)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"a7dfd3500d79778ec2eb2ea17fddc025d0bb5a7d","unresolved":false,"context_lines":[{"line_number":7,"context_line":"Allow ability for non admin users to list all flavors."},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Adds a new policy rule \"os_compute_api:flavors:all\" to control"},{"line_number":10,"context_line":"whether a user can list or show all flavors including disabled"},{"line_number":11,"context_line":"and non public flavors."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Closes-bug: #1796599"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"3f79a3b5_87d5b81c","line":10,"range":{"start_line":10,"start_character":54,"end_line":10,"end_character":62},"updated":"2018-10-10 22:11:37.000000000","message":"nit: we could omit this since there is no way to actually disable flavors via the compute API, it\u0027s a vestigial tail from the very old rax days.","commit_id":"cdd9ed99b51ee026088d326f08c251d8f50618e9"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"08d0e9b60dd4583236dbe618d155bab4b7217cc0","unresolved":false,"context_lines":[{"line_number":9,"context_line":"Adds a new policy rule \"os_compute_api:flavors:all\" to control"},{"line_number":10,"context_line":"whether a user can list or show all flavors including disabled"},{"line_number":11,"context_line":"and non public flavors."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Closes-bug: #1796599"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Change-Id: I715c3d0f3d7d754b4f4443ebfb9d3cda354bbbed"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"3f79a3b5_a732345c","line":12,"updated":"2018-10-10 22:12:23.000000000","message":"I would suggest providing a short sentence on the use case here, e.g. non-admin support role user is trying to triage a ticket for a server create that failed and was using a private flavor.","commit_id":"cdd9ed99b51ee026088d326f08c251d8f50618e9"}],"nova/objects/flavor.py":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"a7dfd3500d79778ec2eb2ea17fddc025d0bb5a7d","unresolved":false,"context_lines":[{"line_number":274,"context_line":"    def _flavor_get_query_from_db(context):"},{"line_number":275,"context_line":"        query \u003d context.session.query(api_models.Flavors).\\"},{"line_number":276,"context_line":"                options(joinedload(\u0027extra_specs\u0027))"},{"line_number":277,"context_line":"        if not context.can(flavor_policies.POLICY_ROOT % \u0027all\u0027, fatal\u003dFalse):"},{"line_number":278,"context_line":"            the_filter \u003d [api_models.Flavors.is_public \u003d\u003d true()]"},{"line_number":279,"context_line":"            the_filter.extend(["},{"line_number":280,"context_line":"                api_models.Flavors.projects.any(project_id\u003dcontext.project_id)"}],"source_content_type":"text/x-python","patch_set":3,"id":"3f79a3b5_87aa986a","line":277,"range":{"start_line":277,"start_character":8,"end_line":277,"end_character":77},"updated":"2018-10-10 22:11:37.000000000","message":"OK this is where the GET /flavors/{flavor_id} (show) case is handled.","commit_id":"cdd9ed99b51ee026088d326f08c251d8f50618e9"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"594f7b919b30f8283310dcbf4af75d9825dde01e","unresolved":false,"context_lines":[{"line_number":274,"context_line":"    def _flavor_get_query_from_db(context):"},{"line_number":275,"context_line":"        query \u003d context.session.query(api_models.Flavors).\\"},{"line_number":276,"context_line":"                options(joinedload(\u0027extra_specs\u0027))"},{"line_number":277,"context_line":"        if not context.can(flavor_policies.POLICY_ROOT % \u0027all\u0027, fatal\u003dFalse):"},{"line_number":278,"context_line":"            the_filter \u003d [api_models.Flavors.is_public \u003d\u003d true()]"},{"line_number":279,"context_line":"            the_filter.extend(["},{"line_number":280,"context_line":"                api_models.Flavors.projects.any(project_id\u003dcontext.project_id)"}],"source_content_type":"text/x-python","patch_set":3,"id":"3f79a3b5_c8d963f1","line":277,"range":{"start_line":277,"start_character":8,"end_line":277,"end_character":77},"in_reply_to":"3f79a3b5_87aa986a","updated":"2018-10-12 02:02:24.000000000","message":"In the before, we move all the policy to the entry of REST API, this move the policy deep into our code again.","commit_id":"cdd9ed99b51ee026088d326f08c251d8f50618e9"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"80abc3bacf171205bebf8d8502eed0e87f2182d7","unresolved":false,"context_lines":[{"line_number":271,"context_line":""},{"line_number":272,"context_line":"    @staticmethod"},{"line_number":273,"context_line":"    @db_api.api_context_manager.reader"},{"line_number":274,"context_line":"    def _flavor_get_query_from_db(context):"},{"line_number":275,"context_line":"        query \u003d context.session.query(api_models.Flavors).\\"},{"line_number":276,"context_line":"                options(joinedload(\u0027extra_specs\u0027))"},{"line_number":277,"context_line":"        if not context.can(flavor_policies.POLICY_ROOT % \u0027view_all\u0027, fatal\u003dFalse):"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_df812cfc","line":274,"range":{"start_line":274,"start_character":2,"end_line":274,"end_character":43},"updated":"2018-10-11 10:43:24.000000000","message":"this is being used while updating the flavor also so this will affect PUT flavor API also.\n- currently public flavors are only allowed to be updated by admin. if not admin and flavor is not public then it return 404 even user has access to update flavor via update policy.