)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"7bcfceaa7e8fb503193e8d0658ffecb8c6eebece","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Adam Young \u003cayoung@redhat.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2016-10-17 11:54:48 -0400"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Refactor Authorization:"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Merged the decorator logic into a single function that"},{"line_number":10,"context_line":"calls check_policy. Moved authorization logic in authorize.py"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"fa6399be_082abae7","line":7,"range":{"start_line":7,"start_character":0,"end_line":7,"end_character":23},"updated":"2016-10-18 03:01:32.000000000","message":"please don\u0027t end this with a colon","commit_id":"d1cfe07fd494a8309d2617de8dbd3b5a1baa9c83"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"7bcfceaa7e8fb503193e8d0658ffecb8c6eebece","unresolved":false,"context_lines":[{"line_number":9,"context_line":"Merged the decorator logic into a single function that"},{"line_number":10,"context_line":"calls check_policy. Moved authorization logic in authorize.py"},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Prep for oslo-context fixes"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Change-Id: Id1452db131740c68b3756a819792f9a60cff239c"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"fa6399be_e8ee66b3","line":12,"range":{"start_line":12,"start_character":0,"end_line":12,"end_character":27},"updated":"2016-10-18 03:01:32.000000000","message":"this is an incomplete sentence, what oslo.context fixes are you referring to?","commit_id":"d1cfe07fd494a8309d2617de8dbd3b5a1baa9c83"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2485d73ff135877a5bb95baf9f0e3f60c5909325","unresolved":false,"context_lines":[{"line_number":7,"context_line":"Refactor Authorization:"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Merged the decorator logic into a single function that"},{"line_number":10,"context_line":"calls check_policy. Moved authorization logic in authorize.py"},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Prep for oslo-context fixes"},{"line_number":13,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":12,"id":"3a1ff146_4f274912","line":10,"updated":"2017-03-15 20:13:32.000000000","message":"Why did the authorization logic need to be moved. I can see that it was moved by looking at the commit - clarifying the reason here would be helpful.","commit_id":"f4c3699ddb9777a0c565e27806f8ff5dd9bd5ddb"}],"keystone/common/authorization.py":[{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"42f53d40545042d07ea1f58d52dec898a4c7f524","unresolved":false,"context_lines":[{"line_number":116,"context_line":"    return auth_context"},{"line_number":117,"context_line":""},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"def assert_admin(app, request):"},{"line_number":120,"context_line":"    \"\"\"Ensure the user is an admin."},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"    :raises keystone.exception.Unauthorized: if a token could not be"}],"source_content_type":"text/x-python","patch_set":2,"id":"fa6399be_e98a1a1a","line":119,"updated":"2016-10-17 05:10:07.000000000","message":"Note that this logic still needs to be unified with the check_policy code below, but that is a fix and not a straight refactoring, and will happen in an additional commit.","commit_id":"528df86c26c49a3b39cd874be06568150d6d030b"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"42f53d40545042d07ea1f58d52dec898a4c7f524","unresolved":false,"context_lines":[{"line_number":150,"context_line":"        app.policy_api.enforce(creds, \u0027admin_required\u0027, {})"},{"line_number":151,"context_line":""},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"def _build_policy_check_credentials(action, context, kwargs):"},{"line_number":154,"context_line":"    kwargs_str \u003d \u0027, \u0027.join([\u0027%s\u003d%s\u0027 % (k, kwargs[k]) for k in kwargs])"},{"line_number":155,"context_line":"    kwargs_str \u003d strutils.mask_password(kwargs_str)"},{"line_number":156,"context_line":"    msg \u003d \u0027RBAC: Authorizing %(action)s(%(kwargs)s)\u0027"}],"source_content_type":"text/x-python","patch_set":2,"id":"fa6399be_098e6e2d","line":153,"updated":"2016-10-17 05:10:07.000000000","message":"This can be inlined now.","commit_id":"528df86c26c49a3b39cd874be06568150d6d030b"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"42f53d40545042d07ea1f58d52dec898a4c7f524","unresolved":false,"context_lines":[{"line_number":196,"context_line":"                    user_domain_id)"},{"line_number":197,"context_line":""},{"line_number":198,"context_line":""},{"line_number":199,"context_line":"def check_protection(controller, request, prep_info, target_attr\u003dNone,"},{"line_number":200,"context_line":"                     *args, **kwargs):"},{"line_number":201,"context_line":"    \"\"\"Provide call protection for complex target attributes."