)]}'
{"keystone/assignment/core.py":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"9d95d6d459cde778c68e7124d363ef3a99d9e585","unresolved":false,"context_lines":[{"line_number":822,"context_line":"                ref, user_id, project_id, subtree_ids, expand_groups)"},{"line_number":823,"context_line":""},{"line_number":824,"context_line":"        refs \u003d self._add_implied_roles(refs)"},{"line_number":825,"context_line":"        if role_id:"},{"line_number":826,"context_line":"            refs \u003d self._filter_by_role_id(role_id, refs)"},{"line_number":827,"context_line":""},{"line_number":828,"context_line":"        return refs"}],"source_content_type":"text/x-python","patch_set":15,"id":"3a57f1b5_104bd0b1","side":"PARENT","line":825,"range":{"start_line":825,"start_character":8,"end_line":825,"end_character":19},"updated":"2016-02-11 07:56:14.000000000","message":"why change this?","commit_id":"7bca1518df7323ce461161f98c035516f6bf07f5"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"1fe5ba293366ad2fcd2d07fdfc53b51c3b3afc07","unresolved":false,"context_lines":[{"line_number":822,"context_line":"                ref, user_id, project_id, subtree_ids, expand_groups)"},{"line_number":823,"context_line":""},{"line_number":824,"context_line":"        refs \u003d self._add_implied_roles(refs)"},{"line_number":825,"context_line":"        if role_id:"},{"line_number":826,"context_line":"            refs \u003d self._filter_by_role_id(role_id, refs)"},{"line_number":827,"context_line":""},{"line_number":828,"context_line":"        return refs"}],"source_content_type":"text/x-python","patch_set":15,"id":"3a57f1b5_e8986bc2","side":"PARENT","line":825,"range":{"start_line":825,"start_character":8,"end_line":825,"end_character":19},"in_reply_to":"3a57f1b5_104bd0b1","updated":"2016-02-11 17:34:34.000000000","message":"since we are going to go through all the refs throwing out any domain specific roles, we can (for efficiency) comibine that loop with filtering by role","commit_id":"7bca1518df7323ce461161f98c035516f6bf07f5"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"09c9edd51964bc2d8ed446072bfacc2a18754ac3","unresolved":false,"context_lines":[{"line_number":662,"context_line":"        and since that has been done before this method is called, we need to"},{"line_number":663,"context_line":"        remove any assignments that include a domain role. In addition, if"},{"line_number":664,"context_line":"        role_id is specified, this means that we should only return any"},{"line_number":665,"context_line":"        assignment refs that include this role."},{"line_number":666,"context_line":""},{"line_number":667,"context_line":"        \"\"\""},{"line_number":668,"context_line":"        def _role_is_global(role_id):"}],"source_content_type":"text/x-python","patch_set":15,"id":"3a57f1b5_06c5fd8c","line":665,"updated":"2016-02-10 17:15:52.000000000","message":"If we have R1 -\u003e R2 -\u003e R3, then a user U with R1 on a project P would get, from effective call:\n\n    U, P, R1\n    U, P, R2\n    U, P, R3\n\nMeaning that implied roles are included in the token. However, domain specific roles can\u0027t be in the token as they don\u0027t appear in the policy (as they aren\u0027t global). Is this correct ?","commit_id":"799421a71308389f2a4e59eb1da72d164fb807c9"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"9d95d6d459cde778c68e7124d363ef3a99d9e585","unresolved":false,"context_lines":[{"line_number":662,"context_line":"        and since that has been done before this method is called, we need to"},{"line_number":663,"context_line":"        remove any assignments that include a domain role. In addition, if"},{"line_number":664,"context_line":"        role_id is specified, this means that we should only return any"},{"line_number":665,"context_line":"        assignment refs that include this role."