)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"733e2015eb172e6ffebd91140b0c62ca164e07b5","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Add scope_types to server policies"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This commit uses some functionality introduced in oslo.policy 1.32.0"},{"line_number":10,"context_line":"and adds a new attribute to policies registered in nova."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"The ``scope_types`` attribute is an immutable parameter of the"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"df87a7cf_2412b80a","line":9,"range":{"start_line":9,"start_character":50,"end_line":9,"end_character":68},"updated":"2017-12-16 13:44:39.000000000","message":"Do you have a minimum g-r bump patch this can depend on?\n\nhttps://github.com/openstack/requirements/blob/master/global-requirements.txt#L144","commit_id":"d49af982c567a3fbc0e50aac689d3ba9b7b75daf"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"3e568c5d542d677617c5e85b891deb465b998720","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Add scope_types to server policies"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This commit uses some functionality introduced in oslo.policy 1.32.0"},{"line_number":10,"context_line":"and adds a new attribute to policies registered in nova."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"The ``scope_types`` attribute is an immutable parameter of the"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"df87a7cf_149c54be","line":9,"range":{"start_line":9,"start_character":50,"end_line":9,"end_character":68},"in_reply_to":"df87a7cf_2412b80a","updated":"2017-12-19 01:18:50.000000000","message":"Looks like it?\n\nhttps://review.openstack.org/#/c/526260/","commit_id":"d49af982c567a3fbc0e50aac689d3ba9b7b75daf"}],"nova/policies/servers.py":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"733e2015eb172e6ffebd91140b0c62ca164e07b5","unresolved":false,"context_lines":[{"line_number":53,"context_line":"                \u0027path\u0027: \u0027/servers\u0027"},{"line_number":54,"context_line":"            }"},{"line_number":55,"context_line":"        ],"},{"line_number":56,"context_line":"        scope_types\u003d[\u0027project\u0027]),"},{"line_number":57,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":58,"context_line":"        SERVERS % \u0027detail:get_all_tenants\u0027,"},{"line_number":59,"context_line":"        base.RULE_ADMIN_API,"}],"source_content_type":"text/x-python","patch_set":1,"id":"df87a7cf_e41cd014","line":56,"updated":"2017-12-16 13:44:39.000000000","message":"Why wouldn\u0027t this include system so a global admin can list all instances across all projects? Same below for detail.","commit_id":"d49af982c567a3fbc0e50aac689d3ba9b7b75daf"},{"author":{"_account_id":11869,"name":"zhubingbing","email":"zhu.bingbing@99cloud.net","username":"zhubingbing"},"change_message_id":"455100d75d7c9a0908ed5b036b024f35f1e9a781","unresolved":false,"context_lines":[{"line_number":53,"context_line":"                \u0027path\u0027: \u0027/servers\u0027"},{"line_number":54,"context_line":"            }"},{"line_number":55,"context_line":"        ],"},{"line_number":56,"context_line":"        scope_types\u003d[\u0027project\u0027]),"},{"line_number":57,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":58,"context_line":"        SERVERS % \u0027detail:get_all_tenants\u0027,"},{"line_number":59,"context_line":"        base.RULE_ADMIN_API,"}],"source_content_type":"text/x-python","patch_set":1,"id":"df87a7cf_b46ef593","line":56,"range":{"start_line":56,"start_character":5,"end_line":56,"end_character":30},"updated":"2017-12-17 11:29:50.000000000","message":"agree Matt","commit_id":"d49af982c567a3fbc0e50aac689d3ba9b7b75daf"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"f20df0d77a999abf276ed54138ac5e8f006f618a","unresolved":false,"context_lines":[{"line_number":53,"context_line":"                \u0027path\u0027: \u0027/servers\u0027"},{"line_number":54,"context_line":"            }"},{"line_number":55,"context_line":"        ],"},{"line_number":56,"context_line":"        scope_types\u003d[\u0027project\u0027]),"},{"line_number":57,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":58,"context_line":"        SERVERS % \u0027detail:get_all_tenants\u0027,"},{"line_number":59,"context_line":"        base.RULE_ADMIN_API,"}],"source_content_type":"text/x-python","patch_set":1,"id":"df87a7cf_4b4eb66f","line":56,"range":{"start_line":56,"start_character":5,"end_line":56,"end_character":30},"in_reply_to":"df87a7cf_88a9247d","updated":"2017-12-19 02:36:55.000000000","message":"I think for v1 of this system scope thing rolling out, the defaults need to be the same as what admin means today, which is \"god\". So god \u003e project admin \u003e project user.