844c5","unresolved":false,"context_lines":[{"line_number":495,"context_line":"                query \u003d query.filter_by(target_id\u003dtarget)"},{"line_number":496,"context_line":"            if assignment_types:"},{"line_number":497,"context_line":"                query \u003d query.filter(RoleAssignment.type.in_(assignment_types))"},{"line_number":498,"context_line":"            if inherited_to_projects:"},{"line_number":499,"context_line":"                query \u003d query.filter_by(inherited\u003dinherited_to_projects)"},{"line_number":500,"context_line":""},{"line_number":501,"context_line":"            return [denormalize_role(ref) for ref in query.all()]"}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_d3a35f4d","line":498,"in_reply_to":"9aa7fdbe_bb67d2e9","updated":"2014-10-21 21:32:57.000000000","message":"In fact it does not mean what you said.\nNote that we only add a filter for inherited column if inherited_to_projects flag is true.\nOtherwise, we do not add it and then get results independently of this column.","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"4204efc3093c59f2af7edd981f2ff8d0b2b472bd","unresolved":false,"context_lines":[{"line_number":495,"context_line":"                query \u003d query.filter_by(target_id\u003dtarget)"},{"line_number":496,"context_line":"            if assignment_types:"},{"line_number":497,"context_line":"                query \u003d query.filter(RoleAssignment.type.in_(assignment_types))"},{"line_number":498,"context_line":"            if inherited_to_projects:"},{"line_number":499,"context_line":"                query \u003d query.filter_by(inherited\u003dinherited_to_projects)"},{"line_number":500,"context_line":""},{"line_number":501,"context_line":"            return [denormalize_role(ref) for ref in query.all()]"}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_51f2f56f","line":498,"in_reply_to":"9aa7fdbe_d3a35f4d","updated":"2014-10-22 09:30:01.000000000","message":"I agree.  But I think that is a bit broken.  If I set \"inherited_to_projects\" \u003d True I get inherited projects, but if I set it to False I get all of them, including the inherited ones?  Very counter intuitive!","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"}],"keystone/assignment/controllers.py":[{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"b024c8952efb093960ba3851b5579ff2932caf39","unresolved":false,"context_lines":[{"line_number":935,"context_line":"        if inherited and effective:"},{"line_number":936,"context_line":"            msg \u003d \u0027Specify either OS-INHERIT or effective, not both\u0027"},{"line_number":937,"context_line":"            raise exception.ValidationError(msg)"},{"line_number":938,"context_line":""},{"line_number":939,"context_line":"    def list_role_assignments(self, context):"},{"line_number":940,"context_line":"        user_id \u003d self._get_query_param_value(\u0027user.id\u0027, context)"},{"line_number":941,"context_line":"        group_id \u003d self._get_query_param_value(\u0027group.id\u0027, context)"}],"source_content_type":"text/x-python","patch_set":2,"id":"1abeadc6_2165dbb4","line":938,"updated":"2014-08-28 10:09:10.000000000","message":"I think we still need to use the protected wrapper here - it does the RBAC checking","commit_id":"b424310f63cb93eb6e10384d9c02bfcd26d6df84"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"41d0abe69a0c75bd336e0d2808b3b238e493501e","unresolved":false,"context_lines":[{"line_number":935,"context_line":"        if inherited and effective:"},{"line_number":936,"context_line":"            msg \u003d \u0027Specify either OS-INHERIT or effective, not both\u0027"},{"line_number":937,"context_line":"            raise exception.ValidationError(msg)"},{"line_number":938,"context_line":""},{"line_number":939,"context_line":"    def list_role_assignments(self, context):"},{"line_number":940,"context_line":"        user_id \u003d self._get_query_param_value(\u0027user.id\u0027, context)"},{"line_number":941,"context_line":"        group_id \u003d self._get_query_param_value(\u0027group.id\u0027, context)"}],"source_content_type":"text/x-python","patch_set":2,"id":"1abeadc6_df306aeb","line":938,"in_reply_to":"1abeadc6_2165dbb4","updated":"2014-08-28 17:31:42.000000000","message":"Done","commit_id":"b424310f63cb93eb6e10384d9c02bfcd26d6df84"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"b024c8952efb093960ba3851b5579ff2932caf39","unresolved":false,"context_lines":[{"line_number":936,"context_line":"            msg \u003d \u0027Specify either OS-INHERIT or effective, not both\u0027"},{"line_number":937,"context_line":"            raise exception.ValidationError(msg)"},{"line_number":938,"context_line":""},{"line_number":939,"context_line":"    def list_role_assignments(self, context):"},{"line_number":940,"context_line":"        user_id \u003d self._get_query_param_value(\u0027user.id\u0027, context)"},{"line_number":941,"context_line":"        group_id \u003d self._get_query_param_value(\u0027group.id\u0027, context)"},{"line_number":942,"context_line":"        self._check_not_user_and_group(user_id, group_id)"}],"source_content_type":"text/x-python","patch_set":2,"id":"1abeadc6_57b375e8","line":939,"updated":"2014-08-28 10:09:10.000000000","message":"If we are planing to support ALL the possible filters via \"must act on\" params, then we should probably add a comment to say why we don\u0027t build a hints dict (i.e. all the possible filters are always satisfied)","commit_id":"b424310f63cb93eb6e10384d9c02bfcd26d6df84"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"41d0abe69a0c75bd336e0d2808b3b238e493501e","unresolved":false,"context_lines":[{"line_number":936,"context_line":"            msg \u003d \u0027Specify either OS-INHERIT or effective, not both\u0027"},{"line_number":937,"context_line":"            raise exception.ValidationError(msg)"},{"line_number":938,"context_line":""},{"line_number":939,"context_line":"    def list_role_assignments(self, context):"},{"line_number":940,"context_line":"        user_id \u003d self._get_query_param_value(\u0027user.id\u0027, context)"},{"line_number":941,"context_line":"        group_id \u003d self._get_query_param_value(\u0027group.id\u0027, context)"},{"line_number":942,"context_line":"        self._check_not_user_and_group(user_id, group_id)"}],"source_content_type":"text/x-python","patch_set":2,"id":"1abeadc6_bf372ee2","line":939,"in_reply_to":"1abeadc6_57b375e8","updated":"2014-08-28 17:31:42.000000000","message":"Done","commit_id":"b424310f63cb93eb6e10384d9c02bfcd26d6df84"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"b024c8952efb093960ba3851b5579ff2932caf39","unresolved":false,"context_lines":[{"line_number":937,"context_line":"            raise exception.ValidationError(msg)"},{"line_number":938,"context_line":""},{"line_number":939,"context_line":"    def list_role_assignments(self, context):"},{"line_number":940,"context_line":"        user_id \u003d self._get_query_param_value(\u0027user.id\u0027, context)"},{"line_number":941,"context_line":"        group_id \u003d self._get_query_param_value(\u0027group.id\u0027, context)"},{"line_number":942,"context_line":"        self._check_not_user_and_group(user_id, group_id)"},{"line_number":943,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"1abeadc6_37a99990","line":940,"updated":"2014-08-28 10:09:10.000000000","message":"...and if we have the filters param..we can pick these out of there","commit_id":"b424310f63cb93eb6e10384d9c02bfcd26d6df84"},{"author":{"_account_id":6282,"name":"Wu