)]}'
{"etc/nova/policy.json":[{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"71fe850c2a5ca39970444144320128dd2d7fe98a","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"context_is_admin\":  \"role:admin\","},{"line_number":3,"context_line":"    \"admin_or_owner\":  \"is_admin:True or project_id:%(project_id)s\","},{"line_number":4,"context_line":"    \"default\": \"rule:admin_or_owner\","},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"    \"cells_scheduler_filter:TargetCellFilter\": \"is_admin:True\","},{"line_number":7,"context_line":""}],"source_content_type":"application/json","patch_set":13,"id":"3aaa91ec_44c8bd22","line":4,"updated":"2016-06-23 13:08:22.000000000","message":"Can drop these now, because of all this?\nhttps://review.openstack.org/#/c/328850/13/nova/policies/base.py@20\n\nBut thats a separate change.","commit_id":"5a10a35b170054ac3ff4a11b86588e1b59fe3fa4"}],"nova/_policy/__init__.py":[{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"f35efc243f3e50064a07012ac4392bd3527f552f","unresolved":false,"context_lines":[{"line_number":22,"context_line":"from nova._policy import attach_interfaces"},{"line_number":23,"context_line":"from nova._policy import availability_zone"},{"line_number":24,"context_line":"from nova._policy import baremetal_nodes"},{"line_number":25,"context_line":"from nova._policy import block_device_mapping_v1"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"def _register_all_policy_rules():"}],"source_content_type":"text/x-python","patch_set":1,"id":"7aa08908_e89b53c7","line":25,"range":{"start_line":25,"start_character":18,"end_line":25,"end_character":24},"updated":"2016-06-13 15:16:15.000000000","message":"not sure objects/__init__.py import will help\nbut seems pep8 complain the \u0027not use\u0027 issue","commit_id":"7202b0321d4803f5917b894becd899ed3901d7f8"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"c724b558d8cc7912f20d710cdb33745a54342fe2","unresolved":false,"context_lines":[{"line_number":22,"context_line":"from nova._policy import attach_interfaces"},{"line_number":23,"context_line":"from nova._policy import availability_zone"},{"line_number":24,"context_line":"from nova._policy import baremetal_nodes"},{"line_number":25,"context_line":"from nova._policy import block_device_mapping_v1"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"def _register_all_policy_rules():"}],"source_content_type":"text/x-python","patch_set":1,"id":"7aa08908_ee0a301f","line":25,"range":{"start_line":25,"start_character":18,"end_line":25,"end_character":24},"in_reply_to":"7aa08908_e89b53c7","updated":"2016-06-13 19:58:35.000000000","message":"yeah, I might do something similar. or at the very least, add # noqa at each line.","commit_id":"7202b0321d4803f5917b894becd899ed3901d7f8"}],"nova/_policy/availability_zone.py":[{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"f35efc243f3e50064a07012ac4392bd3527f552f","unresolved":false,"context_lines":[{"line_number":19,"context_line":"availability_zone_policies \u003d ["},{"line_number":20,"context_line":"    policy.RuleDefault("},{"line_number":21,"context_line":"        name\u003d\u0027os_compute_api:os-availability-zone:list\u0027,"},{"line_number":22,"context_line":"        check_str\u003d\u0027rule:admin_or_owner\u0027),"},{"line_number":23,"context_line":"    policy.RuleDefault("},{"line_number":24,"context_line":"        name\u003d\u0027os_compute_api:os-availability-zone:discoverable\u0027,"},{"line_number":25,"context_line":"        check_str\u003d\u0027@\u0027),"}],"source_content_type":"text/x-python","patch_set":1,"id":"7aa08908_8529d89d","line":22,"range":{"start_line":22,"start_character":24,"end_line":22,"end_character":38},"updated":"2016-06-13 15:16:15.000000000","message":"maybe a another topic, but seems owner is