)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":8313,"name":"Lajos Katona","display_name":"lajoskatona","email":"katonalala@gmail.com","username":"elajkat","status":"Ericsson Software Technology"},"change_message_id":"b23fe5c41972f914d9c3c50c4094fbb89c5b7df9","unresolved":true,"context_lines":[{"line_number":4,"context_line":"Commit:     Rodolfo Alonso Hernandez \u003cralonsoh@redhat.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2026-07-24 10:10:19 +0200"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Validate RBAC ``target_tenant`` as UUID or wildcard"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"The RBAC policy ``target_tenant`` field accepted any arbitrary string,"},{"line_number":10,"context_line":"including project names. Since RBAC enforcement compares"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"246c1ce0_40ebd3e9","line":7,"range":{"start_line":7,"start_character":23,"end_line":7,"end_character":29},"updated":"2026-07-27 08:05:58.000000000","message":"this is project now, am I wrong? in the change there is project also everywhere","commit_id":"94542a65b10070c7fbc26d7c2cb12b958fab5b5c"},{"author":{"_account_id":16688,"name":"Rodolfo Alonso","email":"ralonsoh@redhat.com","username":"rodolfo-alonso-hernandez"},"change_message_id":"82dc33a7674e0cc8135008ff71e6d8a795ac9963","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Rodolfo Alonso Hernandez \u003cralonsoh@redhat.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2026-07-24 10:10:19 +0200"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Validate RBAC ``target_tenant`` as UUID or wildcard"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"The RBAC policy ``target_tenant`` field accepted any arbitrary string,"},{"line_number":10,"context_line":"including project names. Since RBAC enforcement compares"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"8dd80ce9_cdc1527f","line":7,"range":{"start_line":7,"start_character":23,"end_line":7,"end_character":29},"in_reply_to":"246c1ce0_40ebd3e9","updated":"2026-07-27 10:11:10.000000000","message":"Upssss yes. The API field is ``target_tenant`` but we store it in ``target_project`` now.","commit_id":"94542a65b10070c7fbc26d7c2cb12b958fab5b5c"}],"/PATCHSET_LEVEL":[{"author":{"_account_id":16688,"name":"Rodolfo Alonso","email":"ralonsoh@redhat.com","username":"rodolfo-alonso-hernandez"},"change_message_id":"5edc2ee9c6d44e4067cc282185d8f703c3e65ddc","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"4d2c2cdb_711ceaaf","updated":"2026-07-28 14:21:43.000000000","message":"recheck neutron-functional, fix merged","commit_id":"a88325a351d51ae3eb14839ffe6d597133b1e7d4"},{"author":{"_account_id":16688,"name":"Rodolfo Alonso","email":"ralonsoh@redhat.com","username":"rodolfo-alonso-hernandez"},"change_message_id":"a15c363b431143e2d03502d11a7919e0ebe79680","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"af193b08_4657d9fd","updated":"2026-07-27 13:03:19.000000000","message":"recheck neutron-ovs-tempest-dvr-ha-multinode-full","commit_id":"a88325a351d51ae3eb14839ffe6d597133b1e7d4"},{"author":{"_account_id":16688,"name":"Rodolfo Alonso","email":"ralonsoh@redhat.com","username":"rodolfo-alonso-hernandez"},"change_message_id":"15b4c801e744ccdff405f9ba75cd42cb3828fdd9","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"b785588c_2341430d","updated":"2026-07-28 07:16:59.000000000","message":"recheck neutron-tempest-plugin-ovn","commit_id":"a88325a351d51ae3eb14839ffe6d597133b1e7d4"}],"neutron/extensions/rbac.py":[{"author":{"_account_id":11975,"name":"Slawek Kaplonski","email":"skaplons@redhat.com","username":"slaweq"},"change_message_id":"8ffedcd422de44870612254f5871074247b63450","unresolved":true,"context_lines":[{"line_number":82,"context_line":"                      \u0027is_visible\u0027: True, \u0027enforce_policy\u0027: True,"},{"line_number":83,"context_line":"                      \u0027is_filter\u0027: True},"},{"line_number":84,"context_line":"        \u0027target_tenant\u0027: {\u0027allow_post\u0027: True, \u0027allow_put\u0027: True,"},{"line_number":85,"context_line":"                          \u0027convert_to\u0027: convert_valid_target_project,"},{"line_number":86,"context_line":"                          \u0027is_visible\u0027: True, \u0027enforce_policy\u0027: True,"},{"line_number":87,"context_line":"                          \u0027is_filter\u0027: True},"},{"line_number":88,"context_line":"        \u0027tenant_id\u0027: {\u0027allow_post\u0027: True, \u0027allow_put\u0027: False,"}],"source_content_type":"text/x-python","patch_set":3,"id":"6799517e_46976b13","line":85,"updated":"2026-07-29 08:26:35.000000000","message":"correct me if I\u0027m wrong but with this patch will will simply store all new RBAC entries with `target_project` converted to be valid uuid instead of just project id as it is in keystone. But how then validation will work if currently we are just checking later if context.project_id is equal to the `target_project` in RBAC: https://github.com/openstack/neutron/blob/master/neutron/objects/rbac_db.py#L89 - how those new entries will match if context.project_id is still not real UUID but just project_id as in keystone?\n\nAlso what about existing records in the DB? Are those going to be converted somehow to new format?\n\nMaybe instead of having converter have simply validator which would convert provided value to UUID \"in flight\", check if it is valid uuid and thats it. We would still store value provided with API \"as is\" in the DB. Wdyt about it?","commit_id":"a88325a351d51ae3eb14839ffe6d597133b1e7d4"},{"author":{"_account_id":16688,"name":"Rodolfo Alonso","email":"ralonsoh@redhat.com","username":"rodolfo-alonso-hernandez"},"change_message_id":"0f911e2e3a6c00af7c68ae7897a0daef88189882","unresolved":false,"context_lines":[{"line_number":82,"context_line":"                      \u0027is_visible\u0027: True, \u0027enforce_policy\u0027: True,"},{"line_number":83,"context_line":"                      \u0027is_filter\u0027: True},"},{"line_number":84,"context_line":"        \u0027target_tenant\u0027: {\u0027allow_post\u0027: True, \u0027allow_put\u0027: True,"},{"line_number":85,"context_line":"                          \u0027convert_to\u0027: convert_valid_target_project,"},{"line_number":86,"context_line":"                          \u0027is_visible\u0027: True, \u0027enforce_policy\u0027: True,"},{"line_number":87,"context_line":"                          \u0027is_filter\u0027: True},"},{"line_number":88,"context_line":"        \u0027tenant_id\u0027: {\u0027allow_post\u0027: True, \u0027allow_put\u0027: False,"}],"source_content_type":"text/x-python","patch_set":3,"id":"6ff9eb4f_b245fc86","line":85,"in_reply_to":"6799517e_46976b13","updated":"2026-07-29 09:52:39.000000000","message":"Good catch!\n\nThis is a mistake, I\u0027m not sure why I changed `validate` to `convert_to` (I was doing some local testing). I need to revert this.\n\nAbout the existing records in the DB, this patch provides and upgrade check to verify the existing records. Those ones with non-UUID in `target_project` are irrelevant: the Neutron API is not considering them. The users should:\n* Remove them\n* Add new registers using the correct project ID.","commit_id":"a88325a351d51ae3eb14839ffe6d597133b1e7d4"},{"author":{"_account_id":16688,"name":"Rodolfo Alonso","email":"ralonsoh@redhat.com","username":"rodolfo-alonso-hernandez"},"change_message_id":"26318846b67b056dbfdd5129d67d75180245929b","unresolved":false,"context_lines":[{"line_number":82,"context_line":"                      \u0027is_visible\u0027: True, \u0027enforce_policy\u0027: True,"},{"line_number":83,"context_line":"                      \u0027is_filter\u0027: True},"},{"line_number":84,"context_line":"        \u0027target_tenant\u0027: {\u0027allow_post\u0027: True, \u0027allow_put\u0027: True,"},{"line_number":85,"context_line":"                          \u0027convert_to\u0027: convert_valid_target_project,"},{"line_number":86,"context_line":"                          \u0027is_visible\u0027: True, \u0027enforce_policy\u0027: True,"},{"line_number":87,"context_line":"                          \u0027is_filter\u0027: True},"},{"line_number":88,"context_line":"        \u0027tenant_id\u0027: {\u0027allow_post\u0027: True, \u0027allow_put\u0027: False,"}],"source_content_type":"text/x-python","patch_set":3,"id":"840db3ea_0925c16c","line":85,"in_reply_to":"68f3e566_45c87bfd","updated":"2026-07-30 