)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"073816fbad404370b7bb73b7e8560d35525707e3","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Anthony Washington \u003canthony.washington@intel.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2017-02-17 21:18:43 +0000"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"WIP: Policy in code"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Adding the beginning implementation for registering and using"},{"line_number":10,"context_line":"default policy rules in code. Rules are defined in the  new policies module and"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"da36d5c6_92c60215","line":7,"updated":"2017-02-17 21:48:59.000000000","message":"This is pretty darn close to what we want anyway - I\u0027d go ahead and remove the WIP portion.\n\nWe could also do one of two things, either break the implementation up and propose moving user defaults in to a separate commit or add more detail to this commit message about including users here.","commit_id":"c3815373e33ac327e948e5ce755c67dcab058c4b"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"073816fbad404370b7bb73b7e8560d35525707e3","unresolved":false,"context_lines":[{"line_number":12,"context_line":"policy.json file."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Spec for adding policy-in code:"},{"line_number":15,"context_line":"https://review.openstack.org/#/c/428453/"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Change-Id: Ic47b1e8b0d479032d8a7b9891ed9800be7036d94"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"da36d5c6_32d8f6ef","line":15,"updated":"2017-02-17 21:48:59.000000000","message":"We can follow the convention \n\npartially-implements blueprint policy-in-code\n\n(more info in https://wiki.openstack.org/wiki/GitCommitMessages#Including_external_references )","commit_id":"c3815373e33ac327e948e5ce755c67dcab058c4b"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ff51ef2195fbbe98cfa43b0a54105c4d949096f9","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Adding the beginning implementation for registering and using"},{"line_number":10,"context_line":"default policy rules in code. Rules are defined in the  new policies module and"},{"line_number":11,"context_line":"added to the return list __init__.py. This will remove all default rules from"},{"line_number":12,"context_line":"policy.json file."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"This commit specifically:"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"da36d5c6_b81685a5","line":11,"updated":"2017-02-17 23:31:05.000000000","message":"nit: Default policies can now be maintained in code and registered via listing mechanisms in the policies module.","commit_id":"c41246e27f5a40e51fd1860bd2cb96d550f35e1c"},{"author":{"_account_id":22219,"name":"Anthony Washington","email":"anthony.washington@intel.com","username":"antwash"},"change_message_id":"be34c926f522e62e744f86d2ac827b73da450e85","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Adding the beginning implementation for registering and using"},{"line_number":10,"context_line":"default policy rules in code. Rules are defined in the  new policies module and"},{"line_number":11,"context_line":"added to the return list __init__.py. This will remove all default rules from"},{"line_number":12,"context_line":"policy.json file."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"This commit specifically:"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"da36d5c6_175d97e9","line":11,"in_reply_to":"da36d5c6_b81685a5","updated":"2017-02-19 00:49:30.000000000","message":"Thanks for the feedback lance! I will update the unit test next patchset.","commit_id":"c41246e27f5a40e51fd1860bd2cb96d550f35e1c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ff51ef2195fbbe98cfa43b0a54105c4d949096f9","unresolved":false,"context_lines":[{"line_number":9,"context_line":"Adding the beginning implementation for registering and using"},{"line_number":10,"context_line":"default policy rules in code. Rules are defined in the  new policies module and"},{"line_number":11,"context_line":"added to the return list __init__.py. This will remove all default rules from"},{"line_number":12,"context_line":"policy.json file."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"This commit specifically:"},{"line_number":15,"context_line":"- Creates a new module called `policies` to hold our in code defaults."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"da36d5c6_1826b116","line":12,"updated":"2017-02-17 23:31:05.000000000","message":"nit: As we go, we can remove the duplicated default policies from our policy.json file.","commit_id":"c41246e27f5a40e51fd1860bd2cb96d550f35e1c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ff51ef2195fbbe98cfa43b0a54105c4d949096f9","unresolved":false,"context_lines":[{"line_number":18,"context_line":"- Add user default policy module for policy rules."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Spec for adding policy-in code:"},{"line_number":21,"context_line":"https://review.openstack.org/#/c/428453/"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"partially-implements blueprint policy-in-code"},{"line_number":24,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"da36d5c6_183f9126","line":21,"updated":"2017-02-17 23:31:05.000000000","message":"Lines 20 and 21 could be removed now since we\u0027ve implied it with line 23.","commit_id":"c41246e27f5a40e51fd1860bd2cb96d550f35e1c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"b5d1562f23af11de0cfc51cb055b62fc729713fc","unresolved":false,"context_lines":[{"line_number":18,"context_line":"- Creates a new module called `policies` to hold our in code defaults."