)]}'
{"keystone/common/policies/base.py":[{"author":{"_account_id":27621,"name":"Vishakha Agarwal","email":"agarwalvishakha18@gmail.com","username":"Vishakha"},"change_message_id":"907f4609c2a048fc2f8343f80eb8a389600433b8","unresolved":false,"context_lines":[{"line_number":29,"context_line":"RULE_SERVICE_ADMIN_OR_TOKEN_SUBJECT \u003d \u0027rule:service_admin_or_token_subject\u0027"},{"line_number":30,"context_line":"RULE_SERVICE_OR_ADMIN \u003d \u0027rule:service_or_admin\u0027"},{"line_number":31,"context_line":"RULE_TRUST_OWNER \u003d \u0027user_id:%(trust.trustor_user_id)s\u0027"},{"line_number":32,"context_line":"READER_ROLE \u003d \u0027role:reader\u0027"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"rules \u003d ["},{"line_number":35,"context_line":"    policy.RuleDefault("}],"source_content_type":"text/x-python","patch_set":7,"id":"3f79a3b5_fc009d37","line":32,"updated":"2018-10-01 02:10:09.000000000","message":"Here we don\u0027t require \u0027role:reader\u0027 and \u0027system_scope:all\u0027 for system role??","commit_id":"b8e5b46a5b0acc88db62582429aa58f8d6318a75"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ea69b88302e38a70679679ed76bdf008539f1d64","unresolved":false,"context_lines":[{"line_number":29,"context_line":"RULE_SERVICE_ADMIN_OR_TOKEN_SUBJECT \u003d \u0027rule:service_admin_or_token_subject\u0027"},{"line_number":30,"context_line":"RULE_SERVICE_OR_ADMIN \u003d \u0027rule:service_or_admin\u0027"},{"line_number":31,"context_line":"RULE_TRUST_OWNER \u003d \u0027user_id:%(trust.trustor_user_id)s\u0027"},{"line_number":32,"context_line":"READER_ROLE \u003d \u0027role:reader\u0027"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"rules \u003d ["},{"line_number":35,"context_line":"    policy.RuleDefault("}],"source_content_type":"text/x-python","patch_set":7,"id":"3f79a3b5_20fd7c08","line":32,"in_reply_to":"3f79a3b5_fc009d37","updated":"2018-10-12 17:54:08.000000000","message":"This is because the policies that are using this are explicitly setting scope_types to \u0027system\u0027 in the policy definition. So we don\u0027t necessarily need the extra system_scope:all bit.\n\nWe only need that if a policy is expected to work with multiple scoped tokens.","commit_id":"b8e5b46a5b0acc88db62582429aa58f8d6318a75"}],"keystone/common/policies/domain.py":[{"author":{"_account_id":27621,"name":"Vishakha Agarwal","email":"agarwalvishakha18@gmail.com","username":"Vishakha"},"change_message_id":"907f4609c2a048fc2f8343f80eb8a389600433b8","unresolved":false,"context_lines":[{"line_number":35,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":36,"context_line":"        name\u003dbase.IDENTITY % \u0027get_domain\u0027,"},{"line_number":37,"context_line":"        check_str\u003d("},{"line_number":38,"context_line":"            \u0027(role:reader and system_scope:all) or \u0027"},{"line_number":39,"context_line":"            \u0027token.project.domain.id:%(target.domain.id)s\u0027"},{"line_number":40,"context_line":"        ),"},{"line_number":41,"context_line":"        # NOTE(lbragstad): This policy allows system-scope and project-scoped"}],"source_content_type":"text/x-python","patch_set":7,"id":"3f79a3b5_9cf2c96e","line":38,"updated":"2018-10-01 02:10:09.000000000","message":"Can we declare this whole string in base file same as before?","commit_id":"b8e5b46a5b0acc88db62582429aa58f8d6318a75"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ea69b88302e38a70679679ed76bdf008539f1d64","unresolved":false,"context_lines":[{"line_number":35,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":36,"context_line":"        name\u003dbase.IDENTITY % \u0027get_domain\u0027,"},{"line_number":37,"context_line":"        check_str\u003d("},{"line_number":38,"context_line":"            \u0027(role:reader and system_scope:all) or \u0027"},{"line_number":39,"context_line":"            \u0027token.project.domain.id:%(target.domain.id)s\u0027"},{"line_number":40,"context_line":"        ),"},{"line_number":41,"context_line":"        # NOTE(lbragstad): This policy allows system-scope and project-scoped"}],"source_content_type":"text/x-python","patch_set":7,"id":"3f79a3b5_23126656","line":38,"in_reply_to":"3f79a3b5_9cf2c96e","updated":"2018-10-12 17:54:08.000000000","message":"I