)]}'
{"keystone/common/controller.py":[{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"7d31a4777626076681521ae43511cbc71d3d7643","unresolved":false,"context_lines":[{"line_number":256,"context_line":"    `cascade` may be specified. In that case, the operation will be executed"},{"line_number":257,"context_line":"    for both the specified project and its subtree."},{"line_number":258,"context_line":""},{"line_number":259,"context_line":"    The of a cascade operation is the same of executing the same API for each"},{"line_number":260,"context_line":"    node in the tree separately."},{"line_number":261,"context_line":""},{"line_number":262,"context_line":"    That said, the policy check needs to be performed for every project in the"}],"source_content_type":"text/x-python","patch_set":2,"id":"bae84128_2635a9f6","line":259,"range":{"start_line":259,"start_character":8,"end_line":259,"end_character":13},"updated":"2016-02-22 17:57:31.000000000","message":"nit: remove \"of a\"","commit_id":"c3331fc2d6a07593cbf6db9763ac005e054fc9a5"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"7d31a4777626076681521ae43511cbc71d3d7643","unresolved":false,"context_lines":[{"line_number":288,"context_line":"                # Now check permission on every project in its subtree"},{"line_number":289,"context_line":"                subtree \u003d self.resource_api.list_projects_in_subtree(root_id)"},{"line_number":290,"context_line":""},{"line_number":291,"context_line":"                user_id \u003d self.get_auth_context(context).get(\u0027user_id\u0027)"},{"line_number":292,"context_line":"                user_projects \u003d ("},{"line_number":293,"context_line":"                    self.assignment_api.list_projects_for_user(user_id))"},{"line_number":294,"context_line":"                for project in subtree:"},{"line_number":295,"context_line":"                    if project not in user_projects:"},{"line_number":296,"context_line":"                        msg \u003d _(\u0027Cannot perform cascade operation, because the\u0027"},{"line_number":297,"context_line":"                                \u0027 user %(user_id)s does not have access to the\u0027"},{"line_number":298,"context_line":"                                \u0027 whole subtree of project %(root_id)s.\u0027) % ("},{"line_number":299,"context_line":"                            {\u0027user_id\u0027: user_id, \u0027root_id\u0027: root_id})"},{"line_number":300,"context_line":"                        raise exception.Forbidden(message\u003dmsg)"},{"line_number":301,"context_line":""},{"line_number":302,"context_line":"                # NOTE(samueldmq): In update calls, the controller receives the"},{"line_number":303,"context_line":"                # project dict to update. In that case, update each subproject"}],"source_content_type":"text/x-python","patch_set":2,"id":"bae84128_065a254f","line":300,"range":{"start_line":291,"start_character":0,"end_line":300,"end_character":62},"updated":"2016-02-22 17:57:31.000000000","message":"I wonder if we need to actually do this bit, given that we\u0027re going to call the policy rule for each node anyway? Are we doing this to fail more quickly? There may be policy writers that want to be be able to say things like \"as long as you have role XYZ on the parent project, you can perform cascade operations to the subtree, even if you don\u0027t have a role on all of them\"\n\nOne idea, is that you pass \u0027cascade\u0027: True as part of the prep_info..that way the policy rule can make different decisions on the nodes vs the root.","commit_id":"c3331fc2d6a07593cbf6db9763ac005e054fc9a5"},{"author":{"_account_id":8866,"name":"Raildo Mascena de Sousa Filho","email":"rmascena@redhat.com","username":"raildo"},"change_message_id":"846764d59b4894d1315093427bef9d3b4ae669c5","unresolved":false,"context_lines":[{"line_number":288,"context_line":"                # Now check permission on every project in its subtree"},{"line_number":289,"context_line":"                subtree \u003d self.resource_api.list_projects_in_subtree(root_id)"},{"line_number":290,"context_line":""},{"line_number":291,"context_line":"                user_id \u003d