)]}'
{"oslo_policy/_checks.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d88d2c8ef4222d88add788ce112bb5f6afc17b1e","unresolved":false,"context_lines":[{"line_number":23,"context_line":"from oslo_serialization import jsonutils"},{"line_number":24,"context_line":"import requests"},{"line_number":25,"context_line":"import six"},{"line_number":26,"context_line":"import xml.etree.ElementTree as ET"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"registered_checks \u003d {}"},{"line_number":29,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"bae84128_55a43c07","line":26,"updated":"2016-02-24 22:46:27.000000000","message":"xml is a built-in so this belongs in the first section of imports (after line 21)","commit_id":"b0ec64103f5329009a4f21a058ccc20657b98f5d"},{"author":{"_account_id":17862,"name":"Kseniya Tychkova","email":"kseniya.tychkova@gmail.com","username":"ktychkova"},"change_message_id":"3151a78efc30ec8dc434e571daaeae3c8cd8b94f","unresolved":false,"context_lines":[{"line_number":23,"context_line":"from oslo_serialization import jsonutils"},{"line_number":24,"context_line":"import requests"},{"line_number":25,"context_line":"import six"},{"line_number":26,"context_line":"import xml.etree.ElementTree as ET"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"registered_checks \u003d {}"},{"line_number":29,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"5a9d85d2_6a95253f","line":26,"in_reply_to":"bae84128_55a43c07","updated":"2016-06-20 09:29:11.000000000","message":"Done","commit_id":"b0ec64103f5329009a4f21a058ccc20657b98f5d"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d88d2c8ef4222d88add788ce112bb5f6afc17b1e","unresolved":false,"context_lines":[{"line_number":287,"context_line":""},{"line_number":288,"context_line":"        url \u003d \"http://\" + enforcer.conf.oslo_policy.fortress_host + \":\" + \\"},{"line_number":289,"context_line":"              enforcer.conf.oslo_policy.fortress_port + \"/\" + \\"},{"line_number":290,"context_line":"              enforcer.conf.oslo_policy.fortress_service + \"/\""},{"line_number":291,"context_line":"        headers \u003d {\"Accept\": \"text/xml\", \"Content-Type\": \"text/xml\"}"},{"line_number":292,"context_line":"        auth \u003d (enforcer.conf.oslo_policy.fortress_user,"},{"line_number":293,"context_line":"                enforcer.conf.oslo_policy.fortress_password)"}],"source_content_type":"text/x-python","patch_set":1,"id":"bae84128_f5d3d05d","line":290,"updated":"2016-02-24 22:46:27.000000000","message":"rather than split these up into separate config options have a config option with the base url, e.g.,\n\n enforcer.conf.oslo_policy.fortress_base \u003d https://my-fortress/","commit_id":"b0ec64103f5329009a4f21a058ccc20657b98f5d"},{"author":{"_account_id":17862,"name":"Kseniya Tychkova","email":"kseniya.tychkova@gmail.com","username":"ktychkova"},"change_message_id":"3151a78efc30ec8dc434e571daaeae3c8cd8b94f","unresolved":false,"context_lines":[{"line_number":287,"context_line":""},{"line_number":288,"context_line":"        url \u003d \"http://\" + enforcer.conf.oslo_policy.fortress_host + \":\" + \\"},{"line_number":289,"context_line":"              enforcer.conf.oslo_policy.fortress_port + \"/\" + \\"},{"line_number":290,"context_line":"              enforcer.conf.oslo_policy.fortress_service + \"/\""},{"line_number":291,"context_line":"        headers \u003d {\"Accept\": \"text/xml\", \"Content-Type\": \"text/xml\"}"},{"line_number":292,"context_line":"        auth \u003d (enforcer.conf.oslo_policy.fortress_user,"},{"line_number":293,"context_line":"                enforcer.conf.oslo_policy.fortress_password)"}],"source_content_type":"text/x-python","patch_set":1,"id":"5a9d85d2_8a9cd16a","line":290,"in_reply_to":"bae84128_f5d3d05d","updated":"2016-06-20 09:29:11.000000000","message":"Done","commit_id":"b0ec64103f5329009a4f21a058ccc20657b98f5d"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d88d2c8ef4222d88add788ce112bb5f6afc17b1e","unresolved":false,"context_lines":[{"line_number":300,"context_line":"                  \u003copName\u003e{1}\u003c/opName\u003e"},{"line_number":301,"context_line":"                  \u003cadmin\u003efalse\u003c/admin\u003e"},{"line_number":302,"context_line":"               \u003c/entity\u003e"},{"line_number":303,"context_line":"            \u003c/FortRequest\u003e\"\"\".format(self.kind, self.match)"},{"line_number":304,"context_line":""},{"line_number":305,"context_line":"        result \u003d False"},{"line_number":306,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"bae84128_b58ca880","line":303,"updated":"2016-02-24 22:46:27.000000000","message":"Using format for this isn\u0027t safe since values might have XML symbols.","commit_id":"b0ec64103f5329009a4f21a058ccc20657b98f5d"},{"author":{"_account_id":17862,"name":"Kseniya Tychkova","email":"kseniya.tychkova@gmail.com","username":"ktychkova"},"change_message_id":"3151a78efc30ec8dc434e571daaeae3c8cd8b94f","unresolved":false,"context_lines":[{"line_number":300,"context_line":"                  \u003copName\u003e{1}\u003c/opName\u003e"},{"line_number":301,"context_line":"                  \u003cadmin\u003efalse\u003c/admin\u003e"},{"line_number":302,"context_line":"               \u003c/entity\u003e"},{"line_number":303,"context_line":"            \u003c/FortRequest\u003e\"\"\".format(self.kind, self.match)"},{"line_number":304,"context_line":""},{"line_number":305,"context_line":"        result \u003d False"},{"line_number":306,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"5a9d85d2_ca8c1938","line":303,"in_reply_to":"bae84128_b58ca880","updated":"2016-06-20 09:29:11.000000000","message":"Brant please give me some advice. What should I use here?","commit_id":"b0ec64103f5329009a4f21a058ccc20657b98f5d"}],"oslo_policy/opts.py":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"f92d141b6a92c896f94b7973ffdfebfe0d0dc68a","unresolved":false,"context_lines":[{"line_number":44,"context_line":"                           \u0027be searched.  