didn\u0027t put it in the base.py file because it\u0027s specific to this module. This is the only policy that is processing both `system` and `project` scoped tokens. Otherwise all other policies in this module are intended to be used by system scoped tokens.","commit_id":"b8e5b46a5b0acc88db62582429aa58f8d6318a75"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"65b6b5eeb214b9d133d21b99d58c535547bfa4d6","unresolved":false,"context_lines":[{"line_number":52,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":53,"context_line":"        name\u003dbase.IDENTITY % \u0027list_domains\u0027,"},{"line_number":54,"context_line":"        check_str\u003dbase.READER_ROLE,"},{"line_number":55,"context_line":"        scope_types\u003d[\u0027system\u0027],"},{"line_number":56,"context_line":"        description\u003d\u0027List domains.\u0027,"},{"line_number":57,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027/v3/domains\u0027,"},{"line_number":58,"context_line":"                     \u0027method\u0027: \u0027GET\u0027}],"}],"source_content_type":"text/x-python","patch_set":11,"id":"3f79a3b5_16feaab4","line":55,"range":{"start_line":55,"start_character":0,"end_line":55,"end_character":31},"updated":"2018-12-05 21:22:20.000000000","message":"reader can only get their own domain right? If they try to list them all, it is unauthorized?","commit_id":"4337912182aba0292025c7916d47cc10936cfc49"}],"keystone/common/policies/user.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2498ba7fdbf74632dcb723b8e23ed560d585a470","unresolved":false,"context_lines":[{"line_number":52,"context_line":"        deprecated_since\u003dversionutils.deprecated.STEIN),"},{"line_number":53,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":54,"context_line":"        name\u003dbase.IDENTITY % \u0027list_users\u0027,"},{"line_number":55,"context_line":"        check_str\u003d\u0027role:reader\u0027,"},{"line_number":56,"context_line":"        # FIXME(lbragstad): Since listing users has traditionally always been a"},{"line_number":57,"context_line":"        # system-level API call, let\u0027s maintain that pattern here. A system"},{"line_number":58,"context_line":"        # administrator should be able to list all users in the deployment,"}],"source_content_type":"text/x-python","patch_set":16,"id":"dfd5e7cf_f5b7be85","line":55,"range":{"start_line":55,"start_character":18,"end_line":55,"end_character":32},"updated":"2019-01-08 22:07:58.000000000","message":"This needs to be reworked otherwise anyone with the reader role is going to be able to list users in the deployment.","commit_id":"3c450209ade5d4f3802526e3e7f4f695229be15e"}],"keystone/tests/unit/protection/v3/test_domains.py":[{"author":{"_account_id":27621,"name":"Vishakha Agarwal","email":"agarwalvishakha18@gmail.com","username":"Vishakha"},"change_message_id":"907f4609c2a048fc2f8343f80eb8a389600433b8","unresolved":false,"context_lines":[{"line_number":111,"context_line":"            self.assertIn(disabled_domain[\u0027id\u0027], disabled_domain_ids)"},{"line_number":112,"context_line":"            self.assertNotIn(enabled_domain[\u0027id\u0027], disabled_domain_ids)"},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"    def test_user_can_get_a_domain(self):"},{"line_number":115,"context_line":"        domain \u003d PROVIDERS.resource_api.create_domain("},{"line_number":116,"context_line":"            uuid.uuid4().hex, unit.new_domain_ref()"},{"line_number":117,"context_line":"        )"}],"source_content_type":"text/x-python","patch_set":7,"id":"3f79a3b5_bcf6a55d","line":114,"updated":"2018-10-01 02:10:09.000000000","message":"Can we also add a test case for user when trying to get a wrong domain to which he is not authorized??","commit_id":"b8e5b46a5b0acc88db62582429aa58f8d6318a75"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ea69b88302e38a70679679ed76bdf008539f1d64","unresolved":false,"context_lines":[{"line_number":111,"context_line":"            self.assertIn(disabled_domain[\u0027id\u0027], disabled_domain_ids)"},{"line_number":112,"context_line":"            self.assertNotIn(enabled_domain[\u0027id\u0027], disabled_domain_ids)"},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"    def test_user_can_get_a_domain(self):"},{"line_number":115,"context_line":"        