self.get_auth_context(context).get(\u0027user_id\u0027)"},{"line_number":292,"context_line":"                user_projects \u003d ("},{"line_number":293,"context_line":"                    self.assignment_api.list_projects_for_user(user_id))"},{"line_number":294,"context_line":"                for project in subtree:"},{"line_number":295,"context_line":"                    if project not in user_projects:"},{"line_number":296,"context_line":"                        msg \u003d _(\u0027Cannot perform cascade operation, because the\u0027"},{"line_number":297,"context_line":"                                \u0027 user %(user_id)s does not have access to the\u0027"},{"line_number":298,"context_line":"                                \u0027 whole subtree of project %(root_id)s.\u0027) % ("},{"line_number":299,"context_line":"                            {\u0027user_id\u0027: user_id, \u0027root_id\u0027: root_id})"},{"line_number":300,"context_line":"                        raise exception.Forbidden(message\u003dmsg)"},{"line_number":301,"context_line":""},{"line_number":302,"context_line":"                # NOTE(samueldmq): In update calls, the controller receives the"},{"line_number":303,"context_line":"                # project dict to update. In that case, update each subproject"}],"source_content_type":"text/x-python","patch_set":2,"id":"bae84128_dcc00c2d","line":300,"range":{"start_line":291,"start_character":0,"end_line":300,"end_character":62},"in_reply_to":"bae84128_065a254f","updated":"2016-02-22 18:24:13.000000000","message":"In fact, I decided to made some similar  with what we made on the get subtree operations (https://github.com/openstack/keystone/blob/2bad130bf457ab4b23b65f9b407a8cc8bde300fe/keystone/resource/core.py#L497). So, answering your question, yes, we are doing this to fail more quickly, If a user doesn\u0027t have role in the subtree, he can\u0027t perform the cascade action.\n\nI don\u0027t agree with the idea to user be able to perform cascade operations without have role on all of them. \nThis goes against with we are doing at this point (for example: for example a user can\u0027t perform the list_subtree without have role on all of them). This can impact some reseller use cases in the future.","commit_id":"c3331fc2d6a07593cbf6db9763ac005e054fc9a5"},{"author":{"_account_id":8866,"name":"Raildo Mascena de Sousa Filho","email":"rmascena@redhat.com","username":"raildo"},"change_message_id":"e528361bf7b2d15c9db4b97231f48329ad67cc09","unresolved":false,"context_lines":[{"line_number":288,"context_line":"                # Now check permission on every project in its subtree"},{"line_number":289,"context_line":"                subtree \u003d self.resource_api.list_projects_in_subtree(root_id)"},{"line_number":290,"context_line":""},{"line_number":291,"context_line":"                user_id \u003d self.get_auth_context(context).get(\u0027user_id\u0027)"},{"line_number":292,"context_line":"                user_projects \u003d ("},{"line_number":293,"context_line":"                    self.assignment_api.list_projects_for_user(user_id))"},{"line_number":294,"context_line":"                for project in subtree:"},{"line_number":295,"context_line":"                    if project not in user_projects:"},{"line_number":296,"context_line":"                        msg \u003d _(\u0027Cannot perform cascade operation, because the\u0027"},{"line_number":297,"context_line":"                                \u0027 user %(user_id)s does not have access to the\u0027"},{"line_number":298,"context_line":"                                \u0027 whole subtree of project %(root_id)s.