)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":18337,"name":"Sujitha","email":"sujitha.neti@intel.com","username":"Sujitha"},"change_message_id":"6406d33a10c361c8121100ababa715a6ca6af276","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     John Garbutt \u003cjohn.garbutt@rackspace.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2017-02-13 13:39:48 +0000"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Add polcy-docs spec"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"We should ensure operators no longer need to read code to fully"},{"line_number":10,"context_line":"understand what each of the policy rules means."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"fa31d9ce_890c953c","line":7,"range":{"start_line":7,"start_character":4,"end_line":7,"end_character":9},"updated":"2017-02-13 22:10:05.000000000","message":"policy","commit_id":"09887d06a20c3869cc7501e377bd5bcc8f8f362b"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"0bdddbb1bef92c0c0d7e07ff084994c84057b715","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     John Garbutt \u003cjohn.garbutt@rackspace.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2017-02-13 13:39:48 +0000"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Add polcy-docs spec"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"We should ensure operators no longer need to read code to fully"},{"line_number":10,"context_line":"understand what each of the policy rules means."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"fa31d9ce_4e80e3c0","line":7,"updated":"2017-02-14 02:32:31.000000000","message":"policy*","commit_id":"09887d06a20c3869cc7501e377bd5bcc8f8f362b"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c5378d01aa6256ec50ee1745d019ad7adf6e998a","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     John Garbutt \u003cjohn.garbutt@rackspace.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2017-02-16 11:02:29 +0000"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Add polcy-docs spec"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"We should ensure operators no longer need to read code to fully"},{"line_number":10,"context_line":"understand what each of the policy rules means."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":6,"id":"fa31d9ce_d85164da","line":7,"updated":"2017-02-16 18:07:52.000000000","message":"policy*","commit_id":"cb0fcc6e15f4fbfdeaee3766046a194cee9b273b"}],"specs/pike/approved/policy-docs.rst":[{"author":{"_account_id":18337,"name":"Sujitha","email":"sujitha.neti@intel.com","username":"Sujitha"},"change_message_id":"6406d33a10c361c8121100ababa715a6ca6af276","unresolved":false,"context_lines":[{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Add Polcy Docs"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa31d9ce_239d88bc","line":8,"range":{"start_line":8,"start_character":4,"end_line":8,"end_character":9},"updated":"2017-02-13 22:10:05.000000000","message":"s/Polcy/Policy","commit_id":"09887d06a20c3869cc7501e377bd5bcc8f8f362b"},{"author":{"_account_id":18337,"name":"Sujitha","email":"sujitha.neti@intel.com","username":"Sujitha"},"change_message_id":"6406d33a10c361c8121100ababa715a6ca6af276","unresolved":false,"context_lines":[{"line_number":25,"context_line":"* Operator wants to audit the default policy rules and see if they are"},{"line_number":26,"context_line":"  appropriate for their deployment."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"* Operator wants to give users access to a particular API that they current"},{"line_number":29,"context_line":"  get a 403 error when accessing"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"* Operator wants to restrict access to an API they currently have access to."}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa31d9ce_c3958c87","line":28,"range":{"start_line":28,"start_character":68,"end_line":28,"end_character":75},"updated":"2017-02-13 22:10:05.000000000","message":"currently","commit_id":"09887d06a20c3869cc7501e377bd5bcc8f8f362b"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"0bdddbb1bef92c0c0d7e07ff084994c84057b715","unresolved":false,"context_lines":[{"line_number":25,"context_line":"* Operator wants to audit the default policy rules and see if they are"},{"line_number":26,"context_line":"  appropriate for their deployment."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"* Operator wants to give users access to a particular API that they current"},{"line_number":29,"context_line":"  get a 403 error when accessing"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"* Operator wants to restrict access to an API they currently have access to."}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa31d9ce_0e734b16","line":28,"updated":"2017-02-14 02:32:31.000000000","message":"currently*","commit_id":"09887d06a20c3869cc7501e377bd5bcc8f8f362b"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"0bdddbb1bef92c0c0d7e07ff084994c84057b715","unresolved":false,"context_lines":[{"line_number":28,"context_line":"* Operator wants to give users access to a particular API that they current"},{"line_number":29,"context_line":"  get a 403 error when accessing"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"* Operator wants to restrict access to an API they currently have access to."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"Proposed change"},{"line_number":34,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa31d9ce_ae56bf59","line":31,"updated":"2017-02-14 02:32:31.000000000","message":"s/they/a user/\n\ns/have/has/ ?","commit_id":"09887d06a20c3869cc7501e377bd5bcc8f8f362b"},{"author":{"_account_id":18337,"name":"Sujitha","email":"sujitha.neti@intel.com","username":"Sujitha"},"change_message_id":"6406d33a10c361c8121100ababa715a6ca6af276","unresolved":false,"context_lines":[{"line_number":41,"context_line":"  http://developer.openstack.org/api-ref/compute/"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"* We should state the URL of the API the policy rule affects, in the same"},{"line_number":44,"context_line":"  format as it appears int he api-ref, i.e.: DELETE /servers/{server_id}"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"* The default access level should be described, covering both:"},{"line_number":47,"context_line":"  Project or Global,  Member vs Admin vs Anyone, Read vs Write"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa31d9ce_a3c6d897","line":44,"range":{"start_line":44,"start_character":23,"end_line":44,"end_character":29},"updated":"2017-02-13 22:10:05.000000000","message":"in the","commit_id":"09887d06a20c3869cc7501e377bd5bcc8f8f362b"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"0bdddbb1bef92c0c0d7e07ff084994c84057b715","unresolved":false,"context_lines":[{"line_number":41,"context_line":"  http://developer.openstack.org/api-ref/compute/"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"* We should state the URL of the API the policy rule affects, in the same"},{"line_number":44,"context_line":"  format as it appears int he api-ref, i.e.: DELETE /servers/{server_id}"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"* The default access level should be described, covering both:"},{"line_number":47,"context_line":"  Project or Global,  Member vs Admin vs Anyone, Read vs Write"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa31d9ce_aedddfe1","line":44,"updated":"2017-02-14 02:32:31.000000000","message":"in the*","commit_id":"09887d06a20c3869cc7501e377bd5bcc8f8f362b"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"eea6d852c2e0e9ec76471f6ad1b0fb6d42a0ef5b","unresolved":false,"context_lines":[{"line_number":41,"context_line":"  http://developer.openstack.org/api-ref/compute/"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"* We should state the URL of the API the policy rule affects, in the same"},{"line_number":44,"context_line":"  format as it appears int he api-ref, i.e.: DELETE /servers/{server_id}"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"* The default access level should be described, covering both:"},{"line_number":47,"context_line":"  Project or Global,  Member vs Admin vs Anyone, Read vs Write"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa31d9ce_b980b2f8","line":44,"in_reply_to":"fa31d9ce_aedddfe1","updated":"2017-02-14 11:57:17.000000000","message":"oops.","commit_id":"09887d06a20c3869cc7501e377bd5bcc8f8f362b"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"0bdddbb1bef92c0c0d7e07ff084994c84057b715","unresolved":false,"context_lines":[{"line_number":46,"context_line":"* The default access level should be described, covering both:"},{"line_number":47,"context_line":"  Project or Global,  Member vs Admin vs Anyone, Read vs