)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"1aaf11f5294b0e1cf8fcc0d5b78c3248d1e07ddb","unresolved":false,"context_lines":[{"line_number":7,"context_line":"WIP: Adds nova-policy-check cmd"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Change-Id: If4abf0fca043de2cb5c719a53505526f3c0b871b"},{"line_number":10,"context_line":"Implements: blueprint get-policy-settings-cli"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"1aa78d24_f319b27a","line":10,"range":{"start_line":10,"start_character":22,"end_line":10,"end_character":45},"updated":"2016-07-05 18:21:34.000000000","message":"This should be \"discoverable-policy-cli\".","commit_id":"4b1fd923ad66bf98045663e76c09590bd81ca894"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"42b1c56aca94326a79ea183597a7bb902b8e9966","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Claudiu Belu \u003ccbelu@cloudbasesolutions.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2016-07-15 13:25:35 +0000"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"WIP: Adds nova-policy-check cmd"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Change-Id: If4abf0fca043de2cb5c719a53505526f3c0b871b"},{"line_number":10,"context_line":"Implements: blueprint discoverable-policy-cli"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":7,"id":"bacf61ea_bec5433e","line":7,"range":{"start_line":7,"start_character":0,"end_line":7,"end_character":4},"updated":"2016-08-17 05:06:57.000000000","message":"This patch still under WIP?","commit_id":"71f0b507e1fdf10332ee3fe769f8273122d1be85"}],"nova/cmd/policy_check.py":[{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"363698a9898ea4f4e576af452c22b9f73ba7bf8a","unresolved":false,"context_lines":[{"line_number":76,"context_line":"    \"\"\"Commands for policy rules.\"\"\""},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"    def check(self):"},{"line_number":79,"context_line":"        return \"foo:bar\""},{"line_number":80,"context_line":""},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"CATEGORIES \u003d {"}],"source_content_type":"text/x-python","patch_set":1,"id":"7aa08908_430d818f","line":79,"range":{"start_line":79,"start_character":20,"end_line":79,"end_character":23},"updated":"2016-06-06 19:41:28.000000000","message":"still WIP, right?","commit_id":"e88ddc5aa627fe86c231befb52caf4b12e160038"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"7e531dd0cf98480db3ee0d113047b8e885c07bee","unresolved":false,"context_lines":[{"line_number":76,"context_line":"    \"\"\"Commands for policy rules.\"\"\""},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"    def check(self):"},{"line_number":79,"context_line":"        return \"foo:bar\""},{"line_number":80,"context_line":""},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"CATEGORIES \u003d {"}],"source_content_type":"text/x-python","patch_set":1,"id":"7aa08908_81ebbaaf","line":79,"range":{"start_line":79,"start_character":20,"end_line":79,"end_character":23},"in_reply_to":"7aa08908_430d818f","updated":"2016-06-07 12:23:48.000000000","message":"Yep.","commit_id":"e88ddc5aa627fe86c231befb52caf4b12e160038"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"a74a753ea24a8b62f1f1c375a86df4dfe95d001f","unresolved":false,"context_lines":[{"line_number":84,"context_line":"                     help\u003d\u0027Policy rules for the given target.\u0027)"},{"line_number":85,"context_line":"    def check(self, api_name\u003dNone, target\u003dNone):"},{"line_number":86,"context_line":"        import pdb"},{"line_number":87,"context_line":"        pdb.set_trace()"},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"        # NOTE(claudiub): the policy_load file will be loaded from the loaded"},{"line_number":90,"context_line":"        # CONF file."}],"source_content_type":"text/x-python","patch_set":2,"id":"7aa08908_c8f3f771","line":87,"range":{"start_line":87,"start_character":12,"end_line":87,"end_character":21},"updated":"2016-06-13 15:30:11.000000000","message":":)","commit_id":"a7ea117ec30439da3c549c60df50c1993dc5886d"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"1ae535798416ca38e1c285cb91b130537c34d8eb","unresolved":false,"context_lines":[{"line_number":84,"context_line":"                     help\u003d\u0027Policy rules for the given target.\u0027)"},{"line_number":85,"context_line":"    def check(self, api_name\u003dNone, target\u003dNone):"},{"line_number":86,"context_line":"        import pdb"},{"line_number":87,"context_line":"        pdb.set_trace()"},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"        # NOTE(claudiub): the policy_load file will be loaded from the loaded"},{"line_number":90,"context_line":"        # CONF file."}],"source_content_type":"text/x-python","patch_set":2,"id":"7aa08908_aebf88ce","line":87,"range":{"start_line":87,"start_character":12,"end_line":87,"end_character":21},"in_reply_to":"7aa08908_c8f3f771","updated":"2016-06-13 20:10:09.000000000","message":"oups. :)","commit_id":"a7ea117ec30439da3c549c60df50c1993dc5886d"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"873c66958f71e41a6701406f36d9c019f3670663","unresolved":false,"context_lines":[{"line_number":41,"context_line":""},{"line_number":42,"context_line":"cli_opts \u003d ["},{"line_number":43,"context_line":"    cfg.StrOpt("},{"line_number":44,"context_line":"        \u0027os-username\u0027,"},{"line_number":45,"context_line":"        metavar\u003d\u0027\u003cauth-username\u003e\u0027,"},{"line_number":46,"context_line":"        default\u003dos.environ.get(\u0027OS_USERNAME\u0027),"},{"line_number":47,"context_line":"        help\u003d_(\u0027Defaults to env[OS_USERNAME].\u0027)),"}],"source_content_type":"text/x-python","patch_set":7,"id":"3ac371cc_0aeeb4b3","line":44,"range":{"start_line":44,"start_character":8,"end_line":44,"end_character":22},"updated":"2016-08-17 07:13:34.000000000","message":"Due to we didn\u0027t validate with keystone and we haven\u0027t user_name in target, os-username is useless.","commit_id":"71f0b507e1fdf10332ee3fe769f8273122d1be85"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"7fcc88f0ddec9b0569396bf977b92d488c9c5285","unresolved":false,"context_lines":[{"line_number":68,"context_line":""},{"line_number":69,"context_line":"    _ACCEPTABLE_TARGETS \u003d ["},{"line_number":70,"context_line":"        \u0027project_id\u0027, \u0027user_id\u0027, \u0027quota_class\u0027, \u0027availability_zone\u0027,"},{"line_number":71,"context_line":"        \u0027instance_id\u0027, \u0027instance_name\u0027]"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"    @cmd_common.args(\u0027--api-name\u0027, dest\u003d\u0027api_name\u0027, metavar\u003d\u0027\u003cAPI name\u003e\u0027,"},{"line_number":74,"context_line":"                     help\u003d\u0027Will return only passing policy rules containing \u0027"}],"source_content_type":"text/x-python","patch_set":7,"id":"bacf61ea_1873c616","line":71,"updated":"2016-08-04 07:40:01.000000000","message":"The target also can be \u0027keypair\u0027, \u0027aggregate, \u0027host\u0027....all the top-level resource in the API","commit_id":"71f0b507e1fdf10332ee3fe769f8273122d1be85"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"e224ccd6ec9c1eaac0b3c081b58b88d474a49453","unresolved":false,"context_lines":[{"line_number":68,"context_line":""},{"line_number":69,"context_line":"    _ACCEPTABLE_TARGETS \u003d ["},{"line_number":70,"context_line":"        \u0027project_id\u0027, \u0027user_id\u0027, \u0027quota_class\u0027, \u0027availability_zone\u0027,"},{"line_number":71,"context_line":"        \u0027instance_id\u0027, \u0027instance_name\u0027]"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"    @cmd_common.args(\u0027--api-name\u0027, dest\u003d\u0027api_name\u0027, metavar\u003d\u0027\u003cAPI name\u003e\u0027,"},{"line_number":74,"context_line":"                     help\u003d\u0027Will return only passing policy rules containing \u0027"}],"source_content_type":"text/x-python","patch_set":7,"id":"9ad45d7e_c1ae2f97","line":71,"in_reply_to":"9ad45d7e_5697b5eb","updated":"2016-08-10 18:05:22.000000000","message":"I think this is fine for first pass","commit_id":"71f0b507e1fdf10332ee3fe769f8273122d1be85"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"7d4dc1363d178134f375ce83b97dee4283fcb1ac","unresolved":false,"context_lines":[{"line_number":68,"context_line":""},{"line_number":69,"context_line":"    _ACCEPTABLE_TARGETS \u003d ["},{"line_number":70,"context_line":"        \u0027project_id\u0027, \u0027user_id\u0027, \u0027quota_class\u0027, \u0027availability_zone\u0027,"},{"line_number":71,"context_line":"        \u0027instance_id\u0027, \u0027instance_name\u0027]"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"    @cmd_common.args(\u0027--api-name\u0027, dest\u003d\u0027api_name\u0027, metavar\u003d\u0027\u003cAPI name\u003e\u0027,"},{"line_number":74,"context_line":"                     help\u003d\u0027Will return only passing policy rules containing \u0027"}],"source_content_type":"text/x-python","patch_set":7,"id":"9ad45d7e_5697b5eb","line":71,"in_reply_to":"9ad45d7e_a858c557","updated":"2016-08-10 12:50:51.000000000","message":"so, this command emulates what is already being done in nova-api (only those specific target fields are used in nova-api, nothing else - most of the time target is a dict containing project_id and user_id, the only difference is the instance). So, in this sense, jichenjc is right, when checking policy against a keypair, it will check against its user_id / project_id.\n\nwe can, though, add keypairs and other resources here, in order to improve UX. For example: It would be much easier for a user to just pass a --keypair-name\u003dfoo, rather than get its user_id, project_id manually and pass them as --project_id\u003dproject_id --user_id\u003duser_id.","commit_id":"71f0b507e1fdf10332ee3fe769f8273122d1be85"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"42b1c56aca94326a79ea183597a7bb902b8e9966","unresolved":false,"context_lines":[{"line_number":68,"context_line":""},{"line_number":69,"context_line":"    _ACCEPTABLE_TARGETS \u003d ["},{"line_number":70,"context_line":"        \u0027project_id\u0027, \u0027user_id\u0027, \u0027quota_class\u0027, \u0027availability_zone\u0027,"},{"line_number":71,"context_line":"        \u0027instance_id\u0027, \u0027instance_name\u0027]"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"    @cmd_common.args(\u0027--api-name\u0027, dest\u003d\u0027api_name\u0027, metavar\u003d\u0027\u003cAPI name\u003e\u0027,"},{"line_number":74,"context_line":"                     help\u003d\u0027Will return only passing policy rules containing \u0027"}],"source_content_type":"text/x-python","patch_set":7,"id":"3ac371cc_3e1936d8","line":71,"in_reply_to":"9ad45d7e_c1ae2f97","updated":"2016-08-17 05:06:57.000000000","message":"ok, let\u0027s go with this version.","commit_id":"71f0b507e1fdf10332ee3fe769f8273122d1be85"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"05320312e57c1795d05113d5a2fbbe463ff72ae9","unresolved":false,"context_lines":[{"line_number":68,"context_line":""},{"line_number":69,"context_line":"    _ACCEPTABLE_TARGETS \u003d ["},{"line_number":70,"context_line":"        \u0027project_id\u0027, \u0027user_id\u0027, \u0027quota_class\u0027, \u0027availability_zone\u0027,"},{"line_number":71,"context_line":"        \u0027instance_id\u0027, \u0027instance_name\u0027]"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"    @cmd_common.args(\u0027--api-name\u0027, dest\u003d\u0027api_name\u0027, metavar\u003d\u0027\u003cAPI name\u003e\u0027,"},{"line_number":74,"context_line":"                     help\u003d\u0027Will return only passing policy rules containing \u0027"}],"source_content_type":"text/x-python","patch_set":7,"id":"9ad45d7e_a858c557","line":71,"in_reply_to":"bacf61ea_1873c616","updated":"2016-08-08 15:03:29.000000000","message":"guess user_id and project_id is what we used ?even if it\u0027s a keypair, we will construct user_id + project_id to check policy?","commit_id":"71f0b507e1fdf10332ee3fe769f8273122d1be85"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"6903867e0260e9df6e2bfbe17c8d77ad0e441925","unresolved":false,"context_lines":[{"line_number":73,"context_line":"    @cmd_common.args(\u0027--api-name\u0027, dest\u003d\u0027api_name\u0027, metavar\u003d\u0027\u003cAPI name\u003e\u0027,"},{"line_number":74,"context_line":"                     help\u003d\u0027Will return only passing policy rules containing \u0027"},{"line_number":75,"context_line":"                          \u0027the given API name.\u0027)"},{"line_number":76,"context_line":"    @cmd_common.args(\u0027--target\u0027, dest\u003d\u0027target\u0027, metavar\u003d\u0027\u003cTarget\u003e\u0027,"},{"line_number":77,"context_line":"                     help\u003d\u0027Will return only passing policy rules for the \u0027"},{"line_number":78,"context_line":"                          \u0027given target.\u0027)"},{"line_number":79,"context_line":"    def check(self, api_name\u003dNone, target\u003dNone):"},{"line_number":80,"context_line":"        \"\"\"Prints all passing policy rules for the given user."},{"line_number":81,"context_line":""}],"source_content_type":"text/x-python","patch_set":7,"id":"3ac371cc_f4d69def","line":78,"range":{"start_line":76,"start_character":4,"end_line":78,"end_character":42},"updated":"2016-08-17 07:08:09.000000000","message":"When I try this cmd: ./bin/nova-policy policy check --api-name \u0027os_compute_api:servers:show\u0027 --target\u003d\"project_id\u003dxyz\" --target\u003d\"user_id\u003ddef\"\n\nI always get error: \u0027error: need more than 1 value to unpack\u0027. \n\nI think we should add args like this:\n\n@cmd_common.args(\u0027--target\u0027, nargs\u003d\u0027+\u0027, dest\u003dtarget, metaavar\u003d\u0027\u003cTarget\u003e\u0027, help\u003d\u0027....\u0027)","commit_id":"71f0b507e1fdf10332ee3fe769f8273122d1be85"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"b9b94f8f25d7aabe97b36123eba1b113710d4657","unresolved":false,"context_lines":[{"line_number":73,"context_line":"    @cmd_common.args(\u0027--api-name\u0027, dest\u003d\u0027api_name\u0027, metavar\u003d\u0027\u003cAPI name\u003e\u0027,"},{"line_number":74,"context_line":"                     help\u003d\u0027Will return only passing policy rules containing \u0027"},{"line_number":75,"context_line":"                          \u0027the given API name.