\n\nIf we want to remove the hard-coded admin check for public flavor (which is this function also) then, question is whether it is going to be a behavior change of PUT flavor API ?\n\nBecause if any deployment has override the PUT flavor policy to non-admin then, \n- in current situation they get 404 if try to update the non-public flavor (because of this method check).\n- In new situation they can do it successfully because they have access to update the flavor policy.\n\nOR do we want to control PUT flavor API also with new public flavor policy (introduced in this patch) ? in that case there will be 2 policy enforcement for PUT flavor API.","commit_id":"19021f4655a6fdc8898ccbb3ab427e6c14a814fa"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"b2d6fd0e6ee1f2f1bddb56b124fa56dac81e4b14","unresolved":false,"context_lines":[{"line_number":271,"context_line":""},{"line_number":272,"context_line":"    @staticmethod"},{"line_number":273,"context_line":"    @db_api.api_context_manager.reader"},{"line_number":274,"context_line":"    def _flavor_get_query_from_db(context):"},{"line_number":275,"context_line":"        query \u003d context.session.query(api_models.Flavors).\\"},{"line_number":276,"context_line":"                options(joinedload(\u0027extra_specs\u0027))"},{"line_number":277,"context_line":"        if not context.can(flavor_policies.POLICY_ROOT % \u0027view_all\u0027, fatal\u003dFalse):"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_ce75ebca","line":274,"range":{"start_line":274,"start_character":2,"end_line":274,"end_character":43},"in_reply_to":"3f79a3b5_8cf3826d","updated":"2018-10-12 08:10:33.000000000","message":"True they have their own policy but admin context check(this place) is there for other APIs, not create flavor and delete flavor but update flavor, create server, resize server. These API call this method _flavor_get_query_from_db() (via compute/flavors.py-\u003eobjects/flavors.py-\u003eget_by_flavor_id()). Which means if the requester of those API is non-admin and send the non-public flavor id in those API request then, those API will return 400 because the requester does not have access to requested non-public flavor. \n\nfor example, if i am not admin and call POST/servers with private flavor id, i get 404.\n\nTO change the hardcoded check of admin for private flavor for GET flavor API only, we need to send the filter from REST API controller only and leave this check as it is so that no change in other API behaviour.","commit_id":"19021f4655a6fdc8898ccbb3ab427e6c14a814fa"},{"author":{"_account_id":3031,"name":"Sam Morrison","email":"sorrison@gmail.com","username":"sorrison"},"change_message_id":"40a4ddb301a02fc3928b9ad077d571cd98f340c6","unresolved":false,"context_lines":[{"line_number":271,"context_line":""},{"line_number":272,"context_line":"    @staticmethod"},{"line_number":273,"context_line":"    @db_api.api_context_manager.reader"},{"line_number":274,"context_line":"    def _flavor_get_query_from_db(context):"},{"line_number":275,"context_line":"        query \u003d context.session.query(api_models.Flavors).\\"},{"line_number":276,"context_line":"                options(joinedload(\u0027extra_specs\u0027))"},{"line_number":277,"context_line":"        if not context.can(flavor_policies.POLICY_ROOT % \u0027view_all\u0027, fatal\u003dFalse):"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_8cf3826d","line":274,"range":{"start_line":274,"start_character":2,"end_line":274,"end_character":43},"in_reply_to":"3f79a3b5_96215ab8","updated":"2018-10-11 22:37:37.000000000","message":"Flavor create/update/delete already has its own policy checks eg https://github.com/openstack/nova/blob/7a5d7db7fc6ccfbd97508a1e8cd353ec25cf8ca2/nova/api/openstack/compute/flavor_manage.py#L55\n\nSo I don\u0027t think this is changing the behaviour of those methods.","commit_id":"19021f4655a6fdc8898ccbb3ab427e6c14a814fa"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"8b47f8b597de7d4bf3286d6da6e18fabb1ec5cd7","unresolved":false,"context_lines":[{"line_number":271,"context_line":""},{"line_number":272,"context_line":"    @staticmethod"},{"line_number":273,"context_line":"    @db_api.api_context_manager.reader"},{"line_number":274,"context_line":"    def _flavor_get_query_from_db(context):"},{"line_number":275,"context_line":"        query \u003d context.session.query(api_models.Flavors).\\"},{"line_number":276,"context_line":"                options(joinedload(\u0027extra_specs\u0027))"},{"line_number":277,"context_line":"        if not context.can(flavor_policies.POLICY_ROOT % \u0027view_all\u0027, fatal\u003dFalse):"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_96215ab8","line":274,"range":{"start_line":274,"start_character":2,"end_line":274,"end_character":43},"in_reply_to":"3f79a3b5_d5e7cbaa","updated":"2018-10-11 13:41:36.000000000","message":"ok, in that case we need to explicitly pass the filter based on policy from show method and skip existing admin check in that case.","commit_id":"19021f4655a6fdc8898ccbb3ab427e6c14a814fa"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"dc0e467bd06a75ef7de6f0d669d49a04aa76535f","unresolved":false,"context_lines":[{"line_number":271,"context_line":""},{"line_number":272,"context_line":"    @staticmethod"},{"line_number":273,"context_line":"    @db_api.api_context_manager.reader"},{"line_number":274,"context_line":"    def _flavor_get_query_from_db(context):"},{"line_number":275,"context_line":"        query \u003d context.session.query(api_models.Flavors).