},{"line_number":19,"context_line":"- Ensure we pass our in code policy list to our policy ENFORCER."},{"line_number":20,"context_line":"- Add base policy module for common policy rules."},{"line_number":21,"context_line":"- Add user default policy module for policy rules."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"partially-implements blueprint policy-in-code"},{"line_number":24,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":6,"id":"da36d5c6_51ab8389","line":21,"updated":"2017-02-20 15:52:36.000000000","message":"It doesn\u0027t look like this last line is being done in this commit. It looks like this commit is moving catalog policies.","commit_id":"47257fa5d0ed4e0840657ed0325e233d1cc52273"},{"author":{"_account_id":18464,"name":"Richard Avelar","email":"csravelar@gmail.com","username":"razone"},"change_message_id":"48122be9428ed3c406e07a49c36cae3b87ac54bc","unresolved":false,"context_lines":[{"line_number":18,"context_line":"- Creates a new module called `policies` to hold our in code defaults."},{"line_number":19,"context_line":"- Ensure we pass our in code policy list to our policy ENFORCER."},{"line_number":20,"context_line":"- Add base policy module for common policy rules."},{"line_number":21,"context_line":"- Add user default policy module for policy rules."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"partially-implements blueprint policy-in-code"},{"line_number":24,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":6,"id":"da36d5c6_27bb2dc6","line":21,"in_reply_to":"da36d5c6_51ab8389","updated":"2017-02-20 16:36:29.000000000","message":"Done","commit_id":"47257fa5d0ed4e0840657ed0325e233d1cc52273"},{"author":{"_account_id":22219,"name":"Anthony Washington","email":"anthony.washington@intel.com","username":"antwash"},"change_message_id":"d71cdfe94e3c585493dee5472e84ad56113f6d5d","unresolved":false,"context_lines":[{"line_number":18,"context_line":"- Creates a new module called `policies` to hold our in code defaults."},{"line_number":19,"context_line":"- Ensure we pass our in code policy list to our policy ENFORCER."},{"line_number":20,"context_line":"- Add base policy module for common policy rules."},{"line_number":21,"context_line":"- Add user default policy module for policy rules."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"partially-implements blueprint policy-in-code"},{"line_number":24,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":6,"id":"da36d5c6_04ee278b","line":21,"in_reply_to":"da36d5c6_51ab8389","updated":"2017-02-20 16:20:03.000000000","message":"I will update the commit message, it was original doing this but Richard made changes and didn\u0027t update the commit message.","commit_id":"47257fa5d0ed4e0840657ed0325e233d1cc52273"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"ecec4b1ca7bc96ce68ab4cbbd2633e5048e1c328","unresolved":false,"context_lines":[{"line_number":20,"context_line":"- Add base policy module for common policy rules."},{"line_number":21,"context_line":"- Add user default policy module for policy rules."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"partially-implements blueprint policy-in-code"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Change-Id: Ic47b1e8b0d479032d8a7b9891ed9800be7036d94"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":6,"id":"da36d5c6_aa76103c","line":23,"range":{"start_line":23,"start_character":21,"end_line":23,"end_character":45},"updated":"2017-02-20 10:00:52.000000000","message":"nit: this doesn\u0027t seem to reference a keystone blueprint, is that correct?","commit_id":"47257fa5d0ed4e0840657ed0325e233d1cc52273"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"b5d1562f23af11de0cfc51cb055b62fc729713fc","unresolved":false,"context_lines":[{"line_number":20,"context_line":"- Add base policy module for common policy rules."},{"line_number":21,"context_line":"- Add user default policy module for policy rules."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"partially-implements blueprint policy-in-code"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Change-Id: Ic47b1e8b0d479032d8a7b9891ed9800be7036d94"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":6,"id":"da36d5c6_b1c11f83","line":23,"in_reply_to":"da36d5c6_aa76103c","updated":"2017-02-20 15:52:36.000000000","message":"The specification is still in review and I expect we will be talking about it at length during the PTG. Our policy session is on Thursday afternoon.","commit_id":"47257fa5d0ed4e0840657ed0325e233d1cc52273"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6f40ee35154e27beacca9328ae41c57beb8a1c9b","unresolved":false,"context_lines":[{"line_number":22,"context_line":"- Add endpoint default policy module for policy rules."},{"line_number":23,"context_line":"- Add regions default policy module for policy rules."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Partially-Implements: https://blueprints.launchpad.net/keystone/+spec/policy-in-code"},{"line_number":26,"context_line":"Co-Authored-By: Richard Avelar csravelar@gmail.com"},{"line_number":27,"context_line":"Change-Id: Ic47b1e8b0d479032d8a7b9891ed9800be7036d94"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":21,"id":"ba2be162_cbec13ca","line":25,"updated":"2017-03-01 14:41:17.000000000","message":"This changed from patchset 20, it should be: \n\n  bp policy-in-code\n\nor \n\n  blueprint policy-in-code\n\nThis is easier for reviews to get to since it links automatically with gerrit based on the bp and blueprint keywords. It also ensures that we are leaving the links to the reviews that implement the spec in the whiteboard section of the blueprint.","commit_id":"5d01f9b079b06546f9c0587d309073748fa48719"},{"author":{"_account_id":18464,"name":"Richard Avelar","email":"csravelar@gmail.com","username":"razone"},"change_message_id":"f8a1199acb2647c01196d290af3b4912de33872c","unresolved":false,"context_lines":[{"line_number":22,"context_line":"- Add endpoint default policy module for policy rules."