)]}'
{"keystone/common/policies/project.py":[{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"fcb112d2ae3db6494f2de5d2aeba9568cf305c20","unresolved":false,"context_lines":[{"line_number":43,"context_line":"        check_str\u003dbase.RULE_ADMIN_OR_OWNER,"},{"line_number":44,"context_line":"        # FIXME(lbragstad): This feels like a system-level API. What should"},{"line_number":45,"context_line":"        # happen if a someone attempts to list their projects with a"},{"line_number":46,"context_line":"        # project-scoped token?"},{"line_number":47,"context_line":"        scope_types\u003d[\u0027system\u0027],"},{"line_number":48,"context_line":"        description\u003d\u0027List projects for user.\u0027,"},{"line_number":49,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027/v3/users/{user_id}/projects\u0027,"}],"source_content_type":"text/x-python","patch_set":3,"id":"7f96bb07_583e25db","line":46,"updated":"2018-01-19 12:10:26.000000000","message":"If it\u0027s hierarchical, would it list all the projects under the hierarchy?\n\nEven if it\u0027s not, I think it should be possible for a user to use a project-scoped token to list their own, single, project. For example, I\u0027ve been frustrated trying to use osc with the trusts API because if you provide a username and project name rather than IDs, osc uses the list_projects and list_users commands to try to find the IDs of these resources. If you\u0027re not the admin user, it fails because regular users aren\u0027t allowed to list_projects or list_users, so you\u0027re forced to use IDs. If regular users could use a project-scoped token to list projects relevant to that project, even if it\u0027s just one project, that would help a lot.","commit_id":"c650181b30da82b898b7a6b2440991ec34621a12"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2a4f9b097afeeffa83f8169c44fb29cf60c425fc","unresolved":false,"context_lines":[{"line_number":43,"context_line":"        check_str\u003dbase.RULE_ADMIN_OR_OWNER,"},{"line_number":44,"context_line":"        # FIXME(lbragstad): This feels like a system-level API. What should"},{"line_number":45,"context_line":"        # happen if a someone attempts to list their projects with a"},{"line_number":46,"context_line":"        # project-scoped token?"},{"line_number":47,"context_line":"        scope_types\u003d[\u0027system\u0027],"},{"line_number":48,"context_line":"        description\u003d\u0027List projects for user.\u0027,"},{"line_number":49,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027/v3/users/{user_id}/projects\u0027,"}],"source_content_type":"text/x-python","patch_set":3,"id":"7f96bb07_33d6c9f3","line":46,"in_reply_to":"7f96bb07_583e25db","updated":"2018-01-19 23:20:09.000000000","message":"Good point, working that into this comment with a FIXME.","commit_id":"c650181b30da82b898b7a6b2440991ec34621a12"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"fcb112d2ae3db6494f2de5d2aeba9568cf305c20","unresolved":false,"context_lines":[{"line_number":52,"context_line":"        name\u003dbase.IDENTITY % \u0027create_project\u0027,"},{"line_number":53,"context_line":"        check_str\u003dbase.RULE_ADMIN_REQUIRED,"},{"line_number":54,"context_line":"        # FIXME(lbragstad): If this API is called with a project-scoped token,"},{"line_number":55,"context_line":"        # keystone should enforce project hierarchies based on the token scope"},{"line_number":56,"context_line":"        # used in the request. That should be something coded into keystone and"},{"line_number":57,"context_line":"        # not left up to configuration via policy."},{"line_number":58,"context_line":"        scope_types\u003d[\u0027system\u0027, \u0027project\u0027],"}],"source_content_type":"text/x-python","patch_set":3,"id":"7f96bb07_133cfebd","line":55,"range":{"start_line":55,"start_character":26,"end_line":55,"end_character":54},"updated":"2018-01-19 12:10:26.000000000","message":"This breaks my brain a little. If I have a token scoped to project A and I want to use create_project to create project B, does this enforcement mean that project B will automatically have a parent of project A?