)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"89a22d37d5900be51f90bc71e8221418410934f8","unresolved":false,"context_lines":[{"line_number":5,"context_line":"CommitDate: 2018-06-17 23:28:19 +0000"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"[WIP] Implement auth receipts spec"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Change-Id: I51ec6f0f9a5e9183cf776ab67facb2a80614a855"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":7,"id":"5f7c97a3_57d54c46","line":8,"updated":"2018-06-18 21:37:17.000000000","message":"We should be sure to track this with:\n\n  bp mfa-auth-receipt","commit_id":"112227a472e0c098c993f17120616deaa2c38aa7"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"aafe99fa03e762b6f6a5af6a5f1f502d58826303","unresolved":false,"context_lines":[{"line_number":5,"context_line":"CommitDate: 2018-07-02 18:28:33 +1200"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Implement auth receipts spec"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"bp: mfa-auth-receipt"},{"line_number":10,"context_line":"Change-Id: I51ec6f0f9a5e9183cf776ab67facb2a80614a855"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":11,"id":"5f7c97a3_0828d795","line":8,"updated":"2018-07-03 21:58:38.000000000","message":"Ultra short commit messages are a slight pet peeve of mine, even if all the important information is in the spec. Could you please elaborate on what parts of keystone was touched here, and any design choices you made or weirdness that needs explaining? Just having some context set up for what I\u0027m supposed to be reviewing is helpful as a reviewer, even if I\u0027m already familiar with the spec.","commit_id":"f5d4af18098a286cbb9b9c44586635b455dff084"},{"author":{"_account_id":10420,"name":"Adrian Turjak","email":"devs+openstack@uncaught-exceptions.com","username":"adriant"},"change_message_id":"75a098f45a68b27dfb237e1cf89df57354928ee1","unresolved":false,"context_lines":[{"line_number":5,"context_line":"CommitDate: 2018-07-02 18:28:33 +1200"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Implement auth receipts spec"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"bp: mfa-auth-receipt"},{"line_number":10,"context_line":"Change-Id: I51ec6f0f9a5e9183cf776ab67facb2a80614a855"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":11,"id":"5f7c97a3_666721ba","line":8,"in_reply_to":"5f7c97a3_0828d795","updated":"2018-07-05 07:33:07.000000000","message":"Done! Should really have written a little more in here originally.\n\nAmusingly, there wasn\u0027t much weirdness or any particularly odd design choices. I started with what tokens looked like provider wise, copy and pasted a lot of code, cut most of it since it wasn\u0027t relevant, and then added a tiny amount of code to the auth controller layer. The logic for processing the auth receipts really is almost noting, it\u0027s all in the provider logic.","commit_id":"f5d4af18098a286cbb9b9c44586635b455dff084"}],"api-ref/source/v3/authenticate-v3.inc":[{"author":{"_account_id":10420,"name":"Adrian Turjak","email":"devs+openstack@uncaught-exceptions.com","username":"adriant"},"change_message_id":"aec00a9479ee117b37b7472aa127f43e01724475","unresolved":false,"context_lines":[{"line_number":16,"context_line":"the token can be unscoped. You cannot scope a token to multiple scope targets."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"In the case of multi-factor authentication (MFA) more than one authentication"},{"line_number":19,"context_line":"method needs to be supplied to authenticate. As of v3.11 a failure due to MFA"},{"line_number":20,"context_line":"rules only partially being met will result in an auth receipt ID being returned"},{"line_number":21,"context_line":"in the response header ``Openstack-Auth-Receipt``, and a response body that"},{"line_number":22,"context_line":"details the receipt itself and the missing authentication methods. Supplying"}],"source_content_type":"text/x-c++src","patch_set":12,"id":"5f7c97a3_c6f395e6","line":19,"range":{"start_line":19,"start_character":51,"end_line":19,"end_character":56},"updated":"2018-07-05 07:43:43.000000000","message":"Are we on v3.11 now?","commit_id":"85a6a289f08600a80c16651247c9528c60c1fb39"}],"keystone/auth/controllers.py":[{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"87e333deea22840f79159715d7f7744857155a77","unresolved":false,"context_lines":[{"line_number":125,"context_line":""},{"line_number":126,"context_line":"            receipt_id \u003d request.auth_receipt"},{"line_number":127,"context_line":"            if receipt_id:"},{"line_number":128,"context_line":"                response \u003d PROVIDERS.receipt_provider_api.validate_receipt("},{"line_number":129,"context_line":"                    receipt_id)"},{"line_number":130,"context_line":"                receipt_ref \u003d receipt_model.KeystoneReceipt("},{"line_number":131,"context_line":"                    receipt_id\u003dreceipt_id, receipt_data\u003dresponse)"}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_308cde33","line":128,"range":{"start_line":128,"start_character":58,"end_line":128,"end_character":74},"updated":"2018-07-06 18:09:04.000000000","message":"If this raises a ReceiptNotFound today, it issues a 404 to the user. It should be a 401: suggest changing base class of receiptNotFound to Unauthorized. see other comments.","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"},{"author":{"_account_id":10420,"name":"Adrian Turjak","email":"devs+openstack@uncaught-exceptions.com","username":"adriant"},"change_message_id":"a12d60e39bae8152a5a216f827dd4208bb7b1372","unresolved":false,"context_lines":[{"line_number":125,"context_line":""},{"line_number":126,"context_line":"            receipt_id \u003d request.auth_receipt"},{"line_number":127,"context_line":"            if receipt_id:"},{"line_number":128,"context_line":"                response \u003d PROVIDERS.receipt_provider_api.validate_receipt("},{"line_number":129,"context_line":"                    receipt_id)"},{"line_number":130,"context_line":"                receipt_ref \u003d receipt_model.KeystoneReceipt("},{"line_number":131,"context_line":"                    receipt_id\u003dreceipt_id, receipt_data\u003dresponse)"}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_cb183585","line":128,"range":{"start_line":128,"start_character":58,"end_line":128,"end_character":74},"in_reply_to":"5f7c97a3_308cde33","updated":"2018-07-10 03:27:36.000000000","message":"Done","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"87e333deea22840f79159715d7f7744857155a77","unresolved":false,"context_lines":[{"line_number":131,"context_line":"                    receipt_id\u003dreceipt_id, receipt_data\u003dresponse)"},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"                if auth_context[\u0027user_id\u0027] !\u003d receipt_ref.user_id:"},{"line_number":134,"context_line":"                    raise exception.AuthReceiptUserMismatch("},{"line_number":135,"context_line":"                        user_id\u003dauth_context[\u0027user_id\u0027],"},{"line_number":136,"context_line":"                        receipt_user_id\u003dreceipt_ref.user_id)"},{"line_number":137,"context_line":"            else:"}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_50995a77","line":134,"range":{"start_line":134,"start_character":36,"end_line":134,"end_character":59},"updated":"2018-07-06 18:09:04.000000000","message":"Be sure this is not exposed (a plain unauthorized: bad username/password/receipt, non specific as to which) outside of debug mode.","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"87e333deea22840f79159715d7f7744857155a77","unresolved":false,"context_lines":[{"line_number":541,"context_line":"    status \u003d (401, \u0027Unauthorized\u0027)"},{"line_number":542,"context_line":""},{"line_number":543,"context_line":"    return wsgi.render_response("},{"line_number":544,"context_line":"        body\u003dreceipt_data, status\u003dstatus, headers\u003dheaders)"}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_d0932a4d","line":544,"range":{"start_line":544,"start_character":13,"end_line":544,"end_character":25},"updated":"2018-07-06 18:09:04.000000000","message":"Can we/should we render receipt data ever to the end user? I am inclined to say \"no\" and simply communicate what auth methods are possibly still neded and the receipt header.\n\nsuggest never exposing the internal receipt data to the end user. This is to avoid making the receipt data a contract, it should be opaque to the end user at all times.\n\nwe should only ever expose the data that the user should need to auth.","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"},{"author":{"_account_id":10420,"name":"Adrian Turjak","email":"devs+openstack@uncaught-exceptions.com","username":"adriant"},"change_message_id":"a12d60e39bae8152a5a216f827dd4208bb7b1372","unresolved":false,"context_lines":[{"line_number":541,"context_line":"    status \u003d (401, \u0027Unauthorized\u0027)"},{"line_number":542,"context_line":""},{"line_number":543,"context_line":"    return wsgi.render_response("},{"line_number":544,"context_line":"        body\u003dreceipt_data, status\u003dstatus, headers\u003dheaders)"}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_46117c52","line":544,"range":{"start_line":544,"start_character":13,"end_line":544,"end_character":25},"in_reply_to":"5f7c97a3_d0932a4d","updated":"2018-07-10 03:27:36.000000000","message":"We ideally need to expose the expiry date, and definitely the required methods.