)]}'
{"oslo_policy/policy.py":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"bde06fa545a8f8de37d7f3454dbbaeed970b481e","unresolved":false,"context_lines":[{"line_number":56,"context_line":""},{"line_number":57,"context_line":"For example, a check on the domain_id would be defined as::"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"    domain_id:\u003csome_value\u003e"},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"It is also possible to perform checks against other attributes that"},{"line_number":62,"context_line":"represent the credentials.  This is done by adding additional values to"}],"source_content_type":"text/x-python","patch_set":1,"id":"fa81d914_fa0f1986","line":59,"updated":"2015-01-29 23:28:51.000000000","message":"I\u0027d actually use user_id here....\n\nand then have another sentence that says: \nTogether with the example shown above, a complete example of a generic check would be:\n\n  user_id:%(user.id)s","commit_id":"48366af2935fb047e09a0f744ab3b37c647e1345"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"e50bc93a803b1286201903e4652c53a3de1a5bef","unresolved":false,"context_lines":[{"line_number":56,"context_line":""},{"line_number":57,"context_line":"For example, a check on the domain_id would be defined as::"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"    domain_id:\u003csome_value\u003e"},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"It is also possible to perform checks against other attributes that"},{"line_number":62,"context_line":"represent the credentials.  This is done by adding additional values to"}],"source_content_type":"text/x-python","patch_set":1,"id":"fa81d914_e37a1076","line":59,"in_reply_to":"fa81d914_fa0f1986","updated":"2015-01-30 00:44:29.000000000","message":"Done","commit_id":"48366af2935fb047e09a0f744ab3b37c647e1345"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"51cb041afe2b70e18c9e565a1292565b6451c6b3","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Policies are expressed as a target and an associated rule::"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"    \"\u003ctarget\u003e\": \"\u003crule\u003e\""},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"The `target` is specific to the service that is conducting policy"},{"line_number":26,"context_line":"enforcement.  Typically, the target refers to an API call."}],"source_content_type":"text/x-python","patch_set":2,"id":"fa81d914_a3a3b8b0","line":23,"updated":"2015-01-30 00:53:47.000000000","message":"think using \"target\" here may confuse users, since is pretty common to have a rule using target, e.g. s(target.project.domain_id)%","commit_id":"e1fbea22c6f84bcba8d2241bf26c1f766f43d20e"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"48a241499977fd59521456df44287a82e766dad0","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Policies are expressed as a target and an associated rule::"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"    \"\u003ctarget\u003e\": \"\u003crule\u003e\""},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"The `target` is specific to the service that is conducting policy"},{"line_number":26,"context_line":"enforcement.  Typically, the target refers to an API call."}],"source_content_type":"text/x-python","patch_set":2,"id":"fa81d914_0ece6bb4","line":23,"in_reply_to":"fa81d914_43dafce8","updated":"2015-01-30 01:26:31.000000000","message":"you are right, target is only used in keystone\u0027s policy. maybe something like \"operation\"? although target is really a more descriptive name.","commit_id":"e1fbea22c6f84bcba8d2241bf26c1f766f43d20e"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"94f2576be5b86726cc287eeac5e3e78c9f491af5","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Policies are expressed as a target and an associated rule::"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"    \"\u003ctarget\u003e\": \"\u003crule\u003e\""},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"The `target` is specific to the service that is conducting policy"},{"line_number":26,"context_line":"enforcement.  Typically, the target refers to an API call."}],"source_content_type":"text/x-python","patch_set":2,"id":"fa81d914_43dafce8","line":23,"in_reply_to":"fa81d914_a3a3b8b0","updated":"2015-01-30 01:12:07.000000000","message":"The \"target.foo.bar\" generic check is specific to Keystone. Target is the most descriptive term I came up with to use here.  