)]}'
{"keystone/api/groups.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ea6cd1f8f370f6fc2a9be2d0abd14870449c7fb2","unresolved":false,"context_lines":[{"line_number":108,"context_line":"        target \u003d {}"},{"line_number":109,"context_line":"        try:"},{"line_number":110,"context_line":"            target[\u0027group\u0027] \u003d PROVIDERS.identity_api.get_group(group_id)"},{"line_number":111,"context_line":"        except exception.GroupNotFound:"},{"line_number":112,"context_line":"            # NOTE(morgan): If we have an issue populating the group"},{"line_number":113,"context_line":"            # data, leage target empty. This is the safest route and does not"},{"line_number":114,"context_line":"            # leak data before enforcement happens."}],"source_content_type":"text/x-python","patch_set":7,"id":"3f79a3b5_5be08226","line":111,"updated":"2018-08-15 06:59:16.000000000","message":"Interesting. What the purpose of enforcing target data on a group here? This seems circular in a way...","commit_id":"35085508e97596f1200bda94e1072ae841e215fc"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"0740c35656184ff25fb20e2bd82fba89ece62cff","unresolved":false,"context_lines":[{"line_number":108,"context_line":"        target \u003d {}"},{"line_number":109,"context_line":"        try:"},{"line_number":110,"context_line":"            target[\u0027group\u0027] \u003d PROVIDERS.identity_api.get_group(group_id)"},{"line_number":111,"context_line":"        except exception.GroupNotFound:"},{"line_number":112,"context_line":"            # NOTE(morgan): If we have an issue populating the group"},{"line_number":113,"context_line":"            # data, leage target empty. This is the safest route and does not"},{"line_number":114,"context_line":"            # leak data before enforcement happens."}],"source_content_type":"text/x-python","patch_set":7,"id":"3f79a3b5_0b162a4a","line":111,"in_reply_to":"3f79a3b5_5be08226","updated":"2018-08-15 19:51:28.000000000","message":"Somewhere one of the check strings leans on it. I didn\u0027t dig into things, but this is mirroring current behaviors.","commit_id":"35085508e97596f1200bda94e1072ae841e215fc"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ea6cd1f8f370f6fc2a9be2d0abd14870449c7fb2","unresolved":false,"context_lines":[{"line_number":110,"context_line":"            target[\u0027group\u0027] \u003d PROVIDERS.identity_api.get_group(group_id)"},{"line_number":111,"context_line":"        except exception.GroupNotFound:"},{"line_number":112,"context_line":"            # NOTE(morgan): If we have an issue populating the group"},{"line_number":113,"context_line":"            # data, leage target empty. This is the safest route and does not"},{"line_number":114,"context_line":"            # leak data before enforcement happens."},{"line_number":115,"context_line":"            pass"},{"line_number":116,"context_line":"        ENFORCER.enforce_call(action\u003d\u0027identity:list_users_in_group\u0027,"}],"source_content_type":"text/x-python","patch_set":7,"id":"3f79a3b5_bb7c3672","line":113,"range":{"start_line":113,"start_character":20,"end_line":113,"end_character":25},"updated":"2018-08-15 06:59:16.000000000","message":"nit: leave*","commit_id":"35085508e97596f1200bda94e1072ae841e215fc"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ea6cd1f8f370f6fc2a9be2d0abd14870449c7fb2","unresolved":false,"context_lines":[{"line_number":147,"context_line":"        \"\"\""},{"line_number":148,"context_line":"        ENFORCER.enforce_call("},{"line_number":149,"context_line":"            action\u003d\u0027identity:check_user_in_group\u0027,"},{"line_number":150,"context_line":"            target_attr\u003dself._build_enforcement_target_attr(user_id, group_id))"},{"line_number":151,"context_line":"        PROVIDERS.identity_api.check_user_in_group(user_id, group_id)"},{"line_number":152,"context_line":"        return