\n\nI lean on the why not expose it all side since the actual amount of data there is minimal, and unlikely to ever really need to change.\n\nRight now it looks like:\nhttp://paste.openstack.org/show/725380/","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"}],"keystone/cmd/cli.py":[{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"05e660b9007770fa64591cc0d883c142f444f698","unresolved":false,"context_lines":[{"line_number":408,"context_line":"                keystone_user_id, keystone_group_id)"},{"line_number":409,"context_line":""},{"line_number":410,"context_line":"        # NOTE(adriant): If the directories are the same, \u0027max_active_keys\u0027"},{"line_number":411,"context_line":"        # is ignored from fernet_receipts in favor of fernet_tokens to"},{"line_number":412,"context_line":"        # avoid a potential mismatch. Only if the directories are different"},{"line_number":413,"context_line":"        # do we create a different one for receipts, and then respect"},{"line_number":414,"context_line":"        # \u0027max_active_keys\u0027 for receipts."}],"source_content_type":"text/x-python","patch_set":8,"id":"5f7c97a3_677bbf28","line":411,"range":{"start_line":411,"start_character":10,"end_line":411,"end_character":20},"updated":"2018-06-20 19:25:59.000000000","message":"A warning would probably be appropriate","commit_id":"d70cbae0971017da49284a26e5551ee92dd8542f"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"05e660b9007770fa64591cc0d883c142f444f698","unresolved":false,"context_lines":[{"line_number":588,"context_line":"        keystone_user_id, keystone_group_id \u003d cls.get_user_group()"},{"line_number":589,"context_line":"        if futils.validate_key_repository(requires_write\u003dTrue):"},{"line_number":590,"context_line":"            futils.rotate_keys(keystone_user_id, keystone_group_id)"},{"line_number":591,"context_line":""},{"line_number":592,"context_line":""},{"line_number":593,"context_line":"class CredentialSetup(BasePermissionsSetup):"},{"line_number":594,"context_line":"    \"\"\"Setup a Fernet key repository for credential encryption."}],"source_content_type":"text/x-python","patch_set":8,"id":"5f7c97a3_0790cb41","line":591,"updated":"2018-06-20 19:25:59.000000000","message":"These seem like duplication of the Fernet{Setup,Rotate} commands?","commit_id":"d70cbae0971017da49284a26e5551ee92dd8542f"},{"author":{"_account_id":10420,"name":"Adrian Turjak","email":"devs+openstack@uncaught-exceptions.com","username":"adriant"},"change_message_id":"42fd4cfc2d4d41ed2c0a8b99906d7249c41f3c5d","unresolved":false,"context_lines":[{"line_number":588,"context_line":"        keystone_user_id, keystone_group_id \u003d cls.get_user_group()"},{"line_number":589,"context_line":"        if futils.validate_key_repository(requires_write\u003dTrue):"},{"line_number":590,"context_line":"            futils.rotate_keys(keystone_user_id, keystone_group_id)"},{"line_number":591,"context_line":""},{"line_number":592,"context_line":""},{"line_number":593,"context_line":"class CredentialSetup(BasePermissionsSetup):"},{"line_number":594,"context_line":"    \"\"\"Setup a Fernet key repository for credential encryption."}],"source_content_type":"text/x-python","patch_set":8,"id":"5f7c97a3_99fafb74","line":591,"in_reply_to":"5f7c97a3_0790cb41","updated":"2018-06-21 04:02:33.000000000","message":"Not quite. They are a duplicate of Token{Setup,Rotate}.\n\nFernet{Setup,Rotate} does both token and receipt, while Token{Setup,Rotate} and Receipt{Setup,Rotate} control them individually. Token{Setup,Rotate} used to be mostly identical to Fernet{Setup,Rotate}.","commit_id":"d70cbae0971017da49284a26e5551ee92dd8542f"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"87e333deea22840f79159715d7f7744857155a77","unresolved":false,"context_lines":[{"line_number":409,"context_line":"            futils.initialize_key_repository("},{"line_number":410,"context_line":"                keystone_user_id, keystone_group_id)"},{"line_number":411,"context_line":""},{"line_number":412,"context_line":"        # WARNING(adriant): If the directories are the same, \u0027max_active_keys\u0027"},{"line_number":413,"context_line":"        # is ignored from fernet_receipts in favor of fernet_tokens to"},{"line_number":414,"context_line":"        # avoid a potential mismatch. Only if the directories are different"},{"line_number":415,"context_line":"        # do we create a different one for receipts, and then respect"},{"line_number":416,"context_line":"        # \u0027max_active_keys\u0027 for receipts."},{"line_number":417,"context_line":"        if (CONF.fernet_tokens.key_repository !\u003d"},{"line_number":418,"context_line":"                CONF.fernet_receipts.key_repository):"},{"line_number":419,"context_line":"            futils \u003d fernet_utils.FernetUtils("}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_d0032a0b","line":416,"range":{"start_line":412,"start_character":28,"end_line":416,"end_character":41},"updated":"2018-07-06 18:09:04.000000000","message":"I\u0027m of the opinion we either lock the locations together *or* we split them apart and not allow them to be the same.\n\nThis comment is not reason for any negative scoring on this patch. I\u0027m fine with this as is, but wanted to express my opinion that it should not behave in this manner.","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"},{"author":{"_account_id":10420,"name":"Adrian Turjak","email":"devs+openstack@uncaught-exceptions.com","username":"adriant"},"change_message_id":"a12d60e39bae8152a5a216f827dd4208bb7b1372","unresolved":false,"context_lines":[{"line_number":409,"context_line":"            futils.initialize_key_repository("},{"line_number":410,"context_line":"                keystone_user_id, keystone_group_id)"},{"line_number":411,"context_line":""},{"line_number":412,"context_line":"        # WARNING(adriant): If the directories are the same, \u0027max_active_keys\u0027"},{"line_number":413,"context_line":"        # is ignored from fernet_receipts in favor of fernet_tokens to"},{"line_number":414,"context_line":"        # avoid a potential mismatch. Only if the directories are different"},{"line_number":415,"context_line":"        # do we create a different one for receipts, and then respect"},{"line_number":416,"context_line":"        # \u0027max_active_keys\u0027 for receipts."},{"line_number":417,"context_line":"        if (CONF.fernet_tokens.key_repository !\u003d"},{"line_number":418,"context_line":"                CONF.fernet_receipts.key_repository):"},{"line_number":419,"context_line":"            futils \u003d fernet_utils.FernetUtils("}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_e677689e","line":416,"range":{"start_line":412,"start_character":28,"end_line":416,"end_character":41},"in_reply_to":"5f7c97a3_d0032a0b","updated":"2018-07-10 03:27:36.000000000","message":"I\u0027d rather we lock than split as it makes life easier for ops (less upgrade steps), but the problem is that for the VERY security conscious having them split is useful. That\u0027s why I went with both, and have locking be the default.\n\nIf we did lock them, then we\u0027d need to make a new config that isn\u0027t \u0027fernet_tokens\u0027 but rather just \u0027fernet\u0027 and deprecate the ones in \u0027fernet_tokens\u0027, with \u0027fernet_tokens\u0027 still a fallback for the next few cycles.\n\nI prefer locking as the only choice if we had to pick just one, but until told otherwise will stick with both.","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"}],"keystone/common/authorization.py":[{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"87e333deea22840f79159715d7f7744857155a77","unresolved":false,"context_lines":[{"line_number":30,"context_line":""},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"# Header used to transmit the auth receipt"},{"line_number":33,"context_line":"AUTH_RECEIPT_HEADER \u003d \u0027Openstack-Auth-Receipt\u0027"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"# Header used to transmit the subject token"}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_302a9e7d","line":33,"range":{"start_line":33,"start_character":22,"end_line":33,"end_character":46},"updated":"2018-07-06 18:09:04.000000000","message":"Yay, it\u0027s not an X- prefixed header!! :)","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"}],"keystone/conf/fernet_receipts.py":[{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"87e333deea22840f79159715d7f7744857155a77","unresolved":false,"context_lines":[{"line_number":17,"context_line":"from keystone.conf import utils"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"key_repository \u003d cfg.StrOpt("},{"line_number":21,"context_line":"    \u0027key_repository\u0027,"},{"line_number":22,"context_line":"    