)]}'
{"nova/api/openstack/placement/policies/aggregate.py":[{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"d673f5b19d6226a934fb5111f2440fe01ebbc084","unresolved":false,"context_lines":[{"line_number":32,"context_line":"                \u0027path\u0027: BASE_PATH"},{"line_number":33,"context_line":"            }"},{"line_number":34,"context_line":"        ],"},{"line_number":35,"context_line":"        scope_types\u003d[\u0027system\u0027]"},{"line_number":36,"context_line":"    ),"},{"line_number":37,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":38,"context_line":"        UPDATE,"}],"source_content_type":"text/x-python","patch_set":1,"id":"5f7c97a3_5e6e3b2f","line":35,"range":{"start_line":35,"start_character":0,"end_line":35,"end_character":30},"updated":"2018-05-31 07:37:35.000000000","message":"Does adding scope_types to system break upgrade? I mean if current admin token is being given system scope as default by keystone then it is ok but if it is not then, existing admin user will be 403 to access these API right?\n\nOne more point-.\nAll non-GET placement APIs seems system scope so looks ok to add scope_type in policy which is not going to change.  But for GET APIs which will later be defaulted to non-admin or more appropriate default roles like \"auditor\" then again we have to change their scope_types to \u0027project\u0027. So we end up changing the scope twice. If we leave scope_type for GET APIs as now and add only when we will make them with correct default roles then, we will add correct scope_type in single shot.","commit_id":"9e44dc34665bcdabe93322349a230d2a0ece17cc"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"7f15b1d8555b5115d823ba4491aa2bc5c83e5ac9","unresolved":false,"context_lines":[{"line_number":32,"context_line":"                \u0027path\u0027: BASE_PATH"},{"line_number":33,"context_line":"            }"},{"line_number":34,"context_line":"        ],"},{"line_number":35,"context_line":"        scope_types\u003d[\u0027system\u0027]"},{"line_number":36,"context_line":"    ),"},{"line_number":37,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":38,"context_line":"        UPDATE,"}],"source_content_type":"text/x-python","patch_set":1,"id":"5f7c97a3_70573f28","line":35,"range":{"start_line":35,"start_character":0,"end_line":35,"end_character":30},"in_reply_to":"5f7c97a3_3a001434","updated":"2018-06-06 04:15:02.000000000","message":"Okay, so \u0027system\u0027 scope is \"APIs that do not map nicely to the concept of Project scope\" i.e. don\u0027t have a concept of project tenancy. That seems so with placement aggregates.\n\n[1] https://specs.openstack.org/openstack/keystone-specs/specs/keystone/rocky/define-default-roles.html#scope-type-refresher","commit_id":"9e44dc34665bcdabe93322349a230d2a0ece17cc"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"2b03d89fd0695e164a4236dcd43c0eaa305b2d77","unresolved":false,"context_lines":[{"line_number":32,"context_line":"                \u0027path\u0027: BASE_PATH"},{"line_number":33,"context_line":"            }"},{"line_number":34,"context_line":"        ],"},{"line_number":35,"context_line":"        scope_types\u003d[\u0027system\u0027]"},{"line_number":36,"context_line":"    ),"},{"line_number":37,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":38,"context_line":"        UPDATE,"}],"source_content_type":"text/x-python","patch_set":1,"id":"5f7c97a3_3a001434","line":35,"range":{"start_line":35,"start_character":0,"end_line":35,"end_character":30},"in_reply_to":"5f7c97a3_58dde6da","updated":"2018-06-01 09:06:31.000000000","message":"yes scope enforce is not enabled by default so scope things looks god to me.\n\nnot sure about not changing default to non-admin as they are GET but yes we can discuss that later when we think of doing correct default. as of now i am ok here.","commit_id":"9e44dc34665bcdabe93322349a230d2a0ece17cc"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"c26cece97c1297be6d18d426fd636b3e74a97471","unresolved":false,"context_lines":[{"line_number":32,"context_line":"                \u0027path\u0027: BASE_PATH"},{"line_number":33,"context_line":"            }"},{"line_number":34,"context_line":"        ],"},{"line_number":35,"context_line":"        scope_types\u003d[\u0027system\u0027]"},{"line_number":36,"context_line":"    ),"},{"line_number":37,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":38,"context_line":"        UPDATE,"}],"source_content_type":"text/x-python","patch_set":1,"id":"5f7c97a3_58dde6da","line":35,"range":{"start_line":35,"start_character":0,"end_line":35,"end_character":30},"in_reply_to":"5f7c97a3_5e6e3b2f","updated":"2018-05-31 18:06:48.000000000","message":"By default, oslo.policy doesn\u0027t enforce scope, see:\n\nhttps://docs.openstack.org/nova/latest/configuration/config.html#oslo_policy.enforce_scope\n\nI also don\u0027t think we\u0027re going to change the defaults to non-admins.\n\nWhat happens with system vs project scope for some of this stuff remains to be seen and it\u0027s something I\u0027ve been asking about in the mailing list:\n\nhttp://lists.openstack.org/pipermail/openstack-dev/2018-May/130874.html","commit_id":"9e44dc34665bcdabe93322349a230d2a0ece17cc"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"d673f5b19d6226a934fb5111f2440fe01ebbc084","unresolved":false,"context_lines":[{"line_number":44,"context_line":"                \u0027path\u0027: BASE_PATH"},{"line_number":45,"context_line":"            }"},{"line_number":46,"context_line":"        ],"},{"line_number":47,"context_line":"        scope_types\u003d[\u0027system\u0027]"},{"line_number":48,"context_line":"    ),"},{"line_number":49,"context_line":"]"},{"line_number":50,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"5f7c97a3_7e69b722","line":47,"range":{"start_line":47,"start_character":0,"end_line":47,"end_character":30},"updated":"2018-05-31 07:37:35.000000000","message":"ditto","commit_id":"9e44dc34665bcdabe93322349a230d2a0ece17cc"}]}