},{"line_number":666,"context_line":""},{"line_number":667,"context_line":"        \"\"\""},{"line_number":668,"context_line":"        def _role_is_global(role_id):"}],"source_content_type":"text/x-python","patch_set":15,"id":"3a57f1b5_700d648f","line":665,"in_reply_to":"3a57f1b5_06c5fd8c","updated":"2016-02-11 07:56:14.000000000","message":"that sounds correct to me...","commit_id":"799421a71308389f2a4e59eb1da72d164fb807c9"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"1fe5ba293366ad2fcd2d07fdfc53b51c3b3afc07","unresolved":false,"context_lines":[{"line_number":662,"context_line":"        and since that has been done before this method is called, we need to"},{"line_number":663,"context_line":"        remove any assignments that include a domain role. In addition, if"},{"line_number":664,"context_line":"        role_id is specified, this means that we should only return any"},{"line_number":665,"context_line":"        assignment refs that include this role."},{"line_number":666,"context_line":""},{"line_number":667,"context_line":"        \"\"\""},{"line_number":668,"context_line":"        def _role_is_global(role_id):"}],"source_content_type":"text/x-python","patch_set":15,"id":"3a57f1b5_c6aa8519","line":665,"in_reply_to":"3a57f1b5_06c5fd8c","updated":"2016-02-11 17:34:34.000000000","message":"yep, that is correct. Say R1 was a domain specific role, then only R2 and R3 would end up in the token","commit_id":"799421a71308389f2a4e59eb1da72d164fb807c9"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"09c9edd51964bc2d8ed446072bfacc2a18754ac3","unresolved":false,"context_lines":[{"line_number":897,"context_line":"        only supported in effective mode (since in regular mode there is no"},{"line_number":898,"context_line":"        difference between this and a group filter, other than it is a list of"},{"line_number":899,"context_line":"        groups)."},{"line_number":900,"context_line":""},{"line_number":901,"context_line":"        If OS-INHERIT extension is disabled or the used driver does not support"},{"line_number":902,"context_line":"        inherited roles retrieval, inherited role assignments will be ignored."},{"line_number":903,"context_line":""}],"source_content_type":"text/x-python","patch_set":15,"id":"3a57f1b5_86ffad00","line":900,"updated":"2016-02-10 17:15:52.000000000","message":"Maybe add some doc on domain roles here ?","commit_id":"799421a71308389f2a4e59eb1da72d164fb807c9"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"1fe5ba293366ad2fcd2d07fdfc53b51c3b3afc07","unresolved":false,"context_lines":[{"line_number":897,"context_line":"        only supported in effective mode (since in regular mode there is no"},{"line_number":898,"context_line":"        difference between this and a group filter, other than it is a list of"},{"line_number":899,"context_line":"        groups)."},{"line_number":900,"context_line":""},{"line_number":901,"context_line":"        If OS-INHERIT extension is disabled or the used driver does not support"},{"line_number":902,"context_line":"        inherited roles retrieval, inherited role assignments will be ignored."},{"line_number":903,"context_line":""}],"source_content_type":"text/x-python","patch_set":15,"id":"3a57f1b5_e8df0b67","line":900,"in_reply_to":"3a57f1b5_86ffad00","updated":"2016-02-11 17:34:34.000000000","message":"I didn\u0027t on the basis that we don\u0027t mention implied roles either!","commit_id":"799421a71308389f2a4e59eb1da72d164fb807c9"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"dff00d3549f317a7e704d445d9d64ab1de94d981","unresolved":false,"context_lines":[{"line_number":672,"context_line":"        filter_results \u003d []"},{"line_number":673,"context_line":"        for ref in ref_results:"},{"line_number":674,"context_line":"            if (_role_is_global(ref[\u0027role_id\u0027]) and"},{"line_number":675,"context_line":"                    (not role_id or ref[\u0027role_id\u0027] \u003d\u003d role_id)):"},{"line_number":676,"context_line":"                filter_results.append(ref)"},{"line_number":677,"context_line":"        return filter_results"},{"line_number":678,"context_line":""}],"source_content_type":"text/x-python","patch_set":16,"id":"3a57f1b5_30681387","line":675,"range":{"start_line":675,"start_character":20,"end_line":675,"end_character":62},"updated":"2016-02-12 02:47:32.000000000","message":"suggest moving this part to the front to short-circuit the evaluation so it may saved us a potential DB read in _role_is_global().","commit_id":"66c83f9621a8074c86fa37958b5225f8898df3b1"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"33f9c0dcda31f30424fb8da2f0b4be6cbc6c4f17","unresolved":false,"context_lines":[{"line_number":672,"context_line":"        