default\u003d\u0027/etc/keystone/fernet-keys/\u0027,"},{"line_number":23,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":24,"context_line":"Directory containing Fernet receipt keys. This directory must exist before"},{"line_number":25,"context_line":"using `keystone-manage fernet_setup` for the first time, must be writable by"},{"line_number":26,"context_line":"the user running `keystone-manage fernet_setup` or `keystone-manage"}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_903a92ca","line":23,"range":{"start_line":20,"start_character":0,"end_line":23,"end_character":22},"updated":"2018-07-06 18:09:04.000000000","message":"See previous comment.","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"}],"keystone/conf/receipt.py":[{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"87e333deea22840f79159715d7f7744857155a77","unresolved":false,"context_lines":[{"line_number":22,"context_line":"expiration \u003d cfg.IntOpt("},{"line_number":23,"context_line":"    \u0027expiration\u0027,"},{"line_number":24,"context_line":"    default\u003d300,"},{"line_number":25,"context_line":"    min\u003d0,"},{"line_number":26,"context_line":"    max\u003dsys.maxsize,"},{"line_number":27,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":28,"context_line":"The amount of time that a receipt should remain valid (in seconds). This value"}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_50307ae9","line":25,"range":{"start_line":25,"start_character":1,"end_line":25,"end_character":10},"updated":"2018-07-06 18:09:04.000000000","message":"Please set a sane minimum, 60s, 30s, etc or similar. A 0 second expiry is patently invalid (I\u0027ll argue less than ~30s is too narrow to navigate an auth-path).\n\nLong term we should work out a way to do a nonce or similar.","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"},{"author":{"_account_id":10420,"name":"Adrian Turjak","email":"devs+openstack@uncaught-exceptions.com","username":"adriant"},"change_message_id":"a12d60e39bae8152a5a216f827dd4208bb7b1372","unresolved":false,"context_lines":[{"line_number":22,"context_line":"expiration \u003d cfg.IntOpt("},{"line_number":23,"context_line":"    \u0027expiration\u0027,"},{"line_number":24,"context_line":"    default\u003d300,"},{"line_number":25,"context_line":"    min\u003d0,"},{"line_number":26,"context_line":"    max\u003dsys.maxsize,"},{"line_number":27,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":28,"context_line":"The amount of time that a receipt should remain valid (in seconds). This value"}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_a6c970ab","line":25,"range":{"start_line":25,"start_character":1,"end_line":25,"end_character":10},"in_reply_to":"5f7c97a3_50307ae9","updated":"2018-07-10 03:27:36.000000000","message":"Huh... I took this from tokens. Tokens has a min of 0 as well. Will change if needed, but leaving for now.","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"87e333deea22840f79159715d7f7744857155a77","unresolved":false,"context_lines":[{"line_number":23,"context_line":"    \u0027expiration\u0027,"},{"line_number":24,"context_line":"    default\u003d300,"},{"line_number":25,"context_line":"    min\u003d0,"},{"line_number":26,"context_line":"    max\u003dsys.maxsize,"},{"line_number":27,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":28,"context_line":"The amount of time that a receipt should remain valid (in seconds). This value"},{"line_number":29,"context_line":"should always be very short, as it represents how long a user has to reattempt"}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_b0a8eed8","line":26,"range":{"start_line":26,"start_character":8,"end_line":26,"end_character":20},"updated":"2018-07-06 18:09:04.000000000","message":"If we want it to be \"short\" set the max to something like 86400, 292471208677 years as a possibility (64-bit) falls out of the category of \"short\"","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"},{"author":{"_account_id":10420,"name":"Adrian Turjak","email":"devs+openstack@uncaught-exceptions.com","username":"adriant"},"change_message_id":"a12d60e39bae8152a5a216f827dd4208bb7b1372","unresolved":false,"context_lines":[{"line_number":23,"context_line":"    \u0027expiration\u0027,"},{"line_number":24,"context_line":"    default\u003d300,"},{"line_number":25,"context_line":"    min\u003d0,"},{"line_number":26,"context_line":"    max\u003dsys.maxsize,"},{"line_number":27,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":28,"context_line":"The amount of time that a receipt should remain valid (in seconds). This value"},{"line_number":29,"context_line":"should always be very short, as it represents how long a user has to reattempt"}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_46c41c92","line":26,"range":{"start_line":26,"start_character":8,"end_line":26,"end_character":20},"in_reply_to":"5f7c97a3_b0a8eed8","updated":"2018-07-10 03:27:36.000000000","message":"Done","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"87e333deea22840f79159715d7f7744857155a77","unresolved":false,"context_lines":[{"line_number":30,"context_line":"auth with the missing auth methods."},{"line_number":31,"context_line":"\"\"\"))"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"provider \u003d cfg.StrOpt("},{"line_number":34,"context_line":"    \u0027provider\u0027,"},{"line_number":35,"context_line":"    default\u003d\u0027fernet\u0027,"},{"line_number":36,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":37,"context_line":"Entry point for the receipt provider in the `keystone.receipt.provider`"},{"line_number":38,"context_line":"namespace. The receipt provider controls the receipt construction and"},{"line_number":39,"context_line":"validation operations. Keystone includes just the `fernet` receipt provider for"},{"line_number":40,"context_line":"now. `fernet` receipts do not need to be persisted at all, but require that you"},{"line_number":41,"context_line":"run `keystone-manage fernet_setup` (also see the `keystone-manage"},{"line_number":42,"context_line":"fernet_rotate` command)."},{"line_number":43,"context_line":"\"\"\"))"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"caching \u003d cfg.BoolOpt("},{"line_number":46,"context_line":"    \u0027caching\u0027,"}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_30861e67","line":43,"range":{"start_line":33,"start_character":0,"end_line":43,"end_character":5},"updated":"2018-07-06 18:09:04.000000000","message":"I would probably just drop the \"backend\" and be opinionated that this is *only* Fernet based [for now], we can add configuration down the road.\n\nBenefit is it simplifies the whole solution since you\u0027re dropping all the loading bits.","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e04dc5464c0735440d76d85630dea7de9cb11ca7","unresolved":false,"context_lines":[{"line_number":30,"context_line":"auth with the missing auth methods."},{"line_number":31,"context_line":"\"\"\"))"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"provider \u003d cfg.StrOpt("},{"line_number":34,"context_line":"    \u0027provider\u0027,"},{"line_number":35,"context_line":"    default\u003d\u0027fernet\u0027,"},{"line_number":36,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":37,"context_line":"Entry point for the receipt provider in the `keystone.receipt.provider`"},{"line_number":38,"context_line":"namespace. The receipt provider controls the receipt construction and"},{"line_number":39,"context_line":"validation operations. Keystone includes just the `fernet` receipt provider for"},{"line_number":40,"context_line":"now. `fernet` receipts do not need to be persisted at all, but require that you"},{"line_number":41,"context_line":"run `keystone-manage fernet_setup` (also see the `keystone-manage"},{"line_number":42,"context_line":"fernet_rotate` command)."},{"line_number":43,"context_line":"\"\"\"))"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"caching \u003d cfg.BoolOpt("},{"line_number":46,"context_line":"    \u0027caching\u0027,"}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_916a78e9","line":43,"range":{"start_line":33,"start_character":0,"end_line":43,"end_character":5},"in_reply_to":"5f7c97a3_30861e67","updated":"2018-07-09 19:09:45.000000000","message":"Yeah, this might clean up some of the interface concerns I have.\n\nA lot of what is being proposed carries some of the confusing practices we had with the token provider API, which we\u0027re still trying to fix after years of refactoring.\n\nI\u0027d hate to have auth receipts start on the same foot only to be confusing to understand and implement out of the gate due to the patterns we implemented a long time ago :(","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"87e333deea22840f79159715d7f7744857155a77","unresolved":false,"context_lines":[{"line_number":42,"context_line":"fernet_rotate` command)."},{"line_number":43,"context_line":"\"\"\"))"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"caching \u003d cfg.BoolOpt("},{"line_number":46,"context_line":"    \u0027caching\u0027,"},{"line_number":47,"context_line":"    default\u003dTrue,"},{"line_number":48,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":49,"context_line":"Toggle for caching receipt creation and validation data. This has no effect"},{"line_number":50,"context_line":"unless global caching is enabled."