)]}'
{"keystone/limit/controllers.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"64859131756ca4e785d07bbf0c4961927bc56de1","unresolved":false,"context_lines":[{"line_number":112,"context_line":"            project_id_filter \u003d hints.get_exact_filter_by_name(\u0027project_id\u0027)"},{"line_number":113,"context_line":"            if project_id_filter and not context.service_token:"},{"line_number":114,"context_line":"                action \u003d _(\"The request should be admin or service when\""},{"line_number":115,"context_line":"                           \"project_id filter is used.\")"},{"line_number":116,"context_line":"                raise exception.Forbidden(action\u003daction)"},{"line_number":117,"context_line":"            project_id \u003d context.project_id"},{"line_number":118,"context_line":"            if project_id:"}],"source_content_type":"text/x-python","patch_set":2,"id":"5f7c97a3_031e9f0c","line":115,"updated":"2018-07-02 14:12:54.000000000","message":"Technically, the admin check is happening in policy, right? A deployment *could* change that to not require and administrator. Since this check is decoupled from that one, we should make this error message specific to service accounts.\n\nAt the same time, this is only going to get this far if the client passes the policy check.","commit_id":"7f1dede630042f3d1002cb9e9f3a0e2ccc80f9ad"},{"author":{"_account_id":15054,"name":"wangxiyuan","email":"wangxiyuan1007@gmail.com","username":"wangxiyuan"},"change_message_id":"2c7448db92a42ba8891a4669706ee4080bd16b66","unresolved":false,"context_lines":[{"line_number":112,"context_line":"            project_id_filter \u003d hints.get_exact_filter_by_name(\u0027project_id\u0027)"},{"line_number":113,"context_line":"            if project_id_filter and not context.service_token:"},{"line_number":114,"context_line":"                action \u003d _(\"The request should be admin or service when\""},{"line_number":115,"context_line":"                           \"project_id filter is used.\")"},{"line_number":116,"context_line":"                raise exception.Forbidden(action\u003daction)"},{"line_number":117,"context_line":"            project_id \u003d context.project_id"},{"line_number":118,"context_line":"            if project_id:"}],"source_content_type":"text/x-python","patch_set":2,"id":"5f7c97a3_f56f86c1","line":115,"in_reply_to":"5f7c97a3_031e9f0c","updated":"2018-07-03 09:02:08.000000000","message":"list_limits is open for both admin and non-admin by default. non-admin can get its project\u0027s limit, admin can get all projects\u0027 limit.\n\nHere I want to check a case that no matter how this API\u0027s policy changing, the \"project_id\" filter should be only used for admin or service. i.e. only the request is not admin or service and using project_id, the error will raise.","commit_id":"7f1dede630042f3d1002cb9e9f3a0e2ccc80f9ad"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"7631a06db02478b25c36bdee6615c66672b00acb","unresolved":false,"context_lines":[{"line_number":112,"context_line":"            project_id_filter \u003d hints.get_exact_filter_by_name(\u0027project_id\u0027)"},{"line_number":113,"context_line":"            # TODO(wxy): Use oslo.policy to check the filter once it supports."},{"line_number":114,"context_line":"            if project_id_filter:"},{"line_number":115,"context_line":"                if (\u0027service\u0027 not in context.roles and"},{"line_number":116,"context_line":"                        not context.service_token):"},{"line_number":117,"context_line":"                    action \u003d _(\"The request should be admin or service when\""},{"line_number":118,"context_line":"                               \"project_id filter is used.\")"}],"source_content_type":"text/x-python","patch_set":8,"id":"5f7c97a3_66f278e5","line":115,"range":{"start_line":115,"start_character":20,"end_line":115,"end_character":29},"updated":"2018-07-10 01:15:40.000000000","message":"(Comment reason for -1) Do not hard-code any role names. We have battled hard-coded role names for ages. you may specify a rule where \u0027service\u0027 is in the default. However, a hard-coded role name means this cannot be merged, even if it is a \"NOT\" check.","commit_id":"eb49dc4c9092f2a36690a3233dc08f2d33fe4c09"},{"author":{"_account_id":15054,"name":"wangxiyuan","email":"wangxiyuan1007@gmail.com","username":"wangxiyuan"},"change_message_id":"f917f6feafd8a3413077dff6ecc7f85aceedb871","unresolved":false,"context_lines":[{"line_number":113,"context_line":"            # TODO(wxy): Use oslo.policy to check the filter once it supports."},{"line_number":114,"context_line":"            if project_id_filter:"},{"line_number":115,"context_line":"                if (\u0027service\u0027 not in context.roles and"},{"line_number":116,"context_line":"                        not context.service_token):"},{"line_number":117,"context_line":"                    action \u003d _(\"The request should be admin or service when\""},{"line_number":118,"context_line":"                               \"project_id filter is used.