)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":8866,"name":"Raildo Mascena de Sousa Filho","email":"rmascena@redhat.com","username":"raildo"},"change_message_id":"c64460eaf249475c86635a5da6cbd7e7a035e986","unresolved":false,"context_lines":[{"line_number":9,"context_line":"Previously to issue GET /project a user needed"},{"line_number":10,"context_line":"at least project_admin level of permission. With"},{"line_number":11,"context_line":"this change, a user can issue GET /project by just"},{"line_number":12,"context_line":"having a role on the project."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Change-Id: I9d23edc22eb88d0b21ab8968dfbe63661220a6fd"},{"line_number":15,"context_line":"Closes-Bug: 1535878"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"9a68dd71_c37c9774","line":12,"updated":"2016-01-21 18:54:58.000000000","message":"I thought this change would be applied on the v3. So I don\u0027t know if we have to change the policy.json file.\n\nCan you confirm this information?","commit_id":"9495ec38943e3574275d2829a39fc5708e8c6815"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"3f09226a68b40881a8c676c9b39b688b350d41f7","unresolved":false,"context_lines":[{"line_number":9,"context_line":"Previously to issue GET /project a user needed"},{"line_number":10,"context_line":"at least project_admin level of permission. With"},{"line_number":11,"context_line":"this change, a user can issue GET /project by just"},{"line_number":12,"context_line":"having a role on the project."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Change-Id: I9d23edc22eb88d0b21ab8968dfbe63661220a6fd"},{"line_number":15,"context_line":"Closes-Bug: 1535878"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"9a68dd71_518628ba","line":12,"in_reply_to":"9a68dd71_c37c9774","updated":"2016-01-21 21:47:48.000000000","message":"remember that the policy.json file is used for v3 as well. It just represents a simple \"the cloud admin does everything\" policy model","commit_id":"9495ec38943e3574275d2829a39fc5708e8c6815"}],"etc/policy.v3cloudsample.json":[{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"f0a3da081b0ed490553a0174c930b16bf82ff4c7","unresolved":false,"context_lines":[{"line_number":38,"context_line":"    \"admin_and_matching_target_project_domain_id\": \"rule:admin_required and domain_id:%(target.project.domain_id)s\","},{"line_number":39,"context_line":"    \"admin_and_matching_project_domain_id\": \"rule:admin_required and domain_id:%(project.domain_id)s\","},{"line_number":40,"context_line":"    \"admin_and_matching_target_project_id\": \"rule:admin_required and project_id:%(target.project.id)s\","},{"line_number":41,"context_line":"    \"identity:get_project\": \"rule:cloud_admin or rule:admin_and_matching_target_project_domain_id or rule:admin_and_matching_target_project_id or project_id:%(target.project.id)s\","},{"line_number":42,"context_line":"    \"identity:list_projects\": \"rule:cloud_admin or rule:admin_and_matching_domain_id\","},{"line_number":43,"context_line":"    \"identity:list_user_projects\": \"rule:owner or rule:admin_and_matching_domain_id\","},{"line_number":44,"context_line":"    \"identity:create_project\": \"rule:cloud_admin or rule:admin_and_matching_project_domain_id\","}],"source_content_type":"application/json","patch_set":1,"id":"9a68dd71_2635bc45","line":41,"range":{"start_line":41,"start_character":101,"end_line":41,"end_character":142},"updated":"2016-01-20 21:00:48.000000000","message":"You can drop this part of the rule, since this is guaranteed to match if you project check matches","commit_id":"0efc382e46de0a4d62421f9991aa73703bc80421"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"69da35b2ed2b17c9475ba4062352698452b1b8fb","unresolved":false,"context_lines":[{"line_number":37,"context_line":""},{"line_number":38,"context_line":"    \"admin_and_matching_target_project_domain_id\": \"rule:admin_required and domain_id:%(target.project.domain_id)s\","},{"line_number":39,"context_line":"    \"admin_and_matching_project_domain_id\": \"rule:admin_required and domain_id:%(project.domain_id)s\","},{"line_number":40,"context_line":"    \"admin_and_matching_target_project_id\": \"rule:admin_required and project_id:%(target.project.id)s\","},{"line_number":41,"context_line":"    \"identity:get_project\": \"rule:cloud_admin or rule:admin_and_matching_target_project_domain_id or project_id:%(target.project.id)s\","},{"line_number":42,"context_line":"    \"identity:list_projects\": \"rule:cloud_admin or rule:admin_and_matching_domain_id\","},{"line_number":43,"context_line":"    \"identity:list_user_projects\": \"rule:owner or rule:admin_and_matching_domain_id\","}],"source_content_type":"application/json","patch_set":5,"id":"7a5de9d1_b1d44cbd","line":40,"range":{"start_line":40,"start_character":5,"end_line":40,"end_character":41},"updated":"2016-01-28 17:22:25.000000000","message":"Remove this rule as it is no longer used","commit_id":"354151d4287d62c18db34d1485d324a1f91e3030"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"240353cc78c2f274889ace78199646424d2c6161","unresolved":false,"context_lines":[{"line_number":37,"context_line":""},{"line_number":38,"context_line":"    \"admin_and_matching_target_project_domain_id\": \"rule:admin_required and domain_id:%(target.project.domain_id)s\","},{"line_number":39,"context_line":"    \"admin_and_matching_project_domain_id\": \"rule:admin_required and domain_id:%(project.domain_id)s\","},{"line_number":40,"context_line":"    \"admin_and_matching_target_project_id\": \"rule:admin_required and project_id:%(target.project.id)s\","},{"line_number":41,"context_line":"    \"identity:get_project\": \"rule:cloud_admin or rule:admin_and_matching_target_project_domain_id or project_id:%(target.project.id)s\","},{"line_number":42,"context_line":"    \"identity:list_projects\": \"rule:cloud_admin or rule:admin_and_matching_domain_id\","},{"line_number":43,"context_line":"    \"identity:list_user_projects\": \"rule:owner or rule:admin_and_matching_domain_id\","}],"source_content_type":"application/json","patch_set":5,"id":"7a5de9d1_b3f6f88c","line":40,"range":{"start_line":40,"start_character":5,"end_line":40,"end_character":41},"in_reply_to":"7a5de9d1_33668b2a","updated":"2016-02-02 00:53:52.000000000","message":"I share Brant\u0027s opinion here","commit_id":"354151d4287d62c18db34d1485d324a1f91e3030"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"c3d6c65db0ec67218c1a3c427883cc066e03ca35","unresolved":false,"context_lines":[{"line_number":37,"context_line":""},{"line_number":38,"context_line":"    \"admin_and_matching_target_project_domain_id\": \"rule:admin_required and domain_id:%(target.project.domain_id)s\","},{"line_number":39,"context_line":"    \"admin_and_matching_project_domain_id\": \"rule:admin_required and domain_id:%(project.domain_id)s\","},{"line_number":40,"context_line":"    \"admin_and_matching_target_project_id\": \"rule:admin_required and project_id:%(target.project.id)s\","},{"line_number":41,"context_line":"    \"identity:get_project\": \"rule:cloud_admin or rule:admin_and_matching_target_project_domain_id or project_id:%(target.project.id)s\","},{"line_number":42,"context_line":"    \"identity:list_projects\": \"rule:cloud_admin or rule:admin_and_matching_domain_id\","},{"line_number":43,"context_line":"    \"identity:list_user_projects\": \"rule:owner or rule:admin_and_matching_domain_id\","}],"source_content_type":"application/json","patch_set":5,"id":"7a5de9d1_33668b2a","line":40,"range":{"start_line":40,"start_character":5,"end_line":40,"end_character":41},"in_reply_to":"7a5de9d1_9df79b8a","updated":"2016-02-01 23:27:44.000000000","message":"My opinion is we can remove rules from the sample policy file. I don\u0027t think operators would be affected by this. If they customize their policy file then they\u0027re not using the sample.","commit_id":"354151d4287d62c18db34d1485d324a1f91e3030"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"dd8f9412dca659863cab3089422826f1e7ce4620","unresolved":false,"context_lines":[{"line_number":37,"context_line":""},{"line_number":38,"context_line":"    \"admin_and_matching_target_project_domain_id\": \"rule:admin_required and domain_id:%(target.project.domain_id)s\","},{"line_number":39,"context_line":"    \"admin_and_matching_project_domain_id\": \"rule:admin_required and domain_id:%(project.domain_id)s\","},{"line_number":40,"context_line":"    \"admin_and_matching_target_project_id\": \"rule:admin_required and project_id:%(target.project.id)s\","},{"line_number":41,"context_line":"    \"identity:get_project\": \"rule:cloud_admin or rule:admin_and_matching_target_project_domain_id or project_id:%(target.project.id)s\","},{"line_number":42,"context_line":"    \"identity:list_projects\": \"rule:cloud_admin or rule:admin_and_matching_domain_id\","},{"line_number":43,"context_line":"    \"identity:list_user_projects\": \"rule:owner or rule:admin_and_matching_domain_id\","}],"source_content_type":"application/json","patch_set":5,"id":"7a5de9d1_3df0e790","line":40,"range":{"start_line":40,"start_character":5,"end_line":40,"end_character":41},"in_reply_to":"7a5de9d1_b1d44cbd","updated":"2016-01-30 00:06:44.000000000","message":"I don\u0027t know if we can just drop it without deprecating.\n\nIt might break for some operators that might have already been using this rule.","commit_id":"354151d4287d62c18db34d1485d324a1f91e3030"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"dd8f9412dca659863cab3089422826f1e7ce4620","unresolved":false,"context_lines":[{"line_number":37,"context_line":""},{"line_number":38,"context_line":"    \"admin_and_matching_target_project_domain_id\": \"rule:admin_required and domain_id:%(target.project.domain_id)s\","},{"line_number":39,"context_line":"    \"admin_and_matching_project_domain_id\": \"rule:admin_required and domain_id:%(project.domain_id)s\","},{"line_number":40,"context_line":"    \"admin_and_matching_target_project_id\": \"rule:admin_required and project_id:%(target.project.id)s\","},{"line_number":41,"context_line":"    \"identity:get_project\": \"rule:cloud_admin or rule:admin_and_matching_target_project_domain_id or project_id:%(target.project.id)s\","},{"line_number":42,"context_line":"    \"identity:list_projects\": \"rule:cloud_admin or rule:admin_and_matching_domain_id\","},{"line_number":43,"context_line":"    \"identity:list_user_projects\": \"rule:owner or rule:admin_and_matching_domain_id\","}],"source_content_type":"application/json","patch_set":5,"id":"7a5de9d1_9df79b8a","line":40,"range":{"start_line":40,"start_character":5,"end_line":40,"end_character":41},"in_reply_to":"7a5de9d1_b1d44cbd","updated":"2016-01-30 00:06:44.000000000","message":"I don\u0027t know if we can just drop it without deprecating.\n\nIt might break for some operators that might have already been using this rule.","commit_id":"354151d4287d62c18db34d1485d324a1f91e3030"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"dd8f9412dca659863cab3089422826f1e7ce4620","unresolved":false,"context_lines":[{"line_number":37,"context_line":""},{"line_number":38,"context_line":"    \"admin_and_matching_target_project_domain_id\": \"rule:admin_required and domain_id:%(target.project.domain_id)s\","},{"line_number":39,"context_line":"    \"admin_and_matching_project_domain_id\": \"rule:admin_required and domain_id:%(project.domain_id)s\","},{"line_number":40,"context_line":"    \"admin_and_matching_target_project_id\": \"rule:admin_required and project_id:%(target.project.id)s\","},{"line_number":41,"context_line":"    \"identity:get_project\": \"rule:cloud_admin or rule:admin_and_matching_target_project_domain_id or project_id:%(target.project.id)s\","},{"line_number":42,"context_line":"    \"identity:list_projects\": \"rule:cloud_admin or rule:admin_and_matching_domain_id\","},{"line_number":43,"context_line":"    \"identity:list_user_projects\": \"rule:owner or rule:admin_and_matching_domain_id\","}],"source_content_type":"application/json","patch_set":5,"id":"7a5de9d1_5d44c3b5","line":40,"range":{"start_line":40,"start_character":5,"end_line":40,"end_character":41},"in_reply_to":"7a5de9d1_b1d44cbd","updated":"2016-01-30 00:06:44.000000000","message":"I don\u0027t know if we can just drop without deprecation.