)]}'
{"etc/policy.json":[{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"42ce92552b70f62ea17a18c0b6a52a30e47815cc","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"admin_required\": \"role:admin and is_admin_project:True\","},{"line_number":3,"context_line":"    \"service_role\": \"role:service and is_admin_project:True\","},{"line_number":4,"context_line":"    \"service_or_admin\": \"rule:admin_required or rule:service_role\","},{"line_number":5,"context_line":"    \"owner\" : \"user_id:%(user_id)s\","},{"line_number":6,"context_line":"    \"admin_or_owner\": \"rule:admin_required or rule:owner\","}],"source_content_type":"application/json","patch_set":9,"id":"1a6eadb0_0a61aba8","line":3,"range":{"start_line":3,"start_character":0,"end_line":3,"end_character":61},"updated":"2016-12-20 02:50:14.000000000","message":"why does the service role needs to be in the admin project ?","commit_id":"36e6ffd8170fc0b0eb36aff8d648b9da6bfbdd6e"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"731882290ba8c70ab910214c6c33d74f7330430f","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"admin_required\": \"role:admin and is_admin_project:True\","},{"line_number":3,"context_line":"    \"service_role\": \"role:service and is_admin_project:True\","},{"line_number":4,"context_line":"    \"service_or_admin\": \"rule:admin_required or rule:service_role\","},{"line_number":5,"context_line":"    \"owner\" : \"user_id:%(user_id)s\","},{"line_number":6,"context_line":"    \"admin_or_owner\": \"rule:admin_required or rule:owner\","}],"source_content_type":"application/json","patch_set":9,"id":"ba5201f7_48da8a18","line":3,"range":{"start_line":3,"start_character":0,"end_line":3,"end_character":61},"in_reply_to":"1a6eadb0_0a61aba8","updated":"2017-01-05 11:16:26.000000000","message":"Just as with the admin role, this is a global assignment, with special privs:  to validate tokens, regardless of the token\u0027s project.","commit_id":"36e6ffd8170fc0b0eb36aff8d648b9da6bfbdd6e"}],"keystone/common/policies/base.py":[{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"a707113d6a0f8ac0148930a7aff32219aa1f556b","unresolved":false,"context_lines":[{"line_number":13,"context_line":"from oslo_policy import policy"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"IDENTITY \u003d \u0027identity:%s\u0027"},{"line_number":16,"context_line":"RULE_ADMIN_REQUIRED \u003d \u0027(rule:admin_required and is_admin_project:True)\u0027"},{"line_number":17,"context_line":"RULE_ADMIN_OR_OWNER \u003d \u0027rule:admin_or_owner\u0027"},{"line_number":18,"context_line":"RULE_ADMIN_OR_CREDENTIAL_OWNER \u003d ("},{"line_number":19,"context_line":"    \u0027rule:admin_required or \u0027"}],"source_content_type":"text/x-python","patch_set":20,"id":"5ff73747_13c3f658","line":16,"updated":"2017-04-28 20:40:37.000000000","message":"Absolutely not. That\u0027s a nasty, nasty hack. Fix it right, not quick and dirty and hard to maintain or understand.\n\nIt is also wrong to start requiring is_admin_project:True for all things that require admin access. Some things only require being an admin. Other things only require being an admin plus checking that you\u0027re scoped to the right project OR is_admin_project:True. Other things require being an admin AND is_admin_project:True. This is not an across-the-board situation.","commit_id":"e2f7ca81d42b501fa57c29d94b6ae54dfc4b1280"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"bff27fec5af6af44e5decae62d248f4c263d978f","unresolved":false,"context_lines":[{"line_number":13,"context_line":"from oslo_policy import policy"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"IDENTITY \u003d \u0027identity:%s\u0027"},{"line_number":16,"context_line":"RULE_ADMIN_REQUIRED \u003d \u0027(rule:admin_required and is_admin_project:True)\u0027"},{"line_number":17,"context_line":"RULE_ADMIN_OR_OWNER \u003d \u0027rule:admin_or_owner\u0027"},{"line_number":18,"context_line":"RULE_ADMIN_OR_CREDENTIAL_OWNER \u003d ("},{"line_number":19,"context_line":"    \u0027rule:admin_required or \u0027"}],"source_content_type":"text/x-python","patch_set":20,"id":"5ff73747_9336e650","line":16,"in_reply_to":"5ff73747_13c3f658","updated":"2017-09-29 20:06:26.000000000","message":"Please stop reviewing these.  