)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"87d921e284c68cfa9a0ffae3f553628c75f7c635","unresolved":false,"context_lines":[{"line_number":12,"context_line":"keystone.common.authorization."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"This patch lays the plumbing for bp client-ssl-certificate-authorization."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Change-Id: Icee58a5bd47b0ded3b53a8838012864c1c0abcc5"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":7,"id":"AAAAUH%2F%2F%2BaE%3D","line":15,"updated":"2014-01-05 23:59:32.000000000","message":"I think this requires a DocImpact, to describe what\u0027s required to be in the keystone-paste.ini, and also what you can do with overriding the token in the request context.","commit_id":"7294b21c4a14b6c2797e6943807082aad46264a7"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"3cf0c74ac722f2ec36799a57c927a6c606c24a38","unresolved":false,"context_lines":[{"line_number":13,"context_line":""},{"line_number":14,"context_line":"This patch lays the plumbing for bp client-ssl-certificate-authorization."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"DocImpact"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Change-Id: Icee58a5bd47b0ded3b53a8838012864c1c0abcc5"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":9,"id":"AAAAUH%2F%2F3IM%3D","line":16,"updated":"2014-01-07 15:44:14.000000000","message":"I think we need to explain more what the DocImpact is, since the bp doesn\u0027t say.\n\n - new build_auth_context middleware is added to the paste pipeline that does (whatever)\n\nIs the middleware optional or required?","commit_id":"15d8a2b913977523f5b8594d91a9cfeddc05f15c"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"064217255d9f1777fe90c5e1f7396dc73df76e1e","unresolved":false,"context_lines":[{"line_number":13,"context_line":""},{"line_number":14,"context_line":"This patch lays the plumbing for bp client-ssl-certificate-authorization."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"DocImpact"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Change-Id: Icee58a5bd47b0ded3b53a8838012864c1c0abcc5"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":9,"id":"AAAAUH%2F%2F1SY%3D","line":16,"in_reply_to":"AAAAUH%2F%2F3IM%3D","updated":"2014-01-15 01:02:57.000000000","message":"yes, its required. I\u0027ll add more description.","commit_id":"15d8a2b913977523f5b8594d91a9cfeddc05f15c"}],"etc/keystone-paste.ini":[{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"ac2df60c41f65ea77b3f180c70e4a0f80087a03c","unresolved":false,"context_lines":[{"line_number":4,"context_line":"paste.filter_factory \u003d keystone.common.wsgi:Debug.factory"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"[filter:build_auth_context]"},{"line_number":7,"context_line":"paste.filter_factory \u003d keystone.middleware:BuildAuthContextFromAuthToken.factory"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"[filter:token_auth]"},{"line_number":10,"context_line":"paste.filter_factory \u003d keystone.middleware:TokenAuthMiddleware.factory"}],"source_content_type":"text/x-properties","patch_set":1,"id":"AAAATn%2F%2FFJk%3D","line":7,"updated":"2013-11-14 16:59:33.000000000","message":"AuthContextMiddleware  would be clearer","commit_id":"05d197d3fad3c4b1f114aa54edb40b11c25f50c5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"87d921e284c68cfa9a0ffae3f553628c75f7c635","unresolved":false,"context_lines":[{"line_number":61,"context_line":"paste.app_factory \u003d keystone.service:admin_app_factory"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"[pipeline:public_api]"},{"line_number":64,"context_line":"pipeline \u003d access_log sizelimit url_normalize build_auth_context token_auth admin_token_auth xml_body json_body ec2_extension user_crud_extension public_service"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"[pipeline:admin_api]"},{"line_number":67,"context_line":"pipeline \u003d access_log sizelimit url_normalize build_auth_context token_auth admin_token_auth xml_body json_body ec2_extension s3_extension crud_extension admin_service"}],"source_content_type":"text/x-properties","patch_set":7,"id":"AAAAUH%2F%2F%2BaM%3D","line":64,"updated":"2014-01-05 23:59:32.000000000","message":"why is build_auth_context before admin_token_auth? the code in AuthContextMiddleware could use context[\u0027is_admin\u0027] if build_auth_context was after admin_token.","commit_id":"7294b21c4a14b6c2797e6943807082aad46264a7"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e1b2ed766dabc8bb049a78d04176fc9aa87f6bee","unresolved":false,"context_lines":[{"line_number":61,"context_line":"paste.app_factory \u003d keystone.service:admin_app_factory"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"[pipeline:public_api]"},{"line_number":64,"context_line":"pipeline \u003d access_log sizelimit url_normalize build_auth_context token_auth admin_token_auth xml_body json_body ec2_extension user_crud_extension public_service"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"[pipeline:admin_api]"},{"line_number":67,"context_line":"pipeline \u003d access_log sizelimit url_normalize build_auth_context token_auth admin_token_auth xml_body json_body ec2_extension s3_extension crud_extension admin_service"}],"source_content_type":"text/x-properties","patch_set":7,"id":"AAAAUH%2F%2F7E8%3D","line":64,"in_reply_to":"AAAAUH%2F%2F%2BaM%3D","updated":"2014-01-06 18:35:40.000000000","message":"I want to make build_auth_context as independent as possible.","commit_id":"7294b21c4a14b6c2797e6943807082aad46264a7"}],"keystone/common/authorization.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"87d921e284c68cfa9a0ffae3f553628c75f7c635","unresolved":false,"context_lines":[{"line_number":26,"context_line":"from keystone import exception"},{"line_number":27,"context_line":"from keystone.openstack.common import log as logging"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"# Environment variable used to convey the Keystone auth context"},{"line_number":30,"context_line":"AUTH_CONTEXT_ENV \u003d \u0027KEYSTONE_AUTH_CONTEXT\u0027"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"LOG \u003d logging.getLogger(__name__)"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAUH%2F%2F%2BZs%3D","line":29,"updated":"2014-01-05 23:59:32.000000000","message":"what is an auth context, please add more info to the comment.","commit_id":"7294b21c4a14b6c2797e6943807082aad46264a7"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e1b2ed766dabc8bb049a78d04176fc9aa87f6bee","unresolved":false,"context_lines":[{"line_number":26,"context_line":"from keystone import exception"},{"line_number":27,"context_line":"from keystone.openstack.common import log as logging"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"# Environment variable used to convey the Keystone auth context"},{"line_number":30,"context_line":"AUTH_CONTEXT_ENV \u003d \u0027KEYSTONE_AUTH_CONTEXT\u0027"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"LOG \u003d logging.getLogger(__name__)"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAUH%2F%2F7HE%3D","line":29,"in_reply_to":"AAAAUH%2F%2F%2BZs%3D","updated":"2014-01-06 18:35:40.000000000","message":"will do","commit_id":"7294b21c4a14b6c2797e6943807082aad46264a7"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"87d921e284c68cfa9a0ffae3f553628c75f7c635","unresolved":false,"context_lines":[{"line_number":33,"context_line":"CONF \u003d config.CONF"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"def build_policy_check_credentials(self, context):"},{"line_number":37,"context_line":"    try:"},{"line_number":38,"context_line":"        token_ref \u003d self.token_api.get_token(context.get(\u0027token_id\u0027))"},{"line_number":39,"context_line":"    except exception.TokenNotFound:"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAUH%2F%2F%2BZQ%3D","line":36,"updated":"2014-01-05 23:59:32.000000000","message":"a docstring would be helpful.\n\nAlso, would prefer it if a function not in a class didn\u0027t use \"self\" as an argument. Maybe this should be in a class. Or pass in token_api and assignment_api in arguments.","commit_id":"7294b21c4a14b6c2797e6943807082aad46264a7"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e1b2ed766dabc8bb049a78d04176fc9aa87f6bee","unresolved":false,"context_lines":[{"line_number":33,"context_line":"CONF \u003d config.CONF"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"def build_policy_check_credentials(self, context):"},{"line_number":37,"context_line":"    try:"},{"line_number":38,"context_line":"        token_ref \u003d self.token_api.get_token(context.get(\u0027token_id\u0027))"},{"line_number":39,"context_line":"    except exception.TokenNotFound:"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAUH%2F%2F7G0%3D","line":36,"in_reply_to":"AAAAUH%2F%2F%2BZQ%3D","updated":"2014-01-06 18:35:40.000000000","message":"I will remove \"self\" and ask caller to explicitly pass in \"token_api\" and \"assignment_api\".","commit_id":"7294b21c4a14b6c2797e6943807082aad46264a7"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"87d921e284c68cfa9a0ffae3f553628c75f7c635","unresolved":false,"context_lines":[{"line_number":37,"context_line":"    try:"},{"line_number":38,"context_line":"        token_ref \u003d self.token_api.get_token(context.get(\u0027token_id\u0027))"},{"line_number":39,"context_line":"    except exception.TokenNotFound:"},{"line_number":40,"context_line":"        LOG.warning(_(\u0027RBAC: Invalid token\u0027))"},{"line_number":41,"context_line":"        raise exception.Unauthorized()"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"    # NOTE(jamielennox): whilst this maybe shouldn\u0027t be within this function"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAUH%2F%2F%2BZo%3D","line":40,"updated":"2014-01-05 23:59:32.000000000","message":"why RBAC on all these logs message? the log message can already be prefixed with the module name","commit_id":"7294b21c4a14b6c2797e6943807082aad46264a7"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e1b2ed766dabc8bb049a78d04176fc9aa87f6bee","unresolved":false,"context_lines":[{"line_number":37,"context_line":"    try:"},{"line_number":38,"context_line":"        token_ref \u003d self.token_api.get_token(context.get(\u0027token_id\u0027))"},{"line_number":39,"context_line":"    except exception.TokenNotFound:"},{"line_number":40,"context_line":"        LOG.warning(_(\u0027RBAC: Invalid token\u0027))"},{"line_number":41,"context_line":"        raise exception.Unauthorized()"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"    # NOTE(jamielennox): whilst this maybe shouldn\u0027t be within this function"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAUH%2F%2F7GQ%3D","line":40,"in_reply_to":"AAAAUH%2F%2F%2BZo%3D","updated":"2014-01-06 18:35:40.000000000","message":"I am retaining the original impl so it won\u0027t break the existing log filters.","commit_id":"7294b21c4a14b6c2797e6943807082aad46264a7"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"87d921e284c68cfa9a0ffae3f553628c75f7c635","unresolved":false,"context_lines":[{"line_number":51,"context_line":"        try:"},{"line_number":52,"context_line":"            creds[\u0027user_id\u0027] \u003d token_data[\u0027user\u0027][\u0027id\u0027]"},{"line_number":53,"context_line":"        except AttributeError:"},{"line_number":54,"context_line":"            LOG.warning(_(\u0027RBAC: Invalid user\u0027))"},{"line_number":55,"context_line":"            raise exception.Unauthorized()"},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"        if \u0027project\u0027 in token_data:"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAUH%2F%2F%2BZU%3D","line":54,"updated":"2014-01-05 23:59:32.000000000","message":"shouldn\u0027t this say that the request was invalid?","commit_id":"7294b21c4a14b6c2797e6943807082aad46264a7"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"3cf0c74ac722f2ec36799a57c927a6c606c24a38","unresolved":false,"context_lines":[{"line_number":26,"context_line":"from keystone import exception"},{"line_number":27,"context_line":"from keystone.openstack.common import log as logging"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"# Environment variable used to convey the Keystone auth context. Auth context"},{"line_number":30,"context_line":"# is essentially the user credential used for policy enforcement. It is a"},{"line_number":31,"context_line":"# dictionary with the following attributes."