)]}'
{"keystone/trust/controllers.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ce9b0562e2794871ae13c5c74b130af836e782c3","unresolved":false,"context_lines":[{"line_number":128,"context_line":""},{"line_number":129,"context_line":"        if trust.get(\u0027project_id\u0027) and not trust.get(\u0027roles\u0027):"},{"line_number":130,"context_line":"            msg \u003d _(\u0027At least one role should be specified.\u0027)"},{"line_number":131,"context_line":"            raise exception.Forbidden(msg)"},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"        user_id \u003d self._get_user_id(request.context_dict)"},{"line_number":134,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"fad55976_99be07d3","line":131,"updated":"2016-07-15 15:37:19.000000000","message":"This seems more like a Validation error instead of a Forbidden.","commit_id":"813536b4dd021530339bf59f58240afba6ad0808"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ce9b0562e2794871ae13c5c74b130af836e782c3","unresolved":false,"context_lines":[{"line_number":135,"context_line":"        # the creating user must be the trustor"},{"line_number":136,"context_line":"        if user_id !\u003d trust.get(\u0027trustor_user_id\u0027):"},{"line_number":137,"context_line":"            msg \u003d _(\"The authenticated user should match the trustor.\")"},{"line_number":138,"context_line":"            raise exception.Forbidden(msg)"},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"        # ensure trustee exists"},{"line_number":141,"context_line":"        self.identity_api.get_user(trust[\u0027trustee_user_id\u0027])"}],"source_content_type":"text/x-python","patch_set":2,"id":"fad55976_19921758","line":138,"updated":"2016-07-15 15:37:19.000000000","message":"This all seems like code that should belong in the Manager, since it is business logic specific to how keystone implements trusts.","commit_id":"813536b4dd021530339bf59f58240afba6ad0808"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f5ab127e07d9dc8425b3966d7083500538968fdf","unresolved":false,"context_lines":[{"line_number":135,"context_line":"        # the creating user must be the trustor"},{"line_number":136,"context_line":"        if user_id !\u003d trust.get(\u0027trustor_user_id\u0027):"},{"line_number":137,"context_line":"            msg \u003d _(\"The authenticated user should match the trustor.\")"},{"line_number":138,"context_line":"            raise exception.Forbidden(msg)"},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"        # ensure trustee exists"},{"line_number":141,"context_line":"        self.identity_api.get_user(trust[\u0027trustee_user_id\u0027])"}],"source_content_type":"text/x-python","patch_set":2,"id":"dada55a8_ad503c33","line":138,"in_reply_to":"dada55a8_e74a87ab","updated":"2016-07-20 19:24:32.000000000","message":"True - after talking about this a little more at the midcycle, I\u0027m happy to clean this up later.","commit_id":"813536b4dd021530339bf59f58240afba6ad0808"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"6138b7f5357368c8f036cc60e3dc513d49a1422c","unresolved":false,"context_lines":[{"line_number":135,"context_line":"        # the creating user must be the trustor"},{"line_number":136,"context_line":"        if user_id !\u003d trust.get(\u0027trustor_user_id\u0027):"},{"line_number":137,"context_line":"            msg \u003d _(\"The authenticated user should match the trustor.\")"},{"line_number":138,"context_line":"            raise exception.Forbidden(msg)"},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"        # ensure trustee exists"},{"line_number":141,"context_line":"        self.identity_api.get_user(trust[\u0027trustee_user_id\u0027])"}],"source_content_type":"text/x-python","patch_set":2,"id":"dada55a8_e74a87ab","line":138,"in_reply_to":"fad55976_19921758","updated":"2016-07-19 23:40:31.000000000","message":"Yea, the line for that is really blurred and worse through this controller. Actually if anything this might be the one place where i think the controller makes sense because you are checking the data against the incoming user.\n\nhowever there are a bunch of things like: \n\n    self._require_trustor_has_role_in_project(trust)\n\nthat deserve to be on the manager. I guess that one is here because of the stupid _fill_in_roles method.","commit_id":"813536b4dd021530339bf59f58240afba6ad0808"}]}