)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"611f23bfd7583bbda3df9c7e3e6d6b7d4642f1da","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Prep for is_admin_project for scoped operations"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Shift from controller.protected decorator to using"},{"line_number":10,"context_line":"authorization.check_policy"},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"This change also allows projects that do not have a"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":11,"id":"ff346bd7_53cc5dbb","line":9,"updated":"2017-07-25 15:55:48.000000000","message":"Please explain why so everyone understands.","commit_id":"4ec6adeae530d6bbe06f4936fb4001b54449d6ef"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"611f23bfd7583bbda3df9c7e3e6d6b7d4642f1da","unresolved":false,"context_lines":[{"line_number":7,"context_line":"Prep for is_admin_project for scoped operations"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Shift from controller.protected decorator to using"},{"line_number":10,"context_line":"authorization.check_policy"},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"This change also allows projects that do not have a"},{"line_number":13,"context_line":"domain_id but do have a parent_id to retrive the domain_id"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":11,"id":"ff346bd7_b33029ea","line":10,"range":{"start_line":10,"start_character":14,"end_line":10,"end_character":26},"updated":"2017-07-25 15:55:48.000000000","message":"current patch set uses check_protection","commit_id":"4ec6adeae530d6bbe06f4936fb4001b54449d6ef"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"611f23bfd7583bbda3df9c7e3e6d6b7d4642f1da","unresolved":false,"context_lines":[{"line_number":9,"context_line":"Shift from controller.protected decorator to using"},{"line_number":10,"context_line":"authorization.check_policy"},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"This change also allows projects that do not have a"},{"line_number":13,"context_line":"domain_id but do have a parent_id to retrive the domain_id"},{"line_number":14,"context_line":"of its parent before defaulting to either the domain"},{"line_number":15,"context_line":"of the token or default domain."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":11,"id":"ff346bd7_b34a69a9","line":12,"updated":"2017-07-25 15:55:48.000000000","message":"why isn\u0027t this a separate change? Isn\u0027t it unrelated?","commit_id":"4ec6adeae530d6bbe06f4936fb4001b54449d6ef"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"7c2c7078080c48e0b896262c3efa25c9fefa75f6","unresolved":false,"context_lines":[{"line_number":9,"context_line":"Shift from controller.protected decorator to using"},{"line_number":10,"context_line":"authorization.check_policy"},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"This change also allows projects that do not have a"},{"line_number":13,"context_line":"domain_id but do have a parent_id to retrive the domain_id"},{"line_number":14,"context_line":"of its parent before defaulting to either the domain"},{"line_number":15,"context_line":"of the token or default domain."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":11,"id":"df3967d1_0b5a2329","line":12,"in_reply_to":"ff346bd7_b34a69a9","updated":"2017-08-01 15:42:11.000000000","message":"We could pull this part out","commit_id":"4ec6adeae530d6bbe06f4936fb4001b54449d6ef"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"611f23bfd7583bbda3df9c7e3e6d6b7d4642f1da","unresolved":false,"context_lines":[{"line_number":10,"context_line":"authorization.check_policy"},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"This change also allows projects that do not have a"},{"line_number":13,"context_line":"domain_id but do have a parent_id to retrive the domain_id"},{"line_number":14,"context_line":"of its parent before defaulting to either the domain"},{"line_number":15,"context_line":"of the token or default domain."},{"line_number":16,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":11,"id":"ff346bd7_133c95c6","line":13,"range":{"start_line":13,"start_character":37,"end_line":13,"end_character":44},"updated":"2017-07-25 15:55:48.000000000","message":"retrieve","commit_id":"4ec6adeae530d6bbe06f4936fb4001b54449d6ef"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"4fc5abab250724941926b359c4600f1138327fa6","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Prep for is_admin_project for scoped operations"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Shift from controller.protected decorator to using"},{"line_number":10,"context_line":"authorization.check_protection for checking policy against"},{"line_number":11,"context_line":"admin operations."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Partial-Bug: #968696"},{"line_number":14,"context_line":"Change-Id: I7f17fb6497de40f194f227f1de7a551a18ae6ce7"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":12,"id":"df3967d1_764f5392","line":11,"range":{"start_line":9,"start_character":0,"end_line":11,"end_character":17},"updated":"2017-08-01 19:13:07.000000000","message":"a little more explanation of why would be nice","commit_id":"6431e2be005572762a23a33e7932cb6457a87327"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4229835f846ee16013aaf435aab1e7fa3286ca9d","unresolved":false,"context_lines":[{"line_number":9,"context_line":"Shift from controller.protected decorator to using"},{"line_number":10,"context_line":"authorization.check_protection to allow for referencing"},{"line_number":11,"context_line":"admin operations against policy rules when scoped against"},{"line_number":12,"context_line":"a domain or project."