)]}'
{"oslo_policy/_enforcers/base.py":[{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"821bb3f6c63cf7e52bc853eca44182c05f33f8cb","unresolved":false,"context_lines":[{"line_number":114,"context_line":"        :param default: A list of RuleDefault objects to register."},{"line_number":115,"context_line":"        \"\"\""},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"    def authorize(self, rule, target, creds, do_raise\u003dFalse,"},{"line_number":118,"context_line":"                  exc\u003dNone, *args, **kwargs):"},{"line_number":119,"context_line":"        \"\"\"A wrapper around \u0027enforce\u0027 that checks for policy registration."},{"line_number":120,"context_line":""}],"source_content_type":"text/x-python","patch_set":20,"id":"3f79a3b5_ed3254c0","line":117,"updated":"2018-10-10 18:21:53.000000000","message":"We should only need 1 of authorize() or enforce() in the driver. I think we\u0027ll want whichever method we choose to raise the exception when a rule isn\u0027t found, so that\u0027s probably best called authorize(). We can then implement enforce() in the caller and have it catch the exception and ignore it. That eliminates one m method from the driver API.","commit_id":"538ced7639b356f6c327985162cc05fbad06c453"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"34da181016060eb5cf9ae62cb95fc280a0b5a76d","unresolved":false,"context_lines":[{"line_number":114,"context_line":"        :param default: A list of RuleDefault objects to register."},{"line_number":115,"context_line":"        \"\"\""},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"    def authorize(self, rule, target, creds, do_raise\u003dFalse,"},{"line_number":118,"context_line":"                  exc\u003dNone, *args, **kwargs):"},{"line_number":119,"context_line":"        \"\"\"A wrapper around \u0027enforce\u0027 that checks for policy registration."},{"line_number":120,"context_line":""}],"source_content_type":"text/x-python","patch_set":20,"id":"3f79a3b5_d9762593","line":117,"in_reply_to":"3f79a3b5_9eaadd6a","updated":"2018-10-11 13:46:39.000000000","message":"Right, I think that\u0027s a key thing about the different approaches we\u0027re taking: The Enforcer class API and driver API do not need to match. We just need to be able to implement Enforcer using a driver.","commit_id":"538ced7639b356f6c327985162cc05fbad06c453"},{"author":{"_account_id":10873,"name":"Juan Antonio Osorio Robles","email":"jaosorior@redhat.com","username":"ejuaoso"},"change_message_id":"6b7652d73065dacc739171946aecaa04b62ba5e9","unresolved":false,"context_lines":[{"line_number":114,"context_line":"        :param default: A list of RuleDefault objects to register."},{"line_number":115,"context_line":"        \"\"\""},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"    def authorize(self, rule, target, creds, do_raise\u003dFalse,"},{"line_number":118,"context_line":"                  exc\u003dNone, *args, **kwargs):"},{"line_number":119,"context_line":"        \"\"\"A wrapper around \u0027enforce\u0027 that checks for policy registration."},{"line_number":120,"context_line":""}],"source_content_type":"text/x-python","patch_set":20,"id":"3f79a3b5_fea2f1ac","line":117,"in_reply_to":"3f79a3b5_ed3254c0","updated":"2018-10-11 04:58:31.000000000","message":"That would mean that drivers that don\u0027t implement authorize won\u0027t be usable. So... neither nova nor keystone will be able to use drivers in that case.","commit_id":"538ced7639b356f6c327985162cc05fbad06c453"},{"author":{"_account_id":10873,"name":"Juan Antonio Osorio Robles","email":"jaosorior@redhat.com","username":"ejuaoso"},"change_message_id":"59fc6dc3579b070b88321b3f9f5fbf5a194162b8","unresolved":false,"context_lines":[{"line_number":114,"context_line":"        :param default: A list of RuleDefault objects to register."},{"line_number":115,"context_line":"        \"\"\""},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"    def authorize(self, rule, target, creds, do_raise\u003dFalse,"},{"line_number":118,"context_line":"                  exc\u003dNone, *args, **kwargs):"},{"line_number":119,"context_line":"        \"\"\"A wrapper around \u0027enforce\u0027 that checks for policy registration."