)]}'
{"keystone/api/projects.py":[{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"830ae1306066aa90b6cbbc71712701b353e8af0c","unresolved":false,"context_lines":[{"line_number":39,"context_line":"            flask.request.view_args.get(\u0027project_id\u0027)"},{"line_number":40,"context_line":"        )"},{"line_number":41,"context_line":"    except exception.NotFound:  # nosec"},{"line_number":42,"context_line":"        # Defer existance in the event the project doesn\u0027t exist, we\u0027ll"},{"line_number":43,"context_line":"        # check this later anyway."},{"line_number":44,"context_line":"        pass"},{"line_number":45,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"3f79a3b5_33179ba1","line":42,"range":{"start_line":42,"start_character":16,"end_line":42,"end_character":25},"updated":"2018-12-13 12:47:55.000000000","message":"(nit) existence","commit_id":"698fe070c357578d77d534c80a7a7d670dc71d72"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"da47147df42b3401d5be9aa5345eed481a9e809d","unresolved":false,"context_lines":[{"line_number":39,"context_line":"            flask.request.view_args.get(\u0027project_id\u0027)"},{"line_number":40,"context_line":"        )"},{"line_number":41,"context_line":"    except exception.NotFound:  # nosec"},{"line_number":42,"context_line":"        # Defer existance in the event the project doesn\u0027t exist, we\u0027ll"},{"line_number":43,"context_line":"        # check this later anyway."},{"line_number":44,"context_line":"        pass"},{"line_number":45,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"3f79a3b5_5f749103","line":42,"range":{"start_line":42,"start_character":16,"end_line":42,"end_character":25},"in_reply_to":"3f79a3b5_33179ba1","updated":"2018-12-13 20:20:35.000000000","message":"Done","commit_id":"698fe070c357578d77d534c80a7a7d670dc71d72"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"67fbfb27753a0ac9012916a68a468b8a6040bee5","unresolved":false,"context_lines":[{"line_number":134,"context_line":"        refs \u003d PROVIDERS.resource_api.list_projects(hints\u003dhints)"},{"line_number":135,"context_line":"        if self.oslo_context.project_id:"},{"line_number":136,"context_line":"            filtered_refs \u003d ["},{"line_number":137,"context_line":"                p for p in refs if p[\u0027id\u0027] \u003d\u003d self.oslo_context.project_id"},{"line_number":138,"context_line":"            ]"},{"line_number":139,"context_line":"        else:"},{"line_number":140,"context_line":"            filtered_refs \u003d refs"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_163a7431","line":137,"updated":"2018-12-14 12:49:36.000000000","message":"I think this deserves a comment.\n\nIs the idea that if you have a project-scoped token and you call /v3/projects you will get a list of one project? Is that more useful than just getting the project out of /v3/auth/tokens?\n\nWhat about in the hierarchical case: say I have a project-scoped token and I want to list it and the children of my project?\n\nIs this backwards compatible? Currently administrators still need a project-scoped token to be able to do anything useful, once we do this won\u0027t those admins suddenly stop being able to list all projects? I think it\u0027s broken, based on devstack failing: http://logs.openstack.org/15/624215/4/check/tempest-full/449b61f/job-output.txt.gz#_2018-12-13_23_07_55_324358","commit_id":"b6a847e838bdcec666ed54f0456a50205d55bf61"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c5cab114a358b9791e0ccc47da5afae3c28b4e3e","unresolved":false,"context_lines":[{"line_number":134,"context_line":"        refs \u003d PROVIDERS.resource_api.list_projects(hints\u003dhints)"},{"line_number":135,"context_line":"        if self.oslo_context.project_id:"},{"line_number":136,"context_line":"            filtered_refs \u003d ["},{"line_number":137,"context_line":"                p for p in refs if p[\u0027id\u0027] \u003d\u003d self.oslo_context.project_id"},{"line_number":138,"context_line":"            ]"},{"line_number":139,"context_line":"        else:"},{"line_number":140,"context_line":"            filtered_refs \u003d refs"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_15d48a1d","line":137,"in_reply_to":"3f79a3b5_03d45c1d","updated":"2018-12-17 14:45:35.000000000","message":"If I understand correctly, you\u0027re not sure if we can modify the response in this way while `keystone.conf [oslo_policy] enforce_scope \u003d False` because that would be a backward incompatible, breaking change?\n\nAnother option we have would be to check the value of that configuration option here and modify the response accordingly. Ultimately changing line 135 to:\n\n  if self.oslo_context.project_id and CONF.oslo_policy.enforce_scope:\n\nIt would allow per-project users only see what they should while allowing project-scoped tokens to be used for administrative tasks until operators do their migrations.","commit_id":"b6a847e838bdcec666ed54f0456a50205d55bf61"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"37610fca164a670f1302e49cf502ccb761dfe6d4","unresolved":false,"context_lines":[{"line_number":134,"context_line":"        refs \u003d PROVIDERS.resource_api.list_projects(hints\u003dhints)"},{"line_number":135,"context_line":"        if self.oslo_context.project_id:"},{"line_number":136,"context_line":"            filtered_refs \u003d ["},{"line_number":137,"context_line":"                p for p in refs if p[\u0027id\u0027] \u003d\u003d self.oslo_context.project_id"},{"line_number":138,"context_line":"            ]"},{"line_number":139,"context_line":"        else:"},{"line_number":140,"context_line":"            filtered_refs \u003d