\u0027) % ("},{"line_number":299,"context_line":"                            {\u0027user_id\u0027: user_id, \u0027root_id\u0027: root_id})"},{"line_number":300,"context_line":"                        raise exception.Forbidden(message\u003dmsg)"},{"line_number":301,"context_line":""},{"line_number":302,"context_line":"                # NOTE(samueldmq): In update calls, the controller receives the"},{"line_number":303,"context_line":"                # project dict to update. In that case, update each subproject"}],"source_content_type":"text/x-python","patch_set":2,"id":"bae84128_32903f43","line":300,"range":{"start_line":291,"start_character":0,"end_line":300,"end_character":62},"in_reply_to":"bae84128_975add4e","updated":"2016-02-22 19:05:05.000000000","message":"We have this issue with the arbitrary role, I\u0027m working to fix it on the update cascade patch and then we can discuss to drop this part of the code.","commit_id":"c3331fc2d6a07593cbf6db9763ac005e054fc9a5"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"dc56dfc3b058cba9c17bd5f5242265ef3fd556bb","unresolved":false,"context_lines":[{"line_number":288,"context_line":"                # Now check permission on every project in its subtree"},{"line_number":289,"context_line":"                subtree \u003d self.resource_api.list_projects_in_subtree(root_id)"},{"line_number":290,"context_line":""},{"line_number":291,"context_line":"                user_id \u003d self.get_auth_context(context).get(\u0027user_id\u0027)"},{"line_number":292,"context_line":"                user_projects \u003d ("},{"line_number":293,"context_line":"                    self.assignment_api.list_projects_for_user(user_id))"},{"line_number":294,"context_line":"                for project in subtree:"},{"line_number":295,"context_line":"                    if project not in user_projects:"},{"line_number":296,"context_line":"                        msg \u003d _(\u0027Cannot perform cascade operation, because the\u0027"},{"line_number":297,"context_line":"                                \u0027 user %(user_id)s does not have access to the\u0027"},{"line_number":298,"context_line":"                                \u0027 whole subtree of project %(root_id)s.\u0027) % ("},{"line_number":299,"context_line":"                            {\u0027user_id\u0027: user_id, \u0027root_id\u0027: root_id})"},{"line_number":300,"context_line":"                        raise exception.Forbidden(message\u003dmsg)"},{"line_number":301,"context_line":""},{"line_number":302,"context_line":"                # NOTE(samueldmq): In update calls, the controller receives the"},{"line_number":303,"context_line":"                # project dict to update. In that case, update each subproject"}],"source_content_type":"text/x-python","patch_set":2,"id":"bae84128_975add4e","line":300,"range":{"start_line":291,"start_character":0,"end_line":300,"end_character":62},"in_reply_to":"bae84128_dcc00c2d","updated":"2016-02-22 18:50:00.000000000","message":"While having a role seems a reasonable requirement for listing them, I\u0027m not sure why having an arbitrary role on a given project should affect your ability to update it. However, I\u0027m Ok with this as a starting point.","commit_id":"c3331fc2d6a07593cbf6db9763ac005e054fc9a5"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"7d31a4777626076681521ae43511cbc71d3d7643","unresolved":false,"context_lines":[{"line_number":310,"context_line":"                    subproject.update(updated_root)"},{"line_number":311,"context_line":"                    prep_info[\u0027input_attr\u0027] \u003d {\u0027project_id\u0027: subproject[\u0027id\u0027],"},{"line_number":312,"context_line":"                                               \u0027project\u0027: subproject}"},{"line_number":313,"context_line":"                    self.check_protection(context, prep_info)"},{"line_number":314,"context_line":""},{"line_number":315,"context_line":"            return f(self, context, **kwargs)"},{"line_number":316,"context_line":"        return wrapper"}],"source_content_type":"text/x-python","patch_set":2,"id":"bae84128_a16403e5","line":313,"range":{"start_line":313,"start_character":20,"end_line":313,"end_character":61},"updated":"2016-02-22 17:57:31.000000000","message":"is this going to work? Won\u0027t the policy engine try and match the project_id in the token with the one you are putting in prep.....and that will fail for all but the top level project the call was made with?