},{"line_number":51,"context_line":"\"\"\"))"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"cache_time \u003d cfg.IntOpt("},{"line_number":54,"context_line":"    \u0027cache_time\u0027,"}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_508cfa7e","line":51,"range":{"start_line":45,"start_character":0,"end_line":51,"end_character":5},"updated":"2018-07-06 18:09:04.000000000","message":"Please be explicit that this is affected by \"cache_on_issue\".\n\nNOTE (not a reason for a negative score, does not need ot be changed now): Caching should be implemented as a separate commit in the future.\n\nImplement base feature, then caching once the base feature is working.","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"},{"author":{"_account_id":10420,"name":"Adrian Turjak","email":"devs+openstack@uncaught-exceptions.com","username":"adriant"},"change_message_id":"a12d60e39bae8152a5a216f827dd4208bb7b1372","unresolved":false,"context_lines":[{"line_number":42,"context_line":"fernet_rotate` command)."},{"line_number":43,"context_line":"\"\"\"))"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"caching \u003d cfg.BoolOpt("},{"line_number":46,"context_line":"    \u0027caching\u0027,"},{"line_number":47,"context_line":"    default\u003dTrue,"},{"line_number":48,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":49,"context_line":"Toggle for caching receipt creation and validation data. This has no effect"},{"line_number":50,"context_line":"unless global caching is enabled."},{"line_number":51,"context_line":"\"\"\"))"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"cache_time \u003d cfg.IntOpt("},{"line_number":54,"context_line":"    \u0027cache_time\u0027,"}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_86d79422","line":51,"range":{"start_line":45,"start_character":0,"end_line":51,"end_character":5},"in_reply_to":"5f7c97a3_508cfa7e","updated":"2018-07-10 03:27:36.000000000","message":"See below comment, will likely just drop caching entirely.","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"87e333deea22840f79159715d7f7744857155a77","unresolved":false,"context_lines":[{"line_number":51,"context_line":"\"\"\"))"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"cache_time \u003d cfg.IntOpt("},{"line_number":54,"context_line":"    \u0027cache_time\u0027,"},{"line_number":55,"context_line":"    min\u003d0,"},{"line_number":56,"context_line":"    max\u003dsys.maxsize,"},{"line_number":57,"context_line":"    help\u003dutils.fmt(\"\"\""}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_704a5624","line":54,"range":{"start_line":54,"start_character":4,"end_line":54,"end_character":17},"updated":"2018-07-06 18:09:04.000000000","message":"This may need a default","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"},{"author":{"_account_id":10420,"name":"Adrian Turjak","email":"devs+openstack@uncaught-exceptions.com","username":"adriant"},"change_message_id":"a12d60e39bae8152a5a216f827dd4208bb7b1372","unresolved":false,"context_lines":[{"line_number":51,"context_line":"\"\"\"))"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"cache_time \u003d cfg.IntOpt("},{"line_number":54,"context_line":"    \u0027cache_time\u0027,"},{"line_number":55,"context_line":"    min\u003d0,"},{"line_number":56,"context_line":"    max\u003dsys.maxsize,"},{"line_number":57,"context_line":"    help\u003dutils.fmt(\"\"\""}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_86b0f4fe","line":54,"range":{"start_line":54,"start_character":4,"end_line":54,"end_character":17},"in_reply_to":"5f7c97a3_704a5624","updated":"2018-07-10 03:27:36.000000000","message":"done, set to 300 (the default expiry time).\n\nAlthough I\u0027m curious how our caching works. Because if a receipt has been validated just before expiry successfully by the provider, but the auth failed, then the user has until that cached validation expires to retry since it won\u0027t actually attempt to re-validate the receipt until then and see if has expired.\n\nIf that\u0027s the case, the we probably don\u0027t even want caching, or we want it to be VERY short. Which to be fair, since a specific receipt shouldn\u0027t need validation more than maybe 2-3 times (unlike a token), caching isn\u0027t that useful here.","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"87e333deea22840f79159715d7f7744857155a77","unresolved":false,"context_lines":[{"line_number":52,"context_line":""},{"line_number":53,"context_line":"cache_time \u003d cfg.IntOpt("},{"line_number":54,"context_line":"    \u0027cache_time\u0027,"},{"line_number":55,"context_line":"    min\u003d0,"},{"line_number":56,"context_line":"    max\u003dsys.maxsize,"},{"line_number":57,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":58,"context_line":"The number of seconds to cache receipt creation and validation data. This has"}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_d0ed6a24","line":55,"range":{"start_line":55,"start_character":4,"end_line":55,"end_character":10},"updated":"2018-07-06 18:09:04.000000000","message":"this may be need to be -1 minimum for \"forever\". This is a note that we should check the minimum here.","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"87e333deea22840f79159715d7f7744857155a77","unresolved":false,"context_lines":[{"line_number":53,"context_line":"cache_time \u003d cfg.IntOpt("},{"line_number":54,"context_line":"    \u0027cache_time\u0027,"},{"line_number":55,"context_line":"    min\u003d0,"},{"line_number":56,"context_line":"    max\u003dsys.maxsize,"},{"line_number":57,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":58,"context_line":"The number of seconds to cache receipt creation and validation data. This has"},{"line_number":59,"context_line":"no effect unless both global and `[receipt] caching` are enabled."}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_504f1a34","line":56,"range":{"start_line":56,"start_character":0,"end_line":56,"end_character":20},"updated":"2018-07-06 18:09:04.000000000","message":"See above comment. I suggest not even adding a max, the sys.maxsize is somewhat absurd to end up in the comments.","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"},{"author":{"_account_id":10420,"name":"Adrian Turjak","email":"devs+openstack@uncaught-exceptions.com","username":"adriant"},"change_message_id":"a12d60e39bae8152a5a216f827dd4208bb7b1372","unresolved":false,"context_lines":[{"line_number":53,"context_line":"cache_time \u003d cfg.IntOpt("},{"line_number":54,"context_line":"    \u0027cache_time\u0027,"},{"line_number":55,"context_line":"    min\u003d0,"},{"line_number":56,"context_line":"    max\u003dsys.maxsize,"},{"line_number":57,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":58,"context_line":"The number of seconds to cache receipt creation and validation data. This has"},{"line_number":59,"context_line":"no effect unless both global and `[receipt] caching` are enabled."}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_46e5fc08","line":56,"range":{"start_line":56,"start_character":0,"end_line":56,"end_character":20},"in_reply_to":"5f7c97a3_504f1a34","updated":"2018-07-10 03:27:36.000000000","message":"Done","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"}],"keystone/exception.py":[{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"87e333deea22840f79159715d7f7744857155a77","unresolved":false,"context_lines":[{"line_number":413,"context_line":"    message_format \u003d _(\"Could not find token: %(token_id)s.\")"},{"line_number":414,"context_line":""},{"line_number":415,"context_line":""},{"line_number":416,"context_line":"class ReceiptNotFound(NotFound):"},{"line_number":417,"context_line":"    message_format \u003d _(\"Could not find receipt: %(receipt_id)s.\")"},{"line_number":418,"context_line":""},{"line_number":419,"context_line":""}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_b0c9ce79","line":416,"range":{"start_line":416,"start_character":22,"end_line":416,"end_character":30},"updated":"2018-07-06 18:09:04.000000000","message":"See other comment about bubbling up 404s instead of 401s. This should just be a 401, way way way easier than needing to try/except/reraise 401.","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"},{"author":{"_account_id":10420,"name":"Adrian Turjak","email":"devs+openstack@uncaught-exceptions.com","username":"adriant"},"change_message_id":"a12d60e39bae8152a5a216f827dd4208bb7b1372","unresolved":false,"context_lines":[{"line_number":413,"context_line":"    message_format \u003d _(\"Could not find token: %(token_id)s.\")"},{"line_number":414,"context_line":""},{"line_number":415,"context_line":""},{"line_number":416,"context_line":"class ReceiptNotFound(NotFound):"},{"line_number":417,"context_line":"    message_format \u003d _(\"Could not find receipt: %(receipt_id)s.