refs"}],"source_content_type":"text/x-python","patch_set":4,"id":"dfd5e7cf_1f24060d","line":137,"in_reply_to":"3f79a3b5_15d48a1d","updated":"2019-01-07 09:25:31.000000000","message":"I don\u0027t really like the idea of peeking into config in order to change the results of the API. I think what I\u0027d like to see is this:\n\n* a system-scoped admin or reader can list all projects (this will still work for project-scoped admins with enforce_scope\u003dfalse for the time being)\n* a domain-scoped admin or reader can list all projects in their domain (won\u0027t break CI because we don\u0027t use domain admins for anything)\n* a project-scoped admin or reader can\u0027t list projects - listing one project isn\u0027t useful enough to be worth the extra complexity imo\n* defer dealing with hierarchical projects until enforce_scope is gone","commit_id":"b6a847e838bdcec666ed54f0456a50205d55bf61"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4c084ce6276c7d811bb8d7240b6041a07ade2910","unresolved":false,"context_lines":[{"line_number":134,"context_line":"        refs \u003d PROVIDERS.resource_api.list_projects(hints\u003dhints)"},{"line_number":135,"context_line":"        if self.oslo_context.project_id:"},{"line_number":136,"context_line":"            filtered_refs \u003d ["},{"line_number":137,"context_line":"                p for p in refs if p[\u0027id\u0027] \u003d\u003d self.oslo_context.project_id"},{"line_number":138,"context_line":"            ]"},{"line_number":139,"context_line":"        else:"},{"line_number":140,"context_line":"            filtered_refs \u003d refs"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_37f447cd","line":137,"in_reply_to":"3f79a3b5_163a7431","updated":"2018-12-14 17:17:21.000000000","message":"\u003e I think this deserves a comment.\n \u003e \n \u003e Is the idea that if you have a project-scoped token and you call\n \u003e /v3/projects you will get a list of one project? Is that more\n \u003e useful than just getting the project out of /v3/auth/tokens?\n\nIn my opinion, not really. Thinking about the flow of this whole interaction, we require the user to already know the project by having a project-scoped token to call this API. From an end-user perspective, I don\u0027t think this offers any advantage over using GET /v3/auth/projects to figure out what projects I can scope to, then authenticating for a scoped token. At that point, I\u0027m not sure I see a need to ask keystone for a list of at max one entity that I already know about.\n\nI could be glossing over other use cases, but I\u0027m hoping we can air those out. Maybe this API only makes sense as a system and domain level API.\n\n \u003e \n \u003e What about in the hierarchical case: say I have a project-scoped\n \u003e token and I want to list it and the children of my project?\n\nThat sounds like a more valid use case than what I describe above, and my logic here isn\u0027t going to fulfill that.\n\n \u003e \n \u003e Is this backwards compatible? Currently administrators still need a\n \u003e project-scoped token to be able to do anything useful, once we do\n \u003e this won\u0027t those admins suddenly stop being able to list all\n \u003e projects? I think it\u0027s broken, based on devstack failing:\n \u003e http://logs.openstack.org/15/624215/4/check/tempest-full/449b61f/job-output.txt.gz#_2018-12-13_23_07_55_324358\n\nYeah - it is. The more I tinker with this API and default roles; I\u0027m wondering if I need to approach it differently and not shoot for opening this up the project API initially.\n\nIf we keep this API isolated as a system-level API, then open it up to domain users by setting scope_types\u003d[\u0027system\u0027, \u0027domain\u0027], then we might still be able to provide backward compatibility for deployments that set `keystone.conf [oslo_policy] enforce_scope\u003dFalse`(which is the default) and use project-scoped tokens to call this API with an overridden policy.\n\nAlso, I would think opening functionality up to domain users is more of a step in the right direction than trying to open this up for per-project admins managing projects. From what operators seem to tell us, HMT isn\u0027t something that\u0027s on their radar, but domain support is.\n\nhttps://bugs.launchpad.net/openstack-publiccloud-wg/+bug/1771584\nhttps://bugs.launchpad.net/openstack-publiccloud-wg/+bug/1771581\n\nThoughts?","commit_id":"b6a847e838bdcec666ed54f0456a50205d55bf61"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"9a02b31641fcd23bb183010b0b6b80a1eef5cc15","unresolved":false,"context_lines":[{"line_number":134,"context_line":"        refs \u003d PROVIDERS.resource_api.list_projects(hints\u003dhints)"},{"line_number":135,"context_line":"        if self.oslo_context.project_id:"},{"line_number":136,"context_line":"            filtered_refs \u003d ["},{"line_number":137,"context_line":"                p for p in refs if p[\u0027id\u0027] \u003d\u003d self.oslo_context.project_id"},{"line_number":138,"context_line":"            ]"},{"line_number":139,"context_line":"        else:"},{"line_number":140,"context_line":"            filtered_refs \u003d refs"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_03d45c1d","line":137,"in_reply_to":"3f79a3b5_37f447cd","updated":"2018-12-17 09:53:16.000000000","message":"I don\u0027t see how we can do anything about this now while enforce_scope\u003dFalse is still default and being used by devstack.