\n\nIf the rule could check the cascade option (as indicated above) then the polci rule could ignore the project...although not sure if there are security issues with that","commit_id":"c3331fc2d6a07593cbf6db9763ac005e054fc9a5"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"73f59167ffa9a70d1b00532516c339d0931d582a","unresolved":false,"context_lines":[{"line_number":301,"context_line":"                    # TODO(samueldmq): Need to think about trusted and"},{"line_number":302,"context_line":"                    # federated authorization"},{"line_number":303,"context_line":""},{"line_number":304,"context_line":"                    assignments \u003d self.assignment_api.list_role_assignments("},{"line_number":305,"context_line":"                        user_id\u003duser_id, project_id\u003dsubproject[\u0027id\u0027],"},{"line_number":306,"context_line":"                        effective\u003dTrue, include_names\u003dTrue)"},{"line_number":307,"context_line":"                    if not assignments:"},{"line_number":308,"context_line":"                        msg \u003d _(\u0027Cannot perform cascade operation, because the\u0027"},{"line_number":309,"context_line":"                                \u0027 user %(user_id)s does not have access to the\u0027"},{"line_number":310,"context_line":"                                \u0027 whole subtree of project %(root_id)s.\u0027) % ("},{"line_number":311,"context_line":"                            {\u0027user_id\u0027: user_id, \u0027root_id\u0027: root_id})"},{"line_number":312,"context_line":"                        raise exception.Forbidden(message\u003dmsg)"},{"line_number":313,"context_line":""},{"line_number":314,"context_line":"                    role_names \u003d [a[\u0027role_name\u0027] for a in assignments]"},{"line_number":315,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"bae84128_c54f1a69","line":312,"range":{"start_line":304,"start_character":20,"end_line":312,"end_character":62},"updated":"2016-02-24 15:37:28.000000000","message":"I don\u0027t think we need to do this bit...just let the policy engine do its stuff","commit_id":"2f12820426d0dcb7b23c2190d6eafc9bb68a23ab"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"d165537840af58842dbbb45f7dcbd5ef6722079a","unresolved":false,"context_lines":[{"line_number":301,"context_line":"                    # TODO(samueldmq): Need to think about trusted and"},{"line_number":302,"context_line":"                    # federated authorization"},{"line_number":303,"context_line":""},{"line_number":304,"context_line":"                    assignments \u003d self.assignment_api.list_role_assignments("},{"line_number":305,"context_line":"                        user_id\u003duser_id, project_id\u003dsubproject[\u0027id\u0027],"},{"line_number":306,"context_line":"                        effective\u003dTrue, include_names\u003dTrue)"},{"line_number":307,"context_line":"                    if not assignments:"},{"line_number":308,"context_line":"                        msg \u003d _(\u0027Cannot perform cascade operation, because the\u0027"},{"line_number":309,"context_line":"                                \u0027 user %(user_id)s does not have access to the\u0027"},{"line_number":310,"context_line":"                                \u0027 whole subtree of project %(root_id)s.\u0027) % ("},{"line_number":311,"context_line":"                            {\u0027user_id\u0027: user_id, \u0027root_id\u0027: root_id})"},{"line_number":312,"context_line":"                        raise exception.Forbidden(message\u003dmsg)"},{"line_number":313,"context_line":""},{"line_number":314,"context_line":"                    role_names \u003d [a[\u0027role_name\u0027] for a in assignments]"},{"line_number":315,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"bae84128_fda91291","line":312,"range":{"start_line":304,"start_character":20,"end_line":312,"end_character":62},"in_reply_to":"bae84128_c54f1a69","updated":"2016-02-24 15:57:06.000000000","message":"Agreed, althought this message is more meaningful...","commit_id":"2f12820426d0dcb7b23c2190d6eafc9bb68a23ab"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"683639d38306176b788bff0da0b2365b29531877","unresolved":false,"context_lines":[{"line_number":301,"context_line":"                    # TODO(samueldmq): Need to think about trusted and"},{"line_number":302,"context_line":"                    # federated authorization"},{"line_number":303,"context_line":""},{"line_number":304,"context_line":"                    