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Partial-Bug: #968696"},{"line_number":15,"context_line":"Change-Id: I7f17fb6497de40f194f227f1de7a551a18ae6ce7"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":13,"id":"df3967d1_45d36e61","line":12,"updated":"2017-08-01 22:35:33.000000000","message":"This can be reused for the global role stuff right? Since that appears to be the direction we\u0027re going based on the operator thread?","commit_id":"07ab0e05602cc1dc521ca96eca10b825c54194dd"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"4d94ae78c7bb99255ea49391cdd0c42b668e47b8","unresolved":false,"context_lines":[{"line_number":9,"context_line":"Shift from controller.protected decorator to using"},{"line_number":10,"context_line":"authorization.check_protection to allow for referencing"},{"line_number":11,"context_line":"admin operations against policy rules when scoped against"},{"line_number":12,"context_line":"a domain or project."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Partial-Bug: #968696"},{"line_number":15,"context_line":"Change-Id: I7f17fb6497de40f194f227f1de7a551a18ae6ce7"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":13,"id":"df3967d1_856ef692","line":12,"in_reply_to":"df3967d1_45d36e61","updated":"2017-08-01 22:39:44.000000000","message":"I believe so, this is more just tweaking how the user/project creation references policy rules.","commit_id":"07ab0e05602cc1dc521ca96eca10b825c54194dd"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"38d2144e5dcbafac27d6b36c00a5e8d3cc234c6e","unresolved":false,"context_lines":[{"line_number":9,"context_line":"Shift from controller.protected decorator to using"},{"line_number":10,"context_line":"authorization.check_protection to allow for referencing"},{"line_number":11,"context_line":"admin operations against policy rules when scoped against"},{"line_number":12,"context_line":"a domain or project."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Partial-Bug: #968696"},{"line_number":15,"context_line":"Change-Id: I7f17fb6497de40f194f227f1de7a551a18ae6ce7"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":13,"id":"df3967d1_1fa7dc51","line":12,"in_reply_to":"df3967d1_856ef692","updated":"2017-08-02 15:15:02.000000000","message":"yes, this isn\u0027t related to global role stuff, would still apply with that.","commit_id":"07ab0e05602cc1dc521ca96eca10b825c54194dd"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d846b21b049d68f78cdd85fb2a01abe1669eeee4","unresolved":false,"context_lines":[{"line_number":21,"context_line":"because the attributes of the request body weren\u0027t normalized prior"},{"line_number":22,"context_line":"to being processed by the decorator. The protected decorator would"},{"line_number":23,"context_line":"choke on unnormalized data and as a result it would raise a 403"},{"line_number":24,"context_line":"instead of a proper 500."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Partial-Bug: #968696"},{"line_number":27,"context_line":"Change-Id: I7f17fb6497de40f194f227f1de7a551a18ae6ce7"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":17,"id":"9f436f4f_6615cf48","line":24,"updated":"2017-08-16 20:17:31.000000000","message":"After doing some digging - this isn\u0027t true. The oslo.policy library doesn\u0027t come up with a result when passed `domain-id` and we tell it to raise a 403 when there isn\u0027t a result.\n\nhttps://github.com/openstack/oslo.policy/blob/master/oslo_policy/policy.py#L746-L748\n\nhttps://github.com/openstack/keystone/blob/master/keystone/common/policy.py#L60-L61","commit_id":"65d3f7f4ea4dc9c3f857aa076bab9464447e5d51"}],"keystone/identity/controllers.py":[{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"049e806eebdf92d75ead3d69075b573ec25f50b8","unresolved":false,"context_lines":[{"line_number":220,"context_line":"        kwargs \u003d {\u0027user\u0027: ref}"},{"line_number":221,"context_line":"        args \u003d [self, request, ref]"},{"line_number":222,"context_line":""},{"line_number":223,"context_line":"        authorization.check_policy("},{"line_number":224,"context_line":"            self, request, \u0027create_user\u0027,"},{"line_number":225,"context_line":"            filter_attr\u003dNone, input_attr\u003dkwargs, target_attr\u003dNone,"},{"line_number":226,"context_line":"            args\u003dargs, kwargs\u003dkwargs)"}],"source_content_type":"text/x-python","patch_set":10,"id":"3f1d235d_a6136f66","line":223,"range":{"start_line":223,"start_character":22,"end_line":223,"end_character":34},"updated":"2017-07-11 04:44:35.000000000","message":"Will need to change to check_protection so that \"identity:\" gets appended here.","commit_id":"02ab8daabc072301ace92d89245ee9f1218fe5fe"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"0d60112613c600c521c20ca092cfb5e6bbcde4cf","unresolved":false,"context_lines":[{"line_number":220,"context_line":"        kwargs \u003d {\u0027user\u0027: ref}"},{"line_number":221,"context_line":"        args \u003d [self, request, ref]"},{"line_number":222,"context_line":""},{"line_number":223,"context_line":"        authorization.check_policy("},{"line_number":224,"context_line":"            self, request, \u0027create_user\u0027,"},{"line_number":225,"context_line":"            filter_attr\u003dNone, input_attr\u003dkwargs, target_attr\u003dNone,"},{"line_number":226,"context_line":"            args\u003dargs, kwargs\u003dkwargs)"}],"source_content_type":"text/x-python","patch_set":10,"id":"ff346bd7_5cb72288","line":223,"range":{"start_line":223,"start_character":22,"end_line":223,"end_character":34},"in_reply_to":"3f1d235d_a6136f66","updated":"2017-07-22 00:52:35.000000000","message":"check_policy should do that already?","commit_id":"02ab8daabc072301ace92d89245ee9f1218fe5fe"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"611f23bfd7583bbda3df9c7e3e6d6b7d4642f1da","unresolved":false,"context_lines":[{"line_number":218,"context_line":"        # The manager layer will generate the unique ID for users"},{"line_number":219,"context_line":""},{"line_number":220,"context_line":"        