Missing or empty directories are \u0027"},{"line_number":45,"context_line":"                           \u0027ignored.\u0027),"},{"line_number":46,"context_line":"                    deprecated_group\u003d\u0027DEFAULT\u0027),"},{"line_number":47,"context_line":"    cfg.StrOpt(\u0027fortress_host\u0027,"},{"line_number":48,"context_line":"               default\u003d\u0027localhost\u0027,"},{"line_number":49,"context_line":"               help\u003d_(\u0027Fortress host.\u0027),"},{"line_number":50,"context_line":"               deprecated_group\u003d\u0027DEFAULT\u0027),"}],"source_content_type":"text/x-python","patch_set":1,"id":"3a29b11f_c3e32732","line":47,"updated":"2015-10-20 20:52:03.000000000","message":"maybe have a section section?\n\n  [fortress]\n  user\n  password\n  host\n  port\n  service","commit_id":"b0ec64103f5329009a4f21a058ccc20657b98f5d"},{"author":{"_account_id":17862,"name":"Kseniya Tychkova","email":"kseniya.tychkova@gmail.com","username":"ktychkova"},"change_message_id":"3151a78efc30ec8dc434e571daaeae3c8cd8b94f","unresolved":false,"context_lines":[{"line_number":44,"context_line":"                           \u0027be searched.  Missing or empty directories are \u0027"},{"line_number":45,"context_line":"                           \u0027ignored.\u0027),"},{"line_number":46,"context_line":"                    deprecated_group\u003d\u0027DEFAULT\u0027),"},{"line_number":47,"context_line":"    cfg.StrOpt(\u0027fortress_host\u0027,"},{"line_number":48,"context_line":"               default\u003d\u0027localhost\u0027,"},{"line_number":49,"context_line":"               help\u003d_(\u0027Fortress host.\u0027),"},{"line_number":50,"context_line":"               deprecated_group\u003d\u0027DEFAULT\u0027),"}],"source_content_type":"text/x-python","patch_set":1,"id":"5a9d85d2_2a995d6f","line":47,"in_reply_to":"3a29b11f_c3e32732","updated":"2016-06-20 09:29:11.000000000","message":"I reduced a number of parameters. Is it ok now?","commit_id":"b0ec64103f5329009a4f21a058ccc20657b98f5d"},{"author":{"_account_id":6676,"name":"zqfan","email":"aji.zqfan@gmail.com","username":"aji-zqfan"},"change_message_id":"724fcd57ef3ed73e40998b3d66c4eb2be4709afd","unresolved":false,"context_lines":[{"line_number":47,"context_line":"    cfg.StrOpt(\u0027fortress_host\u0027,"},{"line_number":48,"context_line":"               default\u003d\u0027localhost\u0027,"},{"line_number":49,"context_line":"               help\u003d_(\u0027Fortress host.\u0027),"},{"line_number":50,"context_line":"               deprecated_group\u003d\u0027DEFAULT\u0027),"},{"line_number":51,"context_line":"    cfg.StrOpt(\u0027fortress_port\u0027,"},{"line_number":52,"context_line":"               default\u003d\u00278080\u0027,"},{"line_number":53,"context_line":"               help\u003d_(\u0027Fortress port.\u0027),"}],"source_content_type":"text/x-python","patch_set":1,"id":"3a29b11f_e33be09a","line":50,"updated":"2015-10-20 11:48:45.000000000","message":"I think maybe these new options don\u0027t need to declare deprecated group","commit_id":"b0ec64103f5329009a4f21a058ccc20657b98f5d"},{"author":{"_account_id":17862,"name":"Kseniya Tychkova","email":"kseniya.tychkova@gmail.com","username":"ktychkova"},"change_message_id":"3151a78efc30ec8dc434e571daaeae3c8cd8b94f","unresolved":false,"context_lines":[{"line_number":47,"context_line":"    cfg.StrOpt(\u0027fortress_host\u0027,"},{"line_number":48,"context_line":"               default\u003d\u0027localhost\u0027,"},{"line_number":49,"context_line":"               help\u003d_(\u0027Fortress host.\u0027),"},{"line_number":50,"context_line":"               deprecated_group\u003d\u0027DEFAULT\u0027),"},{"line_number":51,"context_line":"    cfg.StrOpt(\u0027fortress_port\u0027,"},{"line_number":52,"context_line":"               default\u003d\u00278080\u0027,"},{"line_number":53,"context_line":"               help\u003d_(\u0027Fortress port.\u0027),"}],"source_content_type":"text/x-python","patch_set":1,"id":"5a9d85d2_0a9e2156","line":50,"in_reply_to":"3a29b11f_a3638bdb","updated":"2016-06-20 09:29:11.000000000","message":"Done","commit_id":"b0ec64103f5329009a4f21a058ccc20657b98f5d"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"f92d141b6a92c896f94b7973ffdfebfe0d0dc68a","unresolved":false,"context_lines":[{"line_number":47,"context_line":"    cfg.StrOpt(\u0027fortress_host\u0027,"},{"line_number":48,"context_line":"               default\u003d\u0027localhost\u0027,"},{"line_number":49,"context_line":"               help\u003d_(\u0027Fortress host.\u0027),"},{"line_number":50,"context_line":"               deprecated_group\u003d\u0027DEFAULT\u0027),"},{"line_number":51,"context_line":"    cfg.StrOpt(\u0027fortress_port\u0027,"},{"line_number":52,"context_line":"               default\u003d\u00278080\u0027,"},{"line_number":53,"context_line":"               help\u003d_(\u0027Fortress port.