Wenxiang","email":"wu.wenxiang@algoblu.com","username":"wu-wenxiang"},"change_message_id":"77becb63ac0486ef5e63f0a4e6fc7faa2ead174d","unresolved":false,"context_lines":[{"line_number":937,"context_line":"            raise exception.ValidationError(msg)"},{"line_number":938,"context_line":""},{"line_number":939,"context_line":"    def list_role_assignments(self, context):"},{"line_number":940,"context_line":"        user_id \u003d self._get_query_param_value(\u0027user.id\u0027, context)"},{"line_number":941,"context_line":"        group_id \u003d self._get_query_param_value(\u0027group.id\u0027, context)"},{"line_number":942,"context_line":"        self._check_not_user_and_group(user_id, group_id)"},{"line_number":943,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"1abeadc6_b374cfcf","line":940,"in_reply_to":"1abeadc6_37a99990","updated":"2014-08-28 15:42:40.000000000","message":"Agree","commit_id":"b424310f63cb93eb6e10384d9c02bfcd26d6df84"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"41d0abe69a0c75bd336e0d2808b3b238e493501e","unresolved":false,"context_lines":[{"line_number":937,"context_line":"            raise exception.ValidationError(msg)"},{"line_number":938,"context_line":""},{"line_number":939,"context_line":"    def list_role_assignments(self, context):"},{"line_number":940,"context_line":"        user_id \u003d self._get_query_param_value(\u0027user.id\u0027, context)"},{"line_number":941,"context_line":"        group_id \u003d self._get_query_param_value(\u0027group.id\u0027, context)"},{"line_number":942,"context_line":"        self._check_not_user_and_group(user_id, group_id)"},{"line_number":943,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"1abeadc6_9f3a72cb","line":940,"in_reply_to":"1abeadc6_37a99990","updated":"2014-08-28 17:31:42.000000000","message":"Done","commit_id":"b424310f63cb93eb6e10384d9c02bfcd26d6df84"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"bdbc2a211f41bf31ceeaaa655cff957aa3be42dc","unresolved":false,"context_lines":[{"line_number":912,"context_line":"                     self._query_filter_is_true("},{"line_number":913,"context_line":"                         context[\u0027query_string\u0027][\u0027effective\u0027]))"},{"line_number":914,"context_line":""},{"line_number":915,"context_line":"        refs \u003d self.assignment_api.list_role_assignments("},{"line_number":916,"context_line":"            role_id\u003dquery_params[\u0027role.id\u0027],"},{"line_number":917,"context_line":"            user_id\u003dquery_params[\u0027user.id\u0027],"},{"line_number":918,"context_line":"            group_id\u003dquery_params[\u0027group.id\u0027],"}],"source_content_type":"text/x-python","patch_set":3,"id":"1abeadc6_1cad8be9","line":915,"updated":"2014-08-28 19:13:02.000000000","message":"so this does now seem a bit odd, both the controller layer and the manager layer now has to, for instance, get the groups a user is in.  Seems like we should do this in one place or the other....was there a particular reason to so this in both places?","commit_id":"4adac2262abb2b7c562bbd8e615ca1385f466413"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"ab3c0690d8330abf47e810965d1a98272737ed4a","unresolved":false,"context_lines":[{"line_number":912,"context_line":"                     self._query_filter_is_true("},{"line_number":913,"context_line":"                         context[\u0027query_string\u0027][\u0027effective\u0027]))"},{"line_number":914,"context_line":""},{"line_number":915,"context_line":"        refs \u003d self.assignment_api.list_role_assignments("},{"line_number":916,"context_line":"            role_id\u003dquery_params[\u0027role.id\u0027],"},{"line_number":917,"context_line":"            user_id\u003dquery_params[\u0027user.id\u0027],"},{"line_number":918,"context_line":"            group_id\u003dquery_params[\u0027group.id\u0027],"}],"source_content_type":"text/x-python","patch_set":3,"id":"1abeadc6_bce497e0","line":915,"in_reply_to":"1abeadc6_1cad8be9","updated":"2014-08-28 19:20:13.000000000","message":"yeah, I agree with you. The main idea when placing that logic in the Manager is to use the improved list_role_assignments() call in other methods, like get_roles_for_user_and_project() and get_roles_for_user_and_domain().","commit_id":"4adac2262abb2b7c562bbd8e615ca1385f466413"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"1fb5caa761d04280d4bd768be00addf06c4858d3","unresolved":false,"context_lines":[{"line_number":912,"context_line":"                     self._query_filter_is_true("},{"line_number":913,"context_line":"                         context[\u0027query_string\u0027][\u0027effective\u0027]))"},{"line_number":914,"context_line":""},{"line_number":915,"context_line":"        refs \u003d self.assignment_api.list_role_assignments("},{"line_number":916,"context_line":"            role_id\u003dquery_params[\u0027role.id\u0027],"},{"line_number":917,"context_line":"            user_id\u003dquery_params[\u0027user.id\u0027],"},{"line_number":918,"context_line":"            group_id\u003dquery_params[\u0027group.id\u0027],"}],"source_content_type":"text/x-python","patch_set":3,"id":"1abeadc6_9bb24a04","line":915,"in_reply_to":"1abeadc6_bce497e0","updated":"2014-08-29 19:25:23.000000000","message":"Decided to keep the logic here. The migration complexity wouldn\u0027t bing much benefits.","commit_id":"4adac2262abb2b7c562bbd8e615ca1385f466413"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"39206848b2bb2991b12775309c2fcdd73b6b4a03","unresolved":false,"context_lines":[{"line_number":940,"context_line":""},{"line_number":941,"context_line":"        actors \u003d self._get_actors(query_params[\u0027user.id\u0027],"},{"line_number":942,"context_line":"                                  query_params[\u0027group.id\u0027],"},{"line_number":943,"context_line":"                                  effective)"},{"line_number":944,"context_line":"        targets \u003d self._get_targets(query_params[\u0027scope.project.id\u0027],"},{"line_number":945,"context_line":"                                    query_params[\u0027scope.domain.id\u0027],"},{"line_number":946,"context_line":"                                    effective)"}],"source_content_type":"text/x-python","patch_set":4,"id":"1abeadc6_91b4eb82","line":943,"updated":"2014-08-29 20:52:45.000000000","message":"So one of the design criteria was that some configurations might use the same ID for a user and group (e.g. in LDAP)...which one of the reason why the assignment table has a type field.  This patch kind of breaks this, since you don\u0027t pass down the type of the actor.  Now, I\u0027ve never been quite sure how likely this common ID usage is in practice....but we\u0027d have to decide to drop that ability unless we pass more data across.","commit_id":"44e2d1f651ca6a48e52e8e44d8bf24c84a0eacdf"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"9bcec86b53b36e069b1ee8c4518902808f99c610","unresolved":false,"context_lines":[{"line_number":940,"context_line":""},{"line_number":941,"context_line":"        actors \u003d self._get_actors(query_params[\u0027user.id\u0027],"},{"line_number":942,"context_line":"                                  query_params[\u0027group.id\u0027],"},{"line_number":943,"context_line":"                                  effective)"},{"line_number":944,"context_line":"        targets \u003d self._get_targets(query_params[\u0027scope.project.id\u0027],"},{"line_number":945,"context_line":"                                    query_params[\u0027scope.domain.id\u0027],"},{"line_number":946,"context_line":"                                    effective)"}],"source_content_type":"text/x-python","patch_set":4,"id":"fa98f980_4efc443f","line":943,"in_reply_to":"1abeadc6_91b4eb82","updated":"2014-09-01 14:31:21.000000000","message":"Ahh... I get your point, so in LDAP backend we would filter by user_id and by the assignment type, right?