kwargs \u003d {\u0027user\u0027: ref}"},{"line_number":221,"context_line":"        args \u003d [self, request, ref]"},{"line_number":222,"context_line":""},{"line_number":223,"context_line":"        authorization.check_protection("},{"line_number":224,"context_line":"            self, request, \u0027create_user\u0027,"}],"source_content_type":"text/x-python","patch_set":11,"id":"ff346bd7_738d2130","line":221,"updated":"2017-07-25 15:55:48.000000000","message":"check_policy doesn\u0027t actually do anything with args, so rather than set some I would rather we remove *args from the signature for check_policy.","commit_id":"4ec6adeae530d6bbe06f4936fb4001b54449d6ef"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"db124fb74b0a2bc7835c26b34e32b16765e311b6","unresolved":false,"context_lines":[{"line_number":218,"context_line":"        # The manager layer will generate the unique ID for users"},{"line_number":219,"context_line":""},{"line_number":220,"context_line":"        kwargs \u003d {\u0027user\u0027: ref}"},{"line_number":221,"context_line":"        args \u003d [self, request, ref]"},{"line_number":222,"context_line":""},{"line_number":223,"context_line":"        authorization.check_protection("},{"line_number":224,"context_line":"            self, request, \u0027create_user\u0027,"}],"source_content_type":"text/x-python","patch_set":11,"id":"df3967d1_5198de19","line":221,"in_reply_to":"ff346bd7_738d2130","updated":"2017-08-01 17:05:31.000000000","message":"Done","commit_id":"4ec6adeae530d6bbe06f4936fb4001b54449d6ef"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"611f23bfd7583bbda3df9c7e3e6d6b7d4642f1da","unresolved":false,"context_lines":[{"line_number":220,"context_line":"        kwargs \u003d {\u0027user\u0027: ref}"},{"line_number":221,"context_line":"        args \u003d [self, request, ref]"},{"line_number":222,"context_line":""},{"line_number":223,"context_line":"        authorization.check_protection("},{"line_number":224,"context_line":"            self, request, \u0027create_user\u0027,"},{"line_number":225,"context_line":"            filter_attr\u003dNone, input_attr\u003dkwargs, target_attr\u003dNone,"},{"line_number":226,"context_line":"            args\u003dargs, kwargs\u003dkwargs)"}],"source_content_type":"text/x-python","patch_set":11,"id":"ff346bd7_586d9c02","line":223,"updated":"2017-07-25 15:55:48.000000000","message":"you\u0027re calling check_protection but with the kwargs for check_policy. Either go back to check_policy and use  pol_base.IDENTITY % \u0027create_user\u0027 instead of just \u0027create_user\u0027 or construct and pass prep_info to check_protection.","commit_id":"4ec6adeae530d6bbe06f4936fb4001b54449d6ef"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"7c2c7078080c48e0b896262c3efa25c9fefa75f6","unresolved":false,"context_lines":[{"line_number":220,"context_line":"        kwargs \u003d {\u0027user\u0027: ref}"},{"line_number":221,"context_line":"        args \u003d [self, request, ref]"},{"line_number":222,"context_line":""},{"line_number":223,"context_line":"        authorization.check_protection("},{"line_number":224,"context_line":"            self, request, \u0027create_user\u0027,"},{"line_number":225,"context_line":"            filter_attr\u003dNone, input_attr\u003dkwargs, target_attr\u003dNone,"},{"line_number":226,"context_line":"            args\u003dargs, kwargs\u003dkwargs)"}],"source_content_type":"text/x-python","patch_set":11,"id":"ff346bd7_3370b9dc","line":223,"in_reply_to":"ff346bd7_586d9c02","updated":"2017-08-01 15:42:11.000000000","message":"will do","commit_id":"4ec6adeae530d6bbe06f4936fb4001b54449d6ef"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"43a821dfa8e9a8795d4519efe741d1f8f017128e","unresolved":false,"context_lines":[{"line_number":221,"context_line":""},{"line_number":222,"context_line":"        prep_info \u003d {"},{"line_number":223,"context_line":"            \u0027f_name\u0027: \u0027create_user\u0027,"},{"line_number":224,"context_line":"            \u0027input_attr\u0027: kwargs"},{"line_number":225,"context_line":"        }"},{"line_number":226,"context_line":""},{"line_number":227,"context_line":"        authorization.check_protection("}],"source_content_type":"text/x-python","patch_set":12,"id":"df3967d1_56d1efcc","line":224,"range":{"start_line":224,"start_character":12,"end_line":224,"end_character":32},"updated":"2017-08-01 19:10:40.000000000","message":"nit: check_policy (when called by check_protection) is going to merge prep_info[\u0027input_attr\u0027] and kwargs into the same dict, so you don\u0027t need to specify both if they\u0027re the same.","commit_id":"6431e2be005572762a23a33e7932cb6457a87327"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"0009b7b9db745b0fe12b42387c75a19b001b3cfb","unresolved":false,"context_lines":[{"line_number":221,"context_line":""},{"line_number":222,"context_line":"        prep_info \u003d {"},{"line_number":223,"context_line":"            \u0027f_name\u0027: \u0027create_user\u0027,"},{"line_number":224,"context_line":"            \u0027input_attr\u0027: kwargs"},{"line_number":225,"context_line":"        }"},{"line_number":226,"context_line":""},{"line_number":227,"context_line":"        authorization.check_protection("}],"source_content_type":"text/x-python","patch_set":12,"id":"df3967d1_e57143e0","line":224,"range":{"start_line":224,"start_character":12,"end_line":224,"end_character":32},"in_reply_to":"df3967d1_56d1efcc","updated":"2017-10-04 21:03:14.000000000","message":"ah ok","commit_id":"6431e2be005572762a23a33e7932cb6457a87327"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"43a821dfa8e9a8795d4519efe741d1f8f017128e","unresolved":false,"context_lines":[{"line_number":226,"context_line":""},{"line_number":227,"context_line":"        authorization.check_protection("},{"line_number":228,"context_line":"            