\n\nFor deployments that do hosted openstack, then the hosting operator is the system scope admin and the project admin at the customer site is the \u0027project\u0027 scope admin, and can only list instances for their project, but the admin at the hosting deployer can list all instances for all projects.\n\nFor deployments like that, they could tweak the policy if these defaults aren\u0027t going to work for them (likely they are already doing policy workarounds for the lack of system vs project scope admin roles right?).\n\nThen maybe over time we can start to restrict the default scoping rules on the APIs, which would come with upgrade notes and such.","commit_id":"d49af982c567a3fbc0e50aac689d3ba9b7b75daf"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2063fd34ad8f3a72d51ee299bef372881a0cd1c3","unresolved":false,"context_lines":[{"line_number":53,"context_line":"                \u0027path\u0027: \u0027/servers\u0027"},{"line_number":54,"context_line":"            }"},{"line_number":55,"context_line":"        ],"},{"line_number":56,"context_line":"        scope_types\u003d[\u0027project\u0027]),"},{"line_number":57,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":58,"context_line":"        SERVERS % \u0027detail:get_all_tenants\u0027,"},{"line_number":59,"context_line":"        base.RULE_ADMIN_API,"}],"source_content_type":"text/x-python","patch_set":1,"id":"df87a7cf_88a9247d","line":56,"range":{"start_line":56,"start_character":5,"end_line":56,"end_character":30},"in_reply_to":"df87a7cf_b46ef593","updated":"2017-12-19 02:30:48.000000000","message":"Yeah - this is exactly the question that I think needs to be asked. For context, this is how I\u0027m approaching it.\n\n`system` scope is intended to used for APIs that interact with the deployment on a system level (e.g. listing hypervisors). Where I start to stumble is mixing this with project-owned resources like instances.\n\nI guess it really depends on how the projects in a deployment are set up. If all the projects bubble up to a single parent project, or domain, index:get_all_tenants would be accomplished by listing instances with a token scoped to that ultimate parent project or domain (since it\u0027s the root of the tree).\n\nIf projects are in a flat structure, then scoping a token to to a parent project such that you can list everything in the deployment because it\u0027s a tree structure isn\u0027t possible. And maybe that\u0027s OK? I\u0027m not sure..\n\nAt the same time, you can go about this from the opposite view point. If we switch this to be `system` instead of `project`, it will mean only users with system role assignments can view all instances, which is fine from an administrative perspective. But we\u0027re requiring that people scope to a thing that has nothing to do with what the instances are encapsulated in (e.g. to list all instances in all projects, A, B, and C, you need to get a system-scoped token). Which kind of led to the original problem that this is trying to fix.\n\nThis will probably be the first of many cases like this. I\u0027m open to any feedback here.","commit_id":"d49af982c567a3fbc0e50aac689d3ba9b7b75daf"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"733e2015eb172e6ffebd91140b0c62ca164e07b5","unresolved":false,"context_lines":[{"line_number":92,"context_line":"                \u0027path\u0027: \u0027/servers/detail\u0027"},{"line_number":93,"context_line":"            }"},{"line_number":94,"context_line":"        ],"},{"line_number":95,"context_line":"        scope_types\u003d[\u0027project\u0027]),"},{"line_number":96,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":97,"context_line":"        SERVERS % \u0027create\u0027,"},{"line_number":98,"context_line":"        RULE_AOO,"}],"source_content_type":"text/x-python","patch_set":1,"id":"df87a7cf_841b8419","line":95,"updated":"2017-12-16 13:44:39.000000000","message":"What