)]}'
{"patrole_tempest_plugin/tests/api/compute/test_lock_server_rbac.py":[{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"37ade02504964a74909aaac31c6fb235406f8b88","unresolved":false,"context_lines":[{"line_number":40,"context_line":"        self.servers_client.lock_server(server[\u0027id\u0027])"},{"line_number":41,"context_line":"        self.addCleanup(self.servers_client.unlock_server, server[\u0027id\u0027])"},{"line_number":42,"context_line":"        self.rbac_utils.switch_role(self, toggle_rbac_role\u003dTrue)"},{"line_number":43,"context_line":"        self.servers_client.unlock_server(server[\u0027id\u0027])"}],"source_content_type":"text/x-python","patch_set":3,"id":"7f231b9d_9d892428","line":43,"updated":"2017-06-09 21:35:09.000000000","message":"We can also add a test for os_compute_api:unlock:unlock_override by doing something like the following:\n\n1) Add credentials \u003d [\u0027primary\u0027, \u0027admin\u0027, \u0027alt\u0027]\n2) Lock the server using os_alt.servers_client.lock_server\n3) Toggle rbac role\n4) Wrap self.servers_client.unlock_server in try/finally\n5) Inside the try, do the unlock using os_primary.servers_client.unlock_server\n6) Inside the finally, do a show server using os_admin.servers_client.show_server and then assert that the server is \u0027ACTIVE\u0027 state -- if it\u0027s not, then raise rbac action failed exception explaining that either unlock or unlock_override caused the test to fail\n\nThis is the reason why we need multiple policy testing so that way we can pass both policies to rbac_rule_validation. I\u0027d add a NOTE explaining that we should make the necessary change to this test once multiple policy testing is implemented. It\u0027d then be nice to be able to tell the user which policy caused the test to fail (if we pass in multiple)","commit_id":"bb2a7dd0491a4f875a41f6b759c0f44e51c80ca2"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"2829d289c2b654d8f0ca4a2419bae5a121aef8b9","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":"class ComputeLockServersV29RbacTest(base.BaseV2ComputeRbacTest):"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"    credentials \u003d [\u0027primary\u0027, \u0027admin\u0027, \u0027alt\u0027]"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"    min_microversion \u003d \u00272.9\u0027"},{"line_number":57,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"7f231b9d_124b8459","line":54,"range":{"start_line":54,"start_character":40,"end_line":54,"end_character":43},"updated":"2017-06-13 00:24:58.000000000","message":"Remove.","commit_id":"616a29fe8db031b8e6deb57ee25ab83b04d902d9"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"2829d289c2b654d8f0ca4a2419bae5a121aef8b9","unresolved":false,"context_lines":[{"line_number":52,"context_line":"class ComputeLockServersV29RbacTest(base.BaseV2ComputeRbacTest):"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"    credentials \u003d [\u0027primary\u0027, \u0027admin\u0027, \u0027alt\u0027]"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"    min_microversion \u003d \u00272.9\u0027"},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"    @rbac_rule_validation.action("}],"source_content_type":"text/x-python","patch_set":5,"id":"7f231b9d_278400b1","line":55,"updated":"2017-06-13 00:24:58.000000000","message":"nit: stylistic, but the convention is to have no newline between these throughout Tempest and Patrole.","commit_id":"616a29fe8db031b8e6deb57ee25ab83b04d902d9"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"2829d289c2b654d8f0ca4a2419bae5a121aef8b9","unresolved":false,"context_lines":[{"line_number":58,"context_line":"    @rbac_rule_validation.action("},{"line_number":59,"context_line":"        service\u003d\"nova\","},{"line_number":60,"context_line":"        rule\u003d\"os_compute_api:os-lock-server:unlock:unlock_override\","},{"line_number":61,"context_line":"        expected_error_code\u003d404)"},{"line_number":62,"context_line":"    @decorators.idempotent_id(\u002740dfeef9-73ee-48a9-be19-a219875de457\u0027)"},{"line_number":63,"context_line":"    def test_unlock_server_override(self):"},{"line_number":64,"context_line":"        # Create server using alt credentials"}],"source_content_type":"text/x-python","patch_set":5,"id":"7f231b9d_f245a844","line":61,"range":{"start_line":61,"start_character":8,"end_line":61,"end_character":31},"updated":"2017-06-13 00:24:58.000000000","message":"Remove.