},{"line_number":120,"context_line":""}],"source_content_type":"text/x-python","patch_set":20,"id":"3f79a3b5_9eaadd6a","line":117,"in_reply_to":"3f79a3b5_fea2f1ac","updated":"2018-10-11 05:09:38.000000000","message":"Actually, thinking about your proposal, we could make it work by moving the above three functions towards the caller. That way we would make \"authorize\" work like it always has.","commit_id":"538ced7639b356f6c327985162cc05fbad06c453"}],"oslo_policy/_enforcers/default.py":[{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"a44b1348bae7e2adb50eab3f9f5a4af4a9e0324f","unresolved":false,"context_lines":[{"line_number":384,"context_line":""},{"line_number":385,"context_line":"        self.load_rules()"},{"line_number":386,"context_line":""},{"line_number":387,"context_line":"        if isinstance(creds, context.RequestContext):"},{"line_number":388,"context_line":"            creds \u003d self._map_context_attributes_into_creds(creds)"},{"line_number":389,"context_line":"        # NOTE(lbragstad): The oslo.context library exposes the ability to call"},{"line_number":390,"context_line":"        # a method on RequestContext objects that converts attributes of the"}],"source_content_type":"text/x-python","patch_set":16,"id":"3f79a3b5_5bb03b41","line":387,"updated":"2018-10-05 20:26:05.000000000","message":"We ought to be able to extract the credentials from the context in the caller and pass the results to the driver so we only have to do that work in one place. Unless there\u0027s some reason to think that different drivers would interpret the context in different ways?","commit_id":"9f4a67901b5af6e73de01fcba07d4d472c294cc4"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"a44b1348bae7e2adb50eab3f9f5a4af4a9e0324f","unresolved":false,"context_lines":[{"line_number":402,"context_line":"            raise policy.InvalidContextObject(msg)"},{"line_number":403,"context_line":""},{"line_number":404,"context_line":"        # Allow the rule to be a Check tree"},{"line_number":405,"context_line":"        if isinstance(rule, _checks.BaseCheck):"},{"line_number":406,"context_line":"            # If the thing we\u0027re given is a Check, we don\u0027t know the"},{"line_number":407,"context_line":"            # name of the rule, so pass None for current_rule."},{"line_number":408,"context_line":"            result \u003d _checks._check("}],"source_content_type":"text/x-python","patch_set":16,"id":"3f79a3b5_fb7ee76b","line":405,"updated":"2018-10-05 20:26:05.000000000","message":"This bit of the logic is definitely not driver-specific, since it\u0027s evaluating an in-memory rule.","commit_id":"9f4a67901b5af6e73de01fcba07d4d472c294cc4"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"a44b1348bae7e2adb50eab3f9f5a4af4a9e0324f","unresolved":false,"context_lines":[{"line_number":423,"context_line":"                # If the rule doesn\u0027t exist, fail closed"},{"line_number":424,"context_line":"                result \u003d False"},{"line_number":425,"context_line":"            else:"},{"line_number":426,"context_line":"                # Check the scope of the operation against the possible scope"},{"line_number":427,"context_line":"                # attributes provided in `creds`."},{"line_number":428,"context_line":"                if creds.get(\u0027system\u0027):"},{"line_number":429,"context_line":"                    token_scope \u003d \u0027system\u0027"}],"source_content_type":"text/x-python","patch_set":16,"id":"3f79a3b5_bbedcf25","line":426,"updated":"2018-10-05 20:26:05.000000000","message":"It seems like we could figure out the scope in the caller, too. That way we pass token_scope to the driver method and drivers are expected to be able to deal with it as part of responding.","commit_id":"9f4a67901b5af6e73de01fcba07d4d472c294cc4"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"29c2a0247b0313f6b64ad622bbd8dc2774a42fa1","unresolved":false,"context_lines":[{"line_number":423,"context_line":"                # If the rule doesn\u0027t exist, fail closed"},{"line_number":424,"context_line":"                result \u003d False"},{"line_number":425,"context_line":"            else:"},{"line_number":426,"context_line":"                # Check the scope of the operation against the possible scope"},{"line_number":427,"context_line":"                # attributes provided in `creds`."