filter_results \u003d []"},{"line_number":673,"context_line":"        for ref in ref_results:"},{"line_number":674,"context_line":"            if (_role_is_global(ref[\u0027role_id\u0027]) and"},{"line_number":675,"context_line":"                    (not role_id or ref[\u0027role_id\u0027] \u003d\u003d role_id)):"},{"line_number":676,"context_line":"                filter_results.append(ref)"},{"line_number":677,"context_line":"        return filter_results"},{"line_number":678,"context_line":""}],"source_content_type":"text/x-python","patch_set":16,"id":"3a57f1b5_1832d95f","line":675,"range":{"start_line":675,"start_character":20,"end_line":675,"end_character":62},"in_reply_to":"3a57f1b5_30681387","updated":"2016-02-12 08:58:07.000000000","message":"Done","commit_id":"66c83f9621a8074c86fa37958b5225f8898df3b1"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"6218bc7c68c1289981b63a4b92fcd7e249264195","unresolved":false,"context_lines":[{"line_number":673,"context_line":"        \"\"\""},{"line_number":674,"context_line":"        def _role_is_global(role_id):"},{"line_number":675,"context_line":"            ref \u003d self.role_api.get_role(role_id)"},{"line_number":676,"context_line":"            return (ref[\u0027domain_id\u0027] is None)"},{"line_number":677,"context_line":""},{"line_number":678,"context_line":"        filter_results \u003d []"},{"line_number":679,"context_line":"        for ref in role_refs:"}],"source_content_type":"text/x-python","patch_set":19,"id":"dae33548_fd5062d6","line":676,"range":{"start_line":676,"start_character":19,"end_line":676,"end_character":45},"updated":"2016-02-17 08:07:14.000000000","message":"braces are unnecessary","commit_id":"a270766eb9c3f2074af550a72661a6a825e9975b"},{"author":{"_account_id":10046,"name":"Henrique Truta","email":"henrique@lsd.ufcg.edu.br","username":"henriquetruta"},"change_message_id":"633accf3f62e07eef3b2899dde39cad9ad5db4cf","unresolved":false,"context_lines":[{"line_number":675,"context_line":"            ref \u003d self.role_api.get_role(role_id)"},{"line_number":676,"context_line":"            return (ref[\u0027domain_id\u0027] is None)"},{"line_number":677,"context_line":""},{"line_number":678,"context_line":"        filter_results \u003d []"},{"line_number":679,"context_line":"        for ref in role_refs:"},{"line_number":680,"context_line":"            if _role_is_global(ref[\u0027role_id\u0027]):"},{"line_number":681,"context_line":"                filter_results.append(ref)"}],"source_content_type":"text/x-python","patch_set":19,"id":"dae33548_ec03a940","line":678,"updated":"2016-02-16 20:14:29.000000000","message":"nit: rename it to filtered_results","commit_id":"a270766eb9c3f2074af550a72661a6a825e9975b"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"6218bc7c68c1289981b63a4b92fcd7e249264195","unresolved":false,"context_lines":[{"line_number":675,"context_line":"            ref \u003d self.role_api.get_role(role_id)"},{"line_number":676,"context_line":"            return (ref[\u0027domain_id\u0027] is None)"},{"line_number":677,"context_line":""},{"line_number":678,"context_line":"        filter_results \u003d []"},{"line_number":679,"context_line":"        for ref in role_refs:"},{"line_number":680,"context_line":"            if _role_is_global(ref[\u0027role_id\u0027]):"},{"line_number":681,"context_line":"                filter_results.append(ref)"},{"line_number":682,"context_line":"        return filter_results"},{"line_number":683,"context_line":""},{"line_number":684,"context_line":"    def _list_effective_role_assignments(self, role_id, user_id, group_id,"},{"line_number":685,"context_line":"                                         domain_id, project_id, subtree_ids,"}],"source_content_type":"text/x-python","patch_set":19,"id":"dae33548_dde91ee8","line":682,"range":{"start_line":678,"start_character":8,"end_line":682,"end_character":29},"updated":"2016-02-17 08:07:14.000000000","message":"less code:\n\n  cleaned_list \u003d [ x for x in role_refs if _role_is_global(x[\u0027role_id\u0027]) ]","commit_id":"a270766eb9c3f2074af550a72661a6a825e9975b"}],"keystone/tests/unit/test_backend.py":[{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"09c9edd51964bc2d8ed446072bfacc2a18754ac3","unresolved":false,"context_lines":[{"line_number":6913,"context_line":"        