confusing","commit_id":"7202b0321d4803f5917b894becd899ed3901d7f8"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"c724b558d8cc7912f20d710cdb33745a54342fe2","unresolved":false,"context_lines":[{"line_number":19,"context_line":"availability_zone_policies \u003d ["},{"line_number":20,"context_line":"    policy.RuleDefault("},{"line_number":21,"context_line":"        name\u003d\u0027os_compute_api:os-availability-zone:list\u0027,"},{"line_number":22,"context_line":"        check_str\u003d\u0027rule:admin_or_owner\u0027),"},{"line_number":23,"context_line":"    policy.RuleDefault("},{"line_number":24,"context_line":"        name\u003d\u0027os_compute_api:os-availability-zone:discoverable\u0027,"},{"line_number":25,"context_line":"        check_str\u003d\u0027@\u0027),"}],"source_content_type":"text/x-python","patch_set":1,"id":"7aa08908_932c77ad","line":22,"range":{"start_line":22,"start_character":24,"end_line":22,"end_character":38},"in_reply_to":"7aa08908_8529d89d","updated":"2016-06-13 19:58:35.000000000","message":"that\u0027s what the current policy rule is. :)","commit_id":"7202b0321d4803f5917b894becd899ed3901d7f8"}],"nova/policies/__init__.py":[{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"3d7cafabd13653961db5d5bc6119db74a9e5eef3","unresolved":false,"context_lines":[{"line_number":31,"context_line":"    from nova.policies import block_device_mapping_v1  # noqa"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"    # get only the locally imported modules."},{"line_number":34,"context_line":"    imported_modules \u003d locals().values()"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"    # all the imported modules have the list_policies method, which returns"},{"line_number":37,"context_line":"    # a list of policy rules."}],"source_content_type":"text/x-python","patch_set":2,"id":"7aa08908_90d5741d","line":34,"updated":"2016-06-14 09:18:02.000000000","message":"can we just call this directly, like we do for config?\nhttps://github.com/openstack/nova/blob/master/nova/conf/__init__.py","commit_id":"b791b668d74e10ed5aeea5c3e9f99bab6145c2f0"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"9290d696a8b0aa43da129cfc919e13b19cbc999e","unresolved":false,"context_lines":[{"line_number":31,"context_line":"    from nova.policies import block_device_mapping_v1  # noqa"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"    # get only the locally imported modules."},{"line_number":34,"context_line":"    imported_modules \u003d locals().values()"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"    # all the imported modules have the list_policies method, which returns"},{"line_number":37,"context_line":"    # a list of policy rules."}],"source_content_type":"text/x-python","patch_set":2,"id":"7aa08908_e03fc384","line":34,"in_reply_to":"7aa08908_90d5741d","updated":"2016-06-14 10:15:45.000000000","message":"we obviously can, but I think it\u0027s easier this way, IMO. If you really want so, I can do it.","commit_id":"b791b668d74e10ed5aeea5c3e9f99bab6145c2f0"}],"nova/policies/_common.py":[{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"80f11ea04378dadc1ca30434e40c56006f38a92c","unresolved":false,"context_lines":[{"line_number":18,"context_line":""},{"line_number":19,"context_line":"RULE_ADMIN_OR_OWNER \u003d \u0027rule:admin_or_owner\u0027"},{"line_number":20,"context_line":"RULE_IS_ADMIN \u003d \u0027is_admin:True\u0027"},{"line_number":21,"context_line":"RULE_ANY \u003d \u0027@\u0027"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"def get_name(*names):"}],"source_content_type":"text/x-python","patch_set":11,"id":"7aa08908_ac31660d","line":21,"updated":"2016-06-17 18:15:38.000000000","message":"This is nice, I like to centralization of the common definitions.","commit_id":"204f45493dca7af47c988a0481da8a0b66feb801"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"80f11ea04378dadc1ca30434e40c56006f38a92c","unresolved":false,"context_lines":[{"line_number":25,"context_line":"    