},{"line_number":428,"context_line":"                if creds.get(\u0027system\u0027):"},{"line_number":429,"context_line":"                    token_scope \u003d \u0027system\u0027"}],"source_content_type":"text/x-python","patch_set":16,"id":"3f79a3b5_ec0c9d94","line":426,"in_reply_to":"3f79a3b5_32c67217","updated":"2018-10-10 18:18:19.000000000","message":"The goal should be to have the drivers do as little work as possible to keep them simple. If scoping is driver-specific, then I agree we should do it in the driver. But we need to figure out how to express that in some way that ensures that all drivers do implement it, otherwise a deployer choice is going to change API behavior and we work hard to avoid that. For example, could it be a separate method of the driver that the caller invokes (the driver and caller API don\u0027t have to be the same)?","commit_id":"9f4a67901b5af6e73de01fcba07d4d472c294cc4"},{"author":{"_account_id":10873,"name":"Juan Antonio Osorio Robles","email":"jaosorior@redhat.com","username":"ejuaoso"},"change_message_id":"32588dabb3ebaec93cba6105c8f80f239d758864","unresolved":false,"context_lines":[{"line_number":423,"context_line":"                # If the rule doesn\u0027t exist, fail closed"},{"line_number":424,"context_line":"                result \u003d False"},{"line_number":425,"context_line":"            else:"},{"line_number":426,"context_line":"                # Check the scope of the operation against the possible scope"},{"line_number":427,"context_line":"                # attributes provided in `creds`."},{"line_number":428,"context_line":"                if creds.get(\u0027system\u0027):"},{"line_number":429,"context_line":"                    token_scope \u003d \u0027system\u0027"}],"source_content_type":"text/x-python","patch_set":16,"id":"3f79a3b5_32c67217","line":426,"in_reply_to":"3f79a3b5_bbedcf25","updated":"2018-10-10 11:23:15.000000000","message":"Well, the scope comes from the creds, so the drivers could just use that to deal with  scoping.","commit_id":"9f4a67901b5af6e73de01fcba07d4d472c294cc4"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"a44b1348bae7e2adb50eab3f9f5a4af4a9e0324f","unresolved":false,"context_lines":[{"line_number":466,"context_line":"                    current_rule\u003drule,"},{"line_number":467,"context_line":"                )"},{"line_number":468,"context_line":""},{"line_number":469,"context_line":"        # If it is False, raise the exception if requested"},{"line_number":470,"context_line":"        if do_raise and not result:"},{"line_number":471,"context_line":"            if exc:"},{"line_number":472,"context_line":"                raise exc(*args, **kwargs)"}],"source_content_type":"text/x-python","patch_set":16,"id":"3f79a3b5_3bba1f0b","line":469,"updated":"2018-10-05 20:26:05.000000000","message":"Drivers shouldn\u0027t have to deal with custom exception classes. Let them always raise PolicyNotAuthorized and let the caller catch it and if it has a custom exception it can raise one of those instead.","commit_id":"9f4a67901b5af6e73de01fcba07d4d472c294cc4"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"a44b1348bae7e2adb50eab3f9f5a4af4a9e0324f","unresolved":false,"context_lines":[{"line_number":496,"context_line":""},{"line_number":497,"context_line":"        return creds"},{"line_number":498,"context_line":""},{"line_number":499,"context_line":"    def register_default(self, default):"},{"line_number":500,"context_line":"        \"\"\"Registers a RuleDefault."},{"line_number":501,"context_line":""},{"line_number":502,"context_line":"        Adds a RuleDefault to the list of registered rules. Rules must be"}],"source_content_type":"text/x-python","patch_set":16,"id":"3f79a3b5_5b5b5b21","line":499,"updated":"2018-10-05 20:26:05.000000000","message":"We ought to be able to handle defaults in the caller so the driver doesn\u0027t have to know about them.","commit_id":"9f4a67901b5af6e73de01fcba07d4d472c294cc4"},{"author":{"_account_id":10873,"name":"Juan Antonio Osorio Robles","email":"jaosorior@redhat.com","username":"ejuaoso"},"change_message_id":"32588dabb3ebaec93cba6105c8f80f239d758864","unresolved":false,"context_lines":[{"line_number":496,"context_line":""},{"line_number":497,"context_line":"        return creds"},{"line_number":498,"context_line":""},{"line_number":499,"context_line":"    def register_default(self, default):"},{"line_number":500,"context_line":"        \"\"\"Registers a RuleDefault."