},{"line_number":202,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"fa6399be_a9758232","line":199,"updated":"2016-10-17 05:10:07.000000000","message":"This is the *good* function, and is what everything else should call to check policy.  Any additional logic to our policy check should work with this function.","commit_id":"528df86c26c49a3b39cd874be06568150d6d030b"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"42f53d40545042d07ea1f58d52dec898a4c7f524","unresolved":false,"context_lines":[{"line_number":236,"context_line":"    LOG.debug(\u0027RBAC: Authorization granted\u0027)"},{"line_number":237,"context_line":""},{"line_number":238,"context_line":""},{"line_number":239,"context_line":"def common_policy_check():"},{"line_number":240,"context_line":"    LOG.debug(\u0027RBAC: Authorization granted\u0027)"},{"line_number":241,"context_line":""},{"line_number":242,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"fa6399be_49adc699","line":239,"updated":"2016-10-17 05:10:07.000000000","message":"This needs to be removed","commit_id":"528df86c26c49a3b39cd874be06568150d6d030b"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"7bcfceaa7e8fb503193e8d0658ffecb8c6eebece","unresolved":false,"context_lines":[{"line_number":233,"context_line":"        controller.policy_api.enforce(creds,"},{"line_number":234,"context_line":"                                      action,"},{"line_number":235,"context_line":"                                      utils.flatten_dict(policy_dict))"},{"line_number":236,"context_line":"    LOG.debug(\u0027RBAC: Authorization granted\u0027)"},{"line_number":237,"context_line":""},{"line_number":238,"context_line":""},{"line_number":239,"context_line":"def common_policy_check():"}],"source_content_type":"text/x-python","patch_set":3,"id":"fa6399be_28cbfe1f","line":236,"range":{"start_line":236,"start_character":4,"end_line":236,"end_character":44},"updated":"2016-10-18 03:01:32.000000000","message":"this should be in the else block according to the original impl.","commit_id":"d1cfe07fd494a8309d2617de8dbd3b5a1baa9c83"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"f4d91be46a22c244e4ba2fac9accf657055cf299","unresolved":false,"context_lines":[{"line_number":233,"context_line":"        controller.policy_api.enforce(creds,"},{"line_number":234,"context_line":"                                      action,"},{"line_number":235,"context_line":"                                      utils.flatten_dict(policy_dict))"},{"line_number":236,"context_line":"    LOG.debug(\u0027RBAC: Authorization granted\u0027)"},{"line_number":237,"context_line":""},{"line_number":238,"context_line":""},{"line_number":239,"context_line":"def common_policy_check():"}],"source_content_type":"text/x-python","patch_set":3,"id":"7a77a97e_7a9daa58","line":236,"range":{"start_line":236,"start_character":4,"end_line":236,"end_character":44},"in_reply_to":"fa6399be_28cbfe1f","updated":"2016-11-22 02:33:59.000000000","message":"Yes, but having it outside the block actually performs the required logging for both.  This was deliberate.","commit_id":"d1cfe07fd494a8309d2617de8dbd3b5a1baa9c83"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"7bcfceaa7e8fb503193e8d0658ffecb8c6eebece","unresolved":false,"context_lines":[{"line_number":236,"context_line":"    LOG.debug(\u0027RBAC: Authorization granted\u0027)"},{"line_number":237,"context_line":""},{"line_number":238,"context_line":""},{"line_number":239,"context_line":"def common_policy_check():"},{"line_number":240,"context_line":"    LOG.debug(\u0027RBAC: Authorization granted\u0027)"},{"line_number":241,"context_line":""},{"line_number":242,"context_line":""},{"line_number":243,"context_line":"def