)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":15554,"name":"Bence Romsics","email":"bence.romsics@gmail.com","username":"ebenrom","status":"working for Ericsson, UTC+1 (+DST)"},"change_message_id":"8fefb94bbba6fc382d66cf750865a3fddef6cf35","unresolved":false,"context_lines":[{"line_number":7,"context_line":"[WIP] Fix creating policy rules from subattributes."},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"In case of policy rule checks for rules like e.g."},{"line_number":10,"context_line":"\"create_port:fixed_ips:subnet\" couldn\u0027t be created to be"},{"line_number":11,"context_line":"pass to policy enforcer becase policy module could only"},{"line_number":12,"context_line":"create rule checks for subattributes which are dict types."},{"line_number":13,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"5fc1f717_5a15d29a","line":10,"range":{"start_line":10,"start_character":23,"end_line":10,"end_character":29},"updated":"2019-03-29 10:37:55.000000000","message":"nit: subnet_id","commit_id":"53c9e2b02d7bc0e05407f440452a1cfb3655b8ce"},{"author":{"_account_id":4694,"name":"Miguel Lavalle","email":"miguel@mlavalle.com","username":"minsel"},"change_message_id":"5ac5e3ee5f80d0561924ca6c56ba88e13957876a","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"In case of policy rule checks for rules like e.g."},{"line_number":10,"context_line":"\"create_port:fixed_ips:subnet\" couldn\u0027t be created to be"},{"line_number":11,"context_line":"pass to policy enforcer becase policy module could only"},{"line_number":12,"context_line":"create rule checks for subattributes which are dict types."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"With this patch checks for such rules can be created also for"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"5fc1f717_11ba5abf","line":11,"range":{"start_line":11,"start_character":24,"end_line":11,"end_character":30},"updated":"2019-04-04 23:40:25.000000000","message":"nit: because","commit_id":"12cc2c1216384e9f6038c567ec64e5f3e1b1c77e"},{"author":{"_account_id":4694,"name":"Miguel Lavalle","email":"miguel@mlavalle.com","username":"minsel"},"change_message_id":"5ac5e3ee5f80d0561924ca6c56ba88e13957876a","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"In case of policy rule checks for rules like e.g."},{"line_number":10,"context_line":"\"create_port:fixed_ips:subnet\" couldn\u0027t be created to be"},{"line_number":11,"context_line":"pass to policy enforcer becase policy module could only"},{"line_number":12,"context_line":"create rule checks for subattributes which are dict types."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"With this patch checks for such rules can be created also for"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"5fc1f717_51a6a2ad","line":11,"range":{"start_line":11,"start_character":0,"end_line":11,"end_character":4},"updated":"2019-04-04 23:40:25.000000000","message":"nit: passed","commit_id":"12cc2c1216384e9f6038c567ec64e5f3e1b1c77e"}],"neutron/conf/policies/port.py":[{"author":{"_account_id":841,"name":"Akihiro Motoki","email":"amotoki@gmail.com","username":"amotoki"},"change_message_id":"7016795d62ab366ca12f28330504f61c43544fc4","unresolved":false,"context_lines":[{"line_number":125,"context_line":"        (\u0027Specify ``ip_address`` of ``allowed_address_pairs`` \u0027"},{"line_number":126,"context_line":"         \u0027attribute when creating a port\u0027),"},{"line_number":127,"context_line":"        ACTION_POST"},{"line_number":128,"context_line":"    ),"},{"line_number":129,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":130,"context_line":"        \u0027create_port:allowed_address_pairs\u0027,"},{"line_number":131,"context_line":"        base.RULE_ADMIN_OR_NET_OWNER,"}],"source_content_type":"text/x-python","patch_set":5,"id":"ffb9cba7_f672857c","line":128,"updated":"2019-04-22 09:01:29.000000000","message":"we usually put them after create_port:allowed_address_pairs.","commit_id":"1cb6ac3dfed5be9e9f1cf3e1e4944c555899abb1"},{"author":{"_account_id":11975,"name":"Slawek