},{"line_number":32,"context_line":"#"}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAAUH%2F%2F3BU%3D","line":29,"updated":"2014-01-07 15:44:14.000000000","message":"would it be easier if the auth context was the same format as a v3 token?","commit_id":"15d8a2b913977523f5b8594d91a9cfeddc05f15c"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"064217255d9f1777fe90c5e1f7396dc73df76e1e","unresolved":false,"context_lines":[{"line_number":26,"context_line":"from keystone import exception"},{"line_number":27,"context_line":"from keystone.openstack.common import log as logging"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"# Environment variable used to convey the Keystone auth context. Auth context"},{"line_number":30,"context_line":"# is essentially the user credential used for policy enforcement. It is a"},{"line_number":31,"context_line":"# dictionary with the following attributes."},{"line_number":32,"context_line":"#"}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAAUH%2F%2F1SQ%3D","line":29,"in_reply_to":"AAAAUH%2F%2F3BU%3D","updated":"2014-01-15 01:02:57.000000000","message":"agreed. Moreover, we need to abstract the auth token itself. Its on the todo list for future enhancements.","commit_id":"15d8a2b913977523f5b8594d91a9cfeddc05f15c"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"12cc2eb1bc947946327c0e37bb0cd1a2bacba469","unresolved":false,"context_lines":[{"line_number":32,"context_line":"#"},{"line_number":33,"context_line":"# user_id: user ID of the principal"},{"line_number":34,"context_line":"# project_id: project ID of the scoped project if auth is project-scoped"},{"line_number":35,"context_line":"# domain_id: domain ID of the scoped domain if auth is domain-scoped"},{"line_number":36,"context_line":"# roles: list of role names for the given scope"},{"line_number":37,"context_line":"#"},{"line_number":38,"context_line":"AUTH_CONTEXT_ENV \u003d \u0027KEYSTONE_AUTH_CONTEXT\u0027"}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAAUH%2F%2Fl4g%3D","line":35,"updated":"2014-01-10 17:43:20.000000000","message":"are the _name attributes available? it\u0027d be nice to eliminate lookups where possible","commit_id":"15d8a2b913977523f5b8594d91a9cfeddc05f15c"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"064217255d9f1777fe90c5e1f7396dc73df76e1e","unresolved":false,"context_lines":[{"line_number":32,"context_line":"#"},{"line_number":33,"context_line":"# user_id: user ID of the principal"},{"line_number":34,"context_line":"# project_id: project ID of the scoped project if auth is project-scoped"},{"line_number":35,"context_line":"# domain_id: domain ID of the scoped domain if auth is domain-scoped"},{"line_number":36,"context_line":"# roles: list of role names for the given scope"},{"line_number":37,"context_line":"#"},{"line_number":38,"context_line":"AUTH_CONTEXT_ENV \u003d \u0027KEYSTONE_AUTH_CONTEXT\u0027"}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAAUH%2F%2FVR0%3D","line":35,"in_reply_to":"AAAAUH%2F%2Fl4g%3D","updated":"2014-01-15 01:02:57.000000000","message":"_name attributes are currently not populated. But I agree, we should. Will file an enhancement bug.","commit_id":"15d8a2b913977523f5b8594d91a9cfeddc05f15c"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"3cf0c74ac722f2ec36799a57c927a6c606c24a38","unresolved":false,"context_lines":[{"line_number":33,"context_line":"# user_id: user ID of the principal"},{"line_number":34,"context_line":"# project_id: project ID of the scoped project if auth is project-scoped"},{"line_number":35,"context_line":"# domain_id: domain ID of the scoped domain if auth is domain-scoped"},{"line_number":36,"context_line":"# roles: list of role names for the given scope"},{"line_number":37,"context_line":"#"},{"line_number":38,"context_line":"AUTH_CONTEXT_ENV \u003d \u0027KEYSTONE_AUTH_CONTEXT\u0027"},{"line_number":39,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAAUH%2F%2F3Co%3D","line":36,"updated":"2014-01-07 15:44:14.000000000","message":"should add \"(optional)\", since this may not be present -- see line 70.","commit_id":"15d8a2b913977523f5b8594d91a9cfeddc05f15c"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"12cc2eb1bc947946327c0e37bb0cd1a2bacba469","unresolved":false,"context_lines":[{"line_number":50,"context_line":""},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"def is_v3_token(token_ref):"},{"line_number":53,"context_line":"    return \u0027token_data\u0027 in token_ref and \u0027token\u0027 in token_ref[\u0027token_data\u0027]"},{"line_number":54,"context_line":""},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"def normalize_v3_token(token_ref):"}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAAUH%2F%2Fl4Y%3D","line":53,"updated":"2014-01-10 17:43:20.000000000","message":"how about a comment explaining why this is representative of a v3 token?","commit_id":"15d8a2b913977523f5b8594d91a9cfeddc05f15c"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"064217255d9f1777fe90c5e1f7396dc73df76e1e","unresolved":false,"context_lines":[{"line_number":50,"context_line":""},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"def is_v3_token(token_ref):"},{"line_number":53,"context_line":"    return \u0027token_data\u0027 in token_ref and \u0027token\u0027 in token_ref[\u0027token_data\u0027]"},{"line_number":54,"context_line":""},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"def normalize_v3_token(token_ref):"}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAAUH%2F%2FVP8%3D","line":53,"in_reply_to":"AAAAUH%2F%2Fl4Y%3D","updated":"2014-01-15 01:02:57.000000000","message":"sure","commit_id":"15d8a2b913977523f5b8594d91a9cfeddc05f15c"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"12cc2eb1bc947946327c0e37bb0cd1a2bacba469","unresolved":false,"context_lines":[{"line_number":57,"context_line":"    creds \u003d {}"},{"line_number":58,"context_line":"    token_data \u003d token_ref[\u0027token_data\u0027][\u0027token\u0027]"},{"line_number":59,"context_line":"    try:"},{"line_number":60,"context_line":"        creds[\u0027user_id\u0027] \u003d token_data[\u0027user\u0027][\u0027id\u0027]"},{"line_number":61,"context_line":"    except AttributeError:"},{"line_number":62,"context_line":"        LOG.warning(_(\u0027RBAC: Invalid user\u0027))"},{"line_number":63,"context_line":"        raise exception.Unauthorized()"}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAAUH%2F%2FsNU%3D","line":60,"updated":"2014-01-10 17:43:20.000000000","message":"where does keystone need to care about the user_id? just password changes?","commit_id":"15d8a2b913977523f5b8594d91a9cfeddc05f15c"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"064217255d9f1777fe90c5e1f7396dc73df76e1e","unresolved":false,"context_lines":[{"line_number":57,"context_line":"    creds \u003d {}"},{"line_number":58,"context_line":"    token_data \u003d token_ref[\u0027token_data\u0027][\u0027token\u0027]"},{"line_number":59,"context_line":"    try:"},{"line_number":60,"context_line":"        creds[\u0027user_id\u0027] \u003d token_data[\u0027user\u0027][\u0027id\u0027]"},{"line_number":61,"context_line":"    except AttributeError:"},{"line_number":62,"context_line":"        LOG.warning(_(\u0027RBAC: Invalid user\u0027))"},{"line_number":63,"context_line":"        raise exception.Unauthorized()"}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAAUH%2F%2FVQU%3D","line":60,"in_reply_to":"AAAAUH%2F%2FsNU%3D","updated":"2014-01-15 01:02:57.000000000","message":"Probably. Looks like create_trust is using it too, according to policy.json\n\n\"identity:create_trust\": [[\"user_id:%(trust.trustor_user_id)s\"]],","commit_id":"15d8a2b913977523f5b8594d91a9cfeddc05f15c"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"3cf0c74ac722f2ec36799a57c927a6c606c24a38","unresolved":false,"context_lines":[{"line_number":59,"context_line":"    try:"},{"line_number":60,"context_line":"        creds[\u0027user_id\u0027] \u003d token_data[\u0027user\u0027][\u0027id\u0027]"},{"line_number":61,"context_line":"    except AttributeError:"},{"line_number":62,"context_line":"        LOG.warning(_(\u0027RBAC: Invalid user\u0027))"},{"line_number":63,"context_line":"        raise exception.Unauthorized()"},{"line_number":64,"context_line":"    if \u0027project\u0027 in token_data:"},{"line_number":65,"context_line":"        creds[\u0027project_id\u0027] \u003d token_data[\u0027project\u0027][\u0027id\u0027]"}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAAUH%2F%2F3FE%3D","line":62,"updated":"2014-01-07 15:44:14.000000000","message":"suggest change to \u0027Invalid user data in v3 token\u0027","commit_id":"15d8a2b913977523f5b8594d91a9cfeddc05f15c"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"3cf0c74ac722f2ec36799a57c927a6c606c24a38","unresolved":false,"context_lines":[{"line_number":67,"context_line":"        LOG.debug(_(\u0027RBAC: Proceeding without project\u0027))"},{"line_number":68,"context_line":"    if \u0027domain\u0027 in token_data:"},{"line_number":69,"context_line":"        creds[\u0027domain_id\u0027] \u003d token_data[\u0027domain\u0027][\u0027id\u0027]"},{"line_number":70,"context_line":"    if \u0027roles\u0027 in token_data:"},{"line_number":71,"context_line":"        creds[\u0027roles\u0027] \u003d []"},{"line_number":72,"context_line":"        for role in token_data[\u0027roles\u0027]:"},{"line_number":73,"context_line":"            creds[\u0027roles\u0027].append(role[\u0027name\u0027])"}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAAUH%2F%2F3C8%3D","line":70,"updated":"2014-01-07 15:44:14.000000000","message":"you can get a token without any roles?\n\nSeems like it would make things easier if always set \u0027roles\u0027 in creds.","commit_id":"15d8a2b913977523f5b8594d91a9cfeddc05f15c"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"064217255d9f1777fe90c5e1f7396dc73df76e1e","unresolved":false,"context_lines":[{"line_number":67,"context_line":"        LOG.debug(_(\u0027RBAC: Proceeding without project\u0027))"},{"line_number":68,"context_line":"    if \u0027domain\u0027 in token_data:"},{"line_number":69,"context_line":"        creds[\u0027domain_id\u0027] \u003d token_data[\u0027domain\u0027][\u0027id\u0027]"},{"line_number":70,"context_line":"    if \u0027roles\u0027 in token_data:"},{"line_number":71,"context_line":"        creds[\u0027roles\u0027] \u003d []"},{"line_number":72,"context_line":"        for role in token_data[\u0027roles\u0027]:"},{"line_number":73,"context_line":"            creds[\u0027roles\u0027].append(role[\u0027name\u0027])"}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAAUH%2F%2F1PM%3D","line":70,"in_reply_to":"AAAAUH%2F%2F3C8%3D","updated":"2014-01-15 01:02:57.000000000","message":"Yes. Unscoped (Keystone-scoped) tokens may not have any roles.","commit_id":"15d8a2b913977523f5b8594d91a9cfeddc05f15c"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"12cc2eb1bc947946327c0e37bb0cd1a2bacba469","unresolved":false,"context_lines":[{"line_number":67,"context_line":"        LOG.debug(_(\u0027RBAC: Proceeding without project\u0027))"},{"line_number":68,"context_line":"    if \u0027domain\u0027 in token_data:"},{"line_number":69,"context_line":"        creds[\u0027domain_id\u0027] \u003d token_data[\u0027domain\u0027][\u0027id\u0027]"},{"line_number":70,"context_line":"    if \u0027roles\u0027 in token_data:"},{"line_number":71,"context_line":"        creds[\u0027roles\u0027] \u003d []"},{"line_number":72,"context_line":"        for role in token_data[\u0027roles\u0027]:"},{"line_number":73,"context_line":"            creds[\u0027roles\u0027].append(role[\u0027name\u0027])"}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAAUH%2F%2FsN0%3D","line":70,"in_reply_to":"AAAAUH%2F%2F3C8%3D","updated":"2014-01-10 17:43:20.000000000","message":"creds[\u0027roles\u0027] \u003d [r[\u0027name\u0027] for r in token_data.get(\u0027roles\u0027, [])]","commit_id":"15d8a2b913977523f5b8594d91a9cfeddc05f15c"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"12cc2eb1bc947946327c0e37bb0cd1a2bacba469","unresolved":false,"context_lines":[{"line_number":74,"context_line":"    return creds"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"def normalize_v2_token(token_ref, role_dict):"},{"line_number":78,"context_line":"    creds \u003d {}"},{"line_number":79,"context_line":"    creds \u003d token_ref.get(\u0027metadata\u0027, {}).copy()"},{"line_number":80,"context_line":"    try:"}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAAUH%2F%2Fl4U%3D","line":77,"updated":"2014-01-10 17:43:20.000000000","message":"normalize to what?","commit_id":"15d8a2b913977523f5b8594d91a9cfeddc05f15c"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"3cf0c74ac722f2ec36799a57c927a6c606c24a38","unresolved":false,"context_lines":[{"line_number":80,"context_line":"    try:"},{"line_number":81,"context_line":"        creds[\u0027user_id\u0027] \u003d token_ref[\u0027user\u0027].get(\u0027id\u0027)"},{"line_number":82,"context_line":"    except AttributeError:"},{"line_number":83,"context_line":"        LOG.warning(_(\u0027RBAC: Invalid user\u0027))"},{"line_number":84,"context_line":"        raise exception.Unauthorized()"},{"line_number":85,"context_line":"    try:"},{"line_number":86,"context_line":"        creds[\u0027project_id\u0027] \u003d