)]}'
{"keystone/common/policies/role_assignment.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"54bd0bc5f9eac78c3eed2edcb5dbe1f92ab420be","unresolved":false,"context_lines":[{"line_number":25,"context_line":"        # token is scoped to. These checks are going to have to be encoded and"},{"line_number":26,"context_line":"        # enforced in keystone code, since their behavior shouldn\u0027t change,"},{"line_number":27,"context_line":"        # regardless of the deployment configuration."},{"line_number":28,"context_line":"        scope_types\u003d[\u0027system\u0027, \u0027project\u0027],"},{"line_number":29,"context_line":"        description\u003d\u0027List role assignments.\u0027,"},{"line_number":30,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027/v3/role_assignments\u0027,"},{"line_number":31,"context_line":"                     \u0027method\u0027: \u0027GET\u0027},"}],"source_content_type":"text/x-python","patch_set":2,"id":"7f96bb07_35cf9458","line":28,"range":{"start_line":28,"start_character":32,"end_line":28,"end_character":39},"updated":"2018-01-19 19:30:59.000000000","message":"In hindsight, I\u0027m thinking this needs to be removed and the TODO should actually be a FIXME. That would keep things safe for now, and once we have code in place to return role assignments based on a project a token is scoped to for project administrators, we can add this back in. Otherwise, we might be giving project administrators the ability to view *all* role assignments across the entire deployment.","commit_id":"74b79972a86d7e4bc068048e143c224e6f9d6f5a"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"9bb269849689ef086324e277b3ba3687766f6433","unresolved":false,"context_lines":[{"line_number":37,"context_line":"        # This should be purely a project-scoped operation. The project tree"},{"line_number":38,"context_line":"        # should be calculated based on the project the token used to make the"},{"line_number":39,"context_line":"        # request is scoped to."},{"line_number":40,"context_line":"        scope_types\u003d[\u0027project\u0027],"},{"line_number":41,"context_line":"        description\u003d(\u0027List all role assignments for a given tree of \u0027"},{"line_number":42,"context_line":"                     \u0027hierarchical projects.\u0027),"},{"line_number":43,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027/v3/role_assignments?include_subtree\u0027,"}],"source_content_type":"text/x-python","patch_set":2,"id":"7f96bb07_c8058016","line":40,"updated":"2018-01-19 13:51:13.000000000","message":"So a system administrator shouldn\u0027t be allowed to check the role assignments under a specific project?","commit_id":"74b79972a86d7e4bc068048e143c224e6f9d6f5a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"54bd0bc5f9eac78c3eed2edcb5dbe1f92ab420be","unresolved":false,"context_lines":[{"line_number":37,"context_line":"        # This should be purely a project-scoped operation. The project tree"},{"line_number":38,"context_line":"        # should be calculated based on the project the token used to make the"},{"line_number":39,"context_line":"        # request is scoped to."},{"line_number":40,"context_line":"        scope_types\u003d[\u0027project\u0027],"},{"line_number":41,"context_line":"        description\u003d(\u0027List all role assignments for a given tree of \u0027"},{"line_number":42,"context_line":"                     \u0027hierarchical projects.\u0027),"},{"line_number":43,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027/v3/role_assignments?include_subtree\u0027,"}],"source_content_type":"text/x-python","patch_set":2,"id":"7f96bb07_d5bbd0c1","line":40,"in_reply_to":"7f96bb07_c8058016","updated":"2018-01-19 19:30:59.000000000","message":"I *think* so? The tricky part is that I believe the project to evaluate in the request is pulled from the scope of the token used to make the call... In that case, if a system administrator calls this API with a system-scoped token, what project do you use to evaluate the tree or subtree?","commit_id":"74b79972a86d7e4bc068048e143c224e6f9d6f5a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"bd874d8fa4dfa2c60f97cb23291e23582c00280f","unresolved":false,"context_lines":[{"line_number":37,"context_line":"        # This should be purely a project-scoped operation. The project tree"},{"line_number":38,"context_line":"        # should be calculated based on the project the token used to make the"},{"line_number":39,"context_line":"        # request is scoped to."},{"line_number":40,"context_line":"        scope_types\u003d[\u0027project\u0027],"},{"line_number":41,"context_line":"        description\u003d(\u0027List all role assignments for a given tree of \u0027"},{"line_number":42,"context_line":"                     \u0027hierarchical projects.\u0027),"},{"line_number":43,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027/v3/role_assignments?include_subtree\u0027,"}],"source_content_type":"text/x-python","patch_set":2,"id":"7f96bb07_c973e97f","line":40,"in_reply_to":"7f96bb07_d5bbd0c1","updated":"2018-01-23 15:54:47.000000000","message":"Yeah - I did some digging and found the code:\n\nhttps://github.com/openstack/keystone/blob/master/keystone/assignment/controllers.py#L916-L919","commit_id":"74b79972a86d7e4bc068048e143c224e6f9d6f5a"}]}