)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"caeb7f96c058f51b7b68c374a431599892eb2920","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     David Stanek \u003cdstanek@dstanek.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2016-08-18 02:09:15 +0000"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Add test for revocation corner case in Fernet"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This test simulates what happens when a Fernet token is generated"},{"line_number":10,"context_line":"*after* the disable event. Technically this should not happen, but"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"9a89bdaa_2ea392b3","line":7,"range":{"start_line":7,"start_character":37,"end_line":7,"end_character":45},"updated":"2016-09-07 03:51:00.000000000","message":"is this test only valid for fernet ? it\u0027s failing for uuid in: keystone.tests.unit.test_auth.UUIDAuthWithTrust.test_trust_get_token_fails_if_trustee_disabled_2","commit_id":"a05b35ae7700884ab9ee31fccf7099b688e10df7"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"d4292f054090f2a7bfee4ced3b984b18c16325b1","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This commit introduces two tests that ensures if a trustee of a"},{"line_number":10,"context_line":"trust-scoped token is disabled, keystone will emit a Forbidden"},{"line_number":11,"context_line":"exception. Regardless of the token provider, keystone should have"},{"line_number":12,"context_line":"a consistent behavior. In order to test this, the test had to be"},{"line_number":13,"context_line":"implemented differently for each token provider, specifically for"},{"line_number":14,"context_line":"persistent and non-persistent tokens."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"7a8ec9b2_2a81344b","line":11,"range":{"start_line":11,"start_character":0,"end_line":11,"end_character":9},"updated":"2016-09-14 01:16:42.000000000","message":"on token validation","commit_id":"acde6ff5b388a6cb1add19fa958007c172b345c3"}],"keystone/tests/unit/test_auth.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"8edc6d20aa2d62adb31ad8217a7ce4fda47fed7d","unresolved":false,"context_lines":[{"line_number":1298,"context_line":"    def test_trust_get_token_fails_if_trustee_disabled_2(self):"},{"line_number":1299,"context_line":"        \"\"\"Test disabling trustee and using an unrevoked token."},{"line_number":1300,"context_line":""},{"line_number":1301,"context_line":"        This test simulates what happens when a Fernet token is generated"},{"line_number":1302,"context_line":"        *after* the disable event. Technically this should not happen, but"},{"line_number":1303,"context_line":"        it\u0027s possible in a multinode deployment with only a slight clock skew."},{"line_number":1304,"context_line":"        \"\"\""}],"source_content_type":"text/x-python","patch_set":2,"id":"9a89bdaa_76c2c4ea","line":1301,"updated":"2016-09-12 22:02:05.000000000","message":"Should we make this a Fernet specific test in FernetAuthWithTrust?","commit_id":"a05b35ae7700884ab9ee31fccf7099b688e10df7"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"caeb7f96c058f51b7b68c374a431599892eb2920","unresolved":false,"context_lines":[{"line_number":1309,"context_line":"        epoch \u003d datetime.datetime.utcfromtimestamp(0)"},{"line_number":1310,"context_line":"        future_time \u003d (timeutils.utcnow() - epoch).total_seconds() + 5"},{"line_number":1311,"context_line":""},{"line_number":1312,"context_line":"        # get a token from the future"},{"line_number":1313,"context_line":"        with mock.patch.object(time, \u0027time\u0027, lambda: future_time):"},{"line_number":1314,"context_line":"            request_body \u003d self.build_v2_token_request("},{"line_number":1315,"context_line":"                self.trustee[\u0027name\u0027], self.trustee[\u0027password\u0027], new_trust)"}],"source_content_type":"text/x-python","patch_set":2,"id":"9a89bdaa_0e16cef0","line":1312,"range":{"start_line":1312,"start_character":8,"end_line":1312,"end_character":37},"updated":"2016-09-07 03:51:00.000000000","message":"wow","commit_id":"a05b35ae7700884ab9ee31fccf7099b688e10df7"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2d1a99a4a64151eff0ade05d7306c5fe63a830f6","unresolved":false,"context_lines":[{"line_number":1310,"context_line":"        future_time \u003d (timeutils.utcnow() - epoch).total_seconds() + 5"},{"line_number":1311,"context_line":""},{"line_number":1312,"context_line":"        # get a token from the future"},{"line_number":1313,"context_line":"        with mock.patch.object(time, \u0027time\u0027, lambda: future_time):"},{"line_number":1314,"context_line":"            request_body \u003d self.build_v2_token_request("},{"line_number":1315,"context_line":"                self.trustee[\u0027name\u0027], self.trustee[\u0027password\u0027], new_trust)"},{"line_number":1316,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"9a89bdaa_eadfc837","line":1313,"updated":"2016-09-12 22:16:01.000000000","message":"This will for sure work to patch time.time() for the fernet implementation, but I don\u0027t think it will work for the UUID provider since we generate the issued_at time differently.\n\nv2.0 - \nhttps://github.com/openstack/keystone/blob/e10305da58cc5160c75f259a10eb6fff92e0d1de/keystone/token/providers/common.py#L181\n\nv3 - https://github.com/openstack/keystone/blob/e10305da58cc5160c75f259a10eb6fff92e0d1de/keystone/token/providers/common.py#L549","commit_id":"a05b35ae7700884ab9ee31fccf7099b688e10df7"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1532138719e1ed590d9cf59c68042cfafa4b1c2e","unresolved":false,"context_lines":[{"line_number":1310,"context_line":"        future_time \u003d (timeutils.utcnow() - epoch).total_seconds() + 5"},{"line_number":1311,"context_line":""},{"line_number":1312,"context_line":"        # get a token from the future"},{"line_number":1313,"context_line":"        with mock.patch.object(time, \u0027time\u0027, lambda: future_time):"},{"line_number":1314,"context_line":"            request_body \u003d self.build_v2_token_request("},{"line_number":1315,"context_line":"                self.trustee[\u0027name\u0027], self.trustee[\u0027password\u0027], new_trust)"},{"line_number":1316,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"9a89bdaa_8a2c7c03","line":1313,"in_reply_to":"9a89bdaa_eadfc837","updated":"2016-09-12 22:24:19.000000000","message":"The reason why this fails for UUID tokens is because the token_provider_api will run a callback when a user is disabled (which we\u0027re doing on line 1317) [0]. \n\nEven, if we could generate a UUID token in the future, it would probably still be considered invalid according to sql because the callback will look through the token table for all tokens with that user and set valid\u003dFalse. I think this means we\u0027ll always just get a 404 TokenNotFound from keystone/persistence/backends/sql.py.\n\nKnowing that, maybe this test really does only make sense for Fernet?\n\n[0] https://github.com/openstack/keystone/blob/e10305da58cc5160c75f259a10eb6fff92e0d1de/keystone/token/provider.py#L161","commit_id":"a05b35ae7700884ab9ee31fccf7099b688e10df7"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"8daa0b28c2e148aab8d7dbc2ab8ce9c6863f92c7","unresolved":false,"context_lines":[{"line_number":1316,"context_line":""},{"line_number":1317,"context_line":"        self.disable_user(self.trustee)"},{"line_number":1318,"context_line":"        self.assertRaises("},{"line_number":1319,"context_line":"            exception.Forbidden,"},{"line_number":1320,"context_line":"            self.controller.authenticate, self.make_request(), request_body)"},{"line_number":1321,"context_line":""},{"line_number":1322,"context_line":"    def test_validate_trust_scoped_token_against_v2(self):"}],"source_content_type":"text/x-python","patch_set":2,"id":"9a89bdaa_561300b8","line":1319,"updated":"2016-09-12 21:57:45.000000000","message":"This is going to fail with the UUID provider because for some reason token_ref.valid is False when you try to retrieve the token from the backend (which obviously doesn\u0027t happen with Fernet): \n\nhttps://github.com/openstack/keystone/blob/e10305da58cc5160c75f259a10eb6fff92e0d1de/keystone/token/persistence/backends/sql.py#L91\n\n\nThis causes a TokenNotFound exception to be raised https://github.com/openstack/keystone/blob/e10305da58cc5160c75f259a10eb6fff92e0d1de/keystone/token/persistence/backends/sql.py#L92  which is then excepted here - https://github.com/openstack/keystone/blob/e10305da58cc5160c75f259a10eb6fff92e0d1de/keystone/token/controllers.py#L182 and raised as an Unauthorized.","commit_id":"a05b35ae7700884ab9ee31fccf7099b688e10df7"}]}