)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"764bcd02eb1efcdbbacc4a53dd6b802f093ea489","unresolved":false,"context_lines":[{"line_number":7,"context_line":"Implement domain admin functionality for projects"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This commit add explicit testing to show how users with the admin role"},{"line_number":10,"context_line":"on a domain can manage projects within thier domain. It also modifies"},{"line_number":11,"context_line":"the default policies to account for this functionality. A subsequent"},{"line_number":12,"context_line":"patch will do the same for project users."},{"line_number":13,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":7,"id":"5fc1f717_e325290a","line":10,"range":{"start_line":10,"start_character":39,"end_line":10,"end_character":44},"updated":"2019-03-15 12:02:48.000000000","message":"their","commit_id":"ff1170e87a55a217414a95352b414522c029e7b5"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"230453586a994d8d556452a0b6485aa0f851a9a7","unresolved":false,"context_lines":[{"line_number":7,"context_line":"Implement domain admin functionality for projects"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This commit add explicit testing to show how users with the admin role"},{"line_number":10,"context_line":"on a domain can manage projects within thier domain. It also modifies"},{"line_number":11,"context_line":"the default policies to account for this functionality. A subsequent"},{"line_number":12,"context_line":"patch will do the same for project users."},{"line_number":13,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":7,"id":"5fc1f717_539fcab3","line":10,"range":{"start_line":10,"start_character":39,"end_line":10,"end_character":44},"in_reply_to":"5fc1f717_e325290a","updated":"2019-03-20 20:19:40.000000000","message":"Done","commit_id":"ff1170e87a55a217414a95352b414522c029e7b5"}],"keystone/common/policies/project.py":[{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"764bcd02eb1efcdbbacc4a53dd6b802f093ea489","unresolved":false,"context_lines":[{"line_number":43,"context_line":""},{"line_number":44,"context_line":"SYSTEM_ADMIN_OR_DOMAIN_ADMIN \u003d ("},{"line_number":45,"context_line":"    \u0027(role:admin and system_scope:all) or \u0027"},{"line_number":46,"context_line":"    \u0027(role:admin and domain_id:%(target.project.domain_id)s)\u0027"},{"line_number":47,"context_line":")"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"deprecated_list_projects \u003d policy.DeprecatedRule("}],"source_content_type":"text/x-python","patch_set":7,"id":"5fc1f717_0382b5c8","line":46,"range":{"start_line":46,"start_character":21,"end_line":46,"end_character":61},"updated":"2019-03-15 12:02:48.000000000","message":"Remind me why it\u0027s target.project.domain_id here but just target.domain_id above?","commit_id":"ff1170e87a55a217414a95352b414522c029e7b5"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"230453586a994d8d556452a0b6485aa0f851a9a7","unresolved":false,"context_lines":[{"line_number":43,"context_line":""},{"line_number":44,"context_line":"SYSTEM_ADMIN_OR_DOMAIN_ADMIN \u003d ("},{"line_number":45,"context_line":"    \u0027(role:admin and system_scope:all) or \u0027"},{"line_number":46,"context_line":"    \u0027(role:admin and domain_id:%(target.project.domain_id)s)\u0027"},{"line_number":47,"context_line":")"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"deprecated_list_projects \u003d policy.DeprecatedRule("}],"source_content_type":"text/x-python","patch_set":7,"id":"5fc1f717_1345c217","line":46,"range":{"start_line":46,"start_character":21,"end_line":46,"end_character":61},"in_reply_to":"5fc1f717_0382b5c8","updated":"2019-03-20 20:19:40.000000000","message":"It\u0027s because we\u0027re working on a list API, which is kinda weird. Line 41 needs target.domain_id which is the domain ID from a domain-scoped token. Because we\u0027re not passing a project_id or anything like as a target, we can\u0027t use something like %(target.project.domain_id)s, since there isn\u0027t a project involved in this request.