\n\nOr maybe this makes a little more sense when we talk about domain admins, who should be able to use a project-(i.e. domain-)scoped token to create projects within their domain?","commit_id":"c650181b30da82b898b7a6b2440991ec34621a12"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2a4f9b097afeeffa83f8169c44fb29cf60c425fc","unresolved":false,"context_lines":[{"line_number":52,"context_line":"        name\u003dbase.IDENTITY % \u0027create_project\u0027,"},{"line_number":53,"context_line":"        check_str\u003dbase.RULE_ADMIN_REQUIRED,"},{"line_number":54,"context_line":"        # FIXME(lbragstad): If this API is called with a project-scoped token,"},{"line_number":55,"context_line":"        # keystone should enforce project hierarchies based on the token scope"},{"line_number":56,"context_line":"        # used in the request. That should be something coded into keystone and"},{"line_number":57,"context_line":"        # not left up to configuration via policy."},{"line_number":58,"context_line":"        scope_types\u003d[\u0027system\u0027, \u0027project\u0027],"}],"source_content_type":"text/x-python","patch_set":3,"id":"7f96bb07_7368d120","line":55,"range":{"start_line":55,"start_character":26,"end_line":55,"end_character":54},"in_reply_to":"7f96bb07_133cfebd","updated":"2018-01-19 23:20:09.000000000","message":"Yeah - I updated to try and make that a little more clear. Let me know if it helps.","commit_id":"c650181b30da82b898b7a6b2440991ec34621a12"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"fcb112d2ae3db6494f2de5d2aeba9568cf305c20","unresolved":false,"context_lines":[{"line_number":63,"context_line":"        name\u003dbase.IDENTITY % \u0027update_project\u0027,"},{"line_number":64,"context_line":"        check_str\u003dbase.RULE_ADMIN_REQUIRED,"},{"line_number":65,"context_line":"        # FIXME(lbragstad): If this API is called with a project-scoped token,"},{"line_number":66,"context_line":"        # keystone should enforce project hierarchies based on the token scope"},{"line_number":67,"context_line":"        # used in the request. That should be coded into keystone and not left"},{"line_number":68,"context_line":"        # up to configuration via policy."},{"line_number":69,"context_line":"        scope_types\u003d[\u0027system\u0027, \u0027project\u0027],"}],"source_content_type":"text/x-python","patch_set":3,"id":"7f96bb07_7399c2ce","line":66,"range":{"start_line":66,"start_character":26,"end_line":66,"end_character":53},"updated":"2018-01-19 12:10:26.000000000","message":"Confused here again about how the hierarchy fits into this. But I agree that allowing project-scope for update_project makes sense so that someone can update their own project at least. Same for delete.","commit_id":"c650181b30da82b898b7a6b2440991ec34621a12"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2a4f9b097afeeffa83f8169c44fb29cf60c425fc","unresolved":false,"context_lines":[{"line_number":63,"context_line":"        name\u003dbase.IDENTITY % \u0027update_project\u0027,"},{"line_number":64,"context_line":"        check_str\u003dbase.RULE_ADMIN_REQUIRED,"},{"line_number":65,"context_line":"        # FIXME(lbragstad): If this API is called with a project-scoped token,"},{"line_number":66,"context_line":"        # keystone should enforce project hierarchies based on the token scope"},{"line_number":67,"context_line":"        # used in the request. That should be coded into keystone and not left"},{"line_number":68,"context_line":"        # up to configuration via policy."},{"line_number":69,"context_line":"        scope_types\u003d[\u0027system\u0027, \u0027project\u0027],"}],"source_content_type":"text/x-python","patch_set":3,"id":"7f96bb07_33724913","line":66,"range":{"start_line":66,"start_character":26,"end_line":66,"end_character":53},"in_reply_to":"7f96bb07_7399c2ce","updated":"2018-01-19 23:20:09.000000000","message":"Ditto.","commit_id":"c650181b30da82b898b7a6b2440991ec34621a12"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"aa05568a6345491b50461eac4b3b121fc7573fa1","unresolved":false,"context_lines":[{"line_number":38,"context_line":"        check_str\u003dbase.RULE_ADMIN_REQUIRED,"},{"line_number":39,"context_line":"        # FIXME(lbragstad): See the above comment as to why this is commented"},{"line_number":40,"context_line":"        # out."},{"line_number":41,"context_line":"        # scope_types\u003d[\u0027system\u0027, \u0027project\u0027],"},{"line_number":42,"context_line":"        description\u003d\u0027List projects.\u0027,"},{"line_number":43,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027/v3/projects\u0027,"},{"line_number":44,"context_line":"                     \u0027method\u0027: \u0027GET\u0027}]),"}],"source_content_type":"text/x-python","patch_set":4,"id":"7f96bb07_fd1fcab4","line":41,"updated":"2018-01-20 18:53:47.000000000","message":"This is admin-only now, so I think that translates to system scope?","commit_id":"b4ba7909e5b532494cf2649b4446d10f83dbea42"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"aa05568a6345491b50461eac4b3b121fc7573fa1","unresolved":false,"context_lines":[{"line_number":61,"context_line":"        check_str\u003dbase.RULE_ADMIN_REQUIRED,"},{"line_number":62,"context_line":"        # FIXME(lbragstad): See the above comments as to why this is commented"},{"line_number":63,"context_line":"        # out."