domain \u003d PROVIDERS.resource_api.create_domain("},{"line_number":116,"context_line":"            uuid.uuid4().hex, unit.new_domain_ref()"},{"line_number":117,"context_line":"        )"}],"source_content_type":"text/x-python","patch_set":7,"id":"3f79a3b5_032e4a8c","line":114,"in_reply_to":"3f79a3b5_bcf6a55d","updated":"2018-10-12 17:54:08.000000000","message":"Since this use is a system reader, they should be able to get any domain since they have reader authorization on the entire deployment \"system\". But that would be a great test for project users.","commit_id":"b8e5b46a5b0acc88db62582429aa58f8d6318a75"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"ced20f03657e754488040a1e4986d0a2df37810e","unresolved":false,"context_lines":[{"line_number":89,"context_line":"        enabled_domain \u003d PROVIDERS.resource_api.create_domain("},{"line_number":90,"context_line":"            uuid.uuid4().hex, unit.new_domain_ref()"},{"line_number":91,"context_line":"        )"},{"line_number":92,"context_line":"        disabled_domain \u003d PROVIDERS.resource_api.create_domain("},{"line_number":93,"context_line":"            uuid.uuid4().hex, unit.new_domain_ref()"},{"line_number":94,"context_line":"        )"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"        update \u003d {\u0027enabled\u0027: False}"},{"line_number":97,"context_line":"        PROVIDERS.resource_api.update_domain(disabled_domain[\u0027id\u0027], update)"},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"        with self.test_client() as c:"},{"line_number":100,"context_line":"            r \u003d c.get(\u0027/v3/domains?enabled\u003dtrue\u0027, headers\u003dself.headers)"}],"source_content_type":"text/x-python","patch_set":9,"id":"3f79a3b5_be636bde","line":97,"range":{"start_line":92,"start_character":8,"end_line":97,"end_character":75},"updated":"2018-10-19 00:11:17.000000000","message":"This should be doable all at once, not needing a separate call.","commit_id":"05d3da65de8ac0902e4180019cca7a9dd966ff4e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"cd1c7ef38c41077aa428ff2ac246fe09aeac9f93","unresolved":false,"context_lines":[{"line_number":89,"context_line":"        enabled_domain \u003d PROVIDERS.resource_api.create_domain("},{"line_number":90,"context_line":"            uuid.uuid4().hex, unit.new_domain_ref()"},{"line_number":91,"context_line":"        )"},{"line_number":92,"context_line":"        disabled_domain \u003d PROVIDERS.resource_api.create_domain("},{"line_number":93,"context_line":"            uuid.uuid4().hex, unit.new_domain_ref()"},{"line_number":94,"context_line":"        )"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"        update \u003d {\u0027enabled\u0027: False}"},{"line_number":97,"context_line":"        PROVIDERS.resource_api.update_domain(disabled_domain[\u0027id\u0027], update)"},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"        with self.test_client() as c:"},{"line_number":100,"context_line":"            r \u003d c.get(\u0027/v3/domains?enabled\u003dtrue\u0027, headers\u003dself.headers)"}],"source_content_type":"text/x-python","patch_set":9,"id":"3f79a3b5_666bcc53","line":97,"range":{"start_line":92,"start_character":8,"end_line":97,"end_character":75},"in_reply_to":"3f79a3b5_be636bde","updated":"2018-11-20 18:04:16.000000000","message":"Done, good call.","commit_id":"05d3da65de8ac0902e4180019cca7a9dd966ff4e"}],"keystone/tests/unit/protection/v3/test_users.py":[{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"f21a888ac401eba3c12d76cd8adda63c01b802e4","unresolved":false,"context_lines":[{"line_number":25,"context_line":"PROVIDERS \u003d provider_api.ProviderAPIs"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"class _CommonUserTests(object):"},{"line_number":29,"context_line":"    \"\"\"Common default functionality for all users.\"\"\""},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"    def test_user_can_get_their_own_user_reference(self):"}],"source_content_type":"text/x-python","patch_set":17,"id":"9fdfeff1_9430f457","line":28,"updated":"2019-02-02 14:01:10.000000000","message":"This isn\u0027t used in this patch?","commit_id":"d9d81485ef6c4c27b6d49e9e92afd9e418c75558"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"41a879cd7480ac5b7030329f6e55e38a2fcd2477","unresolved":false,"context_lines":[{"line_number":25,"context_line":"PROVIDERS \u003d provider_api.ProviderAPIs"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"class _CommonUserTests(object):"},{"line_number":29,"context_line":"    \"\"\"Common default functionality for all users.