You are only doing harm.  If you are willing to do the work to actually fix this, fine. If not, then you should not be holding up the bug fix.\n\nThis is absolutely the right fix for the way the default policy file was defined before.\n\nThere is nothing that is project-specific policy inside keystone.","commit_id":"e2f7ca81d42b501fa57c29d94b6ae54dfc4b1280"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"3e05665d910fad3afaf41d1589f9715185b9ad76","unresolved":false,"context_lines":[{"line_number":13,"context_line":"from oslo_policy import policy"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"IDENTITY \u003d \u0027identity:%s\u0027"},{"line_number":16,"context_line":"RULE_ADMIN_REQUIRED \u003d \u0027(rule:admin_required and is_admin_project:True)\u0027"},{"line_number":17,"context_line":"RULE_ADMIN_OR_OWNER \u003d \u0027rule:admin_or_owner\u0027"},{"line_number":18,"context_line":"RULE_ADMIN_OR_CREDENTIAL_OWNER \u003d ("},{"line_number":19,"context_line":"    \u0027rule:admin_required or \u0027"}],"source_content_type":"text/x-python","patch_set":24,"id":"5ff73747_dafb3f44","line":16,"updated":"2017-05-01 23:52:29.000000000","message":"In addition to my comments from patch set 20 (which still apply), I\u0027ve noticed that this doesn\u0027t help with any of the other rules that involve admin checks. E.g. get_user checks RULE_ADMIN_OR_OWNER, which doesn\u0027t check is_admin_project, so any admin can get_user for any user.","commit_id":"3c19f7218059573bb35887f6c40c5f68c0c94059"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"0f8b62e178ad8819d7b91485fdb6211e7bda0cc2","unresolved":false,"context_lines":[{"line_number":38,"context_line":"        check_str\u003d\u0027role:admin or is_admin:1\u0027),"},{"line_number":39,"context_line":"    policy.RuleDefault("},{"line_number":40,"context_line":"        name\u003d\u0027service_role\u0027,"},{"line_number":41,"context_line":"        check_str\u003d\u0027(role:service and is_admin_project:True)\u0027),"},{"line_number":42,"context_line":"    policy.RuleDefault("},{"line_number":43,"context_line":"        name\u003d\u0027service_or_admin\u0027,"},{"line_number":44,"context_line":"        check_str\u003d\u0027rule:admin_required or rule:service_role\u0027),"}],"source_content_type":"text/x-python","patch_set":33,"id":"7f515b1d_84f22299","line":41,"updated":"2017-09-29 02:10:19.000000000","message":"This doesn\u0027t seem right to me. Why would i have the service role on the admin_project? I would love to see more roles used on admin_project, but i don\u0027t anticipate much use for service.\n\nAlso i see that sam brought this up in patch #9.","commit_id":"1e3177b3e9a90f5987ebfabbdae9c7853cc665cf"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"bff27fec5af6af44e5decae62d248f4c263d978f","unresolved":false,"context_lines":[{"line_number":38,"context_line":"        check_str\u003d\u0027role:admin or is_admin:1\u0027),"},{"line_number":39,"context_line":"    policy.RuleDefault("},{"line_number":40,"context_line":"        name\u003d\u0027service_role\u0027,"},{"line_number":41,"context_line":"        check_str\u003d\u0027(role:service and is_admin_project:True)\u0027),"},{"line_number":42,"context_line":"    policy.RuleDefault("},{"line_number":43,"context_line":"        name\u003d\u0027service_or_admin\u0027,"},{"line_number":44,"context_line":"        check_str\u003d\u0027rule:admin_required or rule:service_role\u0027),"}],"source_content_type":"text/x-python","patch_set":33,"id":"7f515b1d_b59adc5e","line":41,"in_reply_to":"7f515b1d_84f22299","updated":"2017-09-29 20:06:26.000000000","message":"Because the service role is used to do non-project scoped operations, namely to validate a token, and that is really not something that should be delegated by a project admin.