)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"26d650bacbced1ead0b76da6569c390f79960776","unresolved":false,"context_lines":[{"line_number":5,"context_line":"CommitDate: 2015-12-04 10:05:58 -0600"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Reduce revocation records by removing the revoke events for disable"},{"line_number":8,"context_line":"domains and projects."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"Change-Id: I76330567e0df2d9f2af88ef9b6b98b8c379e7406"},{"line_number":11,"context_line":"Related-Bug: 1511775"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"7a740942_34028a0c","line":8,"updated":"2015-12-04 21:14:17.000000000","message":"nit: suggest keeping this under 70 characters. \n\nSome good guidelines on commit messages can be found here - https://wiki.openstack.org/wiki/GitCommitMessages","commit_id":"5c5d7d34072f415f16bb31e4582228867a2e71f0"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a82c563ef84818b780190c5aba9d4b0ac2dd4227","unresolved":false,"context_lines":[{"line_number":5,"context_line":"CommitDate: 2015-12-08 12:46:13 -0600"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Reduce revoke events for disabled domains and projects."},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Closes-Bug: 1524030"},{"line_number":10,"context_line":"Change-Id: I76330567e0df2d9f2af88ef9b6b98b8c379e7406"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":12,"id":"7a740942_9cd087f9","line":8,"updated":"2015-12-09 16:39:18.000000000","message":"We can add a little more context here around why we want to change this and how it effects us.\n\nhttps://wiki.openstack.org/wiki/GitCommitMessages","commit_id":"94b3d9b70f70fbf22175caf479eba30fdac48aff"},{"author":{"_account_id":18835,"name":"Toshiya Shiga","email":"tos-shiga@yk.jp.nec.com","username":"tos-shiga"},"change_message_id":"8c8fbe296afc7e2c7283b37140383d84684935a7","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Reduce revoke events for disabled domains and projects."},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Keystone\u0027s preformance degradates as the ‘revocation_event’ table grows"},{"line_number":10,"context_line":"in size. This patch is the initial step towards reducing the number of"},{"line_number":11,"context_line":"revocation events written the \u0027revocation_event\u0027 table. Instead of"},{"line_number":12,"context_line":"creating revocation events when a project or domain is disabled,"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":23,"id":"3a7e1126_826e8aff","line":9,"range":{"start_line":9,"start_character":41,"end_line":9,"end_character":59},"updated":"2015-12-18 01:06:28.000000000","message":"should use single quotation mark of 1-byte characters.","commit_id":"0bc2301722857e7b880381538d7b7faf531f0207"}],"keystone/assignment/core.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"26d650bacbced1ead0b76da6569c390f79960776","unresolved":false,"context_lines":[{"line_number":370,"context_line":"            self.revoke_api.revoke_by_grant(user_id\u003duser_id,"},{"line_number":371,"context_line":"                                            role_id\u003drole_id,"},{"line_number":372,"context_line":"                                            project_id\u003dproject_id)"},{"line_number":373,"context_line":"            self._emit_revoke_user_grant(role_id, user_id, project_id,"},{"line_number":374,"context_line":"                                         inherited_to_projects, context)"},{"line_number":375,"context_line":"        else:"},{"line_number":376,"context_line":"            try:"}],"source_content_type":"text/x-python","patch_set":4,"id":"7a740942_f79e44b7","line":373,"updated":"2015-12-04 21:14:17.000000000","message":"do we need to remove project_id here, too?","commit_id":"5c5d7d34072f415f16bb31e4582228867a2e71f0"}],"keystone/revoke/core.py":[{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"f88b668834903aac619aeedf4b9d47418906861a","unresolved":false,"context_lines":[{"line_number":91,"context_line":"            model.RevokeEvent(role_id\u003dpayload[\u0027resource_info\u0027]))"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"    def _project_callback(self, service, resource_type, operation,"},{"line_number":94,"context_line":"                          payload):"},{"line_number":95,"context_line":"        self.revoke("},{"line_number":96,"context_line":"            model.RevokeEvent(project_id\u003dpayload[\u0027resource_info\u0027]))"},{"line_number":97,"context_line":""}],"source_content_type":"text/x-python","patch_set":19,"id":"7a740942_97cc076b","side":"PARENT","line":94,"updated":"2015-12-14 18:53:15.000000000","message":"Can these methods just be deleted?","commit_id":"239aa0ab7553162e4c5e3e649bd80a5261691d6b"},{"author":{"_account_id":13152,"name":"Jorge Munoz","email":"elkidster@gmail.com","username":"jmunoz"},"change_message_id":"85e29b20925d93b45b5ec5041ef85ffc0d576552","unresolved":false,"context_lines":[{"line_number":91,"context_line":"            model.RevokeEvent(role_id\u003dpayload[\u0027resource_info\u0027]))"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"    def _project_callback(self, service, resource_type, operation,"},{"line_number":94,"context_line":"                          payload):"},{"line_number":95,"context_line":"        self.revoke("},{"line_number":96,"context_line":"            model.RevokeEvent(project_id\u003dpayload[\u0027resource_info\u0027]))"},{"line_number":97,"context_line":""}],"source_content_type":"text/x-python","patch_set":19,"id":"5a710552_07bbeac5","side":"PARENT","line":94,"in_reply_to":"7a740942_97cc076b","updated":"2015-12-14 23:03:35.000000000","message":"I have a few concerns with this change. I would have expected some trust test to fail since all revocation events for disabled domains/project are no longer sent and I was missing the trust checks. I\u0027m about summit a change to only prevent revocation events when operation \u003d\u003d \u0027disabled\u0027. I\u0027m still not fully sure what else can call these methods. I will add the missing trust test cases.","commit_id":"239aa0ab7553162e4c5e3e649bd80a5261691d6b"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"6b891533f827582f2953d69e51f976e6a3887181","unresolved":false,"context_lines":[{"line_number":84,"context_line":""},{"line_number":85,"context_line":"    def _project_callback(self, service, resource_type, operation,"},{"line_number":86,"context_line":"                          payload):"},{"line_number":87,"context_line":"        if operation !\u003d \"disabled\":"},{"line_number":88,"context_line":"            self.revoke("},{"line_number":89,"context_line":"                revoke_model.RevokeEvent(project_id\u003dpayload[\u0027resource_info\u0027]))"},{"line_number":90,"context_line":""}],"source_content_type":"text/x-python","patch_set":40,"id":"7f515b1d_a1e1b79d","line":87,"range":{"start_line":87,"start_character":24,"end_line":87,"end_character":34},"updated":"2017-10-09 11:16:25.000000000","message":"this seems pretty hard coded ... it would be better if we had constants for these events/operations... that could be used in the place it\u0027s raised too","commit_id":"37d576409d95f332c6e893ef4f03a68f74342763"},{"author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"change_message_id":"8c03927ac54a704ab5dd553ae3a9ff8e4ab7b9ac","unresolved":false,"context_lines":[{"line_number":103,"context_line":"                [\u0027OS-TRUST:trust\u0027, self._trust_callback],"},{"line_number":104,"context_line":"                [\u0027OS-OAUTH1:consumer\u0027, self._consumer_callback],"},{"line_number":105,"context_line":"                [\u0027user\u0027, self._user_callback],"},{"line_number":106,"context_line":"                [\u0027project\u0027, self._project_callback],"},{"line_number":107,"context_line":"            ],"},{"line_number":108,"context_line":"            notifications.ACTIONS.disabled: ["},{"line_number":109,"context_line":"                [\u0027user\u0027, self._user_callback]"}],"source_content_type":"text/x-python","patch_set":43,"id":"ff82abbf_98c64668","line":106,"range":{"start_line":106,"start_character":16,"end_line":106,"end_character":51},"updated":"2017-11-27 15:32:30.000000000","message":"Probably outside the scope of this patch, but the revocation event for deleting a project could also be removed. Token validation will fail anyway because the project doesn\u0027t exist