assignments \u003d self.assignment_api.list_role_assignments("},{"line_number":305,"context_line":"                        user_id\u003duser_id, project_id\u003dsubproject[\u0027id\u0027],"},{"line_number":306,"context_line":"                        effective\u003dTrue, include_names\u003dTrue)"},{"line_number":307,"context_line":"                    if not assignments:"},{"line_number":308,"context_line":"                        msg \u003d _(\u0027Cannot perform cascade operation, because the\u0027"},{"line_number":309,"context_line":"                                \u0027 user %(user_id)s does not have access to the\u0027"},{"line_number":310,"context_line":"                                \u0027 whole subtree of project %(root_id)s.\u0027) % ("},{"line_number":311,"context_line":"                            {\u0027user_id\u0027: user_id, \u0027root_id\u0027: root_id})"},{"line_number":312,"context_line":"                        raise exception.Forbidden(message\u003dmsg)"},{"line_number":313,"context_line":""},{"line_number":314,"context_line":"                    role_names \u003d [a[\u0027role_name\u0027] for a in assignments]"},{"line_number":315,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"bae84128_bd4caa9e","line":312,"range":{"start_line":304,"start_character":20,"end_line":312,"end_character":62},"in_reply_to":"bae84128_fda91291","updated":"2016-02-24 16:01:47.000000000","message":"Actually, is it possible to get a project scoped token with no roles in that project? I don\u0027t think so, so we should keep it like this and not ask the policy engine (as it doesnt\u0027 happen in a normal workflow)","commit_id":"2f12820426d0dcb7b23c2190d6eafc9bb68a23ab"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"73f59167ffa9a70d1b00532516c339d0931d582a","unresolved":false,"context_lines":[{"line_number":317,"context_line":"                             \u0027user_domain_id\u0027: user_domain_id,"},{"line_number":318,"context_line":"                             \u0027project_id\u0027: subproject[\u0027id\u0027],"},{"line_number":319,"context_line":"                             \u0027project_domain_id\u0027: subproject[\u0027domain_id\u0027],"},{"line_number":320,"context_line":"                             \u0027roles\u0027: role_names}"},{"line_number":321,"context_line":""},{"line_number":322,"context_line":"                    subproject.update(updated_root)"},{"line_number":323,"context_line":"                    prep_info[\u0027input_attr\u0027] \u003d {\u0027project_id\u0027: subproject[\u0027id\u0027],"}],"source_content_type":"text/x-python","patch_set":3,"id":"bae84128_a5a016f5","line":320,"range":{"start_line":320,"start_character":38,"end_line":320,"end_character":48},"updated":"2016-02-24 15:37:28.000000000","message":"isn\u0027t this the roles from the token?","commit_id":"2f12820426d0dcb7b23c2190d6eafc9bb68a23ab"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"d165537840af58842dbbb45f7dcbd5ef6722079a","unresolved":false,"context_lines":[{"line_number":317,"context_line":"                             \u0027user_domain_id\u0027: user_domain_id,"},{"line_number":318,"context_line":"                             \u0027project_id\u0027: subproject[\u0027id\u0027],"},{"line_number":319,"context_line":"                             \u0027project_domain_id\u0027: subproject[\u0027domain_id\u0027],"},{"line_number":320,"context_line":"                             \u0027roles\u0027: role_names}"},{"line_number":321,"context_line":""},{"line_number":322,"context_line":"                    subproject.update(updated_root)"},{"line_number":323,"context_line":"                    prep_info[\u0027input_attr\u0027] \u003d {\u0027project_id\u0027: subproject[\u0027id\u0027],"}],"source_content_type":"text/x-python","patch_set":3,"id":"bae84128_fd80f2f8","line":320,"range":{"start_line":320,"start_character":38,"end_line":320,"end_character":48},"in_reply_to":"bae84128_a5a016f5","updated":"2016-02-24 15:57:06.000000000","message":"no, roles may vary dpeending on scope; inherited roles may not be used in all scenarios","commit_id":"2f12820426d0dcb7b23c2190d6eafc9bb68a23ab"}]}