Kaplonski","email":"skaplons@redhat.com","username":"slaweq"},"change_message_id":"365bc736a1f3e6879b22389def2d85822cc57df9","unresolved":false,"context_lines":[{"line_number":125,"context_line":"        (\u0027Specify ``ip_address`` of ``allowed_address_pairs`` \u0027"},{"line_number":126,"context_line":"         \u0027attribute when creating a port\u0027),"},{"line_number":127,"context_line":"        ACTION_POST"},{"line_number":128,"context_line":"    ),"},{"line_number":129,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":130,"context_line":"        \u0027create_port:allowed_address_pairs\u0027,"},{"line_number":131,"context_line":"        base.RULE_ADMIN_OR_NET_OWNER,"}],"source_content_type":"text/x-python","patch_set":5,"id":"ffb9cba7_019a5513","line":128,"in_reply_to":"ffb9cba7_f672857c","updated":"2019-04-23 12:04:25.000000000","message":"Done","commit_id":"1cb6ac3dfed5be9e9f1cf3e1e4944c555899abb1"},{"author":{"_account_id":841,"name":"Akihiro Motoki","email":"amotoki@gmail.com","username":"amotoki"},"change_message_id":"7016795d62ab366ca12f28330504f61c43544fc4","unresolved":false,"context_lines":[{"line_number":256,"context_line":"        (\u0027Update ``ip_address`` of ``allowed_address_pairs`` \u0027"},{"line_number":257,"context_line":"         \u0027attribute of a port\u0027),"},{"line_number":258,"context_line":"        ACTION_PUT"},{"line_number":259,"context_line":"    ),"},{"line_number":260,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":261,"context_line":"        \u0027update_port:allowed_address_pairs\u0027,"},{"line_number":262,"context_line":"        base.RULE_ADMIN_OR_NET_OWNER,"}],"source_content_type":"text/x-python","patch_set":5,"id":"ffb9cba7_16707972","line":259,"updated":"2019-04-22 09:01:29.000000000","message":"ditto","commit_id":"1cb6ac3dfed5be9e9f1cf3e1e4944c555899abb1"},{"author":{"_account_id":11975,"name":"Slawek Kaplonski","email":"skaplons@redhat.com","username":"slaweq"},"change_message_id":"365bc736a1f3e6879b22389def2d85822cc57df9","unresolved":false,"context_lines":[{"line_number":256,"context_line":"        (\u0027Update ``ip_address`` of ``allowed_address_pairs`` \u0027"},{"line_number":257,"context_line":"         \u0027attribute of a port\u0027),"},{"line_number":258,"context_line":"        ACTION_PUT"},{"line_number":259,"context_line":"    ),"},{"line_number":260,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":261,"context_line":"        \u0027update_port:allowed_address_pairs\u0027,"},{"line_number":262,"context_line":"        base.RULE_ADMIN_OR_NET_OWNER,"}],"source_content_type":"text/x-python","patch_set":5,"id":"ffb9cba7_418fedcb","line":259,"in_reply_to":"ffb9cba7_16707972","updated":"2019-04-23 12:04:25.000000000","message":"Done","commit_id":"1cb6ac3dfed5be9e9f1cf3e1e4944c555899abb1"}],"neutron/policy.py":[{"author":{"_account_id":841,"name":"Akihiro Motoki","email":"amotoki@gmail.com","username":"amotoki"},"change_message_id":"7016795d62ab366ca12f28330504f61c43544fc4","unresolved":false,"context_lines":[{"line_number":205,"context_line":"                            attr_rule \u003d _build_list_of_subattrs_rule("},{"line_number":206,"context_line":"                                attribute_name, attribute_value,"},{"line_number":207,"context_line":"                                action, target)"},{"line_number":208,"context_line":""},{"line_number":209,"context_line":"                        if not attr_rule:"},{"line_number":210,"context_line":"                            attr_rule \u003d policy.RuleCheck("},{"line_number":211,"context_line":"                                \u0027rule\u0027, \u0027%s:%s\u0027 % (action, attribute_name))"}],"source_content_type":"text/x-python","patch_set":5,"id":"ffb9cba7_f8b4b337","line":208,"updated":"2019-04-22 09:01:29.000000000","message":"The above function _build_list_of_subattrs_list() constructs rules for sub-attributes, but it does not add a rule for the first level of attribute like create_port:allowed_address_pairs. Is it intended?\n\nIf an empty list is specified, attr_rule is None when the code reaches here. It means a rule for an attribute check will be added by the below code. It looks inconsistent.