about this one?","commit_id":"d49af982c567a3fbc0e50aac689d3ba9b7b75daf"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2063fd34ad8f3a72d51ee299bef372881a0cd1c3","unresolved":false,"context_lines":[{"line_number":92,"context_line":"                \u0027path\u0027: \u0027/servers/detail\u0027"},{"line_number":93,"context_line":"            }"},{"line_number":94,"context_line":"        ],"},{"line_number":95,"context_line":"        scope_types\u003d[\u0027project\u0027]),"},{"line_number":96,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":97,"context_line":"        SERVERS % \u0027create\u0027,"},{"line_number":98,"context_line":"        RULE_AOO,"}],"source_content_type":"text/x-python","patch_set":1,"id":"df87a7cf_88c28433","line":95,"in_reply_to":"df87a7cf_841b8419","updated":"2017-12-19 02:30:48.000000000","message":"So - host would be a hypervisor right? If so, then yes, this should totally be a `system` scoped operation.","commit_id":"d49af982c567a3fbc0e50aac689d3ba9b7b75daf"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"733e2015eb172e6ffebd91140b0c62ca164e07b5","unresolved":false,"context_lines":[{"line_number":114,"context_line":"                \u0027path\u0027: \u0027/servers\u0027"},{"line_number":115,"context_line":"            }"},{"line_number":116,"context_line":"        ],"},{"line_number":117,"context_line":"        # NOTE(lbragstad): I\u0027m not sure how to best classify this operation. Is"},{"line_number":118,"context_line":"        # it something that should be done with a project-scoped token or a"},{"line_number":119,"context_line":"        # system-scoped token?"},{"line_number":120,"context_line":"        scope_types\u003d[\u0027project\u0027, \u0027system\u0027]),"}],"source_content_type":"text/x-python","patch_set":1,"id":"df87a7cf_44d33c39","line":117,"updated":"2017-12-16 13:44:39.000000000","message":"This is creating an instance on a specific host. Should probably be consistent with show:host_status above. It\u0027s unclear to me what should and shouldn\u0027t be possible for a project admin, but if we assume that by default all admin rules today work for a global admin, then I\u0027m not sure why we wouldn\u0027t default to project + system.","commit_id":"d49af982c567a3fbc0e50aac689d3ba9b7b75daf"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2063fd34ad8f3a72d51ee299bef372881a0cd1c3","unresolved":false,"context_lines":[{"line_number":114,"context_line":"                \u0027path\u0027: \u0027/servers\u0027"},{"line_number":115,"context_line":"            }"},{"line_number":116,"context_line":"        ],"},{"line_number":117,"context_line":"        # NOTE(lbragstad): I\u0027m not sure how to best classify this operation. Is"},{"line_number":118,"context_line":"        # it something that should be done with a project-scoped token or a"},{"line_number":119,"context_line":"        # system-scoped token?"},{"line_number":120,"context_line":"        scope_types\u003d[\u0027project\u0027, \u0027system\u0027]),"}],"source_content_type":"text/x-python","patch_set":1,"id":"df87a7cf_288578cf","line":117,"in_reply_to":"df87a7cf_44d33c39","updated":"2017-12-19 02:30:48.000000000","message":"If the host information is considered sensitive in the sense that your average user shouldn\u0027t know about it, then I\u0027d be inclined to make this a system-level operation.\n\nIn the project-admin case, how are they supposed to get system-level hypervisor information if they don\u0027t have access to query the system?\n\nIn the system-admin case, they are creating an instance to be owned by a project with a token that isn\u0027t scoped to that project.\n\nI\u0027m wondering what case is right for usability. Thoughts?","commit_id":"d49af982c567a3fbc0e50aac689d3ba9b7b75daf"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"733e2015eb172e6ffebd91140b0c62ca164e07b5","unresolved":false,"context_lines":[{"line_number":141,"context_line":"        scope_types\u003d[\u0027project\u0027]),"},{"line_number":142,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":143,"context_line":"        NETWORK_ATTACH_EXTERNAL,"},{"line_number":144,"context_line":"        \u0027is_admin:True\u0027,"},{"line_number":145,"context_line":"        \"Attach an unshared external network to a server\","},{"line_number":146,"context_line":"        ["},{"line_number":147,"context_line":"            # Create a server with a requested network or port."