\u0027)"},{"line_number":76,"context_line":"    @cmd_common.args(\u0027--target\u0027, dest\u003d\u0027target\u0027, metavar\u003d\u0027\u003cTarget\u003e\u0027,"},{"line_number":77,"context_line":"                     help\u003d\u0027Will return only passing policy rules for the \u0027"},{"line_number":78,"context_line":"                          \u0027given target.\u0027)"},{"line_number":79,"context_line":"    def check(self, api_name\u003dNone, target\u003dNone):"},{"line_number":80,"context_line":"        \"\"\"Prints all passing policy rules for the given user."},{"line_number":81,"context_line":""}],"source_content_type":"text/x-python","patch_set":7,"id":"3ac371cc_2d39f1f2","line":78,"range":{"start_line":76,"start_character":4,"end_line":78,"end_character":42},"in_reply_to":"3ac371cc_f4d69def","updated":"2016-08-17 14:48:58.000000000","message":"yeah, that\u0027s a good point","commit_id":"71f0b507e1fdf10332ee3fe769f8273122d1be85"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"6903867e0260e9df6e2bfbe17c8d77ad0e441925","unresolved":false,"context_lines":[{"line_number":97,"context_line":"        allowed_operations \u003d self._filter_rules(context, api_name, target)"},{"line_number":98,"context_line":"        print(\u0027\\n\u0027.join(allowed_operations))"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"    def _get_context(self):"},{"line_number":101,"context_line":"        return nova_context.RequestContext("},{"line_number":102,"context_line":"            user\u003dCONF.os_username,"},{"line_number":103,"context_line":"            user_id\u003dCONF.os_user_id,"},{"line_number":104,"context_line":"            tenant\u003dCONF.os_tenant_name,"},{"line_number":105,"context_line":"            project_id\u003dCONF.os_tenant_id)"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"    def _get_target(self, context, target):"},{"line_number":108,"context_line":"        \"\"\"Processes and validates the CLI given target and adapts it for"}],"source_content_type":"text/x-python","patch_set":7,"id":"3ac371cc_aa24c05f","line":105,"range":{"start_line":100,"start_character":4,"end_line":105,"end_character":41},"updated":"2016-08-17 07:08:09.000000000","message":"emm...this doesn\u0027t work for the admin user. We didn\u0027t validate with keystone, then we don\u0027t the roles of user.","commit_id":"71f0b507e1fdf10332ee3fe769f8273122d1be85"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"b9b94f8f25d7aabe97b36123eba1b113710d4657","unresolved":false,"context_lines":[{"line_number":97,"context_line":"        allowed_operations \u003d self._filter_rules(context, api_name, target)"},{"line_number":98,"context_line":"        print(\u0027\\n\u0027.join(allowed_operations))"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"    def _get_context(self):"},{"line_number":101,"context_line":"        return nova_context.RequestContext("},{"line_number":102,"context_line":"            user\u003dCONF.os_username,"},{"line_number":103,"context_line":"            user_id\u003dCONF.os_user_id,"},{"line_number":104,"context_line":"            tenant\u003dCONF.os_tenant_name,"},{"line_number":105,"context_line":"            project_id\u003dCONF.os_tenant_id)"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"    def _get_target(self, context, target):"},{"line_number":108,"context_line":"        \"\"\"Processes and validates the CLI given target and adapts it for"}],"source_content_type":"text/x-python","patch_set":7,"id":"3ac371cc_5fa85077","line":105,"range":{"start_line":100,"start_character":4,"end_line":105,"end_character":41},"in_reply_to":"3ac371cc_aa24c05f","updated":"2016-08-17 14:48:58.000000000","message":"guess keystone is token based and we have to have valiate to keystone otherwise we might encounter not authorized issue?","commit_id":"71f0b507e1fdf10332ee3fe769f8273122d1be85"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"2127db0a3bbd0ec800ae5277116e5f16a0106444","unresolved":false,"context_lines":[{"line_number":151,"context_line":"            # filter out the rules that do not contain the given api_name"},{"line_number":152,"context_line":"            # any string contains \u0027\u0027."},{"line_number":153,"context_line":"            if api_name in rule.name:"},{"line_number":154,"context_line":"                if context.can(rule.name, target, fatal\u003dFalse):"},{"line_number":155,"context_line":"                    allowed_operations.append(rule.name)"},{"line_number":156,"context_line":""},{"line_number":157,"context_line":"        return allowed_operations"}],"source_content_type":"text/x-python","patch_set":7,"id":"bacf61ea_5eb6c7dc","line":154,"updated":"2016-08-04 07:43:19.000000000","message":"Looks like I can use keypair target for instance related rule. But looks like we have no way to resolve this problem. And sounds ok, this is just experimental cli.","commit_id":"71f0b507e1fdf10332ee3fe769f8273122d1be85"},{"author":{"_account_id":1063,"name":"Ed Leafe","email":"ed@leafe.com","username":"ed-leafe"},"change_message_id":"2d81e7b179c103ad46762dd445b02edcb25680ef","unresolved":false,"context_lines":[{"line_number":39,"context_line":"CONF \u003d nova.conf.CONF"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"cli_opts \u003d ["},{"line_number":43,"context_line":"    cfg.ListOpt("},{"line_number":44,"context_line":"        \u0027os-roles\u0027,"},{"line_number":45,"context_line":"        metavar\u003d\u0027\u003cauth-roles\u003e\u0027,"},{"line_number":46,"context_line":"        default\u003dos.environ.get(\u0027OS_ROLES\u0027),"},{"line_number":47,"context_line":"        help\u003d_(\u0027Defaults to env[OS_ROLES].\u0027)),"},{"line_number":48,"context_line":"    cfg.StrOpt("},{"line_number":49,"context_line":"        \u0027os-user-id\u0027,"},{"line_number":50,"context_line":"        metavar\u003d\u0027\u003cauth-user-id\u003e\u0027,"},{"line_number":51,"context_line":"        default\u003dos.environ.get(\u0027OS_USER_ID\u0027),"},{"line_number":52,"context_line":"        help\u003d_(\u0027Defaults to env[OS_USER_ID].\u0027)),"},{"line_number":53,"context_line":"    cfg.StrOpt("},{"line_number":54,"context_line":"        \u0027os-tenant-id\u0027,"},{"line_number":55,"context_line":"        metavar\u003d\u0027\u003cauth-tenant-id\u003e\u0027,"},{"line_number":56,"context_line":"        default\u003dos.environ.get(\u0027OS_TENANT_ID\u0027),"},{"line_number":57,"context_line":"        help\u003d_(\u0027Defaults to env[OS_TENANT_ID].\u0027)),"},{"line_number":58,"context_line":"]"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"class PolicyCommands(object):"}],"source_content_type":"text/x-python","patch_set":10,"id":"1ac06dbe_982e01f9","line":58,"range":{"start_line":42,"start_character":0,"end_line":58,"end_character":1},"updated":"2016-08-24 13:39:30.000000000","message":"These should be added in nova/conf/cmd.py. They should also follow the standards in https://wiki.openstack.org/wiki/ConfigOptionsConsistency","commit_id":"d0ebc78390b27d1974c092d39f43360d4f12f789"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"ca6fabdd9838eb4e719d6b961fe7c803197e069b","unresolved":false,"context_lines":[{"line_number":39,"context_line":"CONF \u003d nova.conf.CONF"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"cli_opts \u003d ["},{"line_number":43,"context_line":"    cfg.ListOpt("},{"line_number":44,"context_line":"        \u0027os-roles\u0027,"},{"line_number":45,"context_line":"        metavar\u003d\u0027\u003cauth-roles\u003e\u0027,"},{"line_number":46,"context_line":"        default\u003dos.environ.get(\u0027OS_ROLES\u0027),"},{"line_number":47,"context_line":"        help\u003d_(\u0027Defaults to env[OS_ROLES].