\n\nI think in the future it makes sense to open this up to domain admins and project admins (or project readers?) to list subprojects of the project they are scoped to, even listing just one project makes sense for the sake of completeness and ease of use for clients, even if it\u0027s a little redundant. I just don\u0027t see how we can accomplish that right now, while scoping to a project is still essentially the only way to do administrative actions.","commit_id":"b6a847e838bdcec666ed54f0456a50205d55bf61"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"71fe6244330890dac4c47ef1e5efc458aa42b4f8","unresolved":false,"context_lines":[{"line_number":134,"context_line":"        refs \u003d PROVIDERS.resource_api.list_projects(hints\u003dhints)"},{"line_number":135,"context_line":"        if self.oslo_context.project_id:"},{"line_number":136,"context_line":"            filtered_refs \u003d ["},{"line_number":137,"context_line":"                p for p in refs if p[\u0027id\u0027] \u003d\u003d self.oslo_context.project_id"},{"line_number":138,"context_line":"            ]"},{"line_number":139,"context_line":"        else:"},{"line_number":140,"context_line":"            filtered_refs \u003d refs"}],"source_content_type":"text/x-python","patch_set":4,"id":"dfd5e7cf_590e25e6","line":137,"in_reply_to":"dfd5e7cf_1f24060d","updated":"2019-01-07 15:07:58.000000000","message":"\u003e I don\u0027t really like the idea of peeking into config in order to\n \u003e change the results of the API. I think what I\u0027d like to see is\n \u003e this:\n\nYeah - me either...\n\n \u003e \n \u003e * a system-scoped admin or reader can list all projects (this will\n \u003e still work for project-scoped admins with enforce_scope\u003dfalse for\n \u003e the time being)\n \u003e * a domain-scoped admin or reader can list all projects in their\n \u003e domain (won\u0027t break CI because we don\u0027t use domain admins for\n \u003e anything)\n \u003e * a project-scoped admin or reader can\u0027t list projects - listing\n \u003e one project isn\u0027t useful enough to be worth the extra complexity\n \u003e imo\n \u003e * defer dealing with hierarchical projects until enforce_scope is\n \u003e gone\n\nQuestion on your third bullet point. That\u0027s assuming enforce_scope\u003dTrue, right?","commit_id":"b6a847e838bdcec666ed54f0456a50205d55bf61"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"4a220f15095b9aa2dd1b94916bad31f5f62fe695","unresolved":false,"context_lines":[{"line_number":134,"context_line":"        refs \u003d PROVIDERS.resource_api.list_projects(hints\u003dhints)"},{"line_number":135,"context_line":"        if self.oslo_context.project_id:"},{"line_number":136,"context_line":"            filtered_refs \u003d ["},{"line_number":137,"context_line":"                p for p in refs if p[\u0027id\u0027] \u003d\u003d self.oslo_context.project_id"},{"line_number":138,"context_line":"            ]"},{"line_number":139,"context_line":"        else:"},{"line_number":140,"context_line":"            filtered_refs \u003d refs"}],"source_content_type":"text/x-python","patch_set":4,"id":"dfd5e7cf_d99d3567","line":137,"in_reply_to":"dfd5e7cf_590e25e6","updated":"2019-01-07 15:14:14.000000000","message":"Right, I guess I mean the desired/future behavior since technically with enforce_scope\u003dFalse we\u0027d always have the behavior of the top bullet.","commit_id":"b6a847e838bdcec666ed54f0456a50205d55bf61"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9106c9961fbe37c073472b73d9700f4c79cfae6e","unresolved":false,"context_lines":[{"line_number":134,"context_line":"        refs \u003d PROVIDERS.resource_api.list_projects(hints\u003dhints)"},{"line_number":135,"context_line":"        if self.oslo_context.project_id:"},{"line_number":136,"context_line":"            filtered_refs \u003d ["},{"line_number":137,"context_line":"                p for p in refs if p[\u0027id\u0027] \u003d\u003d self.oslo_context.project_id"},{"line_number":138,"context_line":"            ]"},{"line_number":139,"context_line":"        else:"},{"line_number":140,"context_line":"            filtered_refs \u003d refs"}],"source_content_type":"text/x-python","patch_set":4,"id":"dfd5e7cf_6b66aaf0","line":137,"in_reply_to":"dfd5e7cf_742c5047","updated":"2019-01-07 16:59:45.000000000","message":"Done","commit_id":"b6a847e838bdcec666ed54f0456a50205d55bf61"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"01d5cd06301d68d35279b1445c10f6021c38ae1f","unresolved":false,"context_lines":[{"line_number":134,"context_line":"        refs \u003d PROVIDERS.resource_api.list_projects(hints\u003dhints)"},{"line_number":135,"context_line":"        if self.oslo_context.project_id:"},{"line_number":136,"context_line":"            filtered_refs \u003d ["},{"line_number":137,"context_line":"                p for p in refs if p[\u0027id\u0027] \u003d\u003d self.oslo_context.project_id"},{"line_number":138,"context_line":"            ]"},{"line_number":139,"context_line":"        else:"},{"line_number":140,"context_line":"            filtered_refs \u003d refs"}],"source_content_type":"text/x-python","patch_set":4,"id":"dfd5e7cf_742c5047","line":137,"in_reply_to":"dfd5e7cf_d99d3567","updated":"2019-01-07 15:43:36.000000000","message":"Thanks for the clarification. I\u0027ll start reworking this per the notes here.","commit_id":"b6a847e838bdcec666ed54f0456a50205d55bf61"}],"keystone/common/policies/project.py":[{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"830ae1306066aa90b6cbbc71712701b353e8af0c","unresolved":false,"context_lines":[{"line_number":46,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":47,"context_line":"        name\u003dbase.IDENTITY % \u0027get_project\u0027,"},{"line_number":48,"context_line":"        check_str\u003dSYSTEM_READER_OR_PROJECT_USER,"},{"line_number":49,"context_line":"        # FIXME(lbragstad): The default check_str here should change to be just"},{"line_number":50,"context_line":"        # a role. The OR_TARGET_PROJECT bit of this check_str should