)]}'
{"nova/api/openstack/compute/servers.py":[{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"6d2546f9dc69dc1c0c4a33e45a656d1a9717e905","unresolved":false,"context_lines":[{"line_number":318,"context_line":"                context.can(server_policies.SERVERS % \u0027all_tenants_visible\u0027)"},{"line_number":319,"context_line":"                elevated \u003d context.elevated()"},{"line_number":320,"context_line":"            except exception.Forbidden:"},{"line_number":321,"context_line":"                if is_detail:"},{"line_number":322,"context_line":"                    context.can("},{"line_number":323,"context_line":"                        server_policies.SERVERS % \u0027detail:get_all_tenants\u0027)"},{"line_number":324,"context_line":"                else:"},{"line_number":325,"context_line":"                    context.can("},{"line_number":326,"context_line":"                        server_policies.SERVERS % \u0027index:get_all_tenants\u0027)"},{"line_number":327,"context_line":"        else:"},{"line_number":328,"context_line":"            if context.project_id:"},{"line_number":329,"context_line":"                search_opts[\u0027project_id\u0027] \u003d context.project_id"}],"source_content_type":"text/x-python","patch_set":5,"id":"ba5201f7_0e0520bb","line":326,"range":{"start_line":321,"start_character":16,"end_line":326,"end_character":74},"updated":"2017-01-04 08:42:39.000000000","message":"We should always check those old policy, whatever all_tenants_visiable is passed or not.\n\nSo we can check those old policy first, then check the all_tenants_visiable.\n\nAnd we can use this parameter https://github.com/openstack/nova/blob/df2fd4a252cecc1e1ef471c071e57526ddf65499/nova/context.py#L260\n\nAnd we need unittest to ensure this logic","commit_id":"d117d6c2965645fcb2184518ce8ccfd95a6f246e"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"f5656f7cf9e20512f07baa9488f471c47cabaec6","unresolved":false,"context_lines":[{"line_number":320,"context_line":"            else:"},{"line_number":321,"context_line":"                context.can("},{"line_number":322,"context_line":"                    server_policies.SERVERS % \u0027index:get_all_tenants\u0027)"},{"line_number":323,"context_line":"            if context.can(server_policies.SERVERS % \u0027all_tenants_visible\u0027,"},{"line_number":324,"context_line":"                           fatal\u003dFalse):"},{"line_number":325,"context_line":"                elevated \u003d context.elevated()"},{"line_number":326,"context_line":"        else:"}],"source_content_type":"text/x-python","patch_set":12,"id":"7a3c09a3_958018c2","line":323,"range":{"start_line":323,"start_character":15,"end_line":323,"end_character":75},"updated":"2017-01-17 06:16:06.000000000","message":"When this returns \u0027false\u0027, we should execute the code at line 327-330.","commit_id":"270381a07efc590103fd921de8898aac76a65c11"},{"author":{"_account_id":15888,"name":"Zhenyu Zheng","email":"zheng.zhenyu@outlook.com","username":"Kevin_Zheng"},"change_message_id":"166cb6ff25c36ee4d7e79cd0d1ffcae32f647c79","unresolved":false,"context_lines":[{"line_number":320,"context_line":"            else:"},{"line_number":321,"context_line":"                context.can("},{"line_number":322,"context_line":"                    server_policies.SERVERS % \u0027index:get_all_tenants\u0027)"},{"line_number":323,"context_line":"            if context.can(server_policies.SERVERS % \u0027all_tenants_visible\u0027,"},{"line_number":324,"context_line":"                           fatal\u003dFalse):"},{"line_number":325,"context_line":"                elevated \u003d context.elevated()"},{"line_number":326,"context_line":"        else:"}],"source_content_type":"text/x-python","patch_set":12,"id":"7a3c09a3_a0079016","line":323,"range":{"start_line":323,"start_character":15,"end_line":323,"end_character":75},"in_reply_to":"7a3c09a3_958018c2","updated":"2017-01-17 06:22:31.000000000","message":"Done","commit_id":"270381a07efc590103fd921de8898aac76a65c11"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"6d20540c8628c8b8ea8091be3f087eb208265e61","unresolved":false,"context_lines":[{"line_number":318,"context_line":"                    server_policies.SERVERS % \u0027detail:get_all_tenants\u0027)"},{"line_number":319,"context_line":"            else:"},{"line_number":320,"context_line":"                context.can("},{"line_number":321,"context_line":"                    server_policies.SERVERS % \u0027index:get_all_tenants\u0027)"},{"line_number":322,"context_line":"            if context.can(server_policies.SERVERS % \u0027all_tenants_visible\u0027,"},{"line_number":323,"context_line":"                           fatal\u003dFalse):"},{"line_number":324,"context_line":"                elevated \u003d context.elevated()"}],"source_content_type":"text/x-python","patch_set":15,"id":"7a3c09a3_df66f6eb","line":321,"range":{"start_line":321,"start_character":68,"end_line":321,"end_character":70},"updated":"2017-01-18 09:20:17.000000000","message":"can we log deprecation warning for those, or we can do generically in context.can and pass deprecated keyword from here.","commit_id":"b5ddea7d80d87abe1efaf7ad42dd246cfd4e8ce2"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"a382677f4b6c181f6ec6ddcad840f3d5760d7dcf","unresolved":false,"context_lines":[{"line_number":312,"context_line":"        search_opts.pop(\u0027all_tenants\u0027, None)"},{"line_number":313,"context_line":""},{"line_number":314,"context_line":"        elevated \u003d None"},{"line_number":315,"context_line":"        if all_tenants:"},{"line_number":316,"context_line":"            if is_detail:"},{"line_number":317,"context_line":"                context.can("},{"line_number":318,"context_line":"                    server_policies.SERVERS % \u0027detail:get_all_tenants\u0027)"}],"source_content_type":"text/x-python","patch_set":16,"id":"5a3905b3_a14e38bf","line":315,"updated":"2017-01-19 10:16:28.000000000","message":"Nit: Might be good to add the TODO here about the plans to make all_tenants mean view all tenants the token has access too, which in a hierarchy of tenants might mean multiple.","commit_id":"ed0d7ed610e637c48ba56175b0d91e24006f4be8"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"a382677f4b6c181f6ec6ddcad840f3d5760d7dcf","unresolved":false,"context_lines":[{"line_number":313,"context_line":""},{"line_number":314,"context_line":"        elevated \u003d None"},{"line_number":315,"context_line":"        if all_tenants:"},{"line_number":316,"context_line":"            if is_detail:"},{"line_number":317,"context_line":"                context.can("},{"line_number":318,"context_line":"                    server_policies.SERVERS % \u0027detail:get_all_tenants\u0027)"},{"line_number":319,"context_line":"            else:"},{"line_number":320,"context_line":"                