get_token_ref(context):"}],"source_content_type":"text/x-python","patch_set":3,"id":"fa6399be_c82e02a5","line":240,"range":{"start_line":239,"start_character":0,"end_line":240,"end_character":44},"updated":"2016-10-18 03:01:32.000000000","message":"is this used anywhere?","commit_id":"d1cfe07fd494a8309d2617de8dbd3b5a1baa9c83"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"f4d91be46a22c244e4ba2fac9accf657055cf299","unresolved":false,"context_lines":[{"line_number":236,"context_line":"    LOG.debug(\u0027RBAC: Authorization granted\u0027)"},{"line_number":237,"context_line":""},{"line_number":238,"context_line":""},{"line_number":239,"context_line":"def common_policy_check():"},{"line_number":240,"context_line":"    LOG.debug(\u0027RBAC: Authorization granted\u0027)"},{"line_number":241,"context_line":""},{"line_number":242,"context_line":""},{"line_number":243,"context_line":"def get_token_ref(context):"}],"source_content_type":"text/x-python","patch_set":3,"id":"7a77a97e_eb61ead4","line":240,"range":{"start_line":239,"start_character":0,"end_line":240,"end_character":44},"in_reply_to":"fa6399be_c82e02a5","updated":"2016-11-22 02:33:59.000000000","message":"No...vestige of a cleanup.,  Will remove it.","commit_id":"d1cfe07fd494a8309d2617de8dbd3b5a1baa9c83"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"aa5d7a7dbf305dbbcee7b42ca9070d6f31c605c9","unresolved":false,"context_lines":[{"line_number":175,"context_line":""},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"def token_validation_window(request):"},{"line_number":178,"context_line":"    # NOTE(jamielennox): it\u0027s dumb that i have to put this here. We should"},{"line_number":179,"context_line":"    # only validate subject token in one place."},{"line_number":180,"context_line":""},{"line_number":181,"context_line":"    allow_expired \u003d request.params.get(\u0027allow_expired\u0027)"},{"line_number":182,"context_line":"    allow_expired \u003d strutils.bool_from_string(allow_expired, default\u003dFalse)"}],"source_content_type":"text/x-python","patch_set":9,"id":"ba5201f7_00956731","line":179,"range":{"start_line":178,"start_character":0,"end_line":179,"end_character":47},"updated":"2017-01-08 05:23:47.000000000","message":"this comment can go away now :)","commit_id":"6a8dfe6a4bee1d7050b3e53d861d841f64c498a8"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"14244de34a392f4af0770aad2f969a515db53e45","unresolved":false,"context_lines":[{"line_number":175,"context_line":""},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"def token_validation_window(request):"},{"line_number":178,"context_line":"    # NOTE(jamielennox): it\u0027s dumb that i have to put this here. We should"},{"line_number":179,"context_line":"    # only validate subject token in one place."},{"line_number":180,"context_line":""},{"line_number":181,"context_line":"    allow_expired \u003d request.params.get(\u0027allow_expired\u0027)"},{"line_number":182,"context_line":"    allow_expired \u003d strutils.bool_from_string(allow_expired, default\u003dFalse)"}],"source_content_type":"text/x-python","patch_set":9,"id":"ba5201f7_958a7062","line":179,"range":{"start_line":178,"start_character":0,"end_line":179,"end_character":47},"in_reply_to":"ba5201f7_00956731","updated":"2017-01-08 17:42:56.000000000","message":"Note quite, but getting closer.  I left it in deliberately.","commit_id":"6a8dfe6a4bee1d7050b3e53d861d841f64c498a8"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2485d73ff135877a5bb95baf9f0e3f60c5909325","unresolved":false,"context_lines":[{"line_number":118,"context_line":"    return auth_context"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"def assert_admin(app, request):"},{"line_number":122,"context_line":"    \"\"\"Ensure the user is an admin."},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"    :raises keystone.exception.Unauthorized: if a token could not be"}],"source_content_type":"text/x-python","patch_set":12,"id":"3a1ff146_fb3a7397","line":121,"updated":"2017-03-15 20:13:32.000000000","message":"It\u0027d be nice to keep that application stuff in wsgi.py for the sake of consistency.","commit_id":"f4c3699ddb9777a0c565e27806f8ff5dd9bd5ddb"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"b1fd31bc67206e506a6461e044cc44d6eb39bc8c","unresolved":false,"context_lines":[{"line_number":118,"context_line":"    return auth_context"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"def assert_admin(app, request):"},{"line_number":122,"context_line":"    \"\"\"Ensure the user is an admin."