self, request, prep_info,"},{"line_number":229,"context_line":"            target_attr\u003dNone, kwargs\u003dkwargs)"},{"line_number":230,"context_line":""},{"line_number":231,"context_line":"        ref \u003d self.identity_api.create_user("},{"line_number":232,"context_line":"            ref, initiator\u003drequest.audit_initiator"}],"source_content_type":"text/x-python","patch_set":12,"id":"df3967d1_36ed4b8b","line":229,"range":{"start_line":229,"start_character":12,"end_line":229,"end_character":28},"updated":"2017-08-01 19:10:40.000000000","message":"nit: target_attr\u0027s default is None, so you don\u0027t really need to specify this.","commit_id":"6431e2be005572762a23a33e7932cb6457a87327"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4f69667206259a879287cbbafd2a3c5c3d3c569a","unresolved":false,"context_lines":[{"line_number":214,"context_line":"        request.assert_authenticated()"},{"line_number":215,"context_line":"        ref \u003d self._normalize_dict(user)"},{"line_number":216,"context_line":"        ref \u003d self._normalize_domain_id(request, ref)"},{"line_number":217,"context_line":"        validation.lazy_validate(schema.user_create, ref)"},{"line_number":218,"context_line":"        # The manager layer will generate the unique ID for users"},{"line_number":219,"context_line":""},{"line_number":220,"context_line":"        prep_info \u003d {"}],"source_content_type":"text/x-python","patch_set":15,"id":"9f436f4f_4bc894a4","line":217,"updated":"2017-08-16 19:09:03.000000000","message":"Shouldn\u0027t the validation here be done on an unmodified request from the user, versus a normalized reference?","commit_id":"67b3b2021b580a5261c191ce24615410568fd1d4"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"429cb6819b687ff031fcc484ae94e535f09cde76","unresolved":false,"context_lines":[{"line_number":214,"context_line":"        request.assert_authenticated()"},{"line_number":215,"context_line":"        ref \u003d self._normalize_dict(user)"},{"line_number":216,"context_line":"        ref \u003d self._normalize_domain_id(request, ref)"},{"line_number":217,"context_line":"        validation.lazy_validate(schema.user_create, ref)"},{"line_number":218,"context_line":"        # The manager layer will generate the unique ID for users"},{"line_number":219,"context_line":""},{"line_number":220,"context_line":"        prep_info \u003d {"}],"source_content_type":"text/x-python","patch_set":15,"id":"9f436f4f_cb7b64f2","line":217,"in_reply_to":"9f436f4f_4bc894a4","updated":"2017-08-16 19:15:39.000000000","message":"Yeah this should be moved up before normalizing anything","commit_id":"67b3b2021b580a5261c191ce24615410568fd1d4"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"8bc3513b7b4b95bce80d2951b6d4d823c9ec21d8","unresolved":false,"context_lines":[{"line_number":214,"context_line":"        request.assert_authenticated()"},{"line_number":215,"context_line":"        ref \u003d self._normalize_dict(user)"},{"line_number":216,"context_line":"        ref \u003d self._normalize_domain_id(request, ref)"},{"line_number":217,"context_line":"        validation.lazy_validate(schema.user_create, ref)"},{"line_number":218,"context_line":"        # The manager layer will generate the unique ID for users"},{"line_number":219,"context_line":""},{"line_number":220,"context_line":"        prep_info \u003d {"}],"source_content_type":"text/x-python","patch_set":15,"id":"9f436f4f_66714fa8","line":217,"in_reply_to":"9f436f4f_a62df795","updated":"2017-08-16 19:34:11.000000000","message":"@ayoung, the reasoning you added in the commit message of ps16 is great, but that doesn\u0027t mean the schema validation needs to be after the normalization as well, does it? Seems like we should:\n\n1) schema validation\n2) normalization\n3) policy check\n\nThe important thing that we needed to move was the policy check, not the schema validation, right?","commit_id":"67b3b2021b580a5261c191ce24615410568fd1d4"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"257ef3261509abbe3fd990e8bc4d2f8d8a3ad25f","unresolved":false,"context_lines":[{"line_number":214,"context_line":"        request.assert_authenticated()"},{"line_number":215,"context_line":"        ref \u003d self._normalize_dict(user)"},{"line_number":216,"context_line":"        ref \u003d self._normalize_domain_id(request, ref)"},{"line_number":217,"context_line":"        validation.lazy_validate(schema.user_create, ref)"},{"line_number":218,"context_line":"        # The manager layer will generate the unique ID for users"},{"line_number":219,"context_line":""},{"line_number":220,"context_line":"        prep_info \u003d {"}],"source_content_type":"text/x-python","patch_set":15,"id":"9f436f4f_a62df795","line":217,"in_reply_to":"9f436f4f_cb7b64f2","updated":"2017-08-16 19:27:18.000000000","message":"I think that it will break that way.  The normalization does some of the work for filling out the user data.  The normalization does not write any data, just fills out more, so we can use it for the policy check.","commit_id":"67b3b2021b580a5261c191ce24615410568fd1d4"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"0c7db9f09e74715d08562a41f1b9656ea735ccde","unresolved":false,"context_lines":[{"line_number":211,"context_line":"        self.check_protection(request, prep_info, ref)"},{"line_number":212,"context_line":""},{"line_number":213,"context_line":"    def create_user(self, request, user):"},{"line_number":214,"context_line":"        validation.lazy_validate(schema.user_create, user)"},{"line_number":215,"context_line":"        request.assert_authenticated()"},{"line_number":216,"context_line":"        ref \u003d self._normalize_dict(user)"},{"line_number":217,"context_line":"        ref \u003d self._normalize_domain_id(request, ref)"}],"source_content_type":"text/x-python","patch_set":17,"id":"9f436f4f_e6977f44","line":214,"updated":"2017-08-16 