)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"8f71dd62039aa71cbb7fa59b4440bbbc3fda3387","unresolved":false,"context_lines":[{"line_number":11,"context_line":"to create a trust with an empty roles list and project_id specified."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"This results in 401 responses whenever you try to consume the trust,"},{"line_number":14,"context_line":"which is not exactly obvious until you realize what\u0027s happening."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"This patch will add a check in trust creation to fix the bug."},{"line_number":17,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"AAAAUH%2F%2Bcpg%3D","line":14,"updated":"2014-01-26 07:09:31.000000000","message":"replace this line with \"because there are no roles for the trustee on the authorized project.\"","commit_id":"3c723125c68e747955363cad7d41a41d3a790db6"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"8f71dd62039aa71cbb7fa59b4440bbbc3fda3387","unresolved":false,"context_lines":[{"line_number":13,"context_line":"This results in 401 responses whenever you try to consume the trust,"},{"line_number":14,"context_line":"which is not exactly obvious until you realize what\u0027s happening."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"This patch will add a check in trust creation to fix the bug."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Change-Id: Iebad0b6b7ed62a029d1e50afb003679bafb1655d"},{"line_number":19,"context_line":"Closes-Bug: #1214064"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"AAAAUH%2F%2BcpY%3D","line":16,"updated":"2014-01-26 07:09:31.000000000","message":"a check in trust creation ... to ensure at least one role exists ...","commit_id":"3c723125c68e747955363cad7d41a41d3a790db6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f3500fea84cb0d25249d73c0cae68cca9ca58197","unresolved":false,"context_lines":[{"line_number":16,"context_line":"This patch will add a check in trust creation to ensure at least one"},{"line_number":17,"context_line":"role exists."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"DocImpact"},{"line_number":20,"context_line":"Change-Id: Iebad0b6b7ed62a029d1e50afb003679bafb1655d"},{"line_number":21,"context_line":"Closes-Bug: #1214064"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"AAAAUH%2F94gs%3D","line":19,"updated":"2014-02-02 14:48:16.000000000","message":"not sure what the docimpact is since according to the first paragraph of the commit message the documentation says this already.","commit_id":"5aa637f8191406ec5e26d574e70177cb8a9fb2f1"}],"keystone/tests/test_auth.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f3500fea84cb0d25249d73c0cae68cca9ca58197","unresolved":false,"context_lines":[{"line_number":706,"context_line":"    def test_create_trust_no_roles(self):"},{"line_number":707,"context_line":"        context \u003d {\u0027token_id\u0027: self.unscoped_token[\u0027access\u0027][\u0027token\u0027][\u0027id\u0027]}"},{"line_number":708,"context_line":"        self.sample_data[\u0027roles\u0027] \u003d []"},{"line_number":709,"context_line":"        self.assertRaises(exception.ValidationError,"},{"line_number":710,"context_line":"                          self.trust_controller.create_trust,"},{"line_number":711,"context_line":"                          context, trust\u003dself.sample_data)"},{"line_number":712,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAUH%2F94gk%3D","line":709,"updated":"2014-02-02 14:48:16.000000000","message":"this should be returning 403 Forbidden and not 400 Bad Request.","commit_id":"5aa637f8191406ec5e26d574e70177cb8a9fb2f1"}],"keystone/tests/test_v3_auth.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f3500fea84cb0d25249d73c0cae68cca9ca58197","unresolved":false,"context_lines":[{"line_number":2033,"context_line":"            trustor_user_id\u003dself.user_id,"},{"line_number":2034,"context_line":"            trustee_user_id\u003dself.trustee_user_id)"},{"line_number":2035,"context_line":"        del ref[\u0027id\u0027]"},{"line_number":2036,"context_line":"        self.post(\u0027/OS-TRUST/trusts\u0027, body\u003d{\u0027trust\u0027: ref}, expected_status\u003d400)"},{"line_number":2037,"context_line":""},{"line_number":2038,"context_line":"    def test_trust_crud(self):"},{"line_number":2039,"context_line":"        ref \u003d self.new_trust_ref("}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAUH%2F94gg%3D","line":2036,"updated":"2014-02-02 14:48:16.000000000","message":"why can\u0027t an unscoped trust be created anymore?","commit_id":"5aa637f8191406ec5e26d574e70177cb8a9fb2f1"},{"author":{"_account_id":9101,"name":"wanghong","email":"reviewwanghong@126.com","username":"wanghong"},"change_message_id":"eb1adfe194bf299239f9ba30b134121b5fe66ec2","unresolved":false,"context_lines":[{"line_number":2033,"context_line":"            