actually"},{"line_number":51,"context_line":"        # be moved into keystone. A system administrator should be able to get"},{"line_number":52,"context_line":"        # any project in the deployement. A domain administrator should be"},{"line_number":53,"context_line":"        # able to get any project within their domain. A project administrator"},{"line_number":54,"context_line":"        # should be able to get their project or children of their project"},{"line_number":55,"context_line":"        # (maybe). This is going to require policy checks in code that make"},{"line_number":56,"context_line":"        # keystone smarter about handling these cases. Until we have those in"},{"line_number":57,"context_line":"        # place, we should keep scope_type commented out. Otherwise, we risk"},{"line_number":58,"context_line":"        # exposing information to people who don\u0027t have the correct"},{"line_number":59,"context_line":"        # authorization."},{"line_number":60,"context_line":"        scope_types\u003d[\u0027system\u0027, \u0027project\u0027],"},{"line_number":61,"context_line":"        description\u003d\u0027Show project details.\u0027,"},{"line_number":62,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027/v3/projects/{project_id}\u0027,"}],"source_content_type":"text/x-python","patch_set":2,"id":"3f79a3b5_f38a83c1","line":59,"range":{"start_line":49,"start_character":8,"end_line":59,"end_character":24},"updated":"2018-12-13 12:47:55.000000000","message":"Can we remove this now?","commit_id":"698fe070c357578d77d534c80a7a7d670dc71d72"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"da47147df42b3401d5be9aa5345eed481a9e809d","unresolved":false,"context_lines":[{"line_number":46,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":47,"context_line":"        name\u003dbase.IDENTITY % \u0027get_project\u0027,"},{"line_number":48,"context_line":"        check_str\u003dSYSTEM_READER_OR_PROJECT_USER,"},{"line_number":49,"context_line":"        # FIXME(lbragstad): The default check_str here should change to be just"},{"line_number":50,"context_line":"        # a role. The OR_TARGET_PROJECT bit of this check_str should actually"},{"line_number":51,"context_line":"        # be moved into keystone. A system administrator should be able to get"},{"line_number":52,"context_line":"        # any project in the deployement. A domain administrator should be"},{"line_number":53,"context_line":"        # able to get any project within their domain. A project administrator"},{"line_number":54,"context_line":"        # should be able to get their project or children of their project"},{"line_number":55,"context_line":"        # (maybe). This is going to require policy checks in code that make"},{"line_number":56,"context_line":"        # keystone smarter about handling these cases. Until we have those in"},{"line_number":57,"context_line":"        # place, we should keep scope_type commented out. Otherwise, we risk"},{"line_number":58,"context_line":"        # exposing information to people who don\u0027t have the correct"},{"line_number":59,"context_line":"        # authorization."},{"line_number":60,"context_line":"        scope_types\u003d[\u0027system\u0027, \u0027project\u0027],"},{"line_number":61,"context_line":"        description\u003d\u0027Show project details.\u0027,"},{"line_number":62,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027/v3/projects/{project_id}\u0027,"}],"source_content_type":"text/x-python","patch_set":2,"id":"3f79a3b5_df5f4176","line":59,"range":{"start_line":49,"start_character":8,"end_line":59,"end_character":24},"in_reply_to":"3f79a3b5_f38a83c1","updated":"2018-12-13 20:20:35.000000000","message":"We could. I was going to wait until later in the chain where we implement support for domain users (since this patch is specific to system-reader functionality).","commit_id":"698fe070c357578d77d534c80a7a7d670dc71d72"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"71dacfd92f76d4c9c3d28c1f0d447ab73ea436fd","unresolved":false,"context_lines":[{"line_number":80,"context_line":"        # administrators should be able to list projects they administer or"},{"line_number":81,"context_line":"        # possibly their children.  Until keystone is smart enought to handle"},{"line_number":82,"context_line":"        # those cases, keep scope_types set to \u0027system\u0027."},{"line_number":83,"context_line":"        scope_types\u003d[\u0027system\u0027, \u0027project\u0027],"},{"line_number":84,"context_line":"        description\u003d\u0027List projects.\u0027,"},{"line_number":85,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027/v3/projects\u0027,"},{"line_number":86,"context_line":"                     \u0027method\u0027: \u0027GET\u0027}],"}],"source_content_type":"text/x-python","patch_set":4,"id":"dfd5e7cf_c8b79cd8","line":83,"range":{"start_line":83,"start_character":32,"end_line":83,"end_character":39},"updated":"2019-01-07 16:34:01.000000000","message":"For now, we should revert this. Project API support with project-scoped tokens is going to be complicated since we support HMT (e.g., filtering subprojects when project admins call this API).\n\nThis will be easier to fix once we can assume enforce_scope\u003dTrue, because we don\u0027t have to support project admins being the deployment admins. Removing that case should make the filtering implementation easier and not based on configuration.","commit_id":"b6a847e838bdcec666ed54f0456a50205d55bf61"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9106c9961fbe37c073472b73d9700f4c79cfae6e","unresolved":false,"context_lines":[{"line_number":80,"context_line":"        # administrators should be able to list projects they administer or"},{"line_number":81,"context_line":"        # possibly their children.  