)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"56f3194c21b39bdcface59887ce21918f8243ef1","unresolved":false,"context_lines":[{"line_number":26,"context_line":"from above, where the middleware can reason about roles specified in"},{"line_number":27,"context_line":"the request environment. Then it just uses the is_admin kwarg of the"},{"line_number":28,"context_line":"oslo.context object to avoid step #3. Second, it removes the"},{"line_number":29,"context_line":"opaque context_is_admin rule in favor or a one-to-one mapping"},{"line_number":30,"context_line":"between a role named \"admin\" and functionality that requires elevated"},{"line_number":31,"context_line":"permissions of some kind."},{"line_number":32,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"9f6a8fd7_772a1a7f","line":29,"range":{"start_line":29,"start_character":38,"end_line":29,"end_character":40},"updated":"2018-04-25 21:54:11.000000000","message":"of","commit_id":"16ad4072b5b81ea075fb63f080e0f249e6bd0f61"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a76086f7ee65395b44010e360db620031a72c780","unresolved":false,"context_lines":[{"line_number":26,"context_line":"from above, where the middleware can reason about roles specified in"},{"line_number":27,"context_line":"the request environment. Then it just uses the is_admin kwarg of the"},{"line_number":28,"context_line":"oslo.context object to avoid step #3. Second, it removes the"},{"line_number":29,"context_line":"opaque context_is_admin rule in favor or a one-to-one mapping"},{"line_number":30,"context_line":"between a role named \"admin\" and functionality that requires elevated"},{"line_number":31,"context_line":"permissions of some kind."},{"line_number":32,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"9f6a8fd7_450dc9e6","line":29,"range":{"start_line":29,"start_character":38,"end_line":29,"end_character":40},"in_reply_to":"9f6a8fd7_772a1a7f","updated":"2018-04-26 21:46:34.000000000","message":"Done","commit_id":"16ad4072b5b81ea075fb63f080e0f249e6bd0f61"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"38fa82aa137f3564661ae2eaae621b9398e7c403","unresolved":false,"context_lines":[{"line_number":10,"context_line":"confusing and has a specific use case. The summarized flow is as"},{"line_number":11,"context_line":"follows:"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"  1.) keystoncontext middleware attempts to build a context object"},{"line_number":14,"context_line":"      from the requests environment while in the paste pipeline"},{"line_number":15,"context_line":"  2.) oslo.context pulls headers from the request and passes them"},{"line_number":16,"context_line":"      to the RequestContext constructor, which nova subclasses"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"9f6a8fd7_01fc973c","line":13,"range":{"start_line":13,"start_character":6,"end_line":13,"end_character":20},"updated":"2018-04-27 13:38:08.000000000","message":"Let\u0027s say NovaKeystoneContext so that people can look this up directly if they want to dig into it.","commit_id":"0c2fd8cbee7e8ec7f69b557c5fc2d54e9cd6a2df"}],"nova/context.py":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"38fa82aa137f3564661ae2eaae621b9398e7c403","unresolved":false,"context_lines":[{"line_number":115,"context_line":"                          \"nova.context.RequestContext is no longer used and \""},{"line_number":116,"context_line":"                          \"will be removed in a future version.\")"},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"        if not is_admin:"},{"line_number":119,"context_line":"            is_admin \u003d False"},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"        super(RequestContext, self).__init__(is_admin\u003dis_admin, **kwargs)"}],"source_content_type":"text/x-python","patch_set":3,"id":"9f6a8fd7_4187efb7","line":118,"range":{"start_line":118,"start_character":11,"end_line":118,"end_character":23},"updated":"2018-04-27 13:38:08.000000000","message":"if is_admin is None:\n    is_admin \u003d False\n\nThat\u0027s a bit more clear.","commit_id":"0c2fd8cbee7e8ec7f69b557c5fc2d54e9cd6a2df"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a2aecefab573e7ae9cbab4b2fa4619a20bd3988d","unresolved":false,"context_lines":[{"line_number":115,"context_line":"                          \"nova.context.RequestContext is no longer used and \""},{"line_number":116,"context_line":"                          \"will be removed in a future version.