}],"source_content_type":"text/x-python","patch_set":1,"id":"df87a7cf_24e078fa","line":144,"range":{"start_line":144,"start_character":8,"end_line":144,"end_character":24},"updated":"2017-12-16 13:44:39.000000000","message":"I don\u0027t know why this doesn\u0027t use base.RULE_ADMIN_API. Is there a difference?","commit_id":"d49af982c567a3fbc0e50aac689d3ba9b7b75daf"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2063fd34ad8f3a72d51ee299bef372881a0cd1c3","unresolved":false,"context_lines":[{"line_number":141,"context_line":"        scope_types\u003d[\u0027project\u0027]),"},{"line_number":142,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":143,"context_line":"        NETWORK_ATTACH_EXTERNAL,"},{"line_number":144,"context_line":"        \u0027is_admin:True\u0027,"},{"line_number":145,"context_line":"        \"Attach an unshared external network to a server\","},{"line_number":146,"context_line":"        ["},{"line_number":147,"context_line":"            # Create a server with a requested network or port."}],"source_content_type":"text/x-python","patch_set":1,"id":"df87a7cf_086af4eb","line":144,"range":{"start_line":144,"start_character":8,"end_line":144,"end_character":24},"in_reply_to":"df87a7cf_24e078fa","updated":"2017-12-19 02:30:48.000000000","message":"That\u0027s a good question. It could be something that is processed by oslo.context? I\u0027d need to dig into this. What I\u0027m working towards should be preventing things like this... My ideal view is specifically found in the examples here: https://trello.com/c/C1INH5AI/7-define-default-roles","commit_id":"d49af982c567a3fbc0e50aac689d3ba9b7b75daf"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"733e2015eb172e6ffebd91140b0c62ca164e07b5","unresolved":false,"context_lines":[{"line_number":155,"context_line":"                \u0027path\u0027: \u0027/servers/{server_id}/os-interface\u0027"},{"line_number":156,"context_line":"            }"},{"line_number":157,"context_line":"        ],"},{"line_number":158,"context_line":"        # NOTE(lbragstad): The is_admin:True bit here makes me think this is a"},{"line_number":159,"context_line":"        # system-level API... double check with someone who is more familiar"},{"line_number":160,"context_line":"        # with this."},{"line_number":161,"context_line":"        scope_types\u003d[\u0027project\u0027, \u0027system\u0027]),"}],"source_content_type":"text/x-python","patch_set":1,"id":"df87a7cf_6431a0a2","line":158,"updated":"2017-12-16 13:44:39.000000000","message":"This policy is checked down in the neutron API code if you\u0027re trying to attach to shared\u003dFalse external network and you\u0027re not an admin, it fails by default:\n\nhttps://github.com/openstack/nova/blob/eabd1c11fdcadc49c0d4185c32b04202ef4dd69d/nova/network/neutronv2/api.py#L481\n\nRegarding the scope, I\u0027m not sure what the use case would be for a \u0027global\u0027 admin to do this to an instance in a project, but I assume that if this meant only admins could do this before, then they could do it to any instance regardless of project, so this is probably the correct scope list so we don\u0027t break backward compatibility.","commit_id":"d49af982c567a3fbc0e50aac689d3ba9b7b75daf"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ff0b1b70c80fee0e09303db4ccb158908a1a4fa2","unresolved":false,"context_lines":[{"line_number":155,"context_line":"                \u0027path\u0027: \u0027/servers/{server_id}/os-interface\u0027"},{"line_number":156,"context_line":"            }"},{"line_number":157,"context_line":"        ],"},{"line_number":158,"context_line":"        # NOTE(lbragstad): The is_admin:True bit here makes me think this is a"},{"line_number":159,"context_line":"        # system-level API... double check with someone who is more familiar"},{"line_number":160,"context_line":"        # with this."