return \u0027:\u0027.join(names)"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"def get_name_partial(base_name):"},{"line_number":29,"context_line":"    return functools.partial(get_name, base_name)"}],"source_content_type":"text/x-python","patch_set":11,"id":"7aa08908_cc3cb2e3","line":28,"updated":"2016-06-17 18:15:38.000000000","message":"This is very useful.","commit_id":"204f45493dca7af47c988a0481da8a0b66feb801"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"5696c9d7cec85d0e556102dc1e74c2ba1e850b91","unresolved":false,"context_lines":[{"line_number":25,"context_line":"    return \u0027:\u0027.join(names)"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"def get_name_partial(base_name):"},{"line_number":29,"context_line":"    return functools.partial(get_name, base_name)"}],"source_content_type":"text/x-python","patch_set":11,"id":"3aaa91ec_3fb04143","line":28,"in_reply_to":"3aaa91ec_75f5cfc9","updated":"2016-06-22 20:22:25.000000000","message":"I think it\u0027s useful but I\u0027ll concede that it\u0027s not as obvious as in place string formatting. Starting simple here is a good path. I left off descriptions in my policy rules for that reason as well. They can be added in later and not complicate these initial reviews.","commit_id":"204f45493dca7af47c988a0481da8a0b66feb801"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"6cb2234c2ea68d2b9ddb25954dc3f880c0a01af4","unresolved":false,"context_lines":[{"line_number":25,"context_line":"    return \u0027:\u0027.join(names)"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"def get_name_partial(base_name):"},{"line_number":29,"context_line":"    return functools.partial(get_name, base_name)"}],"source_content_type":"text/x-python","patch_set":11,"id":"3aaa91ec_75f5cfc9","line":28,"in_reply_to":"7aa08908_cc3cb2e3","updated":"2016-06-22 18:42:44.000000000","message":"actually, I don\u0027t like this pattern, I feel like it adds more indirection then we need, and a lot of the confusion of the v2.1 API stack was over things like this.","commit_id":"204f45493dca7af47c988a0481da8a0b66feb801"}],"nova/policies/access_ips.py":[{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"3d7cafabd13653961db5d5bc6119db74a9e5eef3","unresolved":false,"context_lines":[{"line_number":23,"context_line":""},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"access_ips_policies \u003d ["},{"line_number":26,"context_line":"    policy.RuleDefault("},{"line_number":27,"context_line":"        name\u003dget_name(\u0027discoverable\u0027),"},{"line_number":28,"context_line":"        check_str\u003d_common.RULE_ANY),"},{"line_number":29,"context_line":"    policy.RuleDefault("}],"source_content_type":"text/x-python","patch_set":2,"id":"7aa08908_70bf28d0","line":26,"updated":"2016-06-14 09:18:02.000000000","message":"I think we can actually drop all these discoverable policies.","commit_id":"b791b668d74e10ed5aeea5c3e9f99bab6145c2f0"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"9290d696a8b0aa43da129cfc919e13b19cbc999e","unresolved":false,"context_lines":[{"line_number":23,"context_line":""},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"access_ips_policies \u003d ["},{"line_number":26,"context_line":"    policy.RuleDefault("},{"line_number":27,"context_line":"        name\u003dget_name(\u0027discoverable\u0027),"},{"line_number":28,"context_line":"        check_str\u003d_common.RULE_ANY),"},{"line_number":29,"context_line":"    policy.RuleDefault("}],"source_content_type":"text/x-python","patch_set":2,"id":"7aa08908_80319fa4","line":26,"in_reply_to":"7aa08908_70bf28d0","updated":"2016-06-14 10:15:45.000000000","message":"Yeah, each \"group\" has it\u0027s own discoverable policy.