\"\"\""},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"    def test_user_can_get_their_own_user_reference(self):"}],"source_content_type":"text/x-python","patch_set":17,"id":"9fdfeff1_d810e152","line":28,"in_reply_to":"9fdfeff1_9430f457","updated":"2019-02-04 14:49:32.000000000","message":"Yeah - I can clean this up.","commit_id":"d9d81485ef6c4c27b6d49e9e92afd9e418c75558"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"f21a888ac401eba3c12d76cd8adda63c01b802e4","unresolved":false,"context_lines":[{"line_number":31,"context_line":"    def test_user_can_get_their_own_user_reference(self):"},{"line_number":32,"context_line":"        with self.test_client() as c:"},{"line_number":33,"context_line":"            r \u003d c.get(\u0027/v3/users/%s\u0027 % self.user_id, headers\u003dself.headers)"},{"line_number":34,"context_line":"            self.assertEqual(self.user_id, r.json[\u0027user\u0027][\u0027id\u0027])"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"class _SystemUserTests(object):"}],"source_content_type":"text/x-python","patch_set":17,"id":"9fdfeff1_742d50fc","line":34,"updated":"2019-02-02 14:01:10.000000000","message":"Maybe a test for users cannot get other users?","commit_id":"d9d81485ef6c4c27b6d49e9e92afd9e418c75558"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"41a879cd7480ac5b7030329f6e55e38a2fcd2477","unresolved":false,"context_lines":[{"line_number":31,"context_line":"    def test_user_can_get_their_own_user_reference(self):"},{"line_number":32,"context_line":"        with self.test_client() as c:"},{"line_number":33,"context_line":"            r \u003d c.get(\u0027/v3/users/%s\u0027 % self.user_id, headers\u003dself.headers)"},{"line_number":34,"context_line":"            self.assertEqual(self.user_id, r.json[\u0027user\u0027][\u0027id\u0027])"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"class _SystemUserTests(object):"}],"source_content_type":"text/x-python","patch_set":17,"id":"9fdfeff1_380c8d3a","line":34,"in_reply_to":"9fdfeff1_742d50fc","updated":"2019-02-04 14:49:32.000000000","message":"I agree. I attempted to keep this in a separate patch to mitigate sprawl in this change. Those are tested specifically for project users [0].\n\n[0] https://review.openstack.org/#/c/623322/4/keystone/tests/unit/protection/v3/test_users.py","commit_id":"d9d81485ef6c4c27b6d49e9e92afd9e418c75558"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"b7931e813c26372212e7b7f726f54ade32e377e7","unresolved":false,"context_lines":[{"line_number":100,"context_line":"        # for requests we\u0027ll be making in the tests."},{"line_number":101,"context_line":"        with self.test_client() as c:"},{"line_number":102,"context_line":"            r \u003d c.post(\u0027/v3/auth/tokens\u0027, json\u003dauth)"},{"line_number":103,"context_line":"            self.token_id \u003d r.headers[\u0027X-Subject-Token\u0027]"},{"line_number":104,"context_line":"            self.headers \u003d {\u0027X-Auth-Token\u0027: self.token_id}"},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"    def test_user_cannot_create_users(self):"},{"line_number":107,"context_line":"        create \u003d {"}],"source_content_type":"text/x-python","patch_set":17,"id":"9fdfeff1_d0e823e3","line":104,"range":{"start_line":103,"start_character":0,"end_line":104,"end_character":58},"updated":"2019-01-28 21:40:59.000000000","message":"Add a cleanup action for these:\n\n  self.cleanup_instance(\u0027token_id\u0027)\n  self.cleanup_instance(\u0027headers\u0027)","commit_id":"d9d81485ef6c4c27b6d49e9e92afd9e418c75558"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"790d40c832619fc380660fd00219543c9d650637","unresolved":false,"context_lines":[{"line_number":100,"context_line":"        # for requests we\u0027ll be making in the tests."