19:50:04.000000000","message":"I think we want this one line lower, after assert_authenticated. If there\u0027s a good reason for it to go here, then the other file needs to change as well for consistency.","commit_id":"65d3f7f4ea4dc9c3f857aa076bab9464447e5d51"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a820089992c4ff86df0a9c9523ce94190ff1aa19","unresolved":false,"context_lines":[{"line_number":211,"context_line":"        self.check_protection(request, prep_info, ref)"},{"line_number":212,"context_line":""},{"line_number":213,"context_line":"    def create_user(self, request, user):"},{"line_number":214,"context_line":"        validation.lazy_validate(schema.user_create, user)"},{"line_number":215,"context_line":"        request.assert_authenticated()"},{"line_number":216,"context_line":"        ref \u003d self._normalize_dict(user)"},{"line_number":217,"context_line":"        ref \u003d self._normalize_domain_id(request, ref)"}],"source_content_type":"text/x-python","patch_set":17,"id":"9f436f4f_a17ba189","line":214,"in_reply_to":"9f436f4f_e6977f44","updated":"2017-08-16 20:22:57.000000000","message":"Done","commit_id":"65d3f7f4ea4dc9c3f857aa076bab9464447e5d51"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4dc9c5518e26244a0d6e008f6b72ebb02802dae2","unresolved":false,"context_lines":[{"line_number":58,"context_line":"        ref \u003d self._normalize_domain_id(request, ref)"},{"line_number":59,"context_line":"        # The manager layer will generate the unique ID for users"},{"line_number":60,"context_line":"        authorization.check_policy_input(self, request,"},{"line_number":61,"context_line":"                                         \u0027create_user\u0027, \u0027user\u0027, ref)"},{"line_number":62,"context_line":"        ref \u003d PROVIDERS.identity_api.create_user("},{"line_number":63,"context_line":"            ref, initiator\u003drequest.audit_initiator"},{"line_number":64,"context_line":"        )"}],"source_content_type":"text/x-python","patch_set":22,"id":"9f6a8fd7_9394788d","line":61,"updated":"2018-04-16 21:28:28.000000000","message":"Are we opposed to just calling oslo.policy\u0027s Enforcer.enforce() method here?\n\nI wouldn\u0027t mind seeing what that would look like in favor of call that looks suspiciously like a decorator (because it was previously a decorator).","commit_id":"4624bc84d24e2a08ff7598a77a9b0f6a88969e19"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"a33842cd26d42bffeebd223b74074340aad2fd9c","unresolved":false,"context_lines":[{"line_number":58,"context_line":"        ref \u003d self._normalize_domain_id(request, ref)"},{"line_number":59,"context_line":"        # The manager layer will generate the unique ID for users"},{"line_number":60,"context_line":"        authorization.check_policy_input(self, request,"},{"line_number":61,"context_line":"                                         \u0027create_user\u0027, \u0027user\u0027, ref)"},{"line_number":62,"context_line":"        ref \u003d PROVIDERS.identity_api.create_user("},{"line_number":63,"context_line":"            ref, initiator\u003drequest.audit_initiator"},{"line_number":64,"context_line":"        )"}],"source_content_type":"text/x-python","patch_set":22,"id":"9f6a8fd7_764af227","line":61,"in_reply_to":"9f6a8fd7_9394788d","updated":"2018-04-16 22:13:41.000000000","message":"I\u0027d like to, but I thin it is too far.  This is the method that it has to go through before we can call enforce:  http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/authorization.py#n134\n\nEssentially, we have to build the dictionary that goes to check policy.","commit_id":"4624bc84d24e2a08ff7598a77a9b0f6a88969e19"}],"keystone/resource/controllers.py":[{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"c99cb03e3316c09aa1228a27d72076e85cfd0099","unresolved":false,"context_lines":[{"line_number":255,"context_line":"        request.assert_authenticated()"},{"line_number":256,"context_line":"        validation.lazy_validate(schema.project_create, project)"},{"line_number":257,"context_line":""},{"line_number":258,"context_line":"        try:"},{"line_number":259,"context_line":"            domain_id \u003d project[\u0027domain_id\u0027]"},{"line_number":260,"context_line":"        except KeyError:"},{"line_number":261,"context_line":"            if not project.get(\u0027is_domain\u0027):"}],"source_content_type":"text/x-python","patch_set":4,"id":"7f231b9d_bb6a2bea","line":258,"updated":"2017-06-14 16:51:19.000000000","message":"Should add a comment explaining that we\u0027re figuring domain_id here, if not set explicitly, so that that information is available to be checked against policy.","commit_id":"dda2995d6b66d68d377c371c9a4ea2659f49be30"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"19b6473e0158f0c89762ac869f0722268a70f61d","unresolved":false,"context_lines":[{"line_number":255,"context_line":"        request.assert_authenticated()"},{"line_number":256,"context_line":"        validation.lazy_validate(schema.project_create, project)"},{"line_number":257,"context_line":""},{"line_number":258,"context_line":"        try:"},{"line_number":259,"context_line":"            domain_id \u003d project[\u0027domain_id\u0027]"},{"line_number":260,"context_line":"        except KeyError:"},{"line_number":261,"context_line":"            if not project.get(\u0027is_domain\u0027):"}],"source_content_type":"text/x-python","patch_set":4,"id":"7f231b9d_f7fd4c6e","line":258,"in_reply_to":"7f231b9d_bb6a2bea","updated":"2017-06-14 22:38:38.000000000","message":"lemme know how that looks","commit_id":"dda2995d6b66d68d377c371c9a4ea2659f49be30"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"e2a47f9eea4bef67366c055147e324c885123e44","unresolved":false,"context_lines":[{"line_number":256,"context_line":"        validation.lazy_validate(schema.project_create, project)"},{"line_number":257,"context_line":""},{"line_number":258,"context_line":"        