\n\nLine 41 is really just a way to ensure we require either a system-scoped token or a project-scoped token if someone is using the defaults.\n\nLine 46 is actually getting used on the GET /v3/projects/{project_id} API, so we can make assertions about the project in the request. If that makes sense?\n\n\nhttps://review.openstack.org/#/c/624220/7/keystone/api/projects.py,unified@119","commit_id":"ff1170e87a55a217414a95352b414522c029e7b5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"a818b69892ac8dc2263bc418a416fd5efb222718","unresolved":false,"context_lines":[{"line_number":43,"context_line":""},{"line_number":44,"context_line":"SYSTEM_ADMIN_OR_DOMAIN_ADMIN \u003d ("},{"line_number":45,"context_line":"    \u0027(role:admin and system_scope:all) or \u0027"},{"line_number":46,"context_line":"    \u0027(role:admin and domain_id:%(target.project.domain_id)s)\u0027"},{"line_number":47,"context_line":")"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"deprecated_list_projects \u003d policy.DeprecatedRule("}],"source_content_type":"text/x-python","patch_set":7,"id":"5fc1f717_37d78126","line":46,"range":{"start_line":46,"start_character":21,"end_line":46,"end_character":61},"in_reply_to":"5fc1f717_1345c217","updated":"2019-03-21 09:36:37.000000000","message":"Gotcha, this makes more sense after starting to work through it myself with the group API. The target.domain_id above comes from the target \u003d {\u0027domain_id\u0027: self.oslo_context.domain_id} in the GET project API.","commit_id":"ff1170e87a55a217414a95352b414522c029e7b5"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"fe69792c4db7f3e194210acb4a4fd4d538a84cdb","unresolved":false,"context_lines":[{"line_number":43,"context_line":""},{"line_number":44,"context_line":"SYSTEM_ADMIN_OR_DOMAIN_ADMIN \u003d ("},{"line_number":45,"context_line":"    \u0027(role:admin and system_scope:all) or \u0027"},{"line_number":46,"context_line":"    \u0027(role:admin and domain_id:%(target.project.domain_id)s)\u0027"},{"line_number":47,"context_line":")"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"deprecated_list_projects \u003d policy.DeprecatedRule("}],"source_content_type":"text/x-python","patch_set":7,"id":"5fc1f717_4ee94f7e","line":46,"range":{"start_line":46,"start_character":21,"end_line":46,"end_character":61},"in_reply_to":"5fc1f717_37d78126","updated":"2019-03-21 13:58:01.000000000","message":"Yep.\n\nI don\u0027t think it is very intuitive and it is hard for people to grok, myself included.\n\nOutside of that, I think it might be slightly accident prone because if a developer needs to use this technique, they should also be filtering the response accordingly. If they don\u0027t, we risk a security vulnerability.\n\nI\u0027m open to suggestions to make this easier to understand and less error-prone.","commit_id":"ff1170e87a55a217414a95352b414522c029e7b5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"89985a8f0d992a585eca9ada5e28e2348467b4f1","unresolved":false,"context_lines":[{"line_number":43,"context_line":""},{"line_number":44,"context_line":"SYSTEM_ADMIN_OR_DOMAIN_ADMIN \u003d ("},{"line_number":45,"context_line":"    \u0027(role:admin and system_scope:all) or \u0027"},{"line_number":46,"context_line":"    \u0027(role:admin and domain_id:%(target.project.domain_id)s)\u0027"},{"line_number":47,"context_line":")"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"deprecated_list_projects \u003d policy.DeprecatedRule("}],"source_content_type":"text/x-python","patch_set":7,"id":"5fc1f717_ce069f21","line":46,"range":{"start_line":46,"start_character":21,"end_line":46,"end_character":61},"in_reply_to":"5fc1f717_4ee94f7e","updated":"2019-03-21 14:02:02.000000000","message":"Your guess is as good as mine. I think having a strong foundation of unit tests to copy off of that show how things are supposed to behave is a good start.","commit_id":"ff1170e87a55a217414a95352b414522c029e7b5"}],"keystone/tests/unit/protection/v3/test_projects.py":[{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"764bcd02eb1efcdbbacc4a53dd6b802f093ea489","unresolved":false,"context_lines":[{"line_number":693,"context_line":"                expected_status_code\u003dhttp_client.FORBIDDEN"},{"line_number":694,"context_line":"            )"},{"line_number":695,"context_line":""},{"line_number":696,"context_line":"    def test_user_cannot_update_non_existant_project_forbidden(self):"},{"line_number":697,"context_line":"        # Because domain users operate outside of system scope, we can\u0027t"},{"line_number":698,"context_line":"        # confidently return a Not Found here because they aren\u0027t system users."