},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"    :raises keystone.exception.Unauthorized: if a token could not be"}],"source_content_type":"text/x-python","patch_set":12,"id":"7ffa3b31_4378df28","line":121,"in_reply_to":"3a1ff146_fb3a7397","updated":"2017-04-19 15:57:02.000000000","message":"should not be in wsgi.  The authorization code was scattered all over the code base, and this is consolidating it in one module.  Only a minimal aspect should be reflected in the web-specific technology files.  Access is a cross cutting concern, and should be remote-technology agnostic.","commit_id":"f4c3699ddb9777a0c565e27806f8ff5dd9bd5ddb"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2485d73ff135877a5bb95baf9f0e3f60c5909325","unresolved":false,"context_lines":[{"line_number":149,"context_line":""},{"line_number":150,"context_line":"        creds[\u0027roles\u0027] \u003d user_token_ref.role_names"},{"line_number":151,"context_line":"        # Accept either is_admin or the admin role"},{"line_number":152,"context_line":"        app.policy_api.enforce(creds, \u0027admin_required\u0027, {})"},{"line_number":153,"context_line":""},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"def _build_policy_check_credentials(action, context, kwargs):"}],"source_content_type":"text/x-python","patch_set":12,"id":"3a1ff146_1b102f01","line":152,"updated":"2017-03-15 20:13:32.000000000","message":"This is going to have to be refactored since the policy_api isn\u0027t going to be implementing `enforce` anymore.","commit_id":"f4c3699ddb9777a0c565e27806f8ff5dd9bd5ddb"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"b1fd31bc67206e506a6461e044cc44d6eb39bc8c","unresolved":false,"context_lines":[{"line_number":149,"context_line":""},{"line_number":150,"context_line":"        creds[\u0027roles\u0027] \u003d user_token_ref.role_names"},{"line_number":151,"context_line":"        # Accept either is_admin or the admin role"},{"line_number":152,"context_line":"        app.policy_api.enforce(creds, \u0027admin_required\u0027, {})"},{"line_number":153,"context_line":""},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"def _build_policy_check_credentials(action, context, kwargs):"}],"source_content_type":"text/x-python","patch_set":12,"id":"7ffa3b31_c3998f6e","line":152,"in_reply_to":"3a1ff146_1b102f01","updated":"2017-04-19 15:57:02.000000000","message":"agreed, but in a later review.  Attempting to keep this as a straight move.","commit_id":"f4c3699ddb9777a0c565e27806f8ff5dd9bd5ddb"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2485d73ff135877a5bb95baf9f0e3f60c5909325","unresolved":false,"context_lines":[{"line_number":176,"context_line":""},{"line_number":177,"context_line":"def token_validation_window(request):"},{"line_number":178,"context_line":"    # NOTE(jamielennox): it\u0027s dumb that i have to put this here. We should"},{"line_number":179,"context_line":"    # only validate subject token in one place."},{"line_number":180,"context_line":""},{"line_number":181,"context_line":"    allow_expired \u003d request.params.get(\u0027allow_expired\u0027)"},{"line_number":182,"context_line":"    allow_expired \u003d strutils.bool_from_string(allow_expired, default\u003dFalse)"}],"source_content_type":"text/x-python","patch_set":12,"id":"3a1ff146_ef3475fc","line":179,"updated":"2017-03-15 20:13:32.000000000","message":"Is this still applicable?","commit_id":"f4c3699ddb9777a0c565e27806f8ff5dd9bd5ddb"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"b1fd31bc67206e506a6461e044cc44d6eb39bc8c","unresolved":false,"context_lines":[{"line_number":176,"context_line":""},{"line_number":177,"context_line":"def token_validation_window(request):"},{"line_number":178,"context_line":"    # NOTE(jamielennox): it\u0027s dumb that i have to put this here. We should"},{"line_number":179,"context_line":"    # only validate subject token in one place."},{"line_number":180,"context_line":""},{"line_number":181,"context_line":"    allow_expired \u003d request.params.get(\u0027allow_expired\u0027)"},{"line_number":182,"context_line":"    allow_expired \u003d strutils.bool_from_string(allow_expired, default\u003dFalse)"}],"source_content_type":"text/x-python","patch_set":12,"id":"7ffa3b31_639e3b55","line":179,"in_reply_to":"3a1ff146_ef3475fc","updated":"2017-04-19 15:57:02.000000000","message":"yes...this was put in due to the cycle of dependencies.  