\n\n$ grep -rni RULE_SERVICE_OR_ADMIN keystone/* \nBinary file keystone/common/policies/token_revocation.pyc matches\nkeystone/common/policies/token_revocation.py:20:        check_str\u003dbase.RULE_SERVICE_OR_ADMIN,\nkeystone/common/policies/base.py:31:RULE_SERVICE_OR_ADMIN \u003d \u0027rule:service_or_admin\u0027\nBinary file keystone/common/policies/base.pyc matches\nkeystone/common/policies/revoke_event.py:20:        check_str\u003dbase.RULE_SERVICE_OR_ADMIN,\nBinary file keystone/common/policies/revoke_event.pyc matches\nkeystone/common/policies/token.py:34:        check_str\u003dbase.RULE_SERVICE_OR_ADMIN,","commit_id":"1e3177b3e9a90f5987ebfabbdae9c7853cc665cf"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"2d5942dae4323d7e9cddad62a19158471a18f786","unresolved":false,"context_lines":[{"line_number":38,"context_line":"        check_str\u003d\u0027role:admin or is_admin:1\u0027),"},{"line_number":39,"context_line":"    policy.RuleDefault("},{"line_number":40,"context_line":"        name\u003d\u0027service_role\u0027,"},{"line_number":41,"context_line":"        check_str\u003d\u0027(role:service and is_admin_project:True)\u0027),"},{"line_number":42,"context_line":"    policy.RuleDefault("},{"line_number":43,"context_line":"        name\u003d\u0027service_or_admin\u0027,"},{"line_number":44,"context_line":"        check_str\u003d\u0027rule:admin_required or rule:service_role\u0027),"}],"source_content_type":"text/x-python","patch_set":33,"id":"7f515b1d_fb3965a3","line":41,"in_reply_to":"7f515b1d_b59adc5e","updated":"2017-09-29 21:37:16.000000000","message":"hmm, agreed that admin seems like an escape hatch there - basically just let admins do all the things. \n\nI agree on the service role not being a project scoped op, my concern is how many people we\u0027d break flipping that switch. Most installers i\u0027ve seen will create a services project and add the services role to it. We would need to fix everything immediately to use is_admin_project with that. \n\nMy point is not that you\u0027re wrong on this, but that if you split this debate out into another review I think we can merge the rest which will be the bigger win as deployments are pretty careful with the service role.","commit_id":"1e3177b3e9a90f5987ebfabbdae9c7853cc665cf"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"c13dd392804627b2fcf2455e486d777b09daad28","unresolved":false,"context_lines":[{"line_number":14,"context_line":""},{"line_number":15,"context_line":"IDENTITY \u003d \u0027identity:%s\u0027"},{"line_number":16,"context_line":"RULE_ADMIN_REQUIRED \u003d \u0027rule:admin_required\u0027"},{"line_number":17,"context_line":"RULE_ADMIN_PROJECT_REQUIRED \u003d \u0027(rule:admin_required and is_admin_project:True)\u0027"},{"line_number":18,"context_line":"RULE_ADMIN_OR_OWNER \u003d \u0027rule:admin_or_owner\u0027"},{"line_number":19,"context_line":"RULE_ADMIN_OR_CREDENTIAL_OWNER \u003d ("},{"line_number":20,"context_line":"    \u0027rule:admin_required or \u0027"}],"source_content_type":"text/x-python","patch_set":34,"id":"1f485f77_b0b9cc79","line":17,"updated":"2017-11-17 21:39:11.000000000","message":"I think it has to be token.is_admin_project:True","commit_id":"ec443e247d299123a6ae8ed9e30423b0c3683bdb"}],"keystone/common/policies/domain.py":[{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"3e05665d910fad3afaf41d1589f9715185b9ad76","unresolved":false,"context_lines":[{"line_number":21,"context_line":"        description\u003d\u0027Show domain details.