\n\nIt should raise a 403.","commit_id":"616a29fe8db031b8e6deb57ee25ab83b04d902d9"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"2829d289c2b654d8f0ca4a2419bae5a121aef8b9","unresolved":false,"context_lines":[{"line_number":63,"context_line":"    def test_unlock_server_override(self):"},{"line_number":64,"context_line":"        # Create server using alt credentials"},{"line_number":65,"context_line":"        server_name \u003d data_utils.rand_name()"},{"line_number":66,"context_line":"        server \u003d self.os_alt.servers_client.create_server("},{"line_number":67,"context_line":"            name\u003dserver_name, imageRef\u003dCONF.compute.image_ref,"},{"line_number":68,"context_line":"            flavorRef\u003dCONF.compute.flavor_ref)[\u0027server\u0027]"},{"line_number":69,"context_line":"        waiters.wait_for_server_status(self.os_admin.servers_client,"}],"source_content_type":"text/x-python","patch_set":5,"id":"7f231b9d_f23008eb","line":66,"range":{"start_line":66,"start_character":17,"end_line":66,"end_character":43},"updated":"2017-06-13 00:24:58.000000000","message":"self.servers_client","commit_id":"616a29fe8db031b8e6deb57ee25ab83b04d902d9"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"2829d289c2b654d8f0ca4a2419bae5a121aef8b9","unresolved":false,"context_lines":[{"line_number":68,"context_line":"            flavorRef\u003dCONF.compute.flavor_ref)[\u0027server\u0027]"},{"line_number":69,"context_line":"        waiters.wait_for_server_status(self.os_admin.servers_client,"},{"line_number":70,"context_line":"                                       server[\u0027id\u0027], \u0027ACTIVE\u0027)"},{"line_number":71,"context_line":"        self.servers.append(server)"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"        # Lock server using alt credentials"},{"line_number":74,"context_line":"        self.os_alt.servers_client.lock_server(server[\u0027id\u0027])"}],"source_content_type":"text/x-python","patch_set":5,"id":"7f231b9d_12b9442d","line":71,"updated":"2017-06-13 00:24:58.000000000","message":"Lines 66-71 can be replace by self.create_test_server().\n\nWhile I think it\u0027s ideal to minimize the number of errant policies that are called, it\u0027d make more sense to create a helper method in base compute class that does this which I guess we can discuss adding in another patch, since plenty of other tests just use create_test_server which implicitly calls show_server with os_primary creds.","commit_id":"616a29fe8db031b8e6deb57ee25ab83b04d902d9"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"ac23b5dc9189bc540ba31479199b77f417704706","unresolved":false,"context_lines":[{"line_number":70,"context_line":"                                       server[\u0027id\u0027], \u0027ACTIVE\u0027)"},{"line_number":71,"context_line":"        self.servers.append(server)"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"        # Lock server using alt credentials"},{"line_number":74,"context_line":"        self.os_alt.servers_client.lock_server(server[\u0027id\u0027])"},{"line_number":75,"context_line":"        self.addCleanup(self.os_admin.servers_client.unlock_server,"},{"line_number":76,"context_line":"                        server[\u0027id\u0027])"}],"source_content_type":"text/x-python","patch_set":5,"id":"7f231b9d_b2d5f045","line":73,"range":{"start_line":73,"start_character":28,"end_line":73,"end_character":31},"updated":"2017-06-13 00:26:54.000000000","message":"admin","commit_id":"616a29fe8db031b8e6deb57ee25ab83b04d902d9"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"2829d289c2b654d8f0ca4a2419bae5a121aef8b9","unresolved":false,"context_lines":[{"line_number":71,"context_line":"        self.servers.append(server)"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"        # Lock server using alt credentials"},{"line_number":74,"context_line":"        self.os_alt.servers_client.lock_server(server[\u0027id\u0027])"},{"line_number":75,"context_line":"        self.addCleanup(self.os_admin.servers_client.unlock_server,"},{"line_number":76,"context_line":"                        server[\u0027id\u0027])"},{"line_number":77,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"7f231b9d_323c40be","line":74,"range":{"start_line":74,"start_character":13,"end_line":74,"end_character":19},"updated":"2017-06-13 00:24:58.000000000","message":"os_admin\n\nThis will avoid NotFound.","commit_id":"616a29fe8db031b8e6deb57ee25ab83b04d902d9"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"2829d289c2b654d8f0ca4a2419bae5a121aef8b9","unresolved":false,"context_lines":[{"line_number":72,"context_line":""},{"line_number":73,"context_line":"        # Lock server using alt credentials"},{"line_number":74,"context_line":"        self.os_alt.servers_client.lock_server(server[\u0027id\u0027])"},{"line_number":75,"context_line":"        self.addCleanup(self.os_admin.servers_client.unlock_server,"},{"line_number":76,"context_line":"                        server[\u0027id\u0027])"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"        self.rbac_utils.switch_role(self, toggle_rbac_role\u003dTrue)"}],"source_content_type":"text/x-python","patch_set":5,"id":"7f231b9d_f2b3684c","line":75,"range":{"start_line":75,"start_character":29,"end_line":75,"end_character":37},"updated":"2017-06-13 00:24:58.000000000","message":"nit: This doesn\u0027t have to be here since during tearDown it\u0027ll return to admin creds.","commit_id":"616a29fe8db031b8e6deb57ee25ab83b04d902d9"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"2829d289c2b654d8f0ca4a2419bae5a121aef8b9","unresolved":false,"context_lines":[{"line_number":76,"context_line":"                        server[\u0027id\u0027])"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"        self.rbac_utils.switch_role(self, toggle_rbac_role\u003dTrue)"},{"line_number":79,"context_line":"        # If user is not able to see servers created by other users,"},{"line_number":80,"context_line":"        # test fails with a NotFound."},{"line_number":81,"context_line":"        self.servers_client.unlock_server(server[\u0027id\u0027])"},{"line_number":82,"context_line":"        is_locked \u003d self.os_admin.servers_client.show_server("},{"line_number":83,"context_line":"            server[\u0027id\u0027])[\u0027server\u0027][\u0027locked\u0027]"}],"source_content_type":"text/x-python","patch_set":5,"id":"7f231b9d_d284ec60","line":80,"range":{"start_line":79,"start_character":8,"end_line":80,"end_character":37},"updated":"2017-06-13 00:24:58.000000000","message":"Remove.","commit_id":"616a29fe8db031b8e6deb57ee25ab83b04d902d9"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"2829d289c2b654d8f0ca4a2419bae5a121aef8b9","unresolved":false,"context_lines":[{"line_number":79,"context_line":"        # If user is not able to see servers created by other users,"},{"line_number":80,"context_line":"        # test fails with a NotFound."},{"line_number":81,"context_line":"        self.servers_client.unlock_server(server[\u0027id\u0027])"},{"line_number":82,"context_line":"        is_locked \u003d self.os_admin.servers_client.show_server("},{"line_number":83,"context_line":"            server[\u0027id\u0027])[\u0027server\u0027][\u0027locked\u0027]"},{"line_number":84,"context_line":"        if is_locked:"},{"line_number":85,"context_line":"            raise rbac_exceptions.RbacActionFailed("}],"source_content_type":"text/x-python","patch_set":5,"id":"7f231b9d_7281984a","line":82,"updated":"2017-06-13 00:24:58.000000000","message":"Now a 403 should definitely be thrown.","commit_id":"616a29fe8db031b8e6deb57ee25ab83b04d902d9"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"e049546213bfedf67e01251bc5fd449d84832f21","unresolved":false,"context_lines":[{"line_number":81,"context_line":"        self.servers_client.unlock_server(server[\u0027id\u0027])"},{"line_number":82,"context_line":"        is_locked \u003d self.os_admin.servers_client.show_server("},{"line_number":83,"context_line":"            server[\u0027id\u0027])[\u0027server\u0027][\u0027locked\u0027]"},{"line_number":84,"context_line":"        if is_locked:"},{"line_number":85,"context_line":"            raise rbac_exceptions.RbacActionFailed("},{"line_number":86,"context_line":"                \"Server has not been unlocked. unlock or \""},{"line_number":87,"context_line":"                \"unlock_override action failed.\")"}],"source_content_type":"text/x-python","patch_set":5,"id":"7f231b9d_920f94e0","line":84,"updated":"2017-06-13 00:30:43.000000000","message":"Looking at this again, not even sure L82-87 are needed since 81 will raise a 403 (it\u0027s ADMIN_API rule by default) and otherwise it\u0027s admin which means that is_locked check should always succeed (and if it fails it\u0027ll be due to some other Nova failure, not permissions-based).","commit_id":"616a29fe8db031b8e6deb57ee25ab83b04d902d9"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"d588630cd1c9f4b44373a9ac1dc6dc7c54a7a826","unresolved":false,"context_lines":[{"line_number":13,"context_line":"#    License for the specific language governing permissions and limitations"},{"line_number":14,"context_line":"#    under the License."