\")"},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"        if not is_admin:"},{"line_number":119,"context_line":"            is_admin \u003d False"},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"        super(RequestContext, self).__init__(is_admin\u003dis_admin, **kwargs)"}],"source_content_type":"text/x-python","patch_set":3,"id":"9f6a8fd7_569a4e6e","line":118,"range":{"start_line":118,"start_character":11,"end_line":118,"end_character":23},"in_reply_to":"9f6a8fd7_4187efb7","updated":"2018-04-27 15:54:42.000000000","message":"Done","commit_id":"0c2fd8cbee7e8ec7f69b557c5fc2d54e9cd6a2df"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"38fa82aa137f3564661ae2eaae621b9398e7c403","unresolved":false,"context_lines":[{"line_number":126,"context_line":"        # privileges. We do this here because we can supply a keyword argument"},{"line_number":127,"context_line":"        # to from_environ that will carry through the generation of the"},{"line_number":128,"context_line":"        # oslo.context object and end up as the ``is_admin`` property on the"},{"line_number":129,"context_line":"        # resulting context object. This makes the interaction simpler because"},{"line_number":130,"context_line":"        # previously we were generating a context object from the request"},{"line_number":131,"context_line":"        # environment, then performing a policy check on an alias of the"},{"line_number":132,"context_line":"        # role:admin rule called context_is_admin and storing the result of"},{"line_number":133,"context_line":"        # that oslo.policy method as is_admin on the context object."},{"line_number":134,"context_line":"        #"},{"line_number":135,"context_line":"        # Eventually, we should strive to remove elevating context or"},{"line_number":136,"context_line":"        # authorization of this nature because it hardcodes a set of"}],"source_content_type":"text/x-python","patch_set":3,"id":"9f6a8fd7_61ad5330","line":133,"range":{"start_line":129,"start_character":36,"end_line":133,"end_character":68},"updated":"2018-04-27 13:38:08.000000000","message":"I would leave this as information in the commit message for historical purposes if people need to know this. Leaving what we used to do in the code comments will bit rot and probably lead to confusion over time.","commit_id":"0c2fd8cbee7e8ec7f69b557c5fc2d54e9cd6a2df"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a2aecefab573e7ae9cbab4b2fa4619a20bd3988d","unresolved":false,"context_lines":[{"line_number":126,"context_line":"        # privileges. We do this here because we can supply a keyword argument"},{"line_number":127,"context_line":"        # to from_environ that will carry through the generation of the"},{"line_number":128,"context_line":"        # oslo.context object and end up as the ``is_admin`` property on the"},{"line_number":129,"context_line":"        # resulting context object. This makes the interaction simpler because"},{"line_number":130,"context_line":"        # previously we were generating a context object from the request"},{"line_number":131,"context_line":"        # environment, then performing a policy check on an alias of the"},{"line_number":132,"context_line":"        # role:admin rule called context_is_admin and storing the result of"},{"line_number":133,"context_line":"        # that oslo.policy method as is_admin on the context object."},{"line_number":134,"context_line":"        #"},{"line_number":135,"context_line":"        # Eventually, we should strive to remove elevating context or"},{"line_number":136,"context_line":"        # authorization of this nature because it hardcodes a set of"}],"source_content_type":"text/x-python","patch_set":3,"id":"9f6a8fd7_36c47a40","line":133,"range":{"start_line":129,"start_character":36,"end_line":133,"end_character":68},"in_reply_to":"9f6a8fd7_61ad5330","updated":"2018-04-27 15:54:42.000000000","message":"Yeah - I can remove more of this, too. I mainly wrote all this out to make things more clear to reviewers, but I could have done that with a review comment, too.","commit_id":"0c2fd8cbee7e8ec7f69b557c5fc2d54e9cd6a2df"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d98eb9d926077a27484f9f3e843fcce7f42c98a7","unresolved":false,"context_lines":[{"line_number":138,"context_line":"        # oslo.policy\u0027s `scope_types` attribute to separate things an"},{"line_number":139,"context_line":"        # administrator can do from a typical end user."