\u0027,"},{"line_number":22,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027/v3/domains/{domain_id}\u0027,"},{"line_number":23,"context_line":"                     \u0027method\u0027: \u0027GET\u0027}]),"},{"line_number":24,"context_line":"    # TODO(ayoung): This is probably wrong, but Tempest is"},{"line_number":25,"context_line":"    # currently requiring it."},{"line_number":26,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":27,"context_line":"        name\u003dbase.IDENTITY % \u0027list_domains\u0027,"}],"source_content_type":"text/x-python","patch_set":24,"id":"5ff73747_1a62c70a","line":24,"updated":"2017-05-01 23:52:29.000000000","message":"this is clearly wrong. If it\u0027s necessary to get a patch into tempest before we can fix keystone, then so be it.","commit_id":"3c19f7218059573bb35887f6c40c5f68c0c94059"}],"keystone/common/policies/project.py":[{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"3e05665d910fad3afaf41d1589f9715185b9ad76","unresolved":false,"context_lines":[{"line_number":33,"context_line":"        description\u003d\u0027List projects for user.\u0027,"},{"line_number":34,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027/v3/users/{user_id}/projects\u0027,"},{"line_number":35,"context_line":"                     \u0027method\u0027: \u0027GET\u0027}]),"},{"line_number":36,"context_line":"    # TODO(ayoung): This needs a proper scope check"},{"line_number":37,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":38,"context_line":"        name\u003dbase.IDENTITY % \u0027create_project\u0027,"},{"line_number":39,"context_line":"        check_str\u003d\u0027role:admin or is_admin:1\u0027,"}],"source_content_type":"text/x-python","patch_set":24,"id":"5ff73747_3a3c63df","line":36,"updated":"2017-05-01 23:52:29.000000000","message":"... and that should be the point of this fix... so why aren\u0027t we adding one?","commit_id":"3c19f7218059573bb35887f6c40c5f68c0c94059"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"3e05665d910fad3afaf41d1589f9715185b9ad76","unresolved":false,"context_lines":[{"line_number":36,"context_line":"    # TODO(ayoung): This needs a proper scope check"},{"line_number":37,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":38,"context_line":"        name\u003dbase.IDENTITY % \u0027create_project\u0027,"},{"line_number":39,"context_line":"        check_str\u003d\u0027role:admin or is_admin:1\u0027,"},{"line_number":40,"context_line":"        description\u003d\u0027Create project.\u0027,"},{"line_number":41,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027/v3/projects\u0027,"},{"line_number":42,"context_line":"                     \u0027method\u0027: \u0027POST\u0027}]),"}],"source_content_type":"text/x-python","patch_set":24,"id":"5ff73747_7a366b05","line":39,"updated":"2017-05-01 23:52:29.000000000","message":"changing the default, even to something that is equivalent to the previous default, is going to confuse folks.","commit_id":"3c19f7218059573bb35887f6c40c5f68c0c94059"}],"keystone/identity/controllers.py":[{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"a707113d6a0f8ac0148930a7aff32219aa1f556b","unresolved":false,"context_lines":[{"line_number":216,"context_line":"        ref \u003d self._normalize_domain_id(request, ref)"},{"line_number":217,"context_line":"        kwargs \u003d {\u0027user\u0027: ref}"},{"line_number":218,"context_line":"        args \u003d [self, request, ref]"},{"line_number":219,"context_line":"        validation.lazy_validate(schema.user_create, ref)"},{"line_number":220,"context_line":"        # The manager layer will generate the unique ID for users"},{"line_number":221,"context_line":""},{"line_number":222,"context_line":"        authorization.check_protection2("}],"source_content_type":"text/x-python","patch_set":20,"id":"5ff73747_53c17fe4","line":219,"updated":"2017-04-28 