)]}'
{"nova/api/openstack/compute/server_tags.py":[{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"6005ae64f801673b14cb0a95f4b0bc564f9e85a1","unresolved":false,"context_lines":[{"line_number":60,"context_line":"        context \u003d req.environ[\"nova.context\"]"},{"line_number":61,"context_line":"        server \u003d common.get_instance(self.compute_api, context, server_id)"},{"line_number":62,"context_line":"        context.can(st_policies.POLICY_ROOT % \u0027show\u0027,"},{"line_number":63,"context_line":"                  target\u003d{\u0027user_id\u0027: server.user_id,"},{"line_number":64,"context_line":"                         \u0027project_id\u0027: server.project_id})"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"        try:"},{"line_number":67,"context_line":"            exists \u003d objects.Tag.exists(context, server_id, id)"}],"source_content_type":"text/x-python","patch_set":5,"id":"3a461143_c7bfefcd","line":64,"range":{"start_line":63,"start_character":0,"end_line":64,"end_character":58},"updated":"2017-02-01 10:00:55.000000000","message":"I do not think this is something we want to apply.\nuser based enforcement should not be allowed.\nSome destructive action which we had to support for backward compatibility thing but those are with warning anjd will be removed in future.","commit_id":"54be4e1a4852b06c00e8d26929bac1987d31eb19"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"039c6415cc520d1a0afa4b813fc45089cf7f694f","unresolved":false,"context_lines":[{"line_number":60,"context_line":"        context \u003d req.environ[\"nova.context\"]"},{"line_number":61,"context_line":"        server \u003d common.get_instance(self.compute_api, context, server_id)"},{"line_number":62,"context_line":"        context.can(st_policies.POLICY_ROOT % \u0027show\u0027,"},{"line_number":63,"context_line":"                  target\u003d{\u0027user_id\u0027: server.user_id,"},{"line_number":64,"context_line":"                         \u0027project_id\u0027: server.project_id})"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"        try:"},{"line_number":67,"context_line":"            exists \u003d objects.Tag.exists(context, server_id, id)"}],"source_content_type":"text/x-python","patch_set":5,"id":"3a461143_e7b4eb82","line":64,"range":{"start_line":63,"start_character":0,"end_line":64,"end_character":58},"in_reply_to":"3a461143_c7bfefcd","updated":"2017-02-01 11:23:15.000000000","message":"+1 We certainly *do not* want the user_id in here.\n\nThe project_id thing is an interesting question we need to consider more globally.\n\nI would rather keep this equally terrible as everywhere else for the moment.","commit_id":"54be4e1a4852b06c00e8d26929bac1987d31eb19"},{"author":{"_account_id":18337,"name":"Sujitha","email":"sujitha.neti@intel.com","username":"Sujitha"},"change_message_id":"4c104de46a68ee8339ba47c112b05783a6b5fcd6","unresolved":false,"context_lines":[{"line_number":60,"context_line":"        context \u003d req.environ[\"nova.context\"]"},{"line_number":61,"context_line":"        server \u003d common.get_instance(self.compute_api, context, server_id)"},{"line_number":62,"context_line":"        context.can(st_policies.POLICY_ROOT % \u0027show\u0027,"},{"line_number":63,"context_line":"                  target\u003d{\u0027user_id\u0027: server.user_id,"},{"line_number":64,"context_line":"                         \u0027project_id\u0027: server.project_id})"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"        try:"},{"line_number":67,"context_line":"            exists \u003d objects.Tag.exists(context, server_id, id)"}],"source_content_type":"text/x-python","patch_set":5,"id":"fa31d9ce_7bbf76d0","line":64,"range":{"start_line":63,"start_character":0,"end_line":64,"end_character":58},"in_reply_to":"3a461143_e7b4eb82","updated":"2017-02-10 22:08:14.000000000","message":"Ghanshyam Mann, Agree. user_id should not be added here.