},{"line_number":23,"context_line":"- Add regions default policy module for policy rules."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Partially-Implements: https://blueprints.launchpad.net/keystone/+spec/policy-in-code"},{"line_number":26,"context_line":"Co-Authored-By: Richard Avelar csravelar@gmail.com"},{"line_number":27,"context_line":"Change-Id: Ic47b1e8b0d479032d8a7b9891ed9800be7036d94"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":21,"id":"ba2be162_33d9a122","line":25,"in_reply_to":"ba2be162_cbec13ca","updated":"2017-03-01 15:19:01.000000000","message":"Done","commit_id":"5d01f9b079b06546f9c0587d309073748fa48719"},{"author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"change_message_id":"8bc4ef614552a73eddbea44fbc1030f65951fdf5","unresolved":false,"context_lines":[{"line_number":23,"context_line":"- Add regions default policy module for policy rules."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Partially-Implements: bp policy-in-code"},{"line_number":26,"context_line":"Co-Authored-By: Richard Avelar csravelar@gmail.com"},{"line_number":27,"context_line":"Change-Id: Ic47b1e8b0d479032d8a7b9891ed9800be7036d94"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":22,"id":"9a30ddce_6a63211b","line":26,"range":{"start_line":26,"start_character":31,"end_line":26,"end_character":50},"updated":"2017-03-07 20:31:23.000000000","message":"nit: this is usually put inside \u003c \u003e","commit_id":"95c3ae146e84b1c58f90997ea0734144eb137e8a"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"fe97a9d6256dfb911b5b299b5285a9ca004bd9ce","unresolved":false,"context_lines":[{"line_number":15,"context_line":"file."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"This commit specifically:"},{"line_number":18,"context_line":"- Creates a new module called `policies` to hold our in code defaults."},{"line_number":19,"context_line":"- Ensure we pass our in code policy list to our policy ENFORCER."},{"line_number":20,"context_line":"- Add base policy module for common policy rules."},{"line_number":21,"context_line":"- Add service default policy module for policy rules."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":26,"id":"9a30ddce_0016bcf0","line":18,"range":{"start_line":18,"start_character":53,"end_line":18,"end_character":60},"updated":"2017-03-09 14:09:59.000000000","message":"nit: s/in code/in-code/","commit_id":"feb1ab82440531c590c65b32b0cdfd1f16db008c"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"fe97a9d6256dfb911b5b299b5285a9ca004bd9ce","unresolved":false,"context_lines":[{"line_number":16,"context_line":""},{"line_number":17,"context_line":"This commit specifically:"},{"line_number":18,"context_line":"- Creates a new module called `policies` to hold our in code defaults."},{"line_number":19,"context_line":"- Ensure we pass our in code policy list to our policy ENFORCER."},{"line_number":20,"context_line":"- Add base policy module for common policy rules."},{"line_number":21,"context_line":"- Add service default policy module for policy rules."},{"line_number":22,"context_line":"- Add endpoint default policy module for policy rules."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":26,"id":"9a30ddce_e0efe8e6","line":19,"range":{"start_line":19,"start_character":21,"end_line":19,"end_character":28},"updated":"2017-03-09 14:09:59.000000000","message":"nit: s/in code/in-code/","commit_id":"feb1ab82440531c590c65b32b0cdfd1f16db008c"}],"etc/policy.json":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"7ad649a0a5815e22ed61d8c327eee3a496ff904c","unresolved":false,"context_lines":[{"line_number":8,"context_line":"    \"admin_or_token_subject\": \"rule:admin_required or rule:token_subject\","},{"line_number":9,"context_line":"    \"service_admin_or_token_subject\": \"rule:service_or_admin or rule:token_subject\","},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"    \"default\": \"rule:admin_required\","},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"    \"identity:get_region\": \"\","},{"line_number":14,"context_line":"    \"identity:list_regions\": \"\","}],"source_content_type":"application/json","patch_set":2,"id":"da36d5c6_dd3a4be7","side":"PARENT","line":11,"updated":"2017-02-17 22:51:32.000000000","message":"So it begins!","commit_id":"feb344bfe314a90338b927bbf2b4449dac32847f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"b5d1562f23af11de0cfc51cb055b62fc729713fc","unresolved":false,"context_lines":[{"line_number":26,"context_line":"    \"identity:list_endpoints\": \"rule:admin_required\","},{"line_number":27,"context_line":"    \"identity:create_endpoint\": \"rule:admin_required\","},{"line_number":28,"context_line":"    \"identity:update_endpoint\": \"rule:admin_required\","},{"line_number":29,"context_line":"    \"identity:delete_endpoint\": \"rule:admin_required\","},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"    \"identity:get_domain\": \"rule:admin_required or token.project.domain.id:%(target.domain.id)s\","},{"line_number":32,"context_line":"    \"identity:list_domains\": \"rule:admin_required\","}],"source_content_type":"application/json","patch_set":6,"id":"da36d5c6_91f97bcb","side":"PARENT","line":29,"updated":"2017-02-20 15:52:36.000000000","message":"The commit message says that we are moving user policies, not catalog policies.","commit_id":"feb344bfe314a90338b927bbf2b4449dac32847f"},{"author":{"_account_id":18464,"name":"Richard