anymore.","commit_id":"645a6d7902458f15006c697546668d3391144064"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"8ffc6f66c8dc9f4f50852f5bcb5dcd478639011e","unresolved":false,"context_lines":[{"line_number":103,"context_line":"                [\u0027OS-TRUST:trust\u0027, self._trust_callback],"},{"line_number":104,"context_line":"                [\u0027OS-OAUTH1:consumer\u0027, self._consumer_callback],"},{"line_number":105,"context_line":"                [\u0027user\u0027, self._user_callback],"},{"line_number":106,"context_line":"                [\u0027project\u0027, self._project_callback],"},{"line_number":107,"context_line":"            ],"},{"line_number":108,"context_line":"            notifications.ACTIONS.disabled: ["},{"line_number":109,"context_line":"                [\u0027user\u0027, self._user_callback]"}],"source_content_type":"text/x-python","patch_set":43,"id":"ff82abbf_3f57d95a","line":106,"range":{"start_line":106,"start_character":16,"end_line":106,"end_character":51},"in_reply_to":"ff82abbf_98c64668","updated":"2017-11-27 20:27:46.000000000","message":"++ \n\nI contemplated adding that in here, but opted to keep the scope focused on the original issue. We should totally do that in a follow up. We could also propose a patch to remove that functionality from the revoke API.","commit_id":"645a6d7902458f15006c697546668d3391144064"}],"keystone/tests/unit/common/test_notifications.py":[{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"825abdebcf4cd2c1ddf38d434251ababb0ce2363","unresolved":false,"context_lines":[{"line_number":546,"context_line":"        self._assert_last_audit(policy_ref[\u0027id\u0027], DELETED_OPERATION,"},{"line_number":547,"context_line":"                                \u0027policy\u0027, cadftaxonomy.SECURITY_POLICY)"},{"line_number":548,"context_line":""},{"line_number":549,"context_line":"    def test_disable_domain(self):"},{"line_number":550,"context_line":"        domain_ref \u003d unit.new_domain_ref()"},{"line_number":551,"context_line":"        self.resource_api.create_domain(domain_ref[\u0027id\u0027], domain_ref)"},{"line_number":552,"context_line":"        domain_ref[\u0027enabled\u0027] \u003d False"}],"source_content_type":"text/x-python","patch_set":15,"id":"7a740942_4d625caf","side":"PARENT","line":549,"updated":"2015-12-09 20:18:54.000000000","message":"Leave these.  The notifications still need to be sent.  The revocation event code just does not need to rely on them","commit_id":"3ac286897fe84d9dff0f018385dc88ed4f4c7600"},{"author":{"_account_id":13152,"name":"Jorge Munoz","email":"elkidster@gmail.com","username":"jmunoz"},"change_message_id":"6a2c99541df2f1d6405aa9d4b938d878e88443a0","unresolved":false,"context_lines":[{"line_number":546,"context_line":"        self._assert_last_audit(policy_ref[\u0027id\u0027], DELETED_OPERATION,"},{"line_number":547,"context_line":"                                \u0027policy\u0027, cadftaxonomy.SECURITY_POLICY)"},{"line_number":548,"context_line":""},{"line_number":549,"context_line":"    def test_disable_domain(self):"},{"line_number":550,"context_line":"        domain_ref \u003d unit.new_domain_ref()"},{"line_number":551,"context_line":"        self.resource_api.create_domain(domain_ref[\u0027id\u0027], domain_ref)"},{"line_number":552,"context_line":"        domain_ref[\u0027enabled\u0027] \u003d False"}],"source_content_type":"text/x-python","patch_set":15,"id":"7a740942_8cb59fd1","side":"PARENT","line":549,"in_reply_to":"7a740942_4d625caf","updated":"2015-12-09 23:52:58.000000000","message":"Done","commit_id":"3ac286897fe84d9dff0f018385dc88ed4f4c7600"}],"keystone/tests/unit/test_token_provider.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a82c563ef84818b780190c5aba9d4b0ac2dd4227","unresolved":false,"context_lines":[{"line_number":807,"context_line":"        # Mock domain and project for enabled check"},{"line_number":808,"context_line":"        v2_token \u003d create_v2_token()"},{"line_number":809,"context_line":"        tenant \u003d v2_token[\u0027access\u0027][\u0027token\u0027][\u0027tenant\u0027]"},{"line_number":810,"context_line":"        tenant[\u0027domain_id\u0027] \u003d \u0027default\u0027"},{"line_number":811,"context_line":"        self.token_api.token_provider_api.resource_api.get_project \u003d mock.Mock("},{"line_number":812,"context_line":"            return_value\u003dtenant)"},{"line_number":813,"context_line":"        domain \u003d {\u0027id\u0027: \u0027default\u0027, \u0027name\u0027: \u0027Default\u0027, \u0027enabled\u0027: True}"}],"source_content_type":"text/x-python","patch_set":12,"id":"7a740942_6292d0f8","line":810,"updated":"2015-12-09 16:39:18.000000000","message":"this has to be here because it\u0027s not allowed to be in the create_v2_token() method, right?","commit_id":"94b3d9b70f70fbf22175caf479eba30fdac48aff"},{"author":{"_account_id":13152,"name":"Jorge Munoz","email":"elkidster@gmail.com","username":"jmunoz"},"change_message_id":"b20a2713300c80b3d657ff0647ea57a90e273dea","unresolved":false,"context_lines":[{"line_number":807,"context_line":"        # Mock domain and project for enabled check"},{"line_number":808,"context_line":"        v2_token \u003d create_v2_token()"},{"line_number":809,"context_line":"        tenant \u003d v2_token[\u0027access\u0027][\u0027token\u0027][\u0027tenant\u0027]"},{"line_number":810,"context_line":"        tenant[\u0027domain_id\u0027] \u003d \u0027default\u0027"},{"line_number":811,"context_line":"        self.token_api.token_provider_api.resource_api.get_project \u003d mock.Mock("},{"line_number":812,"context_line":"            return_value\u003dtenant)"},{"line_number":813,"context_line":"        domain \u003d {\u0027id\u0027: \u0027default\u0027, \u0027name\u0027: \u0027Default\u0027, \u0027enabled\u0027: True}"}],"source_content_type":"text/x-python","patch_set":12,"id":"7a740942_6b686b88","line":810,"in_reply_to":"7a740942_6292d0f8","updated":"2015-12-09 19:49:51.000000000","message":"Yes, \u0027domain_id\u0027 is only returned when retrieving the tenant entity from the backend.","commit_id":"94b3d9b70f70fbf22175caf479eba30fdac48aff"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a82c563ef84818b780190c5aba9d4b0ac2dd4227","unresolved":false,"context_lines":[{"line_number":869,"context_line":"            exception.TokenNotFound,"},{"line_number":870,"context_line":"            self.token_provider_api._check_domain_and_project_enabled,"},{"line_number":871,"context_line":"            SAMPLE_V3_TOKEN)"},{"line_number":872,"context_line":""},{"line_number":873,"context_line":""},{"line_number":874,"context_line":"# NOTE(ayoung): renamed to avoid automatic test detection"},{"line_number":875,"context_line":"class PKIProviderTests(object):"}],"source_content_type":"text/x-python","patch_set":12,"id":"7a740942_a5ae82e5","line":872,"updated":"2015-12-09 16:39:18.000000000","message":"we could add one more case here right?\n\n\n    project[\u0027enabled\u0027] \u003d True\n    domain[\u0027enabled\u0027] \u003d True\n\nand verify that we don\u0027t raise an exception.","commit_id":"94b3d9b70f70fbf22175caf479eba30fdac48aff"},{"author":{"_account_id":13152,"name":"Jorge Munoz","email":"elkidster@gmail.com","username":"jmunoz"},"change_message_id":"b20a2713300c80b3d657ff0647ea57a90e273dea","unresolved":false,"context_lines":[{"line_number":869,"context_line":"            exception.TokenNotFound,"},{"line_number":870,"context_line":"            self.token_provider_api._check_domain_and_project_enabled,"},{"line_number":871,"context_line":"            SAMPLE_V3_TOKEN)"},{"line_number":872,"context_line":""},{"line_number":873,"context_line":""},{"line_number":874,"context_line":"# NOTE(ayoung): renamed to avoid automatic test detection"},{"line_number":875,"context_line":"class PKIProviderTests(object):"}],"source_content_type":"text/x-python","patch_set":12,"id":"7a740942_1cafac95","line":872,"in_reply_to":"7a740942_a5ae82e5","updated":"2015-12-09 19:49:51.000000000","message":"Done","commit_id":"94b3d9b70f70fbf22175caf479eba30fdac48aff"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"7513fcdbdfe70d615f440df13f6d8d881915b54a","unresolved":false,"context_lines":[{"line_number":680,"context_line":"                    }"},{"line_number":681,"context_line":"                ],"},{"line_number":682,"context_line":"                \"roles_links\": [],"},{"line_number":683,"context_line":"                \"username\": \"nova\""},{"line_number":684,"context_line":"            }"},{"line_number":685,"context_line":"        }"},{"line_number":686,"context_line":"    }"}],"source_content_type":"text/x-python","patch_set":16,"id":"7a740942_155bfa55","line":683,"updated":"2015-12-09 21:32:56.000000000","message":"just curious, but why do we need to add this to the tokens?","commit_id":"ff14cc92051ebe180f999904c09678c984ab189e"},{"author":{"_account_id":13152,"name":"Jorge Munoz","email":"elkidster@gmail.com","username":"jmunoz"},"change_message_id":"f4fe5211d5c22659aef089198c6f260a4ddaf097","unresolved":false,"context_lines":[{"line_number":680,"context_line":"                    }"},{"line_number":681,"context_line":"                ],"},{"line_number":682,"context_line":"                \"roles_links\": [],"},{"line_number":683,"context_line":"                \"username\": \"nova\""},{"line_number":684,"context_line":"            }"},{"line_number":685,"context_line":"        }"},{"line_number":686,"context_line":"    }"}],"source_content_type":"text/x-python","patch_set":16,"id":"7a740942_6c7153e0","line":683,"in_reply_to":"7a740942_155bfa55","updated":"2015-12-09 23:53:08.000000000","message":"Code attempt to retrieve a user\u0027s domain. If a user was not present the following would fail.