\")"},{"line_number":418,"context_line":""},{"line_number":419,"context_line":""}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_6b1ec174","line":416,"range":{"start_line":416,"start_character":22,"end_line":416,"end_character":30},"in_reply_to":"5f7c97a3_b0c9ce79","updated":"2018-07-10 03:27:36.000000000","message":"Done","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"87e333deea22840f79159715d7f7744857155a77","unresolved":false,"context_lines":[{"line_number":414,"context_line":""},{"line_number":415,"context_line":""},{"line_number":416,"context_line":"class ReceiptNotFound(NotFound):"},{"line_number":417,"context_line":"    message_format \u003d _(\"Could not find receipt: %(receipt_id)s.\")"},{"line_number":418,"context_line":""},{"line_number":419,"context_line":""},{"line_number":420,"context_line":"class UserNotFound(NotFound):"}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_f05746c8","line":417,"range":{"start_line":417,"start_character":39,"end_line":417,"end_character":46},"updated":"2018-07-06 18:09:04.000000000","message":"\"auth receipt\" be explicit.","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"},{"author":{"_account_id":10420,"name":"Adrian Turjak","email":"devs+openstack@uncaught-exceptions.com","username":"adriant"},"change_message_id":"a12d60e39bae8152a5a216f827dd4208bb7b1372","unresolved":false,"context_lines":[{"line_number":414,"context_line":""},{"line_number":415,"context_line":""},{"line_number":416,"context_line":"class ReceiptNotFound(NotFound):"},{"line_number":417,"context_line":"    message_format \u003d _(\"Could not find receipt: %(receipt_id)s.\")"},{"line_number":418,"context_line":""},{"line_number":419,"context_line":""},{"line_number":420,"context_line":"class UserNotFound(NotFound):"}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_0b294d9a","line":417,"range":{"start_line":417,"start_character":39,"end_line":417,"end_character":46},"in_reply_to":"5f7c97a3_f05746c8","updated":"2018-07-10 03:27:36.000000000","message":"Done","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"}],"keystone/models/receipt_model.py":[{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"87e333deea22840f79159715d7f7744857155a77","unresolved":false,"context_lines":[{"line_number":19,"context_line":"import six"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"def _parse_and_normalize_time(time_data):"},{"line_number":23,"context_line":"    if isinstance(time_data, six.string_types):"},{"line_number":24,"context_line":"        time_data \u003d timeutils.parse_isotime(time_data)"},{"line_number":25,"context_line":"    return timeutils.normalize_time(time_data)"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"class KeystoneReceipt(dict):"}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_50687a86","line":25,"range":{"start_line":22,"start_character":0,"end_line":25,"end_character":46},"updated":"2018-07-06 18:09:04.000000000","message":"Don\u0027t we have this code somewhere else (or something similar) already?","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"},{"author":{"_account_id":10420,"name":"Adrian Turjak","email":"devs+openstack@uncaught-exceptions.com","username":"adriant"},"change_message_id":"a12d60e39bae8152a5a216f827dd4208bb7b1372","unresolved":false,"context_lines":[{"line_number":19,"context_line":"import six"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"def _parse_and_normalize_time(time_data):"},{"line_number":23,"context_line":"    if isinstance(time_data, six.string_types):"},{"line_number":24,"context_line":"        time_data \u003d timeutils.parse_isotime(time_data)"},{"line_number":25,"context_line":"    return timeutils.normalize_time(time_data)"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"class KeystoneReceipt(dict):"}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_e6b9a8ca","line":25,"range":{"start_line":22,"start_character":0,"end_line":25,"end_character":46},"in_reply_to":"5f7c97a3_50687a86","updated":"2018-07-10 03:27:36.000000000","message":"the token model module has the same thing. I might move it to common.utils I guess.","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"87e333deea22840f79159715d7f7744857155a77","unresolved":false,"context_lines":[{"line_number":25,"context_line":"    return timeutils.normalize_time(time_data)"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"class KeystoneReceipt(dict):"},{"line_number":29,"context_line":"    \"\"\"An in-memory representation that unifies v3 receipts.\"\"\""},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"    def __init__(self, receipt_id, receipt_data):"}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_70f816c0","line":28,"range":{"start_line":28,"start_character":22,"end_line":28,"end_character":26},"updated":"2018-07-06 18:09:04.000000000","message":"Suggest not basing this on a dict. This should be an object in it\u0027s own right, using @property/@settr/etc. See Lance\u0027s new TokenModel.\n\nThis is to prevent lazy dict referencing and can ensure we are parsing the date data a single time (stored locally). The render to JSON [if ever?] should be explicit as would be conversion to a SQL Model.\n\nThis comment is highly relevant to the -1 score.\n\nRelated: once a recepit is minted (see lance\u0027s token rework) it should be immutable.","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"}],"keystone/notifications.py":[{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"87e333deea22840f79159715d7f7744857155a77","unresolved":false,"context_lines":[{"line_number":81,"context_line":"REMOVE_APP_CREDS_FOR_USER \u003d \u0027remove_application_credentials_for_user\u0027"},{"line_number":82,"context_line":"DOMAIN_DELETED \u003d \u0027domain_deleted\u0027"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"# NOTE(adriant): For potential use later if we need the ability to clear the"},{"line_number":85,"context_line":"# receipt cache."},{"line_number":86,"context_line":"INVALIDATE_RECEIPT_CACHE \u003d \u0027invalidate_receipt_cache\u0027"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"class Audit(object):"}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_f025065c","line":86,"range":{"start_line":84,"start_character":0,"end_line":86,"end_character":53},"updated":"2018-07-06 18:09:04.000000000","message":"If this is not used. Do not add it. We don\u0027t need \"for potential future use\" code. if this is used, comment is inaccurate.","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"}],"keystone/receipt/__init__.py":[{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"05e660b9007770fa64591cc0d883c142f444f698","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# Copyright 2012 OpenStack Foundation"},{"line_number":2,"context_line":"#"},{"line_number":3,"context_line":"# Licensed under the Apache License, Version 2.0 (the \"License\"); you may"},{"line_number":4,"context_line":"# not use this file except in compliance with the License. You may obtain"}],"source_content_type":"text/x-python","patch_set":8,"id":"5f7c97a3_274dc7c3","line":1,"updated":"2018-06-20 19:25:59.000000000","message":"You\u0027ll want to fix the copyrights","commit_id":"d70cbae0971017da49284a26e5551ee92dd8542f"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"87e333deea22840f79159715d7f7744857155a77","unresolved":false,"context_lines":[{"line_number":12,"context_line":"# License for the specific language governing permissions and limitations"},{"line_number":13,"context_line":"# under the License."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"from keystone.receipt import provider  # noqa"}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_10d20235","line":15,"range":{"start_line":15,"start_character":0,"end_line":15,"end_character":45},"updated":"2018-07-06 18:09:04.000000000","message":"Unless you are doing:\n\nfrom keystone import receipt\n\nand then\n\nreceipt.provider.XXXX\n\nRemove this import. The import was largely a legacy thing where we needed to import the providers to get them to load properly (~grizzly, havana era).","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"}],"keystone/receipt/provider.py":[{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"87e333deea22840f79159715d7f7744857155a77","unresolved":false,"context_lines":[{"line_number":46,"context_line":""},{"line_number":47,"context_line":"    \"\"\""},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"    driver_namespace \u003d \u0027keystone.receipt.provider\u0027"},{"line_number":50,"context_line":"    _provides_api \u003d \u0027receipt_provider_api\u0027"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"    def __init__(self):"}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_90e5b20c","line":49,"range":{"start_line":49,"start_character":23,"end_line":49,"end_character":50},"updated":"2018-07-06 18:09:04.000000000","message":"Please see comment on the \"driver\" bit.