\u0027),"}],"source_content_type":"text/x-python","patch_set":1,"id":"3a29b11f_a3638bdb","line":50,"in_reply_to":"3a29b11f_e33be09a","updated":"2015-10-20 20:52:03.000000000","message":"++","commit_id":"b0ec64103f5329009a4f21a058ccc20657b98f5d"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"f92d141b6a92c896f94b7973ffdfebfe0d0dc68a","unresolved":false,"context_lines":[{"line_number":54,"context_line":"               deprecated_group\u003d\u0027DEFAULT\u0027),"},{"line_number":55,"context_line":"    cfg.StrOpt(\u0027fortress_service\u0027,"},{"line_number":56,"context_line":"               default\u003d\u0027fortress-rest-1.0-RC41-SNAPSHOT\u0027,"},{"line_number":57,"context_line":"               help\u003d_(\u0027Fortress service name.\u0027),"},{"line_number":58,"context_line":"               deprecated_group\u003d\u0027DEFAULT\u0027),"},{"line_number":59,"context_line":"    cfg.StrOpt(\u0027fortress_user\u0027,"},{"line_number":60,"context_line":"               help\u003d_(\u0027Fortress user.\u0027),"}],"source_content_type":"text/x-python","patch_set":1,"id":"3a29b11f_e3c5038e","line":57,"updated":"2015-10-20 20:52:03.000000000","message":"improve the help text, i still have no idea what this is supposed to represent","commit_id":"b0ec64103f5329009a4f21a058ccc20657b98f5d"},{"author":{"_account_id":17862,"name":"Kseniya Tychkova","email":"kseniya.tychkova@gmail.com","username":"ktychkova"},"change_message_id":"3151a78efc30ec8dc434e571daaeae3c8cd8b94f","unresolved":false,"context_lines":[{"line_number":54,"context_line":"               deprecated_group\u003d\u0027DEFAULT\u0027),"},{"line_number":55,"context_line":"    cfg.StrOpt(\u0027fortress_service\u0027,"},{"line_number":56,"context_line":"               default\u003d\u0027fortress-rest-1.0-RC41-SNAPSHOT\u0027,"},{"line_number":57,"context_line":"               help\u003d_(\u0027Fortress service name.\u0027),"},{"line_number":58,"context_line":"               deprecated_group\u003d\u0027DEFAULT\u0027),"},{"line_number":59,"context_line":"    cfg.StrOpt(\u0027fortress_user\u0027,"},{"line_number":60,"context_line":"               help\u003d_(\u0027Fortress user.\u0027),"}],"source_content_type":"text/x-python","patch_set":1,"id":"5a9d85d2_aaad4d8a","line":57,"in_reply_to":"3a29b11f_e3c5038e","updated":"2016-06-20 09:29:11.000000000","message":"Done","commit_id":"b0ec64103f5329009a4f21a058ccc20657b98f5d"}],"oslo_policy/policy.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d88d2c8ef4222d88add788ce112bb5f6afc17b1e","unresolved":false,"context_lines":[{"line_number":362,"context_line":"        \"\"\"Checks authorization of a string rule against the target and credentials."},{"line_number":363,"context_line":""},{"line_number":364,"context_line":"        :param rule: The rule to evaluate."},{"line_number":365,"context_line":"        :type rule: string or :class:`BaseCheck`"},{"line_number":366,"context_line":"        :param dict target: As much information about the object being operated"},{"line_number":367,"context_line":"                            on as possible."},{"line_number":368,"context_line":"        :param dict creds: As much information about the user performing the"}],"source_content_type":"text/x-python","patch_set":1,"id":"bae84128_95a24499","line":365,"updated":"2016-02-24 22:46:27.000000000","message":"This is supposed to be just str, right? If rule was BaseCheck then enforce_string_rule isn\u0027t called.","commit_id":"b0ec64103f5329009a4f21a058ccc20657b98f5d"},{"author":{"_account_id":17862,"name":"Kseniya Tychkova","email":"kseniya.tychkova@gmail.com","username":"ktychkova"},"change_message_id":"3151a78efc30ec8dc434e571daaeae3c8cd8b94f","unresolved":false,"context_lines":[{"line_number":362,"context_line":"        \"\"\"Checks authorization of a string rule against the target and credentials."},{"line_number":363,"context_line":""},{"line_number":364,"context_line":"        :param rule: The rule to evaluate."},{"line_number":365,"context_line":"        :type rule: string or :class:`BaseCheck`"},{"line_number":366,"context_line":"        :param dict target: As much information about the object being operated"},{"line_number":367,"context_line":"                            on as possible."},{"line_number":368,"context_line":"        :param dict creds: As much information about the user performing the"}],"source_content_type":"text/x-python","patch_set":1,"id":"5a9d85d2_eab595d0","line":365,"in_reply_to":"bae84128_95a24499","updated":"2016-06-20 09:29:11.000000000","message":"Done","commit_id":"b0ec64103f5329009a4f21a058ccc20657b98f5d"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d88d2c8ef4222d88add788ce112bb5f6afc17b1e","unresolved":false,"context_lines":[{"line_number":368,"context_line":"        :param dict creds: As much information about the user performing the"},{"line_number":369,"context_line":"                           action as possible."},{"line_number":370,"context_line":""},{"line_number":371,"context_line":"        :return: ``False`` if the policy does not allow the action and `exc` is"},{"line_number":372,"context_line":"                 not provided; otherwise, returns a value that evaluates to"},{"line_number":373,"context_line":"                 ``True``.  