\n\nuser_domain \u003d token_data[\u0027user\u0027].get(\u0027domain\u0027, {})","commit_id":"ff14cc92051ebe180f999904c09678c984ab189e"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"f88b668834903aac619aeedf4b9d47418906861a","unresolved":false,"context_lines":[{"line_number":766,"context_line":"        self.assertRaises(ImportError,"},{"line_number":767,"context_line":"                          token.provider.Manager)"},{"line_number":768,"context_line":""},{"line_number":769,"context_line":"    def test_provider_token_expiration_validation(self):"},{"line_number":770,"context_line":"        self.assertRaises(exception.TokenNotFound,"},{"line_number":771,"context_line":"                          self.token_provider_api._is_valid_token,"},{"line_number":772,"context_line":"                          SAMPLE_V2_TOKEN_EXPIRED)"}],"source_content_type":"text/x-python","patch_set":19,"id":"5a710552_e1b56ed0","side":"PARENT","line":769,"updated":"2015-12-14 18:53:15.000000000","message":"So, it looks like you have to change this test because the newly referenced domain and the 01257 project doesn\u0027t actually exist in the backend? :(\n\nI wish we could just fix that instead because I hate mocking. So fragile and hard to maintain!","commit_id":"239aa0ab7553162e4c5e3e649bd80a5261691d6b"},{"author":{"_account_id":13152,"name":"Jorge Munoz","email":"elkidster@gmail.com","username":"jmunoz"},"change_message_id":"85e29b20925d93b45b5ec5041ef85ffc0d576552","unresolved":false,"context_lines":[{"line_number":766,"context_line":"        self.assertRaises(ImportError,"},{"line_number":767,"context_line":"                          token.provider.Manager)"},{"line_number":768,"context_line":""},{"line_number":769,"context_line":"    def test_provider_token_expiration_validation(self):"},{"line_number":770,"context_line":"        self.assertRaises(exception.TokenNotFound,"},{"line_number":771,"context_line":"                          self.token_provider_api._is_valid_token,"},{"line_number":772,"context_line":"                          SAMPLE_V2_TOKEN_EXPIRED)"}],"source_content_type":"text/x-python","patch_set":19,"id":"5a710552_853fcd24","side":"PARENT","line":769,"in_reply_to":"5a710552_e1b56ed0","updated":"2015-12-14 23:03:35.000000000","message":"These test don\u0027t seem to instantiate a backend.  I had to mock the methods that would make calls to the backend. I can work on creating funcional test for these.","commit_id":"239aa0ab7553162e4c5e3e649bd80a5261691d6b"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"f88b668834903aac619aeedf4b9d47418906861a","unresolved":false,"context_lines":[{"line_number":831,"context_line":"    def test_provider_v2_token_enabled_validation(self):"},{"line_number":832,"context_line":"        # mock domain and project for enabled check"},{"line_number":833,"context_line":"        tenant \u003d SAMPLE_V2_TOKEN[\u0027access\u0027][\u0027token\u0027][\u0027tenant\u0027]"},{"line_number":834,"context_line":"        tenant[\u0027domain_id\u0027] \u003d \u0027default\u0027"},{"line_number":835,"context_line":"        tenant[\u0027enabled\u0027] \u003d False"},{"line_number":836,"context_line":"        self.token_api.token_provider_api.resource_api.get_project \u003d mock.Mock("},{"line_number":837,"context_line":"            return_value\u003dtenant)"}],"source_content_type":"text/x-python","patch_set":19,"id":"5a710552_8174aacf","line":834,"updated":"2015-12-14 18:53:15.000000000","message":"why not just put this line in the sample token?","commit_id":"108e662669b6c48f01fc66bf096008fcc51d0497"},{"author":{"_account_id":13152,"name":"Jorge Munoz","email":"elkidster@gmail.com","username":"jmunoz"},"change_message_id":"85e29b20925d93b45b5ec5041ef85ffc0d576552","unresolved":false,"context_lines":[{"line_number":831,"context_line":"    def test_provider_v2_token_enabled_validation(self):"},{"line_number":832,"context_line":"        # mock domain and project for enabled check"},{"line_number":833,"context_line":"        tenant \u003d SAMPLE_V2_TOKEN[\u0027access\u0027][\u0027token\u0027][\u0027tenant\u0027]"},{"line_number":834,"context_line":"        tenant[\u0027domain_id\u0027] \u003d \u0027default\u0027"},{"line_number":835,"context_line":"        tenant[\u0027enabled\u0027] \u003d False"},{"line_number":836,"context_line":"        self.token_api.token_provider_api.resource_api.get_project \u003d mock.Mock("},{"line_number":837,"context_line":"            return_value\u003dtenant)"}],"source_content_type":"text/x-python","patch_set":19,"id":"5a710552_27770604","line":834,"in_reply_to":"5a710552_8174aacf","updated":"2015-12-14 23:03:35.000000000","message":"\u0027domain_id\u0027 is not present in a tenant on a token. I was building a tenant object using on the SAMPLE_V2_TOKEN values.","commit_id":"108e662669b6c48f01fc66bf096008fcc51d0497"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"f88b668834903aac619aeedf4b9d47418906861a","unresolved":false,"context_lines":[{"line_number":846,"context_line":"            SAMPLE_V2_TOKEN)"},{"line_number":847,"context_line":""},{"line_number":848,"context_line":"        # Check for enabled tenants"},{"line_number":849,"context_line":"        tenant[\u0027enabled\u0027] \u003d True"},{"line_number":850,"context_line":""},{"line_number":851,"context_line":"        self.assertIsNone("},{"line_number":852,"context_line":"            self.token_provider_api._check_domain_and_project_enabled("}],"source_content_type":"text/x-python","patch_set":19,"id":"5a710552_412c82ab","line":849,"updated":"2015-12-14 18:53:15.000000000","message":"these would be easier to read if it was clear that you were manipulating the SAMPLE_V2_TOKEN itself","commit_id":"108e662669b6c48f01fc66bf096008fcc51d0497"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"6b891533f827582f2953d69e51f976e6a3887181","unresolved":false,"context_lines":[{"line_number":763,"context_line":"        self.load_backends()"},{"line_number":764,"context_line":"        self._load_test_data()"},{"line_number":765,"context_line":""},{"line_number":766,"context_line":"    # FIX_ME(jorge_munoz) Retrieve data from SAMPLE tokens"},{"line_number":767,"context_line":"    def _load_test_data(self):"},{"line_number":768,"context_line":"        # Create domains of SAMPLE tokens"},{"line_number":769,"context_line":"        domain \u003d unit.new_domain_ref(id\u003d\u0027default\u0027)"}],"source_content_type":"text/x-python","patch_set":40,"id":"7f515b1d_21e707af","line":766,"range":{"start_line":766,"start_character":6,"end_line":766,"end_character":12},"updated":"2017-10-09 11:16:25.000000000","message":"WIP?","commit_id":"37d576409d95f332c6e893ef4f03a68f74342763"}],"keystone/token/provider.