None, http_client.NO_CONTENT"},{"line_number":153,"context_line":""}],"source_content_type":"text/x-python","patch_set":7,"id":"3f79a3b5_7b4d3e3c","line":150,"range":{"start_line":150,"start_character":19,"end_line":150,"end_character":23},"updated":"2018-08-15 06:59:16.000000000","message":"nit: the naming here is a little confusing since we\u0027re dealing with a dict and the name implies a singular string or attribute.","commit_id":"35085508e97596f1200bda94e1072ae841e215fc"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"0740c35656184ff25fb20e2bd82fba89ece62cff","unresolved":false,"context_lines":[{"line_number":147,"context_line":"        \"\"\""},{"line_number":148,"context_line":"        ENFORCER.enforce_call("},{"line_number":149,"context_line":"            action\u003d\u0027identity:check_user_in_group\u0027,"},{"line_number":150,"context_line":"            target_attr\u003dself._build_enforcement_target_attr(user_id, group_id))"},{"line_number":151,"context_line":"        PROVIDERS.identity_api.check_user_in_group(user_id, group_id)"},{"line_number":152,"context_line":"        return None, http_client.NO_CONTENT"},{"line_number":153,"context_line":""}],"source_content_type":"text/x-python","patch_set":7,"id":"3f79a3b5_6b20fe9b","line":150,"range":{"start_line":150,"start_character":19,"end_line":150,"end_character":23},"in_reply_to":"3f79a3b5_7b4d3e3c","updated":"2018-08-15 19:51:28.000000000","message":"Changing this is a change to RBACEnforcer. Similar, this is mirrored in the underlying structures used from @policy. I have no problem changing it, but would prefer to do so after flask is done.","commit_id":"35085508e97596f1200bda94e1072ae841e215fc"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"14e8c528f66fd32625744053bb1781d00c3c6309","unresolved":false,"context_lines":[{"line_number":107,"context_line":"        filters \u003d [\u0027domain_id\u0027, \u0027enabled\u0027, \u0027name\u0027, \u0027password_expires_at\u0027]"},{"line_number":108,"context_line":"        target \u003d {}"},{"line_number":109,"context_line":"        try:"},{"line_number":110,"context_line":"            target[\u0027group\u0027] \u003d PROVIDERS.identity_api.get_group(group_id)"},{"line_number":111,"context_line":"        except exception.GroupNotFound:"},{"line_number":112,"context_line":"            # NOTE(morgan): If we have an issue populating the group"},{"line_number":113,"context_line":"            # data, leage target empty. This is the safest route and does not"}],"source_content_type":"text/x-python","patch_set":9,"id":"3f79a3b5_db01c408","line":110,"range":{"start_line":110,"start_character":12,"end_line":110,"end_character":27},"updated":"2018-08-28 18:50:25.000000000","message":"I think this can just be:\n\n  target \u003d PROVIDERS.identity_api.get_group(group_id)\n\nI don\u0027t think you have to populate a key in target specifically. I think target is meant to be a reference of the target of the operation.\n\nI\u0027d need to double check, but this might require us to write enhanced policy checks like:\n\n  target.group.domain_id\n\nas opposed to:\n\n  target.domain_id","commit_id":"88d3cc4988ea6bbd4999cc3ceddc67def9c93311"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"c5e58aa662af4b569f6b41bc0eb0708b355b536c","unresolved":false,"context_lines":[{"line_number":107,"context_line":"        filters \u003d [\u0027domain_id\u0027, \u0027enabled\u0027, \u0027name\u0027, \u0027password_expires_at\u0027]"},{"line_number":108,"context_line":"        target \u003d {}"},{"line_number":109,"context_line":"        try:"},{"line_number":110,"context_line":"            target[\u0027group\u0027] \u003d PROVIDERS.identity_api.get_group(group_id)"},{"line_number":111,"context_line":"        except exception.GroupNotFound:"},{"line_number":112,"context_line":"            # NOTE(morgan): If we have an issue populating the group"},{"line_number":113,"context_line":"            # data, leage target empty. This is the safest route and does not"}],"source_content_type":"text/x-python","patch_set":9,"id":"3f79a3b5_a3ed68b8","line":110,"range":{"start_line":110,"start_character":12,"end_line":110,"end_character":27},"in_reply_to":"3f79a3b5_db01c408","updated":"2018-08-31 19:45:15.000000000","message":"That isn\u0027t how this works in the current (previous design), the target may have multiple elements added to it, therefore it is important to always make it target.XXXX-Entity.