\u0027)),"},{"line_number":48,"context_line":"    cfg.StrOpt("},{"line_number":49,"context_line":"        \u0027os-user-id\u0027,"},{"line_number":50,"context_line":"        metavar\u003d\u0027\u003cauth-user-id\u003e\u0027,"},{"line_number":51,"context_line":"        default\u003dos.environ.get(\u0027OS_USER_ID\u0027),"},{"line_number":52,"context_line":"        help\u003d_(\u0027Defaults to env[OS_USER_ID].\u0027)),"},{"line_number":53,"context_line":"    cfg.StrOpt("},{"line_number":54,"context_line":"        \u0027os-tenant-id\u0027,"},{"line_number":55,"context_line":"        metavar\u003d\u0027\u003cauth-tenant-id\u003e\u0027,"},{"line_number":56,"context_line":"        default\u003dos.environ.get(\u0027OS_TENANT_ID\u0027),"},{"line_number":57,"context_line":"        help\u003d_(\u0027Defaults to env[OS_TENANT_ID].\u0027)),"},{"line_number":58,"context_line":"]"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"class PolicyCommands(object):"}],"source_content_type":"text/x-python","patch_set":10,"id":"fa7ab95a_a54e52bf","line":58,"range":{"start_line":42,"start_character":0,"end_line":58,"end_character":1},"in_reply_to":"1ac06dbe_83492cd3","updated":"2016-08-26 07:56:46.000000000","message":"probably same reply as John\u0027s comment at line 163","commit_id":"d0ebc78390b27d1974c092d39f43360d4f12f789"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"185922faa61bbc6dd685d74690eee8a81b4523ae","unresolved":false,"context_lines":[{"line_number":39,"context_line":"CONF \u003d nova.conf.CONF"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"cli_opts \u003d ["},{"line_number":43,"context_line":"    cfg.ListOpt("},{"line_number":44,"context_line":"        \u0027os-roles\u0027,"},{"line_number":45,"context_line":"        metavar\u003d\u0027\u003cauth-roles\u003e\u0027,"},{"line_number":46,"context_line":"        default\u003dos.environ.get(\u0027OS_ROLES\u0027),"},{"line_number":47,"context_line":"        help\u003d_(\u0027Defaults to env[OS_ROLES].\u0027)),"},{"line_number":48,"context_line":"    cfg.StrOpt("},{"line_number":49,"context_line":"        \u0027os-user-id\u0027,"},{"line_number":50,"context_line":"        metavar\u003d\u0027\u003cauth-user-id\u003e\u0027,"},{"line_number":51,"context_line":"        default\u003dos.environ.get(\u0027OS_USER_ID\u0027),"},{"line_number":52,"context_line":"        help\u003d_(\u0027Defaults to env[OS_USER_ID].\u0027)),"},{"line_number":53,"context_line":"    cfg.StrOpt("},{"line_number":54,"context_line":"        \u0027os-tenant-id\u0027,"},{"line_number":55,"context_line":"        metavar\u003d\u0027\u003cauth-tenant-id\u003e\u0027,"},{"line_number":56,"context_line":"        default\u003dos.environ.get(\u0027OS_TENANT_ID\u0027),"},{"line_number":57,"context_line":"        help\u003d_(\u0027Defaults to env[OS_TENANT_ID].\u0027)),"},{"line_number":58,"context_line":"]"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"class PolicyCommands(object):"}],"source_content_type":"text/x-python","patch_set":10,"id":"1ac06dbe_83492cd3","line":58,"range":{"start_line":42,"start_character":0,"end_line":58,"end_character":1},"in_reply_to":"1ac06dbe_982e01f9","updated":"2016-08-25 12:06:28.000000000","message":"maybe a better name is policy_check.py ...\n\n\nand it\u0027s used in CLI, why should we add as it\u0027s not configuable","commit_id":"d0ebc78390b27d1974c092d39f43360d4f12f789"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"d70ded4404bd219f0f5b311948c5461790e6499c","unresolved":false,"context_lines":[{"line_number":83,"context_line":"        \"\"\""},{"line_number":84,"context_line":"        # NOTE(claudiub): the policy_load file will be loaded from the loaded"},{"line_number":85,"context_line":"        # CONF file."},{"line_number":86,"context_line":"        policy.init()"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"        context \u003d self._get_context()"},{"line_number":89,"context_line":"        api_name \u003d api_name or \u0027\u0027"}],"source_content_type":"text/x-python","patch_set":10,"id":"1ac06dbe_fd81e7c4","line":86,"range":{"start_line":86,"start_character":8,"end_line":86,"end_character":21},"updated":"2016-08-24 13:21:54.000000000","message":"So this doesn\u0027t actually reload the file.\n\nIt is implicitly called by every policy call, so we don\u0027t need that here.","commit_id":"d0ebc78390b27d1974c092d39f43360d4f12f789"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"ca6fabdd9838eb4e719d6b961fe7c803197e069b","unresolved":false,"context_lines":[{"line_number":83,"context_line":"        \"\"\""},{"line_number":84,"context_line":"        # NOTE(claudiub): the policy_load file will be loaded from the loaded"},{"line_number":85,"context_line":"        # CONF file."},{"line_number":86,"context_line":"        policy.init()"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"        context \u003d self._get_context()"},{"line_number":89,"context_line":"        api_name \u003d api_name or \u0027\u0027"}],"source_content_type":"text/x-python","patch_set":10,"id":"fa7ab95a_459e6657","line":86,"range":{"start_line":86,"start_character":8,"end_line":86,"end_character":21},"in_reply_to":"1ac06dbe_fd81e7c4","updated":"2016-08-26 07:56:46.000000000","message":"yea, will remove it","commit_id":"d0ebc78390b27d1974c092d39f43360d4f12f789"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"c708c3c3fe52a4273665140c0a40e9c005ad437f","unresolved":false,"context_lines":[{"line_number":110,"context_line":"            there is no instance match the id."},{"line_number":111,"context_line":"        \"\"\""},{"line_number":112,"context_line":"        if not target:"},{"line_number":113,"context_line":"            return None"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"        new_target \u003d {}"},{"line_number":116,"context_line":"        for t in target:"}],"source_content_type":"text/x-python","patch_set":10,"id":"1ac06dbe_781ce56a","line":113,"updated":"2016-08-25 14:19:28.000000000","message":"Should we not default to the same the policy engine defaults to:\n\n{\u0027user_id\u0027: context[\u0027user_id\u0027],\n  \u0027project_id\u0027: context[\u0027project_id\u0027]}","commit_id":"d0ebc78390b27d1974c092d39f43360d4f12f789"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"ca6fabdd9838eb4e719d6b961fe7c803197e069b","unresolved":false,"context_lines":[{"line_number":110,"context_line":"            there is no instance match the id."