},{"line_number":64,"context_line":"        # scope_types\u003d[\u0027system\u0027, \u0027project\u0027],"},{"line_number":65,"context_line":"        description\u003d\u0027Create project.\u0027,"},{"line_number":66,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027/v3/projects\u0027,"},{"line_number":67,"context_line":"                     \u0027method\u0027: \u0027POST\u0027}]),"}],"source_content_type":"text/x-python","patch_set":4,"id":"7f96bb07_1d1dd6bc","line":64,"updated":"2018-01-20 18:53:47.000000000","message":"I think this could also be system for now, same for update and delete","commit_id":"b4ba7909e5b532494cf2649b4446d10f83dbea42"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c247b46d1ef76eb6976c73697d50fe5a8d53a896","unresolved":false,"context_lines":[{"line_number":61,"context_line":"        check_str\u003dbase.RULE_ADMIN_REQUIRED,"},{"line_number":62,"context_line":"        # FIXME(lbragstad): See the above comments as to why this is commented"},{"line_number":63,"context_line":"        # out."},{"line_number":64,"context_line":"        # scope_types\u003d[\u0027system\u0027, \u0027project\u0027],"},{"line_number":65,"context_line":"        description\u003d\u0027Create project.\u0027,"},{"line_number":66,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027/v3/projects\u0027,"},{"line_number":67,"context_line":"                     \u0027method\u0027: \u0027POST\u0027}]),"}],"source_content_type":"text/x-python","patch_set":4,"id":"7f96bb07_4fb839c7","line":64,"in_reply_to":"7f96bb07_1d1dd6bc","updated":"2018-01-23 17:11:34.000000000","message":"What about project tags?","commit_id":"b4ba7909e5b532494cf2649b4446d10f83dbea42"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"59de66387f4ba78fe88b9d9f98c2f38732dad236","unresolved":false,"context_lines":[{"line_number":61,"context_line":"        check_str\u003dbase.RULE_ADMIN_REQUIRED,"},{"line_number":62,"context_line":"        # FIXME(lbragstad): See the above comments as to why this is commented"},{"line_number":63,"context_line":"        # out."},{"line_number":64,"context_line":"        # scope_types\u003d[\u0027system\u0027, \u0027project\u0027],"},{"line_number":65,"context_line":"        description\u003d\u0027Create project.\u0027,"},{"line_number":66,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027/v3/projects\u0027,"},{"line_number":67,"context_line":"                     \u0027method\u0027: \u0027POST\u0027}]),"}],"source_content_type":"text/x-python","patch_set":4,"id":"7f96bb07_a4979f90","line":64,"in_reply_to":"7f96bb07_4fb839c7","updated":"2018-01-23 17:36:00.000000000","message":"RULE_ADMIN_OR_TARGET_PROJECT ... looking at https://github.com/openstack/oslo.policy/blob/master/oslo_policy/policy.py#L844 it seems like having scope_types\u003dsystem,project would allow it to pass the scope check and then make it to the rule check at https://github.com/openstack/oslo.policy/blob/master/oslo_policy/policy.py#L867 which might do the right thing?","commit_id":"b4ba7909e5b532494cf2649b4446d10f83dbea42"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"aa05568a6345491b50461eac4b3b121fc7573fa1","unresolved":false,"context_lines":[{"line_number":115,"context_line":"        check_str\u003dbase.RULE_ADMIN_REQUIRED,"},{"line_number":116,"context_line":"        # FIXME(lbragstad): See the above comments as to why this is commented"},{"line_number":117,"context_line":"        # out."},{"line_number":118,"context_line":"        # scope_types\u003d[\u0027system\u0027, \u0027project\u0027],"},{"line_number":119,"context_line":"        description\u003d\u0027Replace all tags on a project with the new set of tags.\u0027,"},{"line_number":120,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027/v3/projects/{project_id}/tags\u0027,"},{"line_number":121,"context_line":"                     \u0027method\u0027: \u0027PUT\u0027}]),"}],"source_content_type":"text/x-python","patch_set":4,"id":"7f96bb07_9d86c6db","line":118,"updated":"2018-01-20 18:53:47.000000000","message":"I think all of these tag operations with admin_required could just use system scope for now?","commit_id":"b4ba7909e5b532494cf2649b4446d10f83dbea42"}]}