},{"line_number":140,"context_line":"        if self.roles:"},{"line_number":141,"context_line":"            for role in self.roles:"},{"line_number":142,"context_line":"                if role in [\u0027admin\u0027, \u0027Admin\u0027, \u0027administrator\u0027]:"},{"line_number":143,"context_line":"                    self.is_admin \u003d True"},{"line_number":144,"context_line":"                    break"}],"source_content_type":"text/x-python","patch_set":3,"id":"9f6a8fd7_a5ece529","line":141,"range":{"start_line":141,"start_character":24,"end_line":141,"end_character":34},"updated":"2018-04-26 21:42:02.000000000","message":"These should be coming from ksm after the token is validated and nova\u0027s keystonecontext middleware pulls them out of the headers and passes them into the context object by calling from_environ()","commit_id":"0c2fd8cbee7e8ec7f69b557c5fc2d54e9cd6a2df"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"38fa82aa137f3564661ae2eaae621b9398e7c403","unresolved":false,"context_lines":[{"line_number":284,"context_line":"                raise"},{"line_number":285,"context_line":"            return False"},{"line_number":286,"context_line":""},{"line_number":287,"context_line":"    def to_policy_values(self):"},{"line_number":288,"context_line":"        policy \u003d super(RequestContext, self).to_policy_values()"},{"line_number":289,"context_line":"        policy[\u0027is_admin\u0027] \u003d self.is_admin"},{"line_number":290,"context_line":"        return policy"},{"line_number":291,"context_line":""},{"line_number":292,"context_line":"    def __str__(self):"},{"line_number":293,"context_line":"        return \"\u003cContext %s\u003e\" % self.to_dict()"}],"source_content_type":"text/x-python","patch_set":3,"id":"9f6a8fd7_61d6b3c6","line":290,"range":{"start_line":287,"start_character":4,"end_line":290,"end_character":21},"updated":"2018-04-27 13:38:08.000000000","message":"I noticed this yesterday when trying to add granular policy checking for placement, which doesn\u0027t use context_is_admin nor the middleware that puts it in the context, so this is also tied directly to the context_is_admin stuff, and we should mark this as deprecated to be removed with context_is_admin. I think a TODO would be fine, we don\u0027t need to warn or something on this.","commit_id":"0c2fd8cbee7e8ec7f69b557c5fc2d54e9cd6a2df"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a2aecefab573e7ae9cbab4b2fa4619a20bd3988d","unresolved":false,"context_lines":[{"line_number":284,"context_line":"                raise"},{"line_number":285,"context_line":"            return False"},{"line_number":286,"context_line":""},{"line_number":287,"context_line":"    def to_policy_values(self):"},{"line_number":288,"context_line":"        policy \u003d super(RequestContext, self).to_policy_values()"},{"line_number":289,"context_line":"        policy[\u0027is_admin\u0027] \u003d self.is_admin"},{"line_number":290,"context_line":"        return policy"},{"line_number":291,"context_line":""},{"line_number":292,"context_line":"    def __str__(self):"},{"line_number":293,"context_line":"        return \"\u003cContext %s\u003e\" % self.to_dict()"}],"source_content_type":"text/x-python","patch_set":3,"id":"9f6a8fd7_d6b5fece","line":290,"range":{"start_line":287,"start_character":4,"end_line":290,"end_character":21},"in_reply_to":"9f6a8fd7_61d6b3c6","updated":"2018-04-27 15:54:42.000000000","message":"Done","commit_id":"0c2fd8cbee7e8ec7f69b557c5fc2d54e9cd6a2df"}],"nova/policies/base.py":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"56f3194c21b39bdcface59887ce21918f8243ef1","unresolved":false,"context_lines":[{"line_number":23,"context_line":"# crazy hard to manually maintain such a list."},{"line_number":24,"context_line":"rules \u003d ["},{"line_number":25,"context_line":"    policy.RuleDefault("},{"line_number":26,"context_line":"        \"context_is_admin\","},{"line_number":27,"context_line":"        \"role:admin\","},{"line_number":28,"context_line":"        \"Decides what is required for the \u0027is_admin:True\u0027 check to succeed.