},{"line_number":111,"context_line":"        \"\"\""},{"line_number":112,"context_line":"        if not target:"},{"line_number":113,"context_line":"            return None"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"        new_target \u003d {}"},{"line_number":116,"context_line":"        for t in target:"}],"source_content_type":"text/x-python","patch_set":10,"id":"fa7ab95a_e5b5bad0","line":113,"in_reply_to":"1ac06dbe_781ce56a","updated":"2016-08-26 07:56:46.000000000","message":"at line 139, we always pass the instance obj into the target. So it\u0027s fine at here.","commit_id":"d0ebc78390b27d1974c092d39f43360d4f12f789"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"185922faa61bbc6dd685d74690eee8a81b4523ae","unresolved":false,"context_lines":[{"line_number":137,"context_line":"            # any string contains \u0027\u0027."},{"line_number":138,"context_line":"            if api_name in rule.name:"},{"line_number":139,"context_line":"                if context.can(rule.name, target, fatal\u003dFalse):"},{"line_number":140,"context_line":"                    allowed_operations.append(rule.name)"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"        return allowed_operations"},{"line_number":143,"context_line":""}],"source_content_type":"text/x-python","patch_set":10,"id":"1ac06dbe_c32b2432","line":140,"updated":"2016-08-25 12:06:28.000000000","message":"should we check if api_name not in the rules and print some error?\n\njichen@refstack:/opt/stack/nova$ nova-policy --os-tenant-id f0e06104ed6c41669aa8b41448b606da policy check os_compute_api:servr\n\njichen@refstack:/opt/stack/nova$","commit_id":"d0ebc78390b27d1974c092d39f43360d4f12f789"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"ca6fabdd9838eb4e719d6b961fe7c803197e069b","unresolved":false,"context_lines":[{"line_number":137,"context_line":"            # any string contains \u0027\u0027."},{"line_number":138,"context_line":"            if api_name in rule.name:"},{"line_number":139,"context_line":"                if context.can(rule.name, target, fatal\u003dFalse):"},{"line_number":140,"context_line":"                    allowed_operations.append(rule.name)"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"        return allowed_operations"},{"line_number":143,"context_line":""}],"source_content_type":"text/x-python","patch_set":10,"id":"fa7ab95a_c5d8b620","line":140,"in_reply_to":"1ac06dbe_c32b2432","updated":"2016-08-26 07:56:46.000000000","message":"yea, sounds better for user.","commit_id":"d0ebc78390b27d1974c092d39f43360d4f12f789"},{"author":{"_account_id":1063,"name":"Ed Leafe","email":"ed@leafe.com","username":"ed-leafe"},"change_message_id":"2d81e7b179c103ad46762dd445b02edcb25680ef","unresolved":false,"context_lines":[{"line_number":130,"context_line":"        return new_target"},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"    def _filter_rules(self, context, api_name, target):"},{"line_number":133,"context_line":"        all_rules \u003d policies.list_rules()"},{"line_number":134,"context_line":"        allowed_operations \u003d []"},{"line_number":135,"context_line":"        for rule in all_rules:"},{"line_number":136,"context_line":"            # filter out the rules that do not contain the given api_name"},{"line_number":137,"context_line":"            # any string contains \u0027\u0027."},{"line_number":138,"context_line":"            if api_name in rule.name:"},{"line_number":139,"context_line":"                if context.can(rule.name, target, fatal\u003dFalse):"},{"line_number":140,"context_line":"                    allowed_operations.append(rule.name)"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"        return allowed_operations"},{"line_number":143,"context_line":""},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"CATEGORIES \u003d {"}],"source_content_type":"text/x-python","patch_set":10,"id":"1ac06dbe_f8b29505","line":142,"range":{"start_line":133,"start_character":0,"end_line":142,"end_character":33},"updated":"2016-08-24 13:39:30.000000000","message":"This can be simplified (and made faster) as follows:\n\nreturn [rule.name for rule in policies.list_rules()\n        if api_name in rule.name\n        and context.can(rule.name, target, fatal\u003dFalse)]","commit_id":"d0ebc78390b27d1974c092d39f43360d4f12f789"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"ca6fabdd9838eb4e719d6b961fe7c803197e069b","unresolved":false,"context_lines":[{"line_number":130,"context_line":"        return new_target"},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"    def _filter_rules(self, context, api_name, target):"},{"line_number":133,"context_line":"        all_rules \u003d policies.list_rules()"},{"line_number":134,"context_line":"        allowed_operations \u003d []"},{"line_number":135,"context_line":"        for rule in all_rules:"},{"line_number":136,"context_line":"            # filter out the rules that do not contain the given api_name"},{"line_number":137,"context_line":"            # any string contains \u0027\u0027."},{"line_number":138,"context_line":"            if api_name in rule.name:"},{"line_number":139,"context_line":"                if context.can(rule.name, target, fatal\u003dFalse):"},{"line_number":140,"context_line":"                    allowed_operations.append(rule.name)"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"        return allowed_operations"},{"line_number":143,"context_line":""},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"CATEGORIES \u003d {"}],"source_content_type":"text/x-python","patch_set":10,"id":"fa7ab95a_455f4672","line":142,"range":{"start_line":133,"start_character":0,"end_line":142,"end_character":33},"in_reply_to":"1ac06dbe_f8b29505","updated":"2016-08-26 07:56:46.000000000","message":"yea, that sounds better","commit_id":"d0ebc78390b27d1974c092d39f43360d4f12f789"},{"author":{"_account_id":1063,"name":"Ed Leafe","email":"ed@leafe.com","username":"ed-leafe"},"change_message_id":"2d81e7b179c103ad46762dd445b02edcb25680ef","unresolved":false,"context_lines":[{"line_number":159,"context_line":""},{"line_number":160,"context_line":"def main():"},{"line_number":161,"context_line":"    \"\"\"Parse options and call the appropriate class/method.\"\"\""},{"line_number":162,"context_line":"    CONF.register_cli_opts(cli_opts)"},{"line_number":163,"context_line":"    CONF.register_cli_opt(category_opt)"},{"line_number":164,"context_line":"    config.parse_args(sys.argv)"},{"line_number":165,"context_line":""},{"line_number":166,"context_line":"    if CONF.category.name \u003d\u003d \"version\":"}],"source_content_type":"text/x-python","patch_set":10,"id":"1ac06dbe_d847d975","line":163,"range":{"start_line":162,"start_character":0,"end_line":163,"end_character":39},"updated":"2016-08-24 13:39:30.000000000","message":"These also belong in nova/conf/cmd.py","commit_id":"d0ebc78390b27d1974c092d39f43360d4f12f789"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"c708c3c3fe52a4273665140c0a40e9c005ad437f","unresolved":false,"context_lines":[{"line_number":159,"context_line":""},{"line_number":160,"context_line":"def main():"},{"line_number":161,"context_line":"    \"\"\"Parse options and call the appropriate class/method.