},{"line_number":699,"context_line":"        # The best we can do is return a Forbidden because we need the"}],"source_content_type":"text/x-python","patch_set":7,"id":"5fc1f717_83e305a4","line":696,"range":{"start_line":696,"start_character":36,"end_line":696,"end_character":44},"updated":"2019-03-15 12:02:48.000000000","message":"existent","commit_id":"ff1170e87a55a217414a95352b414522c029e7b5"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a309d53115c6f63ebcb29892365f696a6a95a311","unresolved":false,"context_lines":[{"line_number":693,"context_line":"                expected_status_code\u003dhttp_client.FORBIDDEN"},{"line_number":694,"context_line":"            )"},{"line_number":695,"context_line":""},{"line_number":696,"context_line":"    def test_user_cannot_update_non_existant_project_forbidden(self):"},{"line_number":697,"context_line":"        # Because domain users operate outside of system scope, we can\u0027t"},{"line_number":698,"context_line":"        # confidently return a Not Found here because they aren\u0027t system users."},{"line_number":699,"context_line":"        # The best we can do is return a Forbidden because we need the"}],"source_content_type":"text/x-python","patch_set":7,"id":"5fc1f717_9350d2d6","line":696,"range":{"start_line":696,"start_character":36,"end_line":696,"end_character":44},"in_reply_to":"5fc1f717_83e305a4","updated":"2019-03-20 20:21:26.000000000","message":"If I had a nickle...","commit_id":"ff1170e87a55a217414a95352b414522c029e7b5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"764bcd02eb1efcdbbacc4a53dd6b802f093ea489","unresolved":false,"context_lines":[{"line_number":730,"context_line":"                expected_status_code\u003dhttp_client.FORBIDDEN"},{"line_number":731,"context_line":"            )"},{"line_number":732,"context_line":""},{"line_number":733,"context_line":"    def test_user_cannot_delete_non_existant_projects_forbidden(self):"},{"line_number":734,"context_line":"        # Because domain users operate outside of system scope, we can\u0027t"},{"line_number":735,"context_line":"        # confidently return a Not Found here because they aren\u0027t system users."},{"line_number":736,"context_line":"        # The best we can do is return a Forbidden because we need the"}],"source_content_type":"text/x-python","patch_set":7,"id":"5fc1f717_03d075c8","line":733,"range":{"start_line":733,"start_character":36,"end_line":733,"end_character":44},"updated":"2019-03-15 12:02:48.000000000","message":"existent","commit_id":"ff1170e87a55a217414a95352b414522c029e7b5"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a309d53115c6f63ebcb29892365f696a6a95a311","unresolved":false,"context_lines":[{"line_number":730,"context_line":"                expected_status_code\u003dhttp_client.FORBIDDEN"},{"line_number":731,"context_line":"            )"},{"line_number":732,"context_line":""},{"line_number":733,"context_line":"    def test_user_cannot_delete_non_existant_projects_forbidden(self):"},{"line_number":734,"context_line":"        # Because domain users operate outside of system scope, we can\u0027t"},{"line_number":735,"context_line":"        # confidently return a Not Found here because they aren\u0027t system users."},{"line_number":736,"context_line":"        # The best we can do is return a Forbidden because we need the"}],"source_content_type":"text/x-python","patch_set":7,"id":"5fc1f717_135e22e6","line":733,"range":{"start_line":733,"start_character":36,"end_line":733,"end_character":44},"in_reply_to":"5fc1f717_03d075c8","updated":"2019-03-20 20:21:26.000000000","message":"Done","commit_id":"ff1170e87a55a217414a95352b414522c029e7b5"}]}