20:40:37.000000000","message":"move this up 2 lines... kwargs and args aren\u0027t needed for this.","commit_id":"e2f7ca81d42b501fa57c29d94b6ae54dfc4b1280"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"a707113d6a0f8ac0148930a7aff32219aa1f556b","unresolved":false,"context_lines":[{"line_number":217,"context_line":"        kwargs \u003d {\u0027user\u0027: ref}"},{"line_number":218,"context_line":"        args \u003d [self, request, ref]"},{"line_number":219,"context_line":"        validation.lazy_validate(schema.user_create, ref)"},{"line_number":220,"context_line":"        # The manager layer will generate the unique ID for users"},{"line_number":221,"context_line":""},{"line_number":222,"context_line":"        authorization.check_protection2("},{"line_number":223,"context_line":"            self, request, \u0027create_user\u0027,"}],"source_content_type":"text/x-python","patch_set":20,"id":"5ff73747_d3b46f82","line":220,"updated":"2017-04-28 20:40:37.000000000","message":"this comment now seems out of place. Has nothing to do with what\u0027s immediately before or after it.","commit_id":"e2f7ca81d42b501fa57c29d94b6ae54dfc4b1280"}],"keystone/models/token_model.py":[{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"7334a17925acba61f9aa81261c569414f11bbb93","unresolved":false,"context_lines":[{"line_number":199,"context_line":"            return False"},{"line_number":200,"context_line":"        # Note that this is essential to fixing the real bug, and should not"},{"line_number":201,"context_line":"        # be defaulting to False.  Do not change this until we can assume"},{"line_number":202,"context_line":"        # admin_project is actually set"},{"line_number":203,"context_line":"        return self.get(\u0027is_admin_project\u0027, True)"},{"line_number":204,"context_line":""},{"line_number":205,"context_line":"    @property"}],"source_content_type":"text/x-python","patch_set":21,"id":"5ff73747_5653ac6b","line":202,"updated":"2017-04-28 21:29:28.000000000","message":"still need a TODO here, so that we do remember to change it later. And we should explain why it is essential to fixing the bug, i.e. that is_admin_project has to default to True if an admin_project isn\u0027t configured, so that we can add checks for is_admin_project:True and not have them block folks that haven\u0027t configured an admin_project.","commit_id":"bbb9d20da03c1d19f445c08eee01c5689a938060"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"67fc5aef890debd32247f5ca65257f0cf767c0c9","unresolved":false,"context_lines":[{"line_number":199,"context_line":"            return False"},{"line_number":200,"context_line":"        # Note that this is essential to fixing the real bug, and should not"},{"line_number":201,"context_line":"        # be defaulting to False.  Do not change this until we can assume"},{"line_number":202,"context_line":"        # admin_project is actually set"},{"line_number":203,"context_line":"        return self.get(\u0027is_admin_project\u0027, True)"},{"line_number":204,"context_line":""},{"line_number":205,"context_line":"    @property"}],"source_content_type":"text/x-python","patch_set":21,"id":"3f044301_3fec9f8d","line":202,"in_reply_to":"5ff73747_5653ac6b","updated":"2017-05-11 14:49:55.000000000","message":"This is done in: https://review.openstack.org/#/c/464009/","commit_id":"bbb9d20da03c1d19f445c08eee01c5689a938060"}],"keystone/resource/controllers.py":[{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"a707113d6a0f8ac0148930a7aff32219aa1f556b","unresolved":false,"context_lines":[{"line_number":256,"context_line":"        try:"},{"line_number":257,"context_line":"            domain_id \u003d project[\u0027domain_id\u0027]"},{"line_number":258,"context_line":"        except KeyError:"},{"line_number":259,"context_line":"            domain_id \u003d request.context.domain_id"},{"line_number":260,"context_line":"            