\n\nHow about always adding a rule for an attribute check?","commit_id":"1cb6ac3dfed5be9e9f1cf3e1e4944c555899abb1"},{"author":{"_account_id":841,"name":"Akihiro Motoki","email":"amotoki@gmail.com","username":"amotoki"},"change_message_id":"afcf5f8c60569b5c877e4b570eb4575fdcf32dce","unresolved":false,"context_lines":[{"line_number":205,"context_line":"                            attr_rule \u003d _build_list_of_subattrs_rule("},{"line_number":206,"context_line":"                                attribute_name, attribute_value,"},{"line_number":207,"context_line":"                                action, target)"},{"line_number":208,"context_line":""},{"line_number":209,"context_line":"                        if not attr_rule:"},{"line_number":210,"context_line":"                            attr_rule \u003d policy.RuleCheck("},{"line_number":211,"context_line":"                                \u0027rule\u0027, \u0027%s:%s\u0027 % (action, attribute_name))"}],"source_content_type":"text/x-python","patch_set":5,"id":"ffb9cba7_bacd2432","line":208,"in_reply_to":"ffb9cba7_5769efbb","updated":"2019-05-01 22:22:12.000000000","message":"Operators might have already configured a policy \"create_port:fixed_ips\", so basically it is not a good idea to drop a policy for \"create_port:fixed_ips\".\n\nIMHO, a policy for a parent attribute like \"create_port:fixed_ips\" should be a super set of policies for sub attributes.\nFor example, if the policy for \"create_port:fixed_ips:subnet_id\" is RULE_ADMIN_OR_NET_OWNER and \"create_port:fixed_ips:ip_address\" is RULE_ADMIN, \"create_port:fixed_ips\" must be RULE_ADMIN_OR_NET_OWNER (so that NET_OWNER is allowed for the parent attribute). If operators change  a policy for sub-attribute, they should update a policy for a parent attribute accordingly.","commit_id":"1cb6ac3dfed5be9e9f1cf3e1e4944c555899abb1"},{"author":{"_account_id":11975,"name":"Slawek Kaplonski","email":"skaplons@redhat.com","username":"slaweq"},"change_message_id":"3997fdd1bf6e065afaf480c96db046de9d002e3b","unresolved":false,"context_lines":[{"line_number":205,"context_line":"                            attr_rule \u003d _build_list_of_subattrs_rule("},{"line_number":206,"context_line":"                                attribute_name, attribute_value,"},{"line_number":207,"context_line":"                                action, target)"},{"line_number":208,"context_line":""},{"line_number":209,"context_line":"                        if not attr_rule:"},{"line_number":210,"context_line":"                            attr_rule \u003d policy.RuleCheck("},{"line_number":211,"context_line":"                                \u0027rule\u0027, \u0027%s:%s\u0027 % (action, attribute_name))"}],"source_content_type":"text/x-python","patch_set":5,"id":"dfbec78f_40405d36","line":208,"in_reply_to":"ffb9cba7_bacd2432","updated":"2019-05-03 21:36:22.000000000","message":"I agree. I will change that.","commit_id":"1cb6ac3dfed5be9e9f1cf3e1e4944c555899abb1"},{"author":{"_account_id":11975,"name":"Slawek Kaplonski","email":"skaplons@redhat.com","username":"slaweq"},"change_message_id":"365bc736a1f3e6879b22389def2d85822cc57df9","unresolved":false,"context_lines":[{"line_number":205,"context_line":"                            attr_rule \u003d _build_list_of_subattrs_rule("},{"line_number":206,"context_line":"                                attribute_name, attribute_value,"},{"line_number":207,"context_line":"                                action, target)"},{"line_number":208,"context_line":""},{"line_number":209,"context_line":"                        if not attr_rule:"},{"line_number":210,"context_line":"                            attr_rule \u003d policy.RuleCheck("},{"line_number":211,"context_line":"                                \u0027rule\u0027, \u0027%s:%s\u0027 % (action, attribute_name))"}],"source_content_type":"text/x-python","patch_set":5,"id":"ffb9cba7_5769efbb","line":208,"in_reply_to":"ffb9cba7_f8b4b337","updated":"2019-04-23 12:04:25.000000000","message":"I did it like that because it may happen that e.g. \"create_port:fixed_ips\" and \"create_port:fixed_ips:subnet_id\" will have rules which aren\u0027t the same. So later as it all goes to \"AndCheck\" it will fail.