try:"},{"line_number":259,"context_line":"            domain_id \u003d project[\u0027domain_id\u0027]"},{"line_number":260,"context_line":"        except KeyError:"},{"line_number":261,"context_line":"            if not project.get(\u0027is_domain\u0027):"},{"line_number":262,"context_line":"                domain_id \u003d request.context.domain_id"}],"source_content_type":"text/x-python","patch_set":4,"id":"7f231b9d_208ca67d","line":259,"updated":"2017-06-14 16:11:41.000000000","message":"we don\u0027t actually ever use the domain_id var this line sets, so it probably makes more sense to replace this try/except with:\n\nif \u0027domain_id\u0027 not in project...","commit_id":"dda2995d6b66d68d377c371c9a4ea2659f49be30"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"19b6473e0158f0c89762ac869f0722268a70f61d","unresolved":false,"context_lines":[{"line_number":256,"context_line":"        validation.lazy_validate(schema.project_create, project)"},{"line_number":257,"context_line":""},{"line_number":258,"context_line":"        try:"},{"line_number":259,"context_line":"            domain_id \u003d project[\u0027domain_id\u0027]"},{"line_number":260,"context_line":"        except KeyError:"},{"line_number":261,"context_line":"            if not project.get(\u0027is_domain\u0027):"},{"line_number":262,"context_line":"                domain_id \u003d request.context.domain_id"}],"source_content_type":"text/x-python","patch_set":4,"id":"7f231b9d_170d68a0","line":259,"in_reply_to":"7f231b9d_208ca67d","updated":"2017-06-14 22:38:38.000000000","message":"Done","commit_id":"dda2995d6b66d68d377c371c9a4ea2659f49be30"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"64eedd6a964d9ab6cad166f5fb9316a359d298c1","unresolved":false,"context_lines":[{"line_number":259,"context_line":"            domain_id \u003d project[\u0027domain_id\u0027]"},{"line_number":260,"context_line":"        except KeyError:"},{"line_number":261,"context_line":"            if not project.get(\u0027is_domain\u0027):"},{"line_number":262,"context_line":"                domain_id \u003d request.context.domain_id"},{"line_number":263,"context_line":"                if domain_id is None:"},{"line_number":264,"context_line":"                    domain_id \u003d request.context.project_domain_id"},{"line_number":265,"context_line":"                project[\u0027domain_id\u0027] \u003d domain_id"},{"line_number":266,"context_line":""},{"line_number":267,"context_line":"        ref \u003d self._assign_unique_id(self._normalize_dict(project))"},{"line_number":268,"context_line":"        if not ref.get(\u0027is_domain\u0027):"}],"source_content_type":"text/x-python","patch_set":4,"id":"7f231b9d_dbe3a7d8","line":265,"range":{"start_line":262,"start_character":0,"end_line":265,"end_character":48},"updated":"2017-06-14 16:45:50.000000000","message":"looking closer, I don\u0027t think this is quite correct. Before we default to the domain from the token scope like this (and it would be nice to add a comment saying that\u0027s what we\u0027re doing), we should see if parent_id was specified. If so, we should figure the domain_id from that (handling both cases where the parent is a domain and where it is another normal project). And indeed that is what we document in the API ref: https://github.com/openstack/keystone/blob/master/api-ref/source/v3/parameters.yaml#L1162-L1168","commit_id":"dda2995d6b66d68d377c371c9a4ea2659f49be30"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"19b6473e0158f0c89762ac869f0722268a70f61d","unresolved":false,"context_lines":[{"line_number":259,"context_line":"            domain_id \u003d project[\u0027domain_id\u0027]"},{"line_number":260,"context_line":"        except KeyError:"},{"line_number":261,"context_line":"            if not project.get(\u0027is_domain\u0027):"},{"line_number":262,"context_line":"                domain_id \u003d request.context.domain_id"},{"line_number":263,"context_line":"                if domain_id is None:"},{"line_number":264,"context_line":"                    domain_id \u003d request.context.project_domain_id"},{"line_number":265,"context_line":"                project[\u0027domain_id\u0027] \u003d domain_id"},{"line_number":266,"context_line":""},{"line_number":267,"context_line":"        ref \u003d self._assign_unique_id(self._normalize_dict(project))"},{"line_number":268,"context_line":"        if not ref.get(\u0027is_domain\u0027):"}],"source_content_type":"text/x-python","patch_set":4,"id":"7f231b9d_77f13c95","line":265,"range":{"start_line":262,"start_character":0,"end_line":265,"end_character":48},"in_reply_to":"7f231b9d_dbe3a7d8","updated":"2017-06-14 22:38:38.000000000","message":"lemme know if this is more correct","commit_id":"dda2995d6b66d68d377c371c9a4ea2659f49be30"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"c99cb03e3316c09aa1228a27d72076e85cfd0099","unresolved":false,"context_lines":[{"line_number":267,"context_line":"        ref \u003d self._assign_unique_id(self._normalize_dict(project))"},{"line_number":268,"context_line":"        if not ref.get(\u0027is_domain\u0027):"},{"line_number":269,"context_line":"            ref \u003d self._normalize_domain_id(request, ref)"},{"line_number":270,"context_line":"        # Our API requires that you specify the location in the hierarchy"},{"line_number":271,"context_line":"        # unambiguously. This could be by parent_id or, if it is a top level"},{"line_number":272,"context_line":"        # project, just by providing a domain_id."