)]}'
{"id":"openstack%2Fkeystone~999084","triplet_id":"openstack%2Fkeystone~master~I2d6d2106de7eb259443e9f396fd6f680330c8e01","project":"openstack/keystone","branch":"master","hashtags":[],"change_id":"I2d6d2106de7eb259443e9f396fd6f680330c8e01","subject":"Fix dropped validation constraints in role_assignments schema","status":"NEW","created":"2026-07-29 11:15:28.000000000","updated":"2026-07-29 18:54:57.000000000","submit_type":"MERGE_IF_NECESSARY","mergeable":true,"submittable":false,"total_comment_count":0,"unresolved_comment_count":0,"work_in_progress":true,"has_review_started":false,"meta_rev_id":"b096c6f54750aa0b0b19005b727ec0dfdcc953a6","_number":999084,"virtual_id_number":999084,"owner":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"actions":{},"labels":{"Verified":{"disliked":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"tag":"autogenerated:zuul:check","value":-1,"date":"2026-07-29 12:56:41.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":-1,"default_value":0,"optional":true},"Code-Review":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"all":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{"REVIEWER":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"reviewer_updates":[{"updated":"2026-07-29 12:56:41.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"08bdc8bfd6a25127de1e9fe1d29cd894291c1029","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-07-29 11:15:28.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"cb173677ba1e0bf31343cf114ee87011c2877870","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-07-29 11:23:29.000000000","message":"Uploaded patch set 2.","accounts_in_message":[],"_revision_number":2},{"id":"0b897a3406e067260988d710eef89f2e4eecc836","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-07-29 12:56:41.000000000","message":"Patch Set 2: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/0b66d950847c43f082f9981b4731c607\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/ff542a8c1b7945cebd0ad57624816888 : SUCCESS in 16m 07s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/0a2fac721d2e4763934c3ca5c0cb5489 : FAILURE in 5m 30s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/a7a59b760f9c4993ab0122db5fd1d2a9 : SUCCESS in 12m 23s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/a977a261dfc14fa386435dd5bed71c81 : SUCCESS in 11m 21s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/4299e2ab54e1455da0388261dfd17457 : SUCCESS in 15m 08s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/a5d98f9b592c46af895575fe5f08f0fd : SUCCESS in 15m 09s\n- grenade https://zuul.opendev.org/t/openstack/build/89dc48dca8ff4be3965fbaefc82f8b92 : SUCCESS in 43m 12s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/06d82c27aa1f43c3aa85ba998392a526 : SUCCESS in 1h 26m 07s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/1d5eb268f60f4c01a13ebda9e6461ba8 : SUCCESS in 15m 05s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/44265b730b7941d3a3f1cf131647363c : SUCCESS in 17m 21s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/79f1decc03484b2688ad7cd0ffe849e5 : SUCCESS in 36m 00s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/040f00941f6e43a5b5697946c9c1932e : FAILURE in 15m 08s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/c48ed7f1a59b4bbda67b7c5126a7d9ca : FAILURE in 21m 30s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/810e29354ae3408eb6a4c8653a69ecb3 : SUCCESS in 33m 13s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/7ceb4d2e038c4ce0b59100d4b6211095 : SUCCESS in 54m 06s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/6eade02ff34c4d76bb409cc4d51a1624 : SUCCESS in 44m 28s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/5ca8b8d3208049ea8e2118228ca4bb76 : SUCCESS in 45m 45s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/6f9039450d674e65867eff98c5062960 : SUCCESS in 35m 08s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/fa1028adfbbe45bca45eea1698631938 : SUCCESS in 6m 51s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":2},{"id":"b096c6f54750aa0b0b19005b727ec0dfdcc953a6","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-07-29 18:54:57.000000000","message":"Patch Set 2:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/d0be2cecc9e34e2e9c0395218a530813\n\n- openstack-tox-py311-arm64 https://zuul.opendev.org/t/openstack/build/4c4b3d5041684eb48888ef1f8572e003 : SUCCESS in 56m 34s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/c3d8a9b814704f56aca17b6d227465d4 : SUCCESS in 53m 25s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/3ffcbbe84e8941f681b64d9b9faaf524 : SUCCESS in 31m 30s (non-voting)","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"3ec6aa8114486cdecab9dd1ee4dd736784ddc1e5","revisions":{"6adef343fd1c72e82ab01ea557990fd52d51c719":{"kind":"REWORK","_number":1,"created":"2026-07-29 11:15:28.