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"26d650bacbced1ead0b76da6569c390f79960776","unresolved":false,"context_lines":[{"line_number":310,"context_line":"            if domain:"},{"line_number":311,"context_line":"                self.resource_api.assert_domain_enabled(domain[\u0027id\u0027])"},{"line_number":312,"context_line":""},{"line_number":313,"context_line":"            if token_data.get(\u0027project\u0027, None):"},{"line_number":314,"context_line":"                project \u003d token_data[\u0027project\u0027]"},{"line_number":315,"context_line":"            else:"},{"line_number":316,"context_line":"                if token_data.get(\u0027token\u0027, None):"}],"source_content_type":"text/x-python","patch_set":4,"id":"7a740942_576958bd","line":313,"updated":"2015-12-04 21:14:17.000000000","message":"I believe the .get() method will default to None, so this could probably be simplified:\n\n    if token_data.get(\u0027project\u0027):","commit_id":"5c5d7d34072f415f16bb31e4582228867a2e71f0"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"26d650bacbced1ead0b76da6569c390f79960776","unresolved":false,"context_lines":[{"line_number":313,"context_line":"            if token_data.get(\u0027project\u0027, None):"},{"line_number":314,"context_line":"                project \u003d token_data[\u0027project\u0027]"},{"line_number":315,"context_line":"            else:"},{"line_number":316,"context_line":"                if token_data.get(\u0027token\u0027, None):"},{"line_number":317,"context_line":"                    project \u003d token_data[\u0027token\u0027].get(\u0027tenant\u0027, None)"},{"line_number":318,"context_line":"            if project:"},{"line_number":319,"context_line":"                self.resource_api.assert_project_enabled(project[\u0027id\u0027])"}],"source_content_type":"text/x-python","patch_set":4,"id":"7a740942_776494e4","line":316,"updated":"2015-12-04 21:14:17.000000000","message":"same comment here","commit_id":"5c5d7d34072f415f16bb31e4582228867a2e71f0"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a82c563ef84818b780190c5aba9d4b0ac2dd4227","unresolved":false,"context_lines":[{"line_number":296,"context_line":"        \"\"\"Check if token properties are enabled."},{"line_number":297,"context_line":""},{"line_number":298,"context_line":"        Reduce the number of revocations events by explicitly checking that"},{"line_number":299,"context_line":"        domains and projects associated to the token are enabled."},{"line_number":300,"context_line":"        \"\"\""},{"line_number":301,"context_line":"        try:"},{"line_number":302,"context_line":"            # Try V3, fall back to V2 for domains and projects"}],"source_content_type":"text/x-python","patch_set":12,"id":"7a740942_0513d60e","line":299,"updated":"2015-12-09 16:39:18.000000000","message":"nit: to someone looking at this comment down the line, it might not be apparent how this method reduced revocation events. We could reword this to be a little more clear: \n\n    Explicitly check that the projects and domains associated with a token\n    are enabled. If they are not enabled then the token is invalid.","commit_id":"94b3d9b70f70fbf22175caf479eba30fdac48aff"},{"author":{"_account_id":13152,"name":"Jorge Munoz","email":"elkidster@gmail.com","username":"jmunoz"},"change_message_id":"b20a2713300c80b3d657ff0647ea57a90e273dea","unresolved":false,"context_lines":[{"line_number":296,"context_line":"        \"\"\"Check if token properties are enabled."},{"line_number":297,"context_line":""},{"line_number":298,"context_line":"        Reduce the number of revocations events by explicitly checking that"},{"line_number":299,"context_line":"        domains and projects associated to the token are enabled."},{"line_number":300,"context_line":"        \"\"\""},{"line_number":301,"context_line":"        try:"},{"line_number":302,"context_line":"            # Try V3, fall back to V2 for domains and projects"}],"source_content_type":"text/x-python","patch_set":12,"id":"7a740942_b988eac7","line":299,"in_reply_to":"7a740942_0513d60e","updated":"2015-12-09 19:49:51.000000000","message":"Done","commit_id":"94b3d9b70f70fbf22175caf479eba30fdac48aff"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a82c563ef84818b780190c5aba9d4b0ac2dd4227","unresolved":false,"context_lines":[{"line_number":301,"context_line":"        try:"},{"line_number":302,"context_line":"            # Try V3, fall back to V2 for domains and projects"},{"line_number":303,"context_line":"            token_data \u003d token.get(\u0027token\u0027, token.get(\u0027access\u0027))"},{"line_number":304,"context_line":"            user_domain \u003d token_data[\u0027user\u0027].get(\u0027domain\u0027, None)"},{"line_number":305,"context_line":"            federated_domain \u003d CONF.federation.federated_domain_name"},{"line_number":306,"context_line":"            if user_domain and user_domain[\u0027name\u0027] !\u003d federated_domain:"},{"line_number":307,"context_line":"                self.resource_api.assert_domain_enabled(user_domain[\u0027id\u0027])"}],"source_content_type":"text/x-python","patch_set":12,"id":"7a740942_252a92e8","line":304,"updated":"2015-12-09 16:39:18.000000000","message":"Should this default to an empty dict? \n\n    .get(\u0027domain\u0027, {})","commit_id":"94b3d9b70f70fbf22175caf479eba30fdac48aff"},{"author":{"_account_id":13152,"name":"Jorge Munoz","email":"elkidster@gmail.com","username":"jmunoz"},"change_message_id":"b20a2713300c80b3d657ff0647ea57a90e273dea","unresolved":false,"context_lines":[{"line_number":301,"context_line":"        try:"},{"line_number":302,"context_line":"            # Try V3, fall back to V2 for domains and projects"},{"line_number":303,"context_line":"            token_data \u003d token.get(\u0027token\u0027, token.get(\u0027access\u0027))"},{"line_number":304,"context_line":"            user_domain \u003d token_data[\u0027user\u0027].get(\u0027domain\u0027, None)"},{"line_number":305,"context_line":"            federated_domain \u003d CONF.federation.federated_domain_name"},{"line_number":306,"context_line":"            if user_domain and user_domain[\u0027name\u0027] !\u003d federated_domain:"},{"line_number":307,"context_line":"                self.resource_api.assert_domain_enabled(user_domain[\u0027id\u0027])"}],"source_content_type":"text/x-python","patch_set":12,"id":"7a740942_7c6b5086","line":304,"in_reply_to":"7a740942_252a92e8","updated":"2015-12-09 19:49:51.000000000","message":"Done","commit_id":"94b3d9b70f70fbf22175caf479eba30fdac48aff"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a82c563ef84818b780190c5aba9d4b0ac2dd4227","unresolved":false,"context_lines":[{"line_number":319,"context_line":"                    project \u003d token_data[\u0027token\u0027].get(\u0027tenant\u0027, None)"},{"line_number":320,"context_line":"            if project:"},{"line_number":321,"context_line":"                self.resource_api.assert_project_enabled(project[\u0027id\u0027])"},{"line_number":322,"context_line":"        except Exception:"},{"line_number":323,"context_line":"            raise exception.TokenNotFound(_(\u0027Failed to validate token\u0027))"},{"line_number":324,"context_line":""},{"line_number":325,"context_line":"    def _token_belongs_to(self, token, belongs_to):"}],"source_content_type":"text/x-python","patch_set":12,"id":"7a740942_c5caae6e","line":322,"updated":"2015-12-09 16:39:18.000000000","message":"we should try and be a bit more specific about the exception we\u0027re catching here. \n\nShould we except KeyErrors, ProjectNotFound, DomainNotFound, etc...\n\nIf we use a blanket Exception it can potentially make future issues harder to debug.","commit_id":"94b3d9b70f70fbf22175caf479eba30fdac48aff"},{"author":{"_account_id":13152,"name":"Jorge Munoz","email":"elkidster@gmail.com","username":"jmunoz"},"change_message_id":"b20a2713300c80b3d657ff0647ea57a90e273dea","unresolved":false,"context_lines":[{"line_number":319,"context_line":"                    project \u003d token_data[\u0027token\u0027].get(\u0027tenant\u0027, None)"},{"line_number":320,"context_line":"            if project:"},{"line_number":321,"context_line":"                self.resource_api.assert_project_enabled(project[\u0027id\u0027])"},{"line_number":322,"context_line":"        except Exception:"},{"line_number":323,"context_line":"            raise exception.TokenNotFound(_(\u0027Failed to validate token\u0027))"},{"line_number":324,"context_line":""},{"line_number":325,"context_line":"    def _token_belongs_to(self, token, belongs_to):"}],"source_content_type":"text/x-python","patch_set":12,"id":"7a740942_dcf5a4cb","line":322,"in_reply_to":"7a740942_c5caae6e","updated":"2015-12-09 19:49:51.000000000","message":"Done","commit_id":"94b3d9b70f70fbf22175caf479eba30fdac48aff"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"825abdebcf4cd2c1ddf38d434251ababb0ce2363","unresolved":false,"context_lines":[{"line_number":301,"context_line":"        try:"},{"line_number":302,"context_line":"            # Try V3, fall back to V2 for domains and projects"},{"line_number":303,"context_line":"            token_data \u003d token.get(\u0027token\u0027, token.get(\u0027access\u0027))"},{"line_number":304,"context_line":"            user_domain \u003d token_data[\u0027user\u0027].get(\u0027domain\u0027, {})"},{"line_number":305,"context_line":"            federated_domain \u003d CONF.federation.federated_domain_name"},{"line_number":306,"context_line":"            if user_domain and user_domain[\u0027name\u0027] !