It will go away eventually.","commit_id":"f4c3699ddb9777a0c565e27806f8ff5dd9bd5ddb"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2485d73ff135877a5bb95baf9f0e3f60c5909325","unresolved":false,"context_lines":[{"line_number":183,"context_line":"    return CONF.token.allow_expired_window if allow_expired else 0"},{"line_number":184,"context_line":""},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"def _handle_subject_token_id(self, request, policy_dict):"},{"line_number":187,"context_line":"    if request.context_dict.get(\u0027subject_token_id\u0027) is not None:"},{"line_number":188,"context_line":"        window_seconds \u003d token_validation_window(request)"},{"line_number":189,"context_line":""}],"source_content_type":"text/x-python","patch_set":12,"id":"3a1ff146_c0e1469c","line":186,"updated":"2017-03-15 20:13:32.000000000","message":"There was a note here from Henry about making this method a member of v3 authentication only - since it\u0027s a v3-ism. We should keep that around because it would be nice refactor to have.","commit_id":"f4c3699ddb9777a0c565e27806f8ff5dd9bd5ddb"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"b1fd31bc67206e506a6461e044cc44d6eb39bc8c","unresolved":false,"context_lines":[{"line_number":183,"context_line":"    return CONF.token.allow_expired_window if allow_expired else 0"},{"line_number":184,"context_line":""},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"def _handle_subject_token_id(self, request, policy_dict):"},{"line_number":187,"context_line":"    if request.context_dict.get(\u0027subject_token_id\u0027) is not None:"},{"line_number":188,"context_line":"        window_seconds \u003d token_validation_window(request)"},{"line_number":189,"context_line":""}],"source_content_type":"text/x-python","patch_set":12,"id":"7ffa3b31_e3bb6bc1","line":186,"in_reply_to":"3a1ff146_c0e1469c","updated":"2017-04-19 15:57:02.000000000","message":"v2 has gone away, and this is going to have longer legs than just v3.  I think I managed to fulfill the intention of that comment by moving it here.","commit_id":"f4c3699ddb9777a0c565e27806f8ff5dd9bd5ddb"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2485d73ff135877a5bb95baf9f0e3f60c5909325","unresolved":false,"context_lines":[{"line_number":222,"context_line":"    \"\"\""},{"line_number":223,"context_line":"    if request.context.is_admin:"},{"line_number":224,"context_line":"        LOG.warning(_LW(\u0027RBAC: Bypassing authorization\u0027))"},{"line_number":225,"context_line":"        return"},{"line_number":226,"context_line":"    else:"},{"line_number":227,"context_line":"        action \u003d \u0027identity:%s\u0027 % prep_info[\u0027f_name\u0027]"},{"line_number":228,"context_line":"        # TODO(henry-nash) need to log the target attributes as well"}],"source_content_type":"text/x-python","patch_set":12,"id":"3a1ff146_120ad421","line":225,"updated":"2017-03-15 20:13:32.000000000","message":"I don\u0027t think this is needed since it\u0027s a straight up if/else statement, if we get here we\u0027re going to be returning anyway.","commit_id":"f4c3699ddb9777a0c565e27806f8ff5dd9bd5ddb"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"b1fd31bc67206e506a6461e044cc44d6eb39bc8c","unresolved":false,"context_lines":[{"line_number":222,"context_line":"    \"\"\""},{"line_number":223,"context_line":"    if request.context.is_admin:"},{"line_number":224,"context_line":"        LOG.warning(_LW(\u0027RBAC: Bypassing authorization\u0027))"},{"line_number":225,"context_line":"        return"},{"line_number":226,"context_line":"    else:"},{"line_number":227,"context_line":"        action \u003d \u0027identity:%s\u0027 % prep_info[\u0027f_name\u0027]"},{"line_number":228,"context_line":"        # TODO(henry-nash) need to log the target attributes as well"}],"source_content_type":"text/x-python","patch_set":12,"id":"dfeb2761_347bb8f5","line":225,"in_reply_to":"3a1ff146_120ad421","updated":"2017-04-19 15:57:02.000000000","message":"Yep.  Just tried to keep the change as clear as possible.  