},{"line_number":501,"context_line":""},{"line_number":502,"context_line":"        Adds a RuleDefault to the list of registered rules. Rules must be"}],"source_content_type":"text/x-python","patch_set":16,"id":"3f79a3b5_b204c21a","line":499,"in_reply_to":"3f79a3b5_5b5b5b21","updated":"2018-10-10 11:23:15.000000000","message":"Not necessarily. In some cases (OPA for instance) the driver won\u0027t need to know anything about the rules that the remote endpoint can evaluate, all it does is call the remote endpoint on whatever rule it got and get an evaluation.\n\nIn OPA it is actually a lot simpler to do defaults, all you need to do is set:\n\nallow \u003d false\n\nIn the beginning of the policy, and it\u0027ll deny by default. Then it\u0027ll evaluate the rest of the policies that it does find.","commit_id":"9f4a67901b5af6e73de01fcba07d4d472c294cc4"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"29c2a0247b0313f6b64ad622bbd8dc2774a42fa1","unresolved":false,"context_lines":[{"line_number":496,"context_line":""},{"line_number":497,"context_line":"        return creds"},{"line_number":498,"context_line":""},{"line_number":499,"context_line":"    def register_default(self, default):"},{"line_number":500,"context_line":"        \"\"\"Registers a RuleDefault."},{"line_number":501,"context_line":""},{"line_number":502,"context_line":"        Adds a RuleDefault to the list of registered rules. Rules must be"}],"source_content_type":"text/x-python","patch_set":16,"id":"3f79a3b5_6d0e4434","line":499,"in_reply_to":"3f79a3b5_b204c21a","updated":"2018-10-10 18:18:19.000000000","message":"The application can\u0027t know about the driver chosen, so we have to make all of them act the same way. I don\u0027t think we want all of the drivers to have to re-implement the default handling, so placing that in the caller avoids the need for any of them to have to do it.","commit_id":"9f4a67901b5af6e73de01fcba07d4d472c294cc4"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"a44b1348bae7e2adb50eab3f9f5a4af4a9e0324f","unresolved":false,"context_lines":[{"line_number":520,"context_line":"        for default in defaults:"},{"line_number":521,"context_line":"            self.register_default(default)"},{"line_number":522,"context_line":""},{"line_number":523,"context_line":"    def authorize(self, rule, target, creds, do_raise\u003dFalse,"},{"line_number":524,"context_line":"                  exc\u003dNone, *args, **kwargs):"},{"line_number":525,"context_line":"        \"\"\"A wrapper around \u0027enforce\u0027 that checks for policy registration."},{"line_number":526,"context_line":""}],"source_content_type":"text/x-python","patch_set":16,"id":"3f79a3b5_9b61f3d7","line":523,"updated":"2018-10-05 20:26:05.000000000","message":"Can we implement this for a system where we don\u0027t load all of the rules into memory? How would that work with a remote service?","commit_id":"9f4a67901b5af6e73de01fcba07d4d472c294cc4"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"29c2a0247b0313f6b64ad622bbd8dc2774a42fa1","unresolved":false,"context_lines":[{"line_number":520,"context_line":"        for default in defaults:"},{"line_number":521,"context_line":"            self.register_default(default)"},{"line_number":522,"context_line":""},{"line_number":523,"context_line":"    def authorize(self, rule, target, creds, do_raise\u003dFalse,"},{"line_number":524,"context_line":"                  exc\u003dNone, *args, **kwargs):"},{"line_number":525,"context_line":"        \"\"\"A wrapper around \u0027enforce\u0027 that checks for policy registration."},{"line_number":526,"context_line":""}],"source_content_type":"text/x-python","patch_set":16,"id":"3f79a3b5_4d2ca892","line":523,"in_reply_to":"3f79a3b5_925bc653","updated":"2018-10-10 18:18:19.000000000","message":"That\u0027s a significant API change, though. The entire point of having authorize() be a separate method is to do that check.\n\nMaybe drivers need to enforce \"registration\" of rules in their own way? So if a remote system doesn\u0027t have information associated with a given rule, it would raise PolicyNotRegistered()?","commit_id":"9f4a67901b5af6e73de01fcba07d4d472c294cc4"},{"author":{"_account_id":10873,"name":"Juan Antonio Osorio Robles","email":"jaosorior@redhat.com","username":"ejuaoso"},"change_message_id":"32588dabb3ebaec93cba6105c8f80f239d758864","unresolved":false,"context_lines":[{"line_number":520,"context_line":"        for default in defaults:"},{"line_number":521,"context_line":"            self.register_default(default)"},{"line_number":522,"context_line":""},{"line_number":523,"context_line":"    def authorize(self, rule, target, creds, do_raise\u003dFalse,"},{"line_number":524,"context_line":"                  exc\u003dNone, *args, **kwargs):"},{"line_number":525,"context_line":"        \"\"\"A wrapper around \u0027enforce\u0027 that checks for policy registration."