\n\nMaybe spliting actors into users and groups would fix this? (the backend would have the ability to filter by the assignment type)","commit_id":"44e2d1f651ca6a48e52e8e44d8bf24c84a0eacdf"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"be216f828633d6ac426a5e737a639bd9d4271c9a","unresolved":false,"context_lines":[{"line_number":664,"context_line":""},{"line_number":665,"context_line":"        return formatted_entity"},{"line_number":666,"context_line":""},{"line_number":667,"context_line":"    def _get_group_members(self, ref):"},{"line_number":668,"context_line":"        \"\"\"Get a list of group members."},{"line_number":669,"context_line":""},{"line_number":670,"context_line":"        Get the list of group members.  If this fails with"}],"source_content_type":"text/x-python","patch_set":8,"id":"baa201ad_a80c3dee","line":667,"updated":"2014-10-07 03:40:27.000000000","message":"can `ref` and `members` be added to the already nicely written doc string? \u003d)","commit_id":"bc422376e1a39dcdc6e5b0a07309964be64c46d9"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"bc98703c3a6c0bcec037eebe6d95f8e1d52e5c58","unresolved":false,"context_lines":[{"line_number":664,"context_line":""},{"line_number":665,"context_line":"        return formatted_entity"},{"line_number":666,"context_line":""},{"line_number":667,"context_line":"    def _get_group_members(self, ref):"},{"line_number":668,"context_line":"        \"\"\"Get a list of group members."},{"line_number":669,"context_line":""},{"line_number":670,"context_line":"        Get the list of group members.  If this fails with"}],"source_content_type":"text/x-python","patch_set":8,"id":"baa201ad_5e0ffd36","line":667,"in_reply_to":"baa201ad_a80c3dee","updated":"2014-10-07 13:56:40.000000000","message":"hehe absolutely \u003d)","commit_id":"bc422376e1a39dcdc6e5b0a07309964be64c46d9"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"2f5cc14dfadf71057f0eeebd547043bba6e98439","unresolved":false,"context_lines":[{"line_number":698,"context_line":"            if \u0027role\u0027 in ref and \u0027id\u0027 in ref[\u0027role\u0027]:"},{"line_number":699,"context_line":"                role_id \u003d ref[\u0027role\u0027][\u0027id\u0027]"},{"line_number":700,"context_line":"            LOG.warning("},{"line_number":701,"context_line":"                _(\u0027Group %(group)s not found for role-assignment - \u0027"},{"line_number":702,"context_line":"                  \u0027%(target)s with Role: %(role)s\u0027), {"},{"line_number":703,"context_line":"                    \u0027group\u0027: ref[\u0027group\u0027][\u0027id\u0027], \u0027target\u0027: target,"},{"line_number":704,"context_line":"                    \u0027role\u0027: role_id})"}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_5060e6a4","line":701,"updated":"2014-10-24 14:18:41.000000000","message":"Should be using _LW here instead of _","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"74166e8ecadbbab2852f4b0ceba87f31c90e30ea","unresolved":false,"context_lines":[{"line_number":698,"context_line":"            if \u0027role\u0027 in ref and \u0027id\u0027 in ref[\u0027role\u0027]:"},{"line_number":699,"context_line":"                role_id \u003d ref[\u0027role\u0027][\u0027id\u0027]"},{"line_number":700,"context_line":"            LOG.warning("},{"line_number":701,"context_line":"                _(\u0027Group %(group)s not found for role-assignment - \u0027"},{"line_number":702,"context_line":"                  \u0027%(target)s with Role: %(role)s\u0027), {"},{"line_number":703,"context_line":"                    \u0027group\u0027: ref[\u0027group\u0027][\u0027id\u0027], \u0027target\u0027: target,"},{"line_number":704,"context_line":"                    \u0027role\u0027: role_id})"}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_ecd3a75d","line":701,"in_reply_to":"9aa7fdbe_5060e6a4","updated":"2014-10-27 14:11:08.000000000","message":"Done","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"4204efc3093c59f2af7edd981f2ff8d0b2b472bd","unresolved":false,"context_lines":[{"line_number":768,"context_line":"    def _expand_inherited_assignment(self, context, ref, user_id, project_id):"},{"line_number":769,"context_line":"        \"\"\"Expand inherited role assignments."},{"line_number":770,"context_line":""},{"line_number":771,"context_line":"        It is an inherited domain role assignment to an actor,"},{"line_number":772,"context_line":"        then replace it with:"},{"line_number":773,"context_line":"        - an equivalent user role assignment for each of the domain"},{"line_number":774,"context_line":"          projects, if the actor is a user;"}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_f103e9b5","line":771,"updated":"2014-10-22 09:30:01.000000000","message":"If it is....","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"effffcc028666765e5ce82648592d5027140fba8","unresolved":false,"context_lines":[{"line_number":768,"context_line":"    def _expand_inherited_assignment(self, context, ref, user_id, project_id):"},{"line_number":769,"context_line":"        \"\"\"Expand inherited role assignments."},{"line_number":770,"context_line":""},{"line_number":771,"context_line":"        It is an inherited domain role assignment to an actor,"},{"line_number":772,"context_line":"        then replace it with:"},{"line_number":773,"context_line":"        - an equivalent user role assignment for each of the domain"},{"line_number":774,"context_line":"          projects, if the actor is a user;"}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_17810ac4","line":771,"in_reply_to":"9aa7fdbe_f103e9b5","updated":"2014-10-23 19:46:17.000000000","message":"Done","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"2f5cc14dfadf71057f0eeebd547043bba6e98439","unresolved":false,"context_lines":[{"line_number":830,"context_line":"            members \u003d self._get_group_members(ref)"},{"line_number":831,"context_line":""},{"line_number":832,"context_line":"            if user_id:"},{"line_number":833,"context_line":"                members \u003d [x for x in members"},{"line_number":834,"context_line":"                           if x[\u0027id\u0027] \u003d\u003d user_id]"},{"line_number":835,"context_line":""},{"line_number":836,"context_line":"            base_entry \u003d copy.deepcopy(ref)"}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_70da4a4d","line":833,"updated":"2014-10-24 14:18:41.000000000","message":"Is there a reason that you are not doing the same thing here as you are doing on line 796?","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"74166e8ecadbbab2852f4b0ceba87f31c90e30ea","unresolved":false,"context_lines":[{"line_number":830,"context_line":"            members \u003d self._get_group_members(ref)"},{"line_number":831,"context_line":""},{"line_number":832,"context_line":"            if user_id:"},{"line_number":833,"context_line":"                members \u003d [x for x in members"},{"line_number":834,"context_line":"                           if x[\u0027id\u0027] \u003d\u003d user_id]"},{"line_number":835,"context_line":""},{"line_number":836,"context_line":"            base_entry \u003d copy.deepcopy(ref)"}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_91007435","line":833,"in_reply_to":"9aa7fdbe_70da4a4d","updated":"2014-10-27 14:11:08.000000000","message":"No \u003dx\n\nChanging this","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"94ea61d8a2229de2528fdf5ff86a9416be9a9372","unresolved":false,"context_lines":[{"line_number":853,"context_line":"        entity for each member of that group, and then remove the group"},{"line_number":854,"context_line":"        assignment entity itself from the list."