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"from tempest.common import waiters"},{"line_number":17,"context_line":"from tempest import config"},{"line_number":18,"context_line":"from tempest.lib.common.utils import data_utils"},{"line_number":19,"context_line":"from tempest.lib import decorators"}],"source_content_type":"text/x-python","patch_set":6,"id":"7f231b9d_316e5e01","line":16,"range":{"start_line":16,"start_character":0,"end_line":16,"end_character":34},"updated":"2017-06-13 19:50:51.000000000","message":"Unused.","commit_id":"6107b1b749f8caa35a855b58b529d0b9db3ef244"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"d588630cd1c9f4b44373a9ac1dc6dc7c54a7a826","unresolved":false,"context_lines":[{"line_number":14,"context_line":"#    under the License."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"from tempest.common import waiters"},{"line_number":17,"context_line":"from tempest import config"},{"line_number":18,"context_line":"from tempest.lib.common.utils import data_utils"},{"line_number":19,"context_line":"from tempest.lib import decorators"},{"line_number":20,"context_line":""}],"source_content_type":"text/x-python","patch_set":6,"id":"7f231b9d_f1b22694","line":17,"range":{"start_line":17,"start_character":0,"end_line":17,"end_character":26},"updated":"2017-06-13 19:50:51.000000000","message":"Unused.","commit_id":"6107b1b749f8caa35a855b58b529d0b9db3ef244"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"d588630cd1c9f4b44373a9ac1dc6dc7c54a7a826","unresolved":false,"context_lines":[{"line_number":15,"context_line":""},{"line_number":16,"context_line":"from tempest.common import waiters"},{"line_number":17,"context_line":"from tempest import config"},{"line_number":18,"context_line":"from tempest.lib.common.utils import data_utils"},{"line_number":19,"context_line":"from tempest.lib import decorators"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"from patrole_tempest_plugin import rbac_exceptions"}],"source_content_type":"text/x-python","patch_set":6,"id":"7f231b9d_917c12b6","line":18,"range":{"start_line":18,"start_character":0,"end_line":18,"end_character":47},"updated":"2017-06-13 19:50:51.000000000","message":"Unused.","commit_id":"6107b1b749f8caa35a855b58b529d0b9db3ef244"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"d588630cd1c9f4b44373a9ac1dc6dc7c54a7a826","unresolved":false,"context_lines":[{"line_number":22,"context_line":"from patrole_tempest_plugin import rbac_rule_validation"},{"line_number":23,"context_line":"from patrole_tempest_plugin.tests.api.compute import rbac_base as base"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"CONF \u003d config.CONF"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"class ComputeLockServersRbacTest(base.BaseV2ComputeRbacTest):"}],"source_content_type":"text/x-python","patch_set":6,"id":"7f231b9d_11bc8267","line":25,"range":{"start_line":25,"start_character":0,"end_line":25,"end_character":18},"updated":"2017-06-13 19:50:51.000000000","message":"Unused.","commit_id":"6107b1b749f8caa35a855b58b529d0b9db3ef244"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"d588630cd1c9f4b44373a9ac1dc6dc7c54a7a826","unresolved":false,"context_lines":[{"line_number":54,"context_line":"    @decorators.idempotent_id(\u002740dfeef9-73ee-48a9-be19-a219875de457\u0027)"},{"line_number":55,"context_line":"    def test_unlock_server_override(self):"},{"line_number":56,"context_line":"        server \u003d self.create_test_server(wait_until\u003d\u0027ACTIVE\u0027)"},{"line_number":57,"context_line":"        self.os_admin.servers_client.lock_server(server[\u0027id\u0027])"},{"line_number":58,"context_line":"        self.addCleanup(self.servers_client.unlock_server, server[\u0027id\u0027])"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"        self.rbac_utils.switch_role(self, toggle_rbac_role\u003dTrue)"}],"source_content_type":"text/x-python","patch_set":6,"id":"7f231b9d_fc131d5b","line":57,"updated":"2017-06-13 19:50:51.000000000","message":"Can we add a comment above this explaining what\u0027s happening?\n\nLike: \n\nLock the server using admin creds because unlock_override is only enforced if a different user than the one who locked the server tries to unlock it. Then perform unlock with primary creds.","commit_id":"6107b1b749f8caa35a855b58b529d0b9db3ef244"}]}