},{"line_number":526,"context_line":""}],"source_content_type":"text/x-python","patch_set":16,"id":"3f79a3b5_925bc653","line":523,"in_reply_to":"3f79a3b5_9b61f3d7","updated":"2018-10-10 11:23:15.000000000","message":"We really can\u0027t. So all I did was make authorize work the same as enforce. this is because some openstack services (like keystone) have stopped calling enforce in favor of authorize.","commit_id":"9f4a67901b5af6e73de01fcba07d4d472c294cc4"}],"oslo_policy/opts.py":[{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"a44b1348bae7e2adb50eab3f9f5a4af4a9e0324f","unresolved":false,"context_lines":[{"line_number":25,"context_line":"_option_group \u003d \u0027oslo_policy\u0027"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"_options \u003d ["},{"line_number":28,"context_line":"    cfg.StrOpt(\u0027enforcer\u0027,"},{"line_number":29,"context_line":"               default\u003d\u0027default\u0027,"},{"line_number":30,"context_line":"               help\u003d_(\u0027This option controls what enforcer is used to evaluate \u0027"},{"line_number":31,"context_line":"                      \u0027the policy rules.\u0027)),"}],"source_content_type":"text/x-python","patch_set":16,"id":"3f79a3b5_1b3723b2","line":28,"updated":"2018-10-05 20:26:05.000000000","message":"Let\u0027s call this \"driver\" like in other places where we have plugins.","commit_id":"9f4a67901b5af6e73de01fcba07d4d472c294cc4"}],"oslo_policy/policy.py":[{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"a44b1348bae7e2adb50eab3f9f5a4af4a9e0324f","unresolved":false,"context_lines":[{"line_number":488,"context_line":"        # parent class."},{"line_number":489,"context_line":"        object.__setattr__(self, \u0027driver\u0027, mgr.driver)"},{"line_number":490,"context_line":""},{"line_number":491,"context_line":"    def __getattr__(self, attr):"},{"line_number":492,"context_line":"        return getattr(self.driver, attr)"},{"line_number":493,"context_line":""},{"line_number":494,"context_line":"    def __setattr__(self, attr, value):"}],"source_content_type":"text/x-python","patch_set":16,"id":"3f79a3b5_181ac97b","line":491,"updated":"2018-10-05 20:26:05.000000000","message":"I don\u0027t understand why we need/want the __getattr__ and __setattr__ methods. Shouldn\u0027t the Enforcer completely hide the fact that there is a driver? And shouldn\u0027t we be able to do that by maintaining the public API of the Enforcer but changing the method implementations, even if those methods mirror the ones in the driver?","commit_id":"9f4a67901b5af6e73de01fcba07d4d472c294cc4"},{"author":{"_account_id":10873,"name":"Juan Antonio Osorio Robles","email":"jaosorior@redhat.com","username":"ejuaoso"},"change_message_id":"32588dabb3ebaec93cba6105c8f80f239d758864","unresolved":false,"context_lines":[{"line_number":488,"context_line":"        # parent class."},{"line_number":489,"context_line":"        object.__setattr__(self, \u0027driver\u0027, mgr.driver)"},{"line_number":490,"context_line":""},{"line_number":491,"context_line":"    def __getattr__(self, attr):"},{"line_number":492,"context_line":"        return getattr(self.driver, attr)"},{"line_number":493,"context_line":""},{"line_number":494,"context_line":"    def __setattr__(self, attr, value):"}],"source_content_type":"text/x-python","patch_set":16,"id":"3f79a3b5_9565f0e4","line":491,"in_reply_to":"3f79a3b5_181ac97b","updated":"2018-10-10 11:23:15.000000000","message":"A lot of tests rely on the variables used by the default driver. So it is not very straight forward to just remove all the variables and rely on methods only. To ease the migration towards drivers, I found this to be the most practical way.","commit_id":"9f4a67901b5af6e73de01fcba07d4d472c294cc4"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"29c2a0247b0313f6b64ad622bbd8dc2774a42fa1","unresolved":false,"context_lines":[{"line_number":488,"context_line":"        # parent class."},{"line_number":489,"context_line":"        object.