Until keystone is smart enought to handle"},{"line_number":82,"context_line":"        # those cases, keep scope_types set to \u0027system\u0027."},{"line_number":83,"context_line":"        scope_types\u003d[\u0027system\u0027, \u0027project\u0027],"},{"line_number":84,"context_line":"        description\u003d\u0027List projects.\u0027,"},{"line_number":85,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027/v3/projects\u0027,"},{"line_number":86,"context_line":"                     \u0027method\u0027: \u0027GET\u0027}],"}],"source_content_type":"text/x-python","patch_set":4,"id":"dfd5e7cf_0b635ede","line":83,"range":{"start_line":83,"start_character":32,"end_line":83,"end_character":39},"in_reply_to":"dfd5e7cf_c8b79cd8","updated":"2019-01-07 16:59:45.000000000","message":"Done","commit_id":"b6a847e838bdcec666ed54f0456a50205d55bf61"},{"author":{"_account_id":15054,"name":"wangxiyuan","email":"wangxiyuan1007@gmail.com","username":"wangxiyuan"},"change_message_id":"0e5a860fada92cb2f7d93a59d9f0919476c3ac86","unresolved":false,"context_lines":[{"line_number":78,"context_line":"        # administrators should be able to list projects they administer or"},{"line_number":79,"context_line":"        # possibly their children.  Until keystone is smart enought to handle"},{"line_number":80,"context_line":"        # those cases, keep scope_types set to \u0027system\u0027."},{"line_number":81,"context_line":"        scope_types\u003d[\u0027system\u0027],"},{"line_number":82,"context_line":"        description\u003d\u0027List projects.\u0027,"},{"line_number":83,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027/v3/projects\u0027,"},{"line_number":84,"context_line":"                     \u0027method\u0027: \u0027GET\u0027}],"}],"source_content_type":"text/x-python","patch_set":5,"id":"dfd5e7cf_0a510637","line":81,"range":{"start_line":81,"start_character":22,"end_line":81,"end_character":28},"updated":"2019-01-08 15:12:41.000000000","message":"I wonder if a domain scoped request can list the projects in the domain?","commit_id":"b35928d5dcd8615d11c199c68c512aaa1dca4ec9"},{"author":{"_account_id":15054,"name":"wangxiyuan","email":"wangxiyuan1007@gmail.com","username":"wangxiyuan"},"change_message_id":"558408356b4367b32a941032c0a47f33b1766dee","unresolved":false,"context_lines":[{"line_number":78,"context_line":"        # administrators should be able to list projects they administer or"},{"line_number":79,"context_line":"        # possibly their children.  Until keystone is smart enought to handle"},{"line_number":80,"context_line":"        # those cases, keep scope_types set to \u0027system\u0027."},{"line_number":81,"context_line":"        scope_types\u003d[\u0027system\u0027],"},{"line_number":82,"context_line":"        description\u003d\u0027List projects.\u0027,"},{"line_number":83,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027/v3/projects\u0027,"},{"line_number":84,"context_line":"                     \u0027method\u0027: \u0027GET\u0027}],"}],"source_content_type":"text/x-python","patch_set":5,"id":"dfd5e7cf_07efb384","line":81,"range":{"start_line":81,"start_character":22,"end_line":81,"end_character":28},"in_reply_to":"dfd5e7cf_007b278c","updated":"2019-01-09 01:45:16.000000000","message":"oh, good to know","commit_id":"b35928d5dcd8615d11c199c68c512aaa1dca4ec9"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f665f58e44b4f2d39eee99e39fbab900d57c59bc","unresolved":false,"context_lines":[{"line_number":78,"context_line":"        # administrators should be able to list projects they administer or"},{"line_number":79,"context_line":"        # possibly their children.  Until keystone is smart enought to handle"},{"line_number":80,"context_line":"        # those cases, keep scope_types set to \u0027system\u0027."},{"line_number":81,"context_line":"        scope_types\u003d[\u0027system\u0027],"},{"line_number":82,"context_line":"        description\u003d\u0027List projects.\u0027,"},{"line_number":83,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027/v3/projects\u0027,"},{"line_number":84,"context_line":"                     \u0027method\u0027: \u0027GET\u0027}],"}],"source_content_type":"text/x-python","patch_set":5,"id":"dfd5e7cf_007b278c","line":81,"range":{"start_line":81,"start_character":22,"end_line":81,"end_character":28},"in_reply_to":"dfd5e7cf_0a510637","updated":"2019-01-08 15:45:43.000000000","message":"Yep - that should be coming in a subsequent patch.\n\nhttps://review.openstack.org/#/c/624218/","commit_id":"b35928d5dcd8615d11c199c68c512aaa1dca4ec9"}],"keystone/tests/unit/protection/v3/test_projects.py":[{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"830ae1306066aa90b6cbbc71712701b353e8af0c","unresolved":false,"context_lines":[{"line_number":44,"context_line":"            project_ids \u003d []"},{"line_number":45,"context_line":"            for project in r.json[\u0027projects\u0027]:"},{"line_number":46,"context_line":"                project_ids.append(project[\u0027id\u0027])"},{"line_number":47,"context_line":"            self.assertIn(project[\u0027id\u0027], project_ids)"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"    def test_user_can_list_their_projects(self):"},{"line_number":50,"context_line":"        other_project \u003d PROVIDERS.resource_api.create_project("}],"source_content_type":"text/x-python","patch_set":2,"id":"3f79a3b5_0e96f8a0","line":47,"updated":"2018-12-13 12:47:55.000000000","message":"Am I misreading this? A user with a reader role in one project is allowed to list all projects? Do you maybe want to have a self.assertEqual(1, len(result)) to ensure it\u0027s not really listing all