},{"line_number":855,"context_line":""},{"line_number":856,"context_line":"        If the OS-INHERIT extension is enabled, then honor any inherited"},{"line_number":857,"context_line":"        roles on the domain by creating the equivalent on all projects"},{"line_number":858,"context_line":"        owned by the domain."},{"line_number":859,"context_line":""}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_63e86a7d","line":856,"updated":"2014-10-18 09:51:21.000000000","message":"Well...I don\u0027t think we actually treat it that way...don\u0027t we honour any inherited assignments we find, even if the OS-INHERIT extension has now been disabled?  If so, I think that was wrong before too!  I\u0027d argue that if the extension is disabled, then we should ignore any inherited assignments we find (we leave them in the DB, but just ignore them)\n\nIf I have the above correct, then maybe we should raises a separate bug to about this and fix it independently of this code refactor - but for now maybe change the comment (and reference the bug) to make it obvious what this code does.","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"4204efc3093c59f2af7edd981f2ff8d0b2b472bd","unresolved":false,"context_lines":[{"line_number":853,"context_line":"        entity for each member of that group, and then remove the group"},{"line_number":854,"context_line":"        assignment entity itself from the list."},{"line_number":855,"context_line":""},{"line_number":856,"context_line":"        If the OS-INHERIT extension is enabled, then honor any inherited"},{"line_number":857,"context_line":"        roles on the domain by creating the equivalent on all projects"},{"line_number":858,"context_line":"        owned by the domain."},{"line_number":859,"context_line":""}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_f6aaff17","line":856,"in_reply_to":"9aa7fdbe_351bab1c","updated":"2014-10-22 09:30:01.000000000","message":"Ok, yes I see, so actually we have already filtered them out before we call this method....so you\u0027re right there\u0027s no bug - although perhaps the doc string should make it clear that this filtering has already happened - since the way the doc string is written I was looking for where in this method do we check if OS-INHERIT is enabled.....","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"ec6ea53f7e4fb7a144a559119b52142031c844c5","unresolved":false,"context_lines":[{"line_number":853,"context_line":"        entity for each member of that group, and then remove the group"},{"line_number":854,"context_line":"        assignment entity itself from the list."},{"line_number":855,"context_line":""},{"line_number":856,"context_line":"        If the OS-INHERIT extension is enabled, then honor any inherited"},{"line_number":857,"context_line":"        roles on the domain by creating the equivalent on all projects"},{"line_number":858,"context_line":"        owned by the domain."},{"line_number":859,"context_line":""}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_351bab1c","line":856,"in_reply_to":"9aa7fdbe_63e86a7d","updated":"2014-10-21 21:32:57.000000000","message":"No, we don\u0027t honour any inherited assignments we find if the OS-INHERIT extension is disabled.\nTake a look at _filter_inherited(..) use at [1], we skip them.\n\nSo we\u0027re ok on this point, no bug to raise. :- )\n\n[1] https://github.com/openstack/keystone/blob/master/keystone/assignment/controllers.py#L886-L887","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"effffcc028666765e5ce82648592d5027140fba8","unresolved":false,"context_lines":[{"line_number":853,"context_line":"        entity for each member of that group, and then remove the group"},{"line_number":854,"context_line":"        assignment entity itself from the list."},{"line_number":855,"context_line":""},{"line_number":856,"context_line":"        If the OS-INHERIT extension is enabled, then honor any inherited"},{"line_number":857,"context_line":"        roles on the domain by creating the equivalent on all projects"},{"line_number":858,"context_line":"        owned by the domain."},{"line_number":859,"context_line":""}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_976c1a37","line":856,"in_reply_to":"9aa7fdbe_f6aaff17","updated":"2014-10-23 19:46:17.000000000","message":"I will improve the doc on this point.","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"1804cd624828d4af83e288dabc9a882e49d00570","unresolved":false,"context_lines":[{"line_number":872,"context_line":"                    context, r, user_id, project_id)"},{"line_number":873,"context_line":"            else:"},{"line_number":874,"context_line":"                if project_id and \u0027domain\u0027 in r[\u0027scope\u0027]:"},{"line_number":875,"context_line":"                    # We want to filter expanded assignments, then disconsider"},{"line_number":876,"context_line":"                    # non inherited user or groups assignments on domain"},{"line_number":877,"context_line":"                    continue"},{"line_number":878,"context_line":""}],"source_content_type":"text/x-python","patch_set":11,"id":"baa201ad_00a41906","line":875,"updated":"2014-10-17 15:49:36.000000000","message":"It took me a whole to think through why you are doing this...it might be worthy of a slightly more verbose comment","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"effffcc028666765e5ce82648592d5027140fba8","unresolved":false,"context_lines":[{"line_number":872,"context_line":"                    context, r, user_id, project_id)"},{"line_number":873,"context_line":"            else:"},{"line_number":874,"context_line":"                if project_id and \u0027domain\u0027 in r[\u0027scope\u0027]:"},{"line_number":875,"context_line":"                    # We want to filter expanded assignments, then disconsider"},{"line_number":876,"context_line":"                    # non inherited user or groups assignments on domain"},{"line_number":877,"context_line":"                    continue"},{"line_number":878,"context_line":""}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_e57690a3","line":875,"in_reply_to":"9aa7fdbe_04967f4c","updated":"2014-10-23 19:46:17.000000000","message":"I will submit a bug to work on a better suite of tests ..","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"ec6ea53f7e4fb7a144a559119b52142031c844c5","unresolved":false,"context_lines":[{"line_number":872,"context_line":"                    context, r, user_id, project_id)"},{"line_number":873,"context_line":"            else:"},{"line_number":874,"context_line":"                if project_id and \u0027domain\u0027 in r[\u0027scope\u0027]:"},{"line_number":875,"context_line":"                    # We want to filter expanded assignments, then disconsider"},{"line_number":876,"context_line":"                    # non inherited user or groups assignments on domain"},{"line_number":877,"context_line":"                    continue"},{"line_number":878,"context_line":""}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_04967f4c","line":875,"in_reply_to":"baa201ad_00a41906","updated":"2014-10-21 21:32:57.000000000","message":"This comment connects with the method doc, that says if project_id is specified, the expanded assignments will be filtered by its value. I\u0027ll be more verbose by remembering what was said there.\n\n---\n\nBut WAIT ...