},{"line_number":101,"context_line":"        with self.test_client() as c:"},{"line_number":102,"context_line":"            r \u003d c.post(\u0027/v3/auth/tokens\u0027, json\u003dauth)"},{"line_number":103,"context_line":"            self.token_id \u003d r.headers[\u0027X-Subject-Token\u0027]"},{"line_number":104,"context_line":"            self.headers \u003d {\u0027X-Auth-Token\u0027: self.token_id}"},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"    def test_user_cannot_create_users(self):"},{"line_number":107,"context_line":"        create \u003d {"}],"source_content_type":"text/x-python","patch_set":17,"id":"9fdfeff1_4ecec2b4","line":104,"range":{"start_line":103,"start_character":0,"end_line":104,"end_character":58},"in_reply_to":"9fdfeff1_73328f12","updated":"2019-01-29 19:49:24.000000000","message":"I can\u0027t seem to validate this, but I could be doing something wrong. I\u0027m attempting to set an attribute of the test class in a test and see if it bleeds into other tests by checking its existence in setUp(). Here is the diff [0] and the output [1].\n\n[0] https://pasted.tech/pastes/e30858a282b7618ae6fe68cca7204170ca538dfc.raw\n[1] https://pasted.tech/pastes/f367719b5303216ded146434b2ed150d2ca1fb69.raw","commit_id":"d9d81485ef6c4c27b6d49e9e92afd9e418c75558"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"1c935280f0f5b5155793c84e7c0445ddb690990b","unresolved":false,"context_lines":[{"line_number":100,"context_line":"        # for requests we\u0027ll be making in the tests."},{"line_number":101,"context_line":"        with self.test_client() as c:"},{"line_number":102,"context_line":"            r \u003d c.post(\u0027/v3/auth/tokens\u0027, json\u003dauth)"},{"line_number":103,"context_line":"            self.token_id \u003d r.headers[\u0027X-Subject-Token\u0027]"},{"line_number":104,"context_line":"            self.headers \u003d {\u0027X-Auth-Token\u0027: self.token_id}"},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"    def test_user_cannot_create_users(self):"},{"line_number":107,"context_line":"        create \u003d {"}],"source_content_type":"text/x-python","patch_set":17,"id":"9fdfeff1_73328f12","line":104,"range":{"start_line":103,"start_character":0,"end_line":104,"end_character":58},"in_reply_to":"9fdfeff1_bf99a8c4","updated":"2019-01-29 19:30:58.000000000","message":"When you assign directly, e.g. \"self.token_id\" you need to delete that instance as cleanup, otherwise you have lingering references. This net can increase memory usage of the unit tests. The cleanup is for the bound values on the self.\n\nThis is not critical, but should be done in all cases so we don\u0027t leave lingering data when we pass beyond the test cases (and all sub-classes).","commit_id":"d9d81485ef6c4c27b6d49e9e92afd9e418c75558"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"35d5721f269dbf43d4c184fee43103cfbf02ecc4","unresolved":false,"context_lines":[{"line_number":100,"context_line":"        # for requests we\u0027ll be making in the tests."},{"line_number":101,"context_line":"        with self.test_client() as c:"},{"line_number":102,"context_line":"            r \u003d c.post(\u0027/v3/auth/tokens\u0027, json\u003dauth)"},{"line_number":103,"context_line":"            self.token_id \u003d r.headers[\u0027X-Subject-Token\u0027]"},{"line_number":104,"context_line":"            self.headers \u003d {\u0027X-Auth-Token\u0027: self.token_id}"},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"    def test_user_cannot_create_users(self):"},{"line_number":107,"context_line":"        create \u003d {"}],"source_content_type":"text/x-python","patch_set":17,"id":"9fdfeff1_bf99a8c4","line":104,"range":{"start_line":103,"start_character":0,"end_line":104,"end_character":58},"in_reply_to":"9fdfeff1_d0e823e3","updated":"2019-01-29 04:06:38.000000000","message":"This uses the database fixture which drops everything before every test case is run.