\nJohn Garbutt, not addressing this as this would be fixed as part of policy bp.","commit_id":"54be4e1a4852b06c00e8d26929bac1987d31eb19"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"6005ae64f801673b14cb0a95f4b0bc564f9e85a1","unresolved":false,"context_lines":[{"line_number":79,"context_line":"        context \u003d req.environ[\"nova.context\"]"},{"line_number":80,"context_line":"        server \u003d common.get_instance(self.compute_api, context, server_id)"},{"line_number":81,"context_line":"        context.can(st_policies.POLICY_ROOT % \u0027index\u0027,"},{"line_number":82,"context_line":"                 target\u003d{\u0027user_id\u0027: server.user_id,"},{"line_number":83,"context_line":"                         \u0027project_id\u0027: server.project_id})"},{"line_number":84,"context_line":"        try:"},{"line_number":85,"context_line":"            tags \u003d objects.TagList.get_by_resource_id(context, server_id)"},{"line_number":86,"context_line":"        except exception.InstanceNotFound as e:"}],"source_content_type":"text/x-python","patch_set":5,"id":"3a461143_27d19323","line":83,"range":{"start_line":82,"start_character":0,"end_line":83,"end_character":57},"updated":"2017-02-01 10:00:55.000000000","message":"ditto","commit_id":"54be4e1a4852b06c00e8d26929bac1987d31eb19"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"6005ae64f801673b14cb0a95f4b0bc564f9e85a1","unresolved":false,"context_lines":[{"line_number":95,"context_line":"        context \u003d req.environ[\"nova.context\"]"},{"line_number":96,"context_line":"        server \u003d common.get_instance(self.compute_api, context, server_id)"},{"line_number":97,"context_line":"        context.can(st_policies.POLICY_ROOT % \u0027update\u0027,"},{"line_number":98,"context_line":"                 target\u003d{\u0027user_id\u0027: server.user_id,"},{"line_number":99,"context_line":"                         \u0027project_id\u0027: server.project_id})"},{"line_number":100,"context_line":"        self._check_instance_in_valid_state(context, server_id, \u0027update tag\u0027)"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"        try:"}],"source_content_type":"text/x-python","patch_set":5,"id":"3a461143_87c24751","line":99,"range":{"start_line":98,"start_character":0,"end_line":99,"end_character":57},"updated":"2017-02-01 10:00:55.000000000","message":"ditto. other place also","commit_id":"54be4e1a4852b06c00e8d26929bac1987d31eb19"}],"nova/policies/server_tags.py":[{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"6005ae64f801673b14cb0a95f4b0bc564f9e85a1","unresolved":false,"context_lines":[{"line_number":24,"context_line":"server_tags_policies \u003d ["},{"line_number":25,"context_line":"    policy.RuleDefault("},{"line_number":26,"context_line":"        name\u003dPOLICY_ROOT % \u0027delete_all\u0027,"},{"line_number":27,"context_line":"        check_str\u003dbase.RULE_ADMIN_OR_OWNER),"},{"line_number":28,"context_line":"    policy.RuleDefault("},{"line_number":29,"context_line":"        name\u003dPOLICY_ROOT % \u0027index\u0027,"},{"line_number":30,"context_line":"        check_str\u003dbase.RULE_ADMIN_OR_OWNER),"}],"source_content_type":"text/x-python","patch_set":5,"id":"3a461143_c78d2f32","line":27,"range":{"start_line":27,"start_character":23,"end_line":27,"end_character":42},"updated":"2017-02-01 10:00:55.000000000","message":"humm, i think it will break upgrade for operator who does not overriding this policy and depends on default one.","commit_id":"54be4e1a4852b06c00e8d26929bac1987d31eb19"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"039c6415cc520d1a0afa4b813fc45089cf7f694f","unresolved":false,"context_lines":[{"line_number":24,"context_line":"server_tags_policies \u003d ["},{"line_number":25,"context_line":"    policy.RuleDefault("},{"line_number":26,"context_line":"        name\u003dPOLICY_ROOT % \u0027delete_all\u0027,"},{"line_number":27,"context_line":"        check_str\u003dbase.RULE_ADMIN_OR_OWNER),"},{"line_number":28,"context_line":"    policy.RuleDefault("},{"line_number":29,"context_line":"        name\u003dPOLICY_ROOT % \u0027index\u0027,"},{"line_number":30,"context_line":"        check_str\u003dbase.RULE_ADMIN_OR_OWNER),"}],"source_content_type":"text/x-python","patch_set":5,"id":"3a461143_eaa3d2fd","line":27,"range":{"start_line":27,"start_character":23,"end_line":27,"end_character":42},"in_reply_to":"3a461143_c78d2f32","updated":"2017-02-01 11:23:15.000000000","message":"I actually think this is fine, because it will make no material change to the policy