)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":17896,"name":"Rick Bartra","email":"rickbartra@microsoft.com","username":"rb560u"},"change_message_id":"20bd45542b3ae877e1399d15012a0ac361abe13a","unresolved":false,"context_lines":[{"line_number":15,"context_line":"whether RBAC is configured correctly, since some API endpoints"},{"line_number":16,"context_line":"enforce multiple policies."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"The new ``rules`` argument is implement for"},{"line_number":19,"context_line":"test_unlock_server_override test which corresponds to [0]"},{"line_number":20,"context_line":"which enforces:"},{"line_number":21,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":7,"id":"5f7c97a3_c34ae753","line":18,"range":{"start_line":18,"start_character":30,"end_line":18,"end_character":39},"updated":"2018-05-08 21:04:21.000000000","message":"nit: implemented","commit_id":"cb6acb6eeaab0a35cde08fac96c24a4629982400"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"88acb9a987569380da7719ece077a3b441eaf597","unresolved":false,"context_lines":[{"line_number":15,"context_line":"whether RBAC is configured correctly, since some API endpoints"},{"line_number":16,"context_line":"enforce multiple policies."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"The new ``rules`` argument is implement for"},{"line_number":19,"context_line":"test_unlock_server_override test which corresponds to [0]"},{"line_number":20,"context_line":"which enforces:"},{"line_number":21,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":7,"id":"5f7c97a3_fa7326b0","line":18,"range":{"start_line":18,"start_character":30,"end_line":18,"end_character":39},"in_reply_to":"5f7c97a3_c34ae753","updated":"2018-05-19 23:14:05.000000000","message":"Done","commit_id":"cb6acb6eeaab0a35cde08fac96c24a4629982400"},{"author":{"_account_id":17896,"name":"Rick Bartra","email":"rickbartra@microsoft.com","username":"rb560u"},"change_message_id":"20bd45542b3ae877e1399d15012a0ac361abe13a","unresolved":false,"context_lines":[{"line_number":30,"context_line":"The following will be carried out in additional follow up patches:"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"  * Renaming rule to rules"},{"line_number":33,"context_line":"  * Adding multi-policy support carefully for selected APIs"},{"line_number":34,"context_line":"    to be tracked via an etherpad"},{"line_number":35,"context_line":"  * Updating Patrole documentation with multi-policy support"},{"line_number":36,"context_line":"    details"},{"line_number":37,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":7,"id":"5f7c97a3_839b8fc7","line":34,"range":{"start_line":33,"start_character":4,"end_line":34,"end_character":33},"updated":"2018-05-08 21:04:21.000000000","message":"will we only be doing it for ones that are easy to spot such as the one noted in [0] where the code clearly shows multiple policy enforcement?\n\ndoes this etherpad exist yet?","commit_id":"cb6acb6eeaab0a35cde08fac96c24a4629982400"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"d58d3d6ae53b5b69f8defeb1d9d0a7ef0df532a6","unresolved":false,"context_lines":[{"line_number":30,"context_line":"The following will be carried out in additional follow up patches:"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"  * Renaming rule to rules"},{"line_number":33,"context_line":"  * Adding multi-policy support carefully for selected APIs"},{"line_number":34,"context_line":"    to be tracked via an etherpad"},{"line_number":35,"context_line":"  * Updating Patrole documentation with multi-policy support"},{"line_number":36,"context_line":"    details"},{"line_number":37,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":7,"id":"5f7c97a3_7a187674","line":34,"range":{"start_line":33,"start_character":4,"end_line":34,"end_character":33},"in_reply_to":"5f7c97a3_839b8fc7","updated":"2018-05-19 23:05:31.000000000","message":"1) re: specific multiple policies for an API: Yes. It\u0027s simply not realistic to keep track of every policy for each API under test.