\n\nThis comment [and other driver comment] is not related to the -1.","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"87e333deea22840f79159715d7f7744857155a77","unresolved":false,"context_lines":[{"line_number":88,"context_line":"            return receipt_ref"},{"line_number":89,"context_line":"        except exception.Unauthorized as e:"},{"line_number":90,"context_line":"            LOG.debug(\u0027Unable to validate receipt: %s\u0027, e)"},{"line_number":91,"context_line":"            raise exception.ReceiptNotFound(receipt_id\u003dreceipt_id)"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"    @MEMOIZE_RECEIPTS"},{"line_number":94,"context_line":"    def _validate_receipt(self, receipt_id):"}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_90ce1281","line":91,"range":{"start_line":91,"start_character":28,"end_line":91,"end_character":43},"updated":"2018-07-06 18:09:04.000000000","message":"NOTE: If a receipt is not found, we need to make sure it turns into an Unauthorized not just a 404 (during the auth bit).\n\nRelated: Can receipts *ever* be validated independantly. I don\u0027t think they should be able to be, therefore this being an actual 404 is almost not needed. I would probably subclass ReceiptNotFound from Unauthorized and never risk bubbling up a 404 instead of a 401.","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"},{"author":{"_account_id":10420,"name":"Adrian Turjak","email":"devs+openstack@uncaught-exceptions.com","username":"adriant"},"change_message_id":"a12d60e39bae8152a5a216f827dd4208bb7b1372","unresolved":false,"context_lines":[{"line_number":88,"context_line":"            return receipt_ref"},{"line_number":89,"context_line":"        except exception.Unauthorized as e:"},{"line_number":90,"context_line":"            LOG.debug(\u0027Unable to validate receipt: %s\u0027, e)"},{"line_number":91,"context_line":"            raise exception.ReceiptNotFound(receipt_id\u003dreceipt_id)"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"    @MEMOIZE_RECEIPTS"},{"line_number":94,"context_line":"    def _validate_receipt(self, receipt_id):"}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_da49e0b7","line":91,"range":{"start_line":91,"start_character":28,"end_line":91,"end_character":43},"in_reply_to":"5f7c97a3_90ce1281","updated":"2018-07-10 03:27:36.000000000","message":"Done","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"87e333deea22840f79159715d7f7744857155a77","unresolved":false,"context_lines":[{"line_number":117,"context_line":"        if current_time \u003c expiry:"},{"line_number":118,"context_line":"            return None"},{"line_number":119,"context_line":"        else:"},{"line_number":120,"context_line":"            raise exception.ReceiptNotFound(_(\u0027Failed to validate receipt\u0027))"},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"    def issue_receipt(self, user_id, method_names, expires_at\u003dNone):"},{"line_number":123,"context_line":"        receipt_id, receipt_data \u003d self.driver.issue_receipt("}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_50c4fa5f","line":120,"range":{"start_line":120,"start_character":28,"end_line":120,"end_character":43},"updated":"2018-07-06 18:09:04.000000000","message":"Be sure (see other comments) that we do not expose \"failed to validate receipt\" to the end user in a failure state (vs. bad password or bad username). \n\nIn non-debug forms, this must be opaque and simply a bad username/password/receipt error (not specific which one).","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"},{"author":{"_account_id":10420,"name":"Adrian Turjak","email":"devs+openstack@uncaught-exceptions.com","username":"adriant"},"change_message_id":"a12d60e39bae8152a5a216f827dd4208bb7b1372","unresolved":false,"context_lines":[{"line_number":117,"context_line":"        if current_time \u003c expiry:"},{"line_number":118,"context_line":"            return None"},{"line_number":119,"context_line":"        else:"},{"line_number":120,"context_line":"            raise exception.ReceiptNotFound(_(\u0027Failed to validate receipt\u0027))"},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"    def issue_receipt(self, user_id, method_names, expires_at\u003dNone):"},{"line_number":123,"context_line":"        receipt_id, receipt_data \u003d self.driver.issue_receipt("}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_fa44dca0","line":120,"range":{"start_line":120,"start_character":28,"end_line":120,"end_character":43},"in_reply_to":"5f7c97a3_50c4fa5f","updated":"2018-07-10 03:27:36.000000000","message":"Done","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"}],"keystone/receipt/providers/base.py":[{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"87e333deea22840f79159715d7f7744857155a77","unresolved":false,"context_lines":[{"line_number":34,"context_line":"        :param issued_at: time the receipt was issued at"},{"line_number":35,"context_line":"        :type issued_at: string"},{"line_number":36,"context_line":"        \"\"\""},{"line_number":37,"context_line":"        raise exception.NotImplemented()  # pragma: no cover"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"    @abc.abstractmethod"},{"line_number":40,"context_line":"    def validate_receipt(self, receipt_ref):"}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_d0e1ead0","line":37,"range":{"start_line":37,"start_character":24,"end_line":37,"end_character":38},"updated":"2018-07-06 18:09:04.000000000","message":"AFAIK we\u0027re doing it wrong in keystone NotImplemented is HTTP-Method specific, aka: HTTP GET/PUT/ETC not implemented. This likely should cause a 500 error [the only case where a 500 is expected] and raise NotImplementedError","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e04dc5464c0735440d76d85630dea7de9cb11ca7","unresolved":false,"context_lines":[{"line_number":37,"context_line":"        raise exception.NotImplemented()  # pragma: no cover"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"    @abc.abstractmethod"},{"line_number":40,"context_line":"    def validate_receipt(self, receipt_ref):"},{"line_number":41,"context_line":"        \"\"\"Validate the given receipt and return the receipt_data."},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"        :param receipt_ref: the receipt reference"}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_51c5c03b","line":40,"range":{"start_line":40,"start_character":31,"end_line":40,"end_character":42},"updated":"2018-07-09 19:09:45.000000000","message":"From the perspective of someone trying to implement this interface, I have no idea what this means. A lot of what we\u0027re doing here is *very* similar to the patterns we had in the token provider APIs for years, which made that API ridiculously complicated to understand.\n\nI fear recreating that complexity here by using those practices.","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e04dc5464c0735440d76d85630dea7de9cb11ca7","unresolved":false,"context_lines":[{"line_number":41,"context_line":"        \"\"\"Validate the given receipt and return the receipt_data."},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"        :param receipt_ref: the receipt reference"},{"line_number":44,"context_line":"        :type receipt_ref: dict"},{"line_number":45,"context_line":"        :returns: receipt data"},{"line_number":46,"context_line":"        :raises keystone.exception.ReceiptNotFound:"},{"line_number":47,"context_line":"            If the receipt doesn\u0027t exist."}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_d1deb00e","line":44,"range":{"start_line":44,"start_character":27,"end_line":44,"end_character":31},"updated":"2018-07-09 19:09:45.000000000","message":"A dictionary of what? Even if we\u0027re only implementing a single pluggable solution, we should try and write this interface as if *everyone* wants to provide their own.","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e04dc5464c0735440d76d85630dea7de9cb11ca7","unresolved":false,"context_lines":[{"line_number":49,"context_line":"        raise exception.NotImplemented()  # pragma: no cover"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"    @abc.abstractmethod"},{"line_number":52,"context_line":"    def _get_receipt_id(self, receipt_data):"},{"line_number":53,"context_line":"        \"\"\"Generate the receipt_id based upon the data in receipt_data."},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"        :param receipt_data: receipt information"}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_b1c5340c","line":52,"range":{"start_line":52,"start_character":8,"end_line":52,"end_character":23},"updated":"2018-07-09 19:09:45.000000000","message":"It\u0027s always felt strange to me for an interface to mandate which *private* methods implementations need to adhere to.\n\nIf the logic above this layer relies on this method, it should be public. We should never guarantee on a specific set of private methods being available across implementations.","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e04dc5464c0735440d76d85630dea7de9cb11ca7","unresolved":false,"context_lines":[{"line_number":53,"context_line":"        \"\"\"Generate the receipt_id based upon the data in receipt_data."