Note: for rules using the \"case\" expression, this"},{"line_number":374,"context_line":"                 ``True`` value will be the specified string from the"}],"source_content_type":"text/x-python","patch_set":1,"id":"bae84128_15b594cf","line":371,"updated":"2016-02-24 22:46:27.000000000","message":"This should just be True or False. The superclass handles raising exc","commit_id":"b0ec64103f5329009a4f21a058ccc20657b98f5d"},{"author":{"_account_id":17862,"name":"Kseniya Tychkova","email":"kseniya.tychkova@gmail.com","username":"ktychkova"},"change_message_id":"3151a78efc30ec8dc434e571daaeae3c8cd8b94f","unresolved":false,"context_lines":[{"line_number":368,"context_line":"        :param dict creds: As much information about the user performing the"},{"line_number":369,"context_line":"                           action as possible."},{"line_number":370,"context_line":""},{"line_number":371,"context_line":"        :return: ``False`` if the policy does not allow the action and `exc` is"},{"line_number":372,"context_line":"                 not provided; otherwise, returns a value that evaluates to"},{"line_number":373,"context_line":"                 ``True``.  Note: for rules using the \"case\" expression, this"},{"line_number":374,"context_line":"                 ``True`` value will be the specified string from the"}],"source_content_type":"text/x-python","patch_set":1,"id":"5a9d85d2_caba59c0","line":371,"in_reply_to":"bae84128_15b594cf","updated":"2016-06-20 09:29:11.000000000","message":"Done","commit_id":"b0ec64103f5329009a4f21a058ccc20657b98f5d"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"f92d141b6a92c896f94b7973ffdfebfe0d0dc68a","unresolved":false,"context_lines":[{"line_number":528,"context_line":""},{"line_number":529,"context_line":"        raise cfg.ConfigFilesNotFoundError((path,))"},{"line_number":530,"context_line":""},{"line_number":531,"context_line":"    def enforce_string_rule(self, rule, target, creds, *args, **kwargs):"},{"line_number":532,"context_line":"        \"\"\"Checks authorization of a string rule against the target and credentials."},{"line_number":533,"context_line":""},{"line_number":534,"context_line":"        :param rule: The rule to evaluate."}],"source_content_type":"text/x-python","patch_set":1,"id":"3a29b11f_a3562bd0","line":531,"updated":"2015-10-20 20:52:03.000000000","message":"we can\u0027t change this, we\u0027d be breaking a lot of projects","commit_id":"b0ec64103f5329009a4f21a058ccc20657b98f5d"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"c96fe3fd44362d47e059981cf4f0d57603f54be7","unresolved":false,"context_lines":[{"line_number":528,"context_line":""},{"line_number":529,"context_line":"        raise cfg.ConfigFilesNotFoundError((path,))"},{"line_number":530,"context_line":""},{"line_number":531,"context_line":"    def enforce_string_rule(self, rule, target, creds, *args, **kwargs):"},{"line_number":532,"context_line":"        \"\"\"Checks authorization of a string rule against the target and credentials."},{"line_number":533,"context_line":""},{"line_number":534,"context_line":"        :param rule: The rule to evaluate."}],"source_content_type":"text/x-python","patch_set":1,"id":"3a29b11f_236aed81","line":531,"in_reply_to":"3a29b11f_a3562bd0","updated":"2015-10-21 16:21:51.000000000","message":"See above. Kseniya is keeping the original enforce() interface in the top-level class. This enforce_string_rule() method is called by enforce() on the base class.","commit_id":"b0ec64103f5329009a4f21a058ccc20657b98f5d"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"f62cd702a0513c5795f1783574a42ccb8816ad71","unresolved":false,"context_lines":[{"line_number":562,"context_line":"        return result"},{"line_number":563,"context_line":""},{"line_number":564,"context_line":""},{"line_number":565,"context_line":"class FortressEnforcer(BaseEnforcer):"},{"line_number":566,"context_line":"    \"\"\"Responsible for enforcing fortress permissions."},{"line_number":567,"context_line":""},{"line_number":568,"context_line":"    :param conf: A configuration object."}],"source_content_type":"text/x-python","patch_set":1,"id":"1a122d0e_4fd115cd","line":565,"updated":"2016-04-22 16:24:04.000000000","message":"Does this mean that applications that want to use fortress will have to explicitly use this class instead of the Enforcer class above?","commit_id":"b0ec64103f5329009a4f21a058ccc20657b98f5d"},{"author":{"_account_id":17862,"name":"Kseniya Tychkova","email":"kseniya.tychkova@gmail.com","username":"ktychkova"},"change_message_id":"3151a78efc30ec8dc434e571daaeae3c8cd8b94f","unresolved":false,"context_lines":[{"line_number":562,"context_line":"        return result"},{"line_number":563,"context_line":""},{"line_number":564,"context_line":""},{"line_number":565,"context_line":"class FortressEnforcer(BaseEnforcer):"},{"line_number":566,"context_line":"    \"\"\"Responsible for enforcing fortress permissions."},{"line_number":567,"context_line":""},{"line_number":568,"context_line":"    :param conf: A configuration object."}],"source_content_type":"text/x-python","patch_set":1,"id":"5a9d85d2_2ab03ddd","line":565,"in_reply_to":"1a122d0e_4fd115cd","updated":"2016-06-20 09:29:11.000000000","message":"Yes, application should use Enforcer class or FortressEnforcer class","commit_id":"b0ec64103f5329009a4f21a058ccc20657b98f5d"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d88d2c8ef4222d88add788ce112bb5f6afc17b1e","unresolved":false,"context_lines":[{"line_number":569,"context_line":"    \"\"\""},{"line_number":570,"context_line":""},{"line_number":571,"context_line":"    def __init__(self, conf):"},{"line_number":572,"context_line":"        super(FortressEnforcer, self).