context.can("},{"line_number":321,"context_line":"                    server_policies.SERVERS % \u0027index:get_all_tenants\u0027)"},{"line_number":322,"context_line":"            if context.can(server_policies.SERVERS % \u0027all_tenants_visible\u0027,"},{"line_number":323,"context_line":"                           fatal\u003dFalse):"},{"line_number":324,"context_line":"                elevated \u003d context.elevated()"}],"source_content_type":"text/x-python","patch_set":16,"id":"5a3905b3_017e2ce4","line":321,"range":{"start_line":316,"start_character":12,"end_line":321,"end_character":70},"updated":"2017-01-19 10:16:28.000000000","message":"For clarity this code should be dropped to carry out my suggestion around the policy rules.","commit_id":"ed0d7ed610e637c48ba56175b0d91e24006f4be8"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"bbe5d549a5f57d8b7a916c7efab0262a9b54f64e","unresolved":false,"context_lines":[{"line_number":322,"context_line":"            # Pike, if they are not overridden by the user, we will check"},{"line_number":323,"context_line":"            # for the new rule."},{"line_number":324,"context_line":"            if (_ENFORCER.file_rules.get("},{"line_number":325,"context_line":"                    \u0027os_compute_api:servers:detail:get_all_tenants\u0027) or"},{"line_number":326,"context_line":"                _ENFORCER.file_rules.get("},{"line_number":327,"context_line":"                    \u0027os_compute_api:servers:index:get_all_tenants\u0027)):"},{"line_number":328,"context_line":"                LOG.warning(\"The policy os_compute_api:servers:detail:\""}],"source_content_type":"text/x-python","patch_set":17,"id":"5a3905b3_bb613c07","line":325,"updated":"2017-01-24 06:52:13.000000000","message":"We should based on variable \u0027detail\u0027.","commit_id":"1131fe6bf82aef7c56da266aa8eaae2743f6a155"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"08a21c0ce4100e7497460477696e4c27599fdb64","unresolved":false,"context_lines":[{"line_number":321,"context_line":"            # use the old policy and log warning about deprecate them in"},{"line_number":322,"context_line":"            # Pike, if they are not overridden by the user, we will check"},{"line_number":323,"context_line":"            # for the new rule."},{"line_number":324,"context_line":"            if (_ENFORCER.file_rules.get("},{"line_number":325,"context_line":"                    \u0027os_compute_api:servers:detail:get_all_tenants\u0027) or"},{"line_number":326,"context_line":"                _ENFORCER.file_rules.get("},{"line_number":327,"context_line":"                    \u0027os_compute_api:servers:index:get_all_tenants\u0027)):"},{"line_number":328,"context_line":"                LOG.warning(\"The policy os_compute_api:servers:detail:\""},{"line_number":329,"context_line":"                            \"get_all_tenants and os_compute_api:servers:\""},{"line_number":330,"context_line":"                            \"index:get_all_tenants will be replaced by \""}],"source_content_type":"text/x-python","patch_set":18,"id":"5a3905b3_79d43beb","line":327,"range":{"start_line":324,"start_character":12,"end_line":327,"end_character":68},"updated":"2017-01-24 08:17:23.000000000","message":"should we add some test for this logic?","commit_id":"4af9f3ebd90e8ae10ed3846ed98846a37a5b9837"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"c0a2d826b9ac96512c57bfd6f25c06ded8082ea4","unresolved":false,"context_lines":[{"line_number":333,"context_line":"                old_all_tenants_rule \u003d (server_policies.SERVERS %"},{"line_number":334,"context_line":"                    \u0027detail:get_all_tenants\u0027)"},{"line_number":335,"context_line":""},{"line_number":336,"context_line":"            if policy.is_rule_override(old_all_tenants_rule):"},{"line_number":337,"context_line":"                LOG.warning(warn_msg, old_all_tenants_rule)"},{"line_number":338,"context_line":"                context.can(old_all_tenants_rule)"},{"line_number":339,"context_line":"                elevated \u003d context.elevated()"}],"source_content_type":"text/x-python","patch_set":21,"id":"5a3905b3_c79eef62","line":336,"range":{"start_line":336,"start_character":12,"end_line":336,"end_character":61},"updated":"2017-01-25 04:14:21.000000000","message":"So the case was considering if anyone just having rules in file with default value(by just uncommenting the sample file).\nThat case also looks like 1st case(rule is overridden) and the behavior will be same for those.\n\nIf new deployer having both rules(old and new) in file with default value (same approach, just uncomment sample file), then also it will enforcing the old rule with warning which also seems right way.","commit_id":"5e74a0ca7b26831db62087f1f5b5a2ed85be5666"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"915cd5aa3c91a3ffbc75b9f010e5c9f74369945c","unresolved":false,"context_lines":[{"line_number":335,"context_line":"                    \u0027detail:get_all_tenants\u0027)"},{"line_number":336,"context_line":""},{"line_number":337,"context_line":"            if policy.is_rule_override(old_all_tenants_rule):"},{"line_number":338,"context_line":"                LOG.warning(warn_msg, old_all_tenants_rule)"},{"line_number":339,"context_line":"                context.can(old_all_tenants_rule)"},{"line_number":340,"context_line":"                elevated \u003d context.elevated()"},{"line_number":341,"context_line":"            else:"}],"source_content_type":"text/x-python","patch_set":24,"id":"3a461143_af2ab57c","line":338,"updated":"2017-01-25 13:11:14.000000000","message":"I think we should do the logging else where:\nhttps://github.com/openstack/nova/blob/master/nova/policy.py#L83","commit_id":"971c0b9ed592e2b215de1a2bf4abecb57bb7ba73"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"915cd5aa3c91a3ffbc75b9f010e5c9f74369945c","unresolved":false,"context_lines":[{"line_number":336,"context_line":""},{"line_number":337,"context_line":"            if policy.is_rule_override(old_all_tenants_rule):"},{"line_number":338,"context_line":"                LOG.warning(warn_msg, old_all_tenants_rule)"},{"line_number":339,"context_line":"                context.can(old_all_tenants_rule)"},{"line_number":340,"context_line":"                elevated \u003d context.elevated()"},{"line_number":341,"context_line":"            else:"},{"line_number":342,"context_line":"                if context.can(server_policies.SERVERS %"}],"source_content_type":"text/x-python","patch_set":24,"id":"3a461143_6f31adec","line":339,"updated":"2017-01-25 13:11:14.000000000","message":"Are we missing an if statement here? surely only elevate the context if the rule passes?","commit_id":"971c0b9ed592e2b215de1a2bf4abecb57bb7ba73"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"128243cd7d19859f99374b6bae768e29314eaf0c","unresolved":false,"context_lines":[{"line_number":336,"context_line":""},{"line_number":337,"context_line":"            