},{"line_number":161,"context_line":"        scope_types\u003d[\u0027project\u0027, \u0027system\u0027]),"}],"source_content_type":"text/x-python","patch_set":1,"id":"df87a7cf_1ebf77aa","line":158,"in_reply_to":"df87a7cf_6431a0a2","updated":"2017-12-19 22:21:24.000000000","message":"We can always introduce the correct scope list initially and build a service-wide toggle that enforces scope. I mocked this up in keystone here - https://review.openstack.org/#/c/528847/","commit_id":"d49af982c567a3fbc0e50aac689d3ba9b7b75daf"},{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"9e0787ea0ef5ac3cbea973d6c44dcd18f5374a6c","unresolved":false,"context_lines":[{"line_number":53,"context_line":"                \u0027path\u0027: \u0027/servers\u0027"},{"line_number":54,"context_line":"            }"},{"line_number":55,"context_line":"        ],"},{"line_number":56,"context_line":"        # This is considered a system-level operation because system"},{"line_number":57,"context_line":"        # administrators should be able to get a list of all instances across"},{"line_number":58,"context_line":"        # the deployment. This is also a project-level operation because when"},{"line_number":59,"context_line":"        # using hierarchical multi-tenancy, is should be possible for a project"},{"line_number":60,"context_line":"        # administrator to get a list of all instances including instances of"},{"line_number":61,"context_line":"        # child projects. Depending on the token\u0027s scope, the response could"},{"line_number":62,"context_line":"        # change. What we don\u0027t want is a project administrator to get a list"},{"line_number":63,"context_line":"        # of all instances across the entire deployment."},{"line_number":64,"context_line":"        scope_types\u003d[\u0027system\u0027, \u0027project\u0027]),"},{"line_number":65,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":66,"context_line":"        SERVERS % \u0027detail:get_all_tenants\u0027,"}],"source_content_type":"text/x-python","patch_set":2,"id":"3fa0c359_cbf61ed8","line":63,"range":{"start_line":56,"start_character":0,"end_line":63,"end_character":56},"updated":"2018-02-12 18:55:47.000000000","message":"++, well documented.","commit_id":"c6ba7a60b53c6e1593bf685f4c1b57c7d401ed64"},{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"9e0787ea0ef5ac3cbea973d6c44dcd18f5374a6c","unresolved":false,"context_lines":[{"line_number":72,"context_line":"                \u0027path\u0027: \u0027/servers/detail\u0027"},{"line_number":73,"context_line":"            }"},{"line_number":74,"context_line":"        ],"},{"line_number":75,"context_line":"        scope_types\u003d[\u0027project\u0027]),"},{"line_number":76,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":77,"context_line":"        SERVERS % \u0027show\u0027,"},{"line_number":78,"context_line":"        RULE_AOO,"}],"source_content_type":"text/x-python","patch_set":2,"id":"3fa0c359_4bd9ae54","line":75,"range":{"start_line":75,"start_character":21,"end_line":75,"end_character":30},"updated":"2018-02-12 18:55:47.000000000","message":"Isn\u0027t it necessary to specify \u0027system\u0027 also here with the above reason? It would be better to write a NOTE about that because of the same \u0027get_all_tenants\u0027 operation.","commit_id":"c6ba7a60b53c6e1593bf685f4c1b57c7d401ed64"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5b2abf94f4fb12666b8b1a02fea174ce0adf093b","unresolved":false,"context_lines":[{"line_number":72,"context_line":"                \u0027path\u0027: \u0027/servers/detail\u0027"},{"line_number":73,"context_line":"            }"},{"line_number":74,"context_line":"        ],"},{"line_number":75,"context_line":"        scope_types\u003d[\u0027project\u0027]),"},{"line_number":76,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":77,"context_line":"        SERVERS % \u0027show\u0027,"},{"line_number":78,"context_line":"        RULE_AOO,"}],"source_content_type":"text/x-python","patch_set":2,"id":"df7087c5_b34e9c94","line":75,"range":{"start_line":75,"start_character":21,"end_line":75,"end_character":30},"in_reply_to":"3fa0c359_4bd9ae54","updated":"2018-03-15 20:43:23.000000000","message":"Done","commit_id":"c6ba7a60b53c6e1593bf685f4c1b57c7d401ed64"},{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"9e0787ea0ef5ac3cbea973d6c44dcd18f5374a6c","unresolved":false,"context_lines":[{"line_number":131,"context_line":"        # that is technically system-level information? When access this API"},{"line_number":132,"context_line":"        # with a system-scoped token, users are scoping to something that"},{"line_number":133,"context_line":"        # doesn\u0027t actually own the resource in order to make the request. Which"},{"line_number":134,"context_line":"        # is better for usability?"