\n\nIf an operator is re-using this, it would just fail for them.","commit_id":"354151d4287d62c18db34d1485d324a1f91e3030"}],"keystone/tests/unit/test_v3_protection.py":[{"author":{"_account_id":11215,"name":"Vivek Dhayaal","email":"vivekdhayaal@gmail.com","username":"vivekdhayaal"},"change_message_id":"379aca6e81bcf6dca3864cd4455ae797147b51f5","unresolved":false,"context_lines":[{"line_number":1390,"context_line":"            password\u003dself.just_a_user[\u0027password\u0027],"},{"line_number":1391,"context_line":"            project_id\u003dself.project[\u0027id\u0027])"},{"line_number":1392,"context_line":""},{"line_number":1393,"context_line":"        resp \u003d self.get(\u0027/projects/%s\u0027 % self.project[\u0027id\u0027], auth\u003duser_auth)"},{"line_number":1394,"context_line":"        self.assertEqual(self.project[\u0027id\u0027],"},{"line_number":1395,"context_line":"                         jsonutils.loads(resp.body)[\u0027project\u0027][\u0027id\u0027])"},{"line_number":1396,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"9a68dd71_8abb3572","line":1393,"updated":"2016-01-21 08:39:40.000000000","message":"now that the negative test case is removed, would it make sense to add a new negative test like \u0027test_user_with_no_role_get_project\u0027 ?","commit_id":"6c7e761edaa6982a95b0091cbf3bc17c71f02331"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"37f3967bb83207db6f7ebd0f472a2098a9c95701","unresolved":false,"context_lines":[{"line_number":1384,"context_line":"        self.delete(\u0027/auth/tokens\u0027, token\u003dadmin_token,"},{"line_number":1385,"context_line":"                    headers\u003d{\u0027X-Subject-Token\u0027: user_token})"},{"line_number":1386,"context_line":""},{"line_number":1387,"context_line":"    def test_user_with_a_role_get_project(self):"},{"line_number":1388,"context_line":"        user_auth \u003d self.build_authentication_request("},{"line_number":1389,"context_line":"            user_id\u003dself.just_a_user[\u0027id\u0027],"},{"line_number":1390,"context_line":"            password\u003dself.just_a_user[\u0027password\u0027],"}],"source_content_type":"text/x-python","patch_set":3,"id":"9a68dd71_9b0fe9e0","line":1387,"range":{"start_line":1387,"start_character":8,"end_line":1387,"end_character":48},"updated":"2016-01-21 17:21:58.000000000","message":"as was mentioned by Vivek, on the earlier patch, given how important the get_project() call is, it might be worth adding a negative check for a user with a project token for the wrong project. (we do already check that a user with a domain token with a different domain cannot call get_project in an earlier test in this class)","commit_id":"9495ec38943e3574275d2829a39fc5708e8c6815"},{"author":{"_account_id":8866,"name":"Raildo Mascena de Sousa Filho","email":"rmascena@redhat.com","username":"raildo"},"change_message_id":"c64460eaf249475c86635a5da6cbd7e7a035e986","unresolved":false,"context_lines":[{"line_number":1384,"context_line":"        self.delete(\u0027/auth/tokens\u0027, token\u003dadmin_token,"},{"line_number":1385,"context_line":"                    headers\u003d{\u0027X-Subject-Token\u0027: user_token})"},{"line_number":1386,"context_line":""},{"line_number":1387,"context_line":"    def test_user_with_a_role_get_project(self):"},{"line_number":1388,"context_line":"        user_auth \u003d self.build_authentication_request("},{"line_number":1389,"context_line":"            user_id\u003dself.just_a_user[\u0027id\u0027],"},{"line_number":1390,"context_line":"            password\u003dself.just_a_user[\u0027password\u0027],"}],"source_content_type":"text/x-python","patch_set":3,"id":"9a68dd71_23d49345","line":1387,"range":{"start_line":1387,"start_character":8,"end_line":1387,"end_character":48},"in_reply_to":"9a68dd71_9b0fe9e0","updated":"2016-01-21 