Write"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"* We should ensure the docs are rendered well in the generated policy file,"},{"line_number":50,"context_line":"  including ensuring all the rules are commented out by default:"},{"line_number":51,"context_line":"  http://docs.openstack.org/developer/nova/sample_policy.html"},{"line_number":52,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa31d9ce_ce01333a","line":49,"updated":"2017-02-14 02:32:31.000000000","message":"This is going to require that we render sample files in yaml, right?","commit_id":"09887d06a20c3869cc7501e377bd5bcc8f8f362b"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"eea6d852c2e0e9ec76471f6ad1b0fb6d42a0ef5b","unresolved":false,"context_lines":[{"line_number":46,"context_line":"* The default access level should be described, covering both:"},{"line_number":47,"context_line":"  Project or Global,  Member vs Admin vs Anyone, Read vs Write"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"* We should ensure the docs are rendered well in the generated policy file,"},{"line_number":50,"context_line":"  including ensuring all the rules are commented out by default:"},{"line_number":51,"context_line":"  http://docs.openstack.org/developer/nova/sample_policy.html"},{"line_number":52,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa31d9ce_599b3672","line":49,"in_reply_to":"fa31d9ce_ce01333a","updated":"2017-02-14 11:57:17.000000000","message":"We already do, but yes.","commit_id":"09887d06a20c3869cc7501e377bd5bcc8f8f362b"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"0bdddbb1bef92c0c0d7e07ff084994c84057b715","unresolved":false,"context_lines":[{"line_number":52,"context_line":""},{"line_number":53,"context_line":"For example, we might see something like this in the sample policy:::"},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"    # Show details of a specific server"},{"line_number":56,"context_line":"    #"},{"line_number":57,"context_line":"    # GET /servers/{server_id}"},{"line_number":58,"context_line":"    # Default access: Project, Member, Read"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa31d9ce_09f8a548","line":55,"updated":"2017-02-14 02:32:31.000000000","message":"This is probably an implementation detail, but it this going to come from the `description` attribute?","commit_id":"09887d06a20c3869cc7501e377bd5bcc8f8f362b"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"eea6d852c2e0e9ec76471f6ad1b0fb6d42a0ef5b","unresolved":false,"context_lines":[{"line_number":52,"context_line":""},{"line_number":53,"context_line":"For example, we might see something like this in the sample policy:::"},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"    # Show details of a specific server"},{"line_number":56,"context_line":"    #"},{"line_number":57,"context_line":"    # GET /servers/{server_id}"},{"line_number":58,"context_line":"    # Default access: Project, Member, Read"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa31d9ce_19953e3e","line":55,"in_reply_to":"fa31d9ce_09f8a548","updated":"2017-02-14 11:57:17.000000000","message":"Yeah, it is, I could include a code snippet I suppose.","commit_id":"09887d06a20c3869cc7501e377bd5bcc8f8f362b"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"0bdddbb1bef92c0c0d7e07ff084994c84057b715","unresolved":false,"context_lines":[{"line_number":98,"context_line":"------------"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"We could try documentation separate to the code, but that has proven hard"},{"line_number":101,"context_line":"to maintain and keep in sync with the code."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"Data model impact"},{"line_number":104,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa31d9ce_1a54621f","line":101,"updated":"2017-02-14 02:32:31.000000000","message":"Yeah - we tried that in keystone once.\n\nhttps://review.openstack.org/#/c/155919/11\n\nIt doesn\u0027t look like it stuck around :( \n\nhttps://github.com/openstack/keystone/blob/master/etc/policy.json","commit_id":"09887d06a20c3869cc7501e377bd5bcc8f8f362b"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"eea6d852c2e0e9ec76471f6ad1b0fb6d42a0ef5b","unresolved":false,"context_lines":[{"line_number":98,"context_line":"------------"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"We could try documentation separate to the code, but that has proven hard"},{"line_number":101,"context_line":"to maintain and keep in sync with the code."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"Data model impact"},{"line_number":104,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa31d9ce_79a39ab2","line":101,"in_reply_to":"fa31d9ce_1a54621f","updated":"2017-02-14 11:57:17.000000000","message":"We did that with the API in nova, total disaster.","commit_id":"09887d06a20c3869cc7501e377bd5bcc8f8f362b"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"0bdddbb1bef92c0c0d7e07ff084994c84057b715","unresolved":false,"context_lines":[{"line_number":114,"context_line":"---------------"},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"A better understanding of what each rule means can only help operators and"},{"line_number":117,"context_line":"developer get the policy configuration correct."},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"Notifications impact"},{"line_number":120,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa31d9ce_55eb0b13","line":117,"updated":"2017-02-14 02:32:31.000000000","message":"++ If anything I would say this helps improve security awareness from an operational perspective.","commit_id":"09887d06a20c3869cc7501e377bd5bcc8f8f362b"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"0bdddbb1bef92c0c0d7e07ff084994c84057b715","unresolved":false,"context_lines":[{"line_number":139,"context_line":"Developer impact"},{"line_number":140,"context_line":"----------------"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"We must remember to add a description when adding a policy docs."},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"Implementation"},{"line_number":145,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa31d9ce_75d72f4b","line":142,"updated":"2017-02-14 02:32:31.000000000","message":"We could add hacking checks for this and integrate them into the linting checks. I can\u0027t think of a common case where we\u0027d be proposing a new operation *without* a description.","commit_id":"09887d06a20c3869cc7501e377bd5bcc8f8f362b"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"eea6d852c2e0e9ec76471f6ad1b0fb6d42a0ef5b","unresolved":false,"context_lines":[{"line_number":139,"context_line":"Developer impact"},{"line_number":140,"context_line":"----------------"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"We must remember to add a description when adding a policy docs."},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"Implementation"},{"line_number":145,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa31d9ce_39c76265","line":142,"in_reply_to":"fa31d9ce_75d72f4b","updated":"2017-02-14 11:57:17.000000000","message":"yeah, I should be explicit and include that here.","commit_id":"09887d06a20c3869cc7501e377bd5bcc8f8f362b"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"14dcd112192172ff9b79910dda06c16726568d81","unresolved":false,"context_lines":[{"line_number":51,"context_line":"  http://docs.openstack.org/developer/nova/sample_policy.html"},{"line_number":52,"context_line":"  Note we already render the sample policy file in yaml."