)]}'
{"keystone/middleware/auth.py":[{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"596ccb098380827ed592aa128fcf78792d7a5310","unresolved":false,"context_lines":[{"line_number":226,"context_line":"        request_context.user_domain_id \u003d auth_context.get(\u0027user_domain_id\u0027)"},{"line_number":227,"context_line":"        request_context.roles \u003d auth_context.get(\u0027roles\u0027)"},{"line_number":228,"context_line":""},{"line_number":229,"context_line":"        is_admin_project \u003d auth_context.get(\u0027is_admin_project\u0027, True)"},{"line_number":230,"context_line":"        request_context.is_admin_project \u003d is_admin_project"},{"line_number":231,"context_line":""},{"line_number":232,"context_line":"        project_domain_id \u003d auth_context.get(\u0027project_domain_id\u0027)"}],"source_content_type":"text/x-python","patch_set":3,"id":"7a8ec9b2_d3b4d336","line":229,"updated":"2016-09-20 13:39:45.000000000","message":"It\u0027s a bit stange to err on the side of more access.","commit_id":"b78d9cfc463f21516dc0be055dc4e0428c37c637"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"21598f12a2c382ef8e7e68db8cfbc3399fa0e3a6","unresolved":false,"context_lines":[{"line_number":226,"context_line":"        request_context.user_domain_id \u003d auth_context.get(\u0027user_domain_id\u0027)"},{"line_number":227,"context_line":"        request_context.roles \u003d auth_context.get(\u0027roles\u0027)"},{"line_number":228,"context_line":""},{"line_number":229,"context_line":"        is_admin_project \u003d auth_context.get(\u0027is_admin_project\u0027, True)"},{"line_number":230,"context_line":"        request_context.is_admin_project \u003d is_admin_project"},{"line_number":231,"context_line":""},{"line_number":232,"context_line":"        project_domain_id \u003d auth_context.get(\u0027project_domain_id\u0027)"}],"source_content_type":"text/x-python","patch_set":3,"id":"3a98d1f4_ea644de6","line":229,"in_reply_to":"5a8bc5a2_c02b4a93","updated":"2016-09-30 04:07:36.000000000","message":"Yep... Necessary.  We can remove code like this in about 2 releases.","commit_id":"b78d9cfc463f21516dc0be055dc4e0428c37c637"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"65009f678e4696efcb99c948a497212cbf4f2c05","unresolved":false,"context_lines":[{"line_number":226,"context_line":"        request_context.user_domain_id \u003d auth_context.get(\u0027user_domain_id\u0027)"},{"line_number":227,"context_line":"        request_context.roles \u003d auth_context.get(\u0027roles\u0027)"},{"line_number":228,"context_line":""},{"line_number":229,"context_line":"        is_admin_project \u003d auth_context.get(\u0027is_admin_project\u0027, True)"},{"line_number":230,"context_line":"        request_context.is_admin_project \u003d is_admin_project"},{"line_number":231,"context_line":""},{"line_number":232,"context_line":"        project_domain_id \u003d auth_context.get(\u0027project_domain_id\u0027)"}],"source_content_type":"text/x-python","patch_set":3,"id":"5a8bc5a2_c02b4a93","line":229,"in_reply_to":"7a8ec9b2_d3b4d336","updated":"2016-09-28 05:00:11.000000000","message":"this of it as erring on the side of backwards compatibility","commit_id":"b78d9cfc463f21516dc0be055dc4e0428c37c637"}],"keystone/models/token_model.py":[{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"4a9de7bd73388a78a77439f064a5ab0c426d3210","unresolved":false,"context_lines":[{"line_number":231,"context_line":"        return self.project_scoped or self.domain_scoped"},{"line_number":232,"context_line":""},{"line_number":233,"context_line":"    @property"},{"line_number":234,"context_line":"    def is_admin_project(self):"},{"line_number":235,"context_line":"        # True gets returned by default for compatibility with older versions"},{"line_number":236,"context_line":"        if self.version is V3:"},{"line_number":237,"context_line":"            return self.get(\u0027is_admin_project\u0027, True)"}],"source_content_type":"text/x-python","patch_set":3,"id":"fa6399be_469df364","line":234,"range":{"start_line":234,"start_character":8,"end_line":234,"end_character":24},"updated":"2016-10-14 01:45:57.000000000","message":"You should add a test for this new property here:\nhttps://github.com/openstack/keystone/blob/master/keystone/tests/unit/token/test_token_model.py#L38","commit_id":"b78d9cfc463f21516dc0be055dc4e0428c37c637"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"596ccb098380827ed592aa128fcf78792d7a5310","unresolved":false,"context_lines":[{"line_number":232,"context_line":""},{"line_number":233,"context_line":"    @property"},{"line_number":234,"context_line":"    def is_admin_project(self):"},{"line_number":235,"context_line":"        # True gets returned by default for compatibility with older versions"},{"line_number":236,"context_line":"        if self.version is V3:"},{"line_number":237,"context_line":"            return self.get(\u0027is_admin_project\u0027, True)"},{"line_number":238,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"7a8ec9b2_b3b90731","line":235,"updated":"2016-09-20 13:39:45.000000000","message":"Is there a test or something that show why this is backward compatible? It seems counterintuitive.","commit_id":"b78d9cfc463f21516dc0be055dc4e0428c37c637"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"63c9b31da1847afcbe7df42ac1c0f4cfe05c9f7a","unresolved":false,"context_lines":[{"line_number":232,"context_line":""},{"line_number":233,"context_line":"    @property"},{"line_number":234,"context_line":"    def is_admin_project(self):"},{"line_number":235,"context_line":"        # True gets returned by default for compatibility with older versions"},{"line_number":236,"context_line":"        if self.version is V3:"},{"line_number":237,"context_line":"            return self.get(\u0027is_admin_project\u0027, True)"},{"line_number":238,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"3a98d1f4_6a867d66","line":235,"in_reply_to":"3a98d1f4_71beda00","updated":"2016-09-30 04:10:25.000000000","message":"I\u0027m not entirely sure what you\u0027re asking there.