\\"},{"line_number":276,"context_line":"                options(joinedload(\u0027extra_specs\u0027))"},{"line_number":277,"context_line":"        if not context.can(flavor_policies.POLICY_ROOT % \u0027view_all\u0027, fatal\u003dFalse):"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_d5e7cbaa","line":274,"range":{"start_line":274,"start_character":2,"end_line":274,"end_character":43},"in_reply_to":"3f79a3b5_df812cfc","updated":"2018-10-11 12:27:17.000000000","message":"I think Sam just wants to have a policy for non-admins to read (show/list) flavors, not create or update them.","commit_id":"19021f4655a6fdc8898ccbb3ab427e6c14a814fa"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"80abc3bacf171205bebf8d8502eed0e87f2182d7","unresolved":false,"context_lines":[{"line_number":272,"context_line":"    @staticmethod"},{"line_number":273,"context_line":"    @db_api.api_context_manager.reader"},{"line_number":274,"context_line":"    def _flavor_get_query_from_db(context):"},{"line_number":275,"context_line":"        query \u003d context.session.query(api_models.Flavors).\\"},{"line_number":276,"context_line":"                options(joinedload(\u0027extra_specs\u0027))"},{"line_number":277,"context_line":"        if not context.can(flavor_policies.POLICY_ROOT % \u0027view_all\u0027, fatal\u003dFalse):"},{"line_number":278,"context_line":"            the_filter \u003d [api_models.Flavors.is_public \u003d\u003d true()]"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_3f706041","line":275,"range":{"start_line":275,"start_character":0,"end_line":275,"end_character":8},"updated":"2018-10-11 10:43:24.000000000","message":"Also same case for POST /servers [1], resize servers [2] APIs as this method is being used on those APIs.\n\n[1] https://github.com/openstack/nova/blob/7a5d7db7fc6ccfbd97508a1e8cd353ec25cf8ca2/nova/api/openstack/compute/servers.py#L579\n\n[2] https://github.com/openstack/nova/blob/7a5d7db7fc6ccfbd97508a1e8cd353ec25cf8ca2/nova/compute/api.py#L3418","commit_id":"19021f4655a6fdc8898ccbb3ab427e6c14a814fa"},{"author":{"_account_id":3031,"name":"Sam Morrison","email":"sorrison@gmail.com","username":"sorrison"},"change_message_id":"40a4ddb301a02fc3928b9ad077d571cd98f340c6","unresolved":false,"context_lines":[{"line_number":272,"context_line":"    @staticmethod"},{"line_number":273,"context_line":"    @db_api.api_context_manager.reader"},{"line_number":274,"context_line":"    def _flavor_get_query_from_db(context):"},{"line_number":275,"context_line":"        query \u003d context.session.query(api_models.Flavors).\\"},{"line_number":276,"context_line":"                options(joinedload(\u0027extra_specs\u0027))"},{"line_number":277,"context_line":"        if not context.can(flavor_policies.POLICY_ROOT % \u0027view_all\u0027, fatal\u003dFalse):"},{"line_number":278,"context_line":"            the_filter \u003d [api_models.Flavors.is_public \u003d\u003d true()]"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_ec547658","line":275,"range":{"start_line":275,"start_character":0,"end_line":275,"end_character":8},"in_reply_to":"3f79a3b5_3f706041","updated":"2018-10-11 22:37:37.000000000","message":"I think this is OK? If a user has the ability to see all private flavors then they should also have the ability to resize/boot to one of those flavors?","commit_id":"19021f4655a6fdc8898ccbb3ab427e6c14a814fa"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"b2d6fd0e6ee1f2f1bddb56b124fa56dac81e4b14","unresolved":false,"context_lines":[{"line_number":272,"context_line":"    @staticmethod"},{"line_number":273,"context_line":"    @db_api.api_context_manager.reader"},{"line_number":274,"context_line":"    def _flavor_get_query_from_db(context):"},{"line_number":275,"context_line":"        query \u003d context.session.query(api_models.Flavors).\\"},{"line_number":276,"context_line":"                options(joinedload(\u0027extra_specs\u0027))"},{"line_number":277,"context_line":"        if not context.can(flavor_policies.POLICY_ROOT % \u0027view_all\u0027, fatal\u003dFalse):"},{"line_number":278,"context_line":"            the_filter \u003d [api_models.Flavors.is_public \u003d\u003d true()]"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_8e32930e","line":275,"range":{"start_line":275,"start_character":0,"end_line":275,"end_character":8},"in_reply_to":"3f79a3b5_ec547658","updated":"2018-10-12 08:10:33.000000000","message":"Yeah that case is fine but if user does not have access to private flavor then they should not be able to boot instance from those private flavor(which is taken care by this admin check)","commit_id":"19021f4655a6fdc8898ccbb3ab427e6c14a814fa"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"80abc3bacf171205bebf8d8502eed0e87f2182d7","unresolved":false,"context_lines":[{"line_number":274,"context_line":"    def _flavor_get_query_from_db(context):"},{"line_number":275,"context_line":"        query \u003d context.session.query(api_models.Flavors).