\"\"\""},{"line_number":162,"context_line":"    CONF.register_cli_opts(cli_opts)"},{"line_number":163,"context_line":"    CONF.register_cli_opt(category_opt)"},{"line_number":164,"context_line":"    config.parse_args(sys.argv)"},{"line_number":165,"context_line":""},{"line_number":166,"context_line":"    if CONF.category.name \u003d\u003d \"version\":"}],"source_content_type":"text/x-python","patch_set":10,"id":"1ac06dbe_babefe61","line":163,"range":{"start_line":162,"start_character":0,"end_line":163,"end_character":39},"in_reply_to":"1ac06dbe_d847d975","updated":"2016-08-25 14:19:28.000000000","message":"I am -1 that, as we don\u0027t want this bleeding into the config docs, it makes no sense there. But I could be missing something.","commit_id":"d0ebc78390b27d1974c092d39f43360d4f12f789"},{"author":{"_account_id":1063,"name":"Ed Leafe","email":"ed@leafe.com","username":"ed-leafe"},"change_message_id":"2d81e7b179c103ad46762dd445b02edcb25680ef","unresolved":false,"context_lines":[{"line_number":165,"context_line":""},{"line_number":166,"context_line":"    if CONF.category.name \u003d\u003d \"version\":"},{"line_number":167,"context_line":"        print(version.version_string_with_package())"},{"line_number":168,"context_line":"        return(0)"},{"line_number":169,"context_line":""},{"line_number":170,"context_line":"    if CONF.category.name \u003d\u003d \"bash-completion\":"},{"line_number":171,"context_line":"        cmd_common.print_bash_completion(CATEGORIES)"}],"source_content_type":"text/x-python","patch_set":10,"id":"1ac06dbe_2cab52d8","line":168,"range":{"start_line":168,"start_character":8,"end_line":168,"end_character":17},"updated":"2016-08-24 13:39:30.000000000","message":"There is no need to write this as a function. Just make it ( and the others below):\n\n    return 0","commit_id":"d0ebc78390b27d1974c092d39f43360d4f12f789"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"ca6fabdd9838eb4e719d6b961fe7c803197e069b","unresolved":false,"context_lines":[{"line_number":165,"context_line":""},{"line_number":166,"context_line":"    if CONF.category.name \u003d\u003d \"version\":"},{"line_number":167,"context_line":"        print(version.version_string_with_package())"},{"line_number":168,"context_line":"        return(0)"},{"line_number":169,"context_line":""},{"line_number":170,"context_line":"    if CONF.category.name \u003d\u003d \"bash-completion\":"},{"line_number":171,"context_line":"        cmd_common.print_bash_completion(CATEGORIES)"}],"source_content_type":"text/x-python","patch_set":10,"id":"fa7ab95a_a5e7323f","line":168,"range":{"start_line":168,"start_character":8,"end_line":168,"end_character":17},"in_reply_to":"1ac06dbe_2cab52d8","updated":"2016-08-26 07:56:46.000000000","message":"Done","commit_id":"d0ebc78390b27d1974c092d39f43360d4f12f789"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"43d1b8b4c725ff761c245332b04ce2c0ad475613","unresolved":false,"context_lines":[{"line_number":68,"context_line":"    @cmd_common.args(\u0027--api-name\u0027, dest\u003d\u0027api_name\u0027, metavar\u003d\u0027\u003cAPI name\u003e\u0027,"},{"line_number":69,"context_line":"                     help\u003d\u0027Will return only passing policy rules containing \u0027"},{"line_number":70,"context_line":"                          \u0027the given API name.\u0027)"},{"line_number":71,"context_line":"    @cmd_common.args(\u0027--target\u0027, nargs\u003d\u0027+\u0027, dest\u003d\u0027target\u0027, metavar\u003d\u0027\u003cTarget\u003e\u0027,"},{"line_number":72,"context_line":"                     help\u003d\u0027Will return only passing policy rules for the \u0027"},{"line_number":73,"context_line":"                          \u0027given target.\u0027)"},{"line_number":74,"context_line":"    def check(self, api_name\u003dNone, target\u003dNone):"}],"source_content_type":"text/x-python","patch_set":11,"id":"fa7ab95a_e7f91bca","line":71,"range":{"start_line":71,"start_character":38,"end_line":71,"end_character":43},"updated":"2016-08-26 16:14:18.000000000","message":"guess some problem here, how we handle target ?\nI reverse the order of 2 params\n-target instance_id\u003d0ac58dc9-32a1-44d2-98e5-3bd41f12b823 --target user_id\u003d5db4c1f442ab466c85faf8299ee76166\nand got different result\n\njichen@refstack:/opt/stack/nova/nova$ nova-policy --os-roles 893dfc60c2f3463ea7126588ab465db3 --os-tenant-id f0e06104ed6c41669aa8b41448b606da  --os-user-id 5db4c1f442ab466c85faf8299ee76166 policy check --target user_id\u003d5db4c1f442ab466c85faf8299ee76166 --target instance_id\u003d0ac58dc9-32a1-44d2-98e5-3bd41f12b823 --api-name os_compute_api:os-lock-server\nos_compute_api:os-lock-server:discoverable\nos_compute_api:os-lock-server:lock\nos_compute_api:os-lock-server:unlock\njichen@refstack:/opt/stack/nova/nova$ nova-policy --os-roles 893dfc60c2f3463ea7126588ab465db3 --os-tenant-id f0e06104ed6c41669aa8b41448b606da  --os-user-id 5db4c1f442ab466c85faf8299ee76166 policy check --target instance_id\u003d0ac58dc9-32a1-44d2-98e5-3bd41f12b823 --target user_id\u003d5db4c1f442ab466c85faf8299ee76166 --api-name os_compute_api:os-lock-server\nos_compute_api:os-lock-server:discoverable\njichen@refstack:/opt/stack/nova/nova$","commit_id":"4b00ed43dc5d361fe54a0d7d4fd9c52eeb66beee"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"43d1b8b4c725ff761c245332b04ce2c0ad475613","unresolved":false,"context_lines":[{"line_number":134,"context_line":"    def _filter_rules(self, context, api_name, target):"},{"line_number":135,"context_line":"        all_rules \u003d policies.list_rules()"},{"line_number":136,"context_line":"        return [rule.name for rule in all_rules if api_name in rule.name and"},{"line_number":137,"context_line":"                context.can(rule.name, target, fatal\u003dFalse)]"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"CATEGORIES \u003d {"}],"source_content_type":"text/x-python","patch_set":11,"id":"fa7ab95a_0c8706b6","line":137,"range":{"start_line":137,"start_character":33,"end_line":137,"end_character":37},"updated":"2016-08-26 16:14:18.000000000","message":"add a follow on, we might remove \u0027admin_or_owner\u0027 from output\n\nos_compute_api:os-availability-zone:list\nos_compute_api:os-availability-zone:discoverable\nos_compute_api:os-baremetal-nodes:discoverable\nadmin_or_owner\nos_compute_api:os-block-device-mapping:discoverable\nos_compute_api:os-block-device-mapping-v1:disc","commit_id":"4b00ed43dc5d361fe54a0d7d4fd9c52eeb66beee"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"11df5aec11b7006d5c5fc8c06d63f666391d83f7","unresolved":false,"context_lines":[{"line_number":17,"context_line":"  CLI interface for nova policy rule commands."},{"line_number":18,"context_line":"\"\"\""},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"from __future__ import print_function"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"import functools"},{"line_number":23,"context_line":"import os"}],"source_content_type":"text/x-python","patch_set":12,"id":"fa7ab95a_20de863f","line":20,"updated":"2016-08-26 18:03:00.000000000","message":"print is already a function in 2.7 which is the lowest supported version of Nova at this time. So this is not necessary.","commit_id":"4f97229bdd68118d5d7f8253ed4565c51bb314ef"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"d3d0f52cffd967d5b7b095585fa002bd56f1bc53","unresolved":false,"context_lines":[{"line_number":17,"context_line":"  CLI interface for nova policy rule commands."