)]}'
{"keystone/common/policies/credential.py":[{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"f23ec4d1e4245284b69170a6c96d0a22dbd93957","unresolved":false,"context_lines":[{"line_number":28,"context_line":"        # project-scoped token, then extra enforcement needs to happen based on"},{"line_number":29,"context_line":"        # who created the credential, what projects they are members of, and"},{"line_number":30,"context_line":"        # the project the token is scoped to. When we fully support the second"},{"line_number":31,"context_line":"        # case, we can add `project` to the list of scope_types."},{"line_number":32,"context_line":"        scope_types\u003d[\u0027system\u0027],"},{"line_number":33,"context_line":"        description\u003d\u0027Show credentials details.\u0027,"},{"line_number":34,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027/v3/credentials/{credential_id}\u0027,"}],"source_content_type":"text/x-python","patch_set":3,"id":"7f96bb07_a5ca9d17","line":31,"updated":"2018-01-19 13:13:41.000000000","message":"The thing is that most users won\u0027t have a role on the system, so setting enforce_scope will break end-users using this API.\n\nIt\u0027s almost like we need a \"user\" scope, or a kind of implicit individual project for each user.","commit_id":"ad0e32f689ab87ce9981c34a93fc0fc82729b6cd"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"dadc0735adde1d1e682d6fae1fd26c1bda87436d","unresolved":false,"context_lines":[{"line_number":28,"context_line":"        # project-scoped token, then extra enforcement needs to happen based on"},{"line_number":29,"context_line":"        # who created the credential, what projects they are members of, and"},{"line_number":30,"context_line":"        # the project the token is scoped to. When we fully support the second"},{"line_number":31,"context_line":"        # case, we can add `project` to the list of scope_types."},{"line_number":32,"context_line":"        scope_types\u003d[\u0027system\u0027],"},{"line_number":33,"context_line":"        description\u003d\u0027Show credentials details.\u0027,"},{"line_number":34,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027/v3/credentials/{credential_id}\u0027,"}],"source_content_type":"text/x-python","patch_set":3,"id":"7f96bb07_8b3f59b4","line":31,"in_reply_to":"7f96bb07_5590204f","updated":"2018-01-21 11:31:21.000000000","message":"Oh, good call. If this is \"admin-only\" before then I think \"system\" is appropriate.","commit_id":"ad0e32f689ab87ce9981c34a93fc0fc82729b6cd"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"89ad2006cee20668d77726726fcb1d0b02c5b493","unresolved":false,"context_lines":[{"line_number":28,"context_line":"        # project-scoped token, then extra enforcement needs to happen based on"},{"line_number":29,"context_line":"        # who created the credential, what projects they are members of, and"},{"line_number":30,"context_line":"        # the project the token is scoped to. When we fully support the second"},{"line_number":31,"context_line":"        # case, we can add `project` to the list of scope_types."},{"line_number":32,"context_line":"        scope_types\u003d[\u0027system\u0027],"},{"line_number":33,"context_line":"        description\u003d\u0027Show credentials details.\u0027,"},{"line_number":34,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027/v3/credentials/{credential_id}\u0027,"}],"source_content_type":"text/x-python","patch_set":3,"id":"7f96bb07_5590204f","line":31,"in_reply_to":"7f96bb07_a5ca9d17","updated":"2018-01-19 19:26:09.000000000","message":"Yeah - this is something that we need to have an in-code check for. When a user calls this API with a project-scoped token we need to make sure the credential they are asking for is one that they own, otherwise throw a 403.\n\nThe reason why I defaults to system here is because this was an \"admin-only\" API prior to the system scope work. So only cloud administrators were meant to access it. If we set it to \u0027project\u0027 without write code to check the user\u0027s authorization in keystone, then we might be letting project administrators get credentials they shouldn\u0027t be able to.\n\nMaybe this needs to be a FIXME instead?","commit_id":"ad0e32f689ab87ce9981c34a93fc0fc82729b6cd"}]}