__init__(conf)"},{"line_number":573,"context_line":""},{"line_number":574,"context_line":"    def enforce_string_rule(self, rule, target, creds, *args, **kwargs):"},{"line_number":575,"context_line":"        \"\"\"Checks authorization of a rule against the target and credentials."}],"source_content_type":"text/x-python","patch_set":1,"id":"bae84128_75f500ca","line":572,"updated":"2016-02-24 22:46:27.000000000","message":"defining __init__ is not necessary since it\u0027s the default.","commit_id":"b0ec64103f5329009a4f21a058ccc20657b98f5d"},{"author":{"_account_id":17862,"name":"Kseniya Tychkova","email":"kseniya.tychkova@gmail.com","username":"ktychkova"},"change_message_id":"3151a78efc30ec8dc434e571daaeae3c8cd8b94f","unresolved":false,"context_lines":[{"line_number":569,"context_line":"    \"\"\""},{"line_number":570,"context_line":""},{"line_number":571,"context_line":"    def __init__(self, conf):"},{"line_number":572,"context_line":"        super(FortressEnforcer, self).__init__(conf)"},{"line_number":573,"context_line":""},{"line_number":574,"context_line":"    def enforce_string_rule(self, rule, target, creds, *args, **kwargs):"},{"line_number":575,"context_line":"        \"\"\"Checks authorization of a rule against the target and credentials."}],"source_content_type":"text/x-python","patch_set":1,"id":"5a9d85d2_6aca4551","line":572,"in_reply_to":"bae84128_75f500ca","updated":"2016-06-20 09:29:11.000000000","message":"Done","commit_id":"b0ec64103f5329009a4f21a058ccc20657b98f5d"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d88d2c8ef4222d88add788ce112bb5f6afc17b1e","unresolved":false,"context_lines":[{"line_number":579,"context_line":"        :param dict target: As much information about the object being operated"},{"line_number":580,"context_line":"                            on as possible."},{"line_number":581,"context_line":"        :param dict creds: As much information about the user performing the"},{"line_number":582,"context_line":"                           action as possible."},{"line_number":583,"context_line":""},{"line_number":584,"context_line":"        :return: ``False`` if the policy does not allow the action and `exc` is"},{"line_number":585,"context_line":"                 not provided; otherwise, returns a value that evaluates to"}],"source_content_type":"text/x-python","patch_set":1,"id":"bae84128_55255c5a","line":582,"updated":"2016-02-24 22:46:27.000000000","message":"the docstring should say what args and kwargs are for.","commit_id":"b0ec64103f5329009a4f21a058ccc20657b98f5d"},{"author":{"_account_id":17862,"name":"Kseniya Tychkova","email":"kseniya.tychkova@gmail.com","username":"ktychkova"},"change_message_id":"3151a78efc30ec8dc434e571daaeae3c8cd8b94f","unresolved":false,"context_lines":[{"line_number":579,"context_line":"        :param dict target: As much information about the object being operated"},{"line_number":580,"context_line":"                            on as possible."},{"line_number":581,"context_line":"        :param dict creds: As much information about the user performing the"},{"line_number":582,"context_line":"                           action as possible."},{"line_number":583,"context_line":""},{"line_number":584,"context_line":"        :return: ``False`` if the policy does not allow the action and `exc` is"},{"line_number":585,"context_line":"                 not provided; otherwise, returns a value that evaluates to"}],"source_content_type":"text/x-python","patch_set":1,"id":"5a9d85d2_8ac17131","line":582,"in_reply_to":"bae84128_55255c5a","updated":"2016-06-20 09:29:11.000000000","message":"Done","commit_id":"b0ec64103f5329009a4f21a058ccc20657b98f5d"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d88d2c8ef4222d88add788ce112bb5f6afc17b1e","unresolved":false,"context_lines":[{"line_number":589,"context_line":"        \"\"\""},{"line_number":590,"context_line":""},{"line_number":591,"context_line":"        try:"},{"line_number":592,"context_line":"            kind, match \u003d rule.split(\u0027:\u0027, 1)"},{"line_number":593,"context_line":"            check \u003d _checks.FortressCheck(kind, match)"},{"line_number":594,"context_line":"            result \u003d check(target, creds, self)"},{"line_number":595,"context_line":"        except ValueError:"}],"source_content_type":"text/x-python","patch_set":1,"id":"bae84128_b51668ef","line":592,"updated":"2016-02-24 22:46:27.000000000","message":"use partition.","commit_id":"b0ec64103f5329009a4f21a058ccc20657b98f5d"},{"author":{"_account_id":17862,"name":"Kseniya Tychkova","email":"kseniya.tychkova@gmail.com","username":"ktychkova"},"change_message_id":"3151a78efc30ec8dc434e571daaeae3c8cd8b94f","unresolved":false,"context_lines":[{"line_number":589,"context_line":"        \"\"\""},{"line_number":590,"context_line":""},{"line_number":591,"context_line":"        try:"},{"line_number":592,"context_line":"            kind, match \u003d rule.split(\u0027:\u0027, 1)"},{"line_number":593,"context_line":"            check \u003d _checks.FortressCheck(kind, match)"},{"line_number":594,"context_line":"            result \u003d check(target, creds, self)"},{"line_number":595,"context_line":"        except ValueError:"}],"source_content_type":"text/x-python","patch_set":1,"id":"5a9d85d2_eadc751a","line":592,"in_reply_to":"bae84128_b51668ef","updated":"2016-06-20 09:29:11.000000000","message":"Done","commit_id":"b0ec64103f5329009a4f21a058ccc20657b98f5d"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"af6778828d9c1b183e7b2d62f9a8b6785f0ed68e","unresolved":false,"context_lines":[{"line_number":683,"context_line":""},{"line_number":684,"context_line":"        return result"},{"line_number":685,"context_line":""},{"line_number":686,"context_line":"    def register_default(self, default):"},{"line_number":687,"context_line":"        \"\"\"Registers a RuleDefault."