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"For example, we might see something like this in the sample policy:::"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"    # Show details of a specific server"},{"line_number":57,"context_line":"    #"}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa31d9ce_fa24a00d","line":54,"updated":"2017-02-15 13:46:17.000000000","message":"I don\u0027t see an example of what an actions rule would look like, could we have one of those as well?","commit_id":"9075d701bcdd92aa3131a9016082e40fee379522"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"dabea2172333ef4468691f6e8172e3745a5d574f","unresolved":false,"context_lines":[{"line_number":53,"context_line":""},{"line_number":54,"context_line":"For example, we might see something like this in the sample policy:::"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"    # Show details of a specific server"},{"line_number":57,"context_line":"    #"},{"line_number":58,"context_line":"    # GET /servers/{server_id}"},{"line_number":59,"context_line":"    # Default access: Project, Member, Read"},{"line_number":60,"context_line":"    #"},{"line_number":61,"context_line":"    # \"os_compute_api:servers:show\": \"rule:admin_or_owner\""},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"    # Show the real hostname the nova-compute managing the server"},{"line_number":64,"context_line":"    #"},{"line_number":65,"context_line":"    # GET /servers/{server_id}"},{"line_number":66,"context_line":"    # Default access: Project, Admin, Read"},{"line_number":67,"context_line":"    #"},{"line_number":68,"context_line":"    # \"os_compute_api:servers:show:host_status\": \"rule:admin_api\""},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"    # Create a server"},{"line_number":71,"context_line":"    #"}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa31d9ce_ea75b131","line":68,"range":{"start_line":56,"start_character":0,"end_line":68,"end_character":65},"updated":"2017-02-15 12:33:18.000000000","message":"yea this looks nice with new line in between. current policy sample does not have and hard to read. We can check policy generator script for that.","commit_id":"9075d701bcdd92aa3131a9016082e40fee379522"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"935d2dc6453a94abf519c05beb6b878b0ed7bdda","unresolved":false,"context_lines":[{"line_number":77,"context_line":"    # List all host aggregates"},{"line_number":78,"context_line":"    #"},{"line_number":79,"context_line":"    # GET /os-aggregates"},{"line_number":80,"context_line":"    # Default access: Global, Admin, Read"},{"line_number":81,"context_line":"    #"},{"line_number":82,"context_line":"    # \"os_compute_api:os-aggregates:index\": \"rule:admin_api\""},{"line_number":83,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa31d9ce_5a2e8cfb","line":80,"range":{"start_line":80,"start_character":4,"end_line":80,"end_character":41},"updated":"2017-02-15 13:45:21.000000000","message":"I think we could make that easier to read if we do it more like:\n\nDefault scope: project\nDefault access: read/write/admin","commit_id":"9075d701bcdd92aa3131a9016082e40fee379522"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"01dd6ac60058afd9cdfa8e5e52affb2d17727429","unresolved":false,"context_lines":[{"line_number":93,"context_line":"    # GET /"},{"line_number":94,"context_line":"    # Default access: Global, Anyone, read"},{"line_number":95,"context_line":"    #"},{"line_number":96,"context_line":"    # \"os_compute_api:os-aggregates:delete\": \"rule:admin_api\""},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"As an example, we would update the policy definition from:::"},{"line_number":99,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa31d9ce_1aadf487","line":96,"updated":"2017-02-15 13:43:11.000000000","message":"Lets add in some actions and some os_compute_api:servers:show:host_status\" related ones, as they are tricky.","commit_id":"9075d701bcdd92aa3131a9016082e40fee379522"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"14dcd112192172ff9b79910dda06c16726568d81","unresolved":false,"context_lines":[{"line_number":106,"context_line":""},{"line_number":107,"context_line":"    GET /servers/{server_id}"},{"line_number":108,"context_line":"    Default access: Project, Member, Read"},{"line_number":109,"context_line":"    \"\"\"),"},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Alternatives"},{"line_number":112,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa31d9ce_3a4478b5","line":109,"updated":"2017-02-15 13:46:17.000000000","message":"I guess my only question is whether we should provide this as more structured metadata for being able to do analysis on this later.\n\nLike \n\n - description\n - url\n - default_access","commit_id":"9075d701bcdd92aa3131a9016082e40fee379522"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"a2cbcc61ffa3dea2c81dd0c763a85d2eeaec4a69","unresolved":false,"context_lines":[{"line_number":106,"context_line":""},{"line_number":107,"context_line":"    GET /servers/{server_id}"},{"line_number":108,"context_line":"    Default access: Project, Member, Read"},{"line_number":109,"context_line":"    \"\"\"),"},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Alternatives"},{"line_number":112,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa31d9ce_6d0ab88b","line":109,"in_reply_to":"fa31d9ce_3a4478b5","updated":"2017-02-15 14:04:56.000000000","message":"Yeah, I was thinking about waiting on doing that, but I have to admit I am tempted to add a wrapper around oslo.policy to do that in the short term.","commit_id":"9075d701bcdd92aa3131a9016082e40fee379522"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"91c9e4c6d8c3e31fcd8adafdc615c46763e3816c","unresolved":false,"context_lines":[{"line_number":41,"context_line":"  http://developer.openstack.org/api-ref/compute/"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"* We should state the URL of the API the policy rule affects, in the same"},{"line_number":44,"context_line":"  format as it appears in the api-ref, i.e.: DELETE /servers/{server_id}"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"* The default access level should be described, covering both:"},{"line_number":47,"context_line":"  Project or Global,  Member vs Admin vs Anyone, Read vs Write"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa31d9ce_66dd0e70","line":44,"updated":"2017-02-17 16:02:02.000000000","message":"+10^many","commit_id":"cb0fcc6e15f4fbfdeaee3766046a194cee9b273b"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c5378d01aa6256ec50ee1745d019ad7adf6e998a","unresolved":false,"context_lines":[{"line_number":109,"context_line":"    #"},{"line_number":110,"context_line":"    # GET /"},{"line_number":111,"context_line":"    # Scope: Global"},{"line_number":112,"context_line":"    # Access: No Auth"},{"line_number":113,"context_line":"    #"},{"line_number":114,"context_line":"    # \"os_compute_api:os-aggregates:delete\": \"rule:admin_api\""},{"line_number":115,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa31d9ce_7825d808","line":112,"updated":"2017-02-16 18:07:52.000000000","message":"nit: s/No Auth/Unauthenticated/ ? \n\nI only think this because it feels more complete when we don\u0027t use abbreviations.","commit_id":"cb0fcc6e15f4fbfdeaee3766046a194cee9b273b"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"3e3a8c7c0bb27d363f58801ecd53994aa2bdecca","unresolved":false,"context_lines":[{"line_number":109,"context_line":"    #"},{"line_number":110,"context_line":"    # GET /"},{"line_number":111,"context_line":"    # Scope: Global"},{"line_number":112,"context_line":"    # Access: No Auth"},{"line_number":113,"context_line":"    #"},{"line_number":114,"context_line":"    # \"os_compute_api:os-aggregates:delete\": \"rule:admin_api\""},{"line_number":115,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa31d9ce_dc720a11","line":112,"in_reply_to":"fa31d9ce_265876fa","updated":"2017-02-17 18:36:30.000000000","message":"good idea.","commit_id":"cb0fcc6e15f4fbfdeaee3766046a194cee9b273b"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"91c9e4c6d8c3e31fcd8adafdc615c46763e3816c","unresolved":false,"context_lines":[{"line_number":109,"context_line":"    #"},{"line_number":110,"context_line":"    # GET /"},{"line_number":111,"context_line":"    # Scope: Global"},{"line_number":112,"context_line":"    # Access: No Auth"},{"line_number":113,"context_line":"    #"},{"line_number":114,"context_line":"    # \"os_compute_api:os-aggregates:delete\": \"rule:admin_api\""},{"line_number":115,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa31d9ce_265876fa","line":112,"in_reply_to":"fa31d9ce_7825d808","updated":"2017-02-17 16:02:02.000000000","message":"yeah, Unauthenticated seems less likely to be misread","commit_id":"cb0fcc6e15f4fbfdeaee3766046a194cee9b273b"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"91c9e4c6d8c3e31fcd8adafdc615c46763e3816c","unresolved":false,"context_lines":[{"line_number":124,"context_line":"        verb\u003d\"GET\","},{"line_number":125,"context_line":"        url\u003d\"/servers/{server_id}\","},{"line_number":126,"context_line":"        scope\u003d\"project\","},{"line_number":127,"context_line":"        access\u003d\"read\")"},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"It is too soon to see if this is a common pattern, so for now this will be"},{"line_number":130,"context_line":"a shim over oslo.policy\u0027s RuleDefault that generates the description from the"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa31d9ce_2626b668","line":127,"updated":"2017-02-17 16:02:02.000000000","message":"I assume the fact that this duplicates information that the code already \"knows\" (the url and method, for example) is just something we\u0027ve got to accept for