},{"line_number":18,"context_line":"\"\"\""},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"from __future__ import print_function"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"import functools"},{"line_number":23,"context_line":"import os"}],"source_content_type":"text/x-python","patch_set":12,"id":"fa7ab95a_1890ebeb","line":20,"in_reply_to":"fa7ab95a_20de863f","updated":"2016-08-29 06:33:15.000000000","message":"Done, thanks","commit_id":"4f97229bdd68118d5d7f8253ed4565c51bb314ef"},{"author":{"_account_id":1063,"name":"Ed Leafe","email":"ed@leafe.com","username":"ed-leafe"},"change_message_id":"cbea5e78af64702f0530622104f0a1e53dd31559","unresolved":false,"context_lines":[{"line_number":17,"context_line":"  CLI interface for nova policy rule commands."},{"line_number":18,"context_line":"\"\"\""},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"from __future__ import print_function"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"import functools"},{"line_number":23,"context_line":"import os"}],"source_content_type":"text/x-python","patch_set":12,"id":"fa7ab95a_d3c9525c","line":20,"in_reply_to":"fa7ab95a_20de863f","updated":"2016-08-31 13:16:29.000000000","message":"Well, there *is* a difference. When you have this import, the old print statements will raise an error. Without it, both forms of print work fine in 2.7.","commit_id":"4f97229bdd68118d5d7f8253ed4565c51bb314ef"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"511640d280e7458eb702a0073cce05bde8bc0879","unresolved":false,"context_lines":[{"line_number":67,"context_line":"    @cmd_common.args(\u0027--api-name\u0027, dest\u003d\u0027api_name\u0027, metavar\u003d\u0027\u003cAPI name\u003e\u0027,"},{"line_number":68,"context_line":"                     help\u003d\u0027Will return only passing policy rules containing \u0027"},{"line_number":69,"context_line":"                          \u0027the given API name.\u0027)"},{"line_number":70,"context_line":"    @cmd_common.args(\u0027--target\u0027, nargs\u003d\u0027+\u0027, dest\u003d\u0027target\u0027, metavar\u003d\u0027\u003cTarget\u003e\u0027,"},{"line_number":71,"context_line":"                     help\u003d\u0027Will return only passing policy rules for the \u0027"},{"line_number":72,"context_line":"                          \u0027given target.\u0027)"},{"line_number":73,"context_line":"    def check(self, api_name\u003dNone, target\u003dNone):"}],"source_content_type":"text/x-python","patch_set":12,"id":"fa7ab95a_87bbefc3","line":70,"range":{"start_line":70,"start_character":38,"end_line":70,"end_character":43},"updated":"2016-08-26 16:16:45.000000000","message":"copy from PS11, seems those not changed from there?\n\nguess some problem here, how we handle target ?\nI reverse the order of 2 params\n-target instance_id\u003d0ac58dc9-32a1-44d2-98e5-3bd41f12b823 --target user_id\u003d5db4c1f442ab466c85faf8299ee76166\nand got different result\n\njichen@refstack:/opt/stack/nova/nova$ nova-policy --os-roles 893dfc60c2f3463ea7126588ab465db3 --os-tenant-id f0e06104ed6c41669aa8b41448b606da  --os-user-id 5db4c1f442ab466c85faf8299ee76166 policy check --target user_id\u003d5db4c1f442ab466c85faf8299ee76166 --target instance_id\u003d0ac58dc9-32a1-44d2-98e5-3bd41f12b823 --api-name os_compute_api:os-lock-server\nos_compute_api:os-lock-server:discoverable\nos_compute_api:os-lock-server:lock\nos_compute_api:os-lock-server:unlock\njichen@refstack:/opt/stack/nova/nova$ nova-policy --os-roles 893dfc60c2f3463ea7126588ab465db3 --os-tenant-id f0e06104ed6c41669aa8b41448b606da  --os-user-id 5db4c1f442ab466c85faf8299ee76166 policy check --target instance_id\u003d0ac58dc9-32a1-44d2-98e5-3bd41f12b823 --target user_id\u003d5db4c1f442ab466c85faf8299ee76166 --api-name os_compute_api:os-lock-server\nos_compute_api:os-lock-server:discoverable\njichen@refstack:/opt/stack/nova/nova$","commit_id":"4f97229bdd68118d5d7f8253ed4565c51bb314ef"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"d3d0f52cffd967d5b7b095585fa002bd56f1bc53","unresolved":false,"context_lines":[{"line_number":67,"context_line":"    @cmd_common.args(\u0027--api-name\u0027, dest\u003d\u0027api_name\u0027, metavar\u003d\u0027\u003cAPI name\u003e\u0027,"},{"line_number":68,"context_line":"                     help\u003d\u0027Will return only passing policy rules containing \u0027"},{"line_number":69,"context_line":"                          \u0027the given API name.\u0027)"},{"line_number":70,"context_line":"    @cmd_common.args(\u0027--target\u0027, nargs\u003d\u0027+\u0027, dest\u003d\u0027target\u0027, metavar\u003d\u0027\u003cTarget\u003e\u0027,"},{"line_number":71,"context_line":"                     help\u003d\u0027Will return only passing policy rules for the \u0027"},{"line_number":72,"context_line":"                          \u0027given target.\u0027)"},{"line_number":73,"context_line":"    def check(self, api_name\u003dNone, target\u003dNone):"}],"source_content_type":"text/x-python","patch_set":12,"id":"fa7ab95a_f8a0a7a1","line":70,"range":{"start_line":70,"start_character":38,"end_line":70,"end_character":43},"in_reply_to":"fa7ab95a_87bbefc3","updated":"2016-08-29 06:33:15.000000000","message":"@jichenjc, actually you should use target parameter like this:\n\n./bin/nova-policy --os-tenant-id xyz policy check --target user_id\u003dabc project_id\u003dxyz\n\nWith separated --target parameter, it only use the last one.","commit_id":"4f97229bdd68118d5d7f8253ed4565c51bb314ef"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"11df5aec11b7006d5c5fc8c06d63f666391d83f7","unresolved":false,"context_lines":[{"line_number":69,"context_line":"                          \u0027the given API name.\u0027)"},{"line_number":70,"context_line":"    @cmd_common.args(\u0027--target\u0027, nargs\u003d\u0027+\u0027, dest\u003d\u0027target\u0027, metavar\u003d\u0027\u003cTarget\u003e\u0027,"},{"line_number":71,"context_line":"                     help\u003d\u0027Will return only passing policy rules for the \u0027"},{"line_number":72,"context_line":"                          \u0027given target.\u0027)"},{"line_number":73,"context_line":"    def check(self, api_name\u003dNone, target\u003dNone):"},{"line_number":74,"context_line":"        \"\"\"Prints all passing policy rules for the given user."},{"line_number":75,"context_line":""}],"source_content_type":"text/x-python","patch_set":12,"id":"fa7ab95a_e0601e38","line":72,"updated":"2016-08-26 18:03:00.000000000","message":"This help text should include what the acceptable targets are.","commit_id":"4f97229bdd68118d5d7f8253ed4565c51bb314ef"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"d3d0f52cffd967d5b7b095585fa002bd56f1bc53","unresolved":false,"context_lines":[{"line_number":69,"context_line":"                          \u0027the given API name.\u0027)"},{"line_number":70,"context_line":"    @cmd_common.args(\u0027--target\u0027, nargs\u003d\u0027+\u0027, dest\u003d\u0027target\u0027, metavar\u003d\u0027\u003cTarget\u003e\u0027,"},{"line_number":71,"context_line":"                     help\u003d\u0027Will return only passing policy rules for the \u0027"},{"line_number":72,"context_line":"                          \u0027given target.\u0027)"},{"line_number":73,"context_line":"    def check(self, api_name\u003dNone, target\u003dNone):"},{"line_number":74,"context_line":"        \"\"\"Prints all passing policy rules for the given user."},{"line_number":75,"context_line":""}],"source_content_type":"text/x-python","patch_set":12,"id":"fa7ab95a_7883b704","line":72,"in_reply_to":"fa7ab95a_e0601e38","updated":"2016-08-29 06:33:15.000000000","message":"yea,will update","commit_id":"4f97229bdd68118d5d7f8253ed4565c51bb314ef"},{"author":{"_account_id":1063,"name":"Ed Leafe","email":"ed@leafe.com","username":"ed-leafe"},"change_message_id":"bdea0050d24fac304592556b96f792b73c73664c","unresolved":false,"context_lines":[{"line_number":36,"context_line":"CONF \u003d nova.conf.CONF"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"cli_opts \u003d ["},{"line_number":40,"context_line":"    cfg.ListOpt("},{"line_number":41,"context_line":"        \u0027os-roles\u0027,"},{"line_number":42,"context_line":"        metavar\u003d\u0027\u003cauth-roles\u003e\u0027,"}],"source_content_type":"text/x-python","patch_set":14,"id":"fa7ab95a_9913680d","line":39,"updated":"2016-08-31 14:13:45.000000000","message":"These should *not* be added here. They belong in nova/conf","commit_id":"9864801d468de5dde79141cbab4374bd2310bef2"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"279d2637b042b6334a7506dd7ffdf6cff84720f1","unresolved":false,"context_lines":[{"line_number":36,"context_line":"CONF \u003d nova.conf.CONF"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"cli_opts \u003d ["},{"line_number":40,"context_line":"    cfg.ListOpt("},{"line_number":41,"context_line":"        \u0027os-roles\u0027,"},{"line_number":42,"context_line":"        metavar\u003d\u0027\u003cauth-roles\u003e\u0027,"}],"source_content_type":"text/x-python","patch_set":14,"id":"fa7ab95a_bafd2c3d","line":39,"in_reply_to":"fa7ab95a_7943046d","updated":"2016-09-01 15:47:22.000000000","message":"agreed","commit_id":"9864801d468de5dde79141cbab4374bd2310bef2"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"751bd39d866cc54989238891bedf7c7f2f1a342f","unresolved":false,"context_lines":[{"line_number":36,"context_line":"CONF \u003d nova.conf.CONF"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"cli_opts \u003d ["},{"line_number":40,"context_line":"    cfg.ListOpt("},{"line_number":41,"context_line":"        \u0027os-roles\u0027,"},{"line_number":42,"context_line":"        metavar\u003d\u0027\u003cauth-roles\u003e\u0027,"}],"source_content_type":"text/x-python","patch_set":14,"id":"fa7ab95a_7943046d","line":39,"in_reply_to":"fa7ab95a_9913680d","updated":"2016-08-31 14:22:52.000000000","message":"I think it\u0027s fine at here. This is just a tool for experimental, everything may be changed in the future. And it may be removed very soon.","commit_id":"9864801d468de5dde79141cbab4374bd2310bef2"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"93e8334f85780fc9003bccb0dc3a1af8faa5e591","unresolved":false,"context_lines":[{"line_number":36,"context_line":"CONF \u003d nova.conf.CONF"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"cli_opts \u003d ["},{"line_number":40,"context_line":"    cfg.ListOpt("},{"line_number":41,"context_line":"        \u0027os-roles\u0027,"},{"line_number":42,"context_line":"        metavar\u003d\u0027\u003cauth-roles\u003e\u0027,"}],"source_content_type":"text/x-python","patch_set":14,"id":"fa7ab95a_f21a78c5","line":39,"in_reply_to":"fa7ab95a_b0070b1c","updated":"2016-09-01 16:21:25.000000000","message":"Also, they aren\u0027t listed in the help:\n\nstack@newton:~$ nova-policy policy check --help\nusage: nova-policy policy check [-h] [--api-name \u003cAPI name\u003e]\n                                [--target \u003cTarget\u003e [\u003cTarget\u003e ...]]\n\noptional arguments:\n  -h, --help            show this help message and exit\n  --api-name \u003cAPI name\u003e\n                        Will return only passing policy rules containing the\n                        given API name.\n  --target \u003cTarget\u003e [\u003cTarget\u003e ...]\n                        Will return only passing policy rules for the given\n                        target. The available targets are project_id,user_id,q\n                        uota_class,availability_zone,instance_id. When\n                        \"instance_id\" is used, the other targets will be\n                        overwritten.\nstack@newton:~$","commit_id":"9864801d468de5dde79141cbab4374bd2310bef2"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"f0ee8b7d2056ed2b9c3d482678689037feb5afe1","unresolved":false,"context_lines":[{"line_number":36,"context_line":"CONF \u003d nova.conf.CONF"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"cli_opts \u003d ["},{"line_number":40,"context_line":"    cfg.ListOpt("},{"line_number":41,"context_line":"        \u0027os-roles\u0027,"},{"line_number":42,"context_line":"        metavar\u003d\u0027\u003cauth-roles\u003e\u0027,"}],"source_content_type":"text/x-python","patch_set":14,"id":"fa7ab95a_b0070b1c","line":39,"in_reply_to":"fa7ab95a_bafd2c3d","updated":"2016-09-01 16:12:05.000000000","message":"Why are these even config options and not just options to the command line?","commit_id":"9864801d468de5dde79141cbab4374bd2310bef2"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"82dfb16f73ec8d8c08416637b060be71c319250e","unresolved":false,"context_lines":[{"line_number":36,"context_line":"CONF \u003d nova.conf.CONF"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"cli_opts \u003d ["},{"line_number":40,"context_line":"    cfg.ListOpt("},{"line_number":41,"context_line":"        \u0027os-roles\u0027,"},{"line_number":42,"context_line":"        metavar\u003d\u0027\u003cauth-roles\u003e\u0027,"}],"source_content_type":"text/x-python","patch_set":14,"id":"fa7ab95a_986ead2d","line":39,"in_reply_to":"fa7ab95a_f21a78c5","updated":"2016-09-01 16:50:27.000000000","message":"I\u0027ve opened bug 1619382 to follow up on this.","commit_id":"9864801d468de5dde79141cbab4374bd2310bef2"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"160e74e6a407a937de7ab42a8c61f4ed188ee7e3","unresolved":false,"context_lines":[{"line_number":93,"context_line":"            print(\u0027No rules matched or allowed\u0027)"},{"line_number":94,"context_line":"            return 1"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"    def _get_context(self):"},{"line_number":97,"context_line":"        return nova_context.RequestContext("},{"line_number":98,"context_line":"            roles\u003dCONF.os_roles,"},{"line_number":99,"context_line":"            user_id\u003dCONF.os_user_id,"},{"line_number":100,"context_line":"            project_id\u003dCONF.os_tenant_id)"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"    def _get_target(self, context, target):"},{"line_number":103,"context_line":"        \"\"\"Processes and validates the CLI given target and adapts it for"}],"source_content_type":"text/x-python","patch_set":14,"id":"fa7ab95a_1063571b","line":100,"range":{"start_line":96,"start_character":4,"end_line":100,"end_character":41},"updated":"2016-09-01 16:10:35.000000000","message":"It seems odd to me that these are configuration options, why wouldn\u0027t they be options to the command and default to the env variables?","commit_id":"9864801d468de5dde79141cbab4374bd2310bef2"}]}