if policy.is_rule_override(old_all_tenants_rule):"},{"line_number":338,"context_line":"                LOG.warning(warn_msg, old_all_tenants_rule)"},{"line_number":339,"context_line":"                context.can(old_all_tenants_rule)"},{"line_number":340,"context_line":"                elevated \u003d context.elevated()"},{"line_number":341,"context_line":"            else:"},{"line_number":342,"context_line":"                if context.can(server_policies.SERVERS %"}],"source_content_type":"text/x-python","patch_set":24,"id":"3a461143_0fce6983","line":339,"in_reply_to":"3a461143_6f31adec","updated":"2017-01-25 13:21:30.000000000","message":"This enforced on the old rule. It is hard enforcement. When fail, the exception is raised.","commit_id":"971c0b9ed592e2b215de1a2bf4abecb57bb7ba73"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"0a6d569cd9d2de5dfc967212276143a28423bd45","unresolved":false,"context_lines":[{"line_number":316,"context_line":"        if all_tenants:"},{"line_number":317,"context_line":"            old_all_tenants_rule \u003d (server_policies.SERVERS %"},{"line_number":318,"context_line":"                \u0027index:get_all_tenants\u0027)"},{"line_number":319,"context_line":"            if is_detail:"},{"line_number":320,"context_line":"                old_all_tenants_rule \u003d (server_policies.SERVERS %"},{"line_number":321,"context_line":"                    \u0027detail:get_all_tenants\u0027)"},{"line_number":322,"context_line":"            if policy.is_rule_override(old_all_tenants_rule):"}],"source_content_type":"text/x-python","patch_set":25,"id":"3a461143_817201e4","line":319,"range":{"start_line":319,"start_character":15,"end_line":319,"end_character":24},"updated":"2017-01-26 09:45:00.000000000","message":"nit: this can be if/else logic with 317-318 lines","commit_id":"2e7a7d83e964ff703a15827149272ddf681ae0b5"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"0a6d569cd9d2de5dfc967212276143a28423bd45","unresolved":false,"context_lines":[{"line_number":321,"context_line":"                    \u0027detail:get_all_tenants\u0027)"},{"line_number":322,"context_line":"            if policy.is_rule_override(old_all_tenants_rule):"},{"line_number":323,"context_line":"                context.can(old_all_tenants_rule)"},{"line_number":324,"context_line":"                elevated \u003d context.elevated()"},{"line_number":325,"context_line":"            else:"},{"line_number":326,"context_line":"                context.can(server_policies.SERVERS %"},{"line_number":327,"context_line":"                            \u0027all_tenants_visible\u0027)"}],"source_content_type":"text/x-python","patch_set":25,"id":"3a461143_e12f459f","line":324,"range":{"start_line":324,"start_character":16,"end_line":324,"end_character":24},"updated":"2017-01-26 09:45:00.000000000","message":"nit: can move this out as both if/else will set this value","commit_id":"2e7a7d83e964ff703a15827149272ddf681ae0b5"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"283bba03957c750d5d4a2fa330de7096bab80bfa","unresolved":false,"context_lines":[{"line_number":321,"context_line":"                    \u0027detail:get_all_tenants\u0027)"},{"line_number":322,"context_line":"            if policy.is_rule_override(old_all_tenants_rule):"},{"line_number":323,"context_line":"                context.can(old_all_tenants_rule)"},{"line_number":324,"context_line":"                elevated \u003d context.elevated()"},{"line_number":325,"context_line":"            else:"},{"line_number":326,"context_line":"                context.can(server_policies.SERVERS %"},{"line_number":327,"context_line":"                            \u0027all_tenants_visible\u0027)"}],"source_content_type":"text/x-python","patch_set":25,"id":"3a461143_e2aae4d3","line":324,"range":{"start_line":324,"start_character":16,"end_line":324,"end_character":24},"in_reply_to":"3a461143_e12f459f","updated":"2017-01-26 11:38:47.000000000","message":"ok.","commit_id":"2e7a7d83e964ff703a15827149272ddf681ae0b5"}],"nova/policies/servers.py":[{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"6d2546f9dc69dc1c0c4a33e45a656d1a9717e905","unresolved":false,"context_lines":[{"line_number":24,"context_line":"    policy.RuleDefault(SERVERS % \u0027detail\u0027, RULE_AOO),"},{"line_number":25,"context_line":"    policy.RuleDefault(SERVERS % \u0027detail:get_all_tenants\u0027,"},{"line_number":26,"context_line":"                       base.RULE_ANY),"},{"line_number":27,"context_line":"    policy.RuleDefault(SERVERS % \u0027index:get_all_tenants\u0027, base.RULE_ANY),"},{"line_number":28,"context_line":"    policy.RuleDefault(SERVERS % \u0027all_tenants_visible\u0027, base.RULE_ADMIN_API),"},{"line_number":29,"context_line":"    policy.RuleDefault(SERVERS % \u0027show\u0027, RULE_AOO),"},{"line_number":30,"context_line":"    # the details in host_status are pretty sensitive, only admins"}],"source_content_type":"text/x-python","patch_set":5,"id":"ba5201f7_ae809447","line":27,"updated":"2017-01-04 08:42:39.000000000","message":"We \u0027d better to have a comment at here, to explain we plan to deprecate it.","commit_id":"d117d6c2965645fcb2184518ce8ccfd95a6f246e"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"6d20540c8628c8b8ea8091be3f087eb208265e61","unresolved":false,"context_lines":[{"line_number":22,"context_line":"rules \u003d ["},{"line_number":23,"context_line":"    policy.RuleDefault(SERVERS % \u0027index\u0027, RULE_AOO),"},{"line_number":24,"context_line":"    policy.RuleDefault(SERVERS % \u0027detail\u0027, RULE_AOO),"},{"line_number":25,"context_line":"    # The policy \u0027os_compute_api:servers:detail:get_all_tenants\u0027 and"},{"line_number":26,"context_line":"    # \u0027os_compute_api:servers:index:get_all_tenants\u0027 are deprecated."},{"line_number":27,"context_line":"    # The default rule changes to \u0027@\u0027. In next release, they will be removed."},{"line_number":28,"context_line":"    policy.RuleDefault(SERVERS % \u0027detail:get_all_tenants\u0027,"},{"line_number":29,"context_line":"                       base.RULE_ANY),"},{"line_number":30,"context_line":"    policy.RuleDefault(SERVERS % \u0027index:get_all_tenants\u0027, base.RULE_ANY),"}],"source_content_type":"text/x-python","patch_set":15,"id":"7a3c09a3_7f08a228","line":27,"range":{"start_line":25,"start_character":0,"end_line":27,"end_character":77},"updated":"2017-01-18 09:20:17.000000000","message":"Thinking if we can have more public way for policy rule deprecation?\nCan we add \u0027deprecation\u0027 for these rules when generating the sample policy file? at least deprecation information will help.","commit_id":"b5ddea7d80d87abe1efaf7ad42dd246cfd4e8ce2"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"89e3934c197f40dd49d9681c6aa10970cff7cb87","unresolved":false,"context_lines":[{"line_number":32,"context_line":"    # introduced. It is now a soft enforcement rule. When the"},{"line_number":33,"context_line":"    # user can\u0027t pass the rule, the API still return successfully,"},{"line_number":34,"context_line":"    # but the user only can see his own instances."