\\"},{"line_number":276,"context_line":"                options(joinedload(\u0027extra_specs\u0027))"},{"line_number":277,"context_line":"        if not context.can(flavor_policies.POLICY_ROOT % \u0027view_all\u0027, fatal\u003dFalse):"},{"line_number":278,"context_line":"            the_filter \u003d [api_models.Flavors.is_public \u003d\u003d true()]"},{"line_number":279,"context_line":"            the_filter.extend(["},{"line_number":280,"context_line":"                api_models.Flavors.projects.any(project_id\u003dcontext.project_id)"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_ff8bc813","line":277,"range":{"start_line":277,"start_character":0,"end_line":277,"end_character":82},"updated":"2018-10-11 10:43:24.000000000","message":"we should move this policy check to controller side. This is what we did about moving the all policy checks on controller side from DB and object or even at lower layer. \n\nAlso this check can effect other place also where this query build function is used. \n\nwe can remove the below filter and this condition from here and then pass the filter \u0027is_public\u0027 from controller show method based on policy like what details API does.","commit_id":"19021f4655a6fdc8898ccbb3ab427e6c14a814fa"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"8b47f8b597de7d4bf3286d6da6e18fabb1ec5cd7","unresolved":false,"context_lines":[{"line_number":274,"context_line":"    def _flavor_get_query_from_db(context):"},{"line_number":275,"context_line":"        query \u003d context.session.query(api_models.Flavors).\\"},{"line_number":276,"context_line":"                options(joinedload(\u0027extra_specs\u0027))"},{"line_number":277,"context_line":"        if not context.can(flavor_policies.POLICY_ROOT % \u0027view_all\u0027, fatal\u003dFalse):"},{"line_number":278,"context_line":"            the_filter \u003d [api_models.Flavors.is_public \u003d\u003d true()]"},{"line_number":279,"context_line":"            the_filter.extend(["},{"line_number":280,"context_line":"                api_models.Flavors.projects.any(project_id\u003dcontext.project_id)"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_76fd9e07","line":277,"range":{"start_line":277,"start_character":0,"end_line":277,"end_character":82},"in_reply_to":"3f79a3b5_55f3bb6d","updated":"2018-10-11 13:41:36.000000000","message":"yeah,  - https://review.openstack.org/#/c/608474/4/nova/api/openstack/compute/flavors.py@68","commit_id":"19021f4655a6fdc8898ccbb3ab427e6c14a814fa"},{"author":{"_account_id":3031,"name":"Sam Morrison","email":"sorrison@gmail.com","username":"sorrison"},"change_message_id":"40a4ddb301a02fc3928b9ad077d571cd98f340c6","unresolved":false,"context_lines":[{"line_number":274,"context_line":"    def _flavor_get_query_from_db(context):"},{"line_number":275,"context_line":"        query \u003d context.session.query(api_models.Flavors).\\"},{"line_number":276,"context_line":"                options(joinedload(\u0027extra_specs\u0027))"},{"line_number":277,"context_line":"        if not context.can(flavor_policies.POLICY_ROOT % \u0027view_all\u0027, fatal\u003dFalse):"},{"line_number":278,"context_line":"            the_filter \u003d [api_models.Flavors.is_public \u003d\u003d true()]"},{"line_number":279,"context_line":"            the_filter.extend(["},{"line_number":280,"context_line":"                api_models.Flavors.projects.any(project_id\u003dcontext.project_id)"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_6cf62661","line":277,"range":{"start_line":277,"start_character":0,"end_line":277,"end_character":82},"in_reply_to":"3f79a3b5_76fd9e07","updated":"2018-10-11 22:37:37.000000000","message":"Yeah ok this makes sense. It would also depend on whether it would be expected to allow you to boot/resize using these flavors too as then we would need to put policy checks at these points to to know whether to add the is_public\u003dNone filter too. Seems like this would be better to do in one place","commit_id":"19021f4655a6fdc8898ccbb3ab427e6c14a814fa"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"dc0e467bd06a75ef7de6f0d669d49a04aa76535f","unresolved":false,"context_lines":[{"line_number":274,"context_line":"    def _flavor_get_query_from_db(context):"},{"line_number":275,"context_line":"        query \u003d context.session.query(api_models.Flavors).\\"},{"line_number":276,"context_line":"                options(joinedload(\u0027extra_specs\u0027))"},{"line_number":277,"context_line":"        if not context.can(flavor_policies.POLICY_ROOT % \u0027view_all\u0027, fatal\u003dFalse):"},{"line_number":278,"context_line":"            the_filter \u003d [api_models.Flavors.is_public \u003d\u003d true()]"},{"line_number":279,"context_line":"            the_filter.extend(["},{"line_number":280,"context_line":"                api_models.Flavors.projects.any(project_id\u003dcontext.project_id)"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_55f3bb6d","line":277,"range":{"start_line":277,"start_character":0,"end_line":277,"end_character":82},"in_reply_to":"3f79a3b5_ff8bc813","updated":"2018-10-11 12:27:17.000000000","message":"By \"controller side\" you mean the actual show/index/detail/etc methods?","commit_id":"19021f4655a6fdc8898ccbb3ab427e6c14a814fa"}],"nova/policies/flavors.py":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"9cc27f7dd502de28e957213ec02a79eb6a85cca1","unresolved":false,"context_lines":[{"line_number":30,"context_line":"        check_str\u003dbase.RULE_ADMIN_OR_OWNER,"},{"line_number":31,"context_line":"        description\u003d\u0027Deprecated in Pike and will be removed in next release\u0027),"},{"line_number":32,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":33,"context_line":"        POLICY_ROOT % \u0027all\u0027,"},{"line_number":34,"context_line":"        base.RULE_ADMIN_API,"},{"line_number":35,"context_line":"        \u0027List all flavors\u0027,"},{"line_number":36,"context_line":"        ["}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_861ddabf","line":33,"range":{"start_line":33,"start_character":23,"end_line":33,"end_character":26},"updated":"2018-10-09 22:20:14.000000000","message":"list_all?","commit_id":"1a5a055b2ebf8a8c84631a0cad8570f577dfc37e"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"9cc27f7dd502de28e957213ec02a79eb6a85cca1","unresolved":false,"context_lines":[{"line_number":32,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":33,"context_line":"        