\u003cwhatever\u003e\n\nIn this case it\u0027s fine, but consistency is important.\n\nSee: https://review.openstack.org/#/c/591147/9/keystone/identity/controllers.py@a50\n\nIt is ref[\u0027group\u0027] which translates to the current target[\u0027group\u0027] that is implemented here.","commit_id":"88d3cc4988ea6bbd4999cc3ceddc67def9c93311"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"14e8c528f66fd32625744053bb1781d00c3c6309","unresolved":false,"context_lines":[{"line_number":110,"context_line":"            target[\u0027group\u0027] \u003d PROVIDERS.identity_api.get_group(group_id)"},{"line_number":111,"context_line":"        except exception.GroupNotFound:"},{"line_number":112,"context_line":"            # NOTE(morgan): If we have an issue populating the group"},{"line_number":113,"context_line":"            # data, leage target empty. This is the safest route and does not"},{"line_number":114,"context_line":"            # leak data before enforcement happens."},{"line_number":115,"context_line":"            pass"},{"line_number":116,"context_line":"        ENFORCER.enforce_call(action\u003d\u0027identity:list_users_in_group\u0027,"}],"source_content_type":"text/x-python","patch_set":9,"id":"3f79a3b5_9e4fba69","line":113,"range":{"start_line":113,"start_character":20,"end_line":113,"end_character":25},"updated":"2018-08-28 18:50:25.000000000","message":"leave","commit_id":"88d3cc4988ea6bbd4999cc3ceddc67def9c93311"}],"keystone/server/flask/common.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ea6cd1f8f370f6fc2a9be2d0abd14870449c7fb2","unresolved":false,"context_lines":[{"line_number":796,"context_line":"        if not flask.request.args:"},{"line_number":797,"context_line":"            return hints"},{"line_number":798,"context_line":""},{"line_number":799,"context_line":"        for key, value in flask.request.args.items(multi\u003dTrue):"},{"line_number":800,"context_line":"            # Check if this is an exact filter"},{"line_number":801,"context_line":"            if supported_filters is None or key in supported_filters:"},{"line_number":802,"context_line":"                hints.add_filter(key, value)"}],"source_content_type":"text/x-python","patch_set":7,"id":"3f79a3b5_db29f236","line":799,"range":{"start_line":799,"start_character":57,"end_line":799,"end_character":61},"updated":"2018-08-15 06:59:16.000000000","message":"Is this because it\u0027s possible to pass multiple request args?","commit_id":"35085508e97596f1200bda94e1072ae841e215fc"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ea6cd1f8f370f6fc2a9be2d0abd14870449c7fb2","unresolved":false,"context_lines":[{"line_number":907,"context_line":""},{"line_number":908,"context_line":"    @classmethod"},{"line_number":909,"context_line":"    def get_token_ref(cls):"},{"line_number":910,"context_line":"        \"\"\"Retrieve KeystoneToken object from the auth context and returns it."},{"line_number":911,"context_line":""},{"line_number":912,"context_line":"        :raises keystone.exception.Unauthorized: If auth context cannot be"},{"line_number":913,"context_line":"                                                 found."}],"source_content_type":"text/x-python","patch_set":7,"id":"3f79a3b5_5b15e2e3","line":910,"range":{"start_line":910,"start_character":20,"end_line":910,"end_character":33},"updated":"2018-08-15 06:59:16.000000000","message":"This is a TokenModel object. I don\u0027t think KeystoneToken exists anymore.","commit_id":"35085508e97596f1200bda94e1072ae841e215fc"}]}