)]}'
{"etc/policy.v3cloudsample.json":[{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"475643e3e7ca555ceea6f80c7f3af650d44af39a","unresolved":false,"context_lines":[{"line_number":32,"context_line":"    \"identity:list_registered_limits\": \"\","},{"line_number":33,"context_line":"    \"identity:create_registered_limits\": \"rule:admin_required\","},{"line_number":34,"context_line":"    \"identity:update_registered_limits\": \"rule:admin_required\","},{"line_number":35,"context_line":"    \"identity:delete_registered_limit\": \"rule:admin_required\","},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"    \"identity:get_limit\": \"\","},{"line_number":38,"context_line":"    \"identity:list_limits\": \"\","}],"source_content_type":"application/json","patch_set":25,"id":"7f96bb07_0b253eab","line":35,"updated":"2018-01-23 20:49:44.000000000","message":"In the context of this file it might be better for these three to be rule:cloud_admin","commit_id":"e8ba3ddb97d0c42c4d97c36f5d4901ec769b9200"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d22acad50b29227a7ccf77708ee8d95e7186ba6f","unresolved":false,"context_lines":[{"line_number":32,"context_line":"    \"identity:list_registered_limits\": \"\","},{"line_number":33,"context_line":"    \"identity:create_registered_limits\": \"rule:admin_required\","},{"line_number":34,"context_line":"    \"identity:update_registered_limits\": \"rule:admin_required\","},{"line_number":35,"context_line":"    \"identity:delete_registered_limit\": \"rule:admin_required\","},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"    \"identity:get_limit\": \"\","},{"line_number":38,"context_line":"    \"identity:list_limits\": \"\","}],"source_content_type":"application/json","patch_set":25,"id":"7f96bb07_8b6ceb36","line":35,"in_reply_to":"7f96bb07_0b253eab","updated":"2018-01-23 23:21:59.000000000","message":"++","commit_id":"e8ba3ddb97d0c42c4d97c36f5d4901ec769b9200"}],"keystone/common/policies/limit.py":[{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"65e0d782c9876465b1b3d35d06a493a26c54a4f7","unresolved":false,"context_lines":[{"line_number":18,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":19,"context_line":"        name\u003dbase.IDENTITY % \u0027get_limit\u0027,"},{"line_number":20,"context_line":"        check_str\u003d\u0027\u0027,"},{"line_number":21,"context_line":"        # Getting a single limit or listing all limits should be information"},{"line_number":22,"context_line":"        # accessible to everyone. By setting scope_types\u003d[\u0027system\u0027, \u0027project\u0027]"},{"line_number":23,"context_line":"        # we\u0027re making it so that anyone with a role on the system or a project"},{"line_number":24,"context_line":"        # can obtain this information.  Making changes to a limit should be"},{"line_number":25,"context_line":"        # considered a protected system-level API, as noted below with"}],"source_content_type":"text/x-python","patch_set":22,"id":"7f96bb07_b7d636c3","line":22,"range":{"start_line":21,"start_character":10,"end_line":22,"end_character":33},"updated":"2018-01-21 21:59:01.000000000","message":"Limits apply only to projects. Is it true that I should be able to get a limit for a project I have no role assignment on?","commit_id":"1744891122f8bd1c2cdadf0517903c8c770cc61c"},{"author":{"_account_id":15054,"name":"wangxiyuan","email":"wangxiyuan1007@gmail.com","username":"wangxiyuan"},"change_message_id":"f757a0bb29d3ef7e5d31f676f7f82224cbb0c9ff","unresolved":false,"context_lines":[{"line_number":18,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":19,"context_line":"        name\u003dbase.IDENTITY % \u0027get_limit\u0027,"},{"line_number":20,"context_line":"        check_str\u003d\u0027\u0027,"},{"line_number":21,"context_line":"        # Getting a single limit or listing all limits should be information"},{"line_number":22,"context_line":"        # accessible to everyone. By setting scope_types\u003d[\u0027system\u0027, \u0027project\u0027]"},{"line_number":23,"context_line":"        # we\u0027re making it so that anyone with a role on the system or a project"},{"line_number":24,"context_line":"        # can obtain this information.  