POLICY_ROOT % \u0027all\u0027,"},{"line_number":34,"context_line":"        base.RULE_ADMIN_API,"},{"line_number":35,"context_line":"        \u0027List all flavors\u0027,"},{"line_number":36,"context_line":"        ["},{"line_number":37,"context_line":"            {"},{"line_number":38,"context_line":"                \u0027method\u0027: \u0027GET\u0027,"}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_c623d205","line":35,"range":{"start_line":35,"start_character":9,"end_line":35,"end_character":25},"updated":"2018-10-09 22:20:14.000000000","message":"including private flavors.","commit_id":"1a5a055b2ebf8a8c84631a0cad8570f577dfc37e"},{"author":{"_account_id":15888,"name":"Zhenyu Zheng","email":"zheng.zhenyu@outlook.com","username":"Kevin_Zheng"},"change_message_id":"912504cf26308810f52dcd936e75ff4d0eccc5fe","unresolved":false,"context_lines":[{"line_number":32,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":33,"context_line":"        POLICY_ROOT % \u0027all\u0027,"},{"line_number":34,"context_line":"        base.RULE_ADMIN_API,"},{"line_number":35,"context_line":"        \u0027List all flavors including private flavors\u0027,"},{"line_number":36,"context_line":"        ["},{"line_number":37,"context_line":"            {"},{"line_number":38,"context_line":"                \u0027method\u0027: \u0027GET\u0027,"}],"source_content_type":"text/x-python","patch_set":2,"id":"3f79a3b5_7a360db6","line":35,"range":{"start_line":35,"start_character":36,"end_line":35,"end_character":51},"updated":"2018-10-10 02:53:30.000000000","message":"and disabled?","commit_id":"eb2739b7415b524c6aa4909b78131f4199211e0f"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"a7dfd3500d79778ec2eb2ea17fddc025d0bb5a7d","unresolved":false,"context_lines":[{"line_number":30,"context_line":"        check_str\u003dbase.RULE_ADMIN_OR_OWNER,"},{"line_number":31,"context_line":"        description\u003d\u0027Deprecated in Pike and will be removed in next release\u0027),"},{"line_number":32,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":33,"context_line":"        POLICY_ROOT % \u0027all\u0027,"},{"line_number":34,"context_line":"        base.RULE_ADMIN_API,"},{"line_number":35,"context_line":"        \u0027List all flavors including private and disabled flavors\u0027,"},{"line_number":36,"context_line":"        ["}],"source_content_type":"text/x-python","patch_set":3,"id":"3f79a3b5_c702d072","line":33,"range":{"start_line":33,"start_character":23,"end_line":33,"end_character":26},"updated":"2018-10-10 22:11:37.000000000","message":"Maybe \"read\" would be a better term? Or \"view\"? Something like that? Or simply just \"show\". I\u0027m not sure, this is kind of like all_tenants but not the same.","commit_id":"cdd9ed99b51ee026088d326f08c251d8f50618e9"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ff9dee80cacb73da4ba7cbe7392c2222a35a7e17","unresolved":false,"context_lines":[{"line_number":30,"context_line":"        check_str\u003dbase.RULE_ADMIN_OR_OWNER,"},{"line_number":31,"context_line":"        description\u003d\u0027Deprecated in Pike and will be removed in next release\u0027),"},{"line_number":32,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":33,"context_line":"        POLICY_ROOT % \u0027all\u0027,"},{"line_number":34,"context_line":"        base.RULE_ADMIN_API,"},{"line_number":35,"context_line":"        \u0027List all flavors including private and disabled flavors\u0027,"},{"line_number":36,"context_line":"        ["}],"source_content_type":"text/x-python","patch_set":3,"id":"3f79a3b5_3d037e78","line":33,"range":{"start_line":33,"start_character":23,"end_line":33,"end_character":26},"in_reply_to":"3f79a3b5_c702d072","updated":"2018-10-11 18:29:15.000000000","message":"I\u0027m not a huge fan of encoding terms like \"all\" in policy names. Simply because it implies something users or operators expect about the response if the policy check passes.\n\nA good example of this is that \"all\" could mean something different to two different users with different levels of authorization. E.g., a user with authorization to do anything within the deployment might expect \"all\" things to be returned, regardless of the owning project or tenant. But what about the user who just has a role on a single project? All to them might only mean \"all\" things within that project. So it\u0027s really open to interpretation based on the authorization of the user accessing the API.\n\nIs ``compute:flavor:list`` taken? Something like that makes the policy descriptive without have to encode expectations into it by processing authorization when the API is accessed and formatting the response accordingly.\n\nAlso - I\u0027m working on some documentation to help sort out conventions. Hopefully, it helps give direction in situations like this.