now?","commit_id":"cb0fcc6e15f4fbfdeaee3766046a194cee9b273b"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"3e3a8c7c0bb27d363f58801ecd53994aa2bdecca","unresolved":false,"context_lines":[{"line_number":124,"context_line":"        verb\u003d\"GET\","},{"line_number":125,"context_line":"        url\u003d\"/servers/{server_id}\","},{"line_number":126,"context_line":"        scope\u003d\"project\","},{"line_number":127,"context_line":"        access\u003d\"read\")"},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"It is too soon to see if this is a common pattern, so for now this will be"},{"line_number":130,"context_line":"a shim over oslo.policy\u0027s RuleDefault that generates the description from the"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa31d9ce_7c54be53","line":127,"in_reply_to":"fa31d9ce_2626b668","updated":"2017-02-17 18:36:30.000000000","message":"Yeah, it sucks really. Its really quite hidden in the current API code, unlike placement.","commit_id":"cb0fcc6e15f4fbfdeaee3766046a194cee9b273b"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"3867bf1f724c8e8528a7392c2061eaa6ab2ca4c2","unresolved":false,"context_lines":[{"line_number":43,"context_line":"* We should state the URL of the API the policy rule affects, in the same"},{"line_number":44,"context_line":"  format as it appears in the api-ref, i.e.: DELETE /servers/{server_id}"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"* The default access level should be described, covering both:"},{"line_number":47,"context_line":"  Project or Global,  Member vs Admin vs Anyone, Read vs Write"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"* We should ensure the docs are rendered well in the generated policy file,"},{"line_number":50,"context_line":"  including ensuring all the rules are commented out by default:"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da36d5c6_5c2ecb43","line":47,"range":{"start_line":46,"start_character":2,"end_line":47,"end_character":62},"updated":"2017-02-23 07:14:05.000000000","message":"I\u0027m not really clear on what this means or how it helps. It seems to me that the only useful information in the examples below is a) the description and b) the API method+path. It doesn\u0027t seem like talking about scope or access are generally necessary, since that should be clear from (a) or (b) or the default value or some combination of those things. If it\u0027s not, you\u0027ve got a problem with (a).","commit_id":"527b44ce9ad2ffe7ee3e757c79f7eeae406d6636"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"733260cbaee59acdf67a9464b3a2d98d90a4126c","unresolved":false,"context_lines":[{"line_number":43,"context_line":"* We should state the URL of the API the policy rule affects, in the same"},{"line_number":44,"context_line":"  format as it appears in the api-ref, i.e.: DELETE /servers/{server_id}"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"* The default access level should be described, covering both:"},{"line_number":47,"context_line":"  Project or Global,  Member vs Admin vs Anyone, Read vs Write"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"* We should ensure the docs are rendered well in the generated policy file,"},{"line_number":50,"context_line":"  including ensuring all the rules are commented out by default:"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da36d5c6_ed96d43c","line":47,"range":{"start_line":46,"start_character":2,"end_line":47,"end_character":62},"in_reply_to":"da36d5c6_5c2ecb43","updated":"2017-02-23 18:46:26.000000000","message":"Agreed at the PTG to drop scope/access for now.","commit_id":"527b44ce9ad2ffe7ee3e757c79f7eeae406d6636"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"1ce887232df857928bb1967662cf8b5c14808e8d","unresolved":false,"context_lines":[{"line_number":51,"context_line":"  http://docs.openstack.org/developer/nova/sample_policy.html"},{"line_number":52,"context_line":"  Note we already render the sample policy file in yaml."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"For example, we might see something like this in the sample policy:::"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"    # Show details of a specific server"},{"line_number":57,"context_line":"    #"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da36d5c6_4dc9a058","line":54,"range":{"start_line":54,"start_character":66,"end_line":54,"end_character":69},"updated":"2017-02-23 18:48:40.000000000","message":"just ::","commit_id":"527b44ce9ad2ffe7ee3e757c79f7eeae406d6636"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"e46abe7344ff342b095a27b8dd175bbdcc9ea569","unresolved":false,"context_lines":[{"line_number":55,"context_line":""},{"line_number":56,"context_line":"    # Show details of a specific server"},{"line_number":57,"context_line":"    #"},{"line_number":58,"context_line":"    # GET /servers/{server_id}"},{"line_number":59,"context_line":"    # Scope: Project"},{"line_number":60,"context_line":"    # Access: Read"},{"line_number":61,"context_line":"    #"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da36d5c6_0de088f9","line":58,"range":{"start_line":58,"start_character":6,"end_line":58,"end_character":30},"updated":"2017-02-23 18:43:31.000000000","message":"sometimes this would be multiple APIs... e.g. a read policy used for both GET /servers/{server_id} and GET /servers","commit_id":"527b44ce9ad2ffe7ee3e757c79f7eeae406d6636"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"20ae81f683220e727ff6df075b70a70ea52ba2dd","unresolved":false,"context_lines":[{"line_number":56,"context_line":"    # Show details of a specific server"},{"line_number":57,"context_line":"    #"},{"line_number":58,"context_line":"    # GET /servers/{server_id}"},{"line_number":59,"context_line":"    # Scope: Project"},{"line_number":60,"context_line":"    # Access: Read"},{"line_number":61,"context_line":"    #"},{"line_number":62,"context_line":"    # \"os_compute_api:servers:show\": \"rule:admin_or_owner\""},{"line_number":63,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"da36d5c6_cda750bb","line":60,"range":{"start_line":59,"start_character":6,"end_line":60,"end_character":18},"updated":"2017-02-25 03:07:47.000000000","message":"Lets drop these in here.","commit_id":"527b44ce9ad2ffe7ee3e757c79f7eeae406d6636"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"20ae81f683220e727ff6df075b70a70ea52ba2dd","unresolved":false,"context_lines":[{"line_number":67,"context_line":"    # to each project. If you pass this rule, we show the real hostname"},{"line_number":68,"context_line":"    # so admins can find which host the server is on."},{"line_number":69,"context_line":"    #"},{"line_number":70,"context_line":"    # GET /servers/{server_id}"},{"line_number":71,"context_line":"    # Scope: Project"},{"line_number":72,"context_line":"    # Access: Admin"},{"line_number":73,"context_line":"    #"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da36d5c6_0d85e805","line":70,"range":{"start_line":70,"start_character":4,"end_line":70,"end_character":30},"updated":"2017-02-25 03:07:47.000000000","message":"If we have multiples here, it could be tricky.","commit_id":"527b44ce9ad2ffe7ee3e757c79f7eeae406d6636"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"1ce887232df857928bb1967662cf8b5c14808e8d","unresolved":false,"context_lines":[{"line_number":113,"context_line":"    #"},{"line_number":114,"context_line":"    # \"os_compute_api:os-aggregates:delete\": \"rule:admin_api\""},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"As an example, we would update the policy definition from:::"},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"    policy.RuleDefault(SERVERS % \u0027show\u0027, RULE_AOO),"},{"line_number":119,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"da36d5c6_6dc2e435","line":116,"range":{"start_line":116,"start_character":57,"end_line":116,"end_character":60},"updated":"2017-02-23 18:48:40.000000000","message":"::","commit_id":"527b44ce9ad2ffe7ee3e757c79f7eeae406d6636"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"1ce887232df857928bb1967662cf8b5c14808e8d","unresolved":false,"context_lines":[{"line_number":117,"context_line":""},{"line_number":118,"context_line":"    policy.RuleDefault(SERVERS % \u0027show\u0027, RULE_AOO),"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"To something more like this:::"},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"    policy.RuleDefault(SERVERS % \"show\", RULE_AOO,"},{"line_number":123,"context_line":"        description\u003d\"Show details of a specific server\","}],"source_content_type":"text/x-rst","patch_set":7,"id":"da36d5c6_cde3d0d7","line":120,"range":{"start_line":120,"start_character":27,"end_line":120,"end_character":30},"updated":"2017-02-23 