},{"line_number":35,"context_line":"    policy.RuleDefault(SERVERS % \u0027all_tenants_visible\u0027, base.RULE_ADMIN_API),"},{"line_number":36,"context_line":"    policy.RuleDefault(SERVERS % \u0027show\u0027, RULE_AOO),"},{"line_number":37,"context_line":"    # the details in host_status are pretty sensitive, only admins"},{"line_number":38,"context_line":"    # should do that by default."}],"source_content_type":"text/x-python","patch_set":16,"id":"7a3c09a3_3770f3a3","line":35,"range":{"start_line":35,"start_character":56,"end_line":35,"end_character":75},"updated":"2017-01-18 13:17:06.000000000","message":"For backwards compatibility, could we not default to \"index:get_all_tenants\"?","commit_id":"ed0d7ed610e637c48ba56175b0d91e24006f4be8"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"27581d17ad95cdcc0e8cae50d4310730911e6f3d","unresolved":false,"context_lines":[{"line_number":32,"context_line":"    # introduced. It is now a soft enforcement rule. When the"},{"line_number":33,"context_line":"    # user can\u0027t pass the rule, the API still return successfully,"},{"line_number":34,"context_line":"    # but the user only can see his own instances."},{"line_number":35,"context_line":"    policy.RuleDefault(SERVERS % \u0027all_tenants_visible\u0027, base.RULE_ADMIN_API),"},{"line_number":36,"context_line":"    policy.RuleDefault(SERVERS % \u0027show\u0027, RULE_AOO),"},{"line_number":37,"context_line":"    # the details in host_status are pretty sensitive, only admins"},{"line_number":38,"context_line":"    # should do that by default."}],"source_content_type":"text/x-python","patch_set":16,"id":"5a3905b3_61aa9e1b","line":35,"range":{"start_line":35,"start_character":56,"end_line":35,"end_character":75},"in_reply_to":"5a3905b3_01147af3","updated":"2017-01-19 03:41:00.000000000","message":"After rethink, if the most important thing is that operator should have a smooth upgrade, then we enable the new rule in pike, sounds reasonable.","commit_id":"ed0d7ed610e637c48ba56175b0d91e24006f4be8"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"2a18b21351d8bca2ff99bf0c8b0da2926a4fbd74","unresolved":false,"context_lines":[{"line_number":32,"context_line":"    # introduced. It is now a soft enforcement rule. When the"},{"line_number":33,"context_line":"    # user can\u0027t pass the rule, the API still return successfully,"},{"line_number":34,"context_line":"    # but the user only can see his own instances."},{"line_number":35,"context_line":"    policy.RuleDefault(SERVERS % \u0027all_tenants_visible\u0027, base.RULE_ADMIN_API),"},{"line_number":36,"context_line":"    policy.RuleDefault(SERVERS % \u0027show\u0027, RULE_AOO),"},{"line_number":37,"context_line":"    # the details in host_status are pretty sensitive, only admins"},{"line_number":38,"context_line":"    # should do that by default."}],"source_content_type":"text/x-python","patch_set":16,"id":"5a3905b3_7e3294f3","line":35,"in_reply_to":"5a3905b3_104a7d55","updated":"2017-01-23 10:46:41.000000000","message":"We can use \u0027_ENFORCER.file_rules\u0027 to check whether there is override rule in the policy.json.\n\nhttps://github.com/openstack/oslo.policy/blob/master/oslo_policy/policy.py#L656","commit_id":"ed0d7ed610e637c48ba56175b0d91e24006f4be8"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"cefb81742071dcf0c6f0a514d5bd65f66a1fa5d9","unresolved":false,"context_lines":[{"line_number":32,"context_line":"    # introduced. It is now a soft enforcement rule. When the"},{"line_number":33,"context_line":"    # user can\u0027t pass the rule, the API still return successfully,"},{"line_number":34,"context_line":"    # but the user only can see his own instances."},{"line_number":35,"context_line":"    policy.RuleDefault(SERVERS % \u0027all_tenants_visible\u0027, base.RULE_ADMIN_API),"},{"line_number":36,"context_line":"    policy.RuleDefault(SERVERS % \u0027show\u0027, RULE_AOO),"},{"line_number":37,"context_line":"    # the details in host_status are pretty sensitive, only admins"},{"line_number":38,"context_line":"    # should do that by default."}],"source_content_type":"text/x-python","patch_set":16,"id":"5a3905b3_22d4cf45","line":35,"range":{"start_line":35,"start_character":56,"end_line":35,"end_character":75},"in_reply_to":"5a3905b3_210c0894","updated":"2017-01-20 06:20:04.000000000","message":"Thinking of the implementation. If we default new rule to old rule, we can\u0027t keep the new behavior for new deployer.\n\nThe new rule is soft enforcement, the new behavior expected as not return 403 to the user. But the old rule will return 403. That is the reason why we set the old rule to open for anyone.","commit_id":"ed0d7ed610e637c48ba56175b0d91e24006f4be8"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"60708c64b8918326f01c0be491e30c91cb43d42a","unresolved":false,"context_lines":[{"line_number":32,"context_line":"    # introduced. It is now a soft enforcement rule. When the"},{"line_number":33,"context_line":"    # user can\u0027t pass the rule, the API still return successfully,"},{"line_number":34,"context_line":"    # but the user only can see his own instances."},{"line_number":35,"context_line":"    policy.RuleDefault(SERVERS % \u0027all_tenants_visible\u0027, base.RULE_ADMIN_API),"},{"line_number":36,"context_line":"    policy.RuleDefault(SERVERS % \u0027show\u0027, RULE_AOO),"},{"line_number":37,"context_line":"    # the details in host_status are pretty sensitive, only admins"},{"line_number":38,"context_line":"    # should do that by default."}],"source_content_type":"text/x-python","patch_set":16,"id":"5a3905b3_d39f5e01","line":35,"range":{"start_line":35,"start_character":56,"end_line":35,"end_character":75},"in_reply_to":"5a3905b3_22d4cf45","updated":"2017-01-20 09:03:58.000000000","message":"true. I am also not sure how to identify all these 3 cases differently in code. even if we consider that if detail:get_all_tenants\u0027 !\u003d base.RULE_ANY as 1st case that also not true in all cases as someone might have overridden to @.\n\nHow about not enforcing the new behavior to 2nd and 3rd case also (new deployer and has not overridden rule in policy file) in Ocata and log warning for them also about new rule and say behavior will change from 403 to soft enforcement in Pike. like below-\n       - Enforce old rule which gives same behavior But with warning about\n         1. Old rule are deprecated and will be removed so switch to new rule \u0027all_tenants_visible\u0027\n         2. Currently new rule is defaulted to old rule \n         3. In Pike cycle, new rule will be changed from 403 to soft enforcement.