\n\nHistorically prior to having is_admin_project whenever you had \"admin\" role you had admin everywhere. \n\nIf is_admin_project is enabled then it will set true or false in the token. \n\nIf it\u0027s not set then we have to do the historical thing and keep working the way we used to which is to respect admin everywhere. In essence every project was the admin project. Similarly for V2 every project was the admin project. \n\nThis is something that will be enabled/disabled by a deployment, not something a developer has to see.","commit_id":"b78d9cfc463f21516dc0be055dc4e0428c37c637"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"7146c5e21d9be73e64a88610846a08efb0872a70","unresolved":false,"context_lines":[{"line_number":232,"context_line":""},{"line_number":233,"context_line":"    @property"},{"line_number":234,"context_line":"    def is_admin_project(self):"},{"line_number":235,"context_line":"        # True gets returned by default for compatibility with older versions"},{"line_number":236,"context_line":"        if self.version is V3:"},{"line_number":237,"context_line":"            return self.get(\u0027is_admin_project\u0027, True)"},{"line_number":238,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"3a98d1f4_0a4df96b","line":235,"in_reply_to":"3a98d1f4_71beda00","updated":"2016-09-30 04:07:00.000000000","message":"No, just the opposite: there might be cases where they think they are supposed to get access, and do when nothing is set up, that they stop getting access to once this is in.  However, this is a necessary transition, and needs to happen this way, or we make no progress.","commit_id":"b78d9cfc463f21516dc0be055dc4e0428c37c637"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"207bc4f28624f825c5c2d2a4c92480ef8a575a58","unresolved":false,"context_lines":[{"line_number":232,"context_line":""},{"line_number":233,"context_line":"    @property"},{"line_number":234,"context_line":"    def is_admin_project(self):"},{"line_number":235,"context_line":"        # True gets returned by default for compatibility with older versions"},{"line_number":236,"context_line":"        if self.version is V3:"},{"line_number":237,"context_line":"            return self.get(\u0027is_admin_project\u0027, True)"},{"line_number":238,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"3a98d1f4_71beda00","line":235,"in_reply_to":"7a8ec9b2_494c7970","updated":"2016-09-28 14:13:31.000000000","message":"So I\u0027m a little worried that this will cause future security issues. If someone is developing a new feature (that doesn\u0027t need backward compat) and uses this because the see an `is_admin_project` property, they may not be getting what they think they are getting. Is that possible and if it is can we stop it?","commit_id":"b78d9cfc463f21516dc0be055dc4e0428c37c637"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"43d4e4a31110908d41afbfe42e1d2e9e5bc3a9a8","unresolved":false,"context_lines":[{"line_number":232,"context_line":""},{"line_number":233,"context_line":"    @property"},{"line_number":234,"context_line":"    def is_admin_project(self):"},{"line_number":235,"context_line":"        # True gets returned by default for compatibility with older versions"},{"line_number":236,"context_line":"        if self.version is V3:"},{"line_number":237,"context_line":"            return self.get(\u0027is_admin_project\u0027, True)"},{"line_number":238,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"7a8ec9b2_494c7970","line":235,"in_reply_to":"7a8ec9b2_7354df53","updated":"2016-09-20 22:50:35.000000000","message":"Right, when admin_project is not defined as in older versions of keystone every project was an admin project. So we default to true to say yes this is an admin project so it doesn\u0027t fail new policies.","commit_id":"b78d9cfc463f21516dc0be055dc4e0428c37c637"},{"author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"change_message_id":"67bc7bd69a0c29a638a466b446f975168139c047","unresolved":false,"context_lines":[{"line_number":232,"context_line":""},{"line_number":233,"context_line":"    @property"},{"line_number":234,"context_line":"    def is_admin_project(self):"},{"line_number":235,"context_line":"        # True gets returned by default for compatibility with older versions"},{"line_number":236,"context_line":"        if self.version is V3:"},{"line_number":237,"context_line":"            return self.get(\u0027is_admin_project\u0027, True)"},{"line_number":238,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"7a8ec9b2_7354df53","line":235,"in_reply_to":"7a8ec9b2_b3b90731","updated":"2016-09-20 13:49:04.000000000","message":"AFAIK, any project used to act like an admin project. So it didn\u0027t matter which project you had the admin role on, as long as you had it. This does the same thing by returning True by default.","commit_id":"b78d9cfc463f21516dc0be055dc4e0428c37c637"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"4a9de7bd73388a78a77439f064a5ab0c426d3210","unresolved":false,"context_lines":[{"line_number":233,"context_line":"    @property"},{"line_number":234,"context_line":"    def is_admin_project(self):"},{"line_number":235,"context_line":"        # True gets returned by default for compatibility with older versions"},{"line_number":236,"context_line":"        if self.version is V3:"},{"line_number":237,"context_line":"            return self.get(\u0027is_admin_project\u0027, True)"},{"line_number":238,"context_line":""},{"line_number":239,"context_line":"        return True"}],"source_content_type":"text/x-python","patch_set":3,"id":"fa6399be_267b9f29","line":236,"range":{"start_line":236,"start_character":8,"end_line":236,"end_character":30},"updated":"2016-10-14 01:45:57.000000000","message":"This needs a rebase; we\u0027re not longer checking for v3 in the token_model:\nhttps://github.com/openstack/keystone/blob/master/keystone/models/token_model.py","commit_id":"b78d9cfc463f21516dc0be055dc4e0428c37c637"}]}