\"),"},{"line_number":29,"context_line":"    policy.RuleDefault("}],"source_content_type":"text/x-python","patch_set":1,"id":"9f6a8fd7_d7b1a645","side":"PARENT","line":26,"updated":"2018-04-25 21:54:11.000000000","message":"Should also be able to remove this:\n\nhttps://github.com/openstack/nova/blob/55bffebc694f311f1f46cdabd6ea63b8a47fa6aa/nova/tests/unit/fake_policy.py#L18\n\nand\n\nhttps://github.com/openstack/nova/blob/a87afe2fc256a4539de85ae46ca2f053a09ae544/doc/source/reference/policy-enforcement.rst#L139","commit_id":"529205af09a2de22036e508ad979929f8dfc22a1"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d98eb9d926077a27484f9f3e843fcce7f42c98a7","unresolved":false,"context_lines":[{"line_number":23,"context_line":"# crazy hard to manually maintain such a list."},{"line_number":24,"context_line":"rules \u003d ["},{"line_number":25,"context_line":"    policy.RuleDefault("},{"line_number":26,"context_line":"        \"context_is_admin\","},{"line_number":27,"context_line":"        \"role:admin\","},{"line_number":28,"context_line":"        \"Decides what is required for the \u0027is_admin:True\u0027 check to succeed.\"),"},{"line_number":29,"context_line":"    policy.RuleDefault("}],"source_content_type":"text/x-python","patch_set":1,"id":"9f6a8fd7_942f95a6","side":"PARENT","line":26,"in_reply_to":"9f6a8fd7_d7b1a645","updated":"2018-04-26 21:42:02.000000000","message":"Done","commit_id":"529205af09a2de22036e508ad979929f8dfc22a1"},{"author":{"_account_id":7634,"name":"Takashi Natsume","email":"takanattie@gmail.com","username":"natsumet"},"change_message_id":"3016aa1d324cdeb179454dad3e0ac328168191a5","unresolved":false,"context_lines":[{"line_number":35,"context_line":"        \"Decides what is required for the \u0027is_admin:True\u0027 check to succeed.\","},{"line_number":36,"context_line":"        deprecated_for_removal\u003dTrue,"},{"line_number":37,"context_line":"        deprecated_reason\u003dcontext_deprecation,"},{"line_number":38,"context_line":"        deprecated_since\u003d\u0027Rocky\u0027),"},{"line_number":39,"context_line":"    policy.RuleDefault("},{"line_number":40,"context_line":"        \"admin_or_owner\","},{"line_number":41,"context_line":"        \"is_admin:True or project_id:%(project_id)s\","}],"source_content_type":"text/x-python","patch_set":3,"id":"9f6a8fd7_5ee82f7b","line":38,"range":{"start_line":38,"start_character":26,"end_line":38,"end_character":31},"updated":"2018-04-27 08:42:38.000000000","message":"18.0.0","commit_id":"0c2fd8cbee7e8ec7f69b557c5fc2d54e9cd6a2df"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a2aecefab573e7ae9cbab4b2fa4619a20bd3988d","unresolved":false,"context_lines":[{"line_number":35,"context_line":"        \"Decides what is required for the \u0027is_admin:True\u0027 check to succeed.\","},{"line_number":36,"context_line":"        deprecated_for_removal\u003dTrue,"},{"line_number":37,"context_line":"        deprecated_reason\u003dcontext_deprecation,"},{"line_number":38,"context_line":"        deprecated_since\u003d\u0027Rocky\u0027),"},{"line_number":39,"context_line":"    policy.RuleDefault("},{"line_number":40,"context_line":"        \"admin_or_owner\","},{"line_number":41,"context_line":"        \"is_admin:True or project_id:%(project_id)s\","}],"source_content_type":"text/x-python","patch_set":3,"id":"9f6a8fd7_d6389e3e","line":38,"range":{"start_line":38,"start_character":26,"end_line":38,"end_character":31},"in_reply_to":"9f6a8fd7_5ee82f7b","updated":"2018-04-27 15:54:42.000000000","message":"Done","commit_id":"0c2fd8cbee7e8ec7f69b557c5fc2d54e9cd6a2df"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"38fd38f576be68f8bf2e101a5db011cbb905be7b","unresolved":false,"context_lines":[{"line_number":18,"context_line":"RULE_ADMIN_API \u003d \u0027rule:admin_api\u0027"},{"line_number":19,"context_line":"RULE_ANY \u003d \u0027@\u0027"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"context_deprecation \u003d ("},{"line_number":22,"context_line":"    \u0027Nova nows checks headers set by keystonemiddleware to see if a user has \u0027"},{"line_number":23,"context_line":"    \u0027the `admin` role instead of relying on oslo.policy and a custom rule \u0027"},{"line_number":24,"context_line":"    \u0027to perform the same check. If your deployment is using this rule, please \u0027"},{"line_number":25,"context_line":"    \u0027use `role:admin` instead\u0027"},{"line_number":26,"context_line":")"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"# NOTE(johngarbutt) The base