},{"line_number":273,"context_line":"        if not ref.get(\u0027parent_id\u0027):"},{"line_number":274,"context_line":"            ref[\u0027parent_id\u0027] \u003d ref.get(\u0027domain_id\u0027)"},{"line_number":275,"context_line":""},{"line_number":276,"context_line":"        kwargs \u003d {\u0027project\u0027: ref}"},{"line_number":277,"context_line":"        args \u003d [self, request, ref]"}],"source_content_type":"text/x-python","patch_set":4,"id":"7f231b9d_fb1b037e","line":274,"range":{"start_line":270,"start_character":0,"end_line":274,"end_character":51},"updated":"2017-06-14 16:51:19.000000000","message":"I think the domain_id logic we\u0027re adding above is largely just the reverse of this... and as such, they should probably be together for better clarity.","commit_id":"dda2995d6b66d68d377c371c9a4ea2659f49be30"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"19b6473e0158f0c89762ac869f0722268a70f61d","unresolved":false,"context_lines":[{"line_number":267,"context_line":"        ref \u003d self._assign_unique_id(self._normalize_dict(project))"},{"line_number":268,"context_line":"        if not ref.get(\u0027is_domain\u0027):"},{"line_number":269,"context_line":"            ref \u003d self._normalize_domain_id(request, ref)"},{"line_number":270,"context_line":"        # Our API requires that you specify the location in the hierarchy"},{"line_number":271,"context_line":"        # unambiguously. This could be by parent_id or, if it is a top level"},{"line_number":272,"context_line":"        # project, just by providing a domain_id."},{"line_number":273,"context_line":"        if not ref.get(\u0027parent_id\u0027):"},{"line_number":274,"context_line":"            ref[\u0027parent_id\u0027] \u003d ref.get(\u0027domain_id\u0027)"},{"line_number":275,"context_line":""},{"line_number":276,"context_line":"        kwargs \u003d {\u0027project\u0027: ref}"},{"line_number":277,"context_line":"        args \u003d [self, request, ref]"}],"source_content_type":"text/x-python","patch_set":4,"id":"7f231b9d_57ee40b4","line":274,"range":{"start_line":270,"start_character":0,"end_line":274,"end_character":51},"in_reply_to":"7f231b9d_fb1b037e","updated":"2017-06-14 22:38:38.000000000","message":"Done","commit_id":"dda2995d6b66d68d377c371c9a4ea2659f49be30"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"611f23bfd7583bbda3df9c7e3e6d6b7d4642f1da","unresolved":false,"context_lines":[{"line_number":256,"context_line":""},{"line_number":257,"context_line":"        ref \u003d self._assign_unique_id(self._normalize_dict(project))"},{"line_number":258,"context_line":""},{"line_number":259,"context_line":"        # For regular projects (i.e. those not acing as a domain), if"},{"line_number":260,"context_line":"        # \"domain_id\" is not specified, but \"parent_id\" is specified,"},{"line_number":261,"context_line":"        # then the domain ID of the parent will be used. If neither"},{"line_number":262,"context_line":"        # \"domain_id\" or \"parent_id\" is specified, we will default to"}],"source_content_type":"text/x-python","patch_set":11,"id":"ff346bd7_5300dd67","line":259,"range":{"start_line":259,"start_character":47,"end_line":259,"end_character":52},"updated":"2017-07-25 15:55:48.000000000","message":"acting","commit_id":"4ec6adeae530d6bbe06f4936fb4001b54449d6ef"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"611f23bfd7583bbda3df9c7e3e6d6b7d4642f1da","unresolved":false,"context_lines":[{"line_number":258,"context_line":""},{"line_number":259,"context_line":"        # For regular projects (i.e. those not acing as a domain), if"},{"line_number":260,"context_line":"        # \"domain_id\" is not specified, but \"parent_id\" is specified,"},{"line_number":261,"context_line":"        # then the domain ID of the parent will be used. If neither"},{"line_number":262,"context_line":"        # \"domain_id\" or \"parent_id\" is specified, we will default to"},{"line_number":263,"context_line":"        # the domain to which the client\u0027s token is scoped."},{"line_number":264,"context_line":"        if not ref.get(\u0027is_domain\u0027):"}],"source_content_type":"text/x-python","patch_set":11,"id":"ff346bd7_9362c53d","line":261,"range":{"start_line":261,"start_character":19,"end_line":261,"end_character":55},"updated":"2017-07-25 15:55:48.000000000","message":"I expect we also need to handle the case where the entity pointed to by parent_id is a domain. I.e. the user chose to specify the id as parent_id but it could just as well have been specified as domain_id because it actually is a domain.","commit_id":"4ec6adeae530d6bbe06f4936fb4001b54449d6ef"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"611f23bfd7583bbda3df9c7e3e6d6b7d4642f1da","unresolved":false,"context_lines":[{"line_number":284,"context_line":"        args \u003d [self, request, ref]"},{"line_number":285,"context_line":""},{"line_number":286,"context_line":"        authorization.check_policy("},{"line_number":287,"context_line":"            self, request, \u0027create_project\u0027,"},{"line_number":288,"context_line":"            filter_attr\u003dNone, input_attr\u003dkwargs, target_attr\u003dNone,"},{"line_number":289,"context_line":"            args\u003dargs, kwargs\u003dkwargs)"},{"line_number":290,"context_line":""}],"source_content_type":"text/x-python","patch_set":11,"id":"ff346bd7_134b752b","line":287,"updated":"2017-07-25 15:55:48.000000000","message":"either s/\u0027create_project\u0027/pol_base.IDENTITY % \u0027create_project\u0027/ or switch to using check_protection.","commit_id":"4ec6adeae530d6bbe06f4936fb4001b54449d6ef"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"db124fb74b0a2bc7835c26b34e32b16765e311b6","unresolved":false,"context_lines":[{"line_number":284,"context_line":"        args \u003d [self, request, ref]"},{"line_number":285,"context_line":""},{"line_number":286,"context_line":"        authorization.check_policy("},{"line_number":287,"context_line":"            self, request, \u0027create_project\u0027,"},{"line_number":288,"context_line":"            filter_attr\u003dNone, input_attr\u003dkwargs, target_attr\u003dNone,"},{"line_number":289,"context_line":"            