)]}'
{"keystone/common/policies/grant.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"12e6cc884de402f7c33bd2db114f39b5541bf430","unresolved":false,"context_lines":[{"line_number":59,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":60,"context_line":"        name\u003dbase.IDENTITY % \u0027check_grant\u0027,"},{"line_number":61,"context_line":"        check_str\u003dbase.RULE_ADMIN_REQUIRED,"},{"line_number":62,"context_line":"        scope_types\u003d[\u0027project\u0027, \u0027system\u0027],"},{"line_number":63,"context_line":"        description\u003d(\u0027Check a role grant between a target and an actor. A \u0027"},{"line_number":64,"context_line":"                     \u0027target can be either a domain or a project. An actor \u0027"},{"line_number":65,"context_line":"                     \u0027can be either a user or a group. These terms also apply \u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"7f96bb07_358794b9","line":62,"range":{"start_line":62,"start_character":22,"end_line":62,"end_character":29},"updated":"2018-01-19 19:39:42.000000000","message":"These should all be system-level APIs for now. At least until we can ensure that a project-scoped token used to make this call actually came from a project admin and we format the response according to the project they are scoped to. Otherwise we are giving project administrators the ability to view *all* grants in the deployment.","commit_id":"5e0974a0ee3dd3f2fe893d182daba230ceca3757"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"aa9160d616a1e7dcb443461933bcc193ebdeaa28","unresolved":false,"context_lines":[{"line_number":59,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":60,"context_line":"        name\u003dbase.IDENTITY % \u0027check_grant\u0027,"},{"line_number":61,"context_line":"        check_str\u003dbase.RULE_ADMIN_REQUIRED,"},{"line_number":62,"context_line":"        scope_types\u003d[\u0027project\u0027, \u0027system\u0027],"},{"line_number":63,"context_line":"        description\u003d(\u0027Check a role grant between a target and an actor. A \u0027"},{"line_number":64,"context_line":"                     \u0027target can be either a domain or a project. An actor \u0027"},{"line_number":65,"context_line":"                     \u0027can be either a user or a group. These terms also apply \u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"7f96bb07_6966552c","line":62,"range":{"start_line":62,"start_character":22,"end_line":62,"end_character":29},"in_reply_to":"7f96bb07_358794b9","updated":"2018-01-23 16:03:11.000000000","message":"Done","commit_id":"5e0974a0ee3dd3f2fe893d182daba230ceca3757"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"412619d0967b4b46aab2f1d59069ec3eb00f2973","unresolved":false,"context_lines":[{"line_number":79,"context_line":"                     \u0027in the specified domain.\u0027),"},{"line_number":80,"context_line":"        operations\u003dlist_grants_operations),"},{"line_number":81,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":82,"context_line":"        name\u003dbase.IDENTITY % \u0027create_grant\u0027,"},{"line_number":83,"context_line":"        check_str\u003dbase.RULE_ADMIN_REQUIRED,"},{"line_number":84,"context_line":"        scope_types\u003d[\u0027project\u0027, \u0027system\u0027],"},{"line_number":85,"context_line":"        description\u003d(\u0027Create a role grant between a target and an actor. A \u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"9f91af0f_526cb507","line":82,"range":{"start_line":82,"start_character":30,"end_line":82,"end_character":42},"updated":"2017-12-29 02:48:16.000000000","message":"These should really just be broken up into more granular policies so that we can have one specifically for granting roles on the system and one for granting roles on projects. Because each requires different scope types.","commit_id":"5e0974a0ee3dd3f2fe893d182daba230ceca3757"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"aa9160d616a1e7dcb443461933bcc193ebdeaa28","unresolved":false,"context_lines":[{"line_number":79,"context_line":"                     \u0027in the specified domain.\u0027),"},{"line_number":80,"context_line":"        operations\u003dlist_grants_operations),"},{"line_number":81,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":82,"context_line":"        name\u003dbase.IDENTITY % \u0027create_grant\u0027,"},{"line_number":83,"context_line":"        check_str\u003dbase.RULE_ADMIN_REQUIRED,"},{"line_number":84,"context_line":"        scope_types\u003d[\u0027project\u0027, \u0027system\u0027],"},{"line_number":85,"context_line":"        description\u003d(\u0027Create a role grant between a target and an actor. A \u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"7f96bb07_29704ddc","line":82,"range":{"start_line":82,"start_character":30,"end_line":82,"end_character":42},"in_reply_to":"9f91af0f_526cb507","updated":"2018-01-23 16:03:11.000000000","message":"Done","commit_id":"5e0974a0ee3dd3f2fe893d182daba230ceca3757"}]}