\nI think we are not treating the case in which we have a non-inherited assignment on a domain and we want to filter returned role assignments by a specific domain_id.\nI\u0027ll go through the tests and check case-by-case...\n\nI do think we have to be exhaustive when testing the possible filter combinations ...","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"94ea61d8a2229de2528fdf5ff86a9416be9a9372","unresolved":false,"context_lines":[{"line_number":893,"context_line":"            project_id)[\u0027domain_id\u0027]"},{"line_number":894,"context_line":"        refs +\u003d self.assignment_api.list_role_assignments("},{"line_number":895,"context_line":"            role_id\u003drole_id, group_ids\u003dgroup_ids,"},{"line_number":896,"context_line":"            domain_id\u003ddomain_id)"},{"line_number":897,"context_line":""},{"line_number":898,"context_line":"        return refs"},{"line_number":899,"context_line":""}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_c3fe7638","line":896,"updated":"2014-10-18 09:51:21.000000000","message":"...don\u0027t we need to set inherited_to_projects \u003d True?\n\nIf so, quite a few of the methods below need changing too. \n\nAlso, if these are bugs, then it is showing us that our testing is insufficient since these didn\u0027t get caught.","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"effffcc028666765e5ce82648592d5027140fba8","unresolved":false,"context_lines":[{"line_number":893,"context_line":"            project_id)[\u0027domain_id\u0027]"},{"line_number":894,"context_line":"        refs +\u003d self.assignment_api.list_role_assignments("},{"line_number":895,"context_line":"            role_id\u003drole_id, group_ids\u003dgroup_ids,"},{"line_number":896,"context_line":"            domain_id\u003ddomain_id)"},{"line_number":897,"context_line":""},{"line_number":898,"context_line":"        return refs"},{"line_number":899,"context_line":""}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_da46c74e","line":896,"in_reply_to":"9aa7fdbe_9110dda9","updated":"2014-10-23 19:46:17.000000000","message":"Agreed! We already have got direct role assignment above at line 887.","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"ec6ea53f7e4fb7a144a559119b52142031c844c5","unresolved":false,"context_lines":[{"line_number":893,"context_line":"            project_id)[\u0027domain_id\u0027]"},{"line_number":894,"context_line":"        refs +\u003d self.assignment_api.list_role_assignments("},{"line_number":895,"context_line":"            role_id\u003drole_id, group_ids\u003dgroup_ids,"},{"line_number":896,"context_line":"            domain_id\u003ddomain_id)"},{"line_number":897,"context_line":""},{"line_number":898,"context_line":"        return refs"},{"line_number":899,"context_line":""}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_e4133b0b","line":896,"in_reply_to":"9aa7fdbe_c3fe7638","updated":"2014-10-21 21:32:57.000000000","message":"No, we don\u0027t.\nThese methods are used inside the _list_effective_assignments(..) method, that in turn has its returned assignments expanded at line 1075-1076.\n\nRemember that when we set effective option we want to get both inherited (later expanded) and direct role assignments.","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"4204efc3093c59f2af7edd981f2ff8d0b2b472bd","unresolved":false,"context_lines":[{"line_number":893,"context_line":"            project_id)[\u0027domain_id\u0027]"},{"line_number":894,"context_line":"        refs +\u003d self.assignment_api.list_role_assignments("},{"line_number":895,"context_line":"            role_id\u003drole_id, group_ids\u003dgroup_ids,"},{"line_number":896,"context_line":"            domain_id\u003ddomain_id)"},{"line_number":897,"context_line":""},{"line_number":898,"context_line":"        return refs"},{"line_number":899,"context_line":""}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_9110dda9","line":896,"in_reply_to":"9aa7fdbe_e4133b0b","updated":"2014-10-22 09:30:01.000000000","message":"So in that case, I guess the question is WHY we are not setting inherited_to_projects \u003d True here?  In this method we know that we are only looking for roles that apply to a project - which means that the only way a domain role can get into the answer is if it is an inherited role.\n\nSame for all the other methods.","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"4204efc3093c59f2af7edd981f2ff8d0b2b472bd","unresolved":false,"context_lines":[{"line_number":907,"context_line":"        domain_id \u003d self.assignment_api.get_project("},{"line_number":908,"context_line":"            project_id)[\u0027domain_id\u0027]"},{"line_number":909,"context_line":"        refs +\u003d self.assignment_api.list_role_assignments("},{"line_number":910,"context_line":"            role_id\u003drole_id, user_id\u003duser_id, domain_id\u003ddomain_id)"},{"line_number":911,"context_line":""},{"line_number":912,"context_line":"        # And also role assignments from the user\u0027s groups on project"},{"line_number":913,"context_line":"        # and project\u0027s domain"}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_ac958841","line":910,"updated":"2014-10-22 09:30:01.000000000","message":"should set inherited_to_projects \u003d True here....","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"effffcc028666765e5ce82648592d5027140fba8","unresolved":false,"context_lines":[{"line_number":907,"context_line":"        domain_id \u003d self.assignment_api.get_project("},{"line_number":908,"context_line":"            project_id)[\u0027domain_id\u0027]"},{"line_number":909,"context_line":"        refs +\u003d self.assignment_api.list_role_assignments("},{"line_number":910,"context_line":"            role_id\u003drole_id, user_id\u003duser_id, domain_id\u003ddomain_id)"},{"line_number":911,"context_line":""},{"line_number":912,"context_line":"        # And also role assignments from the user\u0027s groups on project"},{"line_number":913,"context_line":"        # and project\u0027s domain"}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_1a7ccf82","line":910,"in_reply_to":"9aa7fdbe_ac958841","updated":"2014-10-23 19:46:17.000000000","message":"Agreed!","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"41aa383627825df026580db3c2c57a36dd0652da","unresolved":false,"context_lines":[{"line_number":923,"context_line":"            self, role_id, user_id, domain_id):"},{"line_number":924,"context_line":"        # List direct user role assignments on domain"},{"line_number":925,"context_line":"        refs \u003d self.assignment_api.list_role_assignments("},{"line_number":926,"context_line":"            role_id\u003drole_id, user_id\u003duser_id, domain_id\u003ddomain_id)"},{"line_number":927,"context_line":""},{"line_number":928,"context_line":"        # As well as those from the user\u0027s groups on domain"},{"line_number":929,"context_line":"        group_ids \u003d [group[\u0027id\u0027] for group in"}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_fb615ad4","line":926,"updated":"2014-10-19 07:58:54.000000000","message":"...the way list_role_assignmenst() is currently defined, this call will get both inherited and non-inherited assignments....not sure that\u0027s what we want?","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"4204efc3093c59f2af7edd981f2ff8d0b2b472bd","unresolved":false,"context_lines":[{"line_number":923,"context_line":"            self, role_id, user_id, domain_id):"},{"line_number":924,"context_line":"        # List direct user role assignments on domain"},{"line_number":925,"context_line":"        refs \u003d self.assignment_api.list_role_assignments("},{"line_number":926,"context_line":"            