Avelar","email":"csravelar@gmail.com","username":"razone"},"change_message_id":"48122be9428ed3c406e07a49c36cae3b87ac54bc","unresolved":false,"context_lines":[{"line_number":26,"context_line":"    \"identity:list_endpoints\": \"rule:admin_required\","},{"line_number":27,"context_line":"    \"identity:create_endpoint\": \"rule:admin_required\","},{"line_number":28,"context_line":"    \"identity:update_endpoint\": \"rule:admin_required\","},{"line_number":29,"context_line":"    \"identity:delete_endpoint\": \"rule:admin_required\","},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"    \"identity:get_domain\": \"rule:admin_required or token.project.domain.id:%(target.domain.id)s\","},{"line_number":32,"context_line":"    \"identity:list_domains\": \"rule:admin_required\","}],"source_content_type":"application/json","patch_set":6,"id":"da36d5c6_e7aaf56f","side":"PARENT","line":29,"in_reply_to":"da36d5c6_91f97bcb","updated":"2017-02-20 16:36:29.000000000","message":"Done","commit_id":"feb344bfe314a90338b927bbf2b4449dac32847f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2e2a6aa5ee6d2e760cc4a76a47c67e3b617e6eae","unresolved":false,"context_lines":[{"line_number":196,"context_line":"    \"identity:update_domain_config\": \"rule:admin_required\","},{"line_number":197,"context_line":"    \"identity:delete_domain_config\": \"rule:admin_required\","},{"line_number":198,"context_line":"    \"identity:get_domain_config_default\": \"rule:admin_required\""},{"line_number":199,"context_line":"}"}],"source_content_type":"application/json","patch_set":7,"id":"da36d5c6_9d68aabc","side":"PARENT","line":199,"updated":"2017-02-20 17:22:54.000000000","message":"Extra whitespace here?","commit_id":"feb344bfe314a90338b927bbf2b4449dac32847f"},{"author":{"_account_id":18464,"name":"Richard Avelar","email":"csravelar@gmail.com","username":"razone"},"change_message_id":"1a91f3cef456a5ea8550fe51ab285f12a41175c2","unresolved":false,"context_lines":[{"line_number":196,"context_line":"    \"identity:update_domain_config\": \"rule:admin_required\","},{"line_number":197,"context_line":"    \"identity:delete_domain_config\": \"rule:admin_required\","},{"line_number":198,"context_line":"    \"identity:get_domain_config_default\": \"rule:admin_required\""},{"line_number":199,"context_line":"}"}],"source_content_type":"application/json","patch_set":7,"id":"da36d5c6_dd1a2217","side":"PARENT","line":199,"in_reply_to":"da36d5c6_9d68aabc","updated":"2017-02-20 17:30:58.000000000","message":"Done","commit_id":"feb344bfe314a90338b927bbf2b4449dac32847f"}],"keystone/common/controller.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ec7f09982c83cb18b5f5cda0d652cc19b2510cbb","unresolved":false,"context_lines":[{"line_number":158,"context_line":"                # Add in the kwargs, which means that any entity provided as a"},{"line_number":159,"context_line":"                # parameter for calls like create and update will be included."},{"line_number":160,"context_line":"                policy_dict.update(kwargs)"},{"line_number":161,"context_line":"                policy.enforce(creds, action, utils.flatten_dict(policy_dict))"},{"line_number":162,"context_line":"                LOG.debug(\u0027RBAC: Authorization granted\u0027)"},{"line_number":163,"context_line":"            return f(self, request, *args, **kwargs)"},{"line_number":164,"context_line":"        return inner"}],"source_content_type":"text/x-python","patch_set":17,"id":"da36d5c6_b7020a0a","line":161,"updated":"2017-02-27 20:54:22.000000000","message":"Very nice. Now we could go through and audit the existing controllers to see if they are requiring the policy_api only for this function and remove it.","commit_id":"5358b205edc378eba9acb905ca9de303c862f967"}],"keystone/common/policies/base.py":[{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"fe97a9d6256dfb911b5b299b5285a9ca004bd9ce","unresolved":false,"context_lines":[{"line_number":22,"context_line":"        name\u003d\u0027admin_required\u0027,"},{"line_number":23,"context_line":"        check_str\u003d\u0027role:admin or is_admin:1\u0027),"},{"line_number":24,"context_line":"    policy.RuleDefault("},{"line_number":25,"context_line":"        name\u003d\u0027service_role\u0027,"},{"line_number":26,"context_line":"        check_str\u003d\u0027role:service\u0027),"},{"line_number":27,"context_line":"    policy.RuleDefault("},{"line_number":28,"context_line":"        name\u003d\u0027service_or_admin\u0027,"}],"source_content_type":"text/x-python","patch_set":26,"id":"9a30ddce_4b7b758c","line":25,"range":{"start_line":25,"start_character":14,"end_line":25,"end_character":26},"updated":"2017-03-09 14:09:59.000000000","message":"it doesn\u0027t get much more useless than a rule that a allows us to replace \"role:service\" with \"rule:service_role\"... I\u0027d say it\u0027s even counterproductive. But this isn\u0027t new to this patch, so I\u0027d be ok cleaning it up in a later patch if necessary.","commit_id":"feb1ab82440531c590c65b32b0cdfd1f16db008c"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"fe97a9d6256dfb911b5b299b5285a9ca004bd9ce","unresolved":false,"context_lines":[{"line_number":40,"context_line":"        name\u003d\u0027admin_or_token_subject\u0027,"},{"line_number":41,"context_line":"        check_str\u003d\u0027rule:admin_required or rule:token_subject\u0027),"},{"line_number":42,"context_line":"    policy.RuleDefault("},{"line_number":43,"context_line":"        name\u003d\u0027service_admin_or_token_subject\u0027,"},{"line_number":44,"context_line":"        check_str\u003d\u0027rule:service_or_admin or rule:token_subject\u0027),"},{"line_number":45,"context_line":"    policy.RuleDefault("},{"line_number":46,"context_line":"        