\u003d federated_domain:"},{"line_number":307,"context_line":"                self.resource_api.assert_domain_enabled(user_domain[\u0027id\u0027])"}],"source_content_type":"text/x-python","patch_set":15,"id":"7a740942_8d8cc480","line":304,"updated":"2015-12-09 20:18:54.000000000","message":"this is a safe check, but pretty sure that we would not get here if the users domain was disabled, as the user could not authenticate.\n\nYou want to make sure this works for trusts: trustor.domain_id and trustee.domain_id must both be enabled.","commit_id":"ae8cc83ecec154a98a48d5a31296f02d9bc6057b"},{"author":{"_account_id":13152,"name":"Jorge Munoz","email":"elkidster@gmail.com","username":"jmunoz"},"change_message_id":"6a2c99541df2f1d6405aa9d4b938d878e88443a0","unresolved":false,"context_lines":[{"line_number":301,"context_line":"        try:"},{"line_number":302,"context_line":"            # Try V3, fall back to V2 for domains and projects"},{"line_number":303,"context_line":"            token_data \u003d token.get(\u0027token\u0027, token.get(\u0027access\u0027))"},{"line_number":304,"context_line":"            user_domain \u003d token_data[\u0027user\u0027].get(\u0027domain\u0027, {})"},{"line_number":305,"context_line":"            federated_domain \u003d CONF.federation.federated_domain_name"},{"line_number":306,"context_line":"            if user_domain and user_domain[\u0027name\u0027] !\u003d federated_domain:"},{"line_number":307,"context_line":"                self.resource_api.assert_domain_enabled(user_domain[\u0027id\u0027])"}],"source_content_type":"text/x-python","patch_set":15,"id":"7a740942_ec4543b3","line":304,"in_reply_to":"7a740942_8d8cc480","updated":"2015-12-09 23:52:58.000000000","message":"This also verifies tokens passed in the \u0027X-Auth-Token\u0027 header. A domain could be disabled after a token has been generated.\n\nStill working on making sure trusts works.","commit_id":"ae8cc83ecec154a98a48d5a31296f02d9bc6057b"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"825abdebcf4cd2c1ddf38d434251ababb0ce2363","unresolved":false,"context_lines":[{"line_number":318,"context_line":"                if token_data.get(\u0027token\u0027):"},{"line_number":319,"context_line":"                    project \u003d token_data[\u0027token\u0027].get(\u0027tenant\u0027, {})"},{"line_number":320,"context_line":"            if project:"},{"line_number":321,"context_line":"                self.resource_api.assert_project_enabled(project[\u0027id\u0027])"},{"line_number":322,"context_line":"        except (KeyError, AssertionError):"},{"line_number":323,"context_line":"            raise exception.TokenNotFound(_(\u0027Failed to validate token\u0027))"},{"line_number":324,"context_line":""}],"source_content_type":"text/x-python","patch_set":15,"id":"7a740942_0d5bf42f","line":321,"updated":"2015-12-09 20:18:54.000000000","message":"Good to note here that this also checks if the projects domain is enabled.","commit_id":"ae8cc83ecec154a98a48d5a31296f02d9bc6057b"},{"author":{"_account_id":13152,"name":"Jorge Munoz","email":"elkidster@gmail.com","username":"jmunoz"},"change_message_id":"6a2c99541df2f1d6405aa9d4b938d878e88443a0","unresolved":false,"context_lines":[{"line_number":318,"context_line":"                if token_data.get(\u0027token\u0027):"},{"line_number":319,"context_line":"                    project \u003d token_data[\u0027token\u0027].get(\u0027tenant\u0027, {})"},{"line_number":320,"context_line":"            if project:"},{"line_number":321,"context_line":"                self.resource_api.assert_project_enabled(project[\u0027id\u0027])"},{"line_number":322,"context_line":"        except (KeyError, AssertionError):"},{"line_number":323,"context_line":"            raise exception.TokenNotFound(_(\u0027Failed to validate token\u0027))"},{"line_number":324,"context_line":""}],"source_content_type":"text/x-python","patch_set":15,"id":"7a740942_07af48e4","line":321,"in_reply_to":"7a740942_0d5bf42f","updated":"2015-12-09 23:52:58.000000000","message":"Done","commit_id":"ae8cc83ecec154a98a48d5a31296f02d9bc6057b"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"7513fcdbdfe70d615f440df13f6d8d881915b54a","unresolved":false,"context_lines":[{"line_number":316,"context_line":"                project \u003d token_data[\u0027project\u0027]"},{"line_number":317,"context_line":"            else:"},{"line_number":318,"context_line":"                if token_data.get(\u0027token\u0027):"},{"line_number":319,"context_line":"                    project \u003d token_data[\u0027token\u0027].get(\u0027tenant\u0027, {})"},{"line_number":320,"context_line":"            if project:"},{"line_number":321,"context_line":"                self.resource_api.assert_project_enabled(project[\u0027id\u0027])"},{"line_number":322,"context_line":"        except (KeyError, AssertionError):"}],"source_content_type":"text/x-python","patch_set":16,"id":"7a740942_3559568f","line":319,"updated":"2015-12-09 21:32:56.000000000","message":"could collapse this into an elif: \n\n    elif token_data.get(\u0027token\u0027):\n        project \u003d token_data[\u0027token\u0027].get(\u0027tenant\u0027, {})","commit_id":"ff14cc92051ebe180f999904c09678c984ab189e"},{"author":{"_account_id":13152,"name":"Jorge Munoz","email":"elkidster@gmail.com","username":"jmunoz"},"change_message_id":"f4fe5211d5c22659aef089198c6f260a4ddaf097","unresolved":false,"context_lines":[{"line_number":316,"context_line":"                project \u003d token_data[\u0027project\u0027]"},{"line_number":317,"context_line":"            else:"},{"line_number":318,"context_line":"                if token_data.get(\u0027token\u0027):"},{"line_number":319,"context_line":"                    project \u003d token_data[\u0027token\u0027].get(\u0027tenant\u0027, {})"},{"line_number":320,"context_line":"            if project:"},{"line_number":321,"context_line":"                self.resource_api.assert_project_enabled(project[\u0027id\u0027])"},{"line_number":322,"context_line":"        except (KeyError, AssertionError):"}],"source_content_type":"text/x-python","patch_set":16,"id":"7a740942_ec2b0393","line":319,"in_reply_to":"7a740942_3559568f","updated":"2015-12-09 23:53:08.000000000","message":"Done","commit_id":"ff14cc92051ebe180f999904c09678c984ab189e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"7513fcdbdfe70d615f440df13f6d8d881915b54a","unresolved":false,"context_lines":[{"line_number":320,"context_line":"            if project:"},{"line_number":321,"context_line":"                self.resource_api.assert_project_enabled(project[\u0027id\u0027])"},{"line_number":322,"context_line":"        except (KeyError, AssertionError):"},{"line_number":323,"context_line":"            raise exception.TokenNotFound(_(\u0027Failed to validate token\u0027))"},{"line_number":324,"context_line":""},{"line_number":325,"context_line":"    def _token_belongs_to(self, token, belongs_to):"},{"line_number":326,"context_line":"        \"\"\"Check if the token belongs to the right tenant."}],"source_content_type":"text/x-python","patch_set":16,"id":"7a740942_15d8daee","line":323,"updated":"2015-12-09 21:32:56.000000000","message":"could pass in the token_id here:\n\nhttps://github.com/openstack/keystone/blob/507003981206440313cc6fd692ef58c748742435/keystone/token/persistence/core.py#L60\n\nif we have it available to us.","commit_id":"ff14cc92051ebe180f999904c09678c984ab189e"},{"author":{"_account_id":13152,"name":"Jorge Munoz","email":"elkidster@gmail.com","username":"jmunoz"},"change_message_id":"f4fe5211d5c22659aef089198c6f260a4ddaf097","unresolved":false,"context_lines":[{"line_number":320,"context_line":"            if project:"},{"line_number":321,"context_line":"                self.resource_api.assert_project_enabled(project[\u0027id\u0027])"},{"line_number":322,"context_line":"        except (KeyError, AssertionError):"},{"line_number":323,"context_line":"            raise exception.TokenNotFound(_(\u0027Failed to validate token\u0027))"},{"line_number":324,"context_line":""},{"line_number":325,"context_line":"    def _token_belongs_to(self, token, belongs_to):"},{"line_number":326,"context_line":"        \"\"\"Check if the token belongs to the right tenant."