)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"change_message_id":"d6fb635168c7e9f5f5dc359b068d06db60219f18","unresolved":false,"context_lines":[{"line_number":14,"context_line":"as the code is incorrect, and a 500 \"ISE\" should never be expected)."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Change-Id: I4895242555d2e9761e035d879ca2dfeb6d9b387c"},{"line_number":17,"context_line":"Parital-Bug: #1776504"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"5f7c97a3_dfa08ea7","line":17,"range":{"start_line":17,"start_character":0,"end_line":17,"end_character":11},"updated":"2018-06-30 15:37:19.000000000","message":"Same typo twice in a row, I\u0027m impressed.","commit_id":"d0ebf2d5477d27630bc70a9d1986ed73e8bc74a7"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"e506242449bb15bb5e6a61671a33eabf4f169ff7","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Morgan Fainberg \u003cmorgan.fainberg@gmail.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2018-07-01 14:51:19 +0000"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Address minor comments from initial implementation"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"RBACEnforcer had a couple minor comments and this addresses all"},{"line_number":10,"context_line":"except for adding explicit system-scope enforcement tests."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"5f7c97a3_a126c2ca","line":7,"updated":"2018-07-02 16:15:49.000000000","message":"initial implementation of what?  Remember, this one line is what shows in history.  Make it expressive.","commit_id":"f9da66865e4205dbb21be38671316fe8754fd52b"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"e506242449bb15bb5e6a61671a33eabf4f169ff7","unresolved":false,"context_lines":[{"line_number":9,"context_line":"RBACEnforcer had a couple minor comments and this addresses all"},{"line_number":10,"context_line":"except for adding explicit system-scope enforcement tests."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Notably invalid \"action\" (policy rule name) now correctly raises"},{"line_number":13,"context_line":"ForbiddenAction instead of Unauthorized (it can never be authorized"},{"line_number":14,"context_line":"as the code is incorrect, and a 500 \"ISE\" should never be expected)."},{"line_number":15,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"5f7c97a3_611aea7c","line":12,"updated":"2018-07-02 16:15:49.000000000","message":"maybe make this the summary line?","commit_id":"f9da66865e4205dbb21be38671316fe8754fd52b"}],"keystone/common/rbac_enforcer/enforcer.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"fbfa32f82ead905ab1942c975203ad04fe483377","unresolved":false,"context_lines":[{"line_number":281,"context_line":"        action \u003d action or getattr(flask.g, cls.ACTION_STORE_ATTR, None)"},{"line_number":282,"context_line":"        if action not in _POSSIBLE_TARGET_ACTIONS:"},{"line_number":283,"context_line":"            LOG.warning(\u0027RBAC: Unknown enforcement action name `%s`. \u0027"},{"line_number":284,"context_line":"                        \u0027Rejecting as Forbidden, this is a programming error \u0027"},{"line_number":285,"context_line":"                        \u0027and a bug should be filed with as much information \u0027"},{"line_number":286,"context_line":"                        \u0027about the request that caused this as possible.\u0027,"},{"line_number":287,"context_line":"                        action)"}],"source_content_type":"text/x-python","patch_set":5,"id":"5f7c97a3_bd980869","line":284,"range":{"start_line":284,"start_character":25,"end_line":284,"end_character":47},"updated":"2018-07-03 19:27:49.000000000","message":"Doesn\u0027t this go against the blanket default an operator can define? I think they can say \"yep, allow undefined operations through\" or \"no, deny anything that you\u0027ve never seen before\".\n\nObviously the first seems like a bad idea, but this breaks this, doesn\u0027t it?","commit_id":"6d1456061defc016529b3c7c89edb7618b117267"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c586d875f5186917ed40afea70569481d0162ac8","unresolved":false,"context_lines":[{"line_number":281,"context_line":"        action \u003d action or getattr(flask.g, cls.ACTION_STORE_ATTR, None)"},{"line_number":282,"context_line":"        if action not in _POSSIBLE_TARGET_ACTIONS:"},{"line_number":283,"context_line":"            LOG.warning(\u0027RBAC: Unknown enforcement action name `%s`. \u0027"},{"line_number":284,"context_line":"                        \u0027Rejecting as Forbidden, this is a programming error \u0027"},{"line_number":285,"context_line":"                        \u0027and a bug should be filed with as much information \u0027"},{"line_number":286,"context_line":"                        \u0027about the request that caused this as possible.