)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e6eb1043279891411e9ee6e03c19477b212421c0","unresolved":false,"context_lines":[{"line_number":15,"context_line":"    - Moves default user policies into code"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Change-Id: I8bd0fa342cdfee00acd3c7a33f7232fe0a87e23f"},{"line_number":18,"context_line":"Partially-Implements: https://blueprints.launchpad.net/keystone/+spec/policy-in-code"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":11,"id":"ba2be162_fd1d1a10","line":18,"updated":"2017-03-01 14:49:52.000000000","message":"This should be:\n\n  bp policy-in-code\n\nor \n\n  blueprint policy-in-code\n\nSince we have gerrit setup to automatically link to Launchpad based on the `bp` and `blueprint` keywords. We also have tooling that links the change to the blueprint whiteboard, which is useful for tracking which changes implemented a specific feature.","commit_id":"9a41dd87399989449b8124f080e4d93ba72dd951"}],"keystone/common/policies/base.py":[{"author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"change_message_id":"25706a990cb4412a43b64ad190466e4cc68997e3","unresolved":false,"context_lines":[{"line_number":15,"context_line":"IDENTITY \u003d \u0027identity:%s\u0027"},{"line_number":16,"context_line":"RULE_ADMIN_REQUIRED \u003d \u0027rule:admin_required\u0027"},{"line_number":17,"context_line":"RULE_ADMIN_OR_OWNER \u003d \u0027rule:admin_or_owner\u0027"},{"line_number":18,"context_line":"RULE_ADMIN_OR_CREDENTIAL_OWNER \u003d ("},{"line_number":19,"context_line":"    \u0027rule:admin_required or \u0027"},{"line_number":20,"context_line":"    \u0027(rule:owner and user_id:%(target.credential.user_id)s)\u0027)"},{"line_number":21,"context_line":"RULE_ADMIN_OR_TARGET_DOMAIN \u003d (\u0027rule:admin_required or \u0027"},{"line_number":22,"context_line":"                               \u0027token.project.domain.id:%(target.domain.id)s\u0027)"},{"line_number":23,"context_line":"RULE_ADMIN_OR_TARGET_PROJECT \u003d (\u0027rule:admin_required or \u0027"},{"line_number":24,"context_line":"                                \u0027project_id:%(target.project.id)s\u0027)"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"rules \u003d ["}],"source_content_type":"text/x-python","patch_set":10,"id":"ba2be162_25ca6950","line":24,"range":{"start_line":18,"start_character":0,"end_line":24,"end_character":67},"updated":"2017-02-28 16:36:06.000000000","message":"It would be interesting to investigate if it\u0027s worth it to programmatically compose rules with OR. Like for example a function ``any_of(rule1, rule2)`` which would compose the string \"rule1 or rule2\", ``any_of(RULE_ADMIN, TARGET_DOMAIN)`` would create the string as defined in ``RULE_ADMIN_OR_TARGET_DOMAIN``. This might simplify composition of rules in the long run.","commit_id":"5a702bb42a37ae82c850f48cc34321065c90e665"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"da3a786984f2e971b66c563b7932b06bb4ce9552","unresolved":false,"context_lines":[{"line_number":16,"context_line":"RULE_ADMIN_REQUIRED \u003d \u0027rule:admin_required\u0027"},{"line_number":17,"context_line":"RULE_ADMIN_OR_OWNER \u003d \u0027rule:admin_or_owner\u0027"},{"line_number":18,"context_line":"RULE_ADMIN_OR_CREDENTIAL_OWNER \u003d ("},{"line_number":19,"context_line":"    \u0027rule:admin_required or \u0027"},{"line_number":20,"context_line":"    \u0027(rule:owner and user_id:%(target.credential.user_id)s)\u0027)"},{"line_number":21,"context_line":"RULE_ADMIN_OR_TARGET_DOMAIN \u003d (\u0027rule:admin_required or \u0027"},{"line_number":22,"context_line":"                               \u0027token.project.domain.id:%(target.domain.id)s\u0027)"}],"source_content_type":"text/x-python","patch_set":14,"id":"1a1ced50_a0591137","line":19,"range":{"start_line":19,"start_character":5,"end_line":19,"end_character":24},"updated":"2017-03-22 22:43:28.000000000","message":"you can use string substitution here:\n\n  RULE_ADMIN_OR_CREDENTIAL_OWNER \u003d (%s \"or blah blah\") % RULE_ADMIN_REQUIRED\"\n\nbut maybe you are trying to be verbose","commit_id":"7242125481bab503cfaa14ce509a0730cee7624c"}],"keystone/common/policies/ec2_credential.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"fd1804b6ad6bcc8383501a98f979b165b2ca3e2c","unresolved":false,"context_lines":[{"line_number":20,"context_line":"        check_str\u003dbase.RULE_ADMIN_OR_CREDENTIAL_OWNER),"},{"line_number":21,"context_line":"    policy.RuleDefault("},{"line_number":22,"context_line":"        name\u003dbase.IDENTITY % \u0027ec2_list_credentials\u0027,"},{"line_number":23,"context_line":"        check_str\u003dbase.RULE_ADMIN_REQUIRED),"},{"line_number":24,"context_line":"    policy.RuleDefault("},{"line_number":25,"context_line":"        name\u003dbase.IDENTITY % \u0027ec2_create_credential\u0027,"},{"line_number":26,"context_line":"        check_str\u003dbase.RULE_ADMIN_REQUIRED),"}],"source_content_type":"text/x-python","patch_set":9,"id":"da36d5c6_a0dabe15","line":23,"updated":"2017-02-27 21:05:07.000000000","message":"Based on the values being removed from policy.json, shouldn\u0027t this be base.RULE_ADMIN_OR_OWNER ?","commit_id":"61d33220ccb48c3983dc1d4d222241ab7c4a5541"},{"author":{"_account_id":18464,"name":"Richard Avelar","email":"csravelar@gmail.com","username":"razone"},"change_message_id":"af26e24799c5671708bb18184ff235f07d4e3227","unresolved":false,"context_lines":[{"line_number":20,"context_line":"        check_str\u003dbase.RULE_ADMIN_OR_CREDENTIAL_OWNER),"},{"line_number":21,"context_line":"    policy.RuleDefault("},{"line_number":22,"context_line":"        name\u003dbase.IDENTITY % \u0027ec2_list_credentials\u0027,"},{"line_number":23,"context_line":"        check_str\u003dbase.RULE_ADMIN_REQUIRED),"},{"line_number":24,"context_line":"    policy.RuleDefault("},{"line_number":25,"context_line":"        name\u003dbase.IDENTITY % \u0027ec2_create_credential\u0027,"},{"line_number":26,"context_line":"        check_str\u003dbase.RULE_ADMIN_REQUIRED),"}],"source_content_type":"text/x-python","patch_set":9,"id":"da36d5c6_e6e04ecf","line":23,"in_reply_to":"da36d5c6_a0dabe15","updated":"2017-02-27 21:58:37.000000000","message":"Done","commit_id":"61d33220ccb48c3983dc1d4d222241ab7c4a5541"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"fd1804b6ad6bcc8383501a98f979b165b2ca3e2c","unresolved":false,"context_lines":[{"line_number":23,"context_line":"        check_str\u003dbase.RULE_ADMIN_REQUIRED),"},{"line_number":24,"context_line":"    policy.RuleDefault("},{"line_number":25,"context_line":"        name\u003dbase.IDENTITY % \u0027ec2_create_credential\u0027,"},{"line_number":26,"context_line":"        check_str\u003dbase.RULE_ADMIN_REQUIRED),"},{"line_number":27,"context_line":"    policy.RuleDefault("},{"line_number":28,"context_line":"        name\u003dbase.IDENTITY % \u0027ec2_delete_credential\u0027,"},{"line_number":29,"context_line":"        check_str\u003dbase.RULE_ADMIN_OR_CREDENTIAL_OWNER),"}],"source_content_type":"text/x-python","patch_set":9,"id":"da36d5c6_20fdee6e","line":26,"updated":"2017-02-27 21:05:07.000000000","message":"Same comment