)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"acc066f2763d313109d4e18edd7ddcc225867bab","unresolved":false,"context_lines":[{"line_number":5,"context_line":"CommitDate: 2013-03-22 15:05:30 -0700"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"use the roles in the token when recreating"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Change-Id: I98e1b71d5b7de7867945294ebd569efd2cd7314b"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"AAAAOH%2F%2F3Uo%3D","line":8,"updated":"2013-03-22 22:22:45.000000000","message":"Either link to a bug report, or state the problem that you are fixing.","commit_id":"c6d579e6f7a3e6154a0cfad86cc08775bf86587e"},{"author":{"_account_id":494,"name":"termie","email":"termie@openstack.org","username":"termie"},"change_message_id":"0e599d90f9f5b367735635efb0ede6524f68a7a5","unresolved":false,"context_lines":[{"line_number":5,"context_line":"CommitDate: 2013-03-22 15:05:30 -0700"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"use the roles in the token when recreating"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Change-Id: I98e1b71d5b7de7867945294ebd569efd2cd7314b"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"AAAAOH%2F%2F3QQ%3D","line":8,"in_reply_to":"AAAAOH%2F%2F3Uo%3D","updated":"2013-03-22 23:45:31.000000000","message":"will do sirrah","commit_id":"c6d579e6f7a3e6154a0cfad86cc08775bf86587e"}],"keystone/auth/token_factory.py":[{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"c537c54821fafeec2e05fe1888e82a4cec7de0e4","unresolved":false,"context_lines":[{"line_number":214,"context_line":"    extras \u003d {}"},{"line_number":215,"context_line":"    if token_data:"},{"line_number":216,"context_line":"        # peel the outer layer so its easier to operate"},{"line_number":217,"context_line":"        token_data \u003d token_data[\u0027token\u0027]"},{"line_number":218,"context_line":"        domain_id \u003d (token_data[\u0027domain\u0027][\u0027id\u0027] if \u0027domain\u0027 in token_data"},{"line_number":219,"context_line":"                     else None)"},{"line_number":220,"context_line":"        project_id \u003d (token_data[\u0027project\u0027][\u0027id\u0027] if \u0027project\u0027 in token_data"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAOH%2F%2F35w%3D","side":"PARENT","line":217,"updated":"2013-03-22 16:10:19.000000000","message":"thank you","commit_id":"4b8cab7b3753ba3de9f93175636858555d575be6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"7f37dcee86c95230cc07d1a0c73398e9460989f6","unresolved":false,"context_lines":[{"line_number":191,"context_line":"                      \u0027extras\u0027: extras}"},{"line_number":192,"context_line":"        if token and \u0027roles\u0027 in token:"},{"line_number":193,"context_line":"            token_data[\u0027roles\u0027] \u003d token[\u0027roles\u0027]"},{"line_number":194,"context_line":""},{"line_number":195,"context_line":"        if CONF.trust.enabled and trust:"},{"line_number":196,"context_line":"            if user_id !\u003d trust[\u0027trustee_user_id\u0027]:"},{"line_number":197,"context_line":"                raise exception.Forbidden()"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAOH%2F%2F6Mk%3D","line":194,"updated":"2013-03-21 10:32:02.000000000","message":"So the question is a bit more fundamental.  Is the purpose of validating a token to return what the abilities of the user were when the token was created, or as they are at the instance we call validate()?  The latter is implemented here.  If we want to do the former, quite a lot else would have to change.  For example, if the domain was enabled when we create the token, should we honor that even though the domain might now be disabled?\n\nI do think, however, we don\u0027t have a clarity of intent across our overall implementation, since:\n\n1) If a users \"capabilities\" are changed, then the next validate token is designed pick them up and put the new capabilities into the token data returned, ignoring what was stored in the original token.\n\n2) Any time a users \"capabilities\" are changed we invalidate any token the user has anyway.  If we catch all these cases (admittedly it isn\u0027t quite perfect yet), then 1) would become a no-op, since validate would fail to get a valid token.