trustor_user_id\u003dself.user_id,"},{"line_number":2034,"context_line":"            trustee_user_id\u003dself.trustee_user_id)"},{"line_number":2035,"context_line":"        del ref[\u0027id\u0027]"},{"line_number":2036,"context_line":"        self.post(\u0027/OS-TRUST/trusts\u0027, body\u003d{\u0027trust\u0027: ref}, expected_status\u003d400)"},{"line_number":2037,"context_line":""},{"line_number":2038,"context_line":"    def test_trust_crud(self):"},{"line_number":2039,"context_line":"        ref \u003d self.new_trust_ref("}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAUX%2F%2BThQ%3D","line":2036,"in_reply_to":"AAAAUH%2F94gg%3D","updated":"2014-02-22 02:17:35.000000000","message":"because we do not allow no roles specified now.","commit_id":"5aa637f8191406ec5e26d574e70177cb8a9fb2f1"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"384290268fc46d482f9d3975efdfcf3ea69d552f","unresolved":false,"context_lines":[{"line_number":2033,"context_line":"            trustor_user_id\u003dself.user_id,"},{"line_number":2034,"context_line":"            trustee_user_id\u003dself.trustee_user_id)"},{"line_number":2035,"context_line":"        del ref[\u0027id\u0027]"},{"line_number":2036,"context_line":"        self.post(\u0027/OS-TRUST/trusts\u0027, body\u003d{\u0027trust\u0027: ref}, expected_status\u003d403)"},{"line_number":2037,"context_line":""},{"line_number":2038,"context_line":"    def test_trust_crud(self):"},{"line_number":2039,"context_line":"        ref \u003d self.new_trust_ref("}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAAVn%2F%2F%2BtA%3D","line":2036,"updated":"2014-03-03 01:27:42.000000000","message":"this test is now saying that we can\u0027t create an unscoped trust anymore. Why can\u0027t we create an unscoped trust?","commit_id":"2422a85b93730751a5f20da479f9542ef825ca65"},{"author":{"_account_id":9101,"name":"wanghong","email":"reviewwanghong@126.com","username":"wanghong"},"change_message_id":"fc25eb836f79b7c97b4f0921adbade978a09ae76","unresolved":false,"context_lines":[{"line_number":2033,"context_line":"            trustor_user_id\u003dself.user_id,"},{"line_number":2034,"context_line":"            trustee_user_id\u003dself.trustee_user_id)"},{"line_number":2035,"context_line":"        del ref[\u0027id\u0027]"},{"line_number":2036,"context_line":"        self.post(\u0027/OS-TRUST/trusts\u0027, body\u003d{\u0027trust\u0027: ref}, expected_status\u003d403)"},{"line_number":2037,"context_line":""},{"line_number":2038,"context_line":"    def test_trust_crud(self):"},{"line_number":2039,"context_line":"        ref \u003d self.new_trust_ref("}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAAVn%2F%2F9d8%3D","line":2036,"in_reply_to":"AAAAVn%2F%2F%2BtA%3D","updated":"2014-03-03 06:39:21.000000000","message":"In the past, we can create an unscoped trust because we do not specify \"roles\" parameter. But in this patch, we will raise 403 response if \"roles\" parameter is not specified. So, we can not create an unscoped trust anymore.","commit_id":"2422a85b93730751a5f20da479f9542ef825ca65"}],"keystone/trust/controllers.py":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"8f71dd62039aa71cbb7fa59b4440bbbc3fda3387","unresolved":false,"context_lines":[{"line_number":152,"context_line":"            all_roles \u003d self.assignment_api.list_roles()"},{"line_number":153,"context_line":"            clean_roles \u003d self._clean_role_list(context, trust, all_roles)"},{"line_number":154,"context_line":"            if trust.get(\u0027project_id\u0027):"},{"line_number":155,"context_line":"                if not clean_roles:"},{"line_number":156,"context_line":"                    raise exception.ValidationError(attribute\u003d\u0027roles\u0027,"},{"line_number":157,"context_line":"                                                    target\u003d\u0027trust\u0027)"},{"line_number":158,"context_line":"                user_role \u003d self.assignment_api.get_roles_for_user_and_project("}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAUH%2F%2Bcpw%3D","line":155,"updated":"2014-01-26 07:09:31.000000000","message":"Are you just trying to check if there is a roles reference in the trust? Or specifically when a problem is also specified?\n\nCan this be moved up to like 149 if that\u0027s the case?