I\u0027m open to another suggestion if anyone has one.","commit_id":"e1fbea22c6f84bcba8d2241bf26c1f766f43d20e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"64a0bd00782e9675c7246a8ac7d51f767340fea2","unresolved":false,"context_lines":[{"line_number":30,"context_line":"types are supported, which can be divided into generic checks and"},{"line_number":31,"context_line":"special checks."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"A :class:`generic check \u003copenstack.common.policy.GenericCheck\u003e` is used"},{"line_number":34,"context_line":"to perform matching against attributes that are sent along with the API"},{"line_number":35,"context_line":"calls.  These attributes can be used by the policy engine (on the right"},{"line_number":36,"context_line":"side of the expression), by using the following syntax::"}],"source_content_type":"text/x-python","patch_set":2,"id":"fa81d914_6e4c47c9","line":33,"updated":"2015-01-30 01:56:17.000000000","message":"update this reference.","commit_id":"e1fbea22c6f84bcba8d2241bf26c1f766f43d20e"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"0cd8142ac560739060390af7107ff1519cbd28ee","unresolved":false,"context_lines":[{"line_number":61,"context_line":"Together with the previously shown example, a complete generic check"},{"line_number":62,"context_line":"would be:"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"    user_id:%(user.id)s"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"It is also possible to perform checks against other attributes that"},{"line_number":67,"context_line":"represent the credentials.  This is done by adding additional values to"}],"source_content_type":"text/x-python","patch_set":2,"id":"fa81d914_79ccfa6a","line":64,"updated":"2015-01-30 17:42:33.000000000","message":"What does this rule actually test?","commit_id":"e1fbea22c6f84bcba8d2241bf26c1f766f43d20e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"64a0bd00782e9675c7246a8ac7d51f767340fea2","unresolved":false,"context_lines":[{"line_number":66,"context_line":"It is also possible to perform checks against other attributes that"},{"line_number":67,"context_line":"represent the credentials.  This is done by adding additional values to"},{"line_number":68,"context_line":"the creds dict that is passed to the"},{"line_number":69,"context_line":":meth:`~openstack.common.policy.Enforcer.enforce` method."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"Special checks allow for more flexibility than is possible using generic"},{"line_number":72,"context_line":"checks.  The built-in special check types are \"role\", \"rule\", and \"http\""}],"source_content_type":"text/x-python","patch_set":2,"id":"fa81d914_2e040f49","line":69,"updated":"2015-01-30 01:56:17.000000000","message":"update reference, should be oslo_policy","commit_id":"e1fbea22c6f84bcba8d2241bf26c1f766f43d20e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"64a0bd00782e9675c7246a8ac7d51f767340fea2","unresolved":false,"context_lines":[{"line_number":72,"context_line":"checks.  The built-in special check types are \"role\", \"rule\", and \"http\""},{"line_number":73,"context_line":"checks."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"A :class:`role check \u003copenstack.common.policy.RoleCheck\u003e` is used to"},{"line_number":76,"context_line":"check if a specific role is present in the supplied credentials.  A role"},{"line_number":77,"context_line":"check is expressed as::"},{"line_number":78,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"fa81d914_8ef7bb58","line":75,"updated":"2015-01-30 01:56:17.000000000","message":"update reference","commit_id":"e1fbea22c6f84bcba8d2241bf26c1f766f43d20e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"64a0bd00782e9675c7246a8ac7d51f767340fea2","unresolved":false,"context_lines":[{"line_number":78,"context_line":""},{"line_number":79,"context_line":"    \"role:\u003crole_name\u003e\""},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"A :class:`rule check \u003copenstack.common.policy.RuleCheck\u003e` is used to"},{"line_number":82,"context_line":"reference another defined rule by its name.  This allows for common"},{"line_number":83,"context_line":"checks to be defined once as a reusable rule, which is then referenced"},{"line_number":84,"context_line":"within other rules.  