\n\n3) Any invalidated token will filter back to a client doing PKI via the revocation list","commit_id":"4af53d848d3e86f62c4b4764407e4a6ac6c2d049"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"c537c54821fafeec2e05fe1888e82a4cec7de0e4","unresolved":false,"context_lines":[{"line_number":191,"context_line":"                      \u0027extras\u0027: extras}"},{"line_number":192,"context_line":"        if token and \u0027roles\u0027 in token:"},{"line_number":193,"context_line":"            token_data[\u0027roles\u0027] \u003d token[\u0027roles\u0027]"},{"line_number":194,"context_line":""},{"line_number":195,"context_line":"        if CONF.trust.enabled and trust:"},{"line_number":196,"context_line":"            if user_id !\u003d trust[\u0027trustee_user_id\u0027]:"},{"line_number":197,"context_line":"                raise exception.Forbidden()"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAOH%2F%2F360%3D","line":194,"in_reply_to":"AAAAOH%2F%2F6Mk%3D","updated":"2013-03-22 16:10:19.000000000","message":"i believe we\u0027ve always preferred the former; the token would be invalid if roles were revoked or a domain was disabled anyway (2)","commit_id":"4af53d848d3e86f62c4b4764407e4a6ac6c2d049"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"7f37dcee86c95230cc07d1a0c73398e9460989f6","unresolved":false,"context_lines":[{"line_number":233,"context_line":"    # Make sense?"},{"line_number":234,"context_line":"    # So, how this all looks in the db:"},{"line_number":235,"context_line":"    #   id \u003d some_id"},{"line_number":236,"context_line":"    #   user_id \u003d some_user_id"},{"line_number":237,"context_line":"    #   expires \u003d some_expiration"},{"line_number":238,"context_line":"    #   extras \u003d {\u0027user\u0027: {\u0027id\u0027: some_used_id},"},{"line_number":239,"context_line":"    #             \u0027tenant\u0027: {\u0027id\u0027: some_tenant_id},"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAOH%2F%2F6NI%3D","line":236,"updated":"2013-03-21 10:32:02.000000000","message":"trust_id is here as well","commit_id":"4af53d848d3e86f62c4b4764407e4a6ac6c2d049"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"c537c54821fafeec2e05fe1888e82a4cec7de0e4","unresolved":false,"context_lines":[{"line_number":233,"context_line":"    # Make sense?"},{"line_number":234,"context_line":"    # So, how this all looks in the db:"},{"line_number":235,"context_line":"    #   id \u003d some_id"},{"line_number":236,"context_line":"    #   user_id \u003d some_user_id"},{"line_number":237,"context_line":"    #   expires \u003d some_expiration"},{"line_number":238,"context_line":"    #   extras \u003d {\u0027user\u0027: {\u0027id\u0027: some_used_id},"},{"line_number":239,"context_line":"    #             \u0027tenant\u0027: {\u0027id\u0027: some_tenant_id},"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAOH%2F%2F350%3D","line":236,"in_reply_to":"AAAAOH%2F%2F6NI%3D","updated":"2013-03-22 16:10:19.000000000","message":"not in termie\u0027s world ;)","commit_id":"4af53d848d3e86f62c4b4764407e4a6ac6c2d049"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"7d22311aa76a1ac57ac7708b1ca8f6e5dd2c0bd4","unresolved":false,"context_lines":[{"line_number":199,"context_line":"        token_data \u003d {\u0027methods\u0027: method_names,"},{"line_number":200,"context_line":"                      \u0027extras\u0027: extras}"},{"line_number":201,"context_line":""},{"line_number":202,"context_line":"        # We\u0027ve probably already written these to the token"},{"line_number":203,"context_line":"        for x in (\u0027roles\u0027, \u0027user\u0027, \u0027catalog\u0027, \u0027project\u0027, \u0027domain\u0027):"},{"line_number":204,"context_line":"            if token and x in token:"},{"line_number":205,"context_line":"                token_data[x] \u003d token[x]"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAOH%2F%2F3Bo%3D","line":202,"updated":"2013-03-23 13:54:07.000000000","message":"So I think we need to be clean one way the other.  The approach we are taking here (which I support) is that all we are doing on token validation is enumerating the contents of the token created earlier, for which the token_id has been supplied.