\n\nDo You think it should be changed somehow?","commit_id":"1cb6ac3dfed5be9e9f1cf3e1e4944c555899abb1"},{"author":{"_account_id":841,"name":"Akihiro Motoki","email":"amotoki@gmail.com","username":"amotoki"},"change_message_id":"7016795d62ab366ca12f28330504f61c43544fc4","unresolved":false,"context_lines":[{"line_number":210,"context_line":"                            attr_rule \u003d policy.RuleCheck("},{"line_number":211,"context_line":"                                \u0027rule\u0027, \u0027%s:%s\u0027 % (action, attribute_name))"},{"line_number":212,"context_line":"                            # Build match entries for sub-attributes"},{"line_number":213,"context_line":"                            if _should_validate_sub_attributes("},{"line_number":214,"context_line":"                                    attribute, target[attribute_name]):"},{"line_number":215,"context_line":"                                attr_rule \u003d policy.AndCheck("},{"line_number":216,"context_line":"                                    [attr_rule, _build_subattr_match_rule("}],"source_content_type":"text/x-python","patch_set":5,"id":"ffb9cba7_389fab51","line":213,"updated":"2019-04-22 09:01:29.000000000","message":"_should_validate_sub_attributes() assumes dict only and does not consider a list. This is one of the root causes of the issue.\n\nI think we can change the logic to:\n\n  if \u0027enforce_policy\u0027 in attribute:\n    attr_rule \u003d policy.RuleCheck(\u0027rule\u0027, \u0027%s:%s\u0027 %\n                                                     (action, attribute_name))\n    if isinstance(attribute_value, list):\n       ....\n    elif _should_validate_sub_attributes(...):\n       ....\n    match_rule \u003d policy.AndCheck([match_rule, attr_rule])\n\nThought?\n\n# The other cause is that we have custom validators for a list of\n# dict like type:allowed_address_pairs.\n# As a result we cannot have a good way to generalize this logic.","commit_id":"1cb6ac3dfed5be9e9f1cf3e1e4944c555899abb1"},{"author":{"_account_id":11975,"name":"Slawek Kaplonski","email":"skaplons@redhat.com","username":"slaweq"},"change_message_id":"365bc736a1f3e6879b22389def2d85822cc57df9","unresolved":false,"context_lines":[{"line_number":210,"context_line":"                            attr_rule \u003d policy.RuleCheck("},{"line_number":211,"context_line":"                                \u0027rule\u0027, \u0027%s:%s\u0027 % (action, attribute_name))"},{"line_number":212,"context_line":"                            # Build match entries for sub-attributes"},{"line_number":213,"context_line":"                            if _should_validate_sub_attributes("},{"line_number":214,"context_line":"                                    attribute, target[attribute_name]):"},{"line_number":215,"context_line":"                                attr_rule \u003d policy.AndCheck("},{"line_number":216,"context_line":"                                    [attr_rule, _build_subattr_match_rule("}],"source_content_type":"text/x-python","patch_set":5,"id":"ffb9cba7_37f0fb90","line":213,"in_reply_to":"ffb9cba7_389fab51","updated":"2019-04-23 12:04:25.000000000","message":"But then what if e.g. attribute will be list of items, something like [\u0027id_1\u0027, \u0027id_2\u0027] - I\u0027m not sure that this is possible but I suppose that it may be and in such case we will return None from _build_list_of_subattrs_rule() which will override attr_rule created for attribute above this \"if\" which You propose.","commit_id":"1cb6ac3dfed5be9e9f1cf3e1e4944c555899abb1"},{"author":{"_account_id":27654,"name":"Hongbin Lu","email":"kira034@163.com","username":"hongbin.lu"},"change_message_id":"c98603d893e43af89dbc5ac518433cefafb2aaf6","unresolved":false,"context_lines":[{"line_number":153,"context_line":"    return policy.AndCheck(sub_attr_rules)"},{"line_number":154,"context_line":""},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"def _build_list_of_subattrs_rule(attr_name, attribute_value, action, target):"},{"line_number":157,"context_line":"    rules \u003d []"},{"line_number":158,"context_line":"    for sub_attr in attribute_value:"},{"line_number":159,"context_line":"        