token_ref[\u0027tenant\u0027].get(\u0027id\u0027)"}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAAUH%2F%2F3Eo%3D","line":83,"updated":"2014-01-07 15:44:14.000000000","message":"suggest change to \u0027Invalid user data in v2 token\u0027","commit_id":"15d8a2b913977523f5b8594d91a9cfeddc05f15c"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"12cc2eb1bc947946327c0e37bb0cd1a2bacba469","unresolved":false,"context_lines":[{"line_number":85,"context_line":"    try:"},{"line_number":86,"context_line":"        creds[\u0027project_id\u0027] \u003d token_ref[\u0027tenant\u0027].get(\u0027id\u0027)"},{"line_number":87,"context_line":"    except AttributeError:"},{"line_number":88,"context_line":"        LOG.debug(_(\u0027RBAC: Proceeding without tenant\u0027))"},{"line_number":89,"context_line":"    creds[\u0027roles\u0027] \u003d [role_dict.get(role) for"},{"line_number":90,"context_line":"                      role in creds.get(\u0027roles\u0027, [])]"},{"line_number":91,"context_line":"    return creds"}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAAUH%2F%2Fl4Q%3D","line":88,"updated":"2014-01-10 17:43:20.000000000","message":"project","commit_id":"15d8a2b913977523f5b8594d91a9cfeddc05f15c"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"3cf0c74ac722f2ec36799a57c927a6c606c24a38","unresolved":false,"context_lines":[{"line_number":86,"context_line":"        creds[\u0027project_id\u0027] \u003d token_ref[\u0027tenant\u0027].get(\u0027id\u0027)"},{"line_number":87,"context_line":"    except AttributeError:"},{"line_number":88,"context_line":"        LOG.debug(_(\u0027RBAC: Proceeding without tenant\u0027))"},{"line_number":89,"context_line":"    creds[\u0027roles\u0027] \u003d [role_dict.get(role) for"},{"line_number":90,"context_line":"                      role in creds.get(\u0027roles\u0027, [])]"},{"line_number":91,"context_line":"    return creds"},{"line_number":92,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAAUH%2F%2F3AY%3D","line":89,"updated":"2014-01-07 15:44:14.000000000","message":"role_dict.get could be None, and it would probably be easier if there were no \"None\" roles in creds[\u0027roles\u0027], so suggest change this so skip any that aren\u0027t found instead.","commit_id":"15d8a2b913977523f5b8594d91a9cfeddc05f15c"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"3cf0c74ac722f2ec36799a57c927a6c606c24a38","unresolved":false,"context_lines":[{"line_number":87,"context_line":"    except AttributeError:"},{"line_number":88,"context_line":"        LOG.debug(_(\u0027RBAC: Proceeding without tenant\u0027))"},{"line_number":89,"context_line":"    creds[\u0027roles\u0027] \u003d [role_dict.get(role) for"},{"line_number":90,"context_line":"                      role in creds.get(\u0027roles\u0027, [])]"},{"line_number":91,"context_line":"    return creds"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAAUH%2F%2F3A0%3D","line":90,"updated":"2014-01-07 15:44:14.000000000","message":"I assume creds here should be token_ref -- needs unit test.","commit_id":"15d8a2b913977523f5b8594d91a9cfeddc05f15c"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"3cf0c74ac722f2ec36799a57c927a6c606c24a38","unresolved":false,"context_lines":[{"line_number":93,"context_line":""},{"line_number":94,"context_line":"def normalize_credentials(token_ref, role_dict):"},{"line_number":95,"context_line":"    if is_v3_token(token_ref):"},{"line_number":96,"context_line":"        creds \u003d normalize_v3_token(token_ref)"},{"line_number":97,"context_line":"    else:"},{"line_number":98,"context_line":"        creds \u003d normalize_v2_token(token_ref, role_dict)"},{"line_number":99,"context_line":"    return creds"}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAAUH%2F%2F3EU%3D","line":96,"updated":"2014-01-07 15:44:14.000000000","message":"seems like this should be \"v3_token_to_auth_context\" ... this is a conversion from token to auth_context, not normalizing.\n\nthen could change name of function \"normalize_credentials\" to \"token_to_auth_context\"","commit_id":"15d8a2b913977523f5b8594d91a9cfeddc05f15c"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"12cc2eb1bc947946327c0e37bb0cd1a2bacba469","unresolved":false,"context_lines":[{"line_number":93,"context_line":""},{"line_number":94,"context_line":"def normalize_credentials(token_ref, role_dict):"},{"line_number":95,"context_line":"    if is_v3_token(token_ref):"},{"line_number":96,"context_line":"        creds \u003d normalize_v3_token(token_ref)"},{"line_number":97,"context_line":"    else:"},{"line_number":98,"context_line":"        creds \u003d normalize_v2_token(token_ref, role_dict)"},{"line_number":99,"context_line":"    return creds"}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAAUH%2F%2Fl4M%3D","line":96,"in_reply_to":"AAAAUH%2F%2F3EU%3D","updated":"2014-01-10 17:43:20.000000000","message":"++","commit_id":"15d8a2b913977523f5b8594d91a9cfeddc05f15c"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"3cf0c74ac722f2ec36799a57c927a6c606c24a38","unresolved":false,"context_lines":[{"line_number":95,"context_line":"    if is_v3_token(token_ref):"},{"line_number":96,"context_line":"        creds \u003d normalize_v3_token(token_ref)"},{"line_number":97,"context_line":"    else:"},{"line_number":98,"context_line":"        creds \u003d normalize_v2_token(token_ref, role_dict)"},{"line_number":99,"context_line":"    return creds"},{"line_number":100,"context_line":""},{"line_number":101,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAAUH%2F%2F3EI%3D","line":98,"updated":"2014-01-07 15:44:14.000000000","message":"seems like this should be \"v2_token_to_auth_context\"","commit_id":"15d8a2b913977523f5b8594d91a9cfeddc05f15c"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"12cc2eb1bc947946327c0e37bb0cd1a2bacba469","unresolved":false,"context_lines":[{"line_number":95,"context_line":"    if is_v3_token(token_ref):"},{"line_number":96,"context_line":"        creds \u003d normalize_v3_token(token_ref)"},{"line_number":97,"context_line":"    else:"},{"line_number":98,"context_line":"        creds \u003d normalize_v2_token(token_ref, role_dict)"},{"line_number":99,"context_line":"    return creds"},{"line_number":100,"context_line":""},{"line_number":101,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAAUH%2F%2Fl4E%3D","line":98,"in_reply_to":"AAAAUH%2F%2F3EI%3D","updated":"2014-01-10 17:43:20.000000000","message":"++","commit_id":"15d8a2b913977523f5b8594d91a9cfeddc05f15c"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"3cf0c74ac722f2ec36799a57c927a6c606c24a38","unresolved":false,"context_lines":[{"line_number":113,"context_line":"    try:"},{"line_number":114,"context_line":"        token_ref \u003d token_api.get_token(context.get(\u0027token_id\u0027))"},{"line_number":115,"context_line":"    except exception.TokenNotFound:"},{"line_number":116,"context_line":"        LOG.warning(_(\u0027RBAC: Invalid token\u0027))"},{"line_number":117,"context_line":"        raise exception.Unauthorized()"},{"line_number":118,"context_line":"    role_dict \u003d role_id_to_name_map(assignment_api)"},{"line_number":119,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAAUH%2F%2F2%2F8%3D","line":116,"updated":"2014-01-07 15:44:14.000000000","message":"add some more info to this log since it\u0027s the same as all the other log messages...\n\n \"The token was not found, rejecting auth request.\"","commit_id":"15d8a2b913977523f5b8594d91a9cfeddc05f15c"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"3cf0c74ac722f2ec36799a57c927a6c606c24a38","unresolved":false,"context_lines":[{"line_number":121,"context_line":"    # it would otherwise need to reload the token_ref from backing store."},{"line_number":122,"context_line":"    wsgi.validate_token_bind(context, token_ref)"},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"    creds \u003d normalize_credentials(token_ref, role_dict)"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"    return creds"},{"line_number":127,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAAUH%2F%2F2%2Fo%3D","line":124,"updated":"2014-01-07 15:44:14.000000000","message":"since the docstring says \"returns auth context\", suggest call this variable \"auth_context\"","commit_id":"15d8a2b913977523f5b8594d91a9cfeddc05f15c"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"12cc2eb1bc947946327c0e37bb0cd1a2bacba469","unresolved":false,"context_lines":[{"line_number":121,"context_line":"    # it would otherwise need to reload the token_ref from backing store."},{"line_number":122,"context_line":"    wsgi.validate_token_bind(context, token_ref)"},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"    creds \u003d normalize_credentials(token_ref, role_dict)"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"    return creds"},{"line_number":127,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAAUH%2F%2FsMg%3D","line":124,"in_reply_to":"AAAAUH%2F%2F2%2Fo%3D","updated":"2014-01-10 17:43:20.000000000","message":"yeah, i really don\u0027t like this suddenly being called \"creds\" -- they\u0027re absolutely not authentication credentials. authorization context is much more correct.","commit_id":"15d8a2b913977523f5b8594d91a9cfeddc05f15c"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"3cf0c74ac722f2ec36799a57c927a6c606c24a38","unresolved":false,"context_lines":[{"line_number":136,"context_line":"        \u0027kwargs\u0027: \u0027, \u0027.join([\u0027%s\u003d%s\u0027 % (k, kwargs[k]) for k in kwargs])})"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"    if (\u0027environment\u0027 in context and"},{"line_number":139,"context_line":"            AUTH_CONTEXT_ENV in context[\u0027environment\u0027]):"},{"line_number":140,"context_line":"        return context[\u0027environment\u0027].get(AUTH_CONTEXT_ENV)"},{"line_number":141,"context_line":"    else:"},{"line_number":142,"context_line":"        # NOTE(gyee): if auth context in not found, that means we are in a"}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAAUH%2F%2F2%2Bk%3D","line":139,"updated":"2014-01-07 15:44:14.000000000","message":"could do \n\n AUTH_CONTEXT_ENV in context.get(\u0027environment\u0027, {})\n\nthen wouldn\u0027t need \"\u0027environment\u0027 in context and\"\n\nor, could do\n\n auth_context \u003d context.get(\u0027environment\u0027, {}).get(AUTH_CONTEXT_ENV)\n if auth_context:\n   LOG.debug(\u0027RBAC: Got auth context from environment. user_id\u003d%s\u0027, auth_context[\u0027user_id\u0027])\n   return auth_context\n\n ...","commit_id":"15d8a2b913977523f5b8594d91a9cfeddc05f15c"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"738d94d943e91a445a029e04fa2a8c435dcf659d","unresolved":false,"context_lines":[{"line_number":19,"context_line":"#    under the License."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"from keystone import exception"},{"line_number":22,"context_line":"from keystone.openstack.common import log as logging"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"# Environment variable used to convey the Keystone auth context. Auth context"},{"line_number":25,"context_line":"# is essentially the user credential used for policy enforcement. It is a"}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAUH%2F%2FJcU%3D","line":22,"updated":"2014-01-17 00:59:01.000000000","message":"use the standard way of import logging -- Morgan made this change a little while ago.\n\n from keystone.openstack.common import log","commit_id":"a4244ee26d27cc99807fca443179526204467571"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e768ef0e69ed12d1329878341d816791fd6d6cd4","unresolved":false,"context_lines":[{"line_number":19,"context_line":"#    under the License."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"from keystone import exception"},{"line_number":22,"context_line":"from keystone.openstack.common import log as logging"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"# Environment variable used to convey the Keystone auth context. Auth context"},{"line_number":25,"context_line":"# is essentially the user credential used for policy enforcement. It is a"}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAUH%2F%2FIXg%3D","line":22,"in_reply_to":"AAAAUH%2F%2FJcU%3D","updated":"2014-01-17 06:24:31.000000000","message":"done","commit_id":"a4244ee26d27cc99807fca443179526204467571"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"738d94d943e91a445a029e04fa2a8c435dcf659d","unresolved":false,"context_lines":[{"line_number":21,"context_line":"from keystone import exception"},{"line_number":22,"context_line":"from keystone.openstack.common import log as logging"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"# Environment variable used to convey the Keystone auth context. Auth context"},{"line_number":25,"context_line":"# is essentially the user credential used for policy enforcement. It is a"},{"line_number":26,"context_line":"# dictionary with the following attributes."