\n\nget_token_data() is currently called for both the new token case (by create_token() ) as well as the the token validation case (by  recreate_token() ).  I\u0027d suggest that the best way to implement the change we want is for recreate_token to NOT call get_token_data(), since, as you indicate, we will have set up nearly all the token data anyway.  I think all we need is some tinkering with date expires/issues data.  Then it is clear that get_token_data(), and its sub-functions, have one task to build the token the first time on creation.  We can then remove the bailout checks you have added to these sub-functions.","commit_id":"c6d579e6f7a3e6154a0cfad86cc08775bf86587e"},{"author":{"_account_id":494,"name":"termie","email":"termie@openstack.org","username":"termie"},"change_message_id":"9366f228600f6e0c3d416e53c365890ba5e3a979","unresolved":false,"context_lines":[{"line_number":199,"context_line":"        token_data \u003d {\u0027methods\u0027: method_names,"},{"line_number":200,"context_line":"                      \u0027extras\u0027: extras}"},{"line_number":201,"context_line":""},{"line_number":202,"context_line":"        # We\u0027ve probably already written these to the token"},{"line_number":203,"context_line":"        for x in (\u0027roles\u0027, \u0027user\u0027, \u0027catalog\u0027, \u0027project\u0027, \u0027domain\u0027):"},{"line_number":204,"context_line":"            if token and x in token:"},{"line_number":205,"context_line":"                token_data[x] \u003d token[x]"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAOH%2F%2F1TA%3D","line":202,"in_reply_to":"AAAAOH%2F%2F3Bo%3D","updated":"2013-03-25 19:35:54.000000000","message":"henry-nash: I mostly agree, I actually think all the code in this file is a bad architectural decision, however I wasn\u0027t trying to boil the ocean, just make sure that extensions can generate tokens (not possible if all token generation happens in this file) before release.\n\nI\u0027d be happy for this entire thing to be rewritten in a much simpler and better understood way, but this was intended as a minimal change before release.","commit_id":"c6d579e6f7a3e6154a0cfad86cc08775bf86587e"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"acc066f2763d313109d4e18edd7ddcc225867bab","unresolved":false,"context_lines":[{"line_number":230,"context_line":"    domain_id \u003d None"},{"line_number":231,"context_line":"    methods \u003d [\u0027password\u0027, \u0027token\u0027]"},{"line_number":232,"context_line":"    extras \u003d {}"},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"    # NOTE(termie): Let\u0027s get some things straight here, because this code"},{"line_number":235,"context_line":"    #               is wrong but tested as such:"},{"line_number":236,"context_line":"    # token_data, if it exists, is going to look like:"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAOH%2F%2F3Uw%3D","line":233,"updated":"2013-03-22 22:22:45.000000000","message":"This comment is documenting what is going into the database, but it is strangely placed here;  it probably should be recorded in a bug report if there is something significantly wrong.","commit_id":"c6d579e6f7a3e6154a0cfad86cc08775bf86587e"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"e4ae4be55edfcde09b10aee484119ae98271f03d","unresolved":false,"context_lines":[{"line_number":230,"context_line":"    domain_id \u003d None"},{"line_number":231,"context_line":"    methods \u003d [\u0027password\u0027, \u0027token\u0027]"},{"line_number":232,"context_line":"    extras \u003d {}"},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"    # NOTE(termie): Let\u0027s get some things straight here, because this code"},{"line_number":235,"context_line":"    #               is wrong but tested as such:"},{"line_number":236,"context_line":"    # token_data, if it exists, is going to look like:"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAOH%2F%2F3N0%3D","line":233,"in_reply_to":"AAAAOH%2F%2F3QY%3D","updated":"2013-03-23 01:01:53.000000000","message":"OK,  if it is just explanation, then this is fine.  