18:48:40.000000000","message":"::","commit_id":"527b44ce9ad2ffe7ee3e757c79f7eeae406d6636"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"1ce887232df857928bb1967662cf8b5c14808e8d","unresolved":false,"context_lines":[{"line_number":121,"context_line":""},{"line_number":122,"context_line":"    policy.RuleDefault(SERVERS % \"show\", RULE_AOO,"},{"line_number":123,"context_line":"        description\u003d\"Show details of a specific server\","},{"line_number":124,"context_line":"        verb\u003d\"GET\","},{"line_number":125,"context_line":"        url\u003d\"/servers/{server_id}\","},{"line_number":126,"context_line":"        scope\u003d\"project\","},{"line_number":127,"context_line":"        access\u003d\"read\")"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da36d5c6_adb77cd6","line":124,"range":{"start_line":124,"start_character":8,"end_line":124,"end_character":12},"updated":"2017-02-23 18:48:40.000000000","message":"method?","commit_id":"527b44ce9ad2ffe7ee3e757c79f7eeae406d6636"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"1ce887232df857928bb1967662cf8b5c14808e8d","unresolved":false,"context_lines":[{"line_number":122,"context_line":"    policy.RuleDefault(SERVERS % \"show\", RULE_AOO,"},{"line_number":123,"context_line":"        description\u003d\"Show details of a specific server\","},{"line_number":124,"context_line":"        verb\u003d\"GET\","},{"line_number":125,"context_line":"        url\u003d\"/servers/{server_id}\","},{"line_number":126,"context_line":"        scope\u003d\"project\","},{"line_number":127,"context_line":"        access\u003d\"read\")"},{"line_number":128,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"da36d5c6_cdbcb0bd","line":125,"range":{"start_line":125,"start_character":8,"end_line":125,"end_character":11},"updated":"2017-02-23 18:48:40.000000000","message":"path?","commit_id":"527b44ce9ad2ffe7ee3e757c79f7eeae406d6636"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"1ce887232df857928bb1967662cf8b5c14808e8d","unresolved":false,"context_lines":[{"line_number":123,"context_line":"        description\u003d\"Show details of a specific server\","},{"line_number":124,"context_line":"        verb\u003d\"GET\","},{"line_number":125,"context_line":"        url\u003d\"/servers/{server_id}\","},{"line_number":126,"context_line":"        scope\u003d\"project\","},{"line_number":127,"context_line":"        access\u003d\"read\")"},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"It is too soon to see if this is a common pattern, so for now this will be"},{"line_number":130,"context_line":"a shim over oslo.policy\u0027s RuleDefault that generates the description from the"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da36d5c6_edadf484","line":127,"range":{"start_line":126,"start_character":8,"end_line":127,"end_character":21},"updated":"2017-02-23 18:48:40.000000000","message":"drop","commit_id":"527b44ce9ad2ffe7ee3e757c79f7eeae406d6636"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"3867bf1f724c8e8528a7392c2061eaa6ab2ca4c2","unresolved":false,"context_lines":[{"line_number":126,"context_line":"        scope\u003d\"project\","},{"line_number":127,"context_line":"        access\u003d\"read\")"},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"It is too soon to see if this is a common pattern, so for now this will be"},{"line_number":130,"context_line":"a shim over oslo.policy\u0027s RuleDefault that generates the description from the"},{"line_number":131,"context_line":"metadata we supply. It also makes all of the arguments required, to ensure we"},{"line_number":132,"context_line":"don\u0027t forget to provide all the information."},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da36d5c6_fc1f7f05","line":131,"range":{"start_line":129,"start_character":0,"end_line":131,"end_character":19},"updated":"2017-02-23 07:14:05.000000000","message":"I think keystone wants the same thing in the same timeframe, in which case it would probably make sense to do it in a common place (oslo.policy).","commit_id":"527b44ce9ad2ffe7ee3e757c79f7eeae406d6636"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"3867bf1f724c8e8528a7392c2061eaa6ab2ca4c2","unresolved":false,"context_lines":[{"line_number":128,"context_line":""},{"line_number":129,"context_line":"It is too soon to see if this is a common pattern, so for now this will be"},{"line_number":130,"context_line":"a shim over oslo.policy\u0027s RuleDefault that generates the description from the"},{"line_number":131,"context_line":"metadata we supply. It also makes all of the arguments required, to ensure we"},{"line_number":132,"context_line":"don\u0027t forget to provide all the information."},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da36d5c6_7cc1cf53","line":131,"range":{"start_line":131,"start_character":28,"end_line":131,"end_character":63},"updated":"2017-02-23 07:14:05.000000000","message":"worth noting that if/when it moves into oslo.policy, it would need to be a subclass of the current RuleDefault if you want to keep requiring these arguments, so that other services that aren\u0027t here yet will continue to work without passing these args.","commit_id":"527b44ce9ad2ffe7ee3e757c79f7eeae406d6636"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"3867bf1f724c8e8528a7392c2061eaa6ab2ca4c2","unresolved":false,"context_lines":[{"line_number":137,"context_line":"We could try documentation separate to the code, but that has proven hard"},{"line_number":138,"context_line":"to maintain and keep in sync with the code."},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"We could extend oslo.polcy to have specific parameters for things like the"},{"line_number":141,"context_line":"URL and the default access. It is better to experiment with the"},{"line_number":142,"context_line":"documentation to establish a good pattern before we hard code that format"},{"line_number":143,"context_line":"into the library."}],"source_content_type":"text/x-rst","patch_set":7,"id":"da36d5c6_bce0a7fb","line":140,"range":{"start_line":140,"start_character":21,"end_line":140,"end_character":26},"updated":"2017-02-23 07:14:05.000000000","message":"policy*","commit_id":"527b44ce9ad2ffe7ee3e757c79f7eeae406d6636"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"3867bf1f724c8e8528a7392c2061eaa6ab2ca4c2","unresolved":false,"context_lines":[{"line_number":155,"context_line":"Security impact"},{"line_number":156,"context_line":"---------------"},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"A better understanding of what each rule means can only help operators and"},{"line_number":159,"context_line":"developer get the policy configuration correct."},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"Notifications impact"},{"line_number":162,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da36d5c6_3ced97ef","line":159,"range":{"start_line":158,"start_character":0,"end_line":159,"end_character":47},"updated":"2017-02-23 07:14:05.000000000","message":"++ As someone who customizes policy extensively, this gets a big thumbs up from me!","commit_id":"527b44ce9ad2ffe7ee3e757c79f7eeae406d6636"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"3867bf1f724c8e8528a7392c2061eaa6ab2ca4c2","unresolved":false,"context_lines":[{"line_number":182,"context_line":"----------------"},{"line_number":183,"context_line":""},{"line_number":184,"context_line":"We must remember to add a description when adding a policy docs."},{"line_number":185,"context_line":"We can add a hacking check to ensure the description is not forgotten."},{"line_number":186,"context_line":""},{"line_number":187,"context_line":"Implementation"},{"line_number":188,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da36d5c6_1cc7f364","line":185,"range":{"start_line":185,"start_character":13,"end_line":185,"end_character":26},"updated":"2017-02-23 07:14:05.000000000","message":"is this just a check that you used the shim class that wrappers oslo.policy\u0027s RuleDefault? Since that is supposed to require the args, it shouldn\u0027t be possible not to set them unless you didn\u0027t use that class. Could go further and do some sort of validation of the values, I guess, e.g. to make sure they\u0027re not empty.","commit_id":"527b44ce9ad2ffe7ee3e757c79f7eeae406d6636"},{"author":{"_account_id":19590,"name":"Sarafraj Singh","email":"Sarafraj.Singh@intel.com","username":"sarafrajsingh"},"change_message_id":"ee0762247ef115236313860cbb32b063436eb992","unresolved":false,"context_lines":[{"line_number":45,"context_line":""},{"line_number":46,"context_line":"* We should ensure the docs are rendered well in the generated policy file,"},{"line_number":47,"context_line":"  including ensuring all the rules are commented out by default:"},{"line_number":48,"context_line":"  http://docs.openstack.org/developer/nova/sample_policy.html"},{"line_number":49,"context_line":"  Note we already render the sample policy file in yaml."