)]}'
{"etc/policy.v3cloudsample.json":[{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"658f6f817d5486e70977ea12cf6172a18699d53d","unresolved":false,"context_lines":[{"line_number":92,"context_line":"    \"admin_on_domain_filter\" : \"rule:admin_required and domain_id:%(scope.domain.id)s\","},{"line_number":93,"context_line":"    \"admin_on_project_filter\" : \"rule:admin_required and project_id:%(scope.project.id)s\","},{"line_number":94,"context_line":"    \"identity:list_role_assignments\": \"rule:cloud_admin or rule:admin_on_domain_filter or rule:admin_on_project_filter\","},{"line_number":95,"context_line":"    \"identity:list_role_assignments_for_tree\": \"rule:cloud_admin or rule:admin_on_domain_filter or rule:admin_on_project_filter\","},{"line_number":96,"context_line":"    \"identity:get_policy\": \"rule:cloud_admin\","},{"line_number":97,"context_line":"    \"identity:list_policies\": \"rule:cloud_admin\","},{"line_number":98,"context_line":"    \"identity:create_policy\": \"rule:cloud_admin\","}],"source_content_type":"application/json","patch_set":7,"id":"7a2fa921_fe570e00","line":95,"updated":"2015-10-06 23:08:47.000000000","message":"The admin_on_project_filter seem wrong. Domain admin is not the same as project admin. Otherwise, we would have an escalated privilege security situation. We need a admin_on_special_project_filter to take the is_domain flag into consideration as well.","commit_id":"670e6e116a16c88b16ca77f14d395ee1d6db966e"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"a5221d647a977f0ac6f60e315c7cb2e5800fbad7","unresolved":false,"context_lines":[{"line_number":92,"context_line":"    \"admin_on_domain_filter\" : \"rule:admin_required and domain_id:%(scope.domain.id)s\","},{"line_number":93,"context_line":"    \"admin_on_project_filter\" : \"rule:admin_required and project_id:%(scope.project.id)s\","},{"line_number":94,"context_line":"    \"identity:list_role_assignments\": \"rule:cloud_admin or rule:admin_on_domain_filter or rule:admin_on_project_filter\","},{"line_number":95,"context_line":"    \"identity:list_role_assignments_for_tree\": \"rule:cloud_admin or rule:admin_on_domain_filter or rule:admin_on_project_filter\","},{"line_number":96,"context_line":"    \"identity:get_policy\": \"rule:cloud_admin\","},{"line_number":97,"context_line":"    \"identity:list_policies\": \"rule:cloud_admin\","},{"line_number":98,"context_line":"    \"identity:create_policy\": \"rule:cloud_admin\","}],"source_content_type":"application/json","patch_set":7,"id":"1a26ad4f_7dba2225","line":95,"in_reply_to":"7a2fa921_6c547ffe","updated":"2015-10-29 09:54:21.000000000","message":"the is_domain flag will get added once we convert to project tokens instead of domain tokens","commit_id":"670e6e116a16c88b16ca77f14d395ee1d6db966e"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"e64b97249963add7a6a1138aaa99693ca7766f15","unresolved":false,"context_lines":[{"line_number":92,"context_line":"    \"admin_on_domain_filter\" : \"rule:admin_required and domain_id:%(scope.domain.id)s\","},{"line_number":93,"context_line":"    \"admin_on_project_filter\" : \"rule:admin_required and project_id:%(scope.project.id)s\","},{"line_number":94,"context_line":"    \"identity:list_role_assignments\": \"rule:cloud_admin or rule:admin_on_domain_filter or rule:admin_on_project_filter\","},{"line_number":95,"context_line":"    \"identity:list_role_assignments_for_tree\": \"rule:cloud_admin or rule:admin_on_domain_filter or rule:admin_on_project_filter\","},{"line_number":96,"context_line":"    \"identity:get_policy\": \"rule:cloud_admin\","},{"line_number":97,"context_line":"    \"identity:list_policies\": \"rule:cloud_admin\","},{"line_number":98,"context_line":"    \"identity:create_policy\": \"rule:cloud_admin\","}],"source_content_type":"application/json","patch_set":7,"id":"7a2fa921_6c547ffe","line":95,"in_reply_to":"7a2fa921_fe570e00","updated":"2015-10-08 