Will remove and unindent.","commit_id":"f4c3699ddb9777a0c565e27806f8ff5dd9bd5ddb"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2485d73ff135877a5bb95baf9f0e3f60c5909325","unresolved":false,"context_lines":[{"line_number":223,"context_line":"    if request.context.is_admin:"},{"line_number":224,"context_line":"        LOG.warning(_LW(\u0027RBAC: Bypassing authorization\u0027))"},{"line_number":225,"context_line":"        return"},{"line_number":226,"context_line":"    else:"},{"line_number":227,"context_line":"        action \u003d \u0027identity:%s\u0027 % prep_info[\u0027f_name\u0027]"},{"line_number":228,"context_line":"        # TODO(henry-nash) need to log the target attributes as well"},{"line_number":229,"context_line":"        creds \u003d _build_policy_check_credentials("}],"source_content_type":"text/x-python","patch_set":12,"id":"3a1ff146_9235e4db","line":226,"updated":"2017-03-15 20:13:32.000000000","message":"The previous implementation of this in keystone/common/controller.py had another case that handed the callback here. What\u0027s the reason for keeping that in keystone/common/controller.py?","commit_id":"f4c3699ddb9777a0c565e27806f8ff5dd9bd5ddb"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"b1fd31bc67206e506a6461e044cc44d6eb39bc8c","unresolved":false,"context_lines":[{"line_number":223,"context_line":"    if request.context.is_admin:"},{"line_number":224,"context_line":"        LOG.warning(_LW(\u0027RBAC: Bypassing authorization\u0027))"},{"line_number":225,"context_line":"        return"},{"line_number":226,"context_line":"    else:"},{"line_number":227,"context_line":"        action \u003d \u0027identity:%s\u0027 % prep_info[\u0027f_name\u0027]"},{"line_number":228,"context_line":"        # TODO(henry-nash) need to log the target attributes as well"},{"line_number":229,"context_line":"        creds \u003d _build_policy_check_credentials("}],"source_content_type":"text/x-python","patch_set":12,"id":"dfeb2761_d4100cab","line":226,"in_reply_to":"3a1ff146_9235e4db","updated":"2017-04-19 15:57:02.000000000","message":"Because it really is controller specific code, and is never used for enforcing `admin` role.","commit_id":"f4c3699ddb9777a0c565e27806f8ff5dd9bd5ddb"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2485d73ff135877a5bb95baf9f0e3f60c5909325","unresolved":false,"context_lines":[{"line_number":247,"context_line":"        controller.policy_api.enforce(creds,"},{"line_number":248,"context_line":"                                      action,"},{"line_number":249,"context_line":"                                      utils.flatten_dict(policy_dict))"},{"line_number":250,"context_line":"    LOG.debug(\u0027RBAC: Authorization granted\u0027)"},{"line_number":251,"context_line":""},{"line_number":252,"context_line":""},{"line_number":253,"context_line":"def get_token_ref(context):"}],"source_content_type":"text/x-python","patch_set":12,"id":"3a1ff146_af027d09","line":250,"updated":"2017-03-15 20:13:32.000000000","message":"This should be indented properly to be with the else statement like it was in the previous implementation.","commit_id":"f4c3699ddb9777a0c565e27806f8ff5dd9bd5ddb"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"b1fd31bc67206e506a6461e044cc44d6eb39bc8c","unresolved":false,"context_lines":[{"line_number":247,"context_line":"        controller.policy_api.enforce(creds,"},{"line_number":248,"context_line":"                                      action,"},{"line_number":249,"context_line":"                                      utils.flatten_dict(policy_dict))"},{"line_number":250,"context_line":"    LOG.debug(\u0027RBAC: Authorization granted\u0027)"},{"line_number":251,"context_line":""},{"line_number":252,"context_line":""},{"line_number":253,"context_line":"def get_token_ref(context):"}],"source_content_type":"text/x-python","patch_set":12,"id":"dfeb2761_7446e0c2","line":250,"in_reply_to":"3a1ff146_af027d09","updated":"2017-04-19 15:57:02.000000000","message":"Done","commit_id":"f4c3699ddb9777a0c565e27806f8ff5dd9bd5ddb"}],"keystone/common/controller.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"37a29eddc78e47f10f8e6348b3d7d34ee600b16a","unresolved":false,"context_lines":[{"line_number":145,"context_line":"# explicitly, by removing the calls to check protection from the callbacks."},{"line_number":146,"context_line":"# Instead,  have a call to the callbacks inserted prior to the call to"},{"line_number":147,"context_line":"# `check_protection`."