18:54:58.000000000","message":"++","commit_id":"9495ec38943e3574275d2829a39fc5708e8c6815"},{"author":{"_account_id":17123,"name":"Tom Cocozzello (tjcocozz)","email":"tjcocozz@us.ibm.com","username":"tcocozzello"},"change_message_id":"8d22edefc73f05e52580e899f10abf3620e2c623","unresolved":false,"context_lines":[{"line_number":1390,"context_line":"            password\u003dself.just_a_user[\u0027password\u0027],"},{"line_number":1391,"context_line":"            project_id\u003dself.project[\u0027id\u0027])"},{"line_number":1392,"context_line":""},{"line_number":1393,"context_line":"        resp \u003d self.get(\u0027/projects/%s\u0027 % self.project[\u0027id\u0027], auth\u003duser_auth)"},{"line_number":1394,"context_line":"        self.assertEqual(self.project[\u0027id\u0027],"},{"line_number":1395,"context_line":"                         jsonutils.loads(resp.body)[\u0027project\u0027][\u0027id\u0027])"},{"line_number":1396,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"9a68dd71_55fb3d79","line":1393,"updated":"2016-01-22 19:01:52.000000000","message":"similar as below \"Test user can access a project they have a role in\" - or something like that.","commit_id":"97e7ae1dee40dcc27036f90ed9682a609222986f"},{"author":{"_account_id":17123,"name":"Tom Cocozzello (tjcocozz)","email":"tjcocozz@us.ibm.com","username":"tcocozzello"},"change_message_id":"04e92577767acd4a5fea185ab578a39e2c7722ba","unresolved":false,"context_lines":[{"line_number":1394,"context_line":"        self.assertEqual(self.project[\u0027id\u0027],"},{"line_number":1395,"context_line":"                         jsonutils.loads(resp.body)[\u0027project\u0027][\u0027id\u0027])"},{"line_number":1396,"context_line":""},{"line_number":1397,"context_line":"        project2 \u003d unit.new_project_ref(domain_id\u003dself.domainA[\u0027id\u0027])"},{"line_number":1398,"context_line":"        self.resource_api.create_project(project2[\u0027id\u0027], project2)"},{"line_number":1399,"context_line":"        self.get(\u0027/projects/%s\u0027 % project2[\u0027id\u0027], auth\u003duser_auth,"},{"line_number":1400,"context_line":"                 expected_status\u003dexception.ForbiddenAction.code)"}],"source_content_type":"text/x-python","patch_set":4,"id":"9a68dd71_b5b399e8","line":1397,"updated":"2016-01-22 19:00:10.000000000","message":"I would recommend adding a comment with what you are doing here. \"Test user can\u0027t access project they don\u0027t have a role in\" - or something like that.","commit_id":"97e7ae1dee40dcc27036f90ed9682a609222986f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"b64f53ad6c4b94d671459e1d1635683ea8ee4c45","unresolved":false,"context_lines":[{"line_number":1394,"context_line":"        self.assertEqual(self.project[\u0027id\u0027],"},{"line_number":1395,"context_line":"                         jsonutils.loads(resp.body)[\u0027project\u0027][\u0027id\u0027])"},{"line_number":1396,"context_line":""},{"line_number":1397,"context_line":"        project2 \u003d unit.new_project_ref(domain_id\u003dself.domainA[\u0027id\u0027])"},{"line_number":1398,"context_line":"        self.resource_api.create_project(project2[\u0027id\u0027], project2)"},{"line_number":1399,"context_line":"        self.get(\u0027/projects/%s\u0027 % project2[\u0027id\u0027], auth\u003duser_auth,"},{"line_number":1400,"context_line":"                 expected_status\u003dexception.ForbiddenAction.code)"}],"source_content_type":"text/x-python","patch_set":4,"id":"7a5de9d1_dadcc748","line":1397,"in_reply_to":"9a68dd71_b5b399e8","updated":"2016-01-27 15:03:13.000000000","message":"++ but instead of access I\u0027d be inclined to say \"get\".","commit_id":"97e7ae1dee40dcc27036f90ed9682a609222986f"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"69da35b2ed2b17c9475ba4062352698452b1b8fb","unresolved":false,"context_lines":[{"line_number":1393,"context_line":"        # Test user can get project for