00:08:02.000000000","message":"oops, yes, I meant to change this - excellent catch.","commit_id":"670e6e116a16c88b16ca77f14d395ee1d6db966e"}],"keystone/assignment/controllers.py":[{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"4edec57aa9cc059aa1eeea5cbbe161610c65b8d9","unresolved":false,"context_lines":[{"line_number":653,"context_line":"                                \u0027scope.OS-INHERIT:inherited_to\u0027, \u0027user.id\u0027)"},{"line_number":654,"context_line":"    def list_role_assignments_for_tree(self, context, filters):"},{"line_number":655,"context_line":"        params \u003d context[\u0027query_string\u0027]"},{"line_number":656,"context_line":"        if \u0027scope.project.id\u0027 not in params or not params[\u0027scope.project.id\u0027]:"},{"line_number":657,"context_line":"            msg \u003d _(\u0027scope.project.id must be specified if include_subtree \u0027"},{"line_number":658,"context_line":"                    \u0027is also specified\u0027)"},{"line_number":659,"context_line":"            raise exception.ValidationError(message\u003dmsg)"}],"source_content_type":"text/x-python","patch_set":5,"id":"9a1a9d01_61457c15","line":656,"updated":"2015-09-28 16:13:44.000000000","message":"Please shorten it like this:\n\nif not context[\u0027query_string\u0027].get(\u0027scope.project.id\u0027):","commit_id":"ee323689afae7a88190862bfd88297cf945cdd75"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"1a09274ee437d087976eca35ac17c237b73d6100","unresolved":false,"context_lines":[{"line_number":653,"context_line":"                                \u0027scope.OS-INHERIT:inherited_to\u0027, \u0027user.id\u0027)"},{"line_number":654,"context_line":"    def list_role_assignments_for_tree(self, context, filters):"},{"line_number":655,"context_line":"        params \u003d context[\u0027query_string\u0027]"},{"line_number":656,"context_line":"        if \u0027scope.project.id\u0027 not in params or not params[\u0027scope.project.id\u0027]:"},{"line_number":657,"context_line":"            msg \u003d _(\u0027scope.project.id must be specified if include_subtree \u0027"},{"line_number":658,"context_line":"                    \u0027is also specified\u0027)"},{"line_number":659,"context_line":"            raise exception.ValidationError(message\u003dmsg)"}],"source_content_type":"text/x-python","patch_set":5,"id":"9a1a9d01_6596dff1","line":656,"in_reply_to":"9a1a9d01_61457c15","updated":"2015-09-28 20:04:45.000000000","message":"OK...I keep forgetting that you can things like that in python.....who made up this damn language....:-)","commit_id":"ee323689afae7a88190862bfd88297cf945cdd75"},{"author":{"_account_id":7179,"name":"Brad Pokorny","email":"brad_pokorny@symantec.com","username":"bpokorny"},"change_message_id":"b2b0092794c29ba1ebefae5a1e313e9e93b90e3b","unresolved":false,"context_lines":[{"line_number":685,"context_line":"        \"\"\"Main entry point from router for list role assignments."},{"line_number":686,"context_line":""},{"line_number":687,"context_line":"        Since we want different policy file rules to be applicable based on"},{"line_number":688,"context_line":"        whether there the include_subtree query parameter is part of the API"},{"line_number":689,"context_line":"        call, this method checks for this and then calls the appropriate"},{"line_number":690,"context_line":"        protected entry point."