\n\nDoes this still need cleanup?","commit_id":"d9d81485ef6c4c27b6d49e9e92afd9e418c75558"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"e73b68a6d4f5576663a75eba56b7a4d383bfb2ca","unresolved":false,"context_lines":[{"line_number":30,"context_line":""},{"line_number":31,"context_line":"    def test_user_can_get_their_own_user_reference(self):"},{"line_number":32,"context_line":"        with self.test_client() as c:"},{"line_number":33,"context_line":"            r \u003d c.get(\u0027/v3/users/%s\u0027 % self.user_id, headers\u003dself.headers)"},{"line_number":34,"context_line":"            self.assertEqual(self.user_id, r.json[\u0027user\u0027][\u0027id\u0027])"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":""}],"source_content_type":"text/x-python","patch_set":18,"id":"9fdfeff1_cfbb1ec2","line":33,"range":{"start_line":33,"start_character":22,"end_line":33,"end_character":36},"updated":"2019-02-05 19:01:27.000000000","message":"NIT: This could be done as a template string","commit_id":"40d3458fcb29df1daefce9455d1778e800cac378"}],"keystone/tests/unit/test_v3_protection.py":[{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"f21a888ac401eba3c12d76cd8adda63c01b802e4","unresolved":false,"context_lines":[{"line_number":243,"context_line":"          to Domain A - this should fail"},{"line_number":244,"context_line":"        - Retry this for a user who is in Domain A, which should succeed."},{"line_number":245,"context_line":"        - Finally, try getting a user that does not exist, which should"},{"line_number":246,"context_line":"          still return ForbiddenAction"},{"line_number":247,"context_line":""},{"line_number":248,"context_line":"        \"\"\""},{"line_number":249,"context_line":"        new_policy \u003d {\u0027identity:get_user\u0027:"}],"source_content_type":"text/x-python","patch_set":17,"id":"9fdfeff1_d4ec3cbc","line":246,"updated":"2019-02-02 14:01:10.000000000","message":"This seems like an API break?","commit_id":"d9d81485ef6c4c27b6d49e9e92afd9e418c75558"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"167d2c286d3f65c75db009b43708c3a69b7c2ac0","unresolved":false,"context_lines":[{"line_number":243,"context_line":"          to Domain A - this should fail"},{"line_number":244,"context_line":"        - Retry this for a user who is in Domain A, which should succeed."},{"line_number":245,"context_line":"        - Finally, try getting a user that does not exist, which should"},{"line_number":246,"context_line":"          still return ForbiddenAction"},{"line_number":247,"context_line":""},{"line_number":248,"context_line":"        \"\"\""},{"line_number":249,"context_line":"        new_policy \u003d {\u0027identity:get_user\u0027:"}],"source_content_type":"text/x-python","patch_set":17,"id":"9fdfeff1_23fea26b","line":246,"in_reply_to":"9fdfeff1_2320e29b","updated":"2019-02-04 15:57:28.000000000","message":"I guess we need to decide if we\u0027re going to special case these exceptions or if we\u0027re going to revisit the versioning mechanism discussion (again).\n\nI\u0027d rather not have to implement yet another feature to fix this. At the same time, littering if/else statements for legacy cases where we accidentally issued 404s instead of 403s doesn\u0027t sound like the right solution either.","commit_id":"d9d81485ef6c4c27b6d49e9e92afd9e418c75558"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"c791d6d20551a61a8010160f996aed378814bdbe","unresolved":false,"context_lines":[{"line_number":243,"context_line":"          to Domain A - this should fail"},{"line_number":244,"context_line":"        - Retry this for a user who is in Domain A, which should succeed."},{"line_number":245,"context_line":"        - Finally, try getting a user that does not exist, which should"},{"line_number":246,"context_line":"          still return ForbiddenAction"},{"line_number":247,"context_line":""},{"line_number":248,"context_line":"        \"\"\""},{"line_number":249,"context_line":"        new_policy \u003d {\u0027identity:get_user\u0027:"}],"source_content_type":"text/x-python","patch_set":17,"id":"9fdfeff1_f83e00b8","line":246,"in_reply_to":"9fdfeff1_23fea26b","updated":"2019-02-04 18:08:51.000000000","message":"Maintain the 404 for now. Really this is where we add something like: \n\n     NOTE: THIS SHOULD BE A 403\n\nIf/when we do v4 we clean all those up. Maintain the UserNotFound in *all* cases if possible.","commit_id":"d9d81485ef6c4c27b6d49e9e92afd9e418c75558"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"629c9e9995f28b0f90b355e3e324a77780699557","unresolved":false,"context_lines":[{"line_number":243,"context_line":"          to Domain A - this should fail"},{"line_number":244,"context_line":"        - Retry this for a user who is in Domain A, which should succeed."