}],"source_content_type":"text/x-python","patch_set":16,"id":"7a740942_e7479c49","line":323,"in_reply_to":"7a740942_15d8daee","updated":"2015-12-09 23:53:08.000000000","message":"So, remove the message and add a token_id?","commit_id":"ff14cc92051ebe180f999904c09678c984ab189e"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"f88b668834903aac619aeedf4b9d47418906861a","unresolved":false,"context_lines":[{"line_number":296,"context_line":"        This is only used on v2 tokens.  The structural validity of the token"},{"line_number":297,"context_line":"        will have already been checked before this method is called."},{"line_number":298,"context_line":""},{"line_number":299,"context_line":"        \"\"\""},{"line_number":300,"context_line":"        if belongs_to:"},{"line_number":301,"context_line":"            token_data \u003d token[\u0027access\u0027][\u0027token\u0027]"},{"line_number":302,"context_line":"            if (\u0027tenant\u0027 not in token_data or"}],"source_content_type":"text/x-python","patch_set":19,"id":"5a710552_5c41c938","side":"PARENT","line":299,"updated":"2015-12-14 18:53:15.000000000","message":"method docstrings should end like this one ^","commit_id":"239aa0ab7553162e4c5e3e649bd80a5261691d6b"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"f88b668834903aac619aeedf4b9d47418906861a","unresolved":false,"context_lines":[{"line_number":296,"context_line":"        \"\"\"Check if token properties are enabled."},{"line_number":297,"context_line":""},{"line_number":298,"context_line":"        Explicitly check that the projects and domains associated with a token"},{"line_number":299,"context_line":"        are enabled. If they are not enabled then the token is invalid."},{"line_number":300,"context_line":"        \"\"\""},{"line_number":301,"context_line":"        try:"},{"line_number":302,"context_line":"            # Try V3, fall back to V2 for domains and projects"}],"source_content_type":"text/x-python","patch_set":19,"id":"5a710552_dc4cd978","line":299,"updated":"2015-12-14 18:53:15.000000000","message":"missing whitespace after this paragraph","commit_id":"108e662669b6c48f01fc66bf096008fcc51d0497"},{"author":{"_account_id":13152,"name":"Jorge Munoz","email":"elkidster@gmail.com","username":"jmunoz"},"change_message_id":"85e29b20925d93b45b5ec5041ef85ffc0d576552","unresolved":false,"context_lines":[{"line_number":296,"context_line":"        \"\"\"Check if token properties are enabled."},{"line_number":297,"context_line":""},{"line_number":298,"context_line":"        Explicitly check that the projects and domains associated with a token"},{"line_number":299,"context_line":"        are enabled. If they are not enabled then the token is invalid."},{"line_number":300,"context_line":"        \"\"\""},{"line_number":301,"context_line":"        try:"},{"line_number":302,"context_line":"            # Try V3, fall back to V2 for domains and projects"}],"source_content_type":"text/x-python","patch_set":19,"id":"5a710552_07cc4a34","line":299,"in_reply_to":"5a710552_dc4cd978","updated":"2015-12-14 23:03:35.000000000","message":"Done","commit_id":"108e662669b6c48f01fc66bf096008fcc51d0497"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"f88b668834903aac619aeedf4b9d47418906861a","unresolved":false,"context_lines":[{"line_number":302,"context_line":"            # Try V3, fall back to V2 for domains and projects"},{"line_number":303,"context_line":"            token_data \u003d token.get(\u0027token\u0027, token.get(\u0027access\u0027))"},{"line_number":304,"context_line":"            user_domain \u003d token_data[\u0027user\u0027].get(\u0027domain\u0027, {})"},{"line_number":305,"context_line":"            federated_domain \u003d CONF.federation.federated_domain_name"},{"line_number":306,"context_line":"            if user_domain and user_domain[\u0027name\u0027] !\u003d federated_domain:"},{"line_number":307,"context_line":"                self.resource_api.assert_domain_enabled(user_domain[\u0027id\u0027])"},{"line_number":308,"context_line":""}],"source_content_type":"text/x-python","patch_set":19,"id":"5a710552_bca9cde1","line":305,"updated":"2015-12-14 18:53:15.000000000","message":"out of scope / not your fault: magic values suck","commit_id":"108e662669b6c48f01fc66bf096008fcc51d0497"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"f88b668834903aac619aeedf4b9d47418906861a","unresolved":false,"context_lines":[{"line_number":319,"context_line":"            if project:"},{"line_number":320,"context_line":"                # Also verifies that a project\u0027s domain is enabled"},{"line_number":321,"context_line":"                self.resource_api.assert_project_enabled(project[\u0027id\u0027])"},{"line_number":322,"context_line":"        except (KeyError, AssertionError):"},{"line_number":323,"context_line":"            raise exception.TokenNotFound(_(\u0027Failed to validate token\u0027))"},{"line_number":324,"context_line":""},{"line_number":325,"context_line":"    def _token_belongs_to(self, token, belongs_to):"}],"source_content_type":"text/x-python","patch_set":19,"id":"5a710552_fcd43548","line":322,"updated":"2015-12-14 18:53:15.000000000","message":"How can either of these occur? Write an inline comment explaining when you\u0027re expecting each of them, because that\u0027s a looong try block.","commit_id":"108e662669b6c48f01fc66bf096008fcc51d0497"},{"author":{"_account_id":13152,"name":"Jorge Munoz","email":"elkidster@gmail.com","username":"jmunoz"},"change_message_id":"85e29b20925d93b45b5ec5041ef85ffc0d576552","unresolved":false,"context_lines":[{"line_number":319,"context_line":"            if project:"},{"line_number":320,"context_line":"                # Also verifies that a project\u0027s domain is enabled"},{"line_number":321,"context_line":"                self.resource_api.assert_project_enabled(project[\u0027id\u0027])"},{"line_number":322,"context_line":"        except (KeyError, AssertionError):"},{"line_number":323,"context_line":"            raise exception.TokenNotFound(_(\u0027Failed to validate token\u0027))"},{"line_number":324,"context_line":""},{"line_number":325,"context_line":"    def _token_belongs_to(self, token, belongs_to):"}],"source_content_type":"text/x-python","patch_set":19,"id":"5a710552_2ffcb83d","line":322,"in_reply_to":"5a710552_fcd43548","updated":"2015-12-14 23:03:35.000000000","message":"Done","commit_id":"108e662669b6c48f01fc66bf096008fcc51d0497"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"f88b668834903aac619aeedf4b9d47418906861a","unresolved":false,"context_lines":[{"line_number":320,"context_line":"                # Also verifies that a project\u0027s domain is enabled"},{"line_number":321,"context_line":"                self.resource_api.assert_project_enabled(project[\u0027id\u0027])"},{"line_number":322,"context_line":"        except (KeyError, AssertionError):"},{"line_number":323,"context_line":"            raise exception.TokenNotFound(_(\u0027Failed to validate token\u0027))"},{"line_number":324,"context_line":""},{"line_number":325,"context_line":"    def _token_belongs_to(self, token, belongs_to):"},{"line_number":326,"context_line":"        \"\"\"Check if the token belongs to the right tenant."}],"source_content_type":"text/x-python","patch_set":19,"id":"5a710552_5cdd496f","line":323,"updated":"2015-12-14 18:53:15.000000000","message":"You can/should write an explicit error message here. It will be suppressed outside of debug mode, so there\u0027s no security risk.","commit_id":"108e662669b6c48f01fc66bf096008fcc51d0497"},{"author":{"_account_id":13152,"name":"Jorge Munoz","email":"elkidster@gmail.com","username":"jmunoz"},"change_message_id":"85e29b20925d93b45b5ec5041ef85ffc0d576552","unresolved":false,"context_lines":[{"line_number":320,"context_line":"                # Also verifies that a project\u0027s domain is enabled"},{"line_number":321,"context_line":"                self.resource_api.assert_project_enabled(project[\u0027id\u0027])"},{"line_number":322,"context_line":"        except (KeyError, AssertionError):"},{"line_number":323,"context_line":"            raise exception.TokenNotFound(_(\u0027Failed to validate token\u0027))"},{"line_number":324,"context_line":""},{"line_number":325,"context_line":"    def _token_belongs_to(self, token, belongs_to):"},{"line_number":326,"context_line":"        \"\"\"Check if the token belongs to the right tenant."