},{"line_number":688,"context_line":""},{"line_number":689,"context_line":"        Adds a RuleDefault to the list of registered rules. Rules must be"}],"source_content_type":"text/x-python","patch_set":2,"id":"5a9d85d2_f06c559e","line":686,"updated":"2016-06-20 16:15:12.000000000","message":"You should note that it is now possible for a project, like Nova, to register rules from its codebase and not require them to be loaded externally from a file. It should be possible for those same rules to be written to Fortress when the register_default method is called from a project. https://review.openstack.org/#/c/329122/ is an example of how that works.","commit_id":"e008ff0f16547b37698034f1d0bf3859ba5fbbd3"},{"author":{"_account_id":17862,"name":"Kseniya Tychkova","email":"kseniya.tychkova@gmail.com","username":"ktychkova"},"change_message_id":"b89fad431608684629aff215ff2dd2a3bb1a2661","unresolved":false,"context_lines":[{"line_number":683,"context_line":""},{"line_number":684,"context_line":"        return result"},{"line_number":685,"context_line":""},{"line_number":686,"context_line":"    def register_default(self, default):"},{"line_number":687,"context_line":"        \"\"\"Registers a RuleDefault."},{"line_number":688,"context_line":""},{"line_number":689,"context_line":"        Adds a RuleDefault to the list of registered rules. Rules must be"}],"source_content_type":"text/x-python","patch_set":2,"id":"1ac06dbe_2991db47","line":686,"in_reply_to":"5a9d85d2_f06c559e","updated":"2016-08-23 12:10:59.000000000","message":"Andrew, I don\u0027t see any cases when user want to use Apache Fortress and also register some rules.\nRegister_defaults() method doesn\u0027t make any sense in ApacheFortress enforcer. If you are using - external RBAC system then you don\u0027t need any defaults.\nIt make sense only in case of policy.json file","commit_id":"e008ff0f16547b37698034f1d0bf3859ba5fbbd3"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"af6778828d9c1b183e7b2d62f9a8b6785f0ed68e","unresolved":false,"context_lines":[{"line_number":725,"context_line":"                            *args, **kwargs)"},{"line_number":726,"context_line":""},{"line_number":727,"context_line":""},{"line_number":728,"context_line":"class FortressEnforcer(BaseEnforcer):"},{"line_number":729,"context_line":"    \"\"\"Responsible for enforcing fortress permissions.\"\"\""},{"line_number":730,"context_line":""},{"line_number":731,"context_line":"    def enforce_string_rule(self, rule, target, creds):"}],"source_content_type":"text/x-python","patch_set":2,"id":"5a9d85d2_90acf1ee","line":728,"updated":"2016-06-20 16:15:12.000000000","message":"By splitting the class this way it is a project decision as to which enforcement method is used, not a deployer decision. So if Glance switches to FortressEnforcer then all Glance deployments must use it.\n\nA much friendlier way for deployers would be to have a configuration option that determines where rules are loaded from or registered to. So projects would continue to use Enforcer but it would load rules from a file(s) or Fortress depending on the config option.","commit_id":"e008ff0f16547b37698034f1d0bf3859ba5fbbd3"},{"author":{"_account_id":17862,"name":"Kseniya Tychkova","email":"kseniya.tychkova@gmail.com","username":"ktychkova"},"change_message_id":"b89fad431608684629aff215ff2dd2a3bb1a2661","unresolved":false,"context_lines":[{"line_number":725,"context_line":"                            *args, **kwargs)"},{"line_number":726,"context_line":""},{"line_number":727,"context_line":""},{"line_number":728,"context_line":"class FortressEnforcer(BaseEnforcer):"},{"line_number":729,"context_line":"    \"\"\"Responsible for enforcing fortress permissions.\"\"\""},{"line_number":730,"context_line":""},{"line_number":731,"context_line":"    def enforce_string_rule(self, rule, target, creds):"}],"source_content_type":"text/x-python","patch_set":2,"id":"1ac06dbe_09969f3e","line":728,"in_reply_to":"5a9d85d2_90acf1ee","updated":"2016-08-23 12:10:59.000000000","message":"Done","commit_id":"e008ff0f16547b37698034f1d0bf3859ba5fbbd3"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"af6778828d9c1b183e7b2d62f9a8b6785f0ed68e","unresolved":false,"context_lines":[{"line_number":743,"context_line":"        \"\"\""},{"line_number":744,"context_line":""},{"line_number":745,"context_line":"        try:"},{"line_number":746,"context_line":"            kind, match \u003d rule.partition(\u0027:\u0027)[::2]"},{"line_number":747,"context_line":"            check \u003d _checks.FortressCheck(kind, match)"},{"line_number":748,"context_line":"            result \u003d check(target, creds, self)"},{"line_number":749,"context_line":"        except ValueError:"}],"source_content_type":"text/x-python","patch_set":2,"id":"5a9d85d2_1065a144","line":746,"updated":"2016-06-20 16:15:12.000000000","message":"At this time there is no requirement that a rule looks like \"foo:bar\", though every rule that I am aware of does look like that. In Nova we\u0027ve been discussing changing the rule format to match up with the REST API so they might end up looking like \"POST /servers\", although that\u0027s unclear. Does Fortress require having the ftObjNm set this way?