\n\n\nhttps://review.openstack.org/#/c/606214/","commit_id":"cdd9ed99b51ee026088d326f08c251d8f50618e9"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"a7dfd3500d79778ec2eb2ea17fddc025d0bb5a7d","unresolved":false,"context_lines":[{"line_number":32,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":33,"context_line":"        POLICY_ROOT % \u0027all\u0027,"},{"line_number":34,"context_line":"        base.RULE_ADMIN_API,"},{"line_number":35,"context_line":"        \u0027List all flavors including private and disabled flavors\u0027,"},{"line_number":36,"context_line":"        ["},{"line_number":37,"context_line":"            {"},{"line_number":38,"context_line":"                \u0027method\u0027: \u0027GET\u0027,"}],"source_content_type":"text/x-python","patch_set":3,"id":"3f79a3b5_a7da3447","line":35,"range":{"start_line":35,"start_character":48,"end_line":35,"end_character":56},"updated":"2018-10-10 22:11:37.000000000","message":"same, I\u0027d probably nix this","commit_id":"cdd9ed99b51ee026088d326f08c251d8f50618e9"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"a7dfd3500d79778ec2eb2ea17fddc025d0bb5a7d","unresolved":false,"context_lines":[{"line_number":35,"context_line":"        \u0027List all flavors including private and disabled flavors\u0027,"},{"line_number":36,"context_line":"        ["},{"line_number":37,"context_line":"            {"},{"line_number":38,"context_line":"                \u0027method\u0027: \u0027GET\u0027,"},{"line_number":39,"context_line":"                \u0027path\u0027: \u0027/flavors\u0027"},{"line_number":40,"context_line":"            },"},{"line_number":41,"context_line":"            {"},{"line_number":42,"context_line":"                \u0027method\u0027: \u0027GET\u0027,"}],"source_content_type":"text/x-python","patch_set":3,"id":"3f79a3b5_07e9a8e2","line":39,"range":{"start_line":38,"start_character":16,"end_line":39,"end_character":34},"updated":"2018-10-10 22:11:37.000000000","message":"Is this policy check also applied to GET /flavors/{flavor_id} (show)?","commit_id":"cdd9ed99b51ee026088d326f08c251d8f50618e9"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"80abc3bacf171205bebf8d8502eed0e87f2182d7","unresolved":false,"context_lines":[{"line_number":30,"context_line":"        check_str\u003dbase.RULE_ADMIN_OR_OWNER,"},{"line_number":31,"context_line":"        description\u003d\u0027Deprecated in Pike and will be removed in next release\u0027),"},{"line_number":32,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":33,"context_line":"        POLICY_ROOT % \u0027view_all\u0027,"},{"line_number":34,"context_line":"        base.RULE_ADMIN_API,"},{"line_number":35,"context_line":"        \u0027List all flavors including private flavors\u0027,"},{"line_number":36,"context_line":"        ["}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_df960c3e","line":33,"range":{"start_line":33,"start_character":0,"end_line":33,"end_character":33},"updated":"2018-10-11 10:43:24.000000000","message":"there are effort going on for consistent policy name[1](thanks to lance) so we can consider that for new policies at least (existing one will be taken care by https://review.openstack.org/#/c/547850/). \n\nfrom that, it seems we can name this policy name as:  \"compute_api:flavors:public\" but that is my proposal on consistent policy name patch which is not finalized. \n\nBut for sure we should remove the os- , _api, etc from policy name\n\n\n\n[1] http://lists.openstack.org/pipermail/openstack-dev/2018-September/134597.html\nhttps://review.openstack.org/#/c/606214/","commit_id":"19021f4655a6fdc8898ccbb3ab427e6c14a814fa"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"fc45aa7e2de15fe65b132149a37dc5cec2bec2b7","unresolved":false,"context_lines":[{"line_number":30,"context_line":"        check_str\u003dbase.RULE_ADMIN_OR_OWNER,"},{"line_number":31,"context_line":"        description\u003d\u0027Deprecated in Pike and will be removed in next release\u0027),"},{"line_number":32,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":33,"context_line":"        POLICY_ROOT % \u0027view_all\u0027,"},{"line_number":34,"context_line":"        base.RULE_ADMIN_API,"},{"line_number":35,"context_line":"        \u0027List all flavors including private flavors\u0027,"},{"line_number":36,"context_line":"        ["}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_5e2dfeab","line":33,"range":{"start_line":33,"start_character":0,"end_line":33,"end_character":33},"in_reply_to":"3f79a3b5_0e1e8373","updated":"2018-10-12 14:21:50.000000000","message":"Actually - based on what Sam said, I\u0027d be inclined to suggest inverting the naming here. It sounds like you want to be more flexible to account for two different things. First, allowing people to list all flavors, both public and private. Second, allowing people to list all public flavors. Is this accurate?\n\nIf so, it sounds like the first would be accomplished by a policy name `compute:flavor:list`, which would be used to protect an API that would return all flavors. The second case could be covered by `compute:flavor:public:list` which would only be used to protect an API that returns public flavors.\n\nI could be in left field, but it seems a little odd to have a policy named `compute:flavor:private:list` that returns an entire set of flavors. The names kinda reads like it\u0027s only meant for a subset?\n\nEither way, the contention should support whatever y\u0027all agree on.","commit_id":"19021f4655a6fdc8898ccbb3ab427e6c14a814fa"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"b2d6fd0e6ee1f2f1bddb56b124fa56dac81e4b14","unresolved":false,"context_lines":[{"line_number":30,"context_line":"        check_str\u003dbase.RULE_ADMIN_OR_OWNER,"},{"line_number":31,"context_line":"        description\u003d\u0027Deprecated in Pike and will be removed in next release\u0027),"},{"line_number":32,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":33,"context_line":"        POLICY_ROOT % \u0027view_all\u0027,"},{"line_number":34,"context_line":"        base.RULE_ADMIN_API,"},{"line_number":35,"context_line":"        \u0027List all flavors including private flavors\u0027,"},{"line_number":36,"context_line":"        ["}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_0e1e8373","line":33,"range":{"start_line":33,"start_character":0,"end_line":33,"end_character":33},"in_reply_to":"3f79a3b5_2c602e0d","updated":"2018-10-12 08:10:33.000000000","message":"yeah this is just more than list. also we can add \u0027list\u0027 also for clear name.