},{"line_number":27,"context_line":"#"}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAUH%2F%2FJcI%3D","line":24,"updated":"2014-01-17 00:59:01.000000000","message":"would be nice if this was a DocString (move after variable name).","commit_id":"a4244ee26d27cc99807fca443179526204467571"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e768ef0e69ed12d1329878341d816791fd6d6cd4","unresolved":false,"context_lines":[{"line_number":21,"context_line":"from keystone import exception"},{"line_number":22,"context_line":"from keystone.openstack.common import log as logging"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"# Environment variable used to convey the Keystone auth context. Auth context"},{"line_number":25,"context_line":"# is essentially the user credential used for policy enforcement. It is a"},{"line_number":26,"context_line":"# dictionary with the following attributes."},{"line_number":27,"context_line":"#"}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAUH%2F%2FIXM%3D","line":24,"in_reply_to":"AAAAUH%2F%2FJcI%3D","updated":"2014-01-17 06:24:31.000000000","message":"done","commit_id":"a4244ee26d27cc99807fca443179526204467571"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"738d94d943e91a445a029e04fa2a8c435dcf659d","unresolved":false,"context_lines":[{"line_number":23,"context_line":""},{"line_number":24,"context_line":"# Environment variable used to convey the Keystone auth context. Auth context"},{"line_number":25,"context_line":"# is essentially the user credential used for policy enforcement. It is a"},{"line_number":26,"context_line":"# dictionary with the following attributes."},{"line_number":27,"context_line":"#"},{"line_number":28,"context_line":"# user_id: user ID of the principal"},{"line_number":29,"context_line":"# project_id (optional): project ID of the scoped project if auth is"}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAUH%2F%2FJcQ%3D","line":26,"updated":"2014-01-17 00:59:01.000000000","message":"(nit) change . to :","commit_id":"a4244ee26d27cc99807fca443179526204467571"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e768ef0e69ed12d1329878341d816791fd6d6cd4","unresolved":false,"context_lines":[{"line_number":23,"context_line":""},{"line_number":24,"context_line":"# Environment variable used to convey the Keystone auth context. Auth context"},{"line_number":25,"context_line":"# is essentially the user credential used for policy enforcement. It is a"},{"line_number":26,"context_line":"# dictionary with the following attributes."},{"line_number":27,"context_line":"#"},{"line_number":28,"context_line":"# user_id: user ID of the principal"},{"line_number":29,"context_line":"# project_id (optional): project ID of the scoped project if auth is"}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAUH%2F%2FIXI%3D","line":26,"in_reply_to":"AAAAUH%2F%2FJcQ%3D","updated":"2014-01-17 06:24:31.000000000","message":"done","commit_id":"a4244ee26d27cc99807fca443179526204467571"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"738d94d943e91a445a029e04fa2a8c435dcf659d","unresolved":false,"context_lines":[{"line_number":81,"context_line":"    return creds"},{"line_number":82,"context_line":""},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"def token_to_auth_context(token):"},{"line_number":85,"context_line":"    if is_v3_token(token):"},{"line_number":86,"context_line":"        creds \u003d v3_token_to_auth_context(token)"},{"line_number":87,"context_line":"    else:"}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAUH%2F%2FJbc%3D","line":84,"updated":"2014-01-17 00:59:01.000000000","message":"could do:\n\n  fn \u003d (v3_token_to_auth_context if is_v3_token(token)\n           else v2_token_to_auth_context)\n  return fn(token)\n\nto remove some duplication.","commit_id":"a4244ee26d27cc99807fca443179526204467571"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e768ef0e69ed12d1329878341d816791fd6d6cd4","unresolved":false,"context_lines":[{"line_number":81,"context_line":"    return creds"},{"line_number":82,"context_line":""},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"def token_to_auth_context(token):"},{"line_number":85,"context_line":"    if is_v3_token(token):"},{"line_number":86,"context_line":"        creds \u003d v3_token_to_auth_context(token)"},{"line_number":87,"context_line":"    else:"}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAUH%2F%2FIWs%3D","line":84,"in_reply_to":"AAAAUH%2F%2FJbc%3D","updated":"2014-01-17 06:24:31.000000000","message":"I prefer to keep the current format. Probably easier to read the code that way.","commit_id":"a4244ee26d27cc99807fca443179526204467571"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"b68c05825040bb38d80dbb87fcde6fd02fbeaa1b","unresolved":false,"context_lines":[{"line_number":68,"context_line":"    creds \u003d {}"},{"line_number":69,"context_line":"    token_data \u003d token[\u0027token\u0027]"},{"line_number":70,"context_line":"    try:"},{"line_number":71,"context_line":"        creds[\u0027user_id\u0027] \u003d token_data[\u0027user\u0027][\u0027id\u0027]"},{"line_number":72,"context_line":"    except AttributeError:"},{"line_number":73,"context_line":"        LOG.warning(_(\u0027RBAC: Invalid user data in v3 token\u0027))"},{"line_number":74,"context_line":"        raise exception.Unauthorized()"}],"source_content_type":"text/x-python","patch_set":16,"id":"AAAAUH%2F%2Bm%2FA%3D","line":71,"updated":"2014-01-23 22:18:01.000000000","message":"It will be useful to user_domain_id available as part of creds data as it can be used in policy enforcement","commit_id":"c8e4584a073dbedb37ddfb61fa4b00928b869fdb"}],"keystone/common/controller.py":[{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"ac2df60c41f65ea77b3f180c70e4a0f80087a03c","unresolved":false,"context_lines":[{"line_number":86,"context_line":"        \u0027action\u0027: action,"},{"line_number":87,"context_line":"        \u0027kwargs\u0027: \u0027, \u0027.join([\u0027%s\u003d%s\u0027 % (k, kwargs[k]) for k in kwargs])})"},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"    if (\u0027environment\u0027 in context and"},{"line_number":90,"context_line":"            wsgi.AUTH_CONTEXT_ENV in context[\u0027environment\u0027]):"},{"line_number":91,"context_line":"        return context[\u0027environment\u0027].get(wsgi.AUTH_CONTEXT_ENV)"},{"line_number":92,"context_line":"    else:"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAATn%2F%2FFKk%3D","line":89,"updated":"2013-11-14 16:59:33.000000000","message":"if environemnt is not in the context, it is a bug.  so please do just the second half of this check.\n\nThis really should be pulled out into middleware.  We have the admin_auth middleware that could be repurposed for this.","commit_id":"05d197d3fad3c4b1f114aa54edb40b11c25f50c5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"738d94d943e91a445a029e04fa2a8c435dcf659d","unresolved":false,"context_lines":[{"line_number":43,"context_line":""},{"line_number":44,"context_line":"    # see if auth context has already been created. If so use it."},{"line_number":45,"context_line":"    if (\u0027environment\u0027 in context and"},{"line_number":46,"context_line":"            authorization.AUTH_CONTEXT_ENV in context[\u0027environment\u0027]):"},{"line_number":47,"context_line":"        return context[\u0027environment\u0027].get(authorization.AUTH_CONTEXT_ENV)"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"    # now build the auth context from the incoming auth token"}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAUH%2F%2FJbQ%3D","line":46,"updated":"2014-01-17 00:59:01.000000000","message":"would be nice to have a log statement here saying that using auth_context from environment.","commit_id":"a4244ee26d27cc99807fca443179526204467571"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e768ef0e69ed12d1329878341d816791fd6d6cd4","unresolved":false,"context_lines":[{"line_number":43,"context_line":""},{"line_number":44,"context_line":"    # see if auth context has already been created. If so use it."},{"line_number":45,"context_line":"    if (\u0027environment\u0027 in context and"},{"line_number":46,"context_line":"            authorization.AUTH_CONTEXT_ENV in context[\u0027environment\u0027]):"},{"line_number":47,"context_line":"        return context[\u0027environment\u0027].get(authorization.AUTH_CONTEXT_ENV)"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"    # now build the auth context from the incoming auth token"}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAUH%2F%2FIVs%3D","line":46,"in_reply_to":"AAAAUH%2F%2FJbQ%3D","updated":"2014-01-17 06:24:31.000000000","message":"done","commit_id":"a4244ee26d27cc99807fca443179526204467571"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"738d94d943e91a445a029e04fa2a8c435dcf659d","unresolved":false,"context_lines":[{"line_number":46,"context_line":"            authorization.AUTH_CONTEXT_ENV in context[\u0027environment\u0027]):"},{"line_number":47,"context_line":"        return context[\u0027environment\u0027].get(authorization.AUTH_CONTEXT_ENV)"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"    # now build the auth context from the incoming auth token"},{"line_number":50,"context_line":"    try:"},{"line_number":51,"context_line":"        token_ref \u003d self.token_api.get_token(context[\u0027token_id\u0027])"},{"line_number":52,"context_line":"    except exception.TokenNotFound:"}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAUH%2F%2FJbE%3D","line":49,"updated":"2014-01-17 00:59:01.000000000","message":"would be nice to have this as a log statement rather than a comment.","commit_id":"a4244ee26d27cc99807fca443179526204467571"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e768ef0e69ed12d1329878341d816791fd6d6cd4","unresolved":false,"context_lines":[{"line_number":46,"context_line":"            authorization.AUTH_CONTEXT_ENV in context[\u0027environment\u0027]):"},{"line_number":47,"context_line":"        return context[\u0027environment\u0027].get(authorization.AUTH_CONTEXT_ENV)"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"    # now build the auth context from the incoming auth token"},{"line_number":50,"context_line":"    try:"},{"line_number":51,"context_line":"        token_ref \u003d self.token_api.get_token(context[\u0027token_id\u0027])"},{"line_number":52,"context_line":"    except exception.TokenNotFound:"}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAUH%2F%2FIVo%3D","line":49,"in_reply_to":"AAAAUH%2F%2FJbE%3D","updated":"2014-01-17 06:24:31.000000000","message":"done","commit_id":"a4244ee26d27cc99807fca443179526204467571"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"544195b0d50635facbca9737d163814f3995f1a0","unresolved":false,"context_lines":[{"line_number":44,"context_line":"    # see if auth context has already been created. If so use it."},{"line_number":45,"context_line":"    if (\u0027environment\u0027 in context and"},{"line_number":46,"context_line":"            authorization.AUTH_CONTEXT_ENV in context[\u0027environment\u0027]):"},{"line_number":47,"context_line":"        LOG.debug(\u0027RBAC: use auth context from the request environment\u0027)"},{"line_number":48,"context_line":"        return context[\u0027environment\u0027].get(authorization.AUTH_CONTEXT_ENV)"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"    # now build the auth context from the incoming auth token"}],"source_content_type":"text/x-python","patch_set":14,"id":"AAAAUH%2F%2FF%2BM%3D","line":47,"updated":"2014-01-17 14:33:38.000000000","message":"wrap string in _() for translation.\n\n(nit) change \"use\" to \"using\"","commit_id":"f9589107ce7473330ec91b6254a54d6784c9c384"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"31b446bbba938567d123a3f9d804b7272421b184","unresolved":false,"context_lines":[{"line_number":44,"context_line":"    # see if auth context has already been created. If so use it."},{"line_number":45,"context_line":"    if (\u0027environment\u0027 in context and"},{"line_number":46,"context_line":"            authorization.AUTH_CONTEXT_ENV in context[\u0027environment\u0027]):"},{"line_number":47,"context_line":"        LOG.debug(\u0027RBAC: use auth context from the request environment\u0027)"},{"line_number":48,"context_line":"        return context[\u0027environment\u0027].get(authorization.AUTH_CONTEXT_ENV)"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"    # now build the auth context from the incoming auth token"}],"source_content_type":"text/x-python","patch_set":14,"id":"AAAAUH%2F%2FE8A%3D","line":47,"in_reply_to":"AAAAUH%2F%2FF%2BM%3D","updated":"2014-01-17 16:58:49.000000000","message":"not sure if we are internationalizing debug message, but sure","commit_id":"f9589107ce7473330ec91b6254a54d6784c9c384"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"544195b0d50635facbca9737d163814f3995f1a0","unresolved":false,"context_lines":[{"line_number":49,"context_line":""},{"line_number":50,"context_line":"    # now build the auth context from the incoming auth token"},{"line_number":51,"context_line":"    try:"},{"line_number":52,"context_line":"        LOG.debug(\u0027RBAC: build auth context from the incoming auth token\u0027)"},{"line_number":53,"context_line":"        token_ref \u003d self.token_api.get_token(context[\u0027token_id\u0027])"},{"line_number":54,"context_line":"    except exception.TokenNotFound:"},{"line_number":55,"context_line":"        LOG.warning(_(\u0027RBAC: Invalid token\u0027))"}],"source_content_type":"text/x-python","patch_set":14,"id":"AAAAUH%2F%2FF%2BE%3D","line":52,"updated":"2014-01-17 14:33:38.000000000","message":"wrap string in _() for translation.