)]}'
{"id":"openstack%2Fmistral~1009498","triplet_id":"openstack%2Fmistral~stable%2F2025.2~Iea86d4a8162ae87aee2ae3f3cece29ee66cbd01b","project":"openstack/mistral","branch":"stable/2025.2","topic":"mistral-OSSA-2026-044","attention_set":{},"removed_from_attention_set":{"11583":{"account":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"last_update":"2026-10-08 17:41:34.000000000","reason":"\u003cGERRIT_ACCOUNT_11583\u003e replied on the change","reason_account":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}}},"hashtags":[],"change_id":"Iea86d4a8162ae87aee2ae3f3cece29ee66cbd01b","subject":"Only allow the owner of a resource to share it","status":"MERGED","created":"2026-10-08 14:19:11.000000000","updated":"2026-10-08 20:20:15.000000000","submitted":"2026-10-08 20:20:15.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":1,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"1009498-mistral-OSSA-2026-044","meta_rev_id":"bdda4d3b03826b896407c11dccee3fb3b756700a","_number":1009498,"virtual_id_number":1009498,"owner":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-10-08 20:20:14.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"all":[{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":2,"date":"2026-10-08 19:28:38.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"all":[{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":1,"date":"2026-10-08 19:28:38.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-10-08 16:25:12.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"75bebec37a2410b5a408db7b0fccc07155fc244d","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"date":"2026-10-08 14:19:11.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"33ac67ccf0b2621a163f80981384090a61282180","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-08 16:25:12.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/7cb4e27b55cc497c90c92ff097f160e4\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/189631566b7745d4aa135461dd132066 : SUCCESS in 4m 15s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/7b8b89ec6f2f427eb881d21b90bedb93 : SUCCESS in 11m 48s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/83b1cfbc57af4ebf84e1b1283cc17c4c : SUCCESS in 11m 47s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/84481750828344eebef548b31a44d75d : SUCCESS in 13m 25s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/09a3dea0d7524e77928077196a2b64ab : SUCCESS in 8m 56s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/db6160534aac485590d2e5c001c61819 : SUCCESS in 6m 27s\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/65328562f42848418ee5138f6e1830ad : SUCCESS in 15m 16s (non-voting)\n- mistral-devstack https://zuul.opendev.org/t/openstack/build/3f6bbf7379864f56bed3071d177ec4e5 : POST_FAILURE in 43m 10s\n- mistral-devstack-tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/fa833e618a6f4f57af8ebd5da5227605 : SUCCESS in 42m 37s","accounts_in_message":[],"_revision_number":1},{"id":"13a8881be6fb3e0c641bbe44f84740791e5f2167","author":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"date":"2026-10-08 17:41:34.000000000","message":"Patch Set 1:\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"5bc212b5ec1614a0f8588c588c9c69256ce6c019","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-08 18:52:42.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/3108b0d8f91946e2aa1f17da42ed7aaf\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/3ab294adb4f4424089c6da6f91c8ba80 : SUCCESS in 4m 39s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/667a0892b7eb406baaba461a70e5976c : SUCCESS in 10m 51s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/e087d2502a4940b7b340af0915adb76b : SUCCESS in 11m 07s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/f5cfa49111b84232b83ad3af998592e1 : SUCCESS in 15m 01s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/c559048f524a48c6ba93c0dfecb4ca4f : SUCCESS in 9m 35s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/53af4118ee20408893f2289f406f669b : SUCCESS in 3m 44s\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/b0c3e9081a9241989746edcca7757b47 : SUCCESS in 17m 16s (non-voting)\n- mistral-devstack https://zuul.opendev.org/t/openstack/build/6217387783c548f697a86ef57944458d : SUCCESS in 26m 02s\n- mistral-devstack-tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/9182cfe930e44ec2bb9d7879de17261e : SUCCESS in 34m 57s","accounts_in_message":[],"_revision_number":1},{"id":"601837a42b620145daf2abb56f36df21fb3ecb4e","author":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"date":"2026-10-08 