\n\n\"compute:flavor:private:list\"\n\nref- https://review.openstack.org/#/c/606214/4/doc/source/user/usage.rst@244","commit_id":"19021f4655a6fdc8898ccbb3ab427e6c14a814fa"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9aa55273666e3e46ec736b3e834f6499f69d0381","unresolved":false,"context_lines":[{"line_number":30,"context_line":"        check_str\u003dbase.RULE_ADMIN_OR_OWNER,"},{"line_number":31,"context_line":"        description\u003d\u0027Deprecated in Pike and will be removed in next release\u0027),"},{"line_number":32,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":33,"context_line":"        POLICY_ROOT % \u0027view_all\u0027,"},{"line_number":34,"context_line":"        base.RULE_ADMIN_API,"},{"line_number":35,"context_line":"        \u0027List all flavors including private flavors\u0027,"},{"line_number":36,"context_line":"        ["}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_dd384a3c","line":33,"range":{"start_line":33,"start_character":0,"end_line":33,"end_character":33},"in_reply_to":"3f79a3b5_364e4696","updated":"2018-10-11 18:30:50.000000000","message":"I\u0027m not a huge fan of encoding terms like \"all\" in policy names. Simply because it implies something users or operators expect about the response if the policy check passes.\n\nA good example of this is that \"all\" could mean something different to two different users with different levels of authorization. E.g., a user with authorization to do anything within the deployment might expect \"all\" things to be returned, regardless of the owning project or tenant. But what about the user who just has a role on a single project? All to them might only mean \"all\" things within that project. So it\u0027s really open to interpretation based on the authorization of the user accessing the API.\n\nIs ``compute:flavor:list`` taken? Something like that makes the policy descriptive without have to encode expectations into it by processing authorization when the API is accessed and formatting the response accordingly.\n\nAlso - I\u0027m working on some documentation to help sort out conventions. Hopefully, it helps give direction in situations like this.\n\n\nhttps://review.openstack.org/#/c/606214/","commit_id":"19021f4655a6fdc8898ccbb3ab427e6c14a814fa"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"8b47f8b597de7d4bf3286d6da6e18fabb1ec5cd7","unresolved":false,"context_lines":[{"line_number":30,"context_line":"        check_str\u003dbase.RULE_ADMIN_OR_OWNER,"},{"line_number":31,"context_line":"        description\u003d\u0027Deprecated in Pike and will be removed in next release\u0027),"},{"line_number":32,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":33,"context_line":"        POLICY_ROOT % \u0027view_all\u0027,"},{"line_number":34,"context_line":"        base.RULE_ADMIN_API,"},{"line_number":35,"context_line":"        \u0027List all flavors including private flavors\u0027,"},{"line_number":36,"context_line":"        ["}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_364e4696","line":33,"range":{"start_line":33,"start_character":0,"end_line":33,"end_character":33},"in_reply_to":"3f79a3b5_55889bc1","updated":"2018-10-11 13:41:36.000000000","message":"right, i was confused with public access vs private access. public is all they already have to private in name lgtm  - \"compute:flavor:private\" \n- no _api\n- no os_\n- resource namesingular","commit_id":"19021f4655a6fdc8898ccbb3ab427e6c14a814fa"},{"author":{"_account_id":3031,"name":"Sam Morrison","email":"sorrison@gmail.com","username":"sorrison"},"change_message_id":"40a4ddb301a02fc3928b9ad077d571cd98f340c6","unresolved":false,"context_lines":[{"line_number":30,"context_line":"        check_str\u003dbase.RULE_ADMIN_OR_OWNER,"},{"line_number":31,"context_line":"        description\u003d\u0027Deprecated in Pike and will be removed in next release\u0027),"},{"line_number":32,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":33,"context_line":"        POLICY_ROOT % \u0027view_all\u0027,"},{"line_number":34,"context_line":"        base.RULE_ADMIN_API,"},{"line_number":35,"context_line":"        \u0027List all flavors including private flavors\u0027,"},{"line_number":36,"context_line":"        ["}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_2c602e0d","line":33,"range":{"start_line":33,"start_character":0,"end_line":33,"end_character":33},"in_reply_to":"3f79a3b5_dd384a3c","updated":"2018-10-11 22:37:37.000000000","message":"OK yes it would be great to get some advice on this ``compute:flavor:list`` to me read as if you can list flavors or not. This policy is for allowing a user to list all flavors no matter if they are public or private or any other restriction like disabled","commit_id":"19021f4655a6fdc8898ccbb3ab427e6c14a814fa"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"dc0e467bd06a75ef7de6f0d669d49a04aa76535f","unresolved":false,"context_lines":[{"line_number":30,"context_line":"        check_str\u003dbase.RULE_ADMIN_OR_OWNER,"},{"line_number":31,"context_line":"        description\u003d\u0027Deprecated in Pike and will be removed in next release\u0027),"},{"line_number":32,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":33,"context_line":"        POLICY_ROOT % \u0027view_all\u0027,"},{"line_number":34,"context_line":"        base.RULE_ADMIN_API,"},{"line_number":35,"context_line":"        \u0027List all flavors including private flavors\u0027,"},{"line_number":36,"context_line":"        ["}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_55889bc1","line":33,"range":{"start_line":33,"start_character":0,"end_line":33,"end_character":33},"in_reply_to":"3f79a3b5_df960c3e","updated":"2018-10-11 12:27:17.000000000","message":"Did you mean \"compute:flavors:public\"? Because you said to drop the _api part.