},{"line_number":148,"context_line":"def protected_wrapper(self, f, check_function, request, filter_attr,"},{"line_number":149,"context_line":"                      *args, **kwargs):"},{"line_number":150,"context_line":"    request.assert_authenticated()"},{"line_number":151,"context_line":"    if request.context.is_admin:"}],"source_content_type":"text/x-python","patch_set":15,"id":"3f044301_78be3366","line":148,"updated":"2017-05-05 04:51:08.000000000","message":"We should refactor this in a later patch to change the method name - since it\u0027s not really a wrapper at all.","commit_id":"7d8f2fcfb9a63b23a7c809f1cbb7fd0eddfa2fac"}],"keystone/common/utils.py":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"aa5d7a7dbf305dbbcee7b42ca9070d6f31c605c9","unresolved":false,"context_lines":[{"line_number":526,"context_line":"    return st"},{"line_number":527,"context_line":""},{"line_number":528,"context_line":""},{"line_number":529,"context_line":"def get_token_ref(context):"},{"line_number":530,"context_line":"    \"\"\"Retrieve KeystoneToken object from the auth context and returns it."},{"line_number":531,"context_line":""},{"line_number":532,"context_line":"    :param dict context: The request context."},{"line_number":533,"context_line":"    :raises keystone.exception.Unauthorized: If auth context cannot be found."},{"line_number":534,"context_line":"    :returns: The KeystoneToken object."},{"line_number":535,"context_line":"    \"\"\""},{"line_number":536,"context_line":"    try:"},{"line_number":537,"context_line":"        # Retrieve the auth context that was prepared by AuthContextMiddleware."},{"line_number":538,"context_line":"        auth_context \u003d (context[\u0027environment\u0027]"},{"line_number":539,"context_line":"                        [authorization.AUTH_CONTEXT_ENV])"},{"line_number":540,"context_line":"        return auth_context[\u0027token\u0027]"},{"line_number":541,"context_line":"    except KeyError:"},{"line_number":542,"context_line":"        msg \u003d _(\"Couldn\u0027t find the auth context.\")"},{"line_number":543,"context_line":"        LOG.warning(msg)"},{"line_number":544,"context_line":"        raise exception.Unauthorized(msg)"},{"line_number":545,"context_line":""},{"line_number":546,"context_line":""},{"line_number":547,"context_line":"URL_RESERVED_CHARS \u003d \":/?#[]@!$\u0026\u0027()*+,;\u003d\""}],"source_content_type":"text/x-python","patch_set":9,"id":"ba5201f7_c0999f7a","side":"PARENT","line":544,"range":{"start_line":529,"start_character":0,"end_line":544,"end_character":41},"updated":"2017-01-08 05:23:47.000000000","message":"not sure if i agree on this move, but it doesn\u0027t bother me enough to -1","commit_id":"15f7013213d0bea8fd56e29f46a3a3431f5c0f02"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"14244de34a392f4af0770aad2f969a515db53e45","unresolved":false,"context_lines":[{"line_number":526,"context_line":"    return st"},{"line_number":527,"context_line":""},{"line_number":528,"context_line":""},{"line_number":529,"context_line":"def get_token_ref(context):"},{"line_number":530,"context_line":"    \"\"\"Retrieve KeystoneToken object from the auth context and returns it."},{"line_number":531,"context_line":""},{"line_number":532,"context_line":"    :param dict context: The request context."},{"line_number":533,"context_line":"    :raises keystone.exception.Unauthorized: If auth context cannot be found."},{"line_number":534,"context_line":"    :returns: The KeystoneToken object."},{"line_number":535,"context_line":"    \"\"\""},{"line_number":536,"context_line":"    try:"},{"line_number":537,"context_line":"        # Retrieve the auth context that was prepared by AuthContextMiddleware."},{"line_number":538,"context_line":"        auth_context \u003d (context[\u0027environment\u0027]"},{"line_number":539,"context_line":"                        [authorization.AUTH_CONTEXT_ENV])"},{"line_number":540,"context_line":"        return auth_context[\u0027token\u0027]"},{"line_number":541,"context_line":"    except KeyError:"},{"line_number":542,"context_line":"        msg \u003d _(\"Couldn\u0027t find the auth context.\")"},{"line_number":543,"context_line":"        LOG.warning(msg)"},{"line_number":544,"context_line":"        raise exception.Unauthorized(msg)"},{"line_number":545,"context_line":""},{"line_number":546,"context_line":""},{"line_number":547,"context_line":"URL_RESERVED_CHARS \u003d \":/?