)]}'
{"keystone/assignment/core.py":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"cb72e97dd8a6509a9299d74e8534eccf7ff326cc","unresolved":false,"context_lines":[{"line_number":1200,"context_line":"        prior_role \u003d self.driver.get_role(prior_role_id)"},{"line_number":1201,"context_line":"        if implied_role[\u0027name\u0027] in CONF.assignment.prohibited_implied_role:"},{"line_number":1202,"context_line":"            raise exception.InvalidImpliedRole(role_id\u003dimplied_role_id)"},{"line_number":1203,"context_line":"        if (prior_role[\u0027domain_id\u0027] !\u003d implied_role[\u0027domain_id\u0027] and"},{"line_number":1204,"context_line":"                prior_role[\u0027domain_id\u0027] is not None and"},{"line_number":1205,"context_line":"                implied_role[\u0027domain_id\u0027] is not None):"},{"line_number":1206,"context_line":"            msg \u003d _(\u0027Domain-specific roles can not imply a domain-specific \u0027"},{"line_number":1207,"context_line":"                    \u0027roles from different domain\u0027)"},{"line_number":1208,"context_line":"            raise exception.InvalidImpliedRole(msg, role_id\u003dimplied_role_id)"},{"line_number":1209,"context_line":"        response \u003d self.driver.create_implied_role("},{"line_number":1210,"context_line":"            prior_role_id, implied_role_id)"},{"line_number":1211,"context_line":"        COMPUTED_ASSIGNMENTS_REGION.invalidate()"}],"source_content_type":"text/x-python","patch_set":1,"id":"bacf61ea_69cf617f","line":1208,"range":{"start_line":1203,"start_character":8,"end_line":1208,"end_character":76},"updated":"2016-08-05 04:41:17.000000000","message":"This seems to be checking more than one thing?\n\nI think we want to check:\n  - that DSR1 in domain A can\u0027t imply DSR2 in domain B\n  - a DSR can\u0027t imply a global role\n\nThe checks should raise different error messages","commit_id":"59057a0c1514a4b56256764d1da88087c8984801"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"9fc94a2fcbd0115b38fcd524bc9e7c5dcf65f6b9","unresolved":false,"context_lines":[{"line_number":1201,"context_line":"        if implied_role[\u0027name\u0027] in CONF.assignment.prohibited_implied_role:"},{"line_number":1202,"context_line":"            raise exception.InvalidImpliedRole(role_id\u003dimplied_role_id)"},{"line_number":1203,"context_line":""},{"line_number":1204,"context_line":"        if prior_role[\u0027domain_id\u0027] !\u003d implied_role[\u0027domain_id\u0027]:"},{"line_number":1205,"context_line":"            if implied_role[\u0027domain_id\u0027] is None:"},{"line_number":1206,"context_line":"                msg \u003d _(\u0027Domain-specific roles can not imply global roles\u0027)"},{"line_number":1207,"context_line":"                raise exception.InvalidImpliedRole(msg,"}],"source_content_type":"text/x-python","patch_set":2,"id":"3ac371cc_1ab7743a","line":1204,"range":{"start_line":1204,"start_character":8,"end_line":1204,"end_character":64},"updated":"2016-08-15 19:56:39.000000000","message":"I think we need:\n\n  if prior_role[\u0027domain_id\u0027] \u003d\u003d None\n    raise exception\n\n  # At this point prior domain_id is guaranteed to be not null\n  prior_role[\u0027domain_id\u0027] !\u003d implied_role[\u0027domain_id\u0027]:\n    raise exception","commit_id":"b42d861ac07ed6e080822fab56317dd529c6d511"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"292c93d036abb1822254b6277ae3d59306b5bc6a","unresolved":false,"context_lines":[{"line_number":1201,"context_line":"        if implied_role[\u0027name\u0027] in CONF.assignment.prohibited_implied_role:"},{"line_number":1202,"context_line":"            raise exception.InvalidImpliedRole(role_id\u003dimplied_role_id)"},{"line_number":1203,"context_line":""},{"line_number":1204,"context_line":"        if prior_role[\u0027domain_id\u0027] !\u003d implied_role[\u0027domain_id\u0027]:"},{"line_number":1205,"context_line":"            if implied_role[\u0027domain_id\u0027] is None:"},{"line_number":1206,"context_line":"                msg \u003d _(\u0027Domain-specific roles can not imply global roles\u0027)"},{"line_number":1207,"context_line":"                raise exception.InvalidImpliedRole(msg,"}],"source_content_type":"text/x-python","patch_set":2,"id":"3ac371cc_28706a71","line":1204,"range":{"start_line":1204,"start_character":8,"end_line":1204,"end_character":64},"in_reply_to":"3ac371cc_1ab7743a","updated":"2016-08-18 16:19:53.000000000","message":"Done","commit_id":"b42d861ac07ed6e080822fab56317dd529c6d511"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"9fc94a2fcbd0115b38fcd524bc9e7c5dcf65f6b9","unresolved":false,"context_lines":[{"line_number":1202,"context_line":"            raise exception.InvalidImpliedRole(role_id\u003dimplied_role_id)"},{"line_number":1203,"context_line":""},{"line_number":1204,"context_line":"        if prior_role[\u0027domain_id\u0027] !