},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"        :param receipt_data: receipt information"},{"line_number":56,"context_line":"        :type receipt_data: dict"},{"line_number":57,"context_line":"        :returns: receipt identifier"},{"line_number":58,"context_line":"        :rtype: six.text_type"},{"line_number":59,"context_line":"        \"\"\""}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_91cef829","line":56,"range":{"start_line":56,"start_character":28,"end_line":56,"end_character":32},"updated":"2018-07-09 19:09:45.000000000","message":"Similar comment here as above.","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"}],"keystone/receipt/providers/common.py":[{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"87e333deea22840f79159715d7f7744857155a77","unresolved":false,"context_lines":[{"line_number":12,"context_line":"# License for the specific language governing permissions and limitations"},{"line_number":13,"context_line":"# under the License."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"from __future__ import absolute_import"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"import base64"},{"line_number":18,"context_line":"import datetime"}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_30085e8f","line":15,"range":{"start_line":15,"start_character":0,"end_line":15,"end_character":38},"updated":"2018-07-06 18:09:04.000000000","message":"[NIT/Not important for scoring, no change needed]: We should stop using \"common\" in general, it causes headaches with importing. absolute_import should be the default in py3 and in some cases STILL runs into issues.\n\nConsider naming the module: receipt_provider_common or similar. It is fine to leave this as-is for now.","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e04dc5464c0735440d76d85630dea7de9cb11ca7","unresolved":false,"context_lines":[{"line_number":37,"context_line":"PROVIDERS \u003d provider_api.ProviderAPIs"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"def default_expire_time():"},{"line_number":41,"context_line":"    \"\"\"Determine when a fresh receipt should expire."},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"    Expiration time varies based on configuration (see"}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_71a55cb3","line":40,"range":{"start_line":40,"start_character":4,"end_line":40,"end_character":23},"updated":"2018-07-09 19:09:45.000000000","message":"nit: We define another method like this in the token provider API. I think we should either make the existing method generic enough to support both use cases (for receipts and tokens) or make the name of this one specific to receipts.","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"87e333deea22840f79159715d7f7744857155a77","unresolved":false,"context_lines":[{"line_number":51,"context_line":"    return expires_at.replace(microsecond\u003d0)"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"def random_urlsafe_str():"},{"line_number":55,"context_line":"    \"\"\"Generate a random URL-safe string."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"    :rtype: six.text_type"}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_90f8527c","line":54,"range":{"start_line":54,"start_character":4,"end_line":54,"end_character":22},"updated":"2018-07-06 18:09:04.000000000","message":"I am not seeing where this is used.","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e04dc5464c0735440d76d85630dea7de9cb11ca7","unresolved":false,"context_lines":[{"line_number":51,"context_line":"    return expires_at.replace(microsecond\u003d0)"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"def random_urlsafe_str():"},{"line_number":55,"context_line":"    \"\"\"Generate a random URL-safe string."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"    :rtype: six.text_type"}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_d18b101b","line":54,"range":{"start_line":54,"start_character":4,"end_line":54,"end_character":22},"in_reply_to":"5f7c97a3_90f8527c","updated":"2018-07-09 19:09:45.000000000","message":"Yeah - I think this is safe to remove.","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"87e333deea22840f79159715d7f7744857155a77","unresolved":false,"context_lines":[{"line_number":80,"context_line":"            msg \u003d _(\u0027Unable to validate receipt because domain %(id)s is \u0027"},{"line_number":81,"context_line":"                    \u0027disabled\u0027) % {\u0027id\u0027: domain_ref[\u0027id\u0027]}"},{"line_number":82,"context_line":"            LOG.warning(msg)"},{"line_number":83,"context_line":"            raise exception.DomainNotFound(msg)"},{"line_number":84,"context_line":"        return {\u0027id\u0027: domain_ref[\u0027id\u0027], \u0027name\u0027: domain_ref[\u0027name\u0027]}"},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"    def _populate_user(self, receipt_data, user_id):"}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_f032e65c","line":83,"range":{"start_line":83,"start_character":28,"end_line":83,"end_character":42},"updated":"2018-07-06 18:09:04.000000000","message":"Ensure we are bubbling up 401s where appropriate. This may be 100% ok as is.","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"},{"author":{"_account_id":10420,"name":"Adrian Turjak","email":"devs+openstack@uncaught-exceptions.com","username":"adriant"},"change_message_id":"a12d60e39bae8152a5a216f827dd4208bb7b1372","unresolved":false,"context_lines":[{"line_number":80,"context_line":"            msg \u003d _(\u0027Unable to validate receipt because domain %(id)s is \u0027"},{"line_number":81,"context_line":"                    \u0027disabled\u0027) % {\u0027id\u0027: domain_ref[\u0027id\u0027]}"},{"line_number":82,"context_line":"            LOG.warning(msg)"},{"line_number":83,"context_line":"            raise exception.DomainNotFound(msg)"},{"line_number":84,"context_line":"        return {\u0027id\u0027: domain_ref[\u0027id\u0027], \u0027name\u0027: domain_ref[\u0027name\u0027]}"},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"    def _populate_user(self, receipt_data, user_id):"}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_3d91ee9a","line":83,"range":{"start_line":83,"start_character":28,"end_line":83,"end_character":42},"in_reply_to":"5f7c97a3_f032e65c","updated":"2018-07-10 03:27:36.000000000","message":"taken directly from the token code... unsure if this does bubble up a 401 even there.","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"}],"keystone/receipt/providers/fernet/__init__.py":[{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"87e333deea22840f79159715d7f7744857155a77","unresolved":false,"context_lines":[{"line_number":12,"context_line":"# License for the specific language governing permissions and limitations"},{"line_number":13,"context_line":"# under the License."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"from keystone.receipt.providers.fernet.core import *  # noqa"}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_703ed626","line":15,"range":{"start_line":15,"start_character":0,"end_line":15,"end_character":60},"updated":"2018-07-06 18:09:04.000000000","message":"See other comment about __init__ imports.","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"}],"keystone/receipt/receipt_formatters.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e04dc5464c0735440d76d85630dea7de9cb11ca7","unresolved":false,"context_lines":[{"line_number":143,"context_line":"        serialized_payload \u003d msgpack.packb(payload)"},{"line_number":144,"context_line":"        receipt \u003d self.pack(serialized_payload)"},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"        # NOTE(lbragstad): We should warn against Fernet receipts that are over"},{"line_number":147,"context_line":"        # 255 characters in length. This is mostly due to persisting the"},{"line_number":148,"context_line":"        # receipts in a backend store of some kind that might have a limit of"},{"line_number":149,"context_line":"        # 255 characters. Even though Keystone isn\u0027t storing a Fernet receipt"},{"line_number":150,"context_line":"        # anywhere, we can\u0027t say it isn\u0027t being stored somewhere else with"},{"line_number":151,"context_line":"        # those kind of backend constraints."},{"line_number":152,"context_line":"        if len(receipt) \u003e 255:"},{"line_number":153,"context_line":"            LOG.info(\u0027Fernet receipt created with length of %d \u0027"},{"line_number":154,"context_line":"                     \u0027characters, which exceeds 255 characters\u0027,"}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_34111254","line":151,"range":{"start_line":146,"start_character":7,"end_line":151,"end_character":44},"updated":"2018-07-09 19:09:45.000000000","message":"Does this still apply to receipts?","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e04dc5464c0735440d76d85630dea7de9cb11ca7","unresolved":false,"context_lines":[{"line_number":163,"context_line":""},{"line_number":164,"context_line":"        \"\"\""},{"line_number":165,"context_line":"        serialized_payload \u003d self.unpack(receipt)"},{"line_number":166,"context_line":"        payload \u003d msgpack.unpackb(serialized_payload)"},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"        (user_id, methods, expires_at) \u003d ReceiptPayload.disassemble(payload)"},{"line_number":169,"context_line":""},{"line_number":170,"context_line":"        # rather than appearing in the payload, the creation time is encoded"},{"line_number":171,"context_line":"        # into the receipt format itself"},{"line_number":172,"context_line":"        issued_at \u003d ReceiptFormatter.creation_time(receipt)"},{"line_number":173,"context_line":"        issued_at \u003d ks_utils.isotime(at\u003dissued_at, subsecond\u003dTrue)"},{"line_number":174,"context_line":"        expires_at \u003d timeutils.parse_isotime(expires_at)"},{"line_number":175,"context_line":"        expires_at \u003d ks_utils.isotime(at\u003dexpires_at, subsecond\u003dTrue)"},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"        return (user_id, methods, issued_at, expires_at)"},{"line_number":178,"context_line":""},{"line_number":179,"context_line":""},{"line_number":180,"context_line":"class ReceiptPayload(object):"}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_d400de02","line":177,"range":{"start_line":166,"start_character":8,"end_line":177,"end_character":56},"updated":"2018-07-09 19:09:45.000000000","message":"According to the coverage report, this appears to be untested?