\nAnd just call:\n\n  if not trust.get(\u0027roles\u0027):\n     raise ... \n\nInstead of going through the extra api call to list all roles","commit_id":"3c723125c68e747955363cad7d41a41d3a790db6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f3500fea84cb0d25249d73c0cae68cca9ca58197","unresolved":false,"context_lines":[{"line_number":143,"context_line":"            raise exception.ValidationError(attribute\u003d\u0027trust\u0027,"},{"line_number":144,"context_line":"                                            target\u003d\u0027request\u0027)"},{"line_number":145,"context_line":"        if not trust.get(\u0027roles\u0027):"},{"line_number":146,"context_line":"            raise exception.ValidationError(attribute\u003d\u0027roles\u0027, target\u003d\u0027trust\u0027)"},{"line_number":147,"context_line":"        try:"},{"line_number":148,"context_line":"            user_id \u003d self._get_user_id(context)"},{"line_number":149,"context_line":"            _trustor_only(context, trust, user_id)"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAUH%2F94gc%3D","line":146,"updated":"2014-02-02 14:48:16.000000000","message":"This should be a 403 Forbidden response and not a 400 Bad Request.","commit_id":"5aa637f8191406ec5e26d574e70177cb8a9fb2f1"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5aeba29d161875fabd2e9476c22e48898f1eb114","unresolved":false,"context_lines":[{"line_number":136,"context_line":"                                            target\u003d\u0027request\u0027)"},{"line_number":137,"context_line":"        if not trust.get(\u0027roles\u0027):"},{"line_number":138,"context_line":"            raise exception.Forbidden("},{"line_number":139,"context_line":"                _(\u0027At least one role should be specified.\u0027))"},{"line_number":140,"context_line":"        try:"},{"line_number":141,"context_line":"            user_id \u003d self._get_user_id(context)"},{"line_number":142,"context_line":"            _trustor_only(context, trust, user_id)"}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAAVn%2F%2F4V0%3D","line":139,"updated":"2014-03-03 17:11:16.000000000","message":"This doesn\u0027t check to make sure the role passed in actually exists, it just throws an error if nothing is provided in \u0027roles\u0027. The API spec says that *if* a project_id is supplied in the POST request there should be at least one role associated with it. This doesn\u0027t fix that since we are not checking for project_id, and this will break the case where we don\u0027t provide a project_id or roles, causing inconsistency with the API spec.\n\n\nThere is some logic that exists to take care of some of this: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/trust/controllers.py#n105 and might be an appropriate seam for a fix.","commit_id":"2422a85b93730751a5f20da479f9542ef825ca65"},{"author":{"_account_id":9101,"name":"wanghong","email":"reviewwanghong@126.com","username":"wanghong"},"change_message_id":"062294c8d629bb1c92aadaaf54eadd461ed62d56","unresolved":false,"context_lines":[{"line_number":136,"context_line":"                                            target\u003d\u0027request\u0027)"},{"line_number":137,"context_line":"        if not trust.get(\u0027roles\u0027):"},{"line_number":138,"context_line":"            raise exception.Forbidden("},{"line_number":139,"context_line":"                _(\u0027At least one role should be specified.\u0027))"},{"line_number":140,"context_line":"        try:"},{"line_number":141,"context_line":"            user_id \u003d self._get_user_id(context)"},{"line_number":142,"context_line":"            _trustor_only(context, trust, user_id)"}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAAVn%2F%2Fzfg%3D","line":139,"in_reply_to":"AAAAVn%2F%2F4V0%3D","updated":"2014-03-04 01:51:41.000000000","message":"I think it does not make any sense if we do not specify any role for trust. So I am not checking for project_id. Maybe we should update the API spec?\n\nHere I just throw an error if nothing is provided in roles because there is already some logic in the create function to make sure the roles passed actually exist. It will raise RoleNotFound response if the role passed does not exist.","commit_id":"2422a85b93730751a5f20da479f9542ef825ca65"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"863b4534b9d3921b00e2b565fcc38b7bf6bfb504","unresolved":false,"context_lines":[{"line_number":136,"context_line":"                                            target\u003d\u0027request\u0027)"},{"line_number":137,"context_line":"        if not trust.get(\u0027roles\u0027):"},{"line_number":138,"context_line":"            raise exception.Forbidden("},{"line_number":139,"context_line":"                _(\u0027At least one role should be specified.\u0027))"},{"line_number":140,"context_line":"        try:"},{"line_number":141,"context_line":"            user_id \u003d self._get_user_id(context)"},{"line_number":142,"context_line":"            _trustor_only(context, trust, user_id)"}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAAVn%2F%2Fhs8%3D","line":139,"in_reply_to":"AAAAVn%2F%2Fzfg%3D","updated":"2014-03-05 15:53:42.000000000","message":"the use case for not requiring a project_id is to allow identity impersonation without explicit authorization. so this should be something like:\n\n  if trust.get(\u0027project_id\u0027) and not trust.get(\u0027roles\u0027):\n    # then roles are required","commit_id":"2422a85b93730751a5f20da479f9542ef825ca65"}]}