if isinstance(sub_attr, dict):"}],"source_content_type":"text/x-python","patch_set":6,"id":"ffb9cba7_009b1dc9","line":156,"range":{"start_line":156,"start_character":69,"end_line":156,"end_character":75},"updated":"2019-04-24 03:49:21.000000000","message":"nit: target is not used","commit_id":"d1c7c178158d76051f56640b77d13fb613415bd1"},{"author":{"_account_id":11975,"name":"Slawek Kaplonski","email":"skaplons@redhat.com","username":"slaweq"},"change_message_id":"3997fdd1bf6e065afaf480c96db046de9d002e3b","unresolved":false,"context_lines":[{"line_number":153,"context_line":"    return policy.AndCheck(sub_attr_rules)"},{"line_number":154,"context_line":""},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"def _build_list_of_subattrs_rule(attr_name, attribute_value, action, target):"},{"line_number":157,"context_line":"    rules \u003d []"},{"line_number":158,"context_line":"    for sub_attr in attribute_value:"},{"line_number":159,"context_line":"        if isinstance(sub_attr, dict):"}],"source_content_type":"text/x-python","patch_set":6,"id":"ffb9cba7_6ec0ab7c","line":156,"range":{"start_line":156,"start_character":69,"end_line":156,"end_character":75},"in_reply_to":"ffb9cba7_009b1dc9","updated":"2019-05-03 21:36:22.000000000","message":"thx, removed.","commit_id":"d1c7c178158d76051f56640b77d13fb613415bd1"},{"author":{"_account_id":27654,"name":"Hongbin Lu","email":"kira034@163.com","username":"hongbin.lu"},"change_message_id":"c98603d893e43af89dbc5ac518433cefafb2aaf6","unresolved":false,"context_lines":[{"line_number":206,"context_line":"                                attribute_name, attribute_value,"},{"line_number":207,"context_line":"                                action, target)"},{"line_number":208,"context_line":""},{"line_number":209,"context_line":"                        if not attr_rule:"},{"line_number":210,"context_line":"                            attr_rule \u003d policy.RuleCheck("},{"line_number":211,"context_line":"                                \u0027rule\u0027, \u0027%s:%s\u0027 % (action, attribute_name))"},{"line_number":212,"context_line":"                            # Build match entries for sub-attributes"}],"source_content_type":"text/x-python","patch_set":6,"id":"ffb9cba7_8094ed45","line":209,"range":{"start_line":209,"start_character":24,"end_line":209,"end_character":41},"updated":"2019-04-24 03:49:21.000000000","message":"so, for example, if \"rule: create_port:fixed_ips:ip_address\" applies, then \"rule: create_port:fixed_ips\" is not applied? IMO, both rules should apply.","commit_id":"d1c7c178158d76051f56640b77d13fb613415bd1"},{"author":{"_account_id":841,"name":"Akihiro Motoki","email":"amotoki@gmail.com","username":"amotoki"},"change_message_id":"9946b47a1e758df751121537fa8b71e9fdf6ba79","unresolved":false,"context_lines":[{"line_number":206,"context_line":"                                attribute_name, attribute_value,"},{"line_number":207,"context_line":"                                action, target)"},{"line_number":208,"context_line":""},{"line_number":209,"context_line":"                        if not attr_rule:"},{"line_number":210,"context_line":"                            attr_rule \u003d policy.RuleCheck("},{"line_number":211,"context_line":"                                \u0027rule\u0027, \u0027%s:%s\u0027 % (action, attribute_name))"},{"line_number":212,"context_line":"                            # Build match entries for sub-attributes"}],"source_content_type":"text/x-python","patch_set":6,"id":"dfbec78f_2a0d003e","line":209,"range":{"start_line":209,"start_character":24,"end_line":209,"end_character":41},"in_reply_to":"ffb9cba7_0ed00f50","updated":"2019-05-04 17:13:21.000000000","message":"My example might not be good. Your understanding is correct. we need to update create_port:fixed_ips too.","commit_id":"d1c7c178158d76051f56640b77d13fb613415bd1"},{"author":{"_account_id":841,"name":"Akihiro Motoki","email":"amotoki@gmail.com","username":"amotoki"},"change_message_id":"1eb0dd160a3c9c56890731c289a07f88ac7808f4","unresolved":false,"context_lines":[{"line_number":206,"context_line":"                                