\n\nFrom what I know, they aren\u0027t used anywhere, but at least I am going to use them in the discoverable policy thingy. I only report a policy \"group\" if it is discoverable.","commit_id":"b791b668d74e10ed5aeea5c3e9f99bab6145c2f0"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"818a81cc559027cf2a650868f777f77fae4b82c4","unresolved":false,"context_lines":[{"line_number":23,"context_line":""},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"access_ips_policies \u003d ["},{"line_number":26,"context_line":"    policy.RuleDefault("},{"line_number":27,"context_line":"        name\u003dget_name(\u0027discoverable\u0027),"},{"line_number":28,"context_line":"        check_str\u003d_common.RULE_ANY),"},{"line_number":29,"context_line":"    policy.RuleDefault("}],"source_content_type":"text/x-python","patch_set":2,"id":"7aa08908_8236bf00","line":26,"in_reply_to":"7aa08908_80319fa4","updated":"2016-06-14 12:01:08.000000000","message":"guess it\u0027s all policy are discoverable and we don\u0027t need to say add it in this policy report?","commit_id":"b791b668d74e10ed5aeea5c3e9f99bab6145c2f0"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"ba73438ea9d0758e0a983580990c0fd65ce6ac33","unresolved":false,"context_lines":[{"line_number":28,"context_line":"        check_str\u003d_common.RULE_ANY),"},{"line_number":29,"context_line":"    policy.RuleDefault("},{"line_number":30,"context_line":"        name\u003dget_name(),"},{"line_number":31,"context_line":"        check_str\u003d_common.RULE_ADMIN_OR_OWNER),"},{"line_number":32,"context_line":"]"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"7aa08908_30000002","line":31,"updated":"2016-06-14 09:23:29.000000000","message":"Thinking about this, I was assuming we would be switching the API code over to using these policy rules in the same patch, i.e. this bit:\nhttps://github.com/openstack/nova/blob/master/nova/api/openstack/compute/access_ips.py#L20\n\nI was then expecting that rule to get dropped out of the policy.json file here:\nhttps://github.com/openstack/nova/blob/master/etc/nova/policy.json\n\nI was also expecting some unit test to make sure that the default policy file + the policy in code, when added together, are the same:\nhttps://github.com/openstack/nova/blob/master/nova/tests/unit/test_policy.py#L510","commit_id":"b791b668d74e10ed5aeea5c3e9f99bab6145c2f0"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"406906a5e8aea9854f49fd8bf80aebff968383bf","unresolved":false,"context_lines":[{"line_number":28,"context_line":"        check_str\u003d_common.RULE_ANY),"},{"line_number":29,"context_line":"    policy.RuleDefault("},{"line_number":30,"context_line":"        name\u003dget_name(),"},{"line_number":31,"context_line":"        check_str\u003d_common.RULE_ADMIN_OR_OWNER),"},{"line_number":32,"context_line":"]"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"7aa08908_d37a6376","line":31,"in_reply_to":"7aa08908_30000002","updated":"2016-06-14 10:23:14.000000000","message":"So..\n\n1. Yeah, that\u0027s a an interesting suggestion. I could do that too, I guess, if I\u0027m able to find an easy way to do it. But IMO, that can also be done in a separate patch. Otherwise it can end up being quite hard to review, having so many changes to review.\n\n2. Yeah, we can drop them from the policy.json file. I was thinking about doing it later.\n\n3. That\u0027s a good idea.","commit_id":"b791b668d74e10ed5aeea5c3e9f99bab6145c2f0"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"6cb2234c2ea68d2b9ddb25954dc3f880c0a01af4","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"BASE_POLICY_NAME \u003d \u0027os_compute_api:os-access-ips\u0027"},{"line_number":22,"context_line":"get_name \u003d _common.get_name_partial(BASE_POLICY_NAME)"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"access_ips_policies \u003d ["}],"source_content_type":"text/x-python","patch_set":11,"id":"3aaa91ec_d5ae4384","line":22,"updated":"2016-06-22 