__setattr__(self, \u0027driver\u0027, mgr.driver)"},{"line_number":490,"context_line":""},{"line_number":491,"context_line":"    def __getattr__(self, attr):"},{"line_number":492,"context_line":"        return getattr(self.driver, attr)"},{"line_number":493,"context_line":""},{"line_number":494,"context_line":"    def __setattr__(self, attr, value):"}],"source_content_type":"text/x-python","patch_set":16,"id":"3f79a3b5_2d460c52","line":491,"in_reply_to":"3f79a3b5_9565f0e4","updated":"2018-10-10 18:18:19.000000000","message":"It\u0027s fewer changes now, but is going to lead to code that\u0027s harder to maintain. It also makes the actual public API of this class unclear. So I think we\u0027re going to want to remove the methods.","commit_id":"9f4a67901b5af6e73de01fcba07d4d472c294cc4"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"a44b1348bae7e2adb50eab3f9f5a4af4a9e0324f","unresolved":false,"context_lines":[{"line_number":497,"context_line":"        else:"},{"line_number":498,"context_line":"            setattr(self.driver, attr, value)"},{"line_number":499,"context_line":""},{"line_number":500,"context_line":"    def set_rules(self, rules, overwrite\u003dTrue, use_conf\u003dFalse):"},{"line_number":501,"context_line":"        self.driver.set_rules(rules, overwrite, use_conf)"},{"line_number":502,"context_line":""},{"line_number":503,"context_line":"    def clear(self):"}],"source_content_type":"text/x-python","patch_set":16,"id":"3f79a3b5_bb54efc7","line":500,"updated":"2018-10-05 20:26:05.000000000","message":"We have a *lot* of calls in the services that install rules using set_rules(). What happens to those if the backend is not our custom enforcer implementation but is some other driver?\n\nhttp://codesearch.openstack.org/?q\u003d%5C.set_rules\u0026i\u003dnope\u0026files\u003d\u0026repos\u003d","commit_id":"9f4a67901b5af6e73de01fcba07d4d472c294cc4"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"29c2a0247b0313f6b64ad622bbd8dc2774a42fa1","unresolved":false,"context_lines":[{"line_number":497,"context_line":"        else:"},{"line_number":498,"context_line":"            setattr(self.driver, attr, value)"},{"line_number":499,"context_line":""},{"line_number":500,"context_line":"    def set_rules(self, rules, overwrite\u003dTrue, use_conf\u003dFalse):"},{"line_number":501,"context_line":"        self.driver.set_rules(rules, overwrite, use_conf)"},{"line_number":502,"context_line":""},{"line_number":503,"context_line":"    def clear(self):"}],"source_content_type":"text/x-python","patch_set":16,"id":"3f79a3b5_6daac4d3","line":500,"in_reply_to":"3f79a3b5_b537ccdb","updated":"2018-10-10 18:18:19.000000000","message":"Using:\n\n  beagle search \\.set_rules | grep -v test | wc -l\n\nI found 146 cases not in test files. Many services even define their own high-level set_policy() function to manipulate their Enforcer singleton.","commit_id":"9f4a67901b5af6e73de01fcba07d4d472c294cc4"},{"author":{"_account_id":10873,"name":"Juan Antonio Osorio Robles","email":"jaosorior@redhat.com","username":"ejuaoso"},"change_message_id":"32588dabb3ebaec93cba6105c8f80f239d758864","unresolved":false,"context_lines":[{"line_number":497,"context_line":"        else:"},{"line_number":498,"context_line":"            setattr(self.driver, attr, value)"},{"line_number":499,"context_line":""},{"line_number":500,"context_line":"    def set_rules(self, rules, overwrite\u003dTrue, use_conf\u003dFalse):"},{"line_number":501,"context_line":"        self.driver.set_rules(rules, overwrite, use_conf)"},{"line_number":502,"context_line":""},{"line_number":503,"context_line":"    def clear(self):"}],"source_content_type":"text/x-python","patch_set":16,"id":"3f79a3b5_b537ccdb","line":500,"in_reply_to":"3f79a3b5_bb54efc7","updated":"2018-10-10 11:23:15.000000000","message":"Most of those instances seem to be tests. Given that the default implementation is still the good old policy engine, it should be fine. When an operator decides to use a driver that relies on a remote engine, these set_rules calls will be ignored, as the remote engine ought to have all the information it needs to make policy decisions.","commit_id":"9f4a67901b5af6e73de01fcba07d4d472c294cc4"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"a44b1348bae7e2adb50eab3f9f5a4af4a9e0324f","unresolved":false,"context_lines":[{"line_number":506,"context_line":"    def