It also allows one to define a set of checks as a"}],"source_content_type":"text/x-python","patch_set":2,"id":"fa81d914_ce9c5312","line":81,"updated":"2015-01-30 01:56:17.000000000","message":"update reference","commit_id":"e1fbea22c6f84bcba8d2241bf26c1f766f43d20e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"64a0bd00782e9675c7246a8ac7d51f767340fea2","unresolved":false,"context_lines":[{"line_number":93,"context_line":"    \"admin_required\": \"role:admin\""},{"line_number":94,"context_line":"    \"\u003ctarget\u003e\": \"rule:admin_required\""},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"A :class:`http check \u003copenstack.common.policy.HttpCheck\u003e` is used to"},{"line_number":97,"context_line":"make an HTTP request to a remote server to determine the results of the"},{"line_number":98,"context_line":"check.  The target and credentials are passed to the remote server for"},{"line_number":99,"context_line":"evaluation.  The action is authorized if the remote server returns a"}],"source_content_type":"text/x-python","patch_set":2,"id":"fa81d914_6e91a7f0","line":96,"updated":"2015-01-30 01:56:17.000000000","message":"update reference.\n\nI wonder if anyone uses this?","commit_id":"e1fbea22c6f84bcba8d2241bf26c1f766f43d20e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"64a0bd00782e9675c7246a8ac7d51f767340fea2","unresolved":false,"context_lines":[{"line_number":109,"context_line":"    \"http://server.test/%(name)s\""},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"It is also possible for additional special check types to be registered"},{"line_number":112,"context_line":"using the :func:`~openstack.common.policy.register` function."},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"Policy rules can be expressed in one of two forms: A list of lists, or a"},{"line_number":115,"context_line":"string written in the new policy language."}],"source_content_type":"text/x-python","patch_set":2,"id":"fa81d914_aebe3f63","line":112,"updated":"2015-01-30 01:56:17.000000000","message":"update reference","commit_id":"e1fbea22c6f84bcba8d2241bf26c1f766f43d20e"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"51cb041afe2b70e18c9e565a1292565b6451c6b3","unresolved":false,"context_lines":[{"line_number":174,"context_line":"associated with the rule name of \"default\" will be used as the default"},{"line_number":175,"context_line":"rule.  It is possible to use a different rule name as the default rule"},{"line_number":176,"context_line":"by setting the \"policy_default_rule\" configuration setting to the"},{"line_number":177,"context_line":"desired rule name."},{"line_number":178,"context_line":"\"\"\""},{"line_number":179,"context_line":""},{"line_number":180,"context_line":"import abc"}],"source_content_type":"text/x-python","patch_set":2,"id":"fa81d914_03af2495","line":177,"updated":"2015-01-30 00:53:47.000000000","message":"new line here?","commit_id":"e1fbea22c6f84bcba8d2241bf26c1f766f43d20e"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"94f2576be5b86726cc287eeac5e3e78c9f491af5","unresolved":false,"context_lines":[{"line_number":174,"context_line":"associated with the rule name of \"default\" will be used as the default"},{"line_number":175,"context_line":"rule.  It is possible to use a different rule name as the default rule"},{"line_number":176,"context_line":"by setting the \"policy_default_rule\" configuration setting to the"},{"line_number":177,"context_line":"desired rule name."},{"line_number":178,"context_line":"\"\"\""},{"line_number":179,"context_line":""},{"line_number":180,"context_line":"import abc"}],"source_content_type":"text/x-python","patch_set":2,"id":"fa81d914_238b48c4","line":177,"in_reply_to":"fa81d914_03af2495","updated":"2015-01-30 01:12:07.000000000","message":"It shouldn\u0027t be needed according to PEP 257 (unless there is some convention here that I\u0027m not aware of).","commit_id":"e1fbea22c6f84bcba8d2241bf26c1f766f43d20e"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"48a241499977fd59521456df44287a82e766dad0","unresolved":false,"context_lines":[{"line_number":174,"context_line":"associated with the rule name of \"default\" will be used as the default"},{"line_number":175,"context_line":"rule.  It is possible to use a different rule name as the default rule"},{"line_number":176,"context_line":"by setting the \"policy_default_rule\" configuration setting to the"},{"line_number":177,"context_line":"desired rule name."},{"line_number":178,"context_line":"\"\"\""},{"line_number":179,"context_line":""},{"line_number":180,"context_line":"import abc"}],"source_content_type":"text/x-python","patch_set":2,"id":"fa81d914_6ebc4707","line":177,"in_reply_to":"fa81d914_238b48c4","updated":"2015-01-30 01:26:31.000000000","message":"hmm not really, was just used to see new lines before \"\"\" :)","commit_id":"e1fbea22c6f84bcba8d2241bf26c1f766f43d20e"}]}