I thought you were suggesting a fix.","commit_id":"c6d579e6f7a3e6154a0cfad86cc08775bf86587e"},{"author":{"_account_id":494,"name":"termie","email":"termie@openstack.org","username":"termie"},"change_message_id":"0e599d90f9f5b367735635efb0ede6524f68a7a5","unresolved":false,"context_lines":[{"line_number":230,"context_line":"    domain_id \u003d None"},{"line_number":231,"context_line":"    methods \u003d [\u0027password\u0027, \u0027token\u0027]"},{"line_number":232,"context_line":"    extras \u003d {}"},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"    # NOTE(termie): Let\u0027s get some things straight here, because this code"},{"line_number":235,"context_line":"    #               is wrong but tested as such:"},{"line_number":236,"context_line":"    # token_data, if it exists, is going to look like:"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAOH%2F%2F3QY%3D","line":233,"in_reply_to":"AAAAOH%2F%2F3Uw%3D","updated":"2013-03-22 23:45:31.000000000","message":"Well, I put it here as an explanation of what is going on for anybody trying to make sense of the following code. It can be added to a bug as well but it seems like it is a useful place to explain it. Thoughts?","commit_id":"c6d579e6f7a3e6154a0cfad86cc08775bf86587e"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"7d22311aa76a1ac57ac7708b1ca8f6e5dd2c0bd4","unresolved":false,"context_lines":[{"line_number":232,"context_line":"    extras \u003d {}"},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"    # NOTE(termie): Let\u0027s get some things straight here, because this code"},{"line_number":235,"context_line":"    #               is wrong but tested as such:"},{"line_number":236,"context_line":"    # token_data, if it exists, is going to look like:"},{"line_number":237,"context_line":"    #   {\u0027token\u0027: ... the actual token data + a superfluous extras field ...}"},{"line_number":238,"context_line":"    # this data is actually stored in the database in the \u0027extras\u0027 column and"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAOH%2F%2F3Bk%3D","line":235,"updated":"2013-03-23 13:54:07.000000000","message":"So we\u0027re fixing this here, right?  So do we need this comment?  If we are not fixing it, let\u0027s describe what is wrong and raise a bug so we come back and do fix it.","commit_id":"c6d579e6f7a3e6154a0cfad86cc08775bf86587e"},{"author":{"_account_id":494,"name":"termie","email":"termie@openstack.org","username":"termie"},"change_message_id":"9366f228600f6e0c3d416e53c365890ba5e3a979","unresolved":false,"context_lines":[{"line_number":232,"context_line":"    extras \u003d {}"},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"    # NOTE(termie): Let\u0027s get some things straight here, because this code"},{"line_number":235,"context_line":"    #               is wrong but tested as such:"},{"line_number":236,"context_line":"    # token_data, if it exists, is going to look like:"},{"line_number":237,"context_line":"    #   {\u0027token\u0027: ... the actual token data + a superfluous extras field ...}"},{"line_number":238,"context_line":"    # this data is actually stored in the database in the \u0027extras\u0027 column and"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAOH%2F%2F1So%3D","line":235,"in_reply_to":"AAAAOH%2F%2F3Bk%3D","updated":"2013-03-25 19:35:54.000000000","message":"we aren\u0027t fixing it, just enumerating the unexpected conditions, we are right before release and this section of code is well-tested even though it is misunderstanding what it is doing (ie it is getting a proper result through the wrong methods), a bug could be filed for \"re-write token factory\" though, yes","commit_id":"c6d579e6f7a3e6154a0cfad86cc08775bf86587e"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"7d22311aa76a1ac57ac7708b1ca8f6e5dd2c0bd4","unresolved":false,"context_lines":[{"line_number":241,"context_line":"    # the \u0027user\u0027 and \u0027tenant\u0027 fields are being added to the"},{"line_number":242,"context_line":"    # token_ref due to being deserialized from the \u0027extras\u0027 column"},{"line_number":243,"context_line":"    #"},{"line_number":244,"context_line":"    # Make sense?"},{"line_number":245,"context_line":"    # So, how this all looks in the db:"},{"line_number":246,"context_line":"    #   id \u003d some_id"},{"line_number":247,"context_line":"    #   user_id \u003d some_user_id"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAOH%2F%2F3Bg%3D","line":244,"updated":"2013-03-23 13:54:07.000000000","message":"\"Makes sense?