load_rules(self, force_reload\u003dFalse):"},{"line_number":507,"context_line":"        self.driver.load_rules(force_reload)"},{"line_number":508,"context_line":""},{"line_number":509,"context_line":"    def check_rules(self, raise_on_violation\u003dFalse):"},{"line_number":510,"context_line":"        return self.driver.check_rules(raise_on_violation)"},{"line_number":511,"context_line":""},{"line_number":512,"context_line":"    def enforce(self, rule, target, creds, do_raise\u003dFalse, exc\u003dNone,"}],"source_content_type":"text/x-python","patch_set":16,"id":"3f79a3b5_1b05e3c1","line":509,"updated":"2018-10-05 20:26:05.000000000","message":"I don\u0027t see any calls to check_rules() anywhere outside of oslo.policy. We might be able to make this a private method.","commit_id":"9f4a67901b5af6e73de01fcba07d4d472c294cc4"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"a44b1348bae7e2adb50eab3f9f5a4af4a9e0324f","unresolved":false,"context_lines":[{"line_number":515,"context_line":"                                   *args, **kwargs)"},{"line_number":516,"context_line":""},{"line_number":517,"context_line":"    def register_default(self, default):"},{"line_number":518,"context_line":"        self.driver.register_default(default)"},{"line_number":519,"context_line":""},{"line_number":520,"context_line":"    def register_defaults(self, defaults):"},{"line_number":521,"context_line":"        self.driver.register_defaults(defaults)"}],"source_content_type":"text/x-python","patch_set":16,"id":"3f79a3b5_5b427b3d","line":518,"updated":"2018-10-05 20:26:05.000000000","message":"The driver shouldn\u0027t need to worry about the default. We should keep doing that at this level.","commit_id":"9f4a67901b5af6e73de01fcba07d4d472c294cc4"},{"author":{"_account_id":10873,"name":"Juan Antonio Osorio Robles","email":"jaosorior@redhat.com","username":"ejuaoso"},"change_message_id":"32588dabb3ebaec93cba6105c8f80f239d758864","unresolved":false,"context_lines":[{"line_number":515,"context_line":"                                   *args, **kwargs)"},{"line_number":516,"context_line":""},{"line_number":517,"context_line":"    def register_default(self, default):"},{"line_number":518,"context_line":"        self.driver.register_default(default)"},{"line_number":519,"context_line":""},{"line_number":520,"context_line":"    def register_defaults(self, defaults):"},{"line_number":521,"context_line":"        self.driver.register_defaults(defaults)"}],"source_content_type":"text/x-python","patch_set":16,"id":"3f79a3b5_75413436","line":518,"in_reply_to":"3f79a3b5_5b427b3d","updated":"2018-10-10 11:23:15.000000000","message":"Even if the defaults are ignored by the driver?","commit_id":"9f4a67901b5af6e73de01fcba07d4d472c294cc4"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"29c2a0247b0313f6b64ad622bbd8dc2774a42fa1","unresolved":false,"context_lines":[{"line_number":515,"context_line":"                                   *args, **kwargs)"},{"line_number":516,"context_line":""},{"line_number":517,"context_line":"    def register_default(self, default):"},{"line_number":518,"context_line":"        self.driver.register_default(default)"},{"line_number":519,"context_line":""},{"line_number":520,"context_line":"    def register_defaults(self, defaults):"},{"line_number":521,"context_line":"        self.driver.register_defaults(defaults)"}],"source_content_type":"text/x-python","patch_set":16,"id":"3f79a3b5_ed7fb466","line":518,"in_reply_to":"3f79a3b5_75413436","updated":"2018-10-10 18:18:19.000000000","message":"Why would the driver ignore the defaults?","commit_id":"9f4a67901b5af6e73de01fcba07d4d472c294cc4"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"a44b1348bae7e2adb50eab3f9f5a4af4a9e0324f","unresolved":false,"context_lines":[{"line_number":520,"context_line":"    def register_defaults(self, defaults):"},{"line_number":521,"context_line":"        self.driver.register_defaults(defaults)"},{"line_number":522,"context_line":""},{"line_number":523,"context_line":"    def authorize(self, rule, target, creds, do_raise\u003dFalse,"},{"line_number":524,"context_line":"                  exc\u003dNone, *args, **kwargs):"},{"line_number":525,"context_line":"        return self.driver.authorize(rule, target, creds, do_raise, exc,"},{"line_number":526,"context_line":"                                     *args, **kwargs)"}],"source_content_type":"text/x-python","patch_set":16,"id":"3f79a3b5_1b2e4342","line":523,"updated":"2018-10-05 