rules here affect so many APIs the list"},{"line_number":29,"context_line":"# of related API operations has not been populated. It would be"}],"source_content_type":"text/x-python","patch_set":4,"id":"5f7c97a3_1814b29e","line":26,"range":{"start_line":21,"start_character":0,"end_line":26,"end_character":1},"updated":"2018-07-03 14:02:55.000000000","message":"nit: could probably have just included this inline with a multiline string","commit_id":"c582f103a8c42ca2fe4e55984a0a3fc34858717a"}],"nova/tests/unit/test_policy.py":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"38fa82aa137f3564661ae2eaae621b9398e7c403","unresolved":false,"context_lines":[{"line_number":88,"context_line":"        policy.init()"},{"line_number":89,"context_line":"        # before a policy rule can be used, its default has to be registered."},{"line_number":90,"context_line":"        policy._ENFORCER.register_defaults(rules)"},{"line_number":91,"context_line":"        self.context \u003d context.RequestContext(\u0027fake\u0027, \u0027fake\u0027, is_admin\u003dFalse,"},{"line_number":92,"context_line":"                                              roles\u003d[\u0027member\u0027])"},{"line_number":93,"context_line":"        self.target \u003d {}"},{"line_number":94,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"9f6a8fd7_012d77a7","line":91,"updated":"2018-04-27 13:38:08.000000000","message":"This and below shouldn\u0027t be necessary since the init already checks for None and sets is_admin\u003dFalse.","commit_id":"0c2fd8cbee7e8ec7f69b557c5fc2d54e9cd6a2df"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a2aecefab573e7ae9cbab4b2fa4619a20bd3988d","unresolved":false,"context_lines":[{"line_number":88,"context_line":"        policy.init()"},{"line_number":89,"context_line":"        # before a policy rule can be used, its default has to be registered."},{"line_number":90,"context_line":"        policy._ENFORCER.register_defaults(rules)"},{"line_number":91,"context_line":"        self.context \u003d context.RequestContext(\u0027fake\u0027, \u0027fake\u0027, is_admin\u003dFalse,"},{"line_number":92,"context_line":"                                              roles\u003d[\u0027member\u0027])"},{"line_number":93,"context_line":"        self.target \u003d {}"},{"line_number":94,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"9f6a8fd7_56448eb7","line":91,"in_reply_to":"9f6a8fd7_012d77a7","updated":"2018-04-27 15:54:42.000000000","message":"Good catch, done.","commit_id":"0c2fd8cbee7e8ec7f69b557c5fc2d54e9cd6a2df"}],"releasenotes/notes/deprecate-context-is-admin-8bebbe39f5ead502.yaml":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"38fa82aa137f3564661ae2eaae621b9398e7c403","unresolved":false,"context_lines":[{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    The ``rule:context_is_admin`` policy has been deprecated. Nova now checks"},{"line_number":5,"context_line":"    the headers of the request for the token\u0027s roles, which is set by"},{"line_number":6,"context_line":"    auth_token middleware. If you\u0027re relying on the ``context_is_admin`` rule"},{"line_number":7,"context_line":"    in your deployment, please use ``role:admin`` instead."}],"source_content_type":"text/x-yaml","patch_set":3,"id":"9f6a8fd7_8112e761","line":6,"range":{"start_line":6,"start_character":30,"end_line":6,"end_character":37},"updated":"2018-04-27 13:38:08.000000000","message":"nit: you are\n\nfor docs","commit_id":"0c2fd8cbee7e8ec7f69b557c5fc2d54e9cd6a2df"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a2aecefab573e7ae9cbab4b2fa4619a20bd3988d","unresolved":false,"context_lines":[{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    The ``rule:context_is_admin`` policy has been deprecated. Nova now checks"},{"line_number":5,"context_line":"    the headers of the request for the token\u0027s roles, which is set by"},{"line_number":6,"context_line":"    auth_token middleware. If you\u0027re relying on the ``context_is_admin`` rule"},{"line_number":7,"context_line":"    in your deployment, please use ``role:admin`` instead."}],"source_content_type":"text/x-yaml","patch_set":3,"id":"9f6a8fd7_16661653","line":6,"range":{"start_line":6,"start_character":30,"end_line":6,"end_character":37},"in_reply_to":"9f6a8fd7_8112e761","updated":"2018-04-27 15:54:42.000000000","message":"Done","commit_id":"0c2fd8cbee7e8ec7f69b557c5fc2d54e9cd6a2df"}]}