role_id\u003drole_id, user_id\u003duser_id, domain_id\u003ddomain_id)"},{"line_number":927,"context_line":""},{"line_number":928,"context_line":"        # As well as those from the user\u0027s groups on domain"},{"line_number":929,"context_line":"        group_ids \u003d [group[\u0027id\u0027] for group in"}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_ec1a3016","line":926,"in_reply_to":"9aa7fdbe_a430539f","updated":"2014-10-22 09:30:01.000000000","message":"true...although see my comments about fixing the driver call!","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"effffcc028666765e5ce82648592d5027140fba8","unresolved":false,"context_lines":[{"line_number":923,"context_line":"            self, role_id, user_id, domain_id):"},{"line_number":924,"context_line":"        # List direct user role assignments on domain"},{"line_number":925,"context_line":"        refs \u003d self.assignment_api.list_role_assignments("},{"line_number":926,"context_line":"            role_id\u003drole_id, user_id\u003duser_id, domain_id\u003ddomain_id)"},{"line_number":927,"context_line":""},{"line_number":928,"context_line":"        # As well as those from the user\u0027s groups on domain"},{"line_number":929,"context_line":"        group_ids \u003d [group[\u0027id\u0027] for group in"}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_37436e6d","line":926,"in_reply_to":"9aa7fdbe_ec1a3016","updated":"2014-10-23 19:46:17.000000000","message":"Done","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"ec6ea53f7e4fb7a144a559119b52142031c844c5","unresolved":false,"context_lines":[{"line_number":923,"context_line":"            self, role_id, user_id, domain_id):"},{"line_number":924,"context_line":"        # List direct user role assignments on domain"},{"line_number":925,"context_line":"        refs \u003d self.assignment_api.list_role_assignments("},{"line_number":926,"context_line":"            role_id\u003drole_id, user_id\u003duser_id, domain_id\u003ddomain_id)"},{"line_number":927,"context_line":""},{"line_number":928,"context_line":"        # As well as those from the user\u0027s groups on domain"},{"line_number":929,"context_line":"        group_ids \u003d [group[\u0027id\u0027] for group in"}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_a430539f","line":926,"in_reply_to":"9aa7fdbe_fb615ad4","updated":"2014-10-21 21:32:57.000000000","message":"Replied by the above discussion (line 896).","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"4204efc3093c59f2af7edd981f2ff8d0b2b472bd","unresolved":false,"context_lines":[{"line_number":958,"context_line":"        domain_id \u003d self.assignment_api.get_project("},{"line_number":959,"context_line":"            project_id)[\u0027domain_id\u0027]"},{"line_number":960,"context_line":"        refs +\u003d self.assignment_api.list_role_assignments("},{"line_number":961,"context_line":"            role_id\u003drole_id, domain_id\u003ddomain_id)"},{"line_number":962,"context_line":""},{"line_number":963,"context_line":"        return refs"},{"line_number":964,"context_line":""}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_ecf23099","line":961,"updated":"2014-10-22 09:30:01.000000000","message":"should set inherited_to_projects \u003d True here....","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"effffcc028666765e5ce82648592d5027140fba8","unresolved":false,"context_lines":[{"line_number":958,"context_line":"        domain_id \u003d self.assignment_api.get_project("},{"line_number":959,"context_line":"            project_id)[\u0027domain_id\u0027]"},{"line_number":960,"context_line":"        refs +\u003d self.assignment_api.list_role_assignments("},{"line_number":961,"context_line":"            role_id\u003drole_id, domain_id\u003ddomain_id)"},{"line_number":962,"context_line":""},{"line_number":963,"context_line":"        return refs"},{"line_number":964,"context_line":""}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_fa8aab19","line":961,"in_reply_to":"9aa7fdbe_ecf23099","updated":"2014-10-23 19:46:17.000000000","message":"Also agreed! :)","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"4204efc3093c59f2af7edd981f2ff8d0b2b472bd","unresolved":false,"context_lines":[{"line_number":963,"context_line":"        return refs"},{"line_number":964,"context_line":""},{"line_number":965,"context_line":"    def _list_effective_assignments("},{"line_number":966,"context_line":"            self, role_id, user_id, group_id, project_id, domain_id):"},{"line_number":967,"context_line":"        \"\"\"List assignments in effective mode"},{"line_number":968,"context_line":""},{"line_number":969,"context_line":"        When using effective mode, besides the direct assignments, the indirect"}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_6c59e0fd","line":966,"updated":"2014-10-22 09:30:01.000000000","message":"I have to think about it some more, but I\u0027m not sure if filtering by group_id makes sense in effective mode - basically groups should be expanded before any filtering (hence filtering by user makes sense, but not group).  I don\u0027t think the old code would work if you tried that.  Have a think about it, but we might be able to simplify this a bit.","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"2037edc995d1c6e35ab3c247bbddb7b30e04e552","unresolved":false,"context_lines":[{"line_number":963,"context_line":"        return refs"},{"line_number":964,"context_line":""},{"line_number":965,"context_line":"    def _list_effective_assignments("},{"line_number":966,"context_line":"            self, role_id, user_id, group_id, project_id, domain_id):"},{"line_number":967,"context_line":"        \"\"\"List assignments in effective mode"},{"line_number":968,"context_line":""},{"line_number":969,"context_line":"        When using effective mode, besides the direct assignments, the indirect"}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_e4d924f4","line":966,"in_reply_to":"9aa7fdbe_6b6fcf2b","updated":"2014-10-24 12:07:30.000000000","message":"1) Ok ..\n2) We could include both since we have information from where it comes from inside the \u0027links\u0027 entry on the dict.\nTake a look at _build_project_equivalent_of_group_domain_role(..), we have group information on [\u0027links\u0027][\u0027assignment\u0027] and on [\u0027links\u0027][\u0027membership\u0027].\nSo we\u0027d be able to distinguish when it comes directly and when it comes via a group role.\n\nHowever, I think it is not related to this patch, then I will make the change to avoid the use of \u0027effective\u0027 and specifying a \u0027group_id\u0027 together, ok? I\u0027ll add a verification on the list_role_assignments method, as we do for constraints on combining filters.","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"effffcc028666765e5ce82648592d5027140fba8","unresolved":false,"context_lines":[{"line_number":963,"context_line":"        return refs"},{"line_number":964,"context_line":""},{"line_number":965,"context_line":"    def _list_effective_assignments("},{"line_number":966,"context_line":"            self, role_id, user_id, group_id, project_id, domain_id):"},{"line_number":967,"context_line":"        \"\"\"List assignments in effective mode"},{"line_number":968,"context_line":""},{"line_number":969,"context_line":"        When using effective mode, besides the direct assignments, the indirect"}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_7ad31b04","line":966,"in_reply_to":"9aa7fdbe_6c59e0fd","updated":"2014-10-23 19:46:17.000000000","message":"Suppose the following use case:\n\nAs a project admin, I\u0027d like to know what role assignments are being applied to my project (filter by project) for a given group  of users (suppose master_devs :-) inside my domain (filter by group).