\u003d implied_role[\u0027domain_id\u0027]:"},{"line_number":1205,"context_line":"            if implied_role[\u0027domain_id\u0027] is None:"},{"line_number":1206,"context_line":"                msg \u003d _(\u0027Domain-specific roles can not imply global roles\u0027)"},{"line_number":1207,"context_line":"                raise exception.InvalidImpliedRole(msg,"},{"line_number":1208,"context_line":"                                                   role_id\u003dimplied_role_id)"},{"line_number":1209,"context_line":"            elif prior_role[\u0027domain_id\u0027] is not None:"},{"line_number":1210,"context_line":"                msg \u003d _(\u0027Domain-specific roles can not imply a domain-specific\u0027"},{"line_number":1211,"context_line":"                        \u0027 roles from different domain\u0027)"}],"source_content_type":"text/x-python","patch_set":2,"id":"3ac371cc_e422c1b8","line":1208,"range":{"start_line":1205,"start_character":12,"end_line":1208,"end_character":75},"updated":"2016-08-15 19:56:39.000000000","message":"we need to flip this around and check to make sure the prior role is not a global role","commit_id":"b42d861ac07ed6e080822fab56317dd529c6d511"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"292c93d036abb1822254b6277ae3d59306b5bc6a","unresolved":false,"context_lines":[{"line_number":1202,"context_line":"            raise exception.InvalidImpliedRole(role_id\u003dimplied_role_id)"},{"line_number":1203,"context_line":""},{"line_number":1204,"context_line":"        if prior_role[\u0027domain_id\u0027] !\u003d implied_role[\u0027domain_id\u0027]:"},{"line_number":1205,"context_line":"            if implied_role[\u0027domain_id\u0027] is None:"},{"line_number":1206,"context_line":"                msg \u003d _(\u0027Domain-specific roles can not imply global roles\u0027)"},{"line_number":1207,"context_line":"                raise exception.InvalidImpliedRole(msg,"},{"line_number":1208,"context_line":"                                                   role_id\u003dimplied_role_id)"},{"line_number":1209,"context_line":"            elif prior_role[\u0027domain_id\u0027] is not None:"},{"line_number":1210,"context_line":"                msg \u003d _(\u0027Domain-specific roles can not imply a domain-specific\u0027"},{"line_number":1211,"context_line":"                        \u0027 roles from different domain\u0027)"}],"source_content_type":"text/x-python","patch_set":2,"id":"3ac371cc_4875e661","line":1208,"range":{"start_line":1205,"start_character":12,"end_line":1208,"end_character":75},"in_reply_to":"3ac371cc_e422c1b8","updated":"2016-08-18 16:19:53.000000000","message":"Done","commit_id":"b42d861ac07ed6e080822fab56317dd529c6d511"},{"author":{"_account_id":21465,"name":"Mikhail Nikolaenko","email":"mnikolaenko@protonmail.com","username":"mnikolaenko"},"change_message_id":"9f226020d850110f53450dcacadfb995b462a623","unresolved":false,"context_lines":[{"line_number":1201,"context_line":"        if implied_role[\u0027name\u0027] in CONF.assignment.prohibited_implied_role:"},{"line_number":1202,"context_line":"            raise exception.InvalidImpliedRole(role_id\u003dimplied_role_id)"},{"line_number":1203,"context_line":""},{"line_number":1204,"context_line":"        if prior_role[\u0027domain_id\u0027] is None and not implied_role[\u0027domain_id\u0027]:"},{"line_number":1205,"context_line":"            msg \u003d _(\u0027Domain-specific roles cannot imply a global roles\u0027)"},{"line_number":1206,"context_line":"            raise exception.InvalidImpliedRole(msg, role_id\u003dimplied_role_id)"},{"line_number":1207,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"1ac06dbe_17c8df21","line":1204,"range":{"start_line":1204,"start_character":47,"end_line":1204,"end_character":77},"updated":"2016-08-21 15:55:01.000000000","message":"I think there should be:\nimplied_role[\u0027domain_id\u0027] is not None","commit_id":"4880d2caeae2fb99971be21270e9a63eeec3e1f5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"31a90b3810d661152e3be9bf0ddddba20c7380b4","unresolved":false,"context_lines":[{"line_number":1202,"context_line":"            raise exception.InvalidImpliedRole(role_id\u003dimplied_role_id)"},{"line_number":1203,"context_line":""},{"line_number":1204,"context_line":"        if prior_role[\u0027domain_id\u0027] is None and not implied_role[\u0027domain_id\u0027]:"},{"line_number":1205,"context_line":"            msg \u003d _(\u0027Domain-specific roles cannot imply a global roles\u0027)"},{"line_number":1206,"context_line":"            raise exception.InvalidImpliedRole(msg, role_id\u003dimplied_role_id)"},{"line_number":1207,"context_line":""},{"line_number":1208,"context_line":"        if prior_role[\u0027domain_id\u0027] !