\n\nSo overall \n - Introduced new rule in this cycle with default to old rule \n - Enforce new behavior in Pike once all deployer switched to new rule.","commit_id":"ed0d7ed610e637c48ba56175b0d91e24006f4be8"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"a382677f4b6c181f6ec6ddcad840f3d5760d7dcf","unresolved":false,"context_lines":[{"line_number":32,"context_line":"    # introduced. It is now a soft enforcement rule. When the"},{"line_number":33,"context_line":"    # user can\u0027t pass the rule, the API still return successfully,"},{"line_number":34,"context_line":"    # but the user only can see his own instances."},{"line_number":35,"context_line":"    policy.RuleDefault(SERVERS % \u0027all_tenants_visible\u0027, base.RULE_ADMIN_API),"},{"line_number":36,"context_line":"    policy.RuleDefault(SERVERS % \u0027show\u0027, RULE_AOO),"},{"line_number":37,"context_line":"    # the details in host_status are pretty sensitive, only admins"},{"line_number":38,"context_line":"    # should do that by default."}],"source_content_type":"text/x-python","patch_set":16,"id":"5a3905b3_210c0894","line":35,"range":{"start_line":35,"start_character":56,"end_line":35,"end_character":75},"in_reply_to":"5a3905b3_61aa9e1b","updated":"2017-01-19 10:16:28.000000000","message":"So there are three cases:\n* upgrade, has overridden rule in policy file\n* upgrade, has not overridden rule in policy file\n* new deployer\n\nNow new deployer and not overridden are the same case really. They both should get the new behaviour right away. i.e. we only check all_tenants_visible.\n\nNow in the overridden case, we can default all_tenants_visible to the old rules, so if they loosed it in the past, it should be loosed in the future. For this case we can log warning that they are overriding the wrong rule to make these changes.","commit_id":"ed0d7ed610e637c48ba56175b0d91e24006f4be8"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"d56f4bf45b886b1679fd2c116d9034535b4ca04a","unresolved":false,"context_lines":[{"line_number":32,"context_line":"    # introduced. It is now a soft enforcement rule. When the"},{"line_number":33,"context_line":"    # user can\u0027t pass the rule, the API still return successfully,"},{"line_number":34,"context_line":"    # but the user only can see his own instances."},{"line_number":35,"context_line":"    policy.RuleDefault(SERVERS % \u0027all_tenants_visible\u0027, base.RULE_ADMIN_API),"},{"line_number":36,"context_line":"    policy.RuleDefault(SERVERS % \u0027show\u0027, RULE_AOO),"},{"line_number":37,"context_line":"    # the details in host_status are pretty sensitive, only admins"},{"line_number":38,"context_line":"    # should do that by default."}],"source_content_type":"text/x-python","patch_set":16,"id":"5a3905b3_104a7d55","line":35,"in_reply_to":"5a3905b3_d39f5e01","updated":"2017-01-22 03:00:33.000000000","message":"@Ghanshyam, yea, that sounds a plan, we can\u0027t match all 3 cases totally.\n\nAnother way is we enforce the new behavior to 2nd and 3rd case. That enforced by the old rule with RULE_ANY and the new rule with ADMIN_API.\n\nThen we have a check, if the user override the default rule for old rule in policy.json, then we skip the check for the new rule and log a warning, suggest deploy removing the old rule from policy.json and we will remove the old rule in Pike.","commit_id":"ed0d7ed610e637c48ba56175b0d91e24006f4be8"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"00bb0a91aea10cfd22495f9c7052859ecf40073b","unresolved":false,"context_lines":[{"line_number":32,"context_line":"    # introduced. It is now a soft enforcement rule. When the"},{"line_number":33,"context_line":"    # user can\u0027t pass the rule, the API still return successfully,"},{"line_number":34,"context_line":"    # but the user only can see his own instances."},{"line_number":35,"context_line":"    policy.RuleDefault(SERVERS % \u0027all_tenants_visible\u0027, base.RULE_ADMIN_API),"},{"line_number":36,"context_line":"    policy.RuleDefault(SERVERS % \u0027show\u0027, RULE_AOO),"},{"line_number":37,"context_line":"    # the details in host_status are pretty sensitive, only admins"},{"line_number":38,"context_line":"    # should do that by default."}],"source_content_type":"text/x-python","patch_set":16,"id":"5a3905b3_01147af3","line":35,"range":{"start_line":35,"start_character":56,"end_line":35,"end_character":75},"in_reply_to":"7a3c09a3_17985769","updated":"2017-01-19 03:18:24.000000000","message":"The new rule\u0027s goal is not return 403 for the user anymore.\n\nIf we change \"index:get_all_tenants\" back to the rule:admin_api, that means user still get 400 even for new deployment user.\n\nSo the new rule doesn\u0027t work for the new deployment user util we remove the old rule in pike and the user upgrade to pike.\n\nIs that we expected?\n\nwe can still make the old rule to open for anyone. But we still can have a log if user change old rule in policy.json","commit_id":"ed0d7ed610e637c48ba56175b0d91e24006f4be8"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"1baee068a2844387b6c1b82ba7668420fdf9d211","unresolved":false,"context_lines":[{"line_number":32,"context_line":"    # introduced. It is now a soft enforcement rule. When the"},{"line_number":33,"context_line":"    # user can\u0027t pass the rule, the API still return successfully,"},{"line_number":34,"context_line":"    # but the user only can see his own instances."},{"line_number":35,"context_line":"    policy.RuleDefault(SERVERS % \u0027all_tenants_visible\u0027, base.RULE_ADMIN_API),"},{"line_number":36,"context_line":"    policy.RuleDefault(SERVERS % \u0027show\u0027, RULE_AOO),"},{"line_number":37,"context_line":"    # the details in host_status are pretty sensitive, only admins"},{"line_number":38,"context_line":"    # should do that by default."}],"source_content_type":"text/x-python","patch_set":16,"id":"7a3c09a3_17985769","line":35,"range":{"start_line":35,"start_character":56,"end_line":35,"end_character":75},"in_reply_to":"7a3c09a3_3770f3a3","updated":"2017-01-18 13:24:53.000000000","message":"What I am thinking here, is we log a warning if someone changes index:get_all_tenants from its default value (or detail:get_all_tenants), and warn that there is a new policy file.\n\nWe could default the new one to \"rule:index:get_all_tenants\u0027 or \u0027ruledetail:get_all_tenants\u0027 I guess?","commit_id":"ed0d7ed610e637c48ba56175b0d91e24006f4be8"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"c0a2d826b9ac96512c57bfd6f25c06ded8082ea4","unresolved":false,"context_lines":[{"line_number":26,"context_line":"    # \u0027os_compute_api:servers:index:get_all_tenants\u0027 are deprecated."},{"line_number":27,"context_line":"    # The default rule changes to \u0027@\u0027. In next release, they will be removed."