projects?","commit_id":"698fe070c357578d77d534c80a7a7d670dc71d72"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"da47147df42b3401d5be9aa5345eed481a9e809d","unresolved":false,"context_lines":[{"line_number":44,"context_line":"            project_ids \u003d []"},{"line_number":45,"context_line":"            for project in r.json[\u0027projects\u0027]:"},{"line_number":46,"context_line":"                project_ids.append(project[\u0027id\u0027])"},{"line_number":47,"context_line":"            self.assertIn(project[\u0027id\u0027], project_ids)"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"    def test_user_can_list_their_projects(self):"},{"line_number":50,"context_line":"        other_project \u003d PROVIDERS.resource_api.create_project("}],"source_content_type":"text/x-python","patch_set":2,"id":"3f79a3b5_ff51dd66","line":47,"in_reply_to":"3f79a3b5_0e96f8a0","updated":"2018-12-13 20:20:35.000000000","message":"You\u0027re right. I can make this assertion stronger.","commit_id":"698fe070c357578d77d534c80a7a7d670dc71d72"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"830ae1306066aa90b6cbbc71712701b353e8af0c","unresolved":false,"context_lines":[{"line_number":68,"context_line":"            )"},{"line_number":69,"context_line":"            self.assertEqual(1, len(r.json[\u0027projects\u0027]))"},{"line_number":70,"context_line":"            self.assertEqual(user_project[\u0027id\u0027], r.json[\u0027projects\u0027][0][\u0027id\u0027])"},{"line_number":71,"context_line":"            self.assertNotEqual("},{"line_number":72,"context_line":"                other_project[\u0027id\u0027], r.json[\u0027projects\u0027][0][\u0027id\u0027]"},{"line_number":73,"context_line":"            )"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"    def test_user_can_get_their_project(self):"},{"line_number":76,"context_line":"        project \u003d PROVIDERS.resource_api.create_project("}],"source_content_type":"text/x-python","patch_set":2,"id":"3f79a3b5_4e3dd0b7","line":73,"range":{"start_line":71,"start_character":12,"end_line":73,"end_character":13},"updated":"2018-12-13 12:47:55.000000000","message":"There\u0027s no reason this would be true, regardless of how the API is protected.","commit_id":"698fe070c357578d77d534c80a7a7d670dc71d72"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"da47147df42b3401d5be9aa5345eed481a9e809d","unresolved":false,"context_lines":[{"line_number":68,"context_line":"            )"},{"line_number":69,"context_line":"            self.assertEqual(1, len(r.json[\u0027projects\u0027]))"},{"line_number":70,"context_line":"            self.assertEqual(user_project[\u0027id\u0027], r.json[\u0027projects\u0027][0][\u0027id\u0027])"},{"line_number":71,"context_line":"            self.assertNotEqual("},{"line_number":72,"context_line":"                other_project[\u0027id\u0027], r.json[\u0027projects\u0027][0][\u0027id\u0027]"},{"line_number":73,"context_line":"            )"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"    def test_user_can_get_their_project(self):"},{"line_number":76,"context_line":"        project \u003d PROVIDERS.resource_api.create_project("}],"source_content_type":"text/x-python","patch_set":2,"id":"3f79a3b5_7fa14d3b","line":73,"range":{"start_line":71,"start_character":12,"end_line":73,"end_character":13},"in_reply_to":"3f79a3b5_4e3dd0b7","updated":"2018-12-13 20:20:35.000000000","message":"Done","commit_id":"698fe070c357578d77d534c80a7a7d670dc71d72"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"830ae1306066aa90b6cbbc71712701b353e8af0c","unresolved":false,"context_lines":[{"line_number":101,"context_line":"            r \u003d c.get(\u0027/v3/projects\u0027, headers\u003dself.headers)"},{"line_number":102,"context_line":"            self.assertEqual(2, len(r.json[\u0027projects\u0027]))"},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"    def test_user_can_list_projects_for_other_users(self):"},{"line_number":105,"context_line":"        project \u003d PROVIDERS.resource_api.create_project("},{"line_number":106,"context_line":"            uuid.uuid4().hex,"},{"line_number":107,"context_line":"            unit.new_project_ref(domain_id\u003dCONF.identity.default_domain_id)"}],"source_content_type":"text/x-python","patch_set":2,"id":"3f79a3b5_aec10486","line":104,"range":{"start_line":104,"start_character":8,"end_line":104,"end_character":51},"updated":"2018-12-13 12:47:55.000000000","message":"What? Really?","commit_id":"698fe070c357578d77d534c80a7a7d670dc71d72"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"da47147df42b3401d5be9aa5345eed481a9e809d","unresolved":false,"context_lines":[{"line_number":101,"context_line":"            r \u003d c.get(\u0027/v3/projects\u0027, headers\u003dself.headers)"},{"line_number":102,"context_line":"            self.assertEqual(2, len(r.json[\u0027projects\u0027]))"},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"    def test_user_can_list_projects_for_other_users(self):"},{"line_number":105,"context_line":"        project \u003d PROVIDERS.resource_api.create_project("},{"line_number":106,"context_line":"            uuid.uuid4().hex,"},{"line_number":107,"context_line":"            unit.new_project_ref(domain_id\u003dCONF.identity.default_domain_id)"}],"source_content_type":"text/x-python","patch_set":2,"id":"3f79a3b5_bf55a522","line":104,"range":{"start_line":104,"start_character":8,"end_line":104,"end_character":51},"in_reply_to":"3f79a3b5_aec10486","updated":"2018-12-13 20:20:35.000000000","message":"Yeah, this one caught me off guard...\n\nAs far as I can tell, based on the policy for this endpoint, this functionality was specific to system administrators, which is completely redundant with GET /v3/role_assignments and the usage of filters.