name\u003d\u0027default\u0027,"}],"source_content_type":"text/x-python","patch_set":26,"id":"9a30ddce_00a6bc52","line":43,"range":{"start_line":43,"start_character":14,"end_line":43,"end_character":44},"updated":"2017-03-09 14:09:59.000000000","message":"we\u0027ve gone a little crazy with these policy rules that have long names and are never checked directly. As an operator, it would be much easier to have fewer rules and read a check_str for the API I\u0027m trying to call that does the AND\u0027ing, OR\u0027ing, NOT\u0027ing, etc... so I don\u0027t have to go lookup \u0027service_admin_or_token_subject\u0027, then go lookup \u0027service_or_admin\u0027, etc. I\u0027d be fine cleaning that up in a later patch, though, if need be.","commit_id":"feb1ab82440531c590c65b32b0cdfd1f16db008c"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"fe97a9d6256dfb911b5b299b5285a9ca004bd9ce","unresolved":false,"context_lines":[{"line_number":43,"context_line":"        name\u003d\u0027service_admin_or_token_subject\u0027,"},{"line_number":44,"context_line":"        check_str\u003d\u0027rule:service_or_admin or rule:token_subject\u0027),"},{"line_number":45,"context_line":"    policy.RuleDefault("},{"line_number":46,"context_line":"        name\u003d\u0027default\u0027,"},{"line_number":47,"context_line":"        check_str\u003d\u0027rule:admin_required\u0027)"},{"line_number":48,"context_line":"]"},{"line_number":49,"context_line":""}],"source_content_type":"text/x-python","patch_set":26,"id":"9a30ddce_4080b4c0","line":46,"range":{"start_line":46,"start_character":14,"end_line":46,"end_character":21},"updated":"2017-03-09 14:09:59.000000000","message":"In the current system, the \u0027default\u0027 rule is checked by oslo.policy when the rule that it was told to check is not found. Once all policy defaults are in code, that will never be possible anymore, making the \u0027default\u0027 rule obsolete. So it\u0027s not needed here... just leave it in the policy.json file, and when that file is deleted it would just go away.","commit_id":"feb1ab82440531c590c65b32b0cdfd1f16db008c"}],"keystone/common/policies/endpoint.py":[{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"fe97a9d6256dfb911b5b299b5285a9ca004bd9ce","unresolved":false,"context_lines":[{"line_number":16,"context_line":""},{"line_number":17,"context_line":"endpoint_policies \u003d ["},{"line_number":18,"context_line":"    policy.RuleDefault("},{"line_number":19,"context_line":"        name\u003dbase.IDENTITY % \u0027get_endpoint\u0027,"},{"line_number":20,"context_line":"        check_str\u003dbase.RULE_ADMIN_REQUIRED),"},{"line_number":21,"context_line":"    policy.RuleDefault("},{"line_number":22,"context_line":"        name\u003dbase.IDENTITY % \u0027list_endpoints\u0027,"}],"source_content_type":"text/x-python","patch_set":26,"id":"9a30ddce_8b448d1b","line":19,"range":{"start_line":19,"start_character":30,"end_line":19,"end_character":42},"updated":"2017-03-09 14:09:59.000000000","message":"I\u0027d like to see the format change to \"identity:endpoint:get\", but that\u0027s probably a follow-on patch.","commit_id":"feb1ab82440531c590c65b32b0cdfd1f16db008c"}],"keystone/common/policy.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ec7f09982c83cb18b5f5cda0d652cc19b2510cbb","unresolved":false,"context_lines":[{"line_number":23,"context_line":"_ENFORCER \u003d None"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"def reset():"},{"line_number":27,"context_line":"    global _ENFORCER"},{"line_number":28,"context_line":"    _ENFORCER \u003d None"},{"line_number":29,"context_line":""}],"source_content_type":"text/x-python","patch_set":17,"id":"da36d5c6_801cda14","line":26,"updated":"2017-02-27 20:54:22.000000000","message":"Based on what I can tell, this is only here for testing purposes. We should add a doc string in a subsequent patch explaining that.","commit_id":"5358b205edc378eba9acb905ca9de303c862f967"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"2a77d730ec149025db0e14f457c90edc16ea7e0a","unresolved":false,"context_lines":[{"line_number":44,"context_line":"    :param target: dictionary representing the object of the action for object"},{"line_number":45,"context_line":"                   creation this should be a dictionary representing the"},{"line_number":46,"context_line":"                   location of the object e.g. {\u0027project_id\u0027:"},{"line_number":47,"context_line":"                   object.project_id}"},{"line_number":48,"context_line":"    :raises keystone.exception.Forbidden: If verification fails."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"    Actions should be colon separated for clarity. For example:"}],"source_content_type":"text/x-python","patch_set":23,"id":"9a30ddce_51a35f4f","line":47,"updated":"2017-03-08 07:35:25.000000000","message":"Missing docstring param on do_raise","commit_id":"dc3150d6eaab5dcdeefcd966cfd6ccfde2fa407a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"b6e5c06ed971e5d2a5c44e9954ed3c85a887c062","unresolved":false,"context_lines":[{"line_number":45,"context_line":"                   creation this should be a dictionary representing the"},{"line_number":46,"context_line":"                   location of the object e.g. {\u0027project_id\u0027:"},{"line_number":47,"context_line":"                   object.project_id}"},{"line_number":48,"context_line":"    :param do_raise: if True (the default), raises PolicyNotAuthorized;"},{"line_number":49,"context_line":"                     if False, returns False"},{"line_number":50,"context_line":"    :raises keystone.exception.Forbidden: If verification fails."