\u0027,"},{"line_number":287,"context_line":"                        action)"}],"source_content_type":"text/x-python","patch_set":5,"id":"5f7c97a3_85ed4e25","line":284,"range":{"start_line":284,"start_character":25,"end_line":284,"end_character":47},"in_reply_to":"5f7c97a3_2577fed3","updated":"2018-07-09 21:33:29.000000000","message":"Ok - thanks for the response.","commit_id":"6d1456061defc016529b3c7c89edb7618b117267"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"6bf80c97e139d8ba3ebdaa996d027427a2077557","unresolved":false,"context_lines":[{"line_number":281,"context_line":"        action \u003d action or getattr(flask.g, cls.ACTION_STORE_ATTR, None)"},{"line_number":282,"context_line":"        if action not in _POSSIBLE_TARGET_ACTIONS:"},{"line_number":283,"context_line":"            LOG.warning(\u0027RBAC: Unknown enforcement action name `%s`. \u0027"},{"line_number":284,"context_line":"                        \u0027Rejecting as Forbidden, this is a programming error \u0027"},{"line_number":285,"context_line":"                        \u0027and a bug should be filed with as much information \u0027"},{"line_number":286,"context_line":"                        \u0027about the request that caused this as possible.\u0027,"},{"line_number":287,"context_line":"                        action)"}],"source_content_type":"text/x-python","patch_set":5,"id":"5f7c97a3_2577fed3","line":284,"range":{"start_line":284,"start_character":25,"end_line":284,"end_character":47},"in_reply_to":"5f7c97a3_bd980869","updated":"2018-07-03 20:34:55.000000000","message":"So, First of all, this indicative of a programming error, we define all default rules for all actions in code now.\n\nPrevious to policy-in-code, this feature was more relevant (and still just as dumb to allow keystone to be permissive).\n\nI\u0027ve not taken anything away here, I\u0027ve simply doubled down on the policy-defined-in-code. If it isn\u0027t defined as an action, it\u0027s a 403, you can\u0027t perform an unknown action against keystone.\n\nYep, I\u0027m willing to be more opinionated here.","commit_id":"6d1456061defc016529b3c7c89edb7618b117267"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"fbfa32f82ead905ab1942c975203ad04fe483377","unresolved":false,"context_lines":[{"line_number":294,"context_line":"            raise exception.Forbidden("},{"line_number":295,"context_line":"                message\u003d_("},{"line_number":296,"context_line":"                    \u0027Internal RBAC enforcement error, invalid rule (action) \u0027"},{"line_number":297,"context_line":"                    \u0027name.\u0027))"},{"line_number":298,"context_line":""},{"line_number":299,"context_line":"        # Mark flask.g as \"enforce_call\" has been called. This should occur"},{"line_number":300,"context_line":"        # before anything except the \"is this a valid action\" check, ensuring"}],"source_content_type":"text/x-python","patch_set":5,"id":"5f7c97a3_fd89a024","line":297,"updated":"2018-07-03 19:27:49.000000000","message":"I\u0027m being verbose here, but nothing is use enforce_call yet - so technically this hasn\u0027t leaked through our API yet, right? Thus, the change should be ok?","commit_id":"6d1456061defc016529b3c7c89edb7618b117267"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"6bf80c97e139d8ba3ebdaa996d027427a2077557","unresolved":false,"context_lines":[{"line_number":294,"context_line":"            raise exception.Forbidden("},{"line_number":295,"context_line":"                message\u003d_("},{"line_number":296,"context_line":"                    \u0027Internal RBAC enforcement error, invalid rule (action) \u0027"},{"line_number":297,"context_line":"                    \u0027name.\u0027))"},{"line_number":298,"context_line":""},{"line_number":299,"context_line":"        # Mark flask.g as \"enforce_call\" has been called. This should occur"},{"line_number":300,"context_line":"        # before anything except the \"is this a valid action\" check, ensuring"}],"source_content_type":"text/x-python","patch_set":5,"id":"5f7c97a3_c5496a8e","line":297,"in_reply_to":"5f7c97a3_fd89a024","updated":"2018-07-03 20:34:55.000000000","message":"Correct. Nothing has used enforce call (except tests of enforce_call)","commit_id":"6d1456061defc016529b3c7c89edb7618b117267"}]}