here.","commit_id":"61d33220ccb48c3983dc1d4d222241ab7c4a5541"},{"author":{"_account_id":18464,"name":"Richard Avelar","email":"csravelar@gmail.com","username":"razone"},"change_message_id":"af26e24799c5671708bb18184ff235f07d4e3227","unresolved":false,"context_lines":[{"line_number":23,"context_line":"        check_str\u003dbase.RULE_ADMIN_REQUIRED),"},{"line_number":24,"context_line":"    policy.RuleDefault("},{"line_number":25,"context_line":"        name\u003dbase.IDENTITY % \u0027ec2_create_credential\u0027,"},{"line_number":26,"context_line":"        check_str\u003dbase.RULE_ADMIN_REQUIRED),"},{"line_number":27,"context_line":"    policy.RuleDefault("},{"line_number":28,"context_line":"        name\u003dbase.IDENTITY % \u0027ec2_delete_credential\u0027,"},{"line_number":29,"context_line":"        check_str\u003dbase.RULE_ADMIN_OR_CREDENTIAL_OWNER),"}],"source_content_type":"text/x-python","patch_set":9,"id":"da36d5c6_06e642e8","line":26,"in_reply_to":"da36d5c6_20fdee6e","updated":"2017-02-27 21:58:37.000000000","message":"Done","commit_id":"61d33220ccb48c3983dc1d4d222241ab7c4a5541"}],"keystone/policies/__init__.py":[{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"1aef5e2f7cfe322bb2dcb8100837c95605d792dc","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# Licensed under the Apache License, Version 2.0 (the \"License\"); you may"},{"line_number":2,"context_line":"# not use this file except in compliance with the License. You may obtain"},{"line_number":3,"context_line":"# a copy of the License at"},{"line_number":4,"context_line":"#"}],"source_content_type":"text/x-python","patch_set":5,"id":"da36d5c6_bdbab221","side":"PARENT","line":1,"updated":"2017-02-21 13:07:39.000000000","message":"Maybe move this into keystone.common.policies instead of having this right next to keystone.policy","commit_id":"47257fa5d0ed4e0840657ed0325e233d1cc52273"}],"keystone/policies/domain.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"71cb28dbce2974f2946dfbae0254eba321d4e1d1","unresolved":false,"context_lines":[{"line_number":18,"context_line":"    policy.RuleDefault("},{"line_number":19,"context_line":"        name\u003dbase.IDENTITY % \u0027get_domain\u0027,"},{"line_number":20,"context_line":"        check_str\u003d(\"rule:admin_required or \""},{"line_number":21,"context_line":"                   \"token.project.domain.id:%(target.domain.id)s\")),"},{"line_number":22,"context_line":"    policy.RuleDefault(name\u003dbase.IDENTITY % \u0027list_domains\u0027,"},{"line_number":23,"context_line":"                       check_str\u003dbase.RULE_ADMIN_REQUIRED),"},{"line_number":24,"context_line":"    policy.RuleDefault(name\u003dbase.IDENTITY % \u0027create_domain\u0027,"}],"source_content_type":"text/x-python","patch_set":2,"id":"da36d5c6_d1f2139a","line":21,"updated":"2017-02-20 16:01:29.000000000","message":"nit: I\u0027d use single quotes here since that\u0027s the convention in the rest of the module.","commit_id":"ec1551a62b1dd11c6db6e2701db5530506f6328e"},{"author":{"_account_id":18464,"name":"Richard Avelar","email":"csravelar@gmail.com","username":"razone"},"change_message_id":"c031f07adf48ef11af4f7edaa3a983ab84ecbd98","unresolved":false,"context_lines":[{"line_number":18,"context_line":"    policy.RuleDefault("},{"line_number":19,"context_line":"        name\u003dbase.IDENTITY % \u0027get_domain\u0027,"},{"line_number":20,"context_line":"        check_str\u003d(\"rule:admin_required or \""},{"line_number":21,"context_line":"                   \"token.project.domain.id:%(target.domain.id)s\")),"},{"line_number":22,"context_line":"    