\n\n(nit) change \"build\" to \"building\"","commit_id":"f9589107ce7473330ec91b6254a54d6784c9c384"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"31b446bbba938567d123a3f9d804b7272421b184","unresolved":false,"context_lines":[{"line_number":49,"context_line":""},{"line_number":50,"context_line":"    # now build the auth context from the incoming auth token"},{"line_number":51,"context_line":"    try:"},{"line_number":52,"context_line":"        LOG.debug(\u0027RBAC: build auth context from the incoming auth token\u0027)"},{"line_number":53,"context_line":"        token_ref \u003d self.token_api.get_token(context[\u0027token_id\u0027])"},{"line_number":54,"context_line":"    except exception.TokenNotFound:"},{"line_number":55,"context_line":"        LOG.warning(_(\u0027RBAC: Invalid token\u0027))"}],"source_content_type":"text/x-python","patch_set":14,"id":"AAAAUH%2F%2FE74%3D","line":52,"in_reply_to":"AAAAUH%2F%2FF%2BE%3D","updated":"2014-01-17 16:58:49.000000000","message":"done","commit_id":"f9589107ce7473330ec91b6254a54d6784c9c384"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"23cbd5123baa62d5f305340fada3960837ab3326","unresolved":false,"context_lines":[{"line_number":65,"context_line":"    return auth_context"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"def flatten(d, parent_key\u003d\u0027\u0027):"},{"line_number":69,"context_line":"    \"\"\"Flatten a nested dictionary"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"    Converts a dictionary with nested values to a single level flat"}],"source_content_type":"text/x-python","patch_set":15,"id":"AAAAUH%2F%2B8U0%3D","line":68,"updated":"2014-01-20 15:19:36.000000000","message":"The flatten method really needs to be part of the refactored code.  Without that, more complex policy using deeper values in the token can\u0027t be processed.  The logic is not policy or auth specific, but is certainly not part of the controller.  For now, keep it with authorization.py.","commit_id":"6a41630b67836d4f4a4857abf9c8794e8aba2d47"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"6d79a440e118e00d7c3c8c1dfdb3f96d833e9cd1","unresolved":false,"context_lines":[{"line_number":65,"context_line":"    return auth_context"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"def flatten(d, parent_key\u003d\u0027\u0027):"},{"line_number":69,"context_line":"    \"\"\"Flatten a nested dictionary"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"    Converts a dictionary with nested values to a single level flat"}],"source_content_type":"text/x-python","patch_set":15,"id":"AAAAUH%2F%2B4WI%3D","line":68,"in_reply_to":"AAAAUH%2F%2B8U0%3D","updated":"2014-01-21 06:04:45.000000000","message":"sure, I\u0027ll park it in authorization.py for now","commit_id":"6a41630b67836d4f4a4857abf9c8794e8aba2d47"}],"keystone/common/wsgi.py":[{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"ac2df60c41f65ea77b3f180c70e4a0f80087a03c","unresolved":false,"context_lines":[{"line_number":47,"context_line":""},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"# Environment variable used to convey the Keystone auth context"},{"line_number":50,"context_line":"AUTH_CONTEXT_ENV \u003d \u0027KEYSTONE_AUTH_CONTEXT\u0027"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"_RE_PASS \u003d re.compile(r\u0027([\\\u0027\"].*?password[\\\u0027\"]\\s*:\\s*u?[\\\u0027\"]).*?([\\\u0027\"])\u0027,"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAATn%2F%2FFKg%3D","line":50,"updated":"2013-11-14 16:59:33.000000000","message":"Let\u0027s not put anything more into this file.","commit_id":"05d197d3fad3c4b1f114aa54edb40b11c25f50c5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"738d94d943e91a445a029e04fa2a8c435dcf659d","unresolved":false,"context_lines":[{"line_number":330,"context_line":"        return _factory"},{"line_number":331,"context_line":""},{"line_number":332,"context_line":"    def __init__(self, application):"},{"line_number":333,"context_line":"        # NOTE(gyee): need this or otherwise dependency injection won\u0027t work"},{"line_number":334,"context_line":"        super(Middleware, self).__init__()"},{"line_number":335,"context_line":"        self.application \u003d application"},{"line_number":336,"context_line":""}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAUH%2F%2FJa4%3D","line":333,"updated":"2014-01-17 00:59:01.000000000","message":"suggest remove this comment since this is just how one typically uses OO in python. Also, Could make this change in a separate review.","commit_id":"a4244ee26d27cc99807fca443179526204467571"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e768ef0e69ed12d1329878341d816791fd6d6cd4","unresolved":false,"context_lines":[{"line_number":330,"context_line":"        return _factory"},{"line_number":331,"context_line":""},{"line_number":332,"context_line":"    def __init__(self, application):"},{"line_number":333,"context_line":"        # NOTE(gyee): need this or otherwise dependency injection won\u0027t work"},{"line_number":334,"context_line":"        super(Middleware, self).__init__()"},{"line_number":335,"context_line":"        self.application \u003d application"},{"line_number":336,"context_line":""}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAUH%2F%2FIN8%3D","line":333,"in_reply_to":"AAAAUH%2F%2FJa4%3D","updated":"2014-01-17 06:24:31.000000000","message":"comment removed. I prefer to keep the change in this patch as it is a a one line change. Not worth doing another patch.","commit_id":"a4244ee26d27cc99807fca443179526204467571"}],"keystone/middleware/core.py":[{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"ac2df60c41f65ea77b3f180c70e4a0f80087a03c","unresolved":false,"context_lines":[{"line_number":47,"context_line":""},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"# Environment variable used to convey the Keystone auth context"},{"line_number":50,"context_line":"AUTH_CONTEXT_ENV \u003d wsgi.AUTH_CONTEXT_ENV"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"class TokenAuthMiddleware(wsgi.Middleware):"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAATn%2F%2FFKY%3D","line":50,"updated":"2013-11-14 16:59:33.000000000","message":"Just define it here.  Move all references to this middleware file.","commit_id":"05d197d3fad3c4b1f114aa54edb40b11c25f50c5"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"ac2df60c41f65ea77b3f180c70e4a0f80087a03c","unresolved":false,"context_lines":[{"line_number":223,"context_line":"            # will set the \u0027is_admin\u0027 flag in the context anyway."},{"line_number":224,"context_line":"            return {}"},{"line_number":225,"context_line":"        else:"},{"line_number":226,"context_line":"            return common_controller.build_credentials(self.token_api,"},{"line_number":227,"context_line":"                                                       self.assignment_api,"},{"line_number":228,"context_line":"                                                       {\u0027token_id\u0027: token_id})"},{"line_number":229,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAATn%2F%2FFKI%3D","line":226,"updated":"2013-11-14 16:59:33.000000000","message":"Move that function here.","commit_id":"05d197d3fad3c4b1f114aa54edb40b11c25f50c5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"87d921e284c68cfa9a0ffae3f553628c75f7c635","unresolved":false,"context_lines":[{"line_number":205,"context_line":"        return self.application"},{"line_number":206,"context_line":""},{"line_number":207,"context_line":""},{"line_number":208,"context_line":"@dependency.requires(\u0027token_api\u0027, \u0027assignment_api\u0027)"},{"line_number":209,"context_line":"class AuthContextMiddleware(wsgi.Middleware):"},{"line_number":210,"context_line":"    \"\"\"Build the authentication context from the request auth token.\"\"\""},{"line_number":211,"context_line":""}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAUH%2F%2F%2BaY%3D","line":208,"updated":"2014-01-05 23:59:32.000000000","message":"The below code doesn\u0027t use token_api or assignment_api.","commit_id":"7294b21c4a14b6c2797e6943807082aad46264a7"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e1b2ed766dabc8bb049a78d04176fc9aa87f6bee","unresolved":false,"context_lines":[{"line_number":205,"context_line":"        return self.application"},{"line_number":206,"context_line":""},{"line_number":207,"context_line":""},{"line_number":208,"context_line":"@dependency.requires(\u0027token_api\u0027, \u0027assignment_api\u0027)"},{"line_number":209,"context_line":"class AuthContextMiddleware(wsgi.Middleware):"},{"line_number":210,"context_line":"    \"\"\"Build the authentication context from the request auth token.\"\"\""},{"line_number":211,"context_line":""}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAUH%2F%2F7Ig%3D","line":208,"in_reply_to":"AAAAUH%2F%2F%2BaY%3D","updated":"2014-01-06 18:35:40.000000000","message":"They are still needed. See line 223. They are being used by build_policy_check_credentials(). Perhaps I can change build_policy_check_credentials() to make it explicit.","commit_id":"7294b21c4a14b6c2797e6943807082aad46264a7"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"87d921e284c68cfa9a0ffae3f553628c75f7c635","unresolved":false,"context_lines":[{"line_number":213,"context_line":"        token_id \u003d request.headers.get(AUTH_TOKEN_HEADER)"},{"line_number":214,"context_line":""},{"line_number":215,"context_line":"        if token_id \u003d\u003d CONF.admin_token:"},{"line_number":216,"context_line":"            # NOTE(gyee): no need to preceed any further as the special ADMIN"},{"line_number":217,"context_line":"            # token doesn\u0027t exist in the backend and AdminTokenAuthMiddleware"},{"line_number":218,"context_line":"            # will set the \u0027is_admin\u0027 flag in the context anyway."},{"line_number":219,"context_line":"            return {}"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAUH%2F%2F%2BaU%3D","line":216,"updated":"2014-01-05 23:59:32.000000000","message":"change \"preceed\" to \"proceed\"","commit_id":"7294b21c4a14b6c2797e6943807082aad46264a7"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"87d921e284c68cfa9a0ffae3f553628c75f7c635","unresolved":false,"context_lines":[{"line_number":214,"context_line":""},{"line_number":215,"context_line":"        if token_id \u003d\u003d CONF.admin_token:"},{"line_number":216,"context_line":"            # NOTE(gyee): no need to preceed any further as the special ADMIN"},{"line_number":217,"context_line":"            # token doesn\u0027t exist in the backend and AdminTokenAuthMiddleware"},{"line_number":218,"context_line":"            # will set the \u0027is_admin\u0027 flag in the context anyway."},{"line_number":219,"context_line":"            return {}"},{"line_number":220,"context_line":"        else:"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAUH%2F%2F%2BaQ%3D","line":217,"updated":"2014-01-05 23:59:32.000000000","message":"which backend?","commit_id":"7294b21c4a14b6c2797e6943807082aad46264a7"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e1b2ed766dabc8bb049a78d04176fc9aa87f6bee","unresolved":false,"context_lines":[{"line_number":214,"context_line":""},{"line_number":215,"context_line":"        if token_id \u003d\u003d CONF.admin_token:"},{"line_number":216,"context_line":"            # NOTE(gyee): no need to preceed any further as the special ADMIN"},{"line_number":217,"context_line":"            # token doesn\u0027t exist in the backend and AdminTokenAuthMiddleware"},{"line_number":218,"context_line":"            # will set the \u0027is_admin\u0027 flag in the context anyway."