},{"line_number":135,"context_line":"        scope_types\u003d[\u0027project\u0027, \u0027system\u0027]),"},{"line_number":136,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":137,"context_line":"        SERVERS % \u0027create:attach_volume\u0027,"}],"source_content_type":"text/x-python","patch_set":2,"id":"3fa0c359_2be0e2cc","line":134,"updated":"2018-02-12 18:55:47.000000000","message":"I think that depends on how to define this scope_types on os-hypervisors API. If defining \u0027system\u0027 only on the API, here also should be \u0027system\u0027 here, they should be consistent.","commit_id":"c6ba7a60b53c6e1593bf685f4c1b57c7d401ed64"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5b2abf94f4fb12666b8b1a02fea174ce0adf093b","unresolved":false,"context_lines":[{"line_number":131,"context_line":"        # that is technically system-level information? When access this API"},{"line_number":132,"context_line":"        # with a system-scoped token, users are scoping to something that"},{"line_number":133,"context_line":"        # doesn\u0027t actually own the resource in order to make the request. Which"},{"line_number":134,"context_line":"        # is better for usability?"},{"line_number":135,"context_line":"        scope_types\u003d[\u0027project\u0027, \u0027system\u0027]),"},{"line_number":136,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":137,"context_line":"        SERVERS % \u0027create:attach_volume\u0027,"}],"source_content_type":"text/x-python","patch_set":2,"id":"df7087c5_530b8028","line":134,"in_reply_to":"3fa0c359_2be0e2cc","updated":"2018-03-15 20:43:23.000000000","message":"Done","commit_id":"c6ba7a60b53c6e1593bf685f4c1b57c7d401ed64"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"51005cb5113c099bfa7f7c70cf78b0c050e5342f","unresolved":false,"context_lines":[{"line_number":131,"context_line":"        # that is technically system-level information? When access this API"},{"line_number":132,"context_line":"        # with a system-scoped token, users are scoping to something that"},{"line_number":133,"context_line":"        # doesn\u0027t actually own the resource in order to make the request. Which"},{"line_number":134,"context_line":"        # is better for usability?"},{"line_number":135,"context_line":"        scope_types\u003d[\u0027project\u0027, \u0027system\u0027]),"},{"line_number":136,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":137,"context_line":"        SERVERS % \u0027create:attach_volume\u0027,"}],"source_content_type":"text/x-python","patch_set":2,"id":"3fa0c359_5710524e","line":134,"in_reply_to":"3fa0c359_2be0e2cc","updated":"2018-02-13 16:27:35.000000000","message":"Needs to be system scoped.  A project scoped token should not be allowed to break out of project scoped resources.  This is a system admin level operation","commit_id":"c6ba7a60b53c6e1593bf685f4c1b57c7d401ed64"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5b2abf94f4fb12666b8b1a02fea174ce0adf093b","unresolved":false,"context_lines":[{"line_number":131,"context_line":"        # that is technically system-level information? When access this API"},{"line_number":132,"context_line":"        # with a system-scoped token, users are scoping to something that"},{"line_number":133,"context_line":"        # doesn\u0027t actually own the resource in order to make the request. Which"},{"line_number":134,"context_line":"        # is better for usability?"},{"line_number":135,"context_line":"        scope_types\u003d[\u0027project\u0027, \u0027system\u0027]),"},{"line_number":136,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":137,"context_line":"        SERVERS % \u0027create:attach_volume\u0027,"}],"source_content_type":"text/x-python","patch_set":2,"id":"df7087c5_f305f414","line":134,"in_reply_to":"3fa0c359_5710524e","updated":"2018-03-15 20:43:23.000000000","message":"Done","commit_id":"c6ba7a60b53c6e1593bf685f4c1b57c7d401ed64"},{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"9e0787ea0ef5ac3cbea973d6c44dcd18f5374a6c","unresolved":false,"context_lines":[{"line_number":142,"context_line":"                \u0027method\u0027: \u0027POST\u0027,"},{"line_number":143,"context_line":"                \u0027path\u0027: \u0027/servers\u0027"},{"line_number":144,"context_line":"            }"},{"line_number":145,"context_line":"        ]),"},{"line_number":146,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":147,"context_line":"        SERVERS % \u0027create:attach_network\u0027,"},{"line_number":148,"context_line":"        RULE_AOO,"}],"source_content_type":"text/x-python","patch_set":2,"id":"3fa0c359_6bc82a73","line":145,"updated":"2018-02-12 18:55:47.000000000","message":"Why not specify scope_types here?","commit_id":"c6ba7a60b53c6e1593bf685f4c1b57c7d401ed64"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5b2abf94f4fb12666b8b1a02fea174ce0adf093b","unresolved":false,"context_lines":[{"line_number":142,"context_line":"                \u0027method\u0027: \u0027POST\u0027,"},{"line_number":143,"context_line":"                \u0027path\u0027: \u0027/servers\u0027"},{"line_number":144,"context_line":"            }"},{"line_number":145,"context_line":"        ]),"},{"line_number":146,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":147,"context_line":"        SERVERS % \u0027create:attach_network\u0027,"},{"line_number":148,"context_line":"        RULE_AOO,"}],"source_content_type":"text/x-python","patch_set":2,"id":"df7087c5_960a661d","line":145,"in_reply_to":"3fa0c359_6bc82a73","updated":"2018-03-15 20:43:23.000000000","message":"Done","commit_id":"c6ba7a60b53c6e1593bf685f4c1b57c7d401ed64"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"51005cb5113c099bfa7f7c70cf78b0c050e5342f","unresolved":false,"context_lines":[{"line_number":142,"context_line":"                \u0027method\u0027: \u0027POST\u0027,"},{"line_number":143,"context_line":"                \u0027path\u0027: \u0027/servers\u0027"},{"line_number":144,"context_line":"            }"},{"line_number":145,"context_line":"        ]),"},{"line_number":146,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":147,"context_line":"        SERVERS % \u0027create:attach_network\u0027,"},{"line_number":148,"context_line":"        RULE_AOO,"}],"source_content_type":"text/x-python","patch_set":2,"id":"3fa0c359_f71abe6c","line":145,"in_reply_to":"3fa0c359_6bc82a73","updated":"2018-02-13 16:27:35.000000000","message":"agreed.  Project scope","commit_id":"c6ba7a60b53c6e1593bf685f4c1b57c7d401ed64"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5b2abf94f4fb12666b8b1a02fea174ce0adf093b","unresolved":false,"context_lines":[{"line_number":142,"context_line":"                \u0027method\u0027: \u0027POST\u0027,"},{"line_number":143,"context_line":"                \u0027path\u0027: \u0027/servers\u0027"},{"line_number":144,"context_line":"            }"},{"line_number":145,"context_line":"        ]),"},{"line_number":146,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":147,"context_line":"        SERVERS % \u0027create:attach_network\u0027,"},{"line_number":148,"context_line":"        RULE_AOO,"}],"source_content_type":"text/x-python","patch_set":2,"id":"df7087c5_36159a40","line":145,"in_reply_to":"3fa0c359_f71abe6c","updated":"2018-03-15 20:43:23.000000000","message":"Done","commit_id":"c6ba7a60b53c6e1593bf685f4c1b57c7d401ed64"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"6a3c094fceb1716deecae489563b8c4a6d562113","unresolved":false,"context_lines":[{"line_number":181,"context_line":"                \u0027path\u0027: \u0027/servers/{server_id}/os-interface\u0027"},{"line_number":182,"context_line":"            }"},{"line_number":183,"context_line":"        ],"},{"line_number":184,"context_line":"        # NOTE(lbragstad): The is_admin:True bit here makes me think this is a"},{"line_number":185,"context_line":"        # system-level API... double check with someone who is more familiar"},{"line_number":186,"context_line":"        # with this."},{"line_number":187,"context_line":"        scope_types\u003d[\u0027project\u0027, \u0027system\u0027]),"},{"line_number":188,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":189,"context_line":"        SERVERS % \u0027delete\u0027,"},{"line_number":190,"context_line":"        RULE_AOO,"}],"source_content_type":"text/x-python","patch_set":4,"id":"bf659307_3a8aaf69","line":187,"range":{"start_line":184,"start_character":0,"end_line":187,"end_character":43},"updated":"2018-04-11 10:35:17.000000000","message":"I guess johnthetubaguy or mriedem need to weigh in on this one","commit_id":"908ec6714d76a3647c04d7a46e21b53f9ffbab5a"}]}