20:26:05.000000000","message":"It appears from the description that authorize() is the preferred API over enforce() because it checks that the policy rule is registered. Are we going to be able to provide that same assurance for remote policy engines?","commit_id":"9f4a67901b5af6e73de01fcba07d4d472c294cc4"},{"author":{"_account_id":10873,"name":"Juan Antonio Osorio Robles","email":"jaosorior@redhat.com","username":"ejuaoso"},"change_message_id":"32588dabb3ebaec93cba6105c8f80f239d758864","unresolved":false,"context_lines":[{"line_number":520,"context_line":"    def register_defaults(self, defaults):"},{"line_number":521,"context_line":"        self.driver.register_defaults(defaults)"},{"line_number":522,"context_line":""},{"line_number":523,"context_line":"    def authorize(self, rule, target, creds, do_raise\u003dFalse,"},{"line_number":524,"context_line":"                  exc\u003dNone, *args, **kwargs):"},{"line_number":525,"context_line":"        return self.driver.authorize(rule, target, creds, do_raise, exc,"},{"line_number":526,"context_line":"                                     *args, **kwargs)"}],"source_content_type":"text/x-python","patch_set":16,"id":"3f79a3b5_3575fc97","line":523,"in_reply_to":"3f79a3b5_1b2e4342","updated":"2018-10-10 11:23:15.000000000","message":"I don\u0027t think that will be possible for all drivers.","commit_id":"9f4a67901b5af6e73de01fcba07d4d472c294cc4"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"29c2a0247b0313f6b64ad622bbd8dc2774a42fa1","unresolved":false,"context_lines":[{"line_number":520,"context_line":"    def register_defaults(self, defaults):"},{"line_number":521,"context_line":"        self.driver.register_defaults(defaults)"},{"line_number":522,"context_line":""},{"line_number":523,"context_line":"    def authorize(self, rule, target, creds, do_raise\u003dFalse,"},{"line_number":524,"context_line":"                  exc\u003dNone, *args, **kwargs):"},{"line_number":525,"context_line":"        return self.driver.authorize(rule, target, creds, do_raise, exc,"},{"line_number":526,"context_line":"                                     *args, **kwargs)"}],"source_content_type":"text/x-python","patch_set":16,"id":"3f79a3b5_cdf19802","line":523,"in_reply_to":"3f79a3b5_3575fc97","updated":"2018-10-10 18:18:19.000000000","message":"As I said in the other file, that\u0027s a significant API change that we need to address.","commit_id":"9f4a67901b5af6e73de01fcba07d4d472c294cc4"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"a44b1348bae7e2adb50eab3f9f5a4af4a9e0324f","unresolved":false,"context_lines":[{"line_number":527,"context_line":""},{"line_number":528,"context_line":""},{"line_number":529,"context_line":"@six.add_metaclass(abc.ABCMeta)"},{"line_number":530,"context_line":"class BaseEnforcer(object):"},{"line_number":531,"context_line":"    \"\"\"Base class for the policy enforcer object."},{"line_number":532,"context_line":""},{"line_number":533,"context_line":"    :param conf: A configuration object."}],"source_content_type":"text/x-python","patch_set":16,"id":"3f79a3b5_7b3657eb","line":530,"updated":"2018-10-05 20:26:05.000000000","message":"This class should go in oslo_policy/_enforcers/base.py","commit_id":"9f4a67901b5af6e73de01fcba07d4d472c294cc4"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"a44b1348bae7e2adb50eab3f9f5a4af4a9e0324f","unresolved":false,"context_lines":[{"line_number":539,"context_line":"    :param default_rule: Default rule to use, conf.default_rule will"},{"line_number":540,"context_line":"                         be used if none is specified."},{"line_number":541,"context_line":"    \"\"\""},{"line_number":542,"context_line":"    def __init__(self, conf, rules\u003dNone, default_rule\u003dNone, *args, **kwargs):"},{"line_number":543,"context_line":"        self.conf \u003d conf"},{"line_number":544,"context_line":"        self.default_rule \u003d (default_rule or"},{"line_number":545,"context_line":"                             self.conf.oslo_policy.policy_default_rule)"}],"source_content_type":"text/x-python","patch_set":16,"id":"3f79a3b5_bb514f10","line":542,"updated":"2018-10-05 20:26:05.000000000","message":"What are *args and **kwargs? Do we not know what information we\u0027re going to use to initialize a driver?","commit_id":"9f4a67901b5af6e73de01fcba07d4d472c294cc4"}]}