},{"line_number":691,"context_line":""}],"source_content_type":"text/x-python","patch_set":14,"id":"5a710552_604bafb1","line":688,"updated":"2015-12-14 22:11:20.000000000","message":"\"whether there the\" -\u003e \"whether the\"","commit_id":"a9a47b62c87c7838bc06b0ce31974b7ba460353b"}],"keystone/tests/unit/test_v3_assignment.py":[{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"658f6f817d5486e70977ea12cf6172a18699d53d","unresolved":false,"context_lines":[{"line_number":3035,"context_line":"                 expected_status\u003dhttp_client.BAD_REQUEST)"},{"line_number":3036,"context_line":"        self.get(\u0027/role_assignments?scope.project.id\u0026\u0027"},{"line_number":3037,"context_line":"                 \u0027include_subtree\u003dTrue\u0027,"},{"line_number":3038,"context_line":"                 expected_status\u003dhttp_client.BAD_REQUEST)"},{"line_number":3039,"context_line":""},{"line_number":3040,"context_line":"    def test_get_role_assignments_for_project_tree(self):"},{"line_number":3041,"context_line":"        \"\"\"Get role_assignment ?project_id\u003dX?include_subtree``."}],"source_content_type":"text/x-python","patch_set":7,"id":"7a2fa921_fef38e08","line":3038,"updated":"2015-10-06 23:08:47.000000000","message":"should we also support\n\nGET /role_assignments?scope.domain.id\u003did\u0026include_subtree\u003dTrue","commit_id":"670e6e116a16c88b16ca77f14d395ee1d6db966e"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"6661b4a6fb19a194b92eabc61cebcbdb89f17241","unresolved":false,"context_lines":[{"line_number":3035,"context_line":"                 expected_status\u003dhttp_client.BAD_REQUEST)"},{"line_number":3036,"context_line":"        self.get(\u0027/role_assignments?scope.project.id\u0026\u0027"},{"line_number":3037,"context_line":"                 \u0027include_subtree\u003dTrue\u0027,"},{"line_number":3038,"context_line":"                 expected_status\u003dhttp_client.BAD_REQUEST)"},{"line_number":3039,"context_line":""},{"line_number":3040,"context_line":"    def test_get_role_assignments_for_project_tree(self):"},{"line_number":3041,"context_line":"        \"\"\"Get role_assignment ?project_id\u003dX?include_subtree``."}],"source_content_type":"text/x-python","patch_set":7,"id":"7a2fa921_ec672fe7","line":3038,"in_reply_to":"7a2fa921_fef38e08","updated":"2015-10-08 00:09:43.000000000","message":"So on purpose, I did not over burden this API with supporting domain_id and subtree - since in Mitaka, when we merge all the reseller stuff, we will have projects acting as domains.  Once we have that you can simply pass a project_id for an is_domain project and get the same effect.","commit_id":"670e6e116a16c88b16ca77f14d395ee1d6db966e"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"658f6f817d5486e70977ea12cf6172a18699d53d","unresolved":false,"context_lines":[{"line_number":3038,"context_line":"                 expected_status\u003dhttp_client.BAD_REQUEST)"},{"line_number":3039,"context_line":""},{"line_number":3040,"context_line":"    def test_get_role_assignments_for_project_tree(self):"},{"line_number":3041,"context_line":"        \"\"\"Get role_assignment ?project_id\u003dX?include_subtree``."},{"line_number":3042,"context_line":""},{"line_number":3043,"context_line":"        Test Plan:"},{"line_number":3044,"context_line":""}],"source_content_type":"text/x-python","patch_set":7,"id":"7a2fa921_1ef76af6","line":3041,"updated":"2015-10-06 23:08:47.000000000","message":"?scope.project.id\u003dX?include_subtree","commit_id":"670e6e116a16c88b16ca77f14d395ee1d6db966e"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"e64b97249963add7a6a1138aaa99693ca7766f15","unresolved":false,"context_lines":[{"line_number":3038,"context_line":"                 expected_status\u003dhttp_client.BAD_REQUEST)"},{"line_number":3039,"context_line":""},{"line_number":3040,"context_line":"    def test_get_role_assignments_for_project_tree(self):"},{"line_number":3041,"context_line":"        \"\"\"Get role_assignment ?project_id\u003dX?include_subtree``."},{"line_number":3042,"context_line":""},{"line_number":3043,"context_line":"        Test Plan:"},{"line_number":3044,"context_line":""}],"source_content_type":"text/x-python","patch_set":7,"id":"7a2fa921_4c28a386","line":3041,"in_reply_to":"7a2fa921_1ef76af6","updated":"2015-10-08 00:08:02.000000000","message":"Yep, you are right","commit_id":"670e6e116a16c88b16ca77f14d395ee1d6db966e"}]}