},{"line_number":245,"context_line":"        - Finally, try getting a user that does not exist, which should"},{"line_number":246,"context_line":"          still return ForbiddenAction"},{"line_number":247,"context_line":""},{"line_number":248,"context_line":"        \"\"\""},{"line_number":249,"context_line":"        new_policy \u003d {\u0027identity:get_user\u0027:"}],"source_content_type":"text/x-python","patch_set":17,"id":"9fdfeff1_2320e29b","line":246,"in_reply_to":"9fdfeff1_783455fc","updated":"2019-02-04 15:32:19.000000000","message":"That\u0027s exactly my point, we don\u0027t have a mechanism for making backwards incompatible changes like this.","commit_id":"d9d81485ef6c4c27b6d49e9e92afd9e418c75558"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"09c59272f240a07441558f62798c430cbe2b0af9","unresolved":false,"context_lines":[{"line_number":243,"context_line":"          to Domain A - this should fail"},{"line_number":244,"context_line":"        - Retry this for a user who is in Domain A, which should succeed."},{"line_number":245,"context_line":"        - Finally, try getting a user that does not exist, which should"},{"line_number":246,"context_line":"          still return ForbiddenAction"},{"line_number":247,"context_line":""},{"line_number":248,"context_line":"        \"\"\""},{"line_number":249,"context_line":"        new_policy \u003d {\u0027identity:get_user\u0027:"}],"source_content_type":"text/x-python","patch_set":17,"id":"9fdfeff1_d895418a","line":246,"in_reply_to":"9fdfeff1_b8307dea","updated":"2019-02-04 14:55:12.000000000","message":"That guideline does not go into detail on versioning. We don\u0027t have microversions in keystone and historically we only bump the minor version for new features not backwards incompatibilities. Bumping the API version to v4 seems like overkill, I don\u0027t think that\u0027s what you meant to imply?","commit_id":"d9d81485ef6c4c27b6d49e9e92afd9e418c75558"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"41a879cd7480ac5b7030329f6e55e38a2fcd2477","unresolved":false,"context_lines":[{"line_number":243,"context_line":"          to Domain A - this should fail"},{"line_number":244,"context_line":"        - Retry this for a user who is in Domain A, which should succeed."},{"line_number":245,"context_line":"        - Finally, try getting a user that does not exist, which should"},{"line_number":246,"context_line":"          still return ForbiddenAction"},{"line_number":247,"context_line":""},{"line_number":248,"context_line":"        \"\"\""},{"line_number":249,"context_line":"        new_policy \u003d {\u0027identity:get_user\u0027:"}],"source_content_type":"text/x-python","patch_set":17,"id":"9fdfeff1_b8307dea","line":246,"in_reply_to":"9fdfeff1_d4ec3cbc","updated":"2019-02-04 14:49:32.000000000","message":"It is, in the interest of consistency and security.\n\nAccording to the guidelines [0], I can update the keystone version to account for this if you agree that will be sufficient.\n\n[0] https://specs.openstack.org/openstack/api-wg/guidelines/api_interoperability.html#interoperability","commit_id":"d9d81485ef6c4c27b6d49e9e92afd9e418c75558"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"295b1fb3fdc669a12ec5fe62c372eaa18954d35f","unresolved":false,"context_lines":[{"line_number":243,"context_line":"          to Domain A - this should fail"},{"line_number":244,"context_line":"        - Retry this for a user who is in Domain A, which should succeed."},{"line_number":245,"context_line":"        - Finally, try getting a user that does not exist, which should"},{"line_number":246,"context_line":"          still return ForbiddenAction"},{"line_number":247,"context_line":""},{"line_number":248,"context_line":"        \"\"\""},{"line_number":249,"context_line":"        new_policy \u003d {\u0027identity:get_user\u0027:"}],"source_content_type":"text/x-python","patch_set":17,"id":"9fdfeff1_783455fc","line":246,"in_reply_to":"9fdfeff1_d895418a","updated":"2019-02-04 15:27:28.000000000","message":"Based on the guidelines, how else would you version this change?\n\nI agree that v4 seems like overkill.","commit_id":"d9d81485ef6c4c27b6d49e9e92afd9e418c75558"}]}