},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"For example, we might see something like this in the sample policy::"}],"source_content_type":"text/x-rst","patch_set":8,"id":"da36d5c6_f76c83d2","line":48,"updated":"2017-02-27 18:47:45.000000000","message":"nit: Add a new line so it renders properly. http://docs-draft.openstack.org/10/433010/8/check/gate-nova-specs-docs-ubuntu-xenial/9440fc1//doc/build/html/specs/pike/approved/policy-docs.html#proposed-change","commit_id":"32fe0701328e1a51670a72b9a3f9bd6f4900f234"},{"author":{"_account_id":20217,"name":"Anusha Unnam","email":"anusha.unnam25@gmail.com","username":"aunnam"},"change_message_id":"74d2ffe231ecaf70fa2e3f577f575124b6d95f12","unresolved":false,"context_lines":[{"line_number":53,"context_line":"    # Show details of a specific server"},{"line_number":54,"context_line":"    #"},{"line_number":55,"context_line":"    # GET /servers/{server_id}"},{"line_number":56,"context_line":"    # Scope: Project"},{"line_number":57,"context_line":"    # Access: Read"},{"line_number":58,"context_line":"    #"},{"line_number":59,"context_line":"    # \"os_compute_api:servers:show\": \"rule:admin_or_owner\""},{"line_number":60,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"da36d5c6_03e8ef15","line":57,"range":{"start_line":56,"start_character":4,"end_line":57,"end_character":18},"updated":"2017-02-28 00:08:18.000000000","message":"These should be dropped for now right?","commit_id":"32fe0701328e1a51670a72b9a3f9bd6f4900f234"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"48c6c77d6edaa470a5741928d2d6209e71f64ebf","unresolved":false,"context_lines":[{"line_number":54,"context_line":"    #"},{"line_number":55,"context_line":"    # GET /servers/{server_id}"},{"line_number":56,"context_line":"    # Scope: Project"},{"line_number":57,"context_line":"    # Access: Read"},{"line_number":58,"context_line":"    #"},{"line_number":59,"context_line":"    # \"os_compute_api:servers:show\": \"rule:admin_or_owner\""},{"line_number":60,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"9a30ddce_ca122cb4","line":57,"in_reply_to":"9a30ddce_2f777b3b","updated":"2017-03-08 13:45:56.000000000","message":"oops, yeah, that needs updating.","commit_id":"32fe0701328e1a51670a72b9a3f9bd6f4900f234"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c144c3fba1c1f1390065325bffc3a2c3e6ec3da4","unresolved":false,"context_lines":[{"line_number":54,"context_line":"    #"},{"line_number":55,"context_line":"    # GET /servers/{server_id}"},{"line_number":56,"context_line":"    # Scope: Project"},{"line_number":57,"context_line":"    # Access: Read"},{"line_number":58,"context_line":"    #"},{"line_number":59,"context_line":"    # \"os_compute_api:servers:show\": \"rule:admin_or_owner\""},{"line_number":60,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"9a30ddce_2f777b3b","line":57,"in_reply_to":"da36d5c6_03e8ef15","updated":"2017-03-07 20:00:46.000000000","message":"Based on the discussions from the PTG I believe so. I\u0027ve dropped them from the keystone spec: \n\nhttps://review.openstack.org/#/c/435078/","commit_id":"32fe0701328e1a51670a72b9a3f9bd6f4900f234"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"901a0293cf972fbeb2b9b578aa53716b37f76aa7","unresolved":false,"context_lines":[{"line_number":58,"context_line":"    #"},{"line_number":59,"context_line":"    # \"os_compute_api:servers:show\": \"rule:admin_or_owner\""},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"    # Show real hostname of nova-compute managing the server"},{"line_number":62,"context_line":"    #"},{"line_number":63,"context_line":"    # Users normally only see an obsecured hostname that is unique"},{"line_number":64,"context_line":"    # to each project. If you pass this rule, we show the real hostname"}],"source_content_type":"text/x-rst","patch_set":8,"id":"9a30ddce_4c5bc687","line":61,"range":{"start_line":61,"start_character":6,"end_line":61,"end_character":60},"updated":"2017-03-08 08:12:32.000000000","message":"in this spec https://review.openstack.org/#/c/265282/6/specs/pike/approved/instance-flavor-api.rst@74\n\nthere will be two APIs share same rule","commit_id":"32fe0701328e1a51670a72b9a3f9bd6f4900f234"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"48c6c77d6edaa470a5741928d2d6209e71f64ebf","unresolved":false,"context_lines":[{"line_number":58,"context_line":"    #"},{"line_number":59,"context_line":"    # \"os_compute_api:servers:show\": \"rule:admin_or_owner\""},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"    # Show real hostname of nova-compute managing the server"},{"line_number":62,"context_line":"    #"},{"line_number":63,"context_line":"    # Users normally only see an obsecured hostname that is unique"},{"line_number":64,"context_line":"    # to each project. If you pass this rule, we show the real hostname"}],"source_content_type":"text/x-rst","patch_set":8,"id":"9a30ddce_8a2114fe","line":61,"range":{"start_line":61,"start_character":6,"end_line":61,"end_character":60},"in_reply_to":"9a30ddce_4c5bc687","updated":"2017-03-08 13:45:56.000000000","message":"yeah, I should add that here.","commit_id":"32fe0701328e1a51670a72b9a3f9bd6f4900f234"},{"author":{"_account_id":20217,"name":"Anusha Unnam","email":"anusha.unnam25@gmail.com","username":"aunnam"},"change_message_id":"834c96b56cf0c8ab0692625ae0523a8a42a85234","unresolved":false,"context_lines":[{"line_number":118,"context_line":""},{"line_number":119,"context_line":"    policy.RuleDefault(SERVERS % \"show\", RULE_AOO,"},{"line_number":120,"context_line":"        description\u003d\"Show details of a specific server\","},{"line_number":121,"context_line":"        urls\u003d[{method\u003d\"GET\", path\u003d\"/servers/{server_id}\"})"},{"line_number":122,"context_line":""},{"line_number":123,"context_line":"It is too soon to see if this is a common pattern, so for now this will be"},{"line_number":124,"context_line":"a shim over oslo.policy\u0027s RuleDefault that generates the description from the"}],"source_content_type":"text/x-rst","patch_set":8,"id":"ba2be162_24f4f2f0","line":121,"range":{"start_line":121,"start_character":57,"end_line":121,"end_character":58},"updated":"2017-03-01 18:28:48.000000000","message":"closing \u0027]\u0027 is missing here as url is a list.","commit_id":"32fe0701328e1a51670a72b9a3f9bd6f4900f234"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"48c6c77d6edaa470a5741928d2d6209e71f64ebf","unresolved":false,"context_lines":[{"line_number":118,"context_line":""},{"line_number":119,"context_line":"    policy.RuleDefault(SERVERS % \"show\", RULE_AOO,"},{"line_number":120,"context_line":"        description\u003d\"Show details of a specific server\","},{"line_number":121,"context_line":"        urls\u003d[{method\u003d\"GET\", path\u003d\"/servers/{server_id}\"})"},{"line_number":122,"context_line":""},{"line_number":123,"context_line":"It is too soon to see if this is a common pattern, so for now this will be"},{"line_number":124,"context_line":"a shim over oslo.policy\u0027s RuleDefault that generates the description from the"}],"source_content_type":"text/x-rst","patch_set":8,"id":"9a30ddce_0a8444d2","line":121,"range":{"start_line":121,"start_character":57,"end_line":121,"end_character":58},"in_reply_to":"ba2be162_24f4f2f0","updated":"2017-03-08 13:45:56.000000000","message":"oops, yeah.","commit_id":"32fe0701328e1a51670a72b9a3f9bd6f4900f234"},{"author":{"_account_id":18337,"name":"Sujitha","email":"sujitha.neti@intel.com","username":"Sujitha"},"change_message_id":"25c96c22a104dcb1cd95fa70af5104e81c3429b2","unresolved":false,"context_lines":[{"line_number":176,"context_line":"Developer impact"},{"line_number":177,"context_line":"----------------"},{"line_number":178,"context_line":""},{"line_number":179,"context_line":"We must add a description when adding a policy docs. Theses are all"},{"line_number":180,"context_line":"required arguments to the new method."},{"line_number":181,"context_line":""},{"line_number":182,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":8,"id":"da36d5c6_9d57e525","line":179,"range":{"start_line":179,"start_character":53,"end_line":179,"end_character":59},"updated":"2017-02-27 21:03:49.000000000","message":"s/Theses/These","commit_id":"32fe0701328e1a51670a72b9a3f9bd6f4900f234"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"7ce0daf154afcba1d19a8293284a824416878e7e","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/nova/+spec/policy-docs"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Today operators needs to read the code to work out what a policy rule actually"},{"line_number":14,"context_line":"means. That is terrible, and this spec proposes we fix that by adding a"},{"line_number":15,"context_line":"description for every policy rule."