\n\nDoes it make sense?","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"392073bed27f519a2e0a73937748ca01800b8116","unresolved":false,"context_lines":[{"line_number":963,"context_line":"        return refs"},{"line_number":964,"context_line":""},{"line_number":965,"context_line":"    def _list_effective_assignments("},{"line_number":966,"context_line":"            self, role_id, user_id, group_id, project_id, domain_id):"},{"line_number":967,"context_line":"        \"\"\"List assignments in effective mode"},{"line_number":968,"context_line":""},{"line_number":969,"context_line":"        When using effective mode, besides the direct assignments, the indirect"}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_6b6fcf2b","line":966,"in_reply_to":"9aa7fdbe_7ad31b04","updated":"2014-10-23 22:19:50.000000000","message":"So it that makes sense in non-effective mode, but I don\u0027t think it is does if you have specified effective. Two reasons:\n\n1) I\u0027m not sure it makes sense it terms of the REST API - at least as it is specified today. Specifying a filter is meant to be a function applied to the \"output of the API\"...i.e. you should only be able to filter on attributes that are being returned (and groups are never returned as part of an effective list_role_assignments call)\n\n2) It also doesn\u0027t make algorithmic sense...imagine (in your example) if a given role is assigned to a project in more than one way (e.g. a direct role AND via a group role)....would you include it or not?  In non-effective mode it\u0027s obvious what to do - since you would be asking explicitly about group assignments...but in effective-mode we are meant to normalise both groups and inheritance...so do you consider the assignment to have come from the group assignment or the direct one?","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"7ddae17b8ffb421c7bb2da6a07efa400dcd9472a","unresolved":false,"context_lines":[{"line_number":963,"context_line":"        return refs"},{"line_number":964,"context_line":""},{"line_number":965,"context_line":"    def _list_effective_assignments("},{"line_number":966,"context_line":"            self, role_id, user_id, group_id, project_id, domain_id):"},{"line_number":967,"context_line":"        \"\"\"List assignments in effective mode"},{"line_number":968,"context_line":""},{"line_number":969,"context_line":"        When using effective mode, besides the direct assignments, the indirect"}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_f57aac22","line":966,"in_reply_to":"9aa7fdbe_e4d924f4","updated":"2014-10-24 13:47:53.000000000","message":"...so I think you are correct on 2)...we *could* distinguish (I knew there was a reason I put that membership info in there!!!)....but I think for now, we should not allow the group filter in effective mode.","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"e6f297a96fe75f7a74330f45449287c60a08d67d","unresolved":false,"context_lines":[{"line_number":963,"context_line":"        return refs"},{"line_number":964,"context_line":""},{"line_number":965,"context_line":"    def _list_effective_assignments("},{"line_number":966,"context_line":"            self, role_id, user_id, group_id, project_id, domain_id):"},{"line_number":967,"context_line":"        \"\"\"List assignments in effective mode"},{"line_number":968,"context_line":""},{"line_number":969,"context_line":"        When using effective mode, besides the direct assignments, the indirect"}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_d042163d","line":966,"in_reply_to":"9aa7fdbe_f57aac22","updated":"2014-10-24 14:07:06.000000000","message":"When I think effective + group, I imagine the request returning all users in a group and their respective roles (group roles).\n\nI would return both group and user role, if we are querying user + effective.\n\nAlthough the 1) point makes sense to me. Effective will never follow any REST API-like behaviour, another example would be querying for domain + effective in an env with OS-INHERIT active.","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"94ea61d8a2229de2528fdf5ff86a9416be9a9372","unresolved":false,"context_lines":[{"line_number":1043,"context_line":"    @controller.filterprotected(\u0027group.id\u0027, \u0027role.id\u0027,"},{"line_number":1044,"context_line":"                                \u0027scope.domain.id\u0027, \u0027scope.project.id\u0027,"},{"line_number":1045,"context_line":"                                \u0027scope.OS-INHERIT:inherited_to\u0027, \u0027user.id\u0027)"},{"line_number":1046,"context_line":"    def list_role_assignments(self, context, filters):"},{"line_number":1047,"context_line":"        query_params \u003d self._extract_query_params(context, filters)"},{"line_number":1048,"context_line":""},{"line_number":1049,"context_line":"        # Retrieve user and group ids and check consistency"}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_0374fefb","line":1046,"updated":"2014-10-18 09:51:21.000000000","message":"This method (plus all the methods it calls within this file) is now pretty complex.  That\u0027s not a criticism, just a statement.  I think we really need a very comprehensive doc string that describes what this method has to do in order to satisfy the request.  In particular I\u0027m thinking that we need to explain the algorithms at a high-level in the two cases, depending on whether the effective option is being used.","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"ec6ea53f7e4fb7a144a559119b52142031c844c5","unresolved":false,"context_lines":[{"line_number":1043,"context_line":"    @controller.filterprotected(\u0027group.id\u0027, \u0027role.id\u0027,"},{"line_number":1044,"context_line":"                                \u0027scope.domain.id\u0027, \u0027scope.project.id\u0027,"},{"line_number":1045,"context_line":"                                \u0027scope.OS-INHERIT:inherited_to\u0027, \u0027user.id\u0027)"},{"line_number":1046,"context_line":"    def list_role_assignments(self, context, filters):"},{"line_number":1047,"context_line":"        query_params \u003d self._extract_query_params(context, filters)"},{"line_number":1048,"context_line":""},{"line_number":1049,"context_line":"        # Retrieve user and group ids and check consistency"}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_a93cace3","line":1046,"in_reply_to":"9aa7fdbe_0374fefb","updated":"2014-10-21 21:32:57.000000000","message":"Totally agree. Let\u0027s review the docs on the next patch.","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"94ea61d8a2229de2528fdf5ff86a9416be9a9372","unresolved":false,"context_lines":[{"line_number":1061,"context_line":"        inherited \u003d ("},{"line_number":1062,"context_line":"            query_params[\u0027scope.OS-INHERIT:inherited_to\u0027] \u003d\u003d \u0027projects\u0027)"},{"line_number":1063,"context_line":""},{"line_number":1064,"context_line":"        effective \u003d (\u0027effective\u0027 in context[\u0027query_string\u0027] and"},{"line_number":1065,"context_line":"                     self._query_filter_is_true("},{"line_number":1066,"context_line":"                         context[\u0027query_string\u0027][\u0027effective\u0027]))"},{"line_number":1067,"context_line":""}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_83d62ec4","line":1064,"updated":"2014-10-18 09:51:21.000000000","message":"So \u0027effective\u0027 implies we will honour any inherited assignments....which is kind of not obvious from the way this is laid out. Indeed \u0027inherited\u0027 is not used in the block of \u0027effective\u0027 below.  