},{"line_number":219,"context_line":"            return {}"},{"line_number":220,"context_line":"        else:"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAUH%2F%2F7JY%3D","line":217,"in_reply_to":"AAAAUH%2F%2F%2BaQ%3D","updated":"2014-01-06 18:35:40.000000000","message":"token backend. We don\u0027t persist the ADMIN token.","commit_id":"7294b21c4a14b6c2797e6943807082aad46264a7"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"87d921e284c68cfa9a0ffae3f553628c75f7c635","unresolved":false,"context_lines":[{"line_number":223,"context_line":"            return authorization.build_policy_check_credentials(self, context)"},{"line_number":224,"context_line":""},{"line_number":225,"context_line":"    def process_request(self, request):"},{"line_number":226,"context_line":"        if (authorization.AUTH_CONTEXT_ENV not in request.environ and"},{"line_number":227,"context_line":"                AUTH_TOKEN_HEADER in request.headers):"},{"line_number":228,"context_line":"            auth_context \u003d self._build_auth_context(request)"},{"line_number":229,"context_line":"            LOG.debug(_(\u0027RBAC: auth_context: %s\u0027), auth_context)"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAUH%2F%2F%2BaA%3D","line":226,"updated":"2014-01-05 23:59:32.000000000","message":"seems like should log a warning if the env is already set.","commit_id":"7294b21c4a14b6c2797e6943807082aad46264a7"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"87d921e284c68cfa9a0ffae3f553628c75f7c635","unresolved":false,"context_lines":[{"line_number":224,"context_line":""},{"line_number":225,"context_line":"    def process_request(self, request):"},{"line_number":226,"context_line":"        if (authorization.AUTH_CONTEXT_ENV not in request.environ and"},{"line_number":227,"context_line":"                AUTH_TOKEN_HEADER in request.headers):"},{"line_number":228,"context_line":"            auth_context \u003d self._build_auth_context(request)"},{"line_number":229,"context_line":"            LOG.debug(_(\u0027RBAC: auth_context: %s\u0027), auth_context)"},{"line_number":230,"context_line":"            request.environ[authorization.AUTH_CONTEXT_ENV] \u003d auth_context"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAUH%2F%2F%2BZM%3D","line":227,"updated":"2014-01-05 23:59:32.000000000","message":"suggest have a debug if this processing is getting skipped.","commit_id":"7294b21c4a14b6c2797e6943807082aad46264a7"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"87d921e284c68cfa9a0ffae3f553628c75f7c635","unresolved":false,"context_lines":[{"line_number":226,"context_line":"        if (authorization.AUTH_CONTEXT_ENV not in request.environ and"},{"line_number":227,"context_line":"                AUTH_TOKEN_HEADER in request.headers):"},{"line_number":228,"context_line":"            auth_context \u003d self._build_auth_context(request)"},{"line_number":229,"context_line":"            LOG.debug(_(\u0027RBAC: auth_context: %s\u0027), auth_context)"},{"line_number":230,"context_line":"            request.environ[authorization.AUTH_CONTEXT_ENV] \u003d auth_context"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAUH%2F%2F%2BZ4%3D","line":229,"updated":"2014-01-05 23:59:32.000000000","message":"why RBAC? also, suggest don\u0027t wrap in _() since there\u0027s nothing to translate.","commit_id":"7294b21c4a14b6c2797e6943807082aad46264a7"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e1b2ed766dabc8bb049a78d04176fc9aa87f6bee","unresolved":false,"context_lines":[{"line_number":226,"context_line":"        if (authorization.AUTH_CONTEXT_ENV not in request.environ and"},{"line_number":227,"context_line":"                AUTH_TOKEN_HEADER in request.headers):"},{"line_number":228,"context_line":"            auth_context \u003d self._build_auth_context(request)"},{"line_number":229,"context_line":"            LOG.debug(_(\u0027RBAC: auth_context: %s\u0027), auth_context)"},{"line_number":230,"context_line":"            request.environ[authorization.AUTH_CONTEXT_ENV] \u003d auth_context"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAUH%2F%2F7IM%3D","line":229,"in_reply_to":"AAAAUH%2F%2F%2BZ4%3D","updated":"2014-01-06 18:35:40.000000000","message":"auth context is used by RBAC. I retained the \u0027RBAC: \u0027 tag to make it easier to sort through the log file.","commit_id":"7294b21c4a14b6c2797e6943807082aad46264a7"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"3cf0c74ac722f2ec36799a57c927a6c606c24a38","unresolved":false,"context_lines":[{"line_number":214,"context_line":""},{"line_number":215,"context_line":"        if token_id \u003d\u003d CONF.admin_token:"},{"line_number":216,"context_line":"            # NOTE(gyee): no need to proceed any further as the special ADMIN"},{"line_number":217,"context_line":"            # is being handled by AdminTokenAuthMiddleware."},{"line_number":218,"context_line":"            return {}"},{"line_number":219,"context_line":"        else:"},{"line_number":220,"context_line":"            context \u003d {\u0027token_id\u0027: token_id}"}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAAUH%2F%2F28w%3D","line":217,"updated":"2014-01-07 15:44:14.000000000","message":"what if the admin token middleware is removed from the pipeline? suggest add to the comment.","commit_id":"15d8a2b913977523f5b8594d91a9cfeddc05f15c"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"3cf0c74ac722f2ec36799a57c927a6c606c24a38","unresolved":false,"context_lines":[{"line_number":231,"context_line":"            LOG.debug(_(\u0027RBAC: auth_context: %s\u0027), auth_context)"},{"line_number":232,"context_line":"            request.environ[authorization.AUTH_CONTEXT_ENV] \u003d auth_context"},{"line_number":233,"context_line":"        else:"},{"line_number":234,"context_line":"            msg \u003d _(\u0027auth context already exist in the request environment\u0027)"},{"line_number":235,"context_line":"            LOG.warning(msg)"}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAAUH%2F%2F29A%3D","line":234,"updated":"2014-01-07 15:44:14.000000000","message":"change \"exist\" to \"exists\".\n\nWould be nice to put something here that says what to do about it... although I\u0027m not sure what you would do?","commit_id":"15d8a2b913977523f5b8594d91a9cfeddc05f15c"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"55282710d13b665202e73e533b9e9c265e9e12d5","unresolved":false,"context_lines":[{"line_number":221,"context_line":"            # AdminTokenAuthMiddleware filter."},{"line_number":222,"context_line":"            return {}"},{"line_number":223,"context_line":"        else:"},{"line_number":224,"context_line":"            context \u003d {\u0027token_id\u0027: token_id}"},{"line_number":225,"context_line":"            context[\u0027environment\u0027] \u003d request.environ"},{"line_number":226,"context_line":""},{"line_number":227,"context_line":"            try:"}],"source_content_type":"text/x-python","patch_set":12,"id":"AAAAUH%2F%2FUdU%3D","line":224,"updated":"2014-01-15 03:47:55.000000000","message":"Don\u0027t we need to check for no token_id?   If the user doesn\u0027t send token_id, do we need to go to db to get the error?","commit_id":"6fb85720df87315dac95d47c6e8fd00b630fd553"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"445547ef3c5f3d2695e2352820bfae3df19b7b8c","unresolved":false,"context_lines":[{"line_number":221,"context_line":"            # AdminTokenAuthMiddleware filter."},{"line_number":222,"context_line":"            return {}"},{"line_number":223,"context_line":"        else:"},{"line_number":224,"context_line":"            context \u003d {\u0027token_id\u0027: token_id}"},{"line_number":225,"context_line":"            context[\u0027environment\u0027] \u003d request.environ"},{"line_number":226,"context_line":""},{"line_number":227,"context_line":"            try:"}],"source_content_type":"text/x-python","patch_set":12,"id":"AAAAUH%2F%2FUOA%3D","line":224,"in_reply_to":"AAAAUH%2F%2FUdU%3D","updated":"2014-01-15 05:41:03.000000000","message":"good catch! I\u0027ll add the check.","commit_id":"6fb85720df87315dac95d47c6e8fd00b630fd553"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"55282710d13b665202e73e533b9e9c265e9e12d5","unresolved":false,"context_lines":[{"line_number":228,"context_line":"                token_ref \u003d self.token_api.get_token(token_id)"},{"line_number":229,"context_line":"                # FIXME(gyee): validate_token_bind should really be its own"},{"line_number":230,"context_line":"                # middleware"},{"line_number":231,"context_line":"                wsgi.validate_token_bind(context, token_ref)"},{"line_number":232,"context_line":"                return authorization.token_to_auth_context("},{"line_number":233,"context_line":"                    token_ref[\u0027token_data\u0027])"},{"line_number":234,"context_line":"            except exception.TokenNotFound:"}],"source_content_type":"text/x-python","patch_set":12,"id":"AAAAUH%2F%2FUdY%3D","line":231,"updated":"2014-01-15 03:47:55.000000000","message":"I do see validatebind in build_policy_check credentials. Why do we need that in 2 places","commit_id":"6fb85720df87315dac95d47c6e8fd00b630fd553"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"445547ef3c5f3d2695e2352820bfae3df19b7b8c","unresolved":false,"context_lines":[{"line_number":228,"context_line":"                token_ref \u003d self.token_api.get_token(token_id)"},{"line_number":229,"context_line":"                # FIXME(gyee): validate_token_bind should really be its own"},{"line_number":230,"context_line":"                # middleware"},{"line_number":231,"context_line":"                wsgi.validate_token_bind(context, token_ref)"},{"line_number":232,"context_line":"                return authorization.token_to_auth_context("},{"line_number":233,"context_line":"                    token_ref[\u0027token_data\u0027])"},{"line_number":234,"context_line":"            except exception.TokenNotFound:"}],"source_content_type":"text/x-python","patch_set":12,"id":"AAAAUH%2F%2FUNo%3D","line":231,"in_reply_to":"AAAAUH%2F%2FUdY%3D","updated":"2014-01-15 05:41:03.000000000","message":"They are two different code paths. The other is for backward compatibility. See the FIXME in line 229, validate_token_bind functionality should be its own middleware. We\u0027ll fix that in a different patch.","commit_id":"6fb85720df87315dac95d47c6e8fd00b630fd553"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"738d94d943e91a445a029e04fa2a8c435dcf659d","unresolved":false,"context_lines":[{"line_number":208,"context_line":"    \"\"\"Build the authentication context from the request auth token.\"\"\""},{"line_number":209,"context_line":""},{"line_number":210,"context_line":"    def __init__(self, *args, **kwargs):"},{"line_number":211,"context_line":"        super(AuthContextMiddleware, self).__init__(*args, **kwargs)"},{"line_number":212,"context_line":""},{"line_number":213,"context_line":"    def _build_auth_context(self, request):"},{"line_number":214,"context_line":"        token_id \u003d request.headers.get(AUTH_TOKEN_HEADER)"}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAUH%2F%2FJa0%3D","line":211,"updated":"2014-01-17 00:59:01.000000000","message":"remove this method since it\u0027s not needed, it\u0027s the default.","commit_id":"a4244ee26d27cc99807fca443179526204467571"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e768ef0e69ed12d1329878341d816791fd6d6cd4","unresolved":false,"context_lines":[{"line_number":208,"context_line":"    \"\"\"Build the authentication context from the request auth token.\"\"\""},{"line_number":209,"context_line":""},{"line_number":210,"context_line":"    def __init__(self, *args, **kwargs):"},{"line_number":211,"context_line":"        super(AuthContextMiddleware, self).__init__(*args, **kwargs)"},{"line_number":212,"context_line":""},{"line_number":213,"context_line":"    def _build_auth_context(self, request):"},{"line_number":214,"context_line":"        token_id \u003d request.headers.get(AUTH_TOKEN_HEADER)"}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAUH%2F%2FINo%3D","line":211,"in_reply_to":"AAAAUH%2F%2FJa0%3D","updated":"2014-01-17 06:24:31.000000000","message":"done","commit_id":"a4244ee26d27cc99807fca443179526204467571"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"738d94d943e91a445a029e04fa2a8c435dcf659d","unresolved":false,"context_lines":[{"line_number":214,"context_line":"        token_id \u003d request.headers.get(AUTH_TOKEN_HEADER)"},{"line_number":215,"context_line":""},{"line_number":216,"context_line":"        if token_id \u003d\u003d CONF.admin_token:"},{"line_number":217,"context_line":"            # NOTE(gyee): no need to proceed any further as the special ADMIN"},{"line_number":218,"context_line":"            # is being handled by AdminTokenAuthMiddleware. This code will not"},{"line_number":219,"context_line":"            # be impacted even if admin token is removed from the pipeline as"},{"line_number":220,"context_line":"            # is_admin is default to \"False\". This code is independent of"}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAUH%2F%2FJas%3D","line":217,"updated":"2014-01-17 00:59:01.000000000","message":"change \"ADMIN\" to \"admin token\"","commit_id":"a4244ee26d27cc99807fca443179526204467571"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e768ef0e69ed12d1329878341d816791fd6d6cd4","unresolved":false,"context_lines":[{"line_number":214,"context_line":"        token_id \u003d request.headers.get(AUTH_TOKEN_HEADER)"},{"line_number":215,"context_line":""},{"line_number":216,"context_line":"        if token_id \u003d\u003d CONF.admin_token:"},{"line_number":217,"context_line":"            # NOTE(gyee): no need to proceed any further as the special ADMIN"},{"line_number":218,"context_line":"            # is being handled by AdminTokenAuthMiddleware. This code will not"},{"line_number":219,"context_line":"            # be impacted even if admin token is removed from the pipeline as"},{"line_number":220,"context_line":"            # is_admin is default to \"False\". This code is independent of"}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAUH%2F%2FIMw%3D","line":217,"in_reply_to":"AAAAUH%2F%2FJas%3D","updated":"2014-01-17 06:24:31.000000000","message":"done","commit_id":"a4244ee26d27cc99807fca443179526204467571"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"738d94d943e91a445a029e04fa2a8c435dcf659d","unresolved":false,"context_lines":[{"line_number":220,"context_line":"            # is_admin is default to \"False\". This code is independent of"},{"line_number":221,"context_line":"            # AdminTokenAuthMiddleware filter."