\u003d implied_role[\u0027domain_id\u0027]:"}],"source_content_type":"text/x-python","patch_set":3,"id":"3ac371cc_2bf4da85","line":1205,"updated":"2016-08-18 19:22:15.000000000","message":"\"imply global roles\" or \"imply a global role\" ?","commit_id":"4880d2caeae2fb99971be21270e9a63eeec3e1f5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"31a90b3810d661152e3be9bf0ddddba20c7380b4","unresolved":false,"context_lines":[{"line_number":1203,"context_line":""},{"line_number":1204,"context_line":"        if prior_role[\u0027domain_id\u0027] is None and not implied_role[\u0027domain_id\u0027]:"},{"line_number":1205,"context_line":"            msg \u003d _(\u0027Domain-specific roles cannot imply a global roles\u0027)"},{"line_number":1206,"context_line":"            raise exception.InvalidImpliedRole(msg, role_id\u003dimplied_role_id)"},{"line_number":1207,"context_line":""},{"line_number":1208,"context_line":"        if prior_role[\u0027domain_id\u0027] !\u003d implied_role[\u0027domain_id\u0027]:"},{"line_number":1209,"context_line":"            msg \u003d _(\u0027Domain-specific roles cannot imply a domain-specific\u0027"}],"source_content_type":"text/x-python","patch_set":3,"id":"3ac371cc_6b4532b2","line":1206,"updated":"2016-08-18 19:22:15.000000000","message":"InvalidImpliedRole only shows this custom message in insecure debug mode, would it be safe to create an exception class where these messages could be displayed to the user?","commit_id":"4880d2caeae2fb99971be21270e9a63eeec3e1f5"},{"author":{"_account_id":21465,"name":"Mikhail Nikolaenko","email":"mnikolaenko@protonmail.com","username":"mnikolaenko"},"change_message_id":"9f226020d850110f53450dcacadfb995b462a623","unresolved":false,"context_lines":[{"line_number":1205,"context_line":"            msg \u003d _(\u0027Domain-specific roles cannot imply a global roles\u0027)"},{"line_number":1206,"context_line":"            raise exception.InvalidImpliedRole(msg, role_id\u003dimplied_role_id)"},{"line_number":1207,"context_line":""},{"line_number":1208,"context_line":"        if prior_role[\u0027domain_id\u0027] !\u003d implied_role[\u0027domain_id\u0027]:"},{"line_number":1209,"context_line":"            msg \u003d _(\u0027Domain-specific roles cannot imply a domain-specific\u0027"},{"line_number":1210,"context_line":"                    \u0027 roles from different domain\u0027)"},{"line_number":1211,"context_line":"            raise exception.InvalidImpliedRole(msg, role_id\u003dimplied_role_id)"}],"source_content_type":"text/x-python","patch_set":3,"id":"1ac06dbe_d79487e3","line":1208,"range":{"start_line":1208,"start_character":8,"end_line":1208,"end_character":64},"updated":"2016-08-21 15:55:01.000000000","message":"This also catch a case when DSR implies global role. So I think that \"if prior_role[\u0027domain_id\u0027] !\u003d implied_role[\u0027domain_id\u0027]\" is the main criterion.","commit_id":"4880d2caeae2fb99971be21270e9a63eeec3e1f5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"31a90b3810d661152e3be9bf0ddddba20c7380b4","unresolved":false,"context_lines":[{"line_number":1207,"context_line":""},{"line_number":1208,"context_line":"        if prior_role[\u0027domain_id\u0027] !\u003d implied_role[\u0027domain_id\u0027]:"},{"line_number":1209,"context_line":"            msg \u003d _(\u0027Domain-specific roles cannot imply a domain-specific\u0027"},{"line_number":1210,"context_line":"                    \u0027 roles from different domain\u0027)"},{"line_number":1211,"context_line":"            raise exception.InvalidImpliedRole(msg, role_id\u003dimplied_role_id)"},{"line_number":1212,"context_line":""},{"line_number":1213,"context_line":"        response \u003d self.driver.create_implied_role("}],"source_content_type":"text/x-python","patch_set":3,"id":"3ac371cc_2b221a02","line":1210,"updated":"2016-08-18 19:22:15.000000000","message":"\u0027imply a domain-specific role\u0027 or \u0027imply domain-specific roles\u0027 ?","commit_id":"4880d2caeae2fb99971be21270e9a63eeec3e1f5"}]}