\n\nIf this was originally developed to be introduced to end users, then it\u0027s completely redundant with GET /v3/auth/projects.\n\nTo be honest, I\u0027m not sure why this API exists.","commit_id":"698fe070c357578d77d534c80a7a7d670dc71d72"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1d3e2ca46157ccf8de44170581cb04dfae391c27","unresolved":false,"context_lines":[{"line_number":101,"context_line":"            r \u003d c.get(\u0027/v3/projects\u0027, headers\u003dself.headers)"},{"line_number":102,"context_line":"            self.assertEqual(2, len(r.json[\u0027projects\u0027]))"},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"    def test_user_can_list_projects_for_other_users(self):"},{"line_number":105,"context_line":"        project \u003d PROVIDERS.resource_api.create_project("},{"line_number":106,"context_line":"            uuid.uuid4().hex,"},{"line_number":107,"context_line":"            unit.new_project_ref(domain_id\u003dCONF.identity.default_domain_id)"}],"source_content_type":"text/x-python","patch_set":2,"id":"3f79a3b5_54855308","line":104,"range":{"start_line":104,"start_character":8,"end_line":104,"end_character":51},"in_reply_to":"3f79a3b5_b1dcf944","updated":"2018-12-13 21:34:20.000000000","message":"I think I have a mistake here.\n\nChanging it to \u0027(role:reader and system_scope:all) or project_id:%(target.project.id)s\u0027 should mean that a user with `reader` on the system can access this API and users with project scoped tokens matching the project ID supplied in the target can access this API.\n\nBut, according to keystone/api/users.py. we\u0027re not populating project information in the target dictionary when we do enforcement [0], at least not from what I can tell. I think my mistake might have been that I assumed this was a redundant check string with other policies in this module, but that example shows that it clearly doesn\u0027t make sense.\n\nOk, so if I have this straight. Default system users should be able to call this API. Users should be able to call this API with their own user ID (restoring the previous \"owner\" policy).\n\nShould we continue to evolve the policy to allow domain users to be able to call this API for users within their domain? Note, the output is likely going to need to be sanitized in that case to only include projects within the domain the user is in, too... Otherwise, it might be possible to leak information if a user has a role assignment on a project in another domain.\n\nGood catch.\n\n[0] https://git.openstack.org/cgit/openstack/keystone/tree/keystone/api/users.py#n225","commit_id":"698fe070c357578d77d534c80a7a7d670dc71d72"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"e56413d6b97c8eb302694ad8a879e0a751704c14","unresolved":false,"context_lines":[{"line_number":101,"context_line":"            r \u003d c.get(\u0027/v3/projects\u0027, headers\u003dself.headers)"},{"line_number":102,"context_line":"            self.assertEqual(2, len(r.json[\u0027projects\u0027]))"},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"    def test_user_can_list_projects_for_other_users(self):"},{"line_number":105,"context_line":"        project \u003d PROVIDERS.resource_api.create_project("},{"line_number":106,"context_line":"            uuid.uuid4().hex,"},{"line_number":107,"context_line":"            unit.new_project_ref(domain_id\u003dCONF.identity.default_domain_id)"}],"source_content_type":"text/x-python","patch_set":2,"id":"3f79a3b5_b1dcf944","line":104,"range":{"start_line":104,"start_character":8,"end_line":104,"end_character":51},"in_reply_to":"3f79a3b5_bf55a522","updated":"2018-12-13 20:42:40.000000000","message":"The original rule is `rule:admin_or_owner` which translates to `role:admin or user_id:%(user_id)s`, which I think means the user can view their own projects by calling the API with their own user_id, so yes it would be redundant with /v3/auth/projects but we have a lot of redundancies. Doesn\u0027t changing it to `... or project_id:%(target.project.id)s` mean that an authorization on *any* project allows the user the right to call this API with *any* user_id as a request target? I do not read that as the original intention of this rule and even if it was that seems completely broken to me.","commit_id":"698fe070c357578d77d534c80a7a7d670dc71d72"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"830ae1306066aa90b6cbbc71712701b353e8af0c","unresolved":false,"context_lines":[{"line_number":136,"context_line":"            r \u003d c.get(\u0027/v3/projects/%s\u0027 % project[\u0027id\u0027], headers\u003dself.headers)"},{"line_number":137,"context_line":"            self.assertEqual(project[\u0027id\u0027], r.json[\u0027project\u0027][\u0027id\u0027])"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"    def test_user_cannot_get_non_existant_project_not_found(self):"},{"line_number":140,"context_line":"        with self.test_client() as c:"},{"line_number":141,"context_line":"            c.get("},{"line_number":142,"context_line":"                \u0027/v3/projects/%s\u0027 % uuid.uuid4().hex, headers\u003dself.headers,"},{"line_number":143,"context_line":"                expected_status_code\u003dhttp_client.NOT_FOUND"},{"line_number":144,"context_line":"            )"},{"line_number":145,"context_line":""},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"class _SystemMemberAndReaderProjectTests(object):"}],"source_content_type":"text/x-python","patch_set":2,"id":"3f79a3b5_2eb5f41a","line":144,"range":{"start_line":139,"start_character":4,"end_line":144,"end_character":13},"updated":"2018-12-13 12:47:55.000000000","message":"This test doesn\u0027t make any sense to have in the RBAC tests, unless we want