},{"line_number":16,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"3a1ff146_e6f58183","line":13,"range":{"start_line":13,"start_character":16,"end_line":13,"end_character":21},"updated":"2017-03-15 18:02:39.000000000","message":"need","commit_id":"f42ca2aa444fe77b4381f613349d4b58f0459ef9"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"7ce0daf154afcba1d19a8293284a824416878e7e","unresolved":false,"context_lines":[{"line_number":26,"context_line":"  appropriate for their deployment."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"* Operator wants to give users access to a particular API that they currently"},{"line_number":29,"context_line":"  get a 403 error when accessing"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"* Operator wants to restrict access to an API a user currently has access to."},{"line_number":32,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"3a1ff146_6630b157","line":29,"range":{"start_line":29,"start_character":23,"end_line":29,"end_character":32},"updated":"2017-03-15 18:02:39.000000000","message":"nit: accessing.","commit_id":"f42ca2aa444fe77b4381f613349d4b58f0459ef9"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"7ce0daf154afcba1d19a8293284a824416878e7e","unresolved":false,"context_lines":[{"line_number":44,"context_line":"  format as it appears in the api-ref, i.e.: DELETE /servers/{server_id}"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"* We should ensure the docs are rendered well in the generated policy file,"},{"line_number":47,"context_line":"  including ensuring all the rules are commented out by default:"},{"line_number":48,"context_line":"  http://docs.openstack.org/developer/nova/sample_policy.html"},{"line_number":49,"context_line":"  Note we already render the sample policy file in yaml."},{"line_number":50,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"3a1ff146_66cc3136","line":47,"range":{"start_line":47,"start_character":2,"end_line":47,"end_character":63},"updated":"2017-03-15 18:02:39.000000000","message":"We don\u0027t do that today, right? Looking at:\n\nhttps://docs.openstack.org/developer/nova/sample_policy.html\n\nThe default rules are in there, e.g.:\n\n\"os_compute_api:os-server-diagnostics\": \"rule:admin_api\"\n\nSo I\u0027m not sure what \"all the rules are commented out by default\" means.","commit_id":"f42ca2aa444fe77b4381f613349d4b58f0459ef9"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"7ce0daf154afcba1d19a8293284a824416878e7e","unresolved":false,"context_lines":[{"line_number":54,"context_line":"    #"},{"line_number":55,"context_line":"    # GET /servers/{server_id}"},{"line_number":56,"context_line":"    #"},{"line_number":57,"context_line":"    # \"os_compute_api:servers:show\": \"rule:admin_or_owner\""},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"    # Show real hostname of nova-compute managing the server"},{"line_number":60,"context_line":"    #"}],"source_content_type":"text/x-rst","patch_set":9,"id":"3a1ff146_e6d821f2","line":57,"updated":"2017-03-15 18:02:39.000000000","message":"Oh I see, this is what you mean by commented out by default.","commit_id":"f42ca2aa444fe77b4381f613349d4b58f0459ef9"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"7ce0daf154afcba1d19a8293284a824416878e7e","unresolved":false,"context_lines":[{"line_number":58,"context_line":""},{"line_number":59,"context_line":"    # Show real hostname of nova-compute managing the server"},{"line_number":60,"context_line":"    #"},{"line_number":61,"context_line":"    # Users normally only see an obsecured hostname that is unique"},{"line_number":62,"context_line":"    # to each project. If you pass this rule, we show the real hostname"},{"line_number":63,"context_line":"    # so admins can find which host the server is on."},{"line_number":64,"context_line":"    #"}],"source_content_type":"text/x-rst","patch_set":9,"id":"3a1ff146_66f35174","line":61,"range":{"start_line":61,"start_character":33,"end_line":61,"end_character":42},"updated":"2017-03-15 18:02:39.000000000","message":"obscured? obfuscated?","commit_id":"f42ca2aa444fe77b4381f613349d4b58f0459ef9"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"e309f6ada6a62039d7bdf85550c02f6c0183f161","unresolved":false,"context_lines":[{"line_number":58,"context_line":""},{"line_number":59,"context_line":"    # Show real hostname of nova-compute managing the server"},{"line_number":60,"context_line":"    #"},{"line_number":61,"context_line":"    # Users normally only see an obsecured hostname that is unique"},{"line_number":62,"context_line":"    # to each project. If you pass this rule, we show the real hostname"},{"line_number":63,"context_line":"    # so admins can find which host the server is on."},{"line_number":64,"context_line":"    #"}],"source_content_type":"text/x-rst","patch_set":9,"id":"3a1ff146_acb52b32","line":61,"range":{"start_line":61,"start_character":33,"end_line":61,"end_character":42},"in_reply_to":"3a1ff146_66f35174","updated":"2017-03-15 18:06:56.000000000","message":"yeah, thats a better word.","commit_id":"f42ca2aa444fe77b4381f613349d4b58f0459ef9"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"7ce0daf154afcba1d19a8293284a824416878e7e","unresolved":false,"context_lines":[{"line_number":95,"context_line":"    #"},{"line_number":96,"context_line":"    # GET /"},{"line_number":97,"context_line":"    #"},{"line_number":98,"context_line":"    # \"os_compute_api:os-aggregates:delete\": \"rule:admin_api\""},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"As an example, we would update the policy definition from::"},{"line_number":101,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"3a1ff146_269159f1","line":98,"range":{"start_line":98,"start_character":6,"end_line":98,"end_character":61},"updated":"2017-03-15 18:02:39.000000000","message":"Is this the correct policy rule for GET / for listing versions?","commit_id":"f42ca2aa444fe77b4381f613349d4b58f0459ef9"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"e309f6ada6a62039d7bdf85550c02f6c0183f161","unresolved":false,"context_lines":[{"line_number":95,"context_line":"    #"},{"line_number":96,"context_line":"    # GET /"},{"line_number":97,"context_line":"    #"},{"line_number":98,"context_line":"    # \"os_compute_api:os-aggregates:delete\": \"rule:admin_api\""},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"As an example, we would update the policy definition from::"},{"line_number":101,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"3a1ff146_2c805b46","line":98,"range":{"start_line":98,"start_character":6,"end_line":98,"end_character":61},"in_reply_to":"3a1ff146_269159f1","updated":"2017-03-15 18:06:56.000000000","message":"heh, that cut and paste has not gone well.","commit_id":"f42ca2aa444fe77b4381f613349d4b58f0459ef9"},{"author":{"_account_id":22219,"name":"Anthony Washington","email":"anthony.washington@intel.com","username":"antwash"},"change_message_id":"6b10e5166138bd146738135425078c867b462990","unresolved":false,"context_lines":[{"line_number":104,"context_line":"To something more like this::"},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"    policy.RuleDefault(SERVERS % \"show\", RULE_AOO,"},{"line_number":107,"context_line":"        description\u003d\"Show details of a specific server\","},{"line_number":108,"context_line":"        urls\u003d[{method\u003d\"GET\", path\u003d\"/servers/{server_id}\"}])"},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"It is too soon to see if this is a common pattern, so for now this will be"}],"source_content_type":"text/x-rst","patch_set":9,"id":"3a1ff146_5cf9f3c7","line":107,"updated":"2017-03-14 20:53:42.000000000","message":"Should we modify the policy class being used to follow the subclass approach taking here: https://review.openstack.org/#/c/439070/","commit_id":"f42ca2aa444fe77b4381f613349d4b58f0459ef9"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"7ce0daf154afcba1d19a8293284a824416878e7e","unresolved":false,"context_lines":[{"line_number":104,"context_line":"To something more like this::"},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"    policy.RuleDefault(SERVERS % \"show\", RULE_AOO,"},{"line_number":107,"context_line":"        description\u003d\"Show details of a specific server\","},{"line_number":108,"context_line":"        urls\u003d[{method\u003d\"GET\", path\u003d\"/servers/{server_id}\"}])"},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"It