#[]@!$\u0026\u0027()*+,;\u003d\""}],"source_content_type":"text/x-python","patch_set":9,"id":"ba5201f7_f5f1fc01","side":"PARENT","line":544,"range":{"start_line":529,"start_character":0,"end_line":544,"end_character":41},"in_reply_to":"ba5201f7_c0999f7a","updated":"2017-01-08 17:42:56.000000000","message":"yeah, again, circular dependency issues forced some movements.\n\nin general \"utils\" is a bad name for a file.  Its like a garage...collects junk instead of cars.","commit_id":"15f7013213d0bea8fd56e29f46a3a3431f5c0f02"}],"keystone/common/wsgi.py":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"aa5d7a7dbf305dbbcee7b42ca9070d6f31c605c9","unresolved":false,"context_lines":[{"line_number":281,"context_line":"    def _normalize_dict(self, d):"},{"line_number":282,"context_line":"        return {self._normalize_arg(k): v for (k, v) in d.items()}"},{"line_number":283,"context_line":""},{"line_number":284,"context_line":"    def assert_admin(self, request):"},{"line_number":285,"context_line":"        \"\"\"Ensure the user is an admin."},{"line_number":286,"context_line":""},{"line_number":287,"context_line":"        :raises keystone.exception.Unauthorized: if a token could not be"},{"line_number":288,"context_line":"            found/authorized, a user is invalid, or a tenant is"},{"line_number":289,"context_line":"            invalid/not scoped."},{"line_number":290,"context_line":"        :raises keystone.exception.Forbidden: if the user is not an admin and"},{"line_number":291,"context_line":"            does not have the admin role"},{"line_number":292,"context_line":""},{"line_number":293,"context_line":"        \"\"\""},{"line_number":294,"context_line":"        authorization.assert_admin(self, request)"},{"line_number":295,"context_line":""},{"line_number":296,"context_line":"    def _attribute_is_empty(self, ref, attribute):"},{"line_number":297,"context_line":"        \"\"\"Determine if the attribute in ref is empty or None.\"\"\""}],"source_content_type":"text/x-python","patch_set":9,"id":"ba5201f7_20818bfb","line":294,"range":{"start_line":284,"start_character":4,"end_line":294,"end_character":49},"updated":"2017-01-08 05:23:47.000000000","message":"this just calls the new one, why not replace all the wsgi.assert_admin calls with authorization.assert_admin?\n\nmaybe do it in another patch and remove this one?","commit_id":"6a8dfe6a4bee1d7050b3e53d861d841f64c498a8"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"14244de34a392f4af0770aad2f969a515db53e45","unresolved":false,"context_lines":[{"line_number":281,"context_line":"    def _normalize_dict(self, d):"},{"line_number":282,"context_line":"        return {self._normalize_arg(k): v for (k, v) in d.items()}"},{"line_number":283,"context_line":""},{"line_number":284,"context_line":"    def assert_admin(self, request):"},{"line_number":285,"context_line":"        \"\"\"Ensure the user is an admin."},{"line_number":286,"context_line":""},{"line_number":287,"context_line":"        :raises keystone.exception.Unauthorized: if a token could not be"},{"line_number":288,"context_line":"            found/authorized, a user is invalid, or a tenant is"},{"line_number":289,"context_line":"            invalid/not scoped."},{"line_number":290,"context_line":"        :raises keystone.exception.Forbidden: if the user is not an admin and"},{"line_number":291,"context_line":"            does not have the admin role"},{"line_number":292,"context_line":""},{"line_number":293,"context_line":"        \"\"\""},{"line_number":294,"context_line":"        authorization.assert_admin(self, request)"},{"line_number":295,"context_line":""},{"line_number":296,"context_line":"    def _attribute_is_empty(self, ref, attribute):"},{"line_number":297,"context_line":"        \"\"\"Determine if the attribute in ref is empty or None.\"\"\""}],"source_content_type":"text/x-python","patch_set":9,"id":"ba5201f7_758fcc74","line":294,"range":{"start_line":284,"start_character":4,"end_line":294,"end_character":49},"in_reply_to":"ba5201f7_20818bfb","updated":"2017-01-08 17:42:56.000000000","message":"Circular dependency.  It would trigger far more of a rewrite, but I agree that should be the end state.\n\nThis was an attempt to minimize what is done in each commit.","commit_id":"6a8dfe6a4bee1d7050b3e53d861d841f64c498a8"}]}