\n2) re: etherpad: No it doesn\u0027t; I was holding off on creating it until this patchset was merged.","commit_id":"cb6acb6eeaab0a35cde08fac96c24a4629982400"}],"patrole_tempest_plugin/rbac_rule_validation.py":[{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"de15f95f75364ed9a845304f7d8c16c2bcd4e7bf","unresolved":false,"context_lines":[{"line_number":118,"context_line":"    if extra_target_data is None:"},{"line_number":119,"context_line":"        extra_target_data \u003d {}"},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"    deprecation_msg \u003d ("},{"line_number":122,"context_line":"        \"The `rule` argument has been deprecated in favor of `rules` \""},{"line_number":123,"context_line":"        \"and will be removed in a future version.\")"},{"line_number":124,"context_line":"    versionutils.report_deprecated_feature(LOG, deprecation_msg)"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"    rules \u003d _prepare_rules(rule, rules)"},{"line_number":127,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"bf659307_e5664f52","line":124,"range":{"start_line":121,"start_character":0,"end_line":124,"end_character":64},"updated":"2018-03-25 20:04:56.000000000","message":"Need to add reno with deprecation notes for this as well as include multi-policy support under features.","commit_id":"dea023e8c9b3b010d3048e7e06e3734bd786e3df"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"8c3abe72f4f0ede1858e37f58a463f94c61d2f21","unresolved":false,"context_lines":[{"line_number":214,"context_line":"        rules \u003d [rules]"},{"line_number":215,"context_line":"    if rule:"},{"line_number":216,"context_line":"        if rules:"},{"line_number":217,"context_line":"            LOG.debug(\"The policies in `rules` will be used instead of those \""},{"line_number":218,"context_line":"                      \"in `rule`.\")"},{"line_number":219,"context_line":"        else:"},{"line_number":220,"context_line":"            rules.append(rule)"},{"line_number":221,"context_line":"    return rules"}],"source_content_type":"text/x-python","patch_set":1,"id":"df7087c5_981c6378","line":218,"range":{"start_line":217,"start_character":71,"end_line":218,"end_character":35},"updated":"2018-03-21 02:49:59.000000000","message":"`rule`.","commit_id":"dea023e8c9b3b010d3048e7e06e3734bd786e3df"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"b6e748a1d9967977cbbf3d11d1503efec0daa806","unresolved":false,"context_lines":[{"line_number":118,"context_line":"    if extra_target_data is None:"},{"line_number":119,"context_line":"        extra_target_data \u003d {}"},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"    deprecation_msg \u003d ("},{"line_number":122,"context_line":"        \"The `rule` argument has been deprecated in favor of `rules` \""},{"line_number":123,"context_line":"        \"and will be removed in a future version.\")"},{"line_number":124,"context_line":"    versionutils.report_deprecated_feature(LOG, deprecation_msg)"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"    rules \u003d _prepare_rules(rule, rules)"},{"line_number":127,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"bf659307_005491c9","line":124,"range":{"start_line":121,"start_character":0,"end_line":124,"end_character":64},"updated":"2018-03-25 22:03:28.000000000","message":"Should move this down to L216.","commit_id":"a452729e469ff8d7135433a1aa2d23e0fabd77e0"},{"author":{"_account_id":17896,"name":"Rick Bartra","email":"rickbartra@microsoft.com","username":"rb560u"},"change_message_id":"20bd45542b3ae877e1399d15012a0ac361abe13a","unresolved":false,"context_lines":[{"line_number":72,"context_line":"    :param str service: An OpenStack service. Examples: \"nova\" or \"neutron\"."},{"line_number":73,"context_line":"    :param str rule: (DEPRECATED) A policy action defined in a policy.json file"},{"line_number":74,"context_line":"        or in code."