18:42:44.000000000","message":"couldn\u0027t we just do POLICY_ROOT \u003d \u0027os_compute_api:os-access-ips:%s\u0027","commit_id":"204f45493dca7af47c988a0481da8a0b66feb801"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"6cb2234c2ea68d2b9ddb25954dc3f880c0a01af4","unresolved":false,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":"access_ips_policies \u003d ["},{"line_number":26,"context_line":"    policy.RuleDefault("},{"line_number":27,"context_line":"        name\u003dget_name(\u0027discoverable\u0027),"},{"line_number":28,"context_line":"        check_str\u003d_common.RULE_ANY),"},{"line_number":29,"context_line":"    policy.RuleDefault("},{"line_number":30,"context_line":"        name\u003dget_name(),"}],"source_content_type":"text/x-python","patch_set":11,"id":"3aaa91ec_75914f52","line":27,"updated":"2016-06-22 18:42:44.000000000","message":"POLICY_ROOT % \u0027discoverable\u0027","commit_id":"204f45493dca7af47c988a0481da8a0b66feb801"}],"nova/policies/admin_actions.py":[{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"3d7cafabd13653961db5d5bc6119db74a9e5eef3","unresolved":false,"context_lines":[{"line_number":18,"context_line":"from nova.policies import _common"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"BASE_POLICY_NAME \u003d \u0027os_compute_api:os-admin-actions\u0027"},{"line_number":22,"context_line":"get_name \u003d _common.get_name_partial(BASE_POLICY_NAME)"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"7aa08908_10cd0466","line":21,"updated":"2016-06-14 09:18:02.000000000","message":"I was hoping we could group the policy based on resources.\n\nLike all these could live in the compute policy file?\n\nBut maybe thats a step too far at this stage.","commit_id":"b791b668d74e10ed5aeea5c3e9f99bab6145c2f0"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"9290d696a8b0aa43da129cfc919e13b19cbc999e","unresolved":false,"context_lines":[{"line_number":18,"context_line":"from nova.policies import _common"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"BASE_POLICY_NAME \u003d \u0027os_compute_api:os-admin-actions\u0027"},{"line_number":22,"context_line":"get_name \u003d _common.get_name_partial(BASE_POLICY_NAME)"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"7aa08908_a062db3b","line":21,"in_reply_to":"7aa08908_10cd0466","updated":"2016-06-14 10:15:45.000000000","message":"yeah, that\u0027s one option I\u0027ve considered as well. The module for servers would end up having hundreds of lines with rules.\n\nSo, all these files resulted from a script I\u0027ve made for this task. Basically, it was splitting the policies by their \"group\". Also, the result matches the modules in nova.api.openstack.compute almost entirely, with a few exceptions:\n\n    policies for nova.api.openstack.compute.server_migrations are in nova.policies.servers.py\n    policies for nova.api.openstack.compute.flavors_extraspecs are in nova.policies.flavors_extra_specs (can rename)\n    policies for nova.api.openstack.compute.quota_classes are in nova.policies.quota_class_sets (can rename)\n    there are no policies used in block_device_mapping, image_metadata, multiple_create modules in nova.api.openstack.compute.","commit_id":"b791b668d74e10ed5aeea5c3e9f99bab6145c2f0"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"3d7cafabd13653961db5d5bc6119db74a9e5eef3","unresolved":false,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":"admin_actions_policies \u003d ["},{"line_number":26,"context_line":"    policy.RuleDefault("},{"line_number":27,"context_line":"        name\u003dget_name(\u0027discoverable\u0027),"},{"line_number":28,"context_line":"        check_str\u003d_common.RULE_ANY),"},{"line_number":29,"context_line":"    policy.RuleDefault("},{"line_number":30,"context_line":"        name\u003dget_name(\u0027reset_state\u0027),"}],"source_content_type":"text/x-python","patch_set":2,"id":"7aa08908_50daec17","line":27,"updated":"2016-06-14 