\n\nAnother approach would be to have projects declare a namespace when they create an Enforcer and that could be used for ftObjNm. Then the rules would not require a \u0027:\u0027 in them.","commit_id":"e008ff0f16547b37698034f1d0bf3859ba5fbbd3"},{"author":{"_account_id":17862,"name":"Kseniya Tychkova","email":"kseniya.tychkova@gmail.com","username":"ktychkova"},"change_message_id":"b89fad431608684629aff215ff2dd2a3bb1a2661","unresolved":false,"context_lines":[{"line_number":743,"context_line":"        \"\"\""},{"line_number":744,"context_line":""},{"line_number":745,"context_line":"        try:"},{"line_number":746,"context_line":"            kind, match \u003d rule.partition(\u0027:\u0027)[::2]"},{"line_number":747,"context_line":"            check \u003d _checks.FortressCheck(kind, match)"},{"line_number":748,"context_line":"            result \u003d check(target, creds, self)"},{"line_number":749,"context_line":"        except ValueError:"}],"source_content_type":"text/x-python","patch_set":2,"id":"1ac06dbe_2ceba914","line":746,"in_reply_to":"5a9d85d2_1065a144","updated":"2016-08-23 12:10:59.000000000","message":"For now it is mostly for Keystone project. Does any other projects need an Apache Fortress and how they are going to use it - research should be done.","commit_id":"e008ff0f16547b37698034f1d0bf3859ba5fbbd3"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"9fa5a4c92c293fe5733f62f349f14195faa1f937","unresolved":false,"context_lines":[{"line_number":764,"context_line":"        \"\"\""},{"line_number":765,"context_line":""},{"line_number":766,"context_line":"        try:"},{"line_number":767,"context_line":"            kind, match \u003d rule.partition(\u0027:\u0027)[::2]"},{"line_number":768,"context_line":"            if (\u0027user_id\u0027 in target and"},{"line_number":769,"context_line":"                    creds.get(\u0027user_id\u0027) \u003d\u003d target[\u0027user_id\u0027]):"},{"line_number":770,"context_line":"                kind \u003d self.conf.oslo_policy.own_identity"}],"source_content_type":"text/x-python","patch_set":3,"id":"9f436f4f_29c18e55","line":767,"range":{"start_line":767,"start_character":30,"end_line":767,"end_character":50},"updated":"2017-08-09 16:46:37.000000000","message":".split(\u0027:\u0027, 1) is probably better","commit_id":"76b459acd7a052266bfbb0cf8954017ed3f0d22d"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"9fa5a4c92c293fe5733f62f349f14195faa1f937","unresolved":false,"context_lines":[{"line_number":765,"context_line":""},{"line_number":766,"context_line":"        try:"},{"line_number":767,"context_line":"            kind, match \u003d rule.partition(\u0027:\u0027)[::2]"},{"line_number":768,"context_line":"            if (\u0027user_id\u0027 in target and"},{"line_number":769,"context_line":"                    creds.get(\u0027user_id\u0027) \u003d\u003d target[\u0027user_id\u0027]):"},{"line_number":770,"context_line":"                kind \u003d self.conf.oslo_policy.own_identity"},{"line_number":771,"context_line":"            check \u003d _checks.FortressCheck(kind, match)"}],"source_content_type":"text/x-python","patch_set":3,"id":"9f436f4f_e92ca648","line":768,"updated":"2017-08-09 16:46:37.000000000","message":"there is no commonality between OpenStack services on what \u0027user_id\u0027 may mean in target info, so this is going to yield unpredictable results. I.e., don\u0027t do this.","commit_id":"76b459acd7a052266bfbb0cf8954017ed3f0d22d"}],"oslo_policy/tests/base.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d88d2c8ef4222d88add788ce112bb5f6afc17b1e","unresolved":false,"context_lines":[{"line_number":33,"context_line":"        self.config_dir \u003d self.useFixture(fixtures.TempDir()).path"},{"line_number":34,"context_line":"        self.conf(args\u003d[\u0027--config-dir\u0027, self.config_dir])"},{"line_number":35,"context_line":"        self.enforcer \u003d policy.Enforcer(self.conf)"},{"line_number":36,"context_line":"        self.fortress_enforcer \u003d policy.FortressEnforcer(self.conf)"},{"line_number":37,"context_line":"        self.addCleanup(self.enforcer.clear)"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"    def get_config_file_fullname(self, filename):"}],"source_content_type":"text/x-python","patch_set":1,"id":"bae84128_f52e30f9","line":36,"updated":"2016-02-24 22:46:27.000000000","message":"this shouldn\u0027t be created for every test.","commit_id":"b0ec64103f5329009a4f21a058ccc20657b98f5d"},{"author":{"_account_id":17862,"name":"Kseniya Tychkova","email":"kseniya.tychkova@gmail.com","username":"ktychkova"},"change_message_id":"3151a78efc30ec8dc434e571daaeae3c8cd8b94f","unresolved":false,"context_lines":[{"line_number":33,"context_line":"        self.config_dir \u003d self.useFixture(fixtures.TempDir()).path"},{"line_number":34,"context_line":"        self.conf(args\u003d[\u0027--config-dir\u0027, self.config_dir])"},{"line_number":35,"context_line":"        self.enforcer \u003d policy.Enforcer(self.conf)"},{"line_number":36,"context_line":"        self.fortress_enforcer \u003d policy.FortressEnforcer(self.conf)"},{"line_number":37,"context_line":"        self.addCleanup(self.enforcer.clear)"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"    def get_config_file_fullname(self, filename):"}],"source_content_type":"text/x-python","patch_set":1,"id":"5a9d85d2_0aec61c6","line":36,"in_reply_to":"bae84128_f52e30f9","updated":"2016-06-20 09:29:11.000000000","message":"Done","commit_id":"b0ec64103f5329009a4f21a058ccc20657b98f5d"}],"oslo_policy/tests/test_checks.