10:48:57.000000000","message":"Done","commit_id":"a88325a351d51ae3eb14839ffe6d597133b1e7d4"},{"author":{"_account_id":11975,"name":"Slawek Kaplonski","email":"skaplons@redhat.com","username":"slaweq"},"change_message_id":"6ef49a730dc847ffbd9e13d8401adea6dce95414","unresolved":true,"context_lines":[{"line_number":82,"context_line":"                      \u0027is_visible\u0027: True, \u0027enforce_policy\u0027: True,"},{"line_number":83,"context_line":"                      \u0027is_filter\u0027: True},"},{"line_number":84,"context_line":"        \u0027target_tenant\u0027: {\u0027allow_post\u0027: True, \u0027allow_put\u0027: True,"},{"line_number":85,"context_line":"                          \u0027convert_to\u0027: convert_valid_target_project,"},{"line_number":86,"context_line":"                          \u0027is_visible\u0027: True, \u0027enforce_policy\u0027: True,"},{"line_number":87,"context_line":"                          \u0027is_filter\u0027: True},"},{"line_number":88,"context_line":"        \u0027tenant_id\u0027: {\u0027allow_post\u0027: True, \u0027allow_put\u0027: False,"}],"source_content_type":"text/x-python","patch_set":3,"id":"68f3e566_45c87bfd","line":85,"in_reply_to":"6ff9eb4f_b245fc86","updated":"2026-07-29 09:57:22.000000000","message":"yeah, I noticed upgrade check but what confused me was that \u0027convert_to\u0027 which would actually change how new values would be stored in DB from now on :)","commit_id":"a88325a351d51ae3eb14839ffe6d597133b1e7d4"},{"author":{"_account_id":8313,"name":"Lajos Katona","display_name":"lajoskatona","email":"katonalala@gmail.com","username":"elajkat","status":"Ericsson Software Technology"},"change_message_id":"301a9fde660cf1f60d0c54dec24ce5d363eb3fff","unresolved":true,"context_lines":[{"line_number":54,"context_line":"    raise n_exc.InvalidInput(error_message\u003dmsg)"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"def _validate_valid_target_project(data, valid_values\u003dNone):"},{"line_number":58,"context_line":"    \"\"\"Validate target project is UUID like."},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"    :param data: The data to validate (target project)."},{"line_number":61,"context_line":"    :param valid_values: Not used! Needed by the validators\u0027 framework."},{"line_number":62,"context_line":"    :return: None if the value can be converted to a bool, otherwise a"},{"line_number":63,"context_line":"        ``InvalidInput`` exception will be raised."},{"line_number":64,"context_line":"    \"\"\""},{"line_number":65,"context_line":"    if data \u003d\u003d \u0027*\u0027:"},{"line_number":66,"context_line":"        # Accept all (\u0027*\u0027) projects."},{"line_number":67,"context_line":"        return"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"    if not uuidutils.is_uuid_like(data):"},{"line_number":70,"context_line":"        msg \u003d _(\"\u0027%s\u0027 is not a valid target project ID; \""},{"line_number":71,"context_line":"                \"expected a UUID or \u0027*\u0027\") % data"},{"line_number":72,"context_line":"        raise n_exc.InvalidInput(error_message\u003dmsg)"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"validators.add_validator(\u0027valid_target_project\u0027,"},{"line_number":76,"context_line":"                         _validate_valid_target_project)"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"RESOURCE_NAME \u003d \u0027rbac_policy\u0027"}],"source_content_type":"text/x-python","patch_set":6,"id":"21d18bdf_c1812dcb","line":76,"range":{"start_line":57,"start_character":0,"end_line":76,"end_character":56},"updated":"2026-07-31 09:31:02.000000000","message":"question: do we have to move it to neutron-lib later?","commit_id":"2cc04fb0716ba13f5812d05b6bdec4dea8105dd6"},{"author":{"_account_id":16688,"name":"Rodolfo Alonso","email":"ralonsoh@redhat.com","username":"rodolfo-alonso-hernandez"},"change_message_id":"bfdc95aee95d206876eec9fa93e96fffe0efac05","unresolved":false,"context_lines":[{"line_number":54,"context_line":"    raise n_exc.InvalidInput(error_message\u003dmsg)"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"def _validate_valid_target_project(data, valid_values\u003dNone):"},{"line_number":58,"context_line":"    \"\"\"Validate target project is UUID like."