\n\nhttp://logs.openstack.org/86/572286/15/check/openstack-tox-cover/3df423b/cover/keystone_receipt_receipt_formatters_py.html#n159","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"},{"author":{"_account_id":10420,"name":"Adrian Turjak","email":"devs+openstack@uncaught-exceptions.com","username":"adriant"},"change_message_id":"a12d60e39bae8152a5a216f827dd4208bb7b1372","unresolved":false,"context_lines":[{"line_number":163,"context_line":""},{"line_number":164,"context_line":"        \"\"\""},{"line_number":165,"context_line":"        serialized_payload \u003d self.unpack(receipt)"},{"line_number":166,"context_line":"        payload \u003d msgpack.unpackb(serialized_payload)"},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"        (user_id, methods, expires_at) \u003d ReceiptPayload.disassemble(payload)"},{"line_number":169,"context_line":""},{"line_number":170,"context_line":"        # rather than appearing in the payload, the creation time is encoded"},{"line_number":171,"context_line":"        # into the receipt format itself"},{"line_number":172,"context_line":"        issued_at \u003d ReceiptFormatter.creation_time(receipt)"},{"line_number":173,"context_line":"        issued_at \u003d ks_utils.isotime(at\u003dissued_at, subsecond\u003dTrue)"},{"line_number":174,"context_line":"        expires_at \u003d timeutils.parse_isotime(expires_at)"},{"line_number":175,"context_line":"        expires_at \u003d ks_utils.isotime(at\u003dexpires_at, subsecond\u003dTrue)"},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"        return (user_id, methods, issued_at, expires_at)"},{"line_number":178,"context_line":""},{"line_number":179,"context_line":""},{"line_number":180,"context_line":"class ReceiptPayload(object):"}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_fdb4d61e","line":177,"range":{"start_line":166,"start_character":8,"end_line":177,"end_character":56},"in_reply_to":"5f7c97a3_d400de02","updated":"2018-07-10 03:27:36.000000000","message":"Looks like that\u0027s because we cache on issue, and then don\u0027t need to validate it at all. This gets hit when I turn caching on issue off in the tests.\n\nSo I need a test that turns caching off, or as mentioned elsewhere, drop caching entirely.","commit_id":"4106cf58ee51c5cf249bb53364f110dc2f0cdc7e"}],"keystone/tests/unit/test_v3_auth.py":[{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"05e660b9007770fa64591cc0d883c142f444f698","unresolved":false,"context_lines":[{"line_number":272,"context_line":"        # unauthorized is expected"},{"line_number":273,"context_line":"        rule_list \u003d [[\u0027password\u0027, \u0027totp\u0027]]"},{"line_number":274,"context_line":"        self._update_user_with_MFA_rules(rule_list\u003drule_list)"},{"line_number":275,"context_line":"        # NOTE(notmorgan): Step forward in time to ensure we\u0027re not causing"},{"line_number":276,"context_line":"        # issues with revocation events that occur at the same time as the"},{"line_number":277,"context_line":"        # token issuance. This is a bug with the limited resolution that"},{"line_number":278,"context_line":"        # tokens and revocation events have."},{"line_number":279,"context_line":"        time \u003d datetime.datetime.utcnow() + datetime.timedelta(seconds\u003d5)"},{"line_number":280,"context_line":"        with freezegun.freeze_time(time):"},{"line_number":281,"context_line":"            response \u003d self.admin_request("},{"line_number":282,"context_line":"                method\u003d\u0027POST\u0027,"},{"line_number":283,"context_line":"                path\u003d\u0027/v3/auth/tokens\u0027,"}],"source_content_type":"text/x-python","patch_set":8,"id":"5f7c97a3_6722dfbc","line":280,"range":{"start_line":275,"start_character":0,"end_line":280,"end_character":41},"updated":"2018-06-20 19:25:59.000000000","message":"Is this relevant for receipts?","commit_id":"d70cbae0971017da49284a26e5551ee92dd8542f"},{"author":{"_account_id":10420,"name":"Adrian Turjak","email":"devs+openstack@uncaught-exceptions.com","username":"adriant"},"change_message_id":"7f319e70b862e074bd9c162d92b0c7ee3451cbc3","unresolved":false,"context_lines":[{"line_number":272,"context_line":"        # unauthorized is expected"},{"line_number":273,"context_line":"        rule_list \u003d [[\u0027password\u0027, \u0027totp\u0027]]"},{"line_number":274,"context_line":"        self._update_user_with_MFA_rules(rule_list\u003drule_list)"},{"line_number":275,"context_line":"        # NOTE(notmorgan): Step forward in time to ensure we\u0027re not causing"},{"line_number":276,"context_line":"        # issues with revocation events that occur at the same time as the"},{"line_number":277,"context_line":"        # token issuance. This is a bug with the limited resolution that"},{"line_number":278,"context_line":"        # tokens and revocation events have."},{"line_number":279,"context_line":"        time \u003d datetime.datetime.utcnow() + datetime.timedelta(seconds\u003d5)"},{"line_number":280,"context_line":"        with freezegun.freeze_time(time):"},{"line_number":281,"context_line":"            response \u003d self.admin_request("},{"line_number":282,"context_line":"                method\u003d\u0027POST\u0027,"},{"line_number":283,"context_line":"                path\u003d\u0027/v3/auth/tokens\u0027,"}],"source_content_type":"text/x-python","patch_set":8,"id":"5f7c97a3_d912b3b4","line":280,"range":{"start_line":275,"start_character":0,"end_line":280,"end_character":41},"in_reply_to":"5f7c97a3_6722dfbc","updated":"2018-06-21 04:12:45.000000000","message":"Technically only for the tests where we consume a receipt and get a real token perhaps. Best to get Morgan to weigh in on this, as I just copied what he did from the MFA tests.","commit_id":"d70cbae0971017da49284a26e5551ee92dd8542f"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"05e660b9007770fa64591cc0d883c142f444f698","unresolved":false,"context_lines":[{"line_number":278,"context_line":"        # tokens and revocation events have."},{"line_number":279,"context_line":"        time \u003d datetime.datetime.utcnow() + datetime.timedelta(seconds\u003d5)"},{"line_number":280,"context_line":"        with freezegun.freeze_time(time):"},{"line_number":281,"context_line":"            response \u003d self.admin_request("},{"line_number":282,"context_line":"                method\u003d\u0027POST\u0027,"},{"line_number":283,"context_line":"                path\u003d\u0027/v3/auth/tokens\u0027,"},{"line_number":284,"context_line":"                body\u003dself.build_authentication_request("}],"source_content_type":"text/x-python","patch_set":8,"id":"5f7c97a3_e2257daf","line":281,"range":{"start_line":281,"start_character":28,"end_line":281,"end_character":41},"updated":"2018-06-20 19:25:59.000000000","message":"This could probably be self.public_request right?","commit_id":"d70cbae0971017da49284a26e5551ee92dd8542f"},{"author":{"_account_id":10420,"name":"Adrian Turjak","email":"devs+openstack@uncaught-exceptions.com","username":"adriant"},"change_message_id":"7f319e70b862e074bd9c162d92b0c7ee3451cbc3","unresolved":false,"context_lines":[{"line_number":278,"context_line":"        # tokens and revocation events have."},{"line_number":279,"context_line":"        time \u003d datetime.datetime.utcnow() + datetime.timedelta(seconds\u003d5)"},{"line_number":280,"context_line":"        with freezegun.freeze_time(time):"},{"line_number":281,"context_line":"            response \u003d self.admin_request("},{"line_number":282,"context_line":"                method\u003d\u0027POST\u0027,"},{"line_number":283,"context_line":"                path\u003d\u0027/v3/auth/tokens\u0027,"},{"line_number":284,"context_line":"                body\u003dself.build_authentication_request("}],"source_content_type":"text/x-python","patch_set":8,"id":"5f7c97a3_b934974a","line":281,"range":{"start_line":281,"start_character":28,"end_line":281,"end_character":41},"in_reply_to":"5f7c97a3_e2257daf","updated":"2018-06-21 04:12:45.000000000","message":"oh, yeah.\n\nI was just using that because that\u0027s what self.v3_create_token( calls if you follow the logic.\n\nWill swap out.","commit_id":"d70cbae0971017da49284a26e5551ee92dd8542f"}]}