},{"line_number":75,"context_line":"    :param list rules: A list of policy actions defined in a policy.json file"},{"line_number":76,"context_line":"        or in code. The rules are logical-ANDed together to derive the expected"},{"line_number":77,"context_line":"        result."},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"        .. note::"},{"line_number":80,"context_line":""}],"source_content_type":"text/x-python","patch_set":7,"id":"5f7c97a3_23d87b7d","line":77,"range":{"start_line":75,"start_character":4,"end_line":77,"end_character":15},"updated":"2018-05-08 21:04:21.000000000","message":"we are only talking about single service multi-policy enforcement correct?","commit_id":"cb6acb6eeaab0a35cde08fac96c24a4629982400"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"d58d3d6ae53b5b69f8defeb1d9d0a7ef0df532a6","unresolved":false,"context_lines":[{"line_number":72,"context_line":"    :param str service: An OpenStack service. Examples: \"nova\" or \"neutron\"."},{"line_number":73,"context_line":"    :param str rule: (DEPRECATED) A policy action defined in a policy.json file"},{"line_number":74,"context_line":"        or in code."},{"line_number":75,"context_line":"    :param list rules: A list of policy actions defined in a policy.json file"},{"line_number":76,"context_line":"        or in code. The rules are logical-ANDed together to derive the expected"},{"line_number":77,"context_line":"        result."},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"        .. note::"},{"line_number":80,"context_line":""}],"source_content_type":"text/x-python","patch_set":7,"id":"5f7c97a3_fa2566ac","line":77,"range":{"start_line":75,"start_character":4,"end_line":77,"end_character":15},"in_reply_to":"5f7c97a3_23d87b7d","updated":"2018-05-19 23:05:31.000000000","message":"Yes, single service. Worrying about cross-service multi-policy enforcement is an even more involved problem, and I think we should start out small.","commit_id":"cb6acb6eeaab0a35cde08fac96c24a4629982400"}],"patrole_tempest_plugin/tests/unit/test_rbac_rule_validation.py":[{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"1c2036b7168a31eb028133bd245589ba321ef75e","unresolved":false,"context_lines":[{"line_number":458,"context_line":"        def test_policy(*args):"},{"line_number":459,"context_line":"            pass"},{"line_number":460,"context_line":""},{"line_number":461,"context_line":"        test_policy(self.mock_test_args)"},{"line_number":462,"context_line":""},{"line_number":463,"context_line":"    @mock.patch.object(rbac_rv, \u0027LOG\u0027, autospec\u003dTrue)"},{"line_number":464,"context_line":"    @mock.patch.object(rbac_rv, \u0027policy_authority\u0027, autospec\u003dTrue)"}],"source_content_type":"text/x-python","patch_set":1,"id":"bf659307_85d0b3cb","line":461,"updated":"2018-03-25 20:07:40.000000000","message":"Should assert this stuff is called twice with the expected rules:\n\n            authority \u003d policy_authority.PolicyAuthority(\n                project_id, user_id, service,\n                extra_target_data\u003dformatted_target_data)\n            is_allowed \u003d authority.allowed(rule, role)","commit_id":"dea023e8c9b3b010d3048e7e06e3734bd786e3df"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"2d7cbf73d1f08f3795e8ccde379017aef717073b","unresolved":false,"context_lines":[{"line_number":509,"context_line":""},{"line_number":510,"context_line":"        _do_test([True, True, False])"},{"line_number":511,"context_line":"        _do_test([False, True, True])"},{"line_number":512,"context_line":"        _do_test([True, False, True])"},{"line_number":513,"context_line":""},{"line_number":514,"context_line":"    @mock.patch.object(rbac_rv, \u0027LOG\u0027, autospec\u003dTrue)"},{"line_number":515,"context_line":"    @mock.patch.object(rbac_rv, \u0027policy_authority\u0027, autospec\u003dTrue)"}],"source_content_type":"text/x-python","patch_set":1,"id":"df7087c5_18acd333","line":512,"updated":"2018-03-21 02:46:51.000000000","message":"mock_log.error.assert_not_called()","commit_id":"dea023e8c9b3b010d3048e7e06e3734bd786e3df"},{"author":{"_account_id":17896,"name":"Rick Bartra","email":"rickbartra@microsoft.com","username":"rb560u"},"change_message_id":"20bd45542b3ae877e1399d15012a0ac361abe13a","unresolved":false,"context_lines":[{"line_number":446,"context_line":"    @mock.patch.object(rbac_rv, \u0027policy_authority\u0027, autospec\u003dTrue)"},{"line_number":447,"context_line":"    def test_rule_validation_multi_policy_overpermission_failure("},{"line_number":448,"context_line":"            self, mock_authority, mock_log):"},{"line_number":449,"context_line":"        \"\"\"Test that having permission and NO exception thrown is failure.\"\"\""},{"line_number":450,"context_line":""},{"line_number":451,"context_line":"        rules \u003d ["},{"line_number":452,"context_line":"            mock.sentinel.action1, mock.sentinel.action2, mock.sentinel.action3"}],"source_content_type":"text/x-python","patch_set":7,"id":"5f7c97a3_83794ffd","line":449,"range":{"start_line":449,"start_character":43,"end_line":449,"end_character":55},"updated":"2018-05-08 21:04:21.000000000","message":"should this be \"exception thrown\" without the \"no\"?","commit_id":"cb6acb6eeaab0a35cde08fac96c24a4629982400"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"d58d3d6ae53b5b69f8defeb1d9d0a7ef0df532a6","unresolved":false,"context_lines":[{"line_number":446,"context_line":"    @mock.patch.object(rbac_rv, \u0027policy_authority\u0027, autospec\u003dTrue)"},{"line_number":447,"context_line":"    def test_rule_validation_multi_policy_overpermission_failure("},{"line_number":448,"context_line":"            self, mock_authority, mock_log):"},{"line_number":449,"context_line":"        \"\"\"Test that having permission and NO exception thrown is failure.\"\"\""},{"line_number":450,"context_line":""},{"line_number":451,"context_line":"        rules \u003d ["},{"line_number":452,"context_line":"            mock.sentinel.action1, mock.sentinel.action2, mock.sentinel.action3"}],"source_content_type":"text/x-python","patch_set":7,"id":"5f7c97a3_3a519e0f","line":449,"range":{"start_line":449,"start_character":43,"end_line":449,"end_character":55},"in_reply_to":"5f7c97a3_83794ffd","updated":"2018-05-19 23:05:31.000000000","message":"I think this is worded poorly. I mean: \"Test that when expected result is unauthorized and test succeeds that an OverPermission is raised.\"\n\nL457 just has \"pass\" there, meaning that the pseudo-RBAC test we\u0027re testing here (yes, a unit test testing a fake RBAC test) just \"passes\" -- i.e. succeeds. However, if you look at L470-472, you\u0027ll notice that for each combination there is one False -- meaning that altogether the EXPECTED result is False.\n\nHowever, as stated above, the ACTUAL result is True (due to the pass). Hence it throws an OverPermission.","commit_id":"cb6acb6eeaab0a35cde08fac96c24a4629982400"},{"author":{"_account_id":22636,"name":"Cliff Parsons","email":"cliffhparsons@aol.com","username":"cliffparsons"},"change_message_id":"b6c1c20a5c22cbb685faac7503de0a2053d9f8bc","unresolved":false,"context_lines":[{"line_number":414,"context_line":"            \"Allowed\")"},{"line_number":415,"context_line":""},{"line_number":416,"context_line":""},{"line_number":417,"context_line":"class RBACRuleValidationTestMultiPolicy(BaseRBACRuleValidationTest):"},{"line_number":418,"context_line":"    \"\"\"Test suite for validating multi-policy support for the"},{"line_number":419,"context_line":"    ``rbac_rule_validation`` decorator."},{"line_number":420,"context_line":"    \"\"\""}],"source_content_type":"text/x-python","patch_set":10,"id":"5f7c97a3_8d2f3087","line":417,"range":{"start_line":417,"start_character":0,"end_line":417,"end_character