one they have a role in"},{"line_number":1394,"context_line":"        resp \u003d self.get(\u0027/projects/%s\u0027 % self.project[\u0027id\u0027], auth\u003duser_auth)"},{"line_number":1395,"context_line":"        self.assertEqual(self.project[\u0027id\u0027],"},{"line_number":1396,"context_line":"                         jsonutils.loads(resp.body)[\u0027project\u0027][\u0027id\u0027])"},{"line_number":1397,"context_line":""},{"line_number":1398,"context_line":"        # Test user can not get project for one they don\u0027t have a role in,"},{"line_number":1399,"context_line":"        # even if they have a role on another project"}],"source_content_type":"text/x-python","patch_set":5,"id":"7a5de9d1_f198841d","line":1396,"updated":"2016-01-28 17:22:25.000000000","message":"Why not check all the project dict rather than just the ID ?","commit_id":"354151d4287d62c18db34d1485d324a1f91e3030"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"240353cc78c2f274889ace78199646424d2c6161","unresolved":false,"context_lines":[{"line_number":1393,"context_line":"        # Test user can get project for one they have a role in"},{"line_number":1394,"context_line":"        resp \u003d self.get(\u0027/projects/%s\u0027 % self.project[\u0027id\u0027], auth\u003duser_auth)"},{"line_number":1395,"context_line":"        self.assertEqual(self.project[\u0027id\u0027],"},{"line_number":1396,"context_line":"                         jsonutils.loads(resp.body)[\u0027project\u0027][\u0027id\u0027])"},{"line_number":1397,"context_line":""},{"line_number":1398,"context_line":"        # Test user can not get project for one they don\u0027t have a role in,"},{"line_number":1399,"context_line":"        # even if they have a role on another project"}],"source_content_type":"text/x-python","patch_set":5,"id":"7a5de9d1_33e3e8da","line":1396,"in_reply_to":"7a5de9d1_b30fdb35","updated":"2016-02-02 00:53:52.000000000","message":"Agreed","commit_id":"354151d4287d62c18db34d1485d324a1f91e3030"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"c3d6c65db0ec67218c1a3c427883cc066e03ca35","unresolved":false,"context_lines":[{"line_number":1393,"context_line":"        # Test user can get project for one they have a role in"},{"line_number":1394,"context_line":"        resp \u003d self.get(\u0027/projects/%s\u0027 % self.project[\u0027id\u0027], auth\u003duser_auth)"},{"line_number":1395,"context_line":"        self.assertEqual(self.project[\u0027id\u0027],"},{"line_number":1396,"context_line":"                         jsonutils.loads(resp.body)[\u0027project\u0027][\u0027id\u0027])"},{"line_number":1397,"context_line":""},{"line_number":1398,"context_line":"        # Test user can not get project for one they don\u0027t have a role in,"},{"line_number":1399,"context_line":"        # even if they have a role on another project"}],"source_content_type":"text/x-python","patch_set":5,"id":"7a5de9d1_b30fdb35","line":1396,"in_reply_to":"7a5de9d1_f198841d","updated":"2016-02-01 23:27:44.000000000","message":"There\u0027s no need to check anything since the get would fail if the test fails.","commit_id":"354151d4287d62c18db34d1485d324a1f91e3030"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"69da35b2ed2b17c9475ba4062352698452b1b8fb","unresolved":false,"context_lines":[{"line_number":1400,"context_line":"        project2 \u003d unit.new_project_ref(domain_id\u003dself.domainA[\u0027id\u0027])"},{"line_number":1401,"context_line":"        self.resource_api.create_project(project2[\u0027id\u0027], project2)"},{"line_number":1402,"context_line":"        self.get(\u0027/projects/%s\u0027 % project2[\u0027id\u0027], auth\u003duser_auth,"},{"line_number":1403,"context_line":"                 expected_status\u003dexception.ForbiddenAction.code)"},{"line_number":1404,"context_line":""},{"line_number":1405,"context_line":"    def test_project_admin_get_project(self):"},{"line_number":1406,"context_line":"        admin_auth \u003d