},{"line_number":51,"context_line":""}],"source_content_type":"text/x-python","patch_set":25,"id":"9a30ddce_37315fed","line":48,"updated":"2017-03-08 21:11:08.000000000","message":"the (the default) part is redundant with the method signature. Maybe something like:\n\n  :param do_raise: if True a PolicyNotAuthorized exception is raised if\n                   the policy check fails, otherwise failed policy checks result\n                   in this method returning `False`.","commit_id":"6b0ef2c7e094bd1fb8a7662542decf11143fa280"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"fe97a9d6256dfb911b5b299b5285a9ca004bd9ce","unresolved":false,"context_lines":[{"line_number":60,"context_line":""},{"line_number":61,"context_line":"    # Add the exception arguments if asked to do a raise"},{"line_number":62,"context_line":"    extra \u003d {}"},{"line_number":63,"context_line":"    if do_raise:"},{"line_number":64,"context_line":"        extra.update(exc\u003dexception.ForbiddenAction, action\u003daction,"},{"line_number":65,"context_line":"                     do_raise\u003ddo_raise)"},{"line_number":66,"context_line":""}],"source_content_type":"text/x-python","patch_set":26,"id":"9a30ddce_468fec29","line":63,"range":{"start_line":63,"start_character":4,"end_line":63,"end_character":15},"updated":"2017-03-09 14:09:59.000000000","message":"should just be able to pass all of this on the enforce() call all the time, and let oslo.policy ignore exc and action when do_raise\u003d\u003dFalse, right? Or at least set do_raise on the enforce call rather than in extra.","commit_id":"feb1ab82440531c590c65b32b0cdfd1f16db008c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"3638d0d37c29dfc177f86cd1efeb40ae21043f3a","unresolved":false,"context_lines":[{"line_number":60,"context_line":""},{"line_number":61,"context_line":"    # Add the exception arguments if asked to do a raise"},{"line_number":62,"context_line":"    extra \u003d {}"},{"line_number":63,"context_line":"    if do_raise:"},{"line_number":64,"context_line":"        extra.update(exc\u003dexception.ForbiddenAction, action\u003daction,"},{"line_number":65,"context_line":"                     do_raise\u003ddo_raise)"},{"line_number":66,"context_line":""}],"source_content_type":"text/x-python","patch_set":26,"id":"7a25e98e_1bb06f8b","line":63,"in_reply_to":"9a30ddce_468fec29","updated":"2017-03-13 20:59:01.000000000","message":"Yeah - that makes sense. That\u0027d be a good thing to note for a separate patch. Since this is a refactor, I\u0027d like to keep most of the functionality the same even if it is suboptimal is some respects.","commit_id":"feb1ab82440531c590c65b32b0cdfd1f16db008c"}],"keystone/policies/base.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"87c7017160bc570a1e04c28bd9559f26c96ac4e4","unresolved":false,"context_lines":[{"line_number":18,"context_line":""},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"rules \u003d ["},{"line_number":21,"context_line":"    policy.RuleDefault(\u0027admin_required\u0027, \u0027role:admin or is_admin:1\u0027),"},{"line_number":22,"context_line":"    policy.RuleDefault(\u0027service_role\u0027, \u0027role:service\u0027),"},{"line_number":23,"context_line":"    policy.RuleDefault(\u0027service_or_admin\u0027,"},{"line_number":24,"context_line":"                       \u0027rule:admin_required or rule:service_role\u0027),"}],"source_content_type":"text/x-python","patch_set":8,"id":"da36d5c6_5d447273","line":21,"updated":"2017-02-20 17:53:46.000000000","message":"We should pass these in as kwargs like we do in other places:\n\n  policy.RuleDefault(\n      name\u003d\u0027admin_required\u0027,\n      check_str\u003d\u0027role:admin or is_admin:1\u0027\n  ),\n\nAlso, since later patch use the indentation convention above we should maybe just start doing it now so that everything ends up being consistent.","commit_id":"13e95e261e5d07af177fec39eb2737267b02b63b"}],"keystone/policies/region.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2e2a6aa5ee6d2e760cc4a76a47c67e3b617e6eae","unresolved":false,"context_lines":[{"line_number":16,"context_line":""},{"line_number":17,"context_line":"region_policies \u003d ["},{"line_number":18,"context_line":"    policy.RuleDefault(name\u003dbase.IDENTITY % \u0027get_region\u0027,"},{"line_number":19,"context_line":"                       check_str\u003d\"\"),"},{"line_number":20,"context_line":"    policy.RuleDefault(name\u003dbase.IDENTITY % \u0027list_regions\u0027,"},{"line_number":21,"context_line":"                       check_str\u003d\"\"),"},{"line_number":22,"context_line":"    policy.RuleDefault(name\u003dbase.IDENTITY % \u0027create_region\u0027,"}],"source_content_type":"text/x-python","patch_set":7,"id":"da36d5c6_ddb94230","line":19,"updated":"2017-02-20 17:22:54.000000000","message":"Mixing single and double quotes. We typically don\u0027t mix them unless there is a technical reason to. It\u0027s nice to follow the same convention (single or double) throughout a module.","commit_id":"8af3302dbc77f10fd3630fec473743783572360a"},{"author":{"_account_id":18464,"name":"Richard Avelar","email":"csravelar@gmail.com","username":"razone"},"change_message_id":"1a91f3cef456a5ea8550fe51ab285f12a41175c2","unresolved":false,"context_lines":[{"line_number":16,"context_line":""},{"line_number":17,"context_line":"region_policies \u003d ["},{"line_number":18,"context_line":"    policy.RuleDefault(name\u003dbase.IDENTITY % \u0027get_region\u0027,"},{"line_number":19,"context_line":"                       check_str\u003d\"\"),"},{"line_number":20,"context_line":"    policy.RuleDefault(name\u003dbase.IDENTITY % \u0027list_regions\u0027,"},{"line_number":21,"context_line":"                       check_str\u003d\"\"),"},{"line_number":22,"context_line":"    policy.RuleDefault(name\u003dbase.IDENTITY % \u0027create_region\u0027,"}],"source_content_type":"text/x-python","patch_set":7,"id":"da36d5c6_7de21605","line":19,"in_reply_to":"da36d5c6_ddb94230","updated":"2017-02-20 17:30:58.000000000","message":"Done","commit_id":"8af3302dbc77f10fd3630fec473743783572360a"}],"keystone/policies/user.