Maybe move the \u0027inherited\u0027 setting to inside the \u0027else\u0027 block below where it is used?\n\nAgain, another thing to but in the doctoring above :-)","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"ec6ea53f7e4fb7a144a559119b52142031c844c5","unresolved":false,"context_lines":[{"line_number":1061,"context_line":"        inherited \u003d ("},{"line_number":1062,"context_line":"            query_params[\u0027scope.OS-INHERIT:inherited_to\u0027] \u003d\u003d \u0027projects\u0027)"},{"line_number":1063,"context_line":""},{"line_number":1064,"context_line":"        effective \u003d (\u0027effective\u0027 in context[\u0027query_string\u0027] and"},{"line_number":1065,"context_line":"                     self._query_filter_is_true("},{"line_number":1066,"context_line":"                         context[\u0027query_string\u0027][\u0027effective\u0027]))"},{"line_number":1067,"context_line":""}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_c9bad06d","line":1064,"in_reply_to":"9aa7fdbe_83d62ec4","updated":"2014-10-21 21:32:57.000000000","message":"I will move this to inside the \u0027else\u0027 block below ...   :)","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"4204efc3093c59f2af7edd981f2ff8d0b2b472bd","unresolved":false,"context_lines":[{"line_number":1080,"context_line":"                role_id\u003drole_id,"},{"line_number":1081,"context_line":"                user_id\u003duser_id, group_ids\u003dgroup_ids,"},{"line_number":1082,"context_line":"                project_id\u003dproject_id, domain_id\u003ddomain_id,"},{"line_number":1083,"context_line":"                inherited_to_projects\u003dinherited)"},{"line_number":1084,"context_line":""},{"line_number":1085,"context_line":"            formatted_refs \u003d [self._format_entity(context, x) for x in refs"},{"line_number":1086,"context_line":"                              if self._filter_inherited(x)]"}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_ec4b1057","line":1083,"updated":"2014-10-22 09:30:01.000000000","message":"If inherited is False, the the above call will return all assignments, included the inherited ones (see my comment in sql.py).  I think that means that the subsequent formatting will include inherited assignments in the result if the OS-INHERIT extension is enabled.  I don\u0027t think this is what we want.\n\nI don\u0027t believe the fix is to change _filter_inherited(), rather it is to fix assignment_api.list_role_assigments() to correctly honour the inherited flag.","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"2037edc995d1c6e35ab3c247bbddb7b30e04e552","unresolved":false,"context_lines":[{"line_number":1080,"context_line":"                role_id\u003drole_id,"},{"line_number":1081,"context_line":"                user_id\u003duser_id, group_ids\u003dgroup_ids,"},{"line_number":1082,"context_line":"                project_id\u003dproject_id, domain_id\u003ddomain_id,"},{"line_number":1083,"context_line":"                inherited_to_projects\u003dinherited)"},{"line_number":1084,"context_line":""},{"line_number":1085,"context_line":"            formatted_refs \u003d [self._format_entity(context, x) for x in refs"},{"line_number":1086,"context_line":"                              if self._filter_inherited(x)]"}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_04e388a4","line":1083,"in_reply_to":"9aa7fdbe_6b56ef5d","updated":"2014-10-24 12:07:30.000000000","message":"++","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"392073bed27f519a2e0a73937748ca01800b8116","unresolved":false,"context_lines":[{"line_number":1080,"context_line":"                role_id\u003drole_id,"},{"line_number":1081,"context_line":"                user_id\u003duser_id, group_ids\u003dgroup_ids,"},{"line_number":1082,"context_line":"                project_id\u003dproject_id, domain_id\u003ddomain_id,"},{"line_number":1083,"context_line":"                inherited_to_projects\u003dinherited)"},{"line_number":1084,"context_line":""},{"line_number":1085,"context_line":"            formatted_refs \u003d [self._format_entity(context, x) for x in refs"},{"line_number":1086,"context_line":"                              if self._filter_inherited(x)]"}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_6b56ef5d","line":1083,"in_reply_to":"9aa7fdbe_d71b02c8","updated":"2014-10-23 22:19:50.000000000","message":"So conceptually that makes sense to me (assuming it is considered reasonable pythonic).  None would be the default for inherited, so you\u0027d only probably ever specific True or False when calling it...otherwise just not set the parameter.","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"effffcc028666765e5ce82648592d5027140fba8","unresolved":false,"context_lines":[{"line_number":1080,"context_line":"                role_id\u003drole_id,"},{"line_number":1081,"context_line":"                user_id\u003duser_id, group_ids\u003dgroup_ids,"},{"line_number":1082,"context_line":"                project_id\u003dproject_id, domain_id\u003ddomain_id,"},{"line_number":1083,"context_line":"                inherited_to_projects\u003dinherited)"},{"line_number":1084,"context_line":""},{"line_number":1085,"context_line":"            formatted_refs \u003d [self._format_entity(context, x) for x in refs"},{"line_number":1086,"context_line":"                              if self._filter_inherited(x)]"}],"source_content_type":"text/x-python","patch_set":11,"id":"9aa7fdbe_d71b02c8","line":1083,"in_reply_to":"9aa7fdbe_ec4b1057","updated":"2014-10-23 19:46:17.000000000","message":"Now I got your point. I totally agree.\n\nI\u0027d suggest to supply inherited_to_projects\u003dTrue/False/None to the backend.\nNone means we don\u0027t wanna consider this field when filtering results.\n\nWhat do you think about this?","commit_id":"cad67e293005f73713e20a42b81b7112294d2bd6"}],"keystone/assignment/core.py":[{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"b27134015d91e7f7bd26ce9faddc923dafa14413","unresolved":false,"context_lines":[{"line_number":744,"context_line":""},{"line_number":745,"context_line":"    @abc.abstractmethod"},{"line_number":746,"context_line":"    def list_role_assignments(self, role_id\u003dNone, actors_ids\u003dNone,"},{"line_number":747,"context_line":"                              targets_ids\u003dNone, inherited\u003dNone):"},{"line_number":748,"context_line":""},{"line_number":749,"context_line":"        raise exception.NotImplemented()  # pragma: no cover"},{"line_number":750,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"1abeadc6_5738d53c","line":747,"updated":"2014-08-28 10:12:57.000000000","message":"Should add doc string and param refs here","commit_id":"b424310f63cb93eb6e10384d9c02bfcd26d6df84"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"41d0abe69a0c75bd336e0d2808b3b238e493501e","unresolved":false,"context_lines":[{"line_number":744,"context_line":""},{"line_number":745,"context_line":"    @abc.abstractmethod"},{"line_number":746,"context_line":"    def list_role_assignments(self, role_id\u003dNone, actors_ids\u003dNone,"},{"line_number":747,"context_line":"                              targets_ids\u003dNone, inherited\u003dNone):"},{"line_number":748,"context_line":""},{"line_number":749,"context_line":"        raise exception.NotImplemented()  # pragma: no cover"},{"line_number":750,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"1abeadc6_5f545afd","line":747,"in_reply_to":"1abeadc6_5738d53c","updated":"2014-08-28 17:31:42.000000000","message":"Done","commit_id":"b424310f63cb93eb6e10384d9c02bfcd26d6df84"}]}