policy.RuleDefault(name\u003dbase.IDENTITY % \u0027list_domains\u0027,"},{"line_number":23,"context_line":"                       check_str\u003dbase.RULE_ADMIN_REQUIRED),"},{"line_number":24,"context_line":"    policy.RuleDefault(name\u003dbase.IDENTITY % \u0027create_domain\u0027,"}],"source_content_type":"text/x-python","patch_set":2,"id":"da36d5c6_e71d95be","line":21,"in_reply_to":"da36d5c6_d1f2139a","updated":"2017-02-20 16:54:59.000000000","message":"Done","commit_id":"ec1551a62b1dd11c6db6e2701db5530506f6328e"}],"keystone/policies/ec2_credential.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"71cb28dbce2974f2946dfbae0254eba321d4e1d1","unresolved":false,"context_lines":[{"line_number":18,"context_line":"    policy.RuleDefault("},{"line_number":19,"context_line":"        name\u003dbase.IDENTITY % \u0027ec2_get_credential\u0027,"},{"line_number":20,"context_line":"        check_str\u003d(\"rule:admin_required or \""},{"line_number":21,"context_line":"                   \"(rule:owner and user_id:%(target.credential.user_id)s)\")),"},{"line_number":22,"context_line":"    policy.RuleDefault(name\u003dbase.IDENTITY % \u0027ec2_list_credentials\u0027,"},{"line_number":23,"context_line":"                       check_str\u003dbase.RULE_ADMIN_REQUIRED),"},{"line_number":24,"context_line":"    policy.RuleDefault(name\u003dbase.IDENTITY % \u0027ec2_create_credential\u0027,"}],"source_content_type":"text/x-python","patch_set":2,"id":"da36d5c6_9126db14","line":21,"updated":"2017-02-20 16:01:29.000000000","message":"Same comment here as in the previous module. Also another improvement would be to pull this out into a global variable since it\u0027s used in two places. This would also give us an opportunity to give it a really good name since it\u0027s a long policy:\n\n  RULE_ADMIN_OR_CREDENTIAL_OWNER \u003d ...","commit_id":"ec1551a62b1dd11c6db6e2701db5530506f6328e"},{"author":{"_account_id":18464,"name":"Richard Avelar","email":"csravelar@gmail.com","username":"razone"},"change_message_id":"c031f07adf48ef11af4f7edaa3a983ab84ecbd98","unresolved":false,"context_lines":[{"line_number":18,"context_line":"    policy.RuleDefault("},{"line_number":19,"context_line":"        name\u003dbase.IDENTITY % \u0027ec2_get_credential\u0027,"},{"line_number":20,"context_line":"        check_str\u003d(\"rule:admin_required or \""},{"line_number":21,"context_line":"                   \"(rule:owner and user_id:%(target.credential.user_id)s)\")),"},{"line_number":22,"context_line":"    policy.RuleDefault(name\u003dbase.IDENTITY % \u0027ec2_list_credentials\u0027,"},{"line_number":23,"context_line":"                       check_str\u003dbase.RULE_ADMIN_REQUIRED),"},{"line_number":24,"context_line":"    policy.RuleDefault(name\u003dbase.IDENTITY % \u0027ec2_create_credential\u0027,"}],"source_content_type":"text/x-python","patch_set":2,"id":"da36d5c6_e703d50d","line":21,"in_reply_to":"da36d5c6_9126db14","updated":"2017-02-20 16:54:59.000000000","message":"Done","commit_id":"ec1551a62b1dd11c6db6e2701db5530506f6328e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"71cb28dbce2974f2946dfbae0254eba321d4e1d1","unresolved":false,"context_lines":[{"line_number":26,"context_line":"    policy.RuleDefault("},{"line_number":27,"context_line":"        name\u003dbase.IDENTITY % \u0027ec2_delete_credential\u0027,"},{"line_number":28,"context_line":"        check_str\u003d(\"rule:admin_required or (rule:owner and \""},{"line_number":29,"context_line":"                   \"user_id:%(target.credential.user_id)s)\"))"},{"line_number":30,"context_line":"]"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"da36d5c6_b123df04","line":29,"updated":"2017-02-20 16:01:29.000000000","message":"Same comment here as in the previous module.","commit_id":"ec1551a62b1dd11c6db6e2701db5530506f6328e"},{"author":{"_account_id":18464,"name":"Richard Avelar","email":"csravelar@gmail.com","username":"razone"},"change_message_id":"c031f07adf48ef11af4f7edaa3a983ab84ecbd98","unresolved":false,"context_lines":[{"line_number":26,"context_line":"    policy.RuleDefault("},{"line_number":27,"context_line":"        name\u003dbase.IDENTITY % \u0027ec2_delete_credential\u0027,"},{"line_number":28,"context_line":"        check_str\u003d(\"rule:admin_required or (rule:owner and \""},{"line_number":29,"context_line":"                   \"user_id:%(target.credential.user_id)s)\"))"},{"line_number":30,"context_line":"]"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"da36d5c6_22ff9b02","line":29,"in_reply_to":"da36d5c6_b123df04","updated":"2017-02-20 16:54:59.000000000","message":"Done","commit_id":"ec1551a62b1dd11c6db6e2701db5530506f6328e"}],"keystone/policies/project.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"71cb28dbce2974f2946dfbae0254eba321d4e1d1","unresolved":false,"context_lines":[{"line_number":17,"context_line":"project_policies \u003d ["},{"line_number":18,"context_line":"    policy.RuleDefault(name\u003dbase.IDENTITY % \u0027get_project\u0027,"},{"line_number":19,"context_line":"                       check_str\u003d(\"rule:admin_required or \""},{"line_number":20,"context_line":"                                  \"project_id:%(target.project.id)s\")),"},{"line_number":21,"context_line":"    policy.RuleDefault(name\u003dbase.IDENTITY % \u0027list_projects\u0027,"},{"line_number":22,"context_line":"                       check_str\u003dbase.RULE_ADMIN_REQUIRED),"},{"line_number":23,"context_line":"    policy.RuleDefault(name\u003dbase.IDENTITY % \u0027list_user_projects\u0027,"}],"source_content_type":"text/x-python","patch_set":2,"id":"da36d5c6_31360f04","line":20,"updated":"2017-02-20 16:01:29.000000000","message":"Same comment here as in previous modules. Even though we only use it in one place, I wouldn\u0027t mind having it pulled into it\u0027s own variable since it gives us an opportunity to supply a great name. Same comment for quotes, too.","commit_id":"ec1551a62b1dd11c6db6e2701db5530506f6328e"},{"author":{"_account_id":18464,"name":"Richard Avelar","email":"csravelar@gmail.com","username":"razone"},"change_message_id":"c031f07adf48ef11af4f7edaa3a983ab84ecbd98","unresolved":false,"context_lines":[{"line_number":17,"context_line":"project_policies \u003d ["},{"line_number":18,"context_line":"    policy.RuleDefault(name\u003dbase.IDENTITY % \u0027get_project\u0027,"},{"line_number":19,"context_line":"                       check_str\u003d(\"rule:admin_required or \""},{"line_number":20,"context_line":"                                  \"project_id:%(target.project.id)s\")),"},{"line_number":21,"context_line":"    policy.RuleDefault(name\u003dbase.IDENTITY % \u0027list_projects\u0027,"},{"line_number":22,"context_line":"                       check_str\u003dbase.RULE_ADMIN_REQUIRED),"},{"line_number":23,"context_line":"    policy.RuleDefault(name\u003dbase.IDENTITY % \u0027list_user_projects\u0027,"}],"source_content_type":"text/x-python","patch_set":2,"id":"da36d5c6_e262e3d7","line":20,"in_reply_to":"da36d5c6_31360f04","updated":"2017-02-20 16:54:59.000000000","message":"Done","commit_id":"ec1551a62b1dd11c6db6e2701db5530506f6328e"}]}