attribute_name, attribute_value,"},{"line_number":207,"context_line":"                                action, target)"},{"line_number":208,"context_line":""},{"line_number":209,"context_line":"                        if not attr_rule:"},{"line_number":210,"context_line":"                            attr_rule \u003d policy.RuleCheck("},{"line_number":211,"context_line":"                                \u0027rule\u0027, \u0027%s:%s\u0027 % (action, attribute_name))"},{"line_number":212,"context_line":"                            # Build match entries for sub-attributes"}],"source_content_type":"text/x-python","patch_set":6,"id":"ffb9cba7_5ab5087d","line":209,"range":{"start_line":209,"start_character":24,"end_line":209,"end_character":41},"in_reply_to":"ffb9cba7_8094ed45","updated":"2019-05-01 22:22:50.000000000","message":"Let\u0027s continue the discussion in patch set 5.","commit_id":"d1c7c178158d76051f56640b77d13fb613415bd1"},{"author":{"_account_id":11975,"name":"Slawek Kaplonski","email":"skaplons@redhat.com","username":"slaweq"},"change_message_id":"3997fdd1bf6e065afaf480c96db046de9d002e3b","unresolved":false,"context_lines":[{"line_number":206,"context_line":"                                attribute_name, attribute_value,"},{"line_number":207,"context_line":"                                action, target)"},{"line_number":208,"context_line":""},{"line_number":209,"context_line":"                        if not attr_rule:"},{"line_number":210,"context_line":"                            attr_rule \u003d policy.RuleCheck("},{"line_number":211,"context_line":"                                \u0027rule\u0027, \u0027%s:%s\u0027 % (action, attribute_name))"},{"line_number":212,"context_line":"                            # Build match entries for sub-attributes"}],"source_content_type":"text/x-python","patch_set":6,"id":"ffb9cba7_0ed00f50","line":209,"range":{"start_line":209,"start_character":24,"end_line":209,"end_character":41},"in_reply_to":"ffb9cba7_8094ed45","updated":"2019-05-03 21:36:22.000000000","message":"Please see e.g. defaults of create_port:fixed_ips and create_port:fixed_ips:subnet_id - if we would include both rules in check, create_port:fixed_ips:subnet_id which has additional \"shared\u003dTrue\" will never work for tenant user as create_port:fixed_ips don\u0027t have it.\n\nMaybe those defaults should be changed but IMO it should be done in separate patch and I just wanted here to make it working in current conditions.","commit_id":"d1c7c178158d76051f56640b77d13fb613415bd1"},{"author":{"_account_id":841,"name":"Akihiro Motoki","email":"amotoki@gmail.com","username":"amotoki"},"change_message_id":"b16f5554830381ab0277906248a5826d4d692d04","unresolved":false,"context_lines":[{"line_number":213,"context_line":"                        if isinstance(attribute_value, list):"},{"line_number":214,"context_line":"                            attr_rule \u003d policy.AndCheck("},{"line_number":215,"context_line":"                                [attr_rule, _build_list_of_subattrs_rule("},{"line_number":216,"context_line":"                                    attribute_name, attribute_value, action)])"},{"line_number":217,"context_line":""},{"line_number":218,"context_line":"                        match_rule \u003d policy.AndCheck([match_rule, attr_rule])"},{"line_number":219,"context_line":"    return match_rule"}],"source_content_type":"text/x-python","patch_set":8,"id":"dfbec78f_e5495b60","line":216,"updated":"2019-05-04 17:15:26.000000000","message":"_build_list_of_subattrs_rule can return None.