},{"line_number":28,"context_line":"    policy.RuleDefault(SERVERS % \u0027detail:get_all_tenants\u0027,"},{"line_number":29,"context_line":"                       base.RULE_ANY),"},{"line_number":30,"context_line":"    policy.RuleDefault(SERVERS % \u0027index:get_all_tenants\u0027, base.RULE_ANY),"},{"line_number":31,"context_line":"    # The new rule \u0027os_compute_api:servers:all_tenants_visible\u0027 is"},{"line_number":32,"context_line":"    # introduced. If the user overridden the above two old policies"}],"source_content_type":"text/x-python","patch_set":21,"id":"5a3905b3_67861b15","line":29,"range":{"start_line":29,"start_character":28,"end_line":29,"end_character":36},"updated":"2017-01-25 04:14:21.000000000","message":"as old rules will not come into pic if rule is not overridden then, we can leave old values same as previous.?","commit_id":"5e74a0ca7b26831db62087f1f5b5a2ed85be5666"},{"author":{"_account_id":15888,"name":"Zhenyu Zheng","email":"zheng.zhenyu@outlook.com","username":"Kevin_Zheng"},"change_message_id":"68e78a8af19dc4f42c484f8d7521427c761af9d4","unresolved":false,"context_lines":[{"line_number":26,"context_line":"    # \u0027os_compute_api:servers:index:get_all_tenants\u0027 are deprecated."},{"line_number":27,"context_line":"    # The default rule changes to \u0027@\u0027. In next release, they will be removed."},{"line_number":28,"context_line":"    policy.RuleDefault(SERVERS % \u0027detail:get_all_tenants\u0027,"},{"line_number":29,"context_line":"                       base.RULE_ANY),"},{"line_number":30,"context_line":"    policy.RuleDefault(SERVERS % \u0027index:get_all_tenants\u0027, base.RULE_ANY),"},{"line_number":31,"context_line":"    # The new rule \u0027os_compute_api:servers:all_tenants_visible\u0027 is"},{"line_number":32,"context_line":"    # introduced. If the user overridden the above two old policies"}],"source_content_type":"text/x-python","patch_set":21,"id":"5a3905b3_939fc94f","line":29,"range":{"start_line":29,"start_character":28,"end_line":29,"end_character":36},"in_reply_to":"5a3905b3_67861b15","updated":"2017-01-25 06:39:23.000000000","message":"Done","commit_id":"5e74a0ca7b26831db62087f1f5b5a2ed85be5666"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"c0a2d826b9ac96512c57bfd6f25c06ded8082ea4","unresolved":false,"context_lines":[{"line_number":27,"context_line":"    # The default rule changes to \u0027@\u0027. In next release, they will be removed."},{"line_number":28,"context_line":"    policy.RuleDefault(SERVERS % \u0027detail:get_all_tenants\u0027,"},{"line_number":29,"context_line":"                       base.RULE_ANY),"},{"line_number":30,"context_line":"    policy.RuleDefault(SERVERS % \u0027index:get_all_tenants\u0027, base.RULE_ANY),"},{"line_number":31,"context_line":"    # The new rule \u0027os_compute_api:servers:all_tenants_visible\u0027 is"},{"line_number":32,"context_line":"    # introduced. If the user overridden the above two old policies"},{"line_number":33,"context_line":"    # this rule will not be checked, if the above two old policies"}],"source_content_type":"text/x-python","patch_set":21,"id":"5a3905b3_a778032d","line":30,"range":{"start_line":30,"start_character":63,"end_line":30,"end_character":71},"updated":"2017-01-25 04:14:21.000000000","message":"ditto","commit_id":"5e74a0ca7b26831db62087f1f5b5a2ed85be5666"},{"author":{"_account_id":15888,"name":"Zhenyu Zheng","email":"zheng.zhenyu@outlook.com","username":"Kevin_Zheng"},"change_message_id":"68e78a8af19dc4f42c484f8d7521427c761af9d4","unresolved":false,"context_lines":[{"line_number":27,"context_line":"    # The default rule changes to \u0027@\u0027. In next release, they will be removed."},{"line_number":28,"context_line":"    policy.RuleDefault(SERVERS % \u0027detail:get_all_tenants\u0027,"},{"line_number":29,"context_line":"                       base.RULE_ANY),"},{"line_number":30,"context_line":"    policy.RuleDefault(SERVERS % \u0027index:get_all_tenants\u0027, base.RULE_ANY),"},{"line_number":31,"context_line":"    # The new rule \u0027os_compute_api:servers:all_tenants_visible\u0027 is"},{"line_number":32,"context_line":"    # introduced. If the user overridden the above two old policies"},{"line_number":33,"context_line":"    # this rule will not be checked, if the above two old policies"}],"source_content_type":"text/x-python","patch_set":21,"id":"5a3905b3_b3acc58d","line":30,"range":{"start_line":30,"start_character":63,"end_line":30,"end_character":71},"in_reply_to":"5a3905b3_a778032d","updated":"2017-01-25 06:39:23.000000000","message":"Done","commit_id":"5e74a0ca7b26831db62087f1f5b5a2ed85be5666"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"6937e84cb1b1262abe7673bd7da82b8f9a465646","unresolved":false,"context_lines":[{"line_number":24,"context_line":"    policy.RuleDefault(SERVERS % \u0027detail\u0027, RULE_AOO),"},{"line_number":25,"context_line":"    # The policy \u0027os_compute_api:servers:detail:get_all_tenants\u0027 and"},{"line_number":26,"context_line":"    # \u0027os_compute_api:servers:index:get_all_tenants\u0027 are deprecated."},{"line_number":27,"context_line":"    # The default rule changes to \u0027@\u0027. In next release, they will be removed."},{"line_number":28,"context_line":"    policy.RuleDefault(SERVERS % \u0027detail:get_all_tenants\u0027,"},{"line_number":29,"context_line":"                       base.RULE_ADMIN_API),"},{"line_number":30,"context_line":"    policy.RuleDefault(SERVERS % \u0027index:get_all_tenants\u0027, base.RULE_ADMIN_API),"}],"source_content_type":"text/x-python","patch_set":23,"id":"5a3905b3_d01f79b5","line":27,"range":{"start_line":27,"start_character":6,"end_line":27,"end_character":37},"updated":"2017-01-25 12:05:09.000000000","message":"you need to remove this now.","commit_id":"b4dce46d12f6ab8fc5375141d3dcc388f4920f23"}],"nova/policy.py":[{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"51bf3068775f80f0c3c060e380e5d1e824478c73","unresolved":false,"context_lines":[{"line_number":80,"context_line":""},{"line_number":81,"context_line":"    # Checks whether the rules are updated in the runtime"},{"line_number":82,"context_line":"    if saved_file_rules !\u003d current_file_rules:"},{"line_number":83,"context_line":"        _warning_for_deprecated_user_based_rules(current_file_rules)"},{"line_number":84,"context_line":"        saved_file_rules \u003d copy.deepcopy(current_file_rules)"},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"    # A new rule all_tenants_visible in introduced to replace"}],"source_content_type":"text/x-python","patch_set":25,"id":"3a461143_fc5fea0b","line":83,"updated":"2017-01-26 09:46:57.000000000","message":"How about warning at here?\n\nThen each time the deployer update the policy config, there will be a warning message.","commit_id":"2e7a7d83e964ff703a15827149272ddf681ae0b5"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"283bba03957c750d5d4a2fa330de7096bab80bfa","unresolved":false,"context_lines":[{"line_number":80,"context_line":""},{"line_number":81,"context_line":"    # Checks whether the rules are updated in the runtime"},{"line_number":82,"context_line":"    if saved_file_rules !