09:18:02.000000000","message":"as before, I think we want to drop these ones.","commit_id":"b791b668d74e10ed5aeea5c3e9f99bab6145c2f0"}],"nova/policies/base.py":[{"author":{"_account_id":9542,"name":"Pavlo Shchelokovskyy","email":"pshchelokovskyy@mirantis.com","username":"pshchelo"},"change_message_id":"471e6581880e15752d4b7dbf340101772f1df609","unresolved":false,"context_lines":[{"line_number":13,"context_line":"from oslo_policy import policy"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"RULE_ADMIN_OR_OWNER \u003d \u0027rule:admin_or_owner\u0027"},{"line_number":16,"context_line":"RULE_IS_ADMIN \u003d \u0027is_admin:True\u0027"},{"line_number":17,"context_line":"RULE_ANY \u003d \u0027@\u0027"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"rules \u003d ["}],"source_content_type":"text/x-python","patch_set":13,"id":"3aaa91ec_aff4df86","line":16,"updated":"2016-06-23 12:45:52.000000000","message":"IMO would be better here to make this ref to \"rule:admin_api\" instead, as in the line above for RULE_ADMIN_OR_OWNER\n\nThis way when in need to modify this rule in policy.json, operators would only need to update a single rule \"admin_api\" instead of having to update all the lines that have \"is_admin:True\"\n\nOr was it a conscious choice to make it harder to inappropriately expose all API access with single-line change by accident?","commit_id":"5a10a35b170054ac3ff4a11b86588e1b59fe3fa4"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"2fdec8a36a06bba1907dc623ee6189ee2e51b25c","unresolved":false,"context_lines":[{"line_number":13,"context_line":"from oslo_policy import policy"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"RULE_ADMIN_OR_OWNER \u003d \u0027rule:admin_or_owner\u0027"},{"line_number":16,"context_line":"RULE_IS_ADMIN \u003d \u0027is_admin:True\u0027"},{"line_number":17,"context_line":"RULE_ANY \u003d \u0027@\u0027"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"rules \u003d ["}],"source_content_type":"text/x-python","patch_set":13,"id":"3aaa91ec_e4e3a931","line":16,"in_reply_to":"3aaa91ec_41138fb8","updated":"2016-06-23 13:02:07.000000000","message":"+1 alaski\n\nI think we need to keep this the same for now, in this first step.","commit_id":"5a10a35b170054ac3ff4a11b86588e1b59fe3fa4"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"04c63dbb989c6b254d6175245db7c33adb558479","unresolved":false,"context_lines":[{"line_number":13,"context_line":"from oslo_policy import policy"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"RULE_ADMIN_OR_OWNER \u003d \u0027rule:admin_or_owner\u0027"},{"line_number":16,"context_line":"RULE_IS_ADMIN \u003d \u0027is_admin:True\u0027"},{"line_number":17,"context_line":"RULE_ANY \u003d \u0027@\u0027"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"rules \u003d ["}],"source_content_type":"text/x-python","patch_set":13,"id":"3aaa91ec_41138fb8","line":16,"in_reply_to":"3aaa91ec_aff4df86","updated":"2016-06-23 13:00:14.000000000","message":"We want to make it more difficult to make a policy change and not be entirely sure how much it affects. In general I don\u0027t think it should be encouraged to modify the base rules like admin_or_owner or admin_api, deployers should create new rules and explicitly apply them to the policies they want.\n\nAlso notice that this is being used to set the admin_api rule below on line 23, so using rule:admin_api would be self-referential :)","commit_id":"5a10a35b170054ac3ff4a11b86588e1b59fe3fa4"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"89c336f628ac7d289b4bf2c9703ca73856073a9f","unresolved":false,"context_lines":[{"line_number":13,"context_line":"from oslo_policy import policy"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"RULE_ADMIN_OR_OWNER \u003d \u0027rule:admin_or_owner\u0027"},{"line_number":16,"context_line":"RULE_IS_ADMIN \u003d \u0027is_admin:True\u0027"},{"line_number":17,"context_line":"RULE_ANY \u003d \u0027@\u0027"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"rules \u003d ["}],"source_content_type":"text/x-python","patch_set":13,"id":"3aaa91ec_e44a89ab","line":16,"in_reply_to":"3aaa91ec_e4e3a931","updated":"2016-06-23 13:08:13.000000000","message":"actually, I think Pavlo is correct.