)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"de583a5ca2249148c5a1373fa076eeb06c01d8f2","unresolved":false,"context_lines":[{"line_number":5,"context_line":"CommitDate: 2015-11-01 12:22:49 -0500"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Updated Cloudsample"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Change-Id: Ib23452e171dc90115c77fa5a4b9dc4649054eb0e"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"1a26ad4f_7b4c2a9e","line":8,"updated":"2015-11-01 23:47:05.000000000","message":"beef up the message!\n\nRelated-Bug: 968696\n\n?","commit_id":"fc6b434939a8431d3c02beacfcc89987e3e610c2"}],"etc/policy.v3cloudsample.json":[{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"f38a2be8db31f71f3570a4bf5308a480eac3b686","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"admin_required\": \"role:admin\","},{"line_number":3,"context_line":"    \"cloud_admin\": \"role:admin and token.is_admin_project:True\","},{"line_number":4,"context_line":"    \"service_role\": \"role:service\","},{"line_number":5,"context_line":"    \"service_or_admin\": \"rule:admin_required or rule:service_role\","},{"line_number":6,"context_line":"    \"owner\" : \"user_id:%(user_id)s or user_id:%(target.token.user_id)s\","}],"source_content_type":"application/json","patch_set":5,"id":"9a8ffd7b_93e5330a","line":3,"updated":"2015-12-03 00:08:57.000000000","message":"Lets try now to break potential backward compatibility. How about this?\n\n\"cloud_admin\": \"(rule:admin_required and domain_id:admin_domain_id) or is_admin_project:True\",","commit_id":"2e2d5c2fab9db6c4e633f4a71a01c5404a77f1f1"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"f380b91d44c8594a620fce7c3ba25b621c2d4723","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"admin_required\": \"role:admin\","},{"line_number":3,"context_line":"    \"cloud_admin\": \"role:admin and token.is_admin_project:True\","},{"line_number":4,"context_line":"    \"service_role\": \"role:service\","},{"line_number":5,"context_line":"    \"service_or_admin\": \"rule:admin_required or rule:service_role\","},{"line_number":6,"context_line":"    \"owner\" : \"user_id:%(user_id)s or user_id:%(target.token.user_id)s\","}],"source_content_type":"application/json","patch_set":5,"id":"7a740942_889f9d02","line":3,"in_reply_to":"7a740942_28e30935","updated":"2015-12-04 23:26:18.000000000","message":"the rule as written fails. Logically, it should be \"rule:admin_required and (domain_id:admin_domain_id or is_admin_project:True)\",  but that fails, too, because domain_id is not set on project scoped tokens.","commit_id":"2e2d5c2fab9db6c4e633f4a71a01c5404a77f1f1"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"b5131eded3464c99a985ac8d19f1db29ad49d9b6","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"admin_required\": \"role:admin\","},{"line_number":3,"context_line":"    \"cloud_admin\": \"role:admin and token.is_admin_project:True\","},{"line_number":4,"context_line":"    \"service_role\": \"role:service\","},{"line_number":5,"context_line":"    \"service_or_admin\": \"rule:admin_required or rule:service_role\","},{"line_number":6,"context_line":"    \"owner\" : \"user_id:%(user_id)s or user_id:%(target.token.user_id)s\","}],"source_content_type":"application/json","patch_set":5,"id":"7a740942_c3b6e6db","line":3,"in_reply_to":"7a740942_889f9d02","updated":"2015-12-04 23:57:59.000000000","message":"is_admin_project already implied that you are the \u0027admin\u0027, regardless of the role. So there\u0027s no need to check for both. Some deployments do the v3 policy file as a template so your changes will break existing deployments.\n\nThe rule I suggested should work for both\n\n\"cloud_admin\": \"(rule:admin_required and domain_id:admin_domain_id) or is_admin_project:True\",","commit_id":"2e2d5c2fab9db6c4e633f4a71a01c5404a77f1f1"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"a3a65ff51d55861d10960d1cee83612a2b5b86c6","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"admin_required\": \"role:admin\","},{"line_number":3,"context_line":"    \"cloud_admin\": \"role:admin and token.is_admin_project:True\","},{"line_number":4,"context_line":"    \"service_role\": \"role:service\","},{"line_number":5,"context_line":"    \"service_or_admin\": \"rule:admin_required or rule:service_role\","},{"line_number":6,"context_line":"    \"owner\" : \"user_id:%(user_id)s or user_id:%(target.token.user_id)s\","}],"source_content_type":"application/json","patch_set":5,"id":"7a740942_e77ba78a","line":3,"in_reply_to":"7a740942_c3b6e6db","updated":"2015-12-07 