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/84/999084/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/84/999084/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/84/999084/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/84/999084/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/84/999084/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/84/999084/1"}}},"commit":{"parents":[{"commit":"30ef2ffa65a3486ef882f00538e20f2253c57d4c","subject":"Merge \"Make JWT token signing algorithm configurable\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/30ef2ffa65a3486ef882f00538e20f2253c57d4c"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-07-29 11:15:18.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-07-29 11:15:18.000000000","tz":120},"subject":"Fix dropped validation constraints in role_assignments schema","message":"Fix dropped validation constraints in role_assignments schema\n\nrole_assignments_index_request_query defined the JSON Schema keys\n\"oneOf\" and \"not\" twice each. A Python dict literal silently lets\nthe later occurrence of a duplicate key win, so the first \"oneOf\"\n(requiring at most one of scope.project.id/scope.domain.id/\nscope.system) and the first \"not\" (forbidding effective +\nscope.domain.id + scope.OS-INHERIT:inherited_to together) were dead\ncode, never enforced. A request to GET /role_assignments could\ncombine scope.project.id and scope.domain.id in the same query and\nstill pass schema validation.\n\nCombine all four constraints under \"allOf\" so each one actually\ntakes effect, and verify with jsonschema validation calls that the\npreviously-accepted invalid combination is now rejected while\nexisting valid/invalid combinations behave unchanged.\n\nAssisted-by: Claude Sonnet 5\nChange-Id: I2d6d2106de7eb259443e9f396fd6f680330c8e01\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/6adef343fd1c72e82ab01ea557990fd52d51c719"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/6adef343fd1c72e82ab01ea557990fd52d51c719"}]},"branch":"refs/heads/master"},"3ec6aa8114486cdecab9dd1ee4dd736784ddc1e5":{"kind":"REWORK","_number":2,"created":"2026-07-29 11:23:29.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/84/999084/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/84/999084/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/84/999084/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/84/999084/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/84/999084/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/84/999084/2"}}},"commit":{"parents":[{"commit":"30ef2ffa65a3486ef882f00538e20f2253c57d4c","subject":"Merge \"Make JWT token signing algorithm configurable\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/30ef2ffa65a3486ef882f00538e20f2253c57d4c"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-07-29 11:15:18.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-07-29 11:23:14.000000000","tz":120},"subject":"Fix dropped validation constraints in role_assignments schema","message":"Fix dropped validation constraints in role_assignments schema\n\nrole_assignments_index_request_query defined the JSON Schema keys\n\"oneOf\" and \"not\" twice each. A Python dict literal silently lets\nthe later occurrence of a duplicate key win, so the first \"oneOf\"\n(requiring at most one of scope.project.id/scope.domain.id/\nscope.system) and the first \"not\" (forbidding effective +\nscope.domain.id + scope.OS-INHERIT:inherited_to together) were dead\ncode, never enforced. A request to GET /role_assignments could\ncombine scope.project.id and scope.domain.id in the same query and\nstill pass schema validation.\n\nCombine all four constraints under \"allOf\" so each one actually\ntakes effect, and add RoleAssignmentsQueryValidationTestCase with\nregression tests for both previously-dropped constraints. Confirmed\nboth new regression tests fail against the unpatched schema and pass\nwith the fix; existing valid/invalid combinations are unaffected.\n\nAssisted-by: Claude Sonnet 5\nChange-Id: I2d6d2106de7eb259443e9f396fd6f680330c8e01\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/3ec6aa8114486cdecab9dd1ee4dd736784ddc1e5"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/3ec6aa8114486cdecab9dd1ee4dd736784ddc1e5"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"OK","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY"},{"label":"Workflow","status":"MAY"}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Verified\u003dMAX","label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Code-Review\u003dMAX","label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Workflow\u003dMAX","label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}