is too soon to see if this is a common pattern, so for now this will be"}],"source_content_type":"text/x-rst","patch_set":9,"id":"3a1ff146_a672a9e3","line":107,"in_reply_to":"3a1ff146_5cf9f3c7","updated":"2017-03-15 18:02:39.000000000","message":"Do you mean specifically call out DocumentedRuleDefault here in the nova spec?","commit_id":"f42ca2aa444fe77b4381f613349d4b58f0459ef9"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"e309f6ada6a62039d7bdf85550c02f6c0183f161","unresolved":false,"context_lines":[{"line_number":104,"context_line":"To something more like this::"},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"    policy.RuleDefault(SERVERS % \"show\", RULE_AOO,"},{"line_number":107,"context_line":"        description\u003d\"Show details of a specific server\","},{"line_number":108,"context_line":"        urls\u003d[{method\u003d\"GET\", path\u003d\"/servers/{server_id}\"}])"},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"It is too soon to see if this is a common pattern, so for now this will be"}],"source_content_type":"text/x-rst","patch_set":9,"id":"3a1ff146_6c9253a1","line":107,"in_reply_to":"3a1ff146_a672a9e3","updated":"2017-03-15 18:06:56.000000000","message":"yeah, I can update now, given where its going.","commit_id":"f42ca2aa444fe77b4381f613349d4b58f0459ef9"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"7ce0daf154afcba1d19a8293284a824416878e7e","unresolved":false,"context_lines":[{"line_number":119,"context_line":"We could try documentation separate to the code, but that has proven hard"},{"line_number":120,"context_line":"to maintain and keep in sync with the code."},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"We could extend oslo.policy to have specific parameters for things like the"},{"line_number":123,"context_line":"URL and the default access. It is better to experiment with the"},{"line_number":124,"context_line":"documentation to establish a good pattern before we hard code that format"},{"line_number":125,"context_line":"into the library."},{"line_number":126,"context_line":""},{"line_number":127,"context_line":"Data model impact"},{"line_number":128,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"3a1ff146_863bedea","line":125,"range":{"start_line":122,"start_character":0,"end_line":125,"end_character":17},"updated":"2017-03-15 18:02:39.000000000","message":"Sounds like this means \u0027no\u0027 to DocumentedRuleDefault at least to start, unless this spec was written before DocumentedRuleDefault was available?","commit_id":"f42ca2aa444fe77b4381f613349d4b58f0459ef9"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"e309f6ada6a62039d7bdf85550c02f6c0183f161","unresolved":false,"context_lines":[{"line_number":119,"context_line":"We could try documentation separate to the code, but that has proven hard"},{"line_number":120,"context_line":"to maintain and keep in sync with the code."},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"We could extend oslo.policy to have specific parameters for things like the"},{"line_number":123,"context_line":"URL and the default access. It is better to experiment with the"},{"line_number":124,"context_line":"documentation to establish a good pattern before we hard code that format"},{"line_number":125,"context_line":"into the library."},{"line_number":126,"context_line":""},{"line_number":127,"context_line":"Data model impact"},{"line_number":128,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"3a1ff146_0cf47ff0","line":125,"range":{"start_line":122,"start_character":0,"end_line":125,"end_character":17},"in_reply_to":"3a1ff146_863bedea","updated":"2017-03-15 18:06:56.000000000","message":"more the latter, let me update that.","commit_id":"f42ca2aa444fe77b4381f613349d4b58f0459ef9"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"7ce0daf154afcba1d19a8293284a824416878e7e","unresolved":false,"context_lines":[{"line_number":138,"context_line":"---------------"},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"A better understanding of what each rule means can only help operators and"},{"line_number":141,"context_line":"developer get the policy configuration correct."},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"Notifications impact"},{"line_number":144,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"3a1ff146_e622e1b8","line":141,"range":{"start_line":141,"start_character":0,"end_line":141,"end_character":9},"updated":"2017-03-15 18:02:39.000000000","message":"developers","commit_id":"f42ca2aa444fe77b4381f613349d4b58f0459ef9"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"7ce0daf154afcba1d19a8293284a824416878e7e","unresolved":false,"context_lines":[{"line_number":163,"context_line":"Developer impact"},{"line_number":164,"context_line":"----------------"},{"line_number":165,"context_line":""},{"line_number":166,"context_line":"We must add a description when adding a policy docs. These are all"},{"line_number":167,"context_line":"required arguments to the new method."},{"line_number":168,"context_line":""},{"line_number":169,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":9,"id":"3a1ff146_a6170950","line":166,"range":{"start_line":166,"start_character":38,"end_line":166,"end_character":51},"updated":"2017-03-15 18:02:39.000000000","message":"s/a policy docs/a policy rule/?","commit_id":"f42ca2aa444fe77b4381f613349d4b58f0459ef9"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"7ce0daf154afcba1d19a8293284a824416878e7e","unresolved":false,"context_lines":[{"line_number":192,"context_line":"Testing"},{"line_number":193,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":194,"context_line":""},{"line_number":195,"context_line":"None"},{"line_number":196,"context_line":""},{"line_number":197,"context_line":"Documentation Impact"},{"line_number":198,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":9,"id":"3a1ff146_2c0dbb37","line":195,"updated":"2017-03-15 18:02:39.000000000","message":"Could we have some kind of unit test that scans all of the registered policies and creates a whitelist of those that don\u0027t yet have the docs values, and then as you start going through this you remove entries from the whitelist so you can see the progress and what\u0027s left. I think versioned notifications has something similar. The risk with that is merge conflicts.","commit_id":"f42ca2aa444fe77b4381f613349d4b58f0459ef9"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"e309f6ada6a62039d7bdf85550c02f6c0183f161","unresolved":false,"context_lines":[{"line_number":192,"context_line":"Testing"},{"line_number":193,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":194,"context_line":""},{"line_number":195,"context_line":"None"},{"line_number":196,"context_line":""},{"line_number":197,"context_line":"Documentation Impact"},{"line_number":198,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":9,"id":"3a1ff146_8cbf8ffa","line":195,"in_reply_to":"3a1ff146_2c0dbb37","updated":"2017-03-15 18:06:56.000000000","message":"Hmm, maybe. All the files are in the same directory though, we can just check for RuleDefault not being used, I think. Could add a hacking check for that.","commit_id":"f42ca2aa444fe77b4381f613349d4b58f0459ef9"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3e9ce1d2f71c8693191238ef7ef061555ba6ee14","unresolved":false,"context_lines":[{"line_number":192,"context_line":"Testing"},{"line_number":193,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":194,"context_line":""},{"line_number":195,"context_line":"None"},{"line_number":196,"context_line":""},{"line_number":197,"context_line":"Documentation Impact"},{"line_number":198,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":9,"id":"3a1ff146_ccb6e7db","line":195,"in_reply_to":"3a1ff146_8cbf8ffa","updated":"2017-03-15 18:13:34.000000000","message":"Sure, I\u0027m just wondering how we can enforce that new policy rules are documented, i.e. L166.","commit_id":"f42ca2aa444fe77b4381f613349d4b58f0459ef9"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"add7948b924d196ccdc1292b905bc6af83faf558","unresolved":false,"context_lines":[{"line_number":192,"context_line":"Testing"},{"line_number":193,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":194,"context_line":""},{"line_number":195,"context_line":"None"},{"line_number":196,"context_line":""},{"line_number":197,"context_line":"Documentation Impact"},{"line_number":198,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":9,"id":"3a1ff146_2ff76df6","line":195,"in_reply_to":"3a1ff146_ccb6e7db","updated":"2017-03-15 18:30:04.000000000","message":"Ah, so a hacking check should be enough. added that in the new one.","commit_id":"f42ca2aa444fe77b4381f613349d4b58f0459ef9"}]}