20:02:15.000000000","message":"++","commit_id":"2e2d5c2fab9db6c4e633f4a71a01c5404a77f1f1"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"df0512b687857f53e1c795aafa3f1486843db5b7","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"admin_required\": \"role:admin\","},{"line_number":3,"context_line":"    \"cloud_admin\": \"role:admin and token.is_admin_project:True\","},{"line_number":4,"context_line":"    \"service_role\": \"role:service\","},{"line_number":5,"context_line":"    \"service_or_admin\": \"rule:admin_required or rule:service_role\","},{"line_number":6,"context_line":"    \"owner\" : \"user_id:%(user_id)s or user_id:%(target.token.user_id)s\","}],"source_content_type":"application/json","patch_set":5,"id":"7a740942_0db8d4e4","line":3,"in_reply_to":"7a740942_c3b6e6db","updated":"2015-12-09 20:20:55.000000000","message":"That is very not true.  It just means that the project token you have is for the admin project, but it could have any role on it, not just admin. We need to check for both.","commit_id":"2e2d5c2fab9db6c4e633f4a71a01c5404a77f1f1"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"adcde38ad82cc69f03dce0b660124bd3077f01f1","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"admin_required\": \"role:admin\","},{"line_number":3,"context_line":"    \"cloud_admin\": \"role:admin and token.is_admin_project:True\","},{"line_number":4,"context_line":"    \"service_role\": \"role:service\","},{"line_number":5,"context_line":"    \"service_or_admin\": \"rule:admin_required or rule:service_role\","},{"line_number":6,"context_line":"    \"owner\" : \"user_id:%(user_id)s or user_id:%(target.token.user_id)s\","}],"source_content_type":"application/json","patch_set":5,"id":"7a740942_3db58d30","line":3,"in_reply_to":"9a8ffd7b_93e5330a","updated":"2015-12-04 22:23:27.000000000","message":"++","commit_id":"2e2d5c2fab9db6c4e633f4a71a01c5404a77f1f1"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"9ec049a05e0b17c8cb82bec0bc87adc5312444dd","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"admin_required\": \"role:admin\","},{"line_number":3,"context_line":"    \"cloud_admin\": \"role:admin and token.is_admin_project:True\","},{"line_number":4,"context_line":"    \"service_role\": \"role:service\","},{"line_number":5,"context_line":"    \"service_or_admin\": \"rule:admin_required or rule:service_role\","},{"line_number":6,"context_line":"    \"owner\" : \"user_id:%(user_id)s or user_id:%(target.token.user_id)s\","}],"source_content_type":"application/json","patch_set":5,"id":"7a740942_28e30935","line":3,"in_reply_to":"9a8ffd7b_93e5330a","updated":"2015-12-04 23:10:23.000000000","message":"This had to be edited by hand, so there is no possible breaking of backwards compatibility here.","commit_id":"2e2d5c2fab9db6c4e633f4a71a01c5404a77f1f1"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"7e8225a2259fda2434349c3cef25d297f963d653","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"admin_required\": \"role:admin\","},{"line_number":3,"context_line":"    \"cloud_admin\": \"role:admin and token.is_admin_project:True\","},{"line_number":4,"context_line":"    \"service_role\": \"role:service\","},{"line_number":5,"context_line":"    \"service_or_admin\": \"rule:admin_required or rule:service_role\","},{"line_number":6,"context_line":"    \"owner\" : \"user_id:%(user_id)s or user_id:%(target.token.user_id)s\","}],"source_content_type":"application/json","patch_set":6,"id":"7a740942_1b79eb2f","line":3,"updated":"2015-12-09 22:07:19.000000000","message":"This still breaking backward compatibility. If we are going to check both is_admin_project and role that\u0027s fine. But lets not break deployments which using this template.\n\n\"cloud_admin\": \"rule:admin_required and (domain_id:admin_domain_id or is_admin_project:True)\"","commit_id":"d3bd11eee472794e5c27bb1da4e94e7f56ecdc33"}],"keystone/models/token_model.py":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"de583a5ca2249148c5a1373fa076eeb06c01d8f2","unresolved":false,"context_lines":[{"line_number":330,"context_line":"        return None"},{"line_number":331,"context_line":""},{"line_number":332,"context_line":"    @property"},{"line_number":333,"context_line":"    def is_admin_project(self):"},{"line_number":334,"context_line":"        try:"},{"line_number":335,"context_line":"            return self.token_data[\u0027is_admin_project\u0027]"},{"line_number":336,"context_line":"        except KeyError:"}],"source_content_type":"text/x-python","patch_set":1,"id":"1a26ad4f_1b7736d4","line":333,"updated":"2015-11-01 23:47:05.000000000","message":"this should probably go in the previous patch","commit_id":"fc6b434939a8431d3c02beacfcc89987e3e610c2"}]}