)]}'
{"mistral/db/v2/sqlalchemy/api.py":[{"author":{"_account_id":8731,"name":"Renat Akhmerov","email":"renat.akhmerov@gmail.com","username":"rakhmerov"},"change_message_id":"608f45cbc4c0a4315314381239e1ab27314cf8ac","unresolved":false,"context_lines":[{"line_number":490,"context_line":"    wf_def \u003d get_workflow_definition(identifier)"},{"line_number":491,"context_line":"    ctx \u003d auth_ctx.ctx()"},{"line_number":492,"context_line":""},{"line_number":493,"context_line":"    if not ctx.is_admin and wf_def.project_id !\u003d security.get_project_id():"},{"line_number":494,"context_line":"        raise exc.NotAllowedException("},{"line_number":495,"context_line":"            \"Can not update workflow of other tenants. \""},{"line_number":496,"context_line":"            \"[workflow_identifier\u003d%s]\" % identifier"}],"source_content_type":"text/x-python","patch_set":1,"id":"7a3c09a3_4d8ee72e","line":493,"range":{"start_line":493,"start_character":7,"end_line":493,"end_character":27},"updated":"2017-01-18 05:07:09.000000000","message":"For now it\u0027s ok but I\u0027m starting to not like this whole approach (not your fault). I think we just need to move all security concerns out of DB layer to something standing above (or aside). Ideally what I would like to see in the code is:\n\nrbac.check_access(db_obj)\n\nor\n\nrbac.enforce_acccess(db_obj)\n\nand this method would check everything we need including project_id, admin roles etc. etc.\n\nLingxian, could you please think about it? Otherwise, it\u0027s becoming really hard to maintain. Our DB layer is overloaded already with all kinds of things, we need to be refactoring it step by step.\n\nRenat","commit_id":"002ba71a1835ea76c7dbd826f20b9568d11c02f3"}]}