\nI think we need to check None is returned and if non-None is returned we can pass it to AndCheck at L.214.","commit_id":"184ca4e83854644d8a8484ee55829cbc97dd47b4"},{"author":{"_account_id":11975,"name":"Slawek Kaplonski","email":"skaplons@redhat.com","username":"slaweq"},"change_message_id":"21b0d60c633724e490c875d419664b17fac8e262","unresolved":false,"context_lines":[{"line_number":213,"context_line":"                        if isinstance(attribute_value, list):"},{"line_number":214,"context_line":"                            attr_rule \u003d policy.AndCheck("},{"line_number":215,"context_line":"                                [attr_rule, _build_list_of_subattrs_rule("},{"line_number":216,"context_line":"                                    attribute_name, attribute_value, action)])"},{"line_number":217,"context_line":""},{"line_number":218,"context_line":"                        match_rule \u003d policy.AndCheck([match_rule, attr_rule])"},{"line_number":219,"context_line":"    return match_rule"}],"source_content_type":"text/x-python","patch_set":8,"id":"dfbec78f_65b56bee","line":216,"in_reply_to":"dfbec78f_e5495b60","updated":"2019-05-04 17:34:46.000000000","message":"yes, I just did it :)","commit_id":"184ca4e83854644d8a8484ee55829cbc97dd47b4"},{"author":{"_account_id":841,"name":"Akihiro Motoki","email":"amotoki@gmail.com","username":"amotoki"},"change_message_id":"d098099173cb9f60d4f86009b16338ef884e9dc0","unresolved":false,"context_lines":[{"line_number":200,"context_line":"                    attribute \u003d res_map[resource][attribute_name]"},{"line_number":201,"context_line":"                    if \u0027enforce_policy\u0027 in attribute:"},{"line_number":202,"context_line":"                        attr_rule \u003d policy.RuleCheck("},{"line_number":203,"context_line":"                            \u0027rule\u0027, \u0027%s:%s\u0027 % (action, attribute_name))"},{"line_number":204,"context_line":"                        # Build match entries for sub-attributes"},{"line_number":205,"context_line":"                        if _should_validate_sub_attributes("},{"line_number":206,"context_line":"                                attribute, target[attribute_name]):"}],"source_content_type":"text/x-python","patch_set":9,"id":"dfbec78f_df65d646","line":203,"updated":"2019-05-08 06:53:17.000000000","message":"This actually changes nothing... I am okay with either.","commit_id":"9318fb8bb930a65cb0b388fd4a40fc83183d9199"}],"neutron/tests/unit/test_policy.py":[{"author":{"_account_id":841,"name":"Akihiro Motoki","email":"amotoki@gmail.com","username":"amotoki"},"change_message_id":"7016795d62ab366ca12f28330504f61c43544fc4","unresolved":false,"context_lines":[{"line_number":261,"context_line":"            \"create_fake_resource:attr:sub_attr_2\": \"rule:admin_only\","},{"line_number":262,"context_line":"            \"create_fake_resource:list_attr:admin_element\": \"rule:admin_only\","},{"line_number":263,"context_line":"            \"create_fake_resource:list_attr:user_element\": ("},{"line_number":264,"context_line":"                \"rule:admin_or_owner\"),"},{"line_number":265,"context_line":""},{"line_number":266,"context_line":"            \"create_fake_policy:\": \"rule:admin_or_owner\","},{"line_number":267,"context_line":"        }"}],"source_content_type":"text/x-python","patch_set":3,"id":"5fc1f717_aeb71cd8","line":264,"updated":"2019-04-22 09:01:29.000000000","message":"nit: You can wrap lines without parentheses by wrapping lines just after a colon.","commit_id":"12cc2c1216384e9f6038c567ec64e5f3e1b1c77e"},{"author":{"_account_id":841,"name":"Akihiro Motoki","email":"amotoki@gmail.com","username":"amotoki"},"change_message_id":"7016795d62ab366ca12f28330504f61c43544fc4","unresolved":false,"context_lines":[{"line_number":485,"context_line":"        target \u003d {"},{"line_number":486,"context_line":"            \u0027tenant_id\u0027: \u0027fake\u0027,"},{"line_number":487,"context_line":"            \u0027list_attr\u0027: [{\u0027user_element\u0027: \u0027x\u0027}]}"},{"line_number":488,"context_line":"        result \u003d policy.enforce(self.context,"},{"line_number":489,"context_line":"                                action, target, None)"},{"line_number":490,"context_line":"        self.assertTrue(result)"},{"line_number":491,"context_line":""},{"line_number":492,"context_line":"    def test_enforce_subattribute_as_list_forbiden(self):"}],"source_content_type":"text/x-python","patch_set":3,"id":"5fc1f717_6e7ff416","line":489,"range":{"start_line":488,"start_character":32,"end_line":489,"end_character":53},"updated":"2019-04-22 09:01:29.000000000","message":"nit: this can be one line.","commit_id":"12cc2c1216384e9f6038c567ec64e5f3e1b1c77e"}]}