check.","commit_id":"54be4e1a4852b06c00e8d26929bac1987d31eb19"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"d29bf98c033422e39b1e3663edfebcfe06b585d5","unresolved":false,"context_lines":[{"line_number":24,"context_line":"server_tags_policies \u003d ["},{"line_number":25,"context_line":"    policy.RuleDefault("},{"line_number":26,"context_line":"        name\u003dPOLICY_ROOT % \u0027delete_all\u0027,"},{"line_number":27,"context_line":"        check_str\u003dbase.RULE_ADMIN_OR_OWNER),"},{"line_number":28,"context_line":"    policy.RuleDefault("},{"line_number":29,"context_line":"        name\u003dPOLICY_ROOT % \u0027index\u0027,"},{"line_number":30,"context_line":"        check_str\u003dbase.RULE_ADMIN_OR_OWNER),"}],"source_content_type":"text/x-python","patch_set":5,"id":"da36d5c6_591c8f77","line":27,"range":{"start_line":27,"start_character":23,"end_line":27,"end_character":42},"in_reply_to":"3a461143_eaa3d2fd","updated":"2017-02-28 09:00:17.000000000","message":"oh yea, right, DB does restrict those to admin or owner. Thanks","commit_id":"54be4e1a4852b06c00e8d26929bac1987d31eb19"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"d63cfe789c9ade11dc72d132d26463532bf1c8b9","unresolved":false,"context_lines":[{"line_number":88,"context_line":"    ),"},{"line_number":89,"context_line":"    policy.RuleDefault("},{"line_number":90,"context_line":"        name\u003dPOLICY_ROOT % \u0027discoverable\u0027,"},{"line_number":91,"context_line":"        check_str\u003dbase.RULE_ANY),"},{"line_number":92,"context_line":"]"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":""}],"source_content_type":"text/x-python","patch_set":7,"id":"1a1ced50_5a013c05","side":"PARENT","line":91,"updated":"2017-03-22 15:23:26.000000000","message":"Nit: unrelated change here really.","commit_id":"8e1100f641e0abdf4889129bab986afa25ca35de"}],"nova/tests/unit/api/openstack/compute/test_server_tags.py":[{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"8e6a9b9acccdcc60b0e9fb047ebd617fdf8a3198","unresolved":false,"context_lines":[{"line_number":65,"context_line":""},{"line_number":66,"context_line":"    @mock.patch(\u0027nova.db.instance_tag_exists\u0027)"},{"line_number":67,"context_line":"    def test_show(self, mock_exists):"},{"line_number":68,"context_line":"        self.stub_out(\u0027nova.api.openstack.common.get_instance\u0027, return_server)"},{"line_number":69,"context_line":"        mock_exists.return_value \u003d True"},{"line_number":70,"context_line":"        req \u003d self._get_request("},{"line_number":71,"context_line":"            \u0027/v2/fake/servers/%s/tags/%s\u0027 % (UUID, TAG1), \u0027GET\u0027)"}],"source_content_type":"text/x-python","patch_set":3,"id":"5a74a57a_8c7645d5","line":68,"range":{"start_line":68,"start_character":23,"end_line":68,"end_character":27},"updated":"2016-11-28 12:28:06.000000000","message":"mock might be recommended way","commit_id":"73907aa8bd968cb386da46ba159bd4f6c97a6300"},{"author":{"_account_id":18337,"name":"Sujitha","email":"sujitha.neti@intel.com","username":"Sujitha"},"change_message_id":"2a3dfa65ede8175a4388f4ea5561eaeb9377993e","unresolved":false,"context_lines":[{"line_number":65,"context_line":""},{"line_number":66,"context_line":"    @mock.patch(\u0027nova.db.instance_tag_exists\u0027)"},{"line_number":67,"context_line":"    def test_show(self, mock_exists):"},{"line_number":68,"context_line":"        self.stub_out(\u0027nova.api.openstack.common.get_instance\u0027, return_server)"},{"line_number":69,"context_line":"        mock_exists.return_value \u003d True"},{"line_number":70,"context_line":"        req \u003d self._get_request("},{"line_number":71,"context_line":"            \u0027/v2/fake/servers/%s/tags/%s\u0027 % (UUID, TAG1), \u0027GET\u0027)"}],"source_content_type":"text/x-python","patch_set":3,"id":"5a74a57a_3aecf028","line":68,"range":{"start_line":68,"start_character":23,"end_line":68,"end_character":27},"in_reply_to":"5a74a57a_8c7645d5","updated":"2016-11-30 21:38:24.000000000","message":"jichenjc...nova uses stub_out in many tests. Can you please let me know why this is not recommended.","commit_id":"73907aa8bd968cb386da46ba159bd4f6c97a6300"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"8e6a9b9acccdcc60b0e9fb047ebd617fdf8a3198","unresolved":false,"context_lines":[{"line_number":76,"context_line":""},{"line_number":77,"context_line":"    @mock.patch(\u0027nova.db.instance_tag_get_by_instance_uuid\u0027)"},{"line_number":78,"context_line":"    def test_index(self, mock_db_get_inst_tags):"},{"line_number":79,"context_line":"        self.stub_out(\u0027nova.api.openstack.common.get_instance\u0027, return_server)"},{"line_number":80,"context_line":"        fake_tags \u003d [self._get_tag(tag) for tag in TAGS]"},{"line_number":81,"context_line":"        mock_db_get_inst_tags.return_value \u003d fake_tags"},{"line_number":82,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"5a74a57a_4c70addc","line":79,"range":{"start_line":79,"start_character":23,"end_line":79,"end_character":27},"updated":"2016-11-28 12:28:06.000000000","message":"mock might be recommended way","commit_id":"73907aa8bd968cb386da46ba159bd4f6c97a6300"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"52c1894fcf2f763ad8ad076c4fc596540c7a070c","unresolved":false,"context_lines":[{"line_number":76,"context_line":""},{"line_number":77,"context_line":"    @mock.patch(\u0027nova.db.instance_tag_get_by_instance_uuid\u0027)"},{"line_number":78,"context_line":"    def test_index(self, mock_db_get_inst_tags):"},{"line_number":79,"context_line":"        self.stub_out(\u0027nova.api.openstack.common.get_instance\u0027, return_server)"},{"line_number":80,"context_line":"        fake_tags \u003d [self._get_tag(tag) for tag in TAGS]"},{"line_number":81,"context_line":"        mock_db_get_inst_tags.return_value \u003d fake_tags"},{"line_number":82,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"3a71b18c_b42963e8","line":79,"range":{"start_line":79,"start_character":23,"end_line":79,"end_character":27},"in_reply_to":"5a74a57a_4c70addc","updated":"2016-12-06 18:25:03.000000000","message":"my bad, I see stub so I thought it\u0027s stub.. actually it\u0027s stub_out","commit_id":"73907aa8bd968cb386da46ba159bd4f6c97a6300"}],"releasenotes/notes/os-server-tags-default-policy-change-003a244908a67289.yaml":[{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"8e6a9b9acccdcc60b0e9fb047ebd617fdf8a3198","unresolved":false,"context_lines":[{"line_number":1,"context_line":"upgrade:"},{"line_number":2,"context_line":"  - The default policy on os-server-tags has been changed from"},{"line_number":3,"context_line":"    ``RULE_ANY`` (allow all) to ``RULE_ADMIN_OR_OWNER``. This is because server"},{"line_number":4,"context_line":"    tags should only be manipulated on servers owned by the user admin)."},{"line_number":5,"context_line":"    The ownership restriction is already handled by database code, so adding"},{"line_number":6,"context_line":"    this check to the policy is not creating further restriction, it is just"},{"line_number":7,"context_line":"    making it a clear API failure."}],"source_content_type":"text/x-yaml","patch_set":3,"id":"5a74a57a_0c3875ee","line":4,"range":{"start_line":4,"start_character":47,"end_line":4,"end_character":70},"updated":"2016-11-28 12:28:06.000000000","message":"owned by the user or admin?","commit_id":"73907aa8bd968cb386da46ba159bd4f6c97a6300"},{"author":{"_account_id":18337,"name":"Sujitha","email":"sujitha.neti@intel.com","username":"Sujitha"},"change_message_id":"25fd195678debf1ea5357dfdbf3d813e18af7c33","unresolved":false,"context_lines":[{"line_number":1,"context_line":"upgrade:"},{"line_number":2,"context_line":"  - The default policy on os-server-tags has been changed from"},{"line_number":3,"context_line":"    ``RULE_ANY`` (allow all) to ``RULE_ADMIN_OR_OWNER``. This is because server"},{"line_number":4,"context_line":"    tags should only be manipulated on servers owned by the user admin)."},{"line_number":5,"context_line":"    The ownership restriction is already handled by database code, so adding"},{"line_number":6,"context_line":"    this check to the policy is not creating further restriction, it is just"},{"line_number":7,"context_line":"    making it a clear API failure."}],"source_content_type":"text/x-yaml","patch_set":3,"id":"5a74a57a_3a3a3099","line":4,"range":{"start_line":4,"start_character":47,"end_line":4,"end_character":70},"in_reply_to":"5a74a57a_0c3875ee","updated":"2016-11-30 21:40:49.000000000","message":"Done","commit_id":"73907aa8bd968cb386da46ba159bd4f6c97a6300"}]}