)]}'
{"keystone/common/policies/domain_config.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c8e064ebce3a6d2a603667054fe89975c96fa059","unresolved":false,"context_lines":[{"line_number":22,"context_line":"        # It makes sense to have this be both system-scoped and project-scoped"},{"line_number":23,"context_line":"        # because that will allow domain administrators the ability to update"},{"line_number":24,"context_line":"        # domain configuration for their own domains."},{"line_number":25,"context_line":"        scope_types\u003d[\u0027system\u0027, \u0027project\u0027],"},{"line_number":26,"context_line":"        description\u003d\u0027Create domain configuration.\u0027,"},{"line_number":27,"context_line":"        operations\u003d["},{"line_number":28,"context_line":"            {"}],"source_content_type":"text/x-python","patch_set":1,"id":"7f96bb07_b52964f3","line":25,"range":{"start_line":25,"start_character":32,"end_line":25,"end_character":39},"updated":"2018-01-19 19:35:03.000000000","message":"I don\u0027t think the domain configuration API actually does any checks that support this. For the time being, maybe it makes sense to lock this down to only system administrator until we develop scope checks in code that support project administrators or domain administrator.","commit_id":"f5f7cbd2bd9ce43bb10d21218f9986ba1940b499"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c8e064ebce3a6d2a603667054fe89975c96fa059","unresolved":false,"context_lines":[{"line_number":37,"context_line":"        # It makes sense to have this be both system-scoped and project-scoped"},{"line_number":38,"context_line":"        # because that will allow domain administrators the ability to update"},{"line_number":39,"context_line":"        # domain configuration for their own domains."},{"line_number":40,"context_line":"        scope_types\u003d[\u0027system\u0027, \u0027project\u0027],"},{"line_number":41,"context_line":"        description\u003d(\u0027Get the entire domain configuration for a domain, an \u0027"},{"line_number":42,"context_line":"                     \u0027option group within a domain, or a specific \u0027"},{"line_number":43,"context_line":"                     \u0027configuration option within a group for a domain.\u0027),"}],"source_content_type":"text/x-python","patch_set":1,"id":"7f96bb07_9538e83d","line":40,"range":{"start_line":40,"start_character":32,"end_line":40,"end_character":39},"updated":"2018-01-19 19:35:03.000000000","message":"Same comment here. Otherwise we might be giving someone with an admin role on a project the ability to get domain configurations for domains that they are not a part of, which would be a security concern.","commit_id":"f5f7cbd2bd9ce43bb10d21218f9986ba1940b499"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c8e064ebce3a6d2a603667054fe89975c96fa059","unresolved":false,"context_lines":[{"line_number":73,"context_line":"        check_str\u003d\u0027\u0027,"},{"line_number":74,"context_line":"        # This should be accessible to anyone with a valid token, regardless of"},{"line_number":75,"context_line":"        # system-scope or project-scope."},{"line_number":76,"context_line":"        scope_types\u003d[\u0027system\u0027, \u0027project\u0027],"},{"line_number":77,"context_line":"        description\u003d(\u0027Get security compliance domain configuration for \u0027"},{"line_number":78,"context_line":"                     \u0027either a domain or a specific option in a domain.\u0027),"},{"line_number":79,"context_line":"        operations\u003d["}],"source_content_type":"text/x-python","patch_set":1,"id":"7f96bb07_d51750a3","line":76,"range":{"start_line":76,"start_character":8,"end_line":76,"end_character":42},"updated":"2018-01-19 19:35:03.000000000","message":"This should be fine, since we don\u0027t want to restrict this API and we want it to be accessible to anyone with a valid token.","commit_id":"f5f7cbd2bd9ce43bb10d21218f9986ba1940b499"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c8e064ebce3a6d2a603667054fe89975c96fa059","unresolved":false,"context_lines":[{"line_number":100,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":101,"context_line":"        name\u003dbase.IDENTITY % \u0027update_domain_config\u0027,"},{"line_number":102,"context_line":"        check_str\u003dbase.RULE_ADMIN_REQUIRED,"},{"line_number":103,"context_line":"        # It makes sense to have this be both system-scoped and project-scoped"},{"line_number":104,"context_line":"        # because that will allow domain administrators the ability to update"},{"line_number":105,"context_line":"        # domain configuration for their own domains."},{"line_number":106,"context_line":"        scope_types\u003d[\u0027system\u0027, \u0027project\u0027],"}],"source_content_type":"text/x-python","patch_set":1,"id":"7f96bb07_9511c8af","line":103,"updated":"2018-01-19 19:35:03.000000000","message":"For sure the same comment here.","commit_id":"f5f7cbd2bd9ce43bb10d21218f9986ba1940b499"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c8e064ebce3a6d2a603667054fe89975c96fa059","unresolved":false,"context_lines":[{"line_number":124,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":125,"context_line":"        name\u003dbase.IDENTITY % \u0027delete_domain_config\u0027,"},{"line_number":126,"context_line":"        check_str\u003dbase.RULE_ADMIN_REQUIRED,"},{"line_number":127,"context_line":"        # It makes sense to have this be both system-scoped and project-scoped"},{"line_number":128,"context_line":"        # because that will allow domain administrators the ability to manage"},{"line_number":129,"context_line":"        # domain configuration for their own domains."},{"line_number":130,"context_line":"        scope_types\u003d[\u0027system\u0027, \u0027project\u0027],"}],"source_content_type":"text/x-python","patch_set":1,"id":"7f96bb07_3526b418","line":127,"updated":"2018-01-19 19:35:03.000000000","message":"Same comment here.","commit_id":"f5f7cbd2bd9ce43bb10d21218f9986ba1940b499"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c8e064ebce3a6d2a603667054fe89975c96fa059","unresolved":false,"context_lines":[{"line_number":148,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":149,"context_line":"        name\u003dbase.IDENTITY % \u0027get_domain_config_default\u0027,"},{"line_number":150,"context_line":"        check_str\u003dbase.RULE_ADMIN_REQUIRED,"},{"line_number":151,"context_line":"        # It makes sense to have this be both system-scoped and project-scoped"},{"line_number":152,"context_line":"        # because that will allow domain administrators the ability to manage"},{"line_number":153,"context_line":"        # domain configuration for their own domains."},{"line_number":154,"context_line":"        scope_types\u003d[\u0027system\u0027, \u0027project\u0027],"}],"source_content_type":"text/x-python","patch_set":1,"id":"7f96bb07_75819cc3","line":151,"updated":"2018-01-19 19:35:03.000000000","message":"Same comment here, we should restrict this to system only for the time being until we develop in code checks to handle project-scoped tokens or domain scoped tokens.","commit_id":"f5f7cbd2bd9ce43bb10d21218f9986ba1940b499"}]}