\")"},{"line_number":119,"context_line":"                    raise exception.Forbidden(action\u003daction)"}],"source_content_type":"text/x-python","patch_set":8,"id":"5f7c97a3_df58e925","line":116,"range":{"start_line":116,"start_character":28,"end_line":116,"end_character":49},"updated":"2018-07-10 09:25:32.000000000","message":"\"service_token_roles_required\" is False by default in keystonemiddleware, it means that every token can act as \"service token\" by default, so we should not allow \"service token\" to use project_id filter now.","commit_id":"eb49dc4c9092f2a36690a3233dc08f2d33fe4c09"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"7631a06db02478b25c36bdee6615c66672b00acb","unresolved":false,"context_lines":[{"line_number":112,"context_line":"            project_id_filter \u003d hints.get_exact_filter_by_name(\u0027project_id\u0027)"},{"line_number":113,"context_line":"            # TODO(wxy): Use oslo.policy to check the filter once it supports."},{"line_number":114,"context_line":"            if project_id_filter:"},{"line_number":115,"context_line":"                if (\u0027service\u0027 not in context.roles and"},{"line_number":116,"context_line":"                        not context.service_token):"},{"line_number":117,"context_line":"                    action \u003d _(\"The request should be admin or service when\""},{"line_number":118,"context_line":"                               \"project_id filter is used.\")"},{"line_number":119,"context_line":"                    raise exception.Forbidden(action\u003daction)"},{"line_number":120,"context_line":"            else:"},{"line_number":121,"context_line":"                project_id \u003d context.project_id"}],"source_content_type":"text/x-python","patch_set":8,"id":"5f7c97a3_467c1c1f","line":118,"range":{"start_line":115,"start_character":15,"end_line":118,"end_character":60},"updated":"2018-07-10 01:15:40.000000000","message":"Unfortunately, this is simply the nature of the beast regarding the filter-existing. For now, just remove the project_id filter support. We can add it back in when we have more fidelity in the RBAC enforcement. As this is going to require additional policy checks, it wont be something we can land until Stein or until we move to flask and I can open up the creds dict.\n\nThe alternative is to use the callback implementation and write your entire creds/target dict where the filter data is added in both places so that the default rule can easily check it.\n\nYou\u0027d need something like creds[\u0027filters\u0027] \u003d\u003e [\u003c...filter_name...\u003e: \u003c...filter value...\u003e and a mirror in the target dict and that would need to be built and passed directly to the oslo-policy enforcer with a sane default-rule being implemented that handled the \"OR\" case.\n\nTL;DR - I encourage dropping \"project_id\" filter or only lock on \"service-token\" (for now, so any service token can filter but non-service tokens cannot - we can expand this to proper policy-dsl later). An alternative is to make a filter-specific API service users are meant to utilize.","commit_id":"eb49dc4c9092f2a36690a3233dc08f2d33fe4c09"},{"author":{"_account_id":15054,"name":"wangxiyuan","email":"wangxiyuan1007@gmail.com","username":"wangxiyuan"},"change_message_id":"c3aa2669659c50d1b0c40419f219dd1321e670bc","unresolved":false,"context_lines":[{"line_number":112,"context_line":"            project_id_filter \u003d hints.get_exact_filter_by_name(\u0027project_id\u0027)"},{"line_number":113,"context_line":"            # TODO(wxy): Use oslo.policy to check the filter once it supports."},{"line_number":114,"context_line":"            if project_id_filter:"},{"line_number":115,"context_line":"                if (\u0027service\u0027 not in context.roles and"},{"line_number":116,"context_line":"                        not context.service_token):"},{"line_number":117,"context_line":"                    action \u003d _(\"The request should be admin or service when\""},{"line_number":118,"context_line":"                               \"project_id filter is used.\")"},{"line_number":119,"context_line":"                    raise exception.Forbidden(action\u003daction)"},{"line_number":120,"context_line":"            else:"},{"line_number":121,"context_line":"                project_id \u003d context.project_id"}],"source_content_type":"text/x-python","patch_set":8,"id":"5f7c97a3_1a967895","line":118,"range":{"start_line":115,"start_character":15,"end_line":118,"end_character":60},"in_reply_to":"5f7c97a3_467c1c1f","updated":"2018-07-10 03:40:49.000000000","message":"++,","commit_id":"eb49dc4c9092f2a36690a3233dc08f2d33fe4c09"}],"keystone/tests/unit/test_limits.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"b851be5b1b21a58749852c16b5bc85af3509276a","unresolved":false,"context_lines":[{"line_number":726,"context_line":"                    \u0027resource_limit\u0027]:"},{"line_number":727,"context_line":"            self.assertEqual(limits[0][key], ref1[key])"},{"line_number":728,"context_line":""},{"line_number":729,"context_line":"    def _create_auth_body(self, project_id):"},{"line_number":730,"context_line":"        auth \u003d {"},{"line_number":731,"context_line":"            \u0027auth\u0027: {"},{"line_number":732,"context_line":"                \u0027identity\u0027: {"}],"source_content_type":"text/x-python","patch_set":8,"id":"5f7c97a3_5a6395dd","line":729,"range":{"start_line":729,"start_character":8,"end_line":729,"end_character":25},"updated":"2018-07-09 20:38:19.000000000","message":"You should be able to reuse the utilities in common_auth since it\u0027s being inherited via test_v3.RestfulTestCase\n\nhttps://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/common/auth.py#n17","commit_id":"eb49dc4c9092f2a36690a3233dc08f2d33fe4c09"}]}