\n\nRULE_IS_ADMIN is being used for any rule that needs \"rule:admin_api\".\n\ne.g.:\n\n    admin_actions_policies \u003d [\n        policy.RuleDefault(\n            name\u003dget_name(\u0027reset_state\u0027),\n            check_str\u003d_common.RULE_IS_ADMIN),\n    ]\n\nthis should map to:\n\n    \"os_compute_api:os-admin-actions:reset_state\": \"rule:admin_api\",\n\nand it\u0027s a bit different. My bad. fixing it now.","commit_id":"5a10a35b170054ac3ff4a11b86588e1b59fe3fa4"}],"nova/tests/unit/policies/test_policies.py":[{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"79bcb81cb2c7540032757b65ac5502164513082a","unresolved":false,"context_lines":[{"line_number":34,"context_line":"        policy_rules \u003d policies.list_policies()"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"        # an iterator doesn\u0027t have a length."},{"line_number":37,"context_line":"        self.assertNotEqual(0, len(list(policy_rules)))"}],"source_content_type":"text/x-python","patch_set":9,"id":"7aa08908_7039653f","line":37,"range":{"start_line":37,"start_character":31,"end_line":37,"end_character":34},"updated":"2016-06-16 11:55:28.000000000","message":"sorry but not sure the purpose of this test, test the list_policies is an iterator?","commit_id":"9564f0a0503b8e6831aae9a460d790693acd5ff3"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"aa2494ad899e9bc08269f64ceac1c697744f2b7b","unresolved":false,"context_lines":[{"line_number":34,"context_line":"        policy_rules \u003d policies.list_policies()"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"        # an iterator doesn\u0027t have a length."},{"line_number":37,"context_line":"        self.assertNotEqual(0, len(list(policy_rules)))"}],"source_content_type":"text/x-python","patch_set":9,"id":"7aa08908_173613b4","line":37,"range":{"start_line":37,"start_character":31,"end_line":37,"end_character":34},"in_reply_to":"7aa08908_7039653f","updated":"2016-06-16 13:14:37.000000000","message":"it was useful when I first added this code, so I wouldn\u0027t have some errors. now, it can be a bit overkill.","commit_id":"9564f0a0503b8e6831aae9a460d790693acd5ff3"}],"nova/tests/unit/test_policy.py":[{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"79bcb81cb2c7540032757b65ac5502164513082a","unresolved":false,"context_lines":[{"line_number":232,"context_line":"        \"\"\""},{"line_number":233,"context_line":"        for action, condition in self.actions:"},{"line_number":234,"context_line":"            # NOTE(claudiub): some rules have a TrueCheck condition, which"},{"line_number":235,"context_line":"            # causes this test to fail (e.g. discoverable policies,"},{"line_number":236,"context_line":"            # server-tags). We have to skip them."},{"line_number":237,"context_line":"            if str(condition) \u003d\u003d policies_common.RULE_ANY:"},{"line_number":238,"context_line":"                continue"}],"source_content_type":"text/x-python","patch_set":9,"id":"7aa08908_70fcc53f","line":235,"range":{"start_line":235,"start_character":45,"end_line":235,"end_character":57},"updated":"2016-06-16 11:55:28.000000000","message":"why we need still keep discoverable ?","commit_id":"9564f0a0503b8e6831aae9a460d790693acd5ff3"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"aa2494ad899e9bc08269f64ceac1c697744f2b7b","unresolved":false,"context_lines":[{"line_number":232,"context_line":"        \"\"\""},{"line_number":233,"context_line":"        for action, condition in self.actions:"},{"line_number":234,"context_line":"            # NOTE(claudiub): some rules have a TrueCheck condition, which"},{"line_number":235,"context_line":"            # causes this test to fail (e.g. discoverable policies,"},{"line_number":236,"context_line":"            # server-tags). We have to skip them."