self.config_fixture.config(group\u003d\u0027os_inherit\u0027, enabled\u003dTrue)"},{"line_number":6914,"context_line":"        self.execute_assignment_plan(test_plan)"},{"line_number":6915,"context_line":""},{"line_number":6916,"context_line":"    def test_role_assignments_domain_specific_roles(self):"},{"line_number":6917,"context_line":"        test_plan \u003d {"},{"line_number":6918,"context_line":"            \u0027entities\u0027: {\u0027domains\u0027: {\u0027users\u0027: 1, \u0027projects\u0027: 1, \u0027roles\u0027: 2},"},{"line_number":6919,"context_line":"                         \u0027roles\u0027: 2},"}],"source_content_type":"text/x-python","patch_set":15,"id":"3a57f1b5_50096b2b","line":6916,"range":{"start_line":6916,"start_character":8,"end_line":6916,"end_character":51},"updated":"2016-02-10 17:15:52.000000000","message":"Maybe we could mention it\u0027s also a implied roles test ?\n\n    test_role_assignments_domain_specific_and_implied_roles","commit_id":"799421a71308389f2a4e59eb1da72d164fb807c9"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"1fe5ba293366ad2fcd2d07fdfc53b51c3b3afc07","unresolved":false,"context_lines":[{"line_number":6913,"context_line":"        self.config_fixture.config(group\u003d\u0027os_inherit\u0027, enabled\u003dTrue)"},{"line_number":6914,"context_line":"        self.execute_assignment_plan(test_plan)"},{"line_number":6915,"context_line":""},{"line_number":6916,"context_line":"    def test_role_assignments_domain_specific_roles(self):"},{"line_number":6917,"context_line":"        test_plan \u003d {"},{"line_number":6918,"context_line":"            \u0027entities\u0027: {\u0027domains\u0027: {\u0027users\u0027: 1, \u0027projects\u0027: 1, \u0027roles\u0027: 2},"},{"line_number":6919,"context_line":"                         \u0027roles\u0027: 2},"}],"source_content_type":"text/x-python","patch_set":15,"id":"3a57f1b5_c8fecfad","line":6916,"range":{"start_line":6916,"start_character":8,"end_line":6916,"end_character":51},"in_reply_to":"3a57f1b5_50096b2b","updated":"2016-02-11 17:34:34.000000000","message":"Done","commit_id":"799421a71308389f2a4e59eb1da72d164fb807c9"}],"keystone/tests/unit/test_v3_auth.py":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"9d95d6d459cde778c68e7124d363ef3a99d9e585","unresolved":false,"context_lines":[{"line_number":679,"context_line":"        token_roles \u003d self._get_scoped_token_roles()"},{"line_number":680,"context_line":"        self.assertEqual(len(initial_token_roles) + 1, len(token_roles))"},{"line_number":681,"context_line":""},{"line_number":682,"context_line":"        # The implied role from the domain specific role should be in the"},{"line_number":683,"context_line":"        # token, but not the domain specific role itself."},{"line_number":684,"context_line":"        token_role_ids \u003d [role[\u0027id\u0027] for role in token_roles]"},{"line_number":685,"context_line":"        self.assertIn(implied[\u0027id\u0027], token_role_ids)"},{"line_number":686,"context_line":"        self.assertNotIn(new_role[\u0027id\u0027], token_role_ids)"}],"source_content_type":"text/x-python","patch_set":15,"id":"3a57f1b5_70b7a486","line":683,"range":{"start_line":682,"start_character":8,"end_line":683,"end_character":15},"updated":"2016-02-11 07:56:14.000000000","message":"i didn\u0027t think we were allowing this...\n\ni get roles and implied roles, that gives us finer control.\ni get domain roles, and why they shouldn\u0027t appear in the token.\n\nif a DSR carries no authorization (it\u0027s not in the token), then it shouldn\u0027t be able to imply authorization?","commit_id":"799421a71308389f2a4e59eb1da72d164fb807c9"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"1fe5ba293366ad2fcd2d07fdfc53b51c3b3afc07","unresolved":false,"context_lines":[{"line_number":679,"context_line":"        token_roles \u003d self._get_scoped_token_roles()"},{"line_number":680,"context_line":"        self.assertEqual(len(initial_token_roles) + 1, len(token_roles))"},{"line_number":681,"context_line":""},{"line_number":682,"context_line":"        # The implied role from the domain specific role should be in the"},{"line_number":683,"context_line":"        # token, but not the domain specific role itself."