args\u003dargs, kwargs\u003dkwargs)"},{"line_number":290,"context_line":""}],"source_content_type":"text/x-python","patch_set":11,"id":"df3967d1_11a2564c","line":287,"in_reply_to":"ff346bd7_134b752b","updated":"2017-08-01 17:05:31.000000000","message":"Done","commit_id":"4ec6adeae530d6bbe06f4936fb4001b54449d6ef"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"43a821dfa8e9a8795d4519efe741d1f8f017128e","unresolved":false,"context_lines":[{"line_number":269,"context_line":""},{"line_number":270,"context_line":"        prep_info \u003d {"},{"line_number":271,"context_line":"            \u0027f_name\u0027: \u0027create_project\u0027,"},{"line_number":272,"context_line":"            \u0027input_attr\u0027: kwargs"},{"line_number":273,"context_line":"        }"},{"line_number":274,"context_line":""},{"line_number":275,"context_line":"        authorization.check_protection("}],"source_content_type":"text/x-python","patch_set":12,"id":"df3967d1_d64f1fbb","line":272,"range":{"start_line":272,"start_character":12,"end_line":272,"end_character":32},"updated":"2017-08-01 19:10:40.000000000","message":"nit: check_policy (when called by check_protection) is going to merge prep_info[\u0027input_attr\u0027] and kwargs into the same dict, so you don\u0027t need to specify both if they\u0027re the same.","commit_id":"6431e2be005572762a23a33e7932cb6457a87327"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"43a821dfa8e9a8795d4519efe741d1f8f017128e","unresolved":false,"context_lines":[{"line_number":274,"context_line":""},{"line_number":275,"context_line":"        authorization.check_protection("},{"line_number":276,"context_line":"            self, request, prep_info,"},{"line_number":277,"context_line":"            target_attr\u003dNone, kwargs\u003dkwargs)"},{"line_number":278,"context_line":""},{"line_number":279,"context_line":"        try:"},{"line_number":280,"context_line":"            ref \u003d self.resource_api.create_project("}],"source_content_type":"text/x-python","patch_set":12,"id":"df3967d1_f6f46389","line":277,"range":{"start_line":277,"start_character":12,"end_line":277,"end_character":30},"updated":"2017-08-01 19:10:40.000000000","message":"nit: target_attr\u0027s default is None, so you don\u0027t really need to specify this.","commit_id":"6431e2be005572762a23a33e7932cb6457a87327"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4f69667206259a879287cbbafd2a3c5c3d3c569a","unresolved":false,"context_lines":[{"line_number":251,"context_line":""},{"line_number":252,"context_line":"    @controller.protected()"},{"line_number":253,"context_line":"    def create_project(self, request, project):"},{"line_number":254,"context_line":"        validation.lazy_validate(schema.project_create, project)"},{"line_number":255,"context_line":"        ref \u003d self._assign_unique_id(self._normalize_dict(project))"},{"line_number":256,"context_line":""},{"line_number":257,"context_line":"        if not ref.get(\u0027is_domain\u0027):"}],"source_content_type":"text/x-python","patch_set":15,"id":"9f436f4f_cb6244ae","side":"PARENT","line":254,"updated":"2017-08-16 19:09:03.000000000","message":"Yeah - like this. This validates the request as it comes from the user, instead of after we normalize it.","commit_id":"9cbd6bc0ebdc17976804d892ff8e7ac89e273b64"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4dc9c5518e26244a0d6e008f6b72ebb02802dae2","unresolved":false,"context_lines":[{"line_number":175,"context_line":"            ref[\u0027parent_id\u0027] \u003d ref.get(\u0027domain_id\u0027)"},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"        authorization.check_policy_input(self, request,"},{"line_number":178,"context_line":"                                         \u0027create_project\u0027, \u0027project\u0027, ref)"},{"line_number":179,"context_line":"        try:"},{"line_number":180,"context_line":"            ref \u003d PROVIDERS.resource_api.create_project("},{"line_number":181,"context_line":"                ref[\u0027id\u0027],"}],"source_content_type":"text/x-python","patch_set":22,"id":"9f6a8fd7_73c5248e","line":178,"updated":"2018-04-16 21:28:28.000000000","message":"Same comment here. I\u0027m all for removing the decorator, but I think this is only marginally better because we\u0027re passing the same information to the policy method in a more verbose way. The decorator handled this under the hood.\n\nIf we get rid of a decorator we should try and get rid of it\u0027s semantics in call the oslo.policy API.","commit_id":"4624bc84d24e2a08ff7598a77a9b0f6a88969e19"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"a33842cd26d42bffeebd223b74074340aad2fd9c","unresolved":false,"context_lines":[{"line_number":175,"context_line":"            ref[\u0027parent_id\u0027] \u003d ref.get(\u0027domain_id\u0027)"},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"        authorization.check_policy_input(self, request,"},{"line_number":178,"context_line":"                                         \u0027create_project\u0027, \u0027project\u0027, ref)"},{"line_number":179,"context_line":"        try:"},{"line_number":180,"context_line":"            ref \u003d PROVIDERS.resource_api.create_project("},{"line_number":181,"context_line":"                ref[\u0027id\u0027],"}],"source_content_type":"text/x-python","patch_set":22,"id":"9f6a8fd7_566a4e80","line":178,"in_reply_to":"9f6a8fd7_73c5248e","updated":"2018-04-16 22:13:41.000000000","message":"What the decorator had access to was the name of the function that was called.  While this was concise, it was hard to map that to policy.  We might be able to generate the same information from inside a function, but certainly not from the up the call stack.  So, while we could probably deduce the \"project\" parameter from this call, we could not deduce \"create_project\"","commit_id":"4624bc84d24e2a08ff7598a77a9b0f6a88969e19"}]}