self.build_authentication_request("}],"source_content_type":"text/x-python","patch_set":5,"id":"7a5de9d1_f13404fc","line":1403,"updated":"2016-01-28 17:22:25.000000000","message":"Would be nice to test that an admin cannot GET project for another project which he isn\u0027t scoped to. This helps to ensure we are not suffering of the global admin problem here.","commit_id":"354151d4287d62c18db34d1485d324a1f91e3030"}],"releasenotes/notes/bug-1535878-change-get_project-permission-e460af1256a2c056.yaml":[{"author":{"_account_id":17123,"name":"Tom Cocozzello (tjcocozz)","email":"tjcocozz@us.ibm.com","username":"tcocozzello"},"change_message_id":"2607b94ad683dd0b473a7909375182061a592959","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"fixes:"},{"line_number":3,"context_line":"  - GET /project/{project_id} can now be called by"},{"line_number":4,"context_line":"    a user with any role on that project."}],"source_content_type":"text/x-yaml","patch_set":3,"id":"9a68dd71_d58f7221","line":2,"updated":"2016-01-21 16:54:07.000000000","message":"[`bug 1535878 \u003chttps://bugs.launchpad.net/keystone/+bug/1535878\u003e`_]\n\ndon\u0027t forget to reference the bug. Reference: https://github.com/openstack/keystone/blob/master/releasenotes/notes/bug-1490804-de58a9606edb31eb.yaml#L4","commit_id":"9495ec38943e3574275d2829a39fc5708e8c6815"},{"author":{"_account_id":11428,"name":"Ajaya Agrawal","email":"ajku.agr@gmail.com","username":"ajayaa"},"change_message_id":"c4fb6c01291d01b6e0a24862ddc6d680bbe81fe4","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"fixes:"},{"line_number":3,"context_line":"  - GET /project/{project_id} can now be called by"},{"line_number":4,"context_line":"    a user with any role on that project."}],"source_content_type":"text/x-yaml","patch_set":3,"id":"9a68dd71_3eceab82","line":2,"in_reply_to":"9a68dd71_d58f7221","updated":"2016-01-22 18:10:34.000000000","message":"Tom, thanks for the exact words! It was very helpful. :)","commit_id":"9495ec38943e3574275d2829a39fc5708e8c6815"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"d3892de8086b5003aba3df298444980d83d9b363","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"fixes:"},{"line_number":3,"context_line":"  - GET /project/{project_id} can now be called by"},{"line_number":4,"context_line":"    a user with any role on that project."}],"source_content_type":"text/x-yaml","patch_set":3,"id":"9a68dd71_7b9f9550","line":4,"updated":"2016-01-21 17:24:25.000000000","message":"I think it is worth mentioning what the previous behavior was in the release note so folks have better context on what changed","commit_id":"9495ec38943e3574275d2829a39fc5708e8c6815"},{"author":{"_account_id":11428,"name":"Ajaya Agrawal","email":"ajku.agr@gmail.com","username":"ajayaa"},"change_message_id":"c4fb6c01291d01b6e0a24862ddc6d680bbe81fe4","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"fixes:"},{"line_number":3,"context_line":"  - GET /project/{project_id} can now be called by"},{"line_number":4,"context_line":"    a user with any role on that project."}],"source_content_type":"text/x-yaml","patch_set":3,"id":"9a68dd71_5ea91f8f","line":4,"in_reply_to":"9a68dd71_7b9f9550","updated":"2016-01-22 18:10:34.000000000","message":"Done","commit_id":"9495ec38943e3574275d2829a39fc5708e8c6815"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"c3d6c65db0ec67218c1a3c427883cc066e03ca35","unresolved":false,"context_lines":[{"line_number":2,"context_line":"fixes:"},{"line_number":3,"context_line":"  - \u003e"},{"line_number":4,"context_line":"    [`bug 1535878 \u003chttps://bugs.launchpad.net/keystone/+bug/1535878\u003e`_]"},{"line_number":5,"context_line":"    Earlier to issue GET /project/{project_id} a user needed"},{"line_number":6,"context_line":"    at least project_admin level of permission. Now it can be"},{"line_number":7,"context_line":"    called by having any role on the project."