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d88d2c8ef4222d88add788ce112bb5f6afc17b1e","unresolved":false,"context_lines":[{"line_number":81,"context_line":""},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"class FortressCheckTestCase(base.PolicyBaseTestCase):"},{"line_number":84,"context_line":"    @httpretty.activate"},{"line_number":85,"context_line":"    def test_accept(self):"},{"line_number":86,"context_line":"        body \u003d \"\"\"\u003c?xml version\u003d\"1.0\" encoding\u003d\"UTF-8\" standalone\u003d\"yes\"?\u003e"},{"line_number":87,"context_line":"                  \u003cFortResponse\u003e"}],"source_content_type":"text/x-python","patch_set":1,"id":"bae84128_3587f8d8","line":84,"updated":"2016-02-24 22:46:27.000000000","message":"this is way out of date. We don\u0027t use httpretty anymore.","commit_id":"b0ec64103f5329009a4f21a058ccc20657b98f5d"},{"author":{"_account_id":17862,"name":"Kseniya Tychkova","email":"kseniya.tychkova@gmail.com","username":"ktychkova"},"change_message_id":"3151a78efc30ec8dc434e571daaeae3c8cd8b94f","unresolved":false,"context_lines":[{"line_number":81,"context_line":""},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"class FortressCheckTestCase(base.PolicyBaseTestCase):"},{"line_number":84,"context_line":"    @httpretty.activate"},{"line_number":85,"context_line":"    def test_accept(self):"},{"line_number":86,"context_line":"        body \u003d \"\"\"\u003c?xml version\u003d\"1.0\" encoding\u003d\"UTF-8\" standalone\u003d\"yes\"?\u003e"},{"line_number":87,"context_line":"                  \u003cFortResponse\u003e"}],"source_content_type":"text/x-python","patch_set":1,"id":"5a9d85d2_6ad1a5fb","line":84,"in_reply_to":"bae84128_3587f8d8","updated":"2016-06-20 09:29:11.000000000","message":"Done","commit_id":"b0ec64103f5329009a4f21a058ccc20657b98f5d"}],"oslo_policy/tests/test_policy.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d88d2c8ef4222d88add788ce112bb5f6afc17b1e","unresolved":false,"context_lines":[{"line_number":17,"context_line":""},{"line_number":18,"context_line":"import os"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"import httpretty"},{"line_number":21,"context_line":"import mock"},{"line_number":22,"context_line":"from oslo_config import cfg"},{"line_number":23,"context_line":"from oslo_serialization import jsonutils"}],"source_content_type":"text/x-python","patch_set":1,"id":"bae84128_d54decc5","line":20,"updated":"2016-02-24 22:46:27.000000000","message":"we don\u0027t use httpretty anymore.","commit_id":"b0ec64103f5329009a4f21a058ccc20657b98f5d"},{"author":{"_account_id":17862,"name":"Kseniya Tychkova","email":"kseniya.tychkova@gmail.com","username":"ktychkova"},"change_message_id":"3151a78efc30ec8dc434e571daaeae3c8cd8b94f","unresolved":false,"context_lines":[{"line_number":17,"context_line":""},{"line_number":18,"context_line":"import os"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"import httpretty"},{"line_number":21,"context_line":"import mock"},{"line_number":22,"context_line":"from oslo_config import cfg"},{"line_number":23,"context_line":"from oslo_serialization import jsonutils"}],"source_content_type":"text/x-python","patch_set":1,"id":"5a9d85d2_8ad8511f","line":20,"in_reply_to":"bae84128_d54decc5","updated":"2016-06-20 09:29:11.000000000","message":"Done","commit_id":"b0ec64103f5329009a4f21a058ccc20657b98f5d"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d88d2c8ef4222d88add788ce112bb5f6afc17b1e","unresolved":false,"context_lines":[{"line_number":139,"context_line":"class FortressEnforcerTest(base.PolicyBaseTestCase):"},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"    def setUp(self):"},{"line_number":142,"context_line":"        super(FortressEnforcerTest, self).setUp()"},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"    @httpretty.activate"},{"line_number":145,"context_line":"    def test_enforcer_accept(self):"}],"source_content_type":"text/x-python","patch_set":1,"id":"bae84128_55d0bcc9","line":142,"updated":"2016-02-24 22:46:27.000000000","message":"this is the default behavior so get rid of it.","commit_id":"b0ec64103f5329009a4f21a058ccc20657b98f5d"},{"author":{"_account_id":17862,"name":"Kseniya Tychkova","email":"kseniya.tychkova@gmail.com","username":"ktychkova"},"change_message_id":"3151a78efc30ec8dc434e571daaeae3c8cd8b94f","unresolved":false,"context_lines":[{"line_number":139,"context_line":"class FortressEnforcerTest(base.PolicyBaseTestCase):"},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"    def setUp(self):"},{"line_number":142,"context_line":"        super(FortressEnforcerTest, self).setUp()"},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"    @httpretty.activate"},{"line_number":145,"context_line":"    def test_enforcer_accept(self):"}],"source_content_type":"text/x-python","patch_set":1,"id":"5a9d85d2_ea03d574","line":142,"in_reply_to":"bae84128_55d0bcc9","updated":"2016-06-20 09:29:11.000000000","message":"Done","commit_id":"b0ec64103f5329009a4f21a058ccc20657b98f5d"}]}