\n\n\"compute_api:flavors:public\" seems confusing, the \"public\" part anyway - it would make more sense to say \"private\" because that is the filter, does the user have access to show/list private flavors, even ones they don\u0027t have access to.","commit_id":"19021f4655a6fdc8898ccbb3ab427e6c14a814fa"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"80abc3bacf171205bebf8d8502eed0e87f2182d7","unresolved":false,"context_lines":[{"line_number":32,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":33,"context_line":"        POLICY_ROOT % \u0027view_all\u0027,"},{"line_number":34,"context_line":"        base.RULE_ADMIN_API,"},{"line_number":35,"context_line":"        \u0027List all flavors including private flavors\u0027,"},{"line_number":36,"context_line":"        ["},{"line_number":37,"context_line":"            {"},{"line_number":38,"context_line":"                \u0027method\u0027: \u0027GET\u0027,"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_7f9fb850","line":35,"range":{"start_line":35,"start_character":0,"end_line":35,"end_character":53},"updated":"2018-10-11 10:43:24.000000000","message":"moving hard coded admin check for public flavor to policy this is going to effect lot more API like POST server, resize server etc (i commented on different file).","commit_id":"19021f4655a6fdc8898ccbb3ab427e6c14a814fa"}],"nova/tests/unit/api/openstack/compute/test_serversV21.py":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"9cc27f7dd502de28e957213ec02a79eb6a85cca1","unresolved":false,"context_lines":[{"line_number":1,"context_line":""},{"line_number":2,"context_line":"# Copyright 2010-2011 OpenStack Foundation"},{"line_number":3,"context_line":"# Copyright 2011 Piston Cloud Computing, Inc."},{"line_number":4,"context_line":"# All Rights Reserved."}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_2682c6c8","line":1,"updated":"2018-10-09 22:20:14.000000000","message":"unrelated, remove","commit_id":"1a5a055b2ebf8a8c84631a0cad8570f577dfc37e"}],"nova/tests/unit/test_policy.py":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"9cc27f7dd502de28e957213ec02a79eb6a85cca1","unresolved":false,"context_lines":[{"line_number":272,"context_line":"        self.target \u003d {}"},{"line_number":273,"context_line":"        self.fake_policy \u003d jsonutils.loads(fake_policy.policy_data)"},{"line_number":274,"context_line":""},{"line_number":275,"context_line":"        self.admin_only_rules \u003d ("},{"line_number":276,"context_line":"\"cells_scheduler_filter:DifferentCellFilter\","},{"line_number":277,"context_line":"\"cells_scheduler_filter:TargetCellFilter\","},{"line_number":278,"context_line":"\"network:attach_external_network\","}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_66619e38","line":275,"range":{"start_line":275,"start_character":13,"end_line":275,"end_character":29},"updated":"2018-10-09 22:20:14.000000000","message":"Should be in the admin rules group since it defaults to admin-only.","commit_id":"1a5a055b2ebf8a8c84631a0cad8570f577dfc37e"}],"releasenotes/notes/add-list-all-flavors-policy-0e93eca64c6a7d0e.yaml":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"9cc27f7dd502de28e957213ec02a79eb6a85cca1","unresolved":false,"context_lines":[{"line_number":2,"context_line":"features:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    A new policy rule ``os_compute_api:flavors:all`` has been"},{"line_number":5,"context_line":"    added to control whether a user can list and show all flavors including"},{"line_number":6,"context_line":"    disabled and non public."}],"source_content_type":"text/x-yaml","patch_set":1,"id":"3f79a3b5_0658ea87","line":5,"range":{"start_line":5,"start_character":49,"end_line":5,"end_character":53},"updated":"2018-10-09 22:20:14.000000000","message":"? this doesn\u0027t touch the show() method.","commit_id":"1a5a055b2ebf8a8c84631a0cad8570f577dfc37e"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"9cc27f7dd502de28e957213ec02a79eb6a85cca1","unresolved":false,"context_lines":[{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    A new policy rule ``os_compute_api:flavors:all`` has been"},{"line_number":5,"context_line":"    added to control whether a user can list and show all flavors including"},{"line_number":6,"context_line":"    disabled and non public."}],"source_content_type":"text/x-yaml","patch_set":1,"id":"3f79a3b5_864b9aaf","line":6,"range":{"start_line":6,"start_character":4,"end_line":6,"end_character":12},"updated":"2018-10-09 22:20:14.000000000","message":"I don\u0027t even think it\u0027s possible to disable a flavor. I found that out recently when digging through this code.","commit_id":"1a5a055b2ebf8a8c84631a0cad8570f577dfc37e"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"a7dfd3500d79778ec2eb2ea17fddc025d0bb5a7d","unresolved":false,"context_lines":[{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    A new policy rule ``os_compute_api:flavors:all`` has been"},{"line_number":5,"context_line":"    added to control whether a user can list and show all flavors including"},{"line_number":6,"context_line":"    disabled and non public."}],"source_content_type":"text/x-yaml","patch_set":3,"id":"3f79a3b5_c727301e","line":6,"range":{"start_line":6,"start_character":4,"end_line":6,"end_character":12},"updated":"2018-10-10 22:11:37.000000000","message":"same","commit_id":"cdd9ed99b51ee026088d326f08c251d8f50618e9"}]}