\" - seems superfluous.","commit_id":"c6d579e6f7a3e6154a0cfad86cc08775bf86587e"},{"author":{"_account_id":494,"name":"termie","email":"termie@openstack.org","username":"termie"},"change_message_id":"9366f228600f6e0c3d416e53c365890ba5e3a979","unresolved":false,"context_lines":[{"line_number":241,"context_line":"    # the \u0027user\u0027 and \u0027tenant\u0027 fields are being added to the"},{"line_number":242,"context_line":"    # token_ref due to being deserialized from the \u0027extras\u0027 column"},{"line_number":243,"context_line":"    #"},{"line_number":244,"context_line":"    # Make sense?"},{"line_number":245,"context_line":"    # So, how this all looks in the db:"},{"line_number":246,"context_line":"    #   id \u003d some_id"},{"line_number":247,"context_line":"    #   user_id \u003d some_user_id"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAOH%2F%2F1Sg%3D","line":244,"in_reply_to":"AAAAOH%2F%2F3Bg%3D","updated":"2013-03-25 19:35:54.000000000","message":"Do you hate fun? Rhetorical questions?","commit_id":"c6d579e6f7a3e6154a0cfad86cc08775bf86587e"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"acc066f2763d313109d4e18edd7ddcc225867bab","unresolved":false,"context_lines":[{"line_number":259,"context_line":"    #                                     \u0027methods\u0027: [\u0027password\u0027, \u0027token\u0027],"},{"line_number":260,"context_line":"    #                                     \u0027extras\u0027: { ... empty? ...}"},{"line_number":261,"context_line":"    #"},{"line_number":262,"context_line":"    # Obviously some memos were missed, somewhere."},{"line_number":263,"context_line":"    if token_data:"},{"line_number":264,"context_line":"        # peel the outer layer so its easier to operate"},{"line_number":265,"context_line":"        token \u003d token_data[\u0027token\u0027]"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAOH%2F%2F3Us%3D","line":262,"updated":"2013-03-22 22:22:45.000000000","message":"Please replace this line with a TODO for what should be done.","commit_id":"c6d579e6f7a3e6154a0cfad86cc08775bf86587e"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"e4ae4be55edfcde09b10aee484119ae98271f03d","unresolved":false,"context_lines":[{"line_number":259,"context_line":"    #                                     \u0027methods\u0027: [\u0027password\u0027, \u0027token\u0027],"},{"line_number":260,"context_line":"    #                                     \u0027extras\u0027: { ... empty? ...}"},{"line_number":261,"context_line":"    #"},{"line_number":262,"context_line":"    # Obviously some memos were missed, somewhere."},{"line_number":263,"context_line":"    if token_data:"},{"line_number":264,"context_line":"        # peel the outer layer so its easier to operate"},{"line_number":265,"context_line":"        token \u003d token_data[\u0027token\u0027]"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAOH%2F%2F3Nw%3D","line":262,"in_reply_to":"AAAAOH%2F%2F3QU%3D","updated":"2013-03-23 01:01:53.000000000","message":"Yes, that would be good.","commit_id":"c6d579e6f7a3e6154a0cfad86cc08775bf86587e"},{"author":{"_account_id":494,"name":"termie","email":"termie@openstack.org","username":"termie"},"change_message_id":"0e599d90f9f5b367735635efb0ede6524f68a7a5","unresolved":false,"context_lines":[{"line_number":259,"context_line":"    #                                     \u0027methods\u0027: [\u0027password\u0027, \u0027token\u0027],"},{"line_number":260,"context_line":"    #                                     \u0027extras\u0027: { ... empty? ...}"},{"line_number":261,"context_line":"    #"},{"line_number":262,"context_line":"    # Obviously some memos were missed, somewhere."},{"line_number":263,"context_line":"    if token_data:"},{"line_number":264,"context_line":"        # peel the outer layer so its easier to operate"},{"line_number":265,"context_line":"        token \u003d token_data[\u0027token\u0027]"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAOH%2F%2F3QU%3D","line":262,"in_reply_to":"AAAAOH%2F%2F3Us%3D","updated":"2013-03-22 23:45:31.000000000","message":"how about:\n\nTODO(termie): reduce stored token complexity","commit_id":"c6d579e6f7a3e6154a0cfad86cc08775bf86587e"}]}