Making changes to a limit should be"},{"line_number":25,"context_line":"        # considered a protected system-level API, as noted below with"}],"source_content_type":"text/x-python","patch_set":22,"id":"7f96bb07_9853ffe2","line":22,"range":{"start_line":21,"start_character":10,"end_line":22,"end_character":33},"in_reply_to":"7f96bb07_509fa7b3","updated":"2018-01-23 07:37:39.000000000","message":"Yes, the project limit api only open to the one who has role in the related project. So I added a check in the controller:\nhttps://review.openstack.org/#/c/524110/46/keystone/limit/controllers.py@117\nIf the request is project scoped, the project must match the limit\u0027s.","commit_id":"1744891122f8bd1c2cdadf0517903c8c770cc61c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ace46e4be847f3fedb086f1dd11d2a59ce97eead","unresolved":false,"context_lines":[{"line_number":18,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":19,"context_line":"        name\u003dbase.IDENTITY % \u0027get_limit\u0027,"},{"line_number":20,"context_line":"        check_str\u003d\u0027\u0027,"},{"line_number":21,"context_line":"        # Getting a single limit or listing all limits should be information"},{"line_number":22,"context_line":"        # accessible to everyone. By setting scope_types\u003d[\u0027system\u0027, \u0027project\u0027]"},{"line_number":23,"context_line":"        # we\u0027re making it so that anyone with a role on the system or a project"},{"line_number":24,"context_line":"        # can obtain this information.  Making changes to a limit should be"},{"line_number":25,"context_line":"        # considered a protected system-level API, as noted below with"}],"source_content_type":"text/x-python","patch_set":22,"id":"7f96bb07_509fa7b3","line":22,"range":{"start_line":21,"start_character":10,"end_line":22,"end_character":33},"in_reply_to":"7f96bb07_b7d636c3","updated":"2018-01-22 15:12:32.000000000","message":"Good question - this should include the difference between a registered limit and a project limit. Project limits should be discoverable to people who have role assignments on the projects, and no one else I believe. Registered limits should be discoverable by anyone so long as they have a valid token.\n\nI can follow up with XiYuan about this.","commit_id":"1744891122f8bd1c2cdadf0517903c8c770cc61c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f6220b2c92bb2e5a7fdc4d59f64c629c2580b8a0","unresolved":false,"context_lines":[{"line_number":23,"context_line":"        # we\u0027re making it so that anyone with a role on the system or a project"},{"line_number":24,"context_line":"        # can obtain this information.  Making changes to a limit should be"},{"line_number":25,"context_line":"        # considered a protected system-level API, as noted below with"},{"line_number":26,"context_line":"        # scope_types\u003d[\u0027system\u0027]."},{"line_number":27,"context_line":"        scope_types\u003d[\u0027system\u0027, \u0027project\u0027],"},{"line_number":28,"context_line":"        description\u003d\u0027Show limit details.\u0027,"},{"line_number":29,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027/v3/limits/{limit_id}\u0027,"}],"source_content_type":"text/x-python","patch_set":25,"id":"7f96bb07_2b4fd792","line":26,"updated":"2018-01-23 23:30:18.000000000","message":"This might need to be adjusted a little bit. These limits are specific to projects, so if a project scoped token is used to access this API, we should make sure the project associated with the limit matches the scope of the project in the token.\n\nOtherwise it will be possible for people to query limit information for projects they don\u0027t have access to.\n\nIf we keep the same check_str, then that means anyone with a role on the system (reader, writer, admin, etc..) will be able to get any project limit. Do we think that\u0027s OK?","commit_id":"e8ba3ddb97d0c42c4d97c36f5d4901ec769b9200"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f6220b2c92bb2e5a7fdc4d59f64c629c2580b8a0","unresolved":false,"context_lines":[{"line_number":33,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":34,"context_line":"        name\u003dbase.IDENTITY % \u0027list_limits\u0027,"},{"line_number":35,"context_line":"        check_str\u003d\u0027\u0027,"},{"line_number":36,"context_line":"        scope_types\u003d[\u0027system\u0027, \u0027project\u0027],"},{"line_number":37,"context_line":"        description\u003d\u0027List limits.\u0027,"},{"line_number":38,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027/v3/limits\u0027,"},{"line_number":39,"context_line":"                     \u0027method\u0027: \u0027GET\u0027},"}],"source_content_type":"text/x-python","patch_set":25,"id":"7f96bb07_cb451372","line":36,"updated":"2018-01-23 23:30:18.000000000","message":"Same concerns here as above.","commit_id":"e8ba3ddb97d0c42c4d97c36f5d4901ec769b9200"}]}