}],"source_content_type":"text/x-python","patch_set":19,"id":"5a710552_0f9a1c15","line":323,"in_reply_to":"5a710552_5cdd496f","updated":"2015-12-14 23:03:35.000000000","message":"Done","commit_id":"108e662669b6c48f01fc66bf096008fcc51d0497"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"2ec4c5b36ca68c832dc8033dc1850c95bfe57825","unresolved":false,"context_lines":[{"line_number":342,"context_line":"                else:"},{"line_number":343,"context_line":"                    trustee_id \u003d trust[\u0027trustee_user_id\u0027]"},{"line_number":344,"context_line":"                trustee \u003d self.identity_api.get_user(trustee_id)"},{"line_number":345,"context_line":"                self.resource_api.assert_domain_enabled(trustee[\u0027domain_id\u0027])"},{"line_number":346,"context_line":""},{"line_number":347,"context_line":"            # V3 domain scope token"},{"line_number":348,"context_line":"            domain \u003d token_data.get(\u0027domain\u0027, {})"}],"source_content_type":"text/x-python","patch_set":25,"id":"fa69d971_fc97e78d","line":345,"updated":"2017-11-27 14:52:54.000000000","message":"You need to check this for trustor as well, and for redelegated trusts.","commit_id":"831351d631273c458e5e88e0b99d70647ceca1ff"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"c9f65e03ef1f96ace3c5a6e9413a1fdf631c21b0","unresolved":false,"context_lines":[{"line_number":335,"context_line":"                self.resource_api.assert_domain_enabled(user_domain[\u0027id\u0027])"},{"line_number":336,"context_line":""},{"line_number":337,"context_line":"            # Trust token, trustee domain enable check"},{"line_number":338,"context_line":"            trust \u003d token_data.get(\u0027trust\u0027, token_data.get(\u0027OS-TRUST:trust\u0027))"},{"line_number":339,"context_line":"            if trust:"},{"line_number":340,"context_line":"                if trust.get(\u0027trustee_user\u0027):"},{"line_number":341,"context_line":"                    trustee_id \u003d trust[\u0027trustee_user\u0027][\u0027id\u0027]"}],"source_content_type":"text/x-python","patch_set":26,"id":"fa69d971_fcde076c","line":338,"updated":"2016-01-04 15:52:47.000000000","message":"trustee is only one of the entities that you need to check;  trustor and any users in the redelgation of trusts chain.","commit_id":"2b42288d9ce686094f39d16e5afc180c460c53f1"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"3f760b5b70b732b67374fe6a2795d9cd656af183","unresolved":false,"context_lines":[{"line_number":254,"context_line":"            if project:"},{"line_number":255,"context_line":"                # Also verifies that a project\u0027s domain is enabled"},{"line_number":256,"context_line":"                self.resource_api.assert_project_enabled(project[\u0027id\u0027])"},{"line_number":257,"context_line":"        except AssertionError as e:"},{"line_number":258,"context_line":"            # Catch assertion errors from \u0027assert_domain_enabled\u0027 and"},{"line_number":259,"context_line":"            # \u0027assert_project_enabled\u0027 when a domain/project is disabled."},{"line_number":260,"context_line":"            raise exception.TokenNotFound(_(\u0027Invalid token: %s\u0027) % e)"}],"source_content_type":"text/x-python","patch_set":39,"id":"9f436f4f_12b83474","line":257,"updated":"2017-08-09 15:48:26.000000000","message":"This is a rather later try/except that accepts a general assertion error - we should consider scoping this down to prevent the handling of unwanted issues.","commit_id":"7fa42565c544f3d09b4c1934ae8401ac744c54e2"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"6b891533f827582f2953d69e51f976e6a3887181","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"@dependency.provider(\u0027token_provider_api\u0027)"},{"line_number":54,"context_line":"@dependency.requires(\u0027assignment_api\u0027, \u0027identity_api\u0027, \u0027resource_api\u0027,"},{"line_number":55,"context_line":"                     \u0027revoke_api\u0027)"},{"line_number":56,"context_line":"class Manager(manager.Manager):"},{"line_number":57,"context_line":"    \"\"\"Default pivot point for the token provider backend."}],"source_content_type":"text/x-python","patch_set":40,"id":"7f515b1d_a18f77cb","line":54,"range":{"start_line":54,"start_character":40,"end_line":54,"end_character":53},"updated":"2017-10-09 11:16:25.000000000","message":"this is not used","commit_id":"37d576409d95f332c6e893ef4f03a68f74342763"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9946d1ff6adbbd11ba9bccbd5925f3ca84f6d8da","unresolved":false,"context_lines":[{"line_number":218,"context_line":"        user_domain_id \u003d token_data.get(\u0027user\u0027, {}).get(\u0027domain\u0027, {}).get(\u0027id\u0027)"},{"line_number":219,"context_line":"        if project_id:"},{"line_number":220,"context_line":"            try:"},{"line_number":221,"context_line":"                project_ref \u003d self.resource_api.get_project(project_id)"},{"line_number":222,"context_line":"                if not project_ref[\u0027enabled\u0027]:"},{"line_number":223,"context_line":"                    # The project is disabled so the token is considered"},{"line_number":224,"context_line":"                    # invalid."}],"source_content_type":"text/x-python","patch_set":40,"id":"ff82abbf_6005e013","line":221,"updated":"2017-11-24 21:09:48.000000000","message":"It looks like this is already done here: \n\nhttps://github.com/openstack/keystone/blob/25b688e51de6bbdbb8d40eaabaf38cdd54a607ba/keystone/token/providers/common.py#L121","commit_id":"37d576409d95f332c6e893ef4f03a68f74342763"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9946d1ff6adbbd11ba9bccbd5925f3ca84f6d8da","unresolved":false,"context_lines":[{"line_number":228,"context_line":"                raise exception.TokenNotFound(msg)"},{"line_number":229,"context_line":"        if domain_id:"},{"line_number":230,"context_line":"            try:"},{"line_number":231,"context_line":"                self.resource_api.assert_domain_enabled(domain_id)"},{"line_number":232,"context_line":"            except AssertionError as e:"},{"line_number":233,"context_line":"                # If the domain is disabled, then the token is also considered"},{"line_number":234,"context_line":"                # invalid."}],"source_content_type":"text/x-python","patch_set":40,"id":"ff82abbf_4306a61f","line":231,"updated":"2017-11-24 21:09:48.000000000","message":"It looks like domains are also validated - https://github.com/openstack/keystone/blob/25b688e51de6bbdbb8d40eaabaf38cdd54a607ba/keystone/token/providers/common.py#L96","commit_id":"37d576409d95f332c6e893ef4f03a68f74342763"}],"keystone/token/providers/common.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9122af29e8ef36c9b2984579ffde522536ce92de","unresolved":false,"context_lines":[{"line_number":106,"context_line":"                \u0027disabled\u0027 % {\u0027id\u0027: domain_ref[\u0027id\u0027]}"},{"line_number":107,"context_line":"            )"},{"line_number":108,"context_line":"            LOG.warning(msg)"},{"line_number":109,"context_line":"            raise exception.TokenNotFound(msg)"},{"line_number":110,"context_line":"        return {\u0027id\u0027: domain_ref[\u0027id\u0027], \u0027name\u0027: domain_ref[\u0027name\u0027]}"},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"    def _get_filtered_project(self, project_id):"}],"source_content_type":"text/x-python","patch_set":42,"id":"ff82abbf_2365a21e","line":109,"updated":"2017-11-24 23:19:26.000000000","message":"This is tested here: \n\nhttps://github.com/openstack/keystone/blob/25b688e51de6bbdbb8d40eaabaf38cdd54a607ba/keystone/tests/unit/test_v3_auth.py#L840-L856","commit_id":"e87029c4449a04b45b1bed2306dc6e9556d1cf72"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9122af29e8ef36c9b2984579ffde522536ce92de","unresolved":false,"context_lines":[{"line_number":121,"context_line":"            msg \u003d _("},{"line_number":122,"context_line":"                \u0027Unable to validate token because project %(id)s is \u0027"},{"line_number":123,"context_line":"                \u0027disabled\u0027 % {\u0027id\u0027: project_ref[\u0027id\u0027]}"},{"line_number":124,"context_line":"            )"},{"line_number":125,"context_line":"            LOG.warning(msg)"},{"line_number":126,"context_line":"            