}],"source_content_type":"text/x-yaml","patch_set":5,"id":"7a5de9d1_0e0b2425","line":5,"range":{"start_line":5,"start_character":4,"end_line":5,"end_character":11},"updated":"2016-02-01 23:27:44.000000000","message":"change \"Earlier\" to \"Originally\"\n\nchange \"issue\" to \"perform\"","commit_id":"354151d4287d62c18db34d1485d324a1f91e3030"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"69da35b2ed2b17c9475ba4062352698452b1b8fb","unresolved":false,"context_lines":[{"line_number":3,"context_line":"  - \u003e"},{"line_number":4,"context_line":"    [`bug 1535878 \u003chttps://bugs.launchpad.net/keystone/+bug/1535878\u003e`_]"},{"line_number":5,"context_line":"    Earlier to issue GET /project/{project_id} a user needed"},{"line_number":6,"context_line":"    at least project_admin level of permission. Now it can be"},{"line_number":7,"context_line":"    called by having any role on the project."}],"source_content_type":"text/x-yaml","patch_set":5,"id":"7a5de9d1_510dd83c","line":6,"range":{"start_line":6,"start_character":13,"end_line":6,"end_character":26},"updated":"2016-01-28 17:22:25.000000000","message":"s/project_admin/project admin\n\nproject_admin looks to be the name of a role ? Why the underscore?","commit_id":"354151d4287d62c18db34d1485d324a1f91e3030"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"c3d6c65db0ec67218c1a3c427883cc066e03ca35","unresolved":false,"context_lines":[{"line_number":4,"context_line":"    [`bug 1535878 \u003chttps://bugs.launchpad.net/keystone/+bug/1535878\u003e`_]"},{"line_number":5,"context_line":"    Earlier to issue GET /project/{project_id} a user needed"},{"line_number":6,"context_line":"    at least project_admin level of permission. Now it can be"},{"line_number":7,"context_line":"    called by having any role on the project."}],"source_content_type":"text/x-yaml","patch_set":5,"id":"7a5de9d1_ce38acd5","line":7,"updated":"2016-02-01 23:27:44.000000000","message":"This needs to be updated to say that this only applies when using the sample policy file since a deployment might have updated their policy file to allow this already.","commit_id":"354151d4287d62c18db34d1485d324a1f91e3030"},{"author":{"_account_id":8912,"name":"Ryan McNair","email":"rdmcnair@us.ibm.com","username":"rdmcnair"},"change_message_id":"369a1e1bfd698487daf1014ec0af25cea45344e6","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"fixes:"},{"line_number":3,"context_line":"  - \u003e"},{"line_number":4,"context_line":"    [`bug 1535878 \u003chttps://bugs.launchpad.net/keystone/+bug/1535878\u003e`_]"},{"line_number":5,"context_line":"    Origionally to perform GET /project/{project_id} the v3cloudsample policy"},{"line_number":6,"context_line":"    file required a user to have at least project admin level of permission."},{"line_number":7,"context_line":"    The sample has been updated to allow it to be performed by any user who has"}],"source_content_type":"text/x-yaml","patch_set":7,"id":"3a57f1b5_84d794be","line":4,"updated":"2016-02-10 23:36:53.000000000","message":"s/Origionally/Originally","commit_id":"8e33202edbd50cf3cde8a1b441e46cbfdaf1eba9"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"62ba4162443be544d5824b89f6d5b9938da72f8b","unresolved":false,"context_lines":[{"line_number":2,"context_line":"fixes:"},{"line_number":3,"context_line":"  - \u003e"},{"line_number":4,"context_line":"    [`bug 1535878 \u003chttps://bugs.launchpad.net/keystone/+bug/1535878\u003e`_]"},{"line_number":5,"context_line":"    Originally to perform GET /project/{project_id} the v3cloudsample policy"},{"line_number":6,"context_line":"    file required a user to have at least project admin level of permission."},{"line_number":7,"context_line":"    The sample has been updated to allow it to be performed by any user who has"},{"line_number":8,"context_line":"    a role on the project."}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3a57f1b5_8ac0f27d","line":5,"range":{"start_line":5,"start_character":56,"end_line":5,"end_character":69},"updated":"2016-02-11 07:07:09.000000000","message":"we could just say \"the provided policy files\"","commit_id":"7484e566dfaa0bd824c9e230e798a275fcc6b91d"}]}