if domain_id is None:"},{"line_number":261,"context_line":"                domain_id \u003d CONF.identity.default_domain_id"},{"line_number":262,"context_line":"            project[\u0027domain_id\u0027] \u003d domain_id"}],"source_content_type":"text/x-python","patch_set":20,"id":"5ff73747_13089725","line":259,"updated":"2017-04-28 20:40:37.000000000","message":"only keep trying to pick a domain_id if not project.get(\u0027is_domain\u0027, False) so that the default behavior when creating a new domain is that it doesn\u0027t have a parent.","commit_id":"e2f7ca81d42b501fa57c29d94b6ae54dfc4b1280"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"a707113d6a0f8ac0148930a7aff32219aa1f556b","unresolved":false,"context_lines":[{"line_number":257,"context_line":"            domain_id \u003d project[\u0027domain_id\u0027]"},{"line_number":258,"context_line":"        except KeyError:"},{"line_number":259,"context_line":"            domain_id \u003d request.context.domain_id"},{"line_number":260,"context_line":"            if domain_id is None:"},{"line_number":261,"context_line":"                domain_id \u003d CONF.identity.default_domain_id"},{"line_number":262,"context_line":"            project[\u0027domain_id\u0027] \u003d domain_id"},{"line_number":263,"context_line":""}],"source_content_type":"text/x-python","patch_set":20,"id":"5ff73747_3837f001","line":260,"updated":"2017-04-28 20:40:37.000000000","message":"should also support the case that you have a project-scoped token and want to create the new project in the same domain as the current project. I didn\u0027t check, but wouldn\u0027t request.context.domain_id be None in that case?","commit_id":"e2f7ca81d42b501fa57c29d94b6ae54dfc4b1280"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"a707113d6a0f8ac0148930a7aff32219aa1f556b","unresolved":false,"context_lines":[{"line_number":258,"context_line":"        except KeyError:"},{"line_number":259,"context_line":"            domain_id \u003d request.context.domain_id"},{"line_number":260,"context_line":"            if domain_id is None:"},{"line_number":261,"context_line":"                domain_id \u003d CONF.identity.default_domain_id"},{"line_number":262,"context_line":"            project[\u0027domain_id\u0027] \u003d domain_id"},{"line_number":263,"context_line":""},{"line_number":264,"context_line":"        validation.lazy_validate(schema.project_create, project)"}],"source_content_type":"text/x-python","patch_set":20,"id":"5ff73747_b87420d0","line":261,"range":{"start_line":261,"start_character":42,"end_line":261,"end_character":59},"updated":"2017-04-28 20:40:37.000000000","message":"I believe we\u0027re trying to get rid of default_domain_id, not start using it in more places...","commit_id":"e2f7ca81d42b501fa57c29d94b6ae54dfc4b1280"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"bff27fec5af6af44e5decae62d248f4c263d978f","unresolved":false,"context_lines":[{"line_number":258,"context_line":"        except KeyError:"},{"line_number":259,"context_line":"            domain_id \u003d request.context.domain_id"},{"line_number":260,"context_line":"            if domain_id is None:"},{"line_number":261,"context_line":"                domain_id \u003d CONF.identity.default_domain_id"},{"line_number":262,"context_line":"            project[\u0027domain_id\u0027] \u003d domain_id"},{"line_number":263,"context_line":""},{"line_number":264,"context_line":"        validation.lazy_validate(schema.project_create, project)"}],"source_content_type":"text/x-python","patch_set":20,"id":"5ff73747_5353be6b","line":261,"range":{"start_line":261,"start_character":42,"end_line":261,"end_character":59},"in_reply_to":"5ff73747_b87420d0","updated":"2017-09-29 20:06:26.000000000","message":"No choice here.","commit_id":"e2f7ca81d42b501fa57c29d94b6ae54dfc4b1280"}]}