raise exception.TokenNotFound(msg)"},{"line_number":127,"context_line":"        filtered_project \u003d {"}],"source_content_type":"text/x-python","patch_set":42,"id":"ff82abbf_436a26ee","line":124,"updated":"2017-11-24 23:19:26.000000000","message":"This is tested here:\n\nhttps://github.com/openstack/keystone/blob/25b688e51de6bbdbb8d40eaabaf38cdd54a607ba/keystone/tests/unit/test_v3_auth.py#L1212-L1224\n\nand here: \n\nhttps://github.com/openstack/keystone/blob/25b688e51de6bbdbb8d40eaabaf38cdd54a607ba/keystone/tests/unit/test_v3_auth.py#L2846-L2872","commit_id":"e87029c4449a04b45b1bed2306dc6e9556d1cf72"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"8c4a065d7edd250cde2bd21acee35197ad25fa15","unresolved":false,"context_lines":[{"line_number":104,"context_line":"            msg \u003d _(\u0027Unable to validate token because domain %(id)s is \u0027"},{"line_number":105,"context_line":"                    \u0027disabled\u0027) % {\u0027id\u0027: domain_ref[\u0027id\u0027]}"},{"line_number":106,"context_line":"            LOG.warning(msg)"},{"line_number":107,"context_line":"            raise exception.TokenNotFound(msg)"},{"line_number":108,"context_line":"        return {\u0027id\u0027: domain_ref[\u0027id\u0027], \u0027name\u0027: domain_ref[\u0027name\u0027]}"},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"    def _get_filtered_project(self, project_id):"}],"source_content_type":"text/x-python","patch_set":44,"id":"ff82abbf_6b6d9fca","line":107,"range":{"start_line":107,"start_character":12,"end_line":107,"end_character":46},"updated":"2017-11-27 22:35:44.000000000","message":"This should probably be a DomainNotFound error not \"TokenNotFound\" based upon line 102 raising DomainNotFound if the domain doesn\u0027t exist.\n\nDisabled is the same for all intents and purposes.","commit_id":"b9deddd0e7f38bcfc7508835139f0471c4973f90"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"13fc044533ec879cf61a84ac84fd6800d51ccd56","unresolved":false,"context_lines":[{"line_number":104,"context_line":"            msg \u003d _(\u0027Unable to validate token because domain %(id)s is \u0027"},{"line_number":105,"context_line":"                    \u0027disabled\u0027) % {\u0027id\u0027: domain_ref[\u0027id\u0027]}"},{"line_number":106,"context_line":"            LOG.warning(msg)"},{"line_number":107,"context_line":"            raise exception.TokenNotFound(msg)"},{"line_number":108,"context_line":"        return {\u0027id\u0027: domain_ref[\u0027id\u0027], \u0027name\u0027: domain_ref[\u0027name\u0027]}"},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"    def _get_filtered_project(self, project_id):"}],"source_content_type":"text/x-python","patch_set":44,"id":"ff82abbf_4b877bb6","line":107,"range":{"start_line":107,"start_character":12,"end_line":107,"end_character":46},"in_reply_to":"ff82abbf_6b6d9fca","updated":"2017-11-27 23:06:47.000000000","message":"Done","commit_id":"b9deddd0e7f38bcfc7508835139f0471c4973f90"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"8c4a065d7edd250cde2bd21acee35197ad25fa15","unresolved":false,"context_lines":[{"line_number":119,"context_line":"            msg \u003d _(\u0027Unable to validate token because project %(id)s is \u0027"},{"line_number":120,"context_line":"                    \u0027disabled\u0027) % {\u0027id\u0027: project_ref[\u0027id\u0027]}"},{"line_number":121,"context_line":"            LOG.warning(msg)"},{"line_number":122,"context_line":"            raise exception.TokenNotFound(msg)"},{"line_number":123,"context_line":"        filtered_project \u003d {"},{"line_number":124,"context_line":"            \u0027id\u0027: project_ref[\u0027id\u0027],"},{"line_number":125,"context_line":"            \u0027name\u0027: project_ref[\u0027name\u0027]}"}],"source_content_type":"text/x-python","patch_set":44,"id":"ff82abbf_8b7263ac","line":122,"range":{"start_line":122,"start_character":12,"end_line":122,"end_character":46},"updated":"2017-11-27 22:35:44.000000000","message":"See above comment, but ProjectNotFound","commit_id":"b9deddd0e7f38bcfc7508835139f0471c4973f90"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"13fc044533ec879cf61a84ac84fd6800d51ccd56","unresolved":false,"context_lines":[{"line_number":119,"context_line":"            msg \u003d _(\u0027Unable to validate token because project %(id)s is \u0027"},{"line_number":120,"context_line":"                    \u0027disabled\u0027) % {\u0027id\u0027: project_ref[\u0027id\u0027]}"},{"line_number":121,"context_line":"            LOG.warning(msg)"},{"line_number":122,"context_line":"            raise exception.TokenNotFound(msg)"},{"line_number":123,"context_line":"        filtered_project \u003d {"},{"line_number":124,"context_line":"            \u0027id\u0027: project_ref[\u0027id\u0027],"},{"line_number":125,"context_line":"            \u0027name\u0027: project_ref[\u0027name\u0027]}"}],"source_content_type":"text/x-python","patch_set":44,"id":"ff82abbf_eb8f6fca","line":122,"range":{"start_line":122,"start_character":12,"end_line":122,"end_character":46},"in_reply_to":"ff82abbf_8b7263ac","updated":"2017-11-27 23:06:47.000000000","message":"Done","commit_id":"b9deddd0e7f38bcfc7508835139f0471c4973f90"}],"releasenotes/notes/bug-1524030-0814724d5c2b7c8d.yaml":[{"author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"change_message_id":"8c03927ac54a704ab5dd553ae3a9ff8e4ab7b9ac","unresolved":false,"context_lines":[{"line_number":5,"context_line":"    Revocation records are no longer written to the ``revocation_event`` table"},{"line_number":6,"context_line":"    when a domain or project is disabled. These records were only ever used"},{"line_number":7,"context_line":"    during the token validation process. In favor of revocation events, the"},{"line_number":8,"context_line":"    project or domain will be validated online when the token is validate. This"},{"line_number":9,"context_line":"    results in less database bloat while maintaining security during token"},{"line_number":10,"context_line":"    validation."}],"source_content_type":"text/x-yaml","patch_set":43,"id":"ff82abbf_18b5567e","line":8,"range":{"start_line":8,"start_character":65,"end_line":8,"end_character":73},"updated":"2017-11-27 15:32:30.000000000","message":"/validate/validated/","commit_id":"645a6d7902458f15006c697546668d3391144064"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"8ffc6f66c8dc9f4f50852f5bcb5dcd478639011e","unresolved":false,"context_lines":[{"line_number":5,"context_line":"    Revocation records are no longer written to the ``revocation_event`` table"},{"line_number":6,"context_line":"    when a domain or project is disabled. These records were only ever used"},{"line_number":7,"context_line":"    during the token validation process. In favor of revocation events, the"},{"line_number":8,"context_line":"    project or domain will be validated online when the token is validate. This"},{"line_number":9,"context_line":"    results in less database bloat while maintaining security during token"},{"line_number":10,"context_line":"    validation."}],"source_content_type":"text/x-yaml","patch_set":43,"id":"ff82abbf_5f541d53","line":8,"range":{"start_line":8,"start_character":65,"end_line":8,"end_character":73},"in_reply_to":"ff82abbf_18b5567e","updated":"2017-11-27 20:27:46.000000000","message":"Done","commit_id":"645a6d7902458f15006c697546668d3391144064"}],"releasenotes/notes/bug-1524030-ccff6b0ec9d1cbf2.yaml":[{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"6b891533f827582f2953d69e51f976e6a3887181","unresolved":false,"context_lines":[{"line_number":8,"context_line":"    longer persists revocation events for disabled domains and projects."},{"line_number":9,"context_line":"    Instead, the domain or project referenced in a token\u0027s scope is checked"},{"line_number":10,"context_line":"    during token validation to see if it is enabled. This reduces the number"},{"line_number":11,"context_line":"    of events in the revocation API backend."},{"line_number":12,"context_line":"other:"},{"line_number":13,"context_line":"  - \u003e"},{"line_number":14,"context_line":"    [`bug 1524030 \u003chttps://bugs.launchpad.net/keystone/+bug/1524030\u003e`_]"}],"source_content_type":"text/x-yaml","patch_set":40,"id":"7f515b1d_01bacb6c","line":11,"updated":"2017-10-09 11:16:25.000000000","message":"I think at this point we better have a new release note (for the new cycle)","commit_id":"37d576409d95f332c6e893ef4f03a68f74342763"}]}