},{"line_number":222,"context_line":"            return {}"},{"line_number":223,"context_line":"        else:"},{"line_number":224,"context_line":"            context \u003d {\u0027token_id\u0027: token_id}"},{"line_number":225,"context_line":"            context[\u0027environment\u0027] \u003d request.environ"},{"line_number":226,"context_line":""}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAUH%2F%2FJao%3D","line":223,"updated":"2014-01-17 00:59:01.000000000","message":"suggest remove the else here then can unindent several lines.","commit_id":"a4244ee26d27cc99807fca443179526204467571"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e768ef0e69ed12d1329878341d816791fd6d6cd4","unresolved":false,"context_lines":[{"line_number":220,"context_line":"            # is_admin is default to \"False\". This code is independent of"},{"line_number":221,"context_line":"            # AdminTokenAuthMiddleware filter."},{"line_number":222,"context_line":"            return {}"},{"line_number":223,"context_line":"        else:"},{"line_number":224,"context_line":"            context \u003d {\u0027token_id\u0027: token_id}"},{"line_number":225,"context_line":"            context[\u0027environment\u0027] \u003d request.environ"},{"line_number":226,"context_line":""}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAUH%2F%2FIMs%3D","line":223,"in_reply_to":"AAAAUH%2F%2FJao%3D","updated":"2014-01-17 06:24:31.000000000","message":"done","commit_id":"a4244ee26d27cc99807fca443179526204467571"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"738d94d943e91a445a029e04fa2a8c435dcf659d","unresolved":false,"context_lines":[{"line_number":226,"context_line":""},{"line_number":227,"context_line":"            try:"},{"line_number":228,"context_line":"                token_ref \u003d self.token_api.get_token(token_id)"},{"line_number":229,"context_line":"                # FIXME(gyee): validate_token_bind should really be its own"},{"line_number":230,"context_line":"                # middleware"},{"line_number":231,"context_line":"                wsgi.validate_token_bind(context, token_ref)"},{"line_number":232,"context_line":"                return authorization.token_to_auth_context("}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAUH%2F%2FJaU%3D","line":229,"updated":"2014-01-17 00:59:01.000000000","message":"suggest make this a TODO. FIXME indicates to me that this isn\u0027t going to work without this changed.","commit_id":"a4244ee26d27cc99807fca443179526204467571"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e768ef0e69ed12d1329878341d816791fd6d6cd4","unresolved":false,"context_lines":[{"line_number":226,"context_line":""},{"line_number":227,"context_line":"            try:"},{"line_number":228,"context_line":"                token_ref \u003d self.token_api.get_token(token_id)"},{"line_number":229,"context_line":"                # FIXME(gyee): validate_token_bind should really be its own"},{"line_number":230,"context_line":"                # middleware"},{"line_number":231,"context_line":"                wsgi.validate_token_bind(context, token_ref)"},{"line_number":232,"context_line":"                return authorization.token_to_auth_context("}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAUH%2F%2FIMo%3D","line":229,"in_reply_to":"AAAAUH%2F%2FJaU%3D","updated":"2014-01-17 06:24:31.000000000","message":"done","commit_id":"a4244ee26d27cc99807fca443179526204467571"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"738d94d943e91a445a029e04fa2a8c435dcf659d","unresolved":false,"context_lines":[{"line_number":245,"context_line":"            LOG.debug(_(\u0027RBAC: auth_context: %s\u0027), auth_context)"},{"line_number":246,"context_line":"            request.environ[authorization.AUTH_CONTEXT_ENV] \u003d auth_context"},{"line_number":247,"context_line":"        else:"},{"line_number":248,"context_line":"            msg \u003d _(\u0027auth context already exists in the request environment\u0027)"},{"line_number":249,"context_line":"            LOG.warning(msg)"}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAUH%2F%2FJZA%3D","line":248,"updated":"2014-01-17 00:59:01.000000000","message":"suggest move this up to the top of the function, right after 241 --\n\n if authorization.AUTH_CONTEXT_ENV in request.environ:\n    msg \u003d _(\u0027auth context already exists in the request environment\u0027)\n    LOG.warning(msg)\n    return\n\nThen you can switch from \"not in\" to \"in\", which is better since negative tests are more difficult. And it will be obvious that there\u0027s 2 situations where the normal code doesn\u0027t happen.","commit_id":"a4244ee26d27cc99807fca443179526204467571"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e768ef0e69ed12d1329878341d816791fd6d6cd4","unresolved":false,"context_lines":[{"line_number":245,"context_line":"            LOG.debug(_(\u0027RBAC: auth_context: %s\u0027), auth_context)"},{"line_number":246,"context_line":"            request.environ[authorization.AUTH_CONTEXT_ENV] \u003d auth_context"},{"line_number":247,"context_line":"        else:"},{"line_number":248,"context_line":"            msg \u003d _(\u0027auth context already exists in the request environment\u0027)"},{"line_number":249,"context_line":"            LOG.warning(msg)"}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAUH%2F%2FIMU%3D","line":248,"in_reply_to":"AAAAUH%2F%2FJZA%3D","updated":"2014-01-17 06:24:31.000000000","message":"good idea!","commit_id":"a4244ee26d27cc99807fca443179526204467571"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"23cbd5123baa62d5f305340fada3960837ab3326","unresolved":false,"context_lines":[{"line_number":226,"context_line":"            # TODO(gyee): validate_token_bind should really be its own"},{"line_number":227,"context_line":"            # middleware"},{"line_number":228,"context_line":"            wsgi.validate_token_bind(context, token_ref)"},{"line_number":229,"context_line":"            return authorization.token_to_auth_context("},{"line_number":230,"context_line":"                token_ref[\u0027token_data\u0027])"},{"line_number":231,"context_line":"        except exception.TokenNotFound:"},{"line_number":232,"context_line":"            LOG.warning(_(\u0027RBAC: Invalid token\u0027))"}],"source_content_type":"text/x-python","patch_set":15,"id":"AAAAUH%2F%2B8RQ%3D","line":229,"updated":"2014-01-20 15:19:36.000000000","message":"This needs to call flatten or deeper values in the token won\u0027t be accessed by policy","commit_id":"6a41630b67836d4f4a4857abf9c8794e8aba2d47"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"6d79a440e118e00d7c3c8c1dfdb3f96d833e9cd1","unresolved":false,"context_lines":[{"line_number":226,"context_line":"            # TODO(gyee): validate_token_bind should really be its own"},{"line_number":227,"context_line":"            # middleware"},{"line_number":228,"context_line":"            wsgi.validate_token_bind(context, token_ref)"},{"line_number":229,"context_line":"            return authorization.token_to_auth_context("},{"line_number":230,"context_line":"                token_ref[\u0027token_data\u0027])"},{"line_number":231,"context_line":"        except exception.TokenNotFound:"},{"line_number":232,"context_line":"            LOG.warning(_(\u0027RBAC: Invalid token\u0027))"}],"source_content_type":"text/x-python","patch_set":15,"id":"AAAAUH%2F%2B4U8%3D","line":229,"in_reply_to":"AAAAUH%2F%2B8RQ%3D","updated":"2014-01-21 06:04:45.000000000","message":"I hear ya. But that\u0027s a bigger change as the policy files are also impacted. Furthermore, we need to come up with a normalized token format before flatten it so it is token version agnostic. I think we should do this in a separate patch.","commit_id":"6a41630b67836d4f4a4857abf9c8794e8aba2d47"}],"keystone/tests/test_auth.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"3cf0c74ac722f2ec36799a57c927a6c606c24a38","unresolved":false,"context_lines":[{"line_number":76,"context_line":"                                         {\u0027REMOTE_USER\u0027: \u0027FOO\u0027,"},{"line_number":77,"context_line":"                                          \u0027AUTH_TYPE\u0027: \u0027Negotiate\u0027}}"},{"line_number":78,"context_line":"        self.empty_context \u003d {\u0027environment\u0027: {}}"},{"line_number":79,"context_line":"        #environment.use_stdlib()"},{"line_number":80,"context_line":"        self.controller \u003d token.controllers.Auth()"},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"    def assertEqualTokens(self, a, b):"}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAAUH%2F%2F28k%3D","line":79,"updated":"2014-01-07 15:44:14.000000000","message":"remove commented-out code","commit_id":"15d8a2b913977523f5b8594d91a9cfeddc05f15c"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"738d94d943e91a445a029e04fa2a8c435dcf659d","unresolved":false,"context_lines":[{"line_number":75,"context_line":"                                         {\u0027REMOTE_USER\u0027: \u0027FOO\u0027,"},{"line_number":76,"context_line":"                                          \u0027AUTH_TYPE\u0027: \u0027Negotiate\u0027}}"},{"line_number":77,"context_line":"        self.empty_context \u003d {\u0027environment\u0027: {}}"},{"line_number":78,"context_line":"        self.controller \u003d token.controllers.Auth()"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"    def assertEqualTokens(self, a, b):"},{"line_number":81,"context_line":"        \"\"\"Assert that two tokens are equal."}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAUH%2F%2FJY4%3D","line":78,"updated":"2014-01-17 00:59:01.000000000","message":"revert whitespace change on previous line.","commit_id":"a4244ee26d27cc99807fca443179526204467571"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e768ef0e69ed12d1329878341d816791fd6d6cd4","unresolved":false,"context_lines":[{"line_number":75,"context_line":"                                         {\u0027REMOTE_USER\u0027: \u0027FOO\u0027,"},{"line_number":76,"context_line":"                                          \u0027AUTH_TYPE\u0027: \u0027Negotiate\u0027}}"},{"line_number":77,"context_line":"        self.empty_context \u003d {\u0027environment\u0027: {}}"},{"line_number":78,"context_line":"        self.controller \u003d token.controllers.Auth()"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"    def assertEqualTokens(self, a, b):"},{"line_number":81,"context_line":"        \"\"\"Assert that two tokens are equal."}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAUH%2F%2FIMM%3D","line":78,"in_reply_to":"AAAAUH%2F%2FJY4%3D","updated":"2014-01-17 06:24:31.000000000","message":"done","commit_id":"a4244ee26d27cc99807fca443179526204467571"}],"keystone/tests/test_v3.