to test that an existing project a user doesn\u0027t have access to returns a 404 instead of a 403","commit_id":"698fe070c357578d77d534c80a7a7d670dc71d72"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"da47147df42b3401d5be9aa5345eed481a9e809d","unresolved":false,"context_lines":[{"line_number":136,"context_line":"            r \u003d c.get(\u0027/v3/projects/%s\u0027 % project[\u0027id\u0027], headers\u003dself.headers)"},{"line_number":137,"context_line":"            self.assertEqual(project[\u0027id\u0027], r.json[\u0027project\u0027][\u0027id\u0027])"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"    def test_user_cannot_get_non_existant_project_not_found(self):"},{"line_number":140,"context_line":"        with self.test_client() as c:"},{"line_number":141,"context_line":"            c.get("},{"line_number":142,"context_line":"                \u0027/v3/projects/%s\u0027 % uuid.uuid4().hex, headers\u003dself.headers,"},{"line_number":143,"context_line":"                expected_status_code\u003dhttp_client.NOT_FOUND"},{"line_number":144,"context_line":"            )"},{"line_number":145,"context_line":""},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"class _SystemMemberAndReaderProjectTests(object):"}],"source_content_type":"text/x-python","patch_set":2,"id":"3f79a3b5_7112e158","line":144,"range":{"start_line":139,"start_character":4,"end_line":144,"end_character":13},"in_reply_to":"3f79a3b5_2eb5f41a","updated":"2018-12-13 20:20:35.000000000","message":"Exactly.\n\nWhat I\u0027m testing for here is that people who are authorized call this API get a 404 and those who are not authorized get a 403, regardless of the project existing or not.","commit_id":"698fe070c357578d77d534c80a7a7d670dc71d72"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a5b4fafdc90d69c4ad31d5458bbd1c2bfb03b98f","unresolved":false,"context_lines":[{"line_number":25,"context_line":"PROVIDERS \u003d provider_api.ProviderAPIs"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"class _CommonUserTests(object):"},{"line_number":29,"context_line":"    \"\"\"Common functionality for all users regardless of role or scope.\"\"\""},{"line_number":30,"context_line":""},{"line_number":31,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"dfd5e7cf_483e4c2a","line":28,"range":{"start_line":28,"start_character":6,"end_line":28,"end_character":22},"updated":"2019-01-07 16:37:20.000000000","message":"Remove this.","commit_id":"b6a847e838bdcec666ed54f0456a50205d55bf61"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9106c9961fbe37c073472b73d9700f4c79cfae6e","unresolved":false,"context_lines":[{"line_number":25,"context_line":"PROVIDERS \u003d provider_api.ProviderAPIs"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"class _CommonUserTests(object):"},{"line_number":29,"context_line":"    \"\"\"Common functionality for all users regardless of role or scope.\"\"\""},{"line_number":30,"context_line":""},{"line_number":31,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"dfd5e7cf_cb9a36c4","line":28,"range":{"start_line":28,"start_character":6,"end_line":28,"end_character":22},"in_reply_to":"dfd5e7cf_483e4c2a","updated":"2019-01-07 16:59:45.000000000","message":"Done","commit_id":"b6a847e838bdcec666ed54f0456a50205d55bf61"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a5b4fafdc90d69c4ad31d5458bbd1c2bfb03b98f","unresolved":false,"context_lines":[{"line_number":220,"context_line":"    # about the project, like the name or owning domain, but from a listing"},{"line_number":221,"context_line":"    # perspective, I\u0027m not sure I see the value in this type of functionality?"},{"line_number":222,"context_line":"    # Maybe GET /v3/projects should be left for only system and domain users..."},{"line_number":223,"context_line":"    def test_user_can_list_projects(self):"},{"line_number":224,"context_line":"        # This test is assuming the user calling the API has a role assignment"},{"line_number":225,"context_line":"        # on the project created by ``keystone-manage bootstrap``."},{"line_number":226,"context_line":"        with self.test_client() as c:"}],"source_content_type":"text/x-python","patch_set":4,"id":"dfd5e7cf_e80aa088","line":223,"range":{"start_line":223,"start_character":8,"end_line":223,"end_character":35},"updated":"2019-01-07 16:37:20.000000000","message":"Rewrite this to expect a 403. Support for this case can come at a late time, once we can safely assume system administrators are used consistently.","commit_id":"b6a847e838bdcec666ed54f0456a50205d55bf61"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9106c9961fbe37c073472b73d9700f4c79cfae6e","unresolved":false,"context_lines":[{"line_number":220,"context_line":"    # about the project, like the name or owning domain, but from a listing"},{"line_number":221,"context_line":"    # perspective, I\u0027m not sure I see the value in this type of functionality?"},{"line_number":222,"context_line":"    # Maybe GET /v3/projects should be left for only system and domain users..."},{"line_number":223,"context_line":"    def test_user_can_list_projects(self):"},{"line_number":224,"context_line":"        # This test is assuming the user calling the API has a role assignment"},{"line_number":225,"context_line":"        # on the project created by ``keystone-manage bootstrap``."},{"line_number":226,"context_line":"        with self.test_client() as c:"}],"source_content_type":"text/x-python","patch_set":4,"id":"dfd5e7cf_eb9ffab1","line":223,"range":{"start_line":223,"start_character":8,"end_line":223,"end_character":35},"in_reply_to":"dfd5e7cf_e80aa088","updated":"2019-01-07 16:59:45.000000000","message":"Done","commit_id":"b6a847e838bdcec666ed54f0456a50205d55bf61"}]}