\u003d current_file_rules:"},{"line_number":83,"context_line":"        _warning_for_deprecated_user_based_rules(current_file_rules)"},{"line_number":84,"context_line":"        saved_file_rules \u003d copy.deepcopy(current_file_rules)"},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"    # A new rule all_tenants_visible in introduced to replace"}],"source_content_type":"text/x-python","patch_set":25,"id":"3a461143_023b70d2","line":83,"in_reply_to":"3a461143_5cf39e0a","updated":"2017-01-26 11:38:47.000000000","message":"thanks ll add that.","commit_id":"2e7a7d83e964ff703a15827149272ddf681ae0b5"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"283a2be33e16d6b7c72e07f69ef04a70830e85b7","unresolved":false,"context_lines":[{"line_number":80,"context_line":""},{"line_number":81,"context_line":"    # Checks whether the rules are updated in the runtime"},{"line_number":82,"context_line":"    if saved_file_rules !\u003d current_file_rules:"},{"line_number":83,"context_line":"        _warning_for_deprecated_user_based_rules(current_file_rules)"},{"line_number":84,"context_line":"        saved_file_rules \u003d copy.deepcopy(current_file_rules)"},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"    # A new rule all_tenants_visible in introduced to replace"}],"source_content_type":"text/x-python","patch_set":25,"id":"3a461143_b76e54c7","line":83,"in_reply_to":"3a461143_822680b8","updated":"2017-01-26 12:49:59.000000000","message":"Emm...sorry, I may not get you. You want to warn at anytime the rule is overriden? That is just right under the if statement.  Also as line 179,  init() will be called in every enforcement. That means the warning will show each time.","commit_id":"2e7a7d83e964ff703a15827149272ddf681ae0b5"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"f57cc4e03b2f44562938cc8f00f78fdb82dda2bb","unresolved":false,"context_lines":[{"line_number":80,"context_line":""},{"line_number":81,"context_line":"    # Checks whether the rules are updated in the runtime"},{"line_number":82,"context_line":"    if saved_file_rules !\u003d current_file_rules:"},{"line_number":83,"context_line":"        _warning_for_deprecated_user_based_rules(current_file_rules)"},{"line_number":84,"context_line":"        saved_file_rules \u003d copy.deepcopy(current_file_rules)"},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"    # A new rule all_tenants_visible in introduced to replace"}],"source_content_type":"text/x-python","patch_set":25,"id":"3a461143_5cf39e0a","line":83,"in_reply_to":"3a461143_fc5fea0b","updated":"2017-01-26 09:48:54.000000000","message":"And we can have test at https://github.com/openstack/nova/blob/master/nova/tests/unit/test_policy.py#L161","commit_id":"2e7a7d83e964ff703a15827149272ddf681ae0b5"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"283bba03957c750d5d4a2fa330de7096bab80bfa","unresolved":false,"context_lines":[{"line_number":80,"context_line":""},{"line_number":81,"context_line":"    # Checks whether the rules are updated in the runtime"},{"line_number":82,"context_line":"    if saved_file_rules !\u003d current_file_rules:"},{"line_number":83,"context_line":"        _warning_for_deprecated_user_based_rules(current_file_rules)"},{"line_number":84,"context_line":"        saved_file_rules \u003d copy.deepcopy(current_file_rules)"},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"    # A new rule all_tenants_visible in introduced to replace"}],"source_content_type":"text/x-python","patch_set":25,"id":"3a461143_822680b8","line":83,"in_reply_to":"3a461143_fc5fea0b","updated":"2017-01-26 11:38:47.000000000","message":"I think it better to warn if there is any old rule is overridden irrespective of policy file is updated or not.","commit_id":"2e7a7d83e964ff703a15827149272ddf681ae0b5"}],"nova/tests/unit/api/openstack/compute/test_serversV21.py":[{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"f5656f7cf9e20512f07baa9488f471c47cabaec6","unresolved":false,"context_lines":[{"line_number":889,"context_line":"        # will be limited to their own instances."},{"line_number":890,"context_line":"        def fake_get_all(api, context, search_opts\u003dNone, **kwargs):"},{"line_number":891,"context_line":"            self.assertIsNotNone(search_opts)"},{"line_number":892,"context_line":"            self.assertNotIn(\u0027project_id\u0027, search_opts)"},{"line_number":893,"context_line":"            self.assertFalse(context.is_admin)"},{"line_number":894,"context_line":"            return [fakes.stub_instance_obj(100)]"},{"line_number":895,"context_line":""}],"source_content_type":"text/x-python","patch_set":12,"id":"7a3c09a3_95c3b8ec","line":892,"updated":"2017-01-17 06:16:06.000000000","message":"the project_id and user_id should be in the search_opts, right? When \u0027os_compute_api:servers:all_tenants_visible\u0027 return false, we expect return user-owned instances, so the project_id and user_id should be in the search_opts","commit_id":"270381a07efc590103fd921de8898aac76a65c11"},{"author":{"_account_id":15888,"name":"Zhenyu Zheng","email":"zheng.zhenyu@outlook.com","username":"Kevin_Zheng"},"change_message_id":"166cb6ff25c36ee4d7e79cd0d1ffcae32f647c79","unresolved":false,"context_lines":[{"line_number":889,"context_line":"        # will be limited to their own instances."},{"line_number":890,"context_line":"        def fake_get_all(api, context, search_opts\u003dNone, **kwargs):"},{"line_number":891,"context_line":"            self.assertIsNotNone(search_opts)"},{"line_number":892,"context_line":"            self.assertNotIn(\u0027project_id\u0027, search_opts)"},{"line_number":893,"context_line":"            self.assertFalse(context.is_admin)"},{"line_number":894,"context_line":"            return [fakes.stub_instance_obj(100)]"},{"line_number":895,"context_line":""}],"source_content_type":"text/x-python","patch_set":12,"id":"7a3c09a3_802d3497","line":892,"in_reply_to":"7a3c09a3_95c3b8ec","updated":"2017-01-17 06:22:31.000000000","message":"Done","commit_id":"270381a07efc590103fd921de8898aac76a65c11"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"c0a2d826b9ac96512c57bfd6f25c06ded8082ea4","unresolved":false,"context_lines":[{"line_number":861,"context_line":"    def test_all_tenants_enforce_on_old_rule_pass(self):"},{"line_number":862,"context_line":"        def fake_get_all(api, context, search_opts\u003dNone, **kwargs):"},{"line_number":863,"context_line":"            self.assertIsNotNone(search_opts)"},{"line_number":864,"context_line":"            self.assertNotIn(\u0027project_id\u0027, search_opts)"},{"line_number":865,"context_line":"            return [fakes.stub_instance_obj(100)]"},{"line_number":866,"context_line":""},{"line_number":867,"context_line":"        # The old rule will be enforced when there is override in policy.json."