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"87d921e284c68cfa9a0ffae3f553628c75f7c635","unresolved":false,"context_lines":[{"line_number":1074,"context_line":"    def test_auth_context(self):"},{"line_number":1075,"context_line":"        admin_token \u003d self.get_scoped_token()"},{"line_number":1076,"context_line":"        req \u003d self._make_request(admin_token)"},{"line_number":1077,"context_line":"        middleware.AuthContextMiddleware(None).process_request(req)"},{"line_number":1078,"context_line":"        self.assertEqual("},{"line_number":1079,"context_line":"            req.environ.get(authorization.AUTH_CONTEXT_ENV)[\u0027user_id\u0027],"},{"line_number":1080,"context_line":"            self.user[\u0027id\u0027])"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAUH%2F%2F%2BYY%3D","line":1077,"updated":"2014-01-05 23:59:32.000000000","message":"provide a name to the \"None\" parameter -- what\u0027s it supposed to be?","commit_id":"7294b21c4a14b6c2797e6943807082aad46264a7"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e1b2ed766dabc8bb049a78d04176fc9aa87f6bee","unresolved":false,"context_lines":[{"line_number":1074,"context_line":"    def test_auth_context(self):"},{"line_number":1075,"context_line":"        admin_token \u003d self.get_scoped_token()"},{"line_number":1076,"context_line":"        req \u003d self._make_request(admin_token)"},{"line_number":1077,"context_line":"        middleware.AuthContextMiddleware(None).process_request(req)"},{"line_number":1078,"context_line":"        self.assertEqual("},{"line_number":1079,"context_line":"            req.environ.get(authorization.AUTH_CONTEXT_ENV)[\u0027user_id\u0027],"},{"line_number":1080,"context_line":"            self.user[\u0027id\u0027])"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAUH%2F%2F7I8%3D","line":1077,"in_reply_to":"AAAAUH%2F%2F%2BYY%3D","updated":"2014-01-06 18:35:40.000000000","message":"I\u0027ll remove the None. Just need an instance of AuthContextMiddleware.","commit_id":"7294b21c4a14b6c2797e6943807082aad46264a7"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"87d921e284c68cfa9a0ffae3f553628c75f7c635","unresolved":false,"context_lines":[{"line_number":1085,"context_line":"        token \u003d uuid.uuid4().hex"},{"line_number":1086,"context_line":"        req \u003d self._make_request(token)"},{"line_number":1087,"context_line":"        req.environ[authorization.AUTH_CONTEXT_ENV] \u003d overridden_context"},{"line_number":1088,"context_line":"        middleware.AuthContextMiddleware(None).process_request(req)"},{"line_number":1089,"context_line":"        # make sure overridden context take precedence"},{"line_number":1090,"context_line":"        self.assertEqual(req.environ.get(authorization.AUTH_CONTEXT_ENV),"},{"line_number":1091,"context_line":"                         overridden_context)"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAUH%2F%2F%2BYU%3D","line":1088,"updated":"2014-01-05 23:59:32.000000000","message":"provide a name to the \"None\" parameter -- what\u0027s it supposed to be?","commit_id":"7294b21c4a14b6c2797e6943807082aad46264a7"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"87d921e284c68cfa9a0ffae3f553628c75f7c635","unresolved":false,"context_lines":[{"line_number":1092,"context_line":""},{"line_number":1093,"context_line":"    def test_admin_token_auth_context(self):"},{"line_number":1094,"context_line":"        req \u003d self._make_request(CONF.admin_token)"},{"line_number":1095,"context_line":"        middleware.AuthContextMiddleware(None).process_request(req)"},{"line_number":1096,"context_line":"        self.assertDictEqual(req.environ.get(authorization.AUTH_CONTEXT_ENV),"},{"line_number":1097,"context_line":"                             {})"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAUH%2F%2F%2BYQ%3D","line":1095,"updated":"2014-01-05 23:59:32.000000000","message":"provide a name to the \"None\" parameter -- what\u0027s it supposed to be?","commit_id":"7294b21c4a14b6c2797e6943807082aad46264a7"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"738d94d943e91a445a029e04fa2a8c435dcf659d","unresolved":false,"context_lines":[{"line_number":1072,"context_line":""},{"line_number":1073,"context_line":""},{"line_number":1074,"context_line":"#NOTE(gyee): test AuthContextMiddleware here instead of test_middleware.py"},{"line_number":1075,"context_line":"# because we need the actual token"},{"line_number":1076,"context_line":"class AuthContextMiddlewareTestCase(RestfulTestCase):"},{"line_number":1077,"context_line":"    def _make_request(self, token_id):"},{"line_number":1078,"context_line":""}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAUH%2F%2FJYo%3D","line":1075,"updated":"2014-01-17 00:59:01.000000000","message":"suggest remove \"actual\"","commit_id":"a4244ee26d27cc99807fca443179526204467571"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e768ef0e69ed12d1329878341d816791fd6d6cd4","unresolved":false,"context_lines":[{"line_number":1072,"context_line":""},{"line_number":1073,"context_line":""},{"line_number":1074,"context_line":"#NOTE(gyee): test AuthContextMiddleware here instead of test_middleware.py"},{"line_number":1075,"context_line":"# because we need the actual token"},{"line_number":1076,"context_line":"class AuthContextMiddlewareTestCase(RestfulTestCase):"},{"line_number":1077,"context_line":"    def _make_request(self, token_id):"},{"line_number":1078,"context_line":""}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAUH%2F%2FIL4%3D","line":1075,"in_reply_to":"AAAAUH%2F%2FJYo%3D","updated":"2014-01-17 06:24:31.000000000","message":"done","commit_id":"a4244ee26d27cc99807fca443179526204467571"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"738d94d943e91a445a029e04fa2a8c435dcf659d","unresolved":false,"context_lines":[{"line_number":1074,"context_line":"#NOTE(gyee): test AuthContextMiddleware here instead of test_middleware.py"},{"line_number":1075,"context_line":"# because we need the actual token"},{"line_number":1076,"context_line":"class AuthContextMiddlewareTestCase(RestfulTestCase):"},{"line_number":1077,"context_line":"    def _make_request(self, token_id):"},{"line_number":1078,"context_line":""},{"line_number":1079,"context_line":"        class fake_req:"},{"line_number":1080,"context_line":"            headers \u003d {middleware.AUTH_TOKEN_HEADER: token_id}"}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAUH%2F%2FJXo%3D","line":1077,"updated":"2014-01-17 00:59:01.000000000","message":"suggest change \"make\" to \"create\" since \"make\" can also mean \"do\"\n\nalso, why not do the request in a function? why would you create a request and then not do the request? None of these tests do.","commit_id":"a4244ee26d27cc99807fca443179526204467571"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e768ef0e69ed12d1329878341d816791fd6d6cd4","unresolved":false,"context_lines":[{"line_number":1074,"context_line":"#NOTE(gyee): test AuthContextMiddleware here instead of test_middleware.py"},{"line_number":1075,"context_line":"# because we need the actual token"},{"line_number":1076,"context_line":"class AuthContextMiddlewareTestCase(RestfulTestCase):"},{"line_number":1077,"context_line":"    def _make_request(self, token_id):"},{"line_number":1078,"context_line":""},{"line_number":1079,"context_line":"        class fake_req:"},{"line_number":1080,"context_line":"            headers \u003d {middleware.AUTH_TOKEN_HEADER: token_id}"}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAUH%2F%2FILQ%3D","line":1077,"in_reply_to":"AAAAUH%2F%2FJXo%3D","updated":"2014-01-17 06:24:31.000000000","message":"it is essentially mocking the request object. Perhaps I\u0027ll just rename to method to make it more clear.","commit_id":"a4244ee26d27cc99807fca443179526204467571"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"738d94d943e91a445a029e04fa2a8c435dcf659d","unresolved":false,"context_lines":[{"line_number":1082,"context_line":""},{"line_number":1083,"context_line":"        return fake_req()"},{"line_number":1084,"context_line":""},{"line_number":1085,"context_line":"    def test_auth_context(self):"},{"line_number":1086,"context_line":"        admin_token \u003d self.get_scoped_token()"},{"line_number":1087,"context_line":"        req \u003d self._make_request(admin_token)"},{"line_number":1088,"context_line":"        application \u003d None"}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAUH%2F%2FJX4%3D","line":1085,"updated":"2014-01-17 00:59:01.000000000","message":"would be nice to have comments on these functions saying what they\u0027re supposed to be verifying.","commit_id":"a4244ee26d27cc99807fca443179526204467571"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e768ef0e69ed12d1329878341d816791fd6d6cd4","unresolved":false,"context_lines":[{"line_number":1082,"context_line":""},{"line_number":1083,"context_line":"        return fake_req()"},{"line_number":1084,"context_line":""},{"line_number":1085,"context_line":"    def test_auth_context(self):"},{"line_number":1086,"context_line":"        admin_token \u003d self.get_scoped_token()"},{"line_number":1087,"context_line":"        req \u003d self._make_request(admin_token)"},{"line_number":1088,"context_line":"        application \u003d None"}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAUH%2F%2FIKM%3D","line":1085,"in_reply_to":"AAAAUH%2F%2FJX4%3D","updated":"2014-01-17 06:24:31.000000000","message":"done","commit_id":"a4244ee26d27cc99807fca443179526204467571"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"738d94d943e91a445a029e04fa2a8c435dcf659d","unresolved":false,"context_lines":[{"line_number":1103,"context_line":"        self.assertEqual(req.environ.get(authorization.AUTH_CONTEXT_ENV),"},{"line_number":1104,"context_line":"                         overridden_context)"},{"line_number":1105,"context_line":""},{"line_number":1106,"context_line":"    def test_admin_token_auth_context(self):"},{"line_number":1107,"context_line":"        req \u003d self._make_request(CONF.admin_token)"},{"line_number":1108,"context_line":"        application \u003d None"},{"line_number":1109,"context_line":"        middleware.AuthContextMiddleware(application).process_request(req)"}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAUH%2F%2FJXc%3D","line":1106,"updated":"2014-01-17 00:59:01.000000000","message":"for example\n \n   # if the admin token is provided on the request then it\u0027s not the auth context","commit_id":"a4244ee26d27cc99807fca443179526204467571"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e768ef0e69ed12d1329878341d816791fd6d6cd4","unresolved":false,"context_lines":[{"line_number":1103,"context_line":"        self.assertEqual(req.environ.get(authorization.AUTH_CONTEXT_ENV),"},{"line_number":1104,"context_line":"                         overridden_context)"},{"line_number":1105,"context_line":""},{"line_number":1106,"context_line":"    def test_admin_token_auth_context(self):"},{"line_number":1107,"context_line":"        req \u003d self._make_request(CONF.admin_token)"},{"line_number":1108,"context_line":"        application \u003d None"},{"line_number":1109,"context_line":"        middleware.AuthContextMiddleware(application).process_request(req)"}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAUH%2F%2FIJs%3D","line":1106,"in_reply_to":"AAAAUH%2F%2FJXc%3D","updated":"2014-01-17 06:24:31.000000000","message":"done","commit_id":"a4244ee26d27cc99807fca443179526204467571"}],"keystone/tests/test_v3_auth.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"738d94d943e91a445a029e04fa2a8c435dcf659d","unresolved":false,"context_lines":[{"line_number":2449,"context_line":"        resp \u003d self.post(\u0027/auth/tokens\u0027, body\u003dauth_data)"},{"line_number":2450,"context_line":"        token \u003d resp.headers.get(\u0027X-Subject-Token\u0027)"},{"line_number":2451,"context_line":"        auth_controller \u003d auth.controllers.Auth()"},{"line_number":2452,"context_line":"        # all we care is that auth context is not in the environment and"},{"line_number":2453,"context_line":"        # \u0027token_id\u0027 is used to build the auth context instead"},{"line_number":2454,"context_line":"        context \u003d {\u0027subject_token_id\u0027: token,"},{"line_number":2455,"context_line":"                   \u0027token_id\u0027: token,"}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAUH%2F%2FJWw%3D","line":2452,"updated":"2014-01-17 00:59:01.000000000","message":"could add a test for if auth context is in the environment... what happens?","commit_id":"a4244ee26d27cc99807fca443179526204467571"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e768ef0e69ed12d1329878341d816791fd6d6cd4","unresolved":false,"context_lines":[{"line_number":2449,"context_line":"        resp \u003d self.post(\u0027/auth/tokens\u0027, body\u003dauth_data)"},{"line_number":2450,"context_line":"        token \u003d resp.headers.get(\u0027X-Subject-Token\u0027)"},{"line_number":2451,"context_line":"        auth_controller \u003d auth.controllers.Auth()"},{"line_number":2452,"context_line":"        # all we care is that auth context is not in the environment and"},{"line_number":2453,"context_line":"        # \u0027token_id\u0027 is used to build the auth context instead"},{"line_number":2454,"context_line":"        context \u003d {\u0027subject_token_id\u0027: token,"},{"line_number":2455,"context_line":"                   \u0027token_id\u0027: token,"}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAUH%2F%2FIJc%3D","line":2452,"in_reply_to":"AAAAUH%2F%2FJWw%3D","updated":"2014-01-17 06:24:31.000000000","message":"those tests are implicitly covered. Essentially, all API tests are not flowing through the new middleware.","commit_id":"a4244ee26d27cc99807fca443179526204467571"}]}