19:28:38.000000000","message":"Patch Set 1: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":1},{"id":"eb2ed65f437902e22a96f3733f683a51bd046f73","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-08 19:29:57.000000000","message":"Patch Set 1: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":1},{"id":"f233654c7e54ef595fac2882b6b61cbc79e8932c","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-08 20:20:14.000000000","message":"Patch Set 1: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/3a045e4e75654c3ea813bda30c19c91b\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/f83ae51b20e84496a3e068237d46ea34 : SUCCESS in 4m 26s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/a6ac3260da6d484491b28c62b1db6fef : SUCCESS in 9m 56s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/866a4abd14c345e08e26ae43bfd952e4 : SUCCESS in 10m 52s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/8e78aa26127f4ee18ad132cbd3359513 : SUCCESS in 8m 34s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/dca6f5715312480485223c35fecbefc1 : SUCCESS in 2m 47s\n- mistral-devstack https://zuul.opendev.org/t/openstack/build/54252726400b46ed81e4db88d445586d : SUCCESS in 39m 43s\n- mistral-devstack-tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/d1f41b2695e84f9781654488cc522bd4 : SUCCESS in 17m 43s","accounts_in_message":[],"_revision_number":1},{"id":"bdda4d3b03826b896407c11dccee3fb3b756700a","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-08 20:20:15.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"7eb3b07dcd6cec1afd6c6d1970afaca0099ee746","revisions":{"7eb3b07dcd6cec1afd6c6d1970afaca0099ee746":{"kind":"REWORK","_number":1,"created":"2026-10-08 14:19:11.000000000","uploader":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"ref":"refs/changes/98/1009498/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/mistral","ref":"refs/changes/98/1009498/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/mistral refs/changes/98/1009498/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/mistral refs/changes/98/1009498/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/mistral refs/changes/98/1009498/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/mistral refs/changes/98/1009498/1"}}},"commit":{"parents":[{"commit":"3aea44c10b89360a9639bbf5b6c4ca9ee1091842","subject":"Resolve own-project cron trigger in create_or_update_cron_trigger","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/mistral/commit/3aea44c10b89360a9639bbf5b6c4ca9ee1091842"}]}],"author":{"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","date":"2026-08-26 19:29:26.000000000","tz":120},"committer":{"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","date":"2026-10-08 14:18:34.000000000","tz":120},"subject":"Only allow the owner of a resource to share it","message":"Only allow the owner of a resource to share it\n\nSharing a workflow (POST /v2/workflows/\u003cid\u003e/members) only verified that\nthe caller could fetch the workflow definition and that its scope was\nprivate. The secure query that fetches the definition also returns\nresources shared with the caller through an accepted membership, so a\nproject that a workflow was shared with - once it accepted the share -\ncould re-share the owner\u0027s private workflow with an arbitrary third\nproject.\n\nThe resulting ResourceMember row is stamped with the re-sharing\nproject\u0027s id (the caller), not the owner\u0027s, so:\n\n* the real owner can neither list nor delete that membership;\n* the third project can accept it and thereby read and execute the\n  owner\u0027s private workflow, which the owner never shared with it;\n* only the re-sharing project, not the owner, can revoke it.\n\nReject the share unless the caller is the owner of the resource\n(wf_db.project_id \u003d\u003d security.get_project_id()), with a 403. This does\nnot affect the previously reported \"pending\" case, where the member\ncannot see the workflow yet and the fetch already fails with 404.\n\nCloses-Bug: #2161277\nSigned-off-by: Arnaud Morin \u003carnaud.morin@gmail.com\u003e\nChange-Id: Iea86d4a8162ae87aee2ae3f3cece29ee66cbd01b\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/mistral/commit/7eb3b07dcd6cec1afd6c6d1970afaca0099ee746"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/mistral/commit/7eb3b07dcd6cec1afd6c6d1970afaca0099ee746"}]},"branch":"refs/heads/stable/2025.2"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}