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"073816fbad404370b7bb73b7e8560d35525707e3","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"from keystone.policies import base"},{"line_number":15,"context_line":"from oslo_policy import policy"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"ID \u003d base.IDENTITY"}],"source_content_type":"text/x-python","patch_set":1,"id":"da36d5c6_52f2ca9b","line":15,"updated":"2017-02-17 21:48:59.000000000","message":"We typically follow the openstack guidelines for import conventions [0]. \n\nSo here we would actually like oslo_policy before keystone since it is a third-party library with respect to keystone.\n\n  from oslo_policy import policy \n\n  from keystone.policies import base\n\n[0] https://docs.openstack.org/developer/hacking/#import-order-template","commit_id":"c3815373e33ac327e948e5ce755c67dcab058c4b"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"073816fbad404370b7bb73b7e8560d35525707e3","unresolved":false,"context_lines":[{"line_number":15,"context_line":"from oslo_policy import policy"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"ID \u003d base.IDENTITY"},{"line_number":19,"context_line":"RULE_AR \u003d base.RULE_ADMIN_REQUIRED"},{"line_number":20,"context_line":"RULE_AOO \u003d base.RULE_ADMIN_OR_OWNER"},{"line_number":21,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"da36d5c6_b2ba26bf","line":18,"updated":"2017-02-17 21:48:59.000000000","message":"I\u0027d just go ahead and use all of these directly below.","commit_id":"c3815373e33ac327e948e5ce755c67dcab058c4b"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"073816fbad404370b7bb73b7e8560d35525707e3","unresolved":false,"context_lines":[{"line_number":20,"context_line":"RULE_AOO \u003d base.RULE_ADMIN_OR_OWNER"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"rules \u003d ["},{"line_number":24,"context_line":"    policy.RuleDefault(ID % \u0027get_user\u0027, RULE_AOO),"},{"line_number":25,"context_line":"    policy.RuleDefault(ID % \u0027list_users\u0027, RULE_AR),"},{"line_number":26,"context_line":"    policy.RuleDefault(ID % \u0027create_user\u0027, RULE_AR),"}],"source_content_type":"text/x-python","patch_set":1,"id":"da36d5c6_f2873ed5","line":23,"updated":"2017-02-17 21:48:59.000000000","message":"nit: user_policies or user_rules?","commit_id":"c3815373e33ac327e948e5ce755c67dcab058c4b"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"073816fbad404370b7bb73b7e8560d35525707e3","unresolved":false,"context_lines":[{"line_number":21,"context_line":""},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"rules \u003d ["},{"line_number":24,"context_line":"    policy.RuleDefault(ID % \u0027get_user\u0027, RULE_AOO),"},{"line_number":25,"context_line":"    policy.RuleDefault(ID % \u0027list_users\u0027, RULE_AR),"},{"line_number":26,"context_line":"    policy.RuleDefault(ID % \u0027create_user\u0027, RULE_AR),"},{"line_number":27,"context_line":"    policy.RuleDefault(ID % \u0027update_user\u0027, RULE_AR),"}],"source_content_type":"text/x-python","patch_set":1,"id":"da36d5c6_32c71647","line":24,"updated":"2017-02-17 21:48:59.000000000","message":"Like this:\n\n  policy.RuleDefault(\n      name\u003dbase.IDENTITY_API % \u0027get_user\u0027,\n      check_str\u003dbase.RULE_ADMIN_OR_OWNER\n  )","commit_id":"c3815373e33ac327e948e5ce755c67dcab058c4b"},{"author":{"_account_id":22219,"name":"Anthony Washington","email":"anthony.washington@intel.com","username":"antwash"},"change_message_id":"f36fed46fff2af6f56308e21397c3e65c5a0862c","unresolved":false,"context_lines":[{"line_number":21,"context_line":""},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"rules \u003d ["},{"line_number":24,"context_line":"    policy.RuleDefault(ID % \u0027get_user\u0027, RULE_AOO),"},{"line_number":25,"context_line":"    policy.RuleDefault(ID % \u0027list_users\u0027, RULE_AR),"},{"line_number":26,"context_line":"    policy.RuleDefault(ID % \u0027create_user\u0027, RULE_AR),"},{"line_number":27,"context_line":"    policy.RuleDefault(ID % \u0027update_user\u0027, RULE_AR),"}],"source_content_type":"text/x-python","patch_set":1,"id":"da36d5c6_dd0b2b7c","line":24,"in_reply_to":"da36d5c6_32c71647","updated":"2017-02-17 22:34:58.000000000","message":"Yeah I like this way as well.","commit_id":"c3815373e33ac327e948e5ce755c67dcab058c4b"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ff51ef2195fbbe98cfa43b0a54105c4d949096f9","unresolved":false,"context_lines":[{"line_number":20,"context_line":"    policy.RuleDefault("},{"line_number":21,"context_line":"        name\u003dbase.IDENTITY % \u0027get_user\u0027,"},{"line_number":22,"context_line":"        check_str\u003dbase.RULE_ADMIN_OR_OWNER),"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"    policy.RuleDefault("},{"line_number":25,"context_line":"        name\u003dbase.IDENTITY % \u0027list_users\u0027,"},{"line_number":26,"context_line":"        check_str\u003dbase.RULE_ADMIN_REQUIRED),"}],"source_content_type":"text/x-python","patch_set":2,"id":"da36d5c6_186dd132","line":23,"updated":"2017-02-17 23:31:05.000000000","message":"nit: we typically don\u0027t have newlines in our list definitions, the new list item could start on the next line so long as there is a comma in between the items.","commit_id":"c41246e27f5a40e51fd1860bd2cb96d550f35e1c"}],"keystone/policy/backends/rules.