},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"    :param data: The data to validate (target project)."},{"line_number":61,"context_line":"    :param valid_values: Not used! Needed by the validators\u0027 framework."},{"line_number":62,"context_line":"    :return: None if the value can be converted to a bool, otherwise a"},{"line_number":63,"context_line":"        ``InvalidInput`` exception will be raised."},{"line_number":64,"context_line":"    \"\"\""},{"line_number":65,"context_line":"    if data \u003d\u003d \u0027*\u0027:"},{"line_number":66,"context_line":"        # Accept all (\u0027*\u0027) projects."},{"line_number":67,"context_line":"        return"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"    if not uuidutils.is_uuid_like(data):"},{"line_number":70,"context_line":"        msg \u003d _(\"\u0027%s\u0027 is not a valid target project ID; \""},{"line_number":71,"context_line":"                \"expected a UUID or \u0027*\u0027\") % data"},{"line_number":72,"context_line":"        raise n_exc.InvalidInput(error_message\u003dmsg)"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"validators.add_validator(\u0027valid_target_project\u0027,"},{"line_number":76,"context_line":"                         _validate_valid_target_project)"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"RESOURCE_NAME \u003d \u0027rbac_policy\u0027"}],"source_content_type":"text/x-python","patch_set":6,"id":"a8a3ac0f_ad0decb0","line":76,"range":{"start_line":57,"start_character":0,"end_line":76,"end_character":56},"in_reply_to":"21d18bdf_c1812dcb","updated":"2026-07-31 10:10:19.000000000","message":"We would need to migrate the whole RBAC API definition to neutron-lib","commit_id":"2cc04fb0716ba13f5812d05b6bdec4dea8105dd6"}],"neutron/tests/unit/cmd/upgrade_checks/test_checks.py":[{"author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"tag":"autogenerated:zuul:check","change_message_id":"780794fe0f15024d85d4409d3cc8e188abdc401d","unresolved":false,"context_lines":[{"line_number":313,"context_line":"        mock_get_invalid.assert_called_once_with()"},{"line_number":314,"context_line":""},{"line_number":315,"context_line":"    @mock.patch.object(checks, \u0027get_rbac_policies_with_invalid_target_project\u0027)"},{"line_number":316,"context_line":"    def test_rbac_target_project_check_warning_multiple(self, mock_get_invalid):"},{"line_number":317,"context_line":"        mock_get_invalid.return_value \u003d ["},{"line_number":318,"context_line":"            {\u0027id\u0027: \u0027rbac-1\u0027, \u0027object_type\u0027: \u0027network\u0027,"},{"line_number":319,"context_line":"             \u0027object_id\u0027: \u0027net-1\u0027, \u0027target_project\u0027: \u0027project-name-1\u0027},"}],"source_content_type":"text/x-python","patch_set":1,"id":"52bcf3e9_4967c1b6","line":316,"updated":"2026-07-23 18:57:39.000000000","message":"pep8: E501 line too long (80 \u003e 79 characters)","commit_id":"905a0575582dd4ebd7c6da098519c12def74c575"}],"releasenotes/notes/validate-rbac-target-project-uuid-a3f2e8b1c4d5f6a9.yaml":[{"author":{"_account_id":8313,"name":"Lajos Katona","display_name":"lajoskatona","email":"katonalala@gmail.com","username":"elajkat","status":"Ericsson Software Technology"},"change_message_id":"301a9fde660cf1f60d0c54dec24ce5d363eb3fff","unresolved":true,"context_lines":[{"line_number":13,"context_line":"    affected because the client successfully resolves names to IDs via"},{"line_number":14,"context_line":"    Keystone before sending the request. For more information, see bug"},{"line_number":15,"context_line":"    `2161653 \u003chttps://bugs.launchpad.net/neutron/+bug/2161653\u003e`_."},{"line_number":16,"context_line":"upgrade:"},{"line_number":17,"context_line":"  - |"},{"line_number":18,"context_line":"    An upgrade check has been added to detect existing RBAC policies whose"},{"line_number":19,"context_line":"    ``target_project`` value is not ``*`` or a valid UUID. These policies"}],"source_content_type":"text/x-yaml","patch_set":6,"id":"59ce93ae_abd3c34a","line":16,"range":{"start_line":16,"start_character":0,"end_line":16,"end_character":7},"updated":"2026-07-31 09:31:02.000000000","message":"+1","commit_id":"2cc04fb0716ba13f5812d05b6bdec4dea8105dd6"}]}