},{"line_number":684,"context_line":"        token_role_ids \u003d [role[\u0027id\u0027] for role in token_roles]"},{"line_number":685,"context_line":"        self.assertIn(implied[\u0027id\u0027], token_role_ids)"},{"line_number":686,"context_line":"        self.assertNotIn(new_role[\u0027id\u0027], token_role_ids)"}],"source_content_type":"text/x-python","patch_set":15,"id":"3a57f1b5_c8ed6fb8","line":683,"range":{"start_line":682,"start_character":8,"end_line":683,"end_character":15},"in_reply_to":"3a57f1b5_70b7a486","updated":"2016-02-11 17:34:34.000000000","message":"I\u0027m not sure why a role or implied_role should be treated any different if it is implied by a DSR....which is all I\u0027m doing here. If DSR R1 implies a standard role R2, the R2 (only) goes in the token. If R2 now is actually an implied role itself to R3, then R2 and R3 should go in the token,","commit_id":"799421a71308389f2a4e59eb1da72d164fb807c9"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"6218bc7c68c1289981b63a4b92fcd7e249264195","unresolved":false,"context_lines":[{"line_number":667,"context_line":"        self.assertEqual(2, len(token_roles))"},{"line_number":668,"context_line":""},{"line_number":669,"context_line":"    def test_domain_scpecific_roles_do_not_show_v3_token(self):"},{"line_number":670,"context_line":"        self.config_fixture.config(group\u003d\u0027token\u0027, infer_roles\u003dTrue)"},{"line_number":671,"context_line":"        initial_token_roles \u003d self._get_scoped_token_roles()"},{"line_number":672,"context_line":""},{"line_number":673,"context_line":"        new_role \u003d self._create_role(domain_id\u003dself.domain_id)"}],"source_content_type":"text/x-python","patch_set":19,"id":"dae33548_dd047e4b","line":670,"range":{"start_line":670,"start_character":8,"end_line":670,"end_character":67},"updated":"2016-02-17 08:07:14.000000000","message":"this already defaults to true and can be removed: https://github.com/openstack/keystone/blob/master/etc/keystone.conf.sample#L1917","commit_id":"a270766eb9c3f2074af550a72661a6a825e9975b"}],"keystone/trust/controllers.py":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"6218bc7c68c1289981b63a4b92fcd7e249264195","unresolved":false,"context_lines":[{"line_number":43,"context_line":"        raise exception.Forbidden()"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"@dependency.requires(\u0027assignment_api\u0027, \u0027identity_api\u0027, \u0027resource_api\u0027,"},{"line_number":47,"context_line":"                     \u0027role_api\u0027, \u0027token_provider_api\u0027, \u0027trust_api\u0027)"},{"line_number":48,"context_line":"class TrustV3(controller.V3Controller):"},{"line_number":49,"context_line":"    collection_name \u003d \"trusts\""}],"source_content_type":"text/x-python","patch_set":19,"id":"dae33548_bdf7fa89","line":46,"range":{"start_line":46,"start_character":56,"end_line":46,"end_character":68},"updated":"2016-02-17 08:07:14.000000000","message":"remove this along with line 182","commit_id":"a270766eb9c3f2074af550a72661a6a825e9975b"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"6218bc7c68c1289981b63a4b92fcd7e249264195","unresolved":false,"context_lines":[{"line_number":179,"context_line":"                original_trust[\u0027redelegated_trust_id\u0027])"},{"line_number":180,"context_line":""},{"line_number":181,"context_line":"        if not self._attribute_is_empty(trust, \u0027project_id\u0027):"},{"line_number":182,"context_line":"            self.resource_api.get_project(original_trust[\u0027project_id\u0027])"},{"line_number":183,"context_line":"            # Get a list of roles including any domain specific roles"},{"line_number":184,"context_line":"            assignment_list \u003d self.assignment_api.list_role_assignments("},{"line_number":185,"context_line":"                user_id\u003doriginal_trust[\u0027trustor_user_id\u0027],"}],"source_content_type":"text/x-python","patch_set":19,"id":"dae33548_bdd09af7","line":182,"range":{"start_line":182,"start_character":12,"end_line":182,"end_character":71},"updated":"2016-02-17 08:07:14.000000000","message":"this line seems unnecessary - remove it","commit_id":"a270766eb9c3f2074af550a72661a6a825e9975b"}]}