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ebdbd0afc730673ab5817720fdc9dc26f903ac27","unresolved":false,"context_lines":[{"line_number":40,"context_line":"    if not _ENFORCER:"},{"line_number":41,"context_line":"        _ENFORCER \u003d common_policy.Enforcer(CONF)"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"def enforce(credentials, action, target, do_raise\u003dTrue):"},{"line_number":45,"context_line":"    \"\"\"Verify that the action is valid on the target in this context."},{"line_number":46,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"da36d5c6_bdbe77d2","side":"PARENT","line":43,"updated":"2017-02-17 22:17:17.000000000","message":"Looks like we\u0027ll need one more newline here.","commit_id":"feb344bfe314a90338b927bbf2b4449dac32847f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ebdbd0afc730673ab5817720fdc9dc26f903ac27","unresolved":false,"context_lines":[{"line_number":41,"context_line":"    if not _ENFORCER:"},{"line_number":42,"context_line":"        _ENFORCER \u003d common_policy.Enforcer(CONF)"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"    register_rules(_ENFORCER)"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"def enforce(credentials, action, target, do_raise\u003dTrue):"},{"line_number":47,"context_line":"    \"\"\"Verify that the action is valid on the target in this context."}],"source_content_type":"text/x-python","patch_set":1,"id":"da36d5c6_ddb32b09","line":44,"updated":"2017-02-17 22:17:17.000000000","message":"Also - I\u0027m wondering if this should be in the if block above.","commit_id":"c3815373e33ac327e948e5ce755c67dcab058c4b"},{"author":{"_account_id":22219,"name":"Anthony Washington","email":"anthony.washington@intel.com","username":"antwash"},"change_message_id":"f36fed46fff2af6f56308e21397c3e65c5a0862c","unresolved":false,"context_lines":[{"line_number":41,"context_line":"    if not _ENFORCER:"},{"line_number":42,"context_line":"        _ENFORCER \u003d common_policy.Enforcer(CONF)"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"    register_rules(_ENFORCER)"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"def enforce(credentials, action, target, do_raise\u003dTrue):"},{"line_number":47,"context_line":"    \"\"\"Verify that the action is valid on the target in this context."}],"source_content_type":"text/x-python","patch_set":1,"id":"da36d5c6_7d46bfc0","line":44,"in_reply_to":"da36d5c6_ddb32b09","updated":"2017-02-17 22:34:58.000000000","message":"Good catch, It\u0027ll be better in the if because we don\u0027t want to register rules every time. Should be registered once.","commit_id":"c3815373e33ac327e948e5ce755c67dcab058c4b"}],"keystone/tests/unit/test_policy.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2e2a6aa5ee6d2e760cc4a76a47c67e3b617e6eae","unresolved":false,"context_lines":[{"line_number":216,"context_line":"                       \u0027domain_id\u0027: uuid.uuid4().hex}"},{"line_number":217,"context_line":""},{"line_number":218,"context_line":"        # Since we are moving policy.json defaults to code, we instead call"},{"line_number":219,"context_line":"        # rule init which does the enforce setup for us with the added bonus of"},{"line_number":220,"context_line":"        # registering the in code default policies."},{"line_number":221,"context_line":"        rules.init()"},{"line_number":222,"context_line":"        result \u003d rules._ENFORCER.enforce(action, target, credentials)"}],"source_content_type":"text/x-python","patch_set":7,"id":"da36d5c6_3d87be62","line":219,"updated":"2017-02-20 17:22:54.000000000","message":"nit: `rules.init()`","commit_id":"8af3302dbc77f10fd3630fec473743783572360a"},{"author":{"_account_id":18464,"name":"Richard Avelar","email":"csravelar@gmail.com","username":"razone"},"change_message_id":"1a91f3cef456a5ea8550fe51ab285f12a41175c2","unresolved":false,"context_lines":[{"line_number":216,"context_line":"                       \u0027domain_id\u0027: uuid.uuid4().hex}"},{"line_number":217,"context_line":""},{"line_number":218,"context_line":"        # Since we are moving policy.json defaults to code, we instead call"},{"line_number":219,"context_line":"        # rule init which does the enforce setup for us with the added bonus of"},{"line_number":220,"context_line":"        # registering the in code default policies."},{"line_number":221,"context_line":"        rules.init()"},{"line_number":222,"context_line":"        result \u003d rules._ENFORCER.enforce(action, target, credentials)"}],"source_content_type":"text/x-python","patch_set":7,"id":"da36d5c6_9de7ca11","line":219,"in_reply_to":"da36d5c6_3d87be62","updated":"2017-02-20 17:30:58.000000000","message":"Done","commit_id":"8af3302dbc77f10fd3630fec473743783572360a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"37bb5f7412e2c7c09e31748b1f1b31f2d9ff0726","unresolved":false,"context_lines":[{"line_number":216,"context_line":"                       \u0027domain_id\u0027: uuid.uuid4().hex}"},{"line_number":217,"context_line":""},{"line_number":218,"context_line":"        # Since we are moving policy.json defaults to code, we instead call"},{"line_number":219,"context_line":"        # `rule.init()` which does the enforce setup for us with the added"},{"line_number":220,"context_line":"        # bonus of registering the in code default policies."},{"line_number":221,"context_line":"        rules.init()"},{"line_number":222,"context_line":"        result \u003d rules._ENFORCER.enforce(action, target, credentials)"}],"source_content_type":"text/x-python","patch_set":8,"id":"da36d5c6_9d950a42","line":219,"updated":"2017-02-20 17:32:02.000000000","message":"nit: rules* \n\n:)","commit_id":"13e95e261e5d07af177fec39eb2737267b02b63b"}]}