}],"source_content_type":"text/x-python","patch_set":21,"id":"5a3905b3_84c9455d","line":864,"range":{"start_line":864,"start_character":54,"end_line":864,"end_character":55},"updated":"2017-01-25 04:14:21.000000000","message":"self.assertTrue(context.is_admin)","commit_id":"5e74a0ca7b26831db62087f1f5b5a2ed85be5666"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"b106b61b471d3a65024fd600e57261882c161a26","unresolved":false,"context_lines":[{"line_number":861,"context_line":"    def test_all_tenants_enforce_on_old_rule_pass(self):"},{"line_number":862,"context_line":"        def fake_get_all(api, context, search_opts\u003dNone, **kwargs):"},{"line_number":863,"context_line":"            self.assertIsNotNone(search_opts)"},{"line_number":864,"context_line":"            self.assertNotIn(\u0027project_id\u0027, search_opts)"},{"line_number":865,"context_line":"            return [fakes.stub_instance_obj(100)]"},{"line_number":866,"context_line":""},{"line_number":867,"context_line":"        # The old rule will be enforced when there is override in policy.json."}],"source_content_type":"text/x-python","patch_set":21,"id":"5a3905b3_70488588","line":864,"range":{"start_line":864,"start_character":54,"end_line":864,"end_character":55},"in_reply_to":"5a3905b3_73a25d9c","updated":"2017-01-25 12:05:40.000000000","message":"seems like missed to fix this?","commit_id":"5e74a0ca7b26831db62087f1f5b5a2ed85be5666"},{"author":{"_account_id":15888,"name":"Zhenyu Zheng","email":"zheng.zhenyu@outlook.com","username":"Kevin_Zheng"},"change_message_id":"68e78a8af19dc4f42c484f8d7521427c761af9d4","unresolved":false,"context_lines":[{"line_number":861,"context_line":"    def test_all_tenants_enforce_on_old_rule_pass(self):"},{"line_number":862,"context_line":"        def fake_get_all(api, context, search_opts\u003dNone, **kwargs):"},{"line_number":863,"context_line":"            self.assertIsNotNone(search_opts)"},{"line_number":864,"context_line":"            self.assertNotIn(\u0027project_id\u0027, search_opts)"},{"line_number":865,"context_line":"            return [fakes.stub_instance_obj(100)]"},{"line_number":866,"context_line":""},{"line_number":867,"context_line":"        # The old rule will be enforced when there is override in policy.json."}],"source_content_type":"text/x-python","patch_set":21,"id":"5a3905b3_73a25d9c","line":864,"range":{"start_line":864,"start_character":54,"end_line":864,"end_character":55},"in_reply_to":"5a3905b3_84c9455d","updated":"2017-01-25 06:39:23.000000000","message":"Done","commit_id":"5e74a0ca7b26831db62087f1f5b5a2ed85be5666"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"c0a2d826b9ac96512c57bfd6f25c06ded8082ea4","unresolved":false,"context_lines":[{"line_number":910,"context_line":""},{"line_number":911,"context_line":"        req \u003d self.req(\u0027/fake/servers?all_tenants\u003d1\u0027)"},{"line_number":912,"context_line":"        self.assertRaises(exception.PolicyNotAuthorized,"},{"line_number":913,"context_line":"            self.controller.index, req)"},{"line_number":914,"context_line":""},{"line_number":915,"context_line":"    def test_get_servers_allows_flavor(self):"},{"line_number":916,"context_line":"        server_uuid \u003d uuids.fake"}],"source_content_type":"text/x-python","patch_set":21,"id":"5a3905b3_07039777","line":913,"range":{"start_line":913,"start_character":38,"end_line":913,"end_character":39},"updated":"2017-01-25 04:14:21.000000000","message":"can we have tests case with new rule \u0027all_tenants_visible\u0027 (without old) only for\n1. overridden case\n2. not overridden case","commit_id":"5e74a0ca7b26831db62087f1f5b5a2ed85be5666"},{"author":{"_account_id":15888,"name":"Zhenyu Zheng","email":"zheng.zhenyu@outlook.com","username":"Kevin_Zheng"},"change_message_id":"68e78a8af19dc4f42c484f8d7521427c761af9d4","unresolved":false,"context_lines":[{"line_number":910,"context_line":""},{"line_number":911,"context_line":"        req \u003d self.req(\u0027/fake/servers?all_tenants\u003d1\u0027)"},{"line_number":912,"context_line":"        self.assertRaises(exception.PolicyNotAuthorized,"},{"line_number":913,"context_line":"            self.controller.index, req)"},{"line_number":914,"context_line":""},{"line_number":915,"context_line":"    def test_get_servers_allows_flavor(self):"},{"line_number":916,"context_line":"        server_uuid \u003d uuids.fake"}],"source_content_type":"text/x-python","patch_set":21,"id":"5a3905b3_539d6158","line":913,"range":{"start_line":913,"start_character":38,"end_line":913,"end_character":39},"in_reply_to":"5a3905b3_07039777","updated":"2017-01-25 06:39:23.000000000","message":"I don\u0027t quite get what you mean by new rule only and with (not) overridden case, I think we are overridden the old rule, and think the current tests already tested all cases well.","commit_id":"5e74a0ca7b26831db62087f1f5b5a2ed85be5666"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"b106b61b471d3a65024fd600e57261882c161a26","unresolved":false,"context_lines":[{"line_number":910,"context_line":""},{"line_number":911,"context_line":"        req \u003d self.req(\u0027/fake/servers?all_tenants\u003d1\u0027)"},{"line_number":912,"context_line":"        self.assertRaises(exception.PolicyNotAuthorized,"},{"line_number":913,"context_line":"            self.controller.index, req)"},{"line_number":914,"context_line":""},{"line_number":915,"context_line":"    def test_get_servers_allows_flavor(self):"},{"line_number":916,"context_line":"        server_uuid \u003d uuids.fake"}],"source_content_type":"text/x-python","patch_set":21,"id":"5a3905b3_b0acad36","line":913,"range":{"start_line":913,"start_character":38,"end_line":913,"end_character":39},"in_reply_to":"5a3905b3_539d6158","updated":"2017-01-25 12:05:40.000000000","message":"I mean tests with having new rule \u0027all_tenants_visible\u0027 only.\nSo that we can test the new deployer case","commit_id":"5e74a0ca7b26831db62087f1f5b5a2ed85be5666"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"6937e84cb1b1262abe7673bd7da82b8f9a465646","unresolved":false,"context_lines":[{"line_number":964,"context_line":""},{"line_number":965,"context_line":"        req \u003d self.req(\u0027/fake/servers?all_tenants\u003d1\u0027)"},{"line_number":966,"context_line":"        self.assertRaises(exception.PolicyNotAuthorized,"},{"line_number":967,"context_line":"            self.controller.index, req)"},{"line_number":968,"context_line":""},{"line_number":969,"context_line":"    def test_get_servers_allows_flavor(self):"},{"line_number":970,"context_line":"        server_uuid \u003d uuids.fake"}],"source_content_type":"text/x-python","patch_set":23,"id":"5a3905b3_503aa9e8","line":967,"range":{"start_line":967,"start_character":38,"end_line":967,"end_character":39},"updated":"2017-01-25 12:05:09.000000000","message":"i still think tests with new rules only will be nice here.","commit_id":"b4dce46d12f6ab8fc5375141d3dcc388f4920f23"}]}