},{"line_number":237,"context_line":"            if str(condition) \u003d\u003d policies_common.RULE_ANY:"},{"line_number":238,"context_line":"                continue"}],"source_content_type":"text/x-python","patch_set":9,"id":"7aa08908_3737cf4e","line":235,"range":{"start_line":235,"start_character":45,"end_line":235,"end_character":57},"in_reply_to":"7aa08908_70fcc53f","updated":"2016-06-16 13:14:37.000000000","message":"so, the discoverable policies are not particularly useful at the moment. But they can prove useful in the future. For example, when we are going to add the discoverable policy feature in the future, one important criteria would be if a policy is discoverable (e.g.: if \u0027os_compute_api:servers:discoverable\u0027 policy does not pass, none of the \u0027os_compute_api:server:*\u0027 will be exposed).\n\nplus, those policy rules were already existent in the policy.json file.","commit_id":"9564f0a0503b8e6831aae9a460d790693acd5ff3"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"79bcb81cb2c7540032757b65ac5502164513082a","unresolved":false,"context_lines":[{"line_number":235,"context_line":"            # causes this test to fail (e.g. discoverable policies,"},{"line_number":236,"context_line":"            # server-tags). We have to skip them."},{"line_number":237,"context_line":"            if str(condition) \u003d\u003d policies_common.RULE_ANY:"},{"line_number":238,"context_line":"                continue"},{"line_number":239,"context_line":""},{"line_number":240,"context_line":"            self.assertRaises(exception.PolicyNotAuthorized, policy.enforce,"},{"line_number":241,"context_line":"                          self.context, action, self.target)"}],"source_content_type":"text/x-python","patch_set":9,"id":"7aa08908_5043896c","line":238,"range":{"start_line":238,"start_character":16,"end_line":238,"end_character":24},"updated":"2016-06-16 11:55:28.000000000","message":"just curious, why we can pass test before? seems no change to server-tags?","commit_id":"9564f0a0503b8e6831aae9a460d790693acd5ff3"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"aa2494ad899e9bc08269f64ceac1c697744f2b7b","unresolved":false,"context_lines":[{"line_number":235,"context_line":"            # causes this test to fail (e.g. discoverable policies,"},{"line_number":236,"context_line":"            # server-tags). We have to skip them."},{"line_number":237,"context_line":"            if str(condition) \u003d\u003d policies_common.RULE_ANY:"},{"line_number":238,"context_line":"                continue"},{"line_number":239,"context_line":""},{"line_number":240,"context_line":"            self.assertRaises(exception.PolicyNotAuthorized, policy.enforce,"},{"line_number":241,"context_line":"                          self.context, action, self.target)"}],"source_content_type":"text/x-python","patch_set":9,"id":"7aa08908_72be8501","line":238,"range":{"start_line":238,"start_character":16,"end_line":238,"end_character":24},"in_reply_to":"7aa08908_5043896c","updated":"2016-06-16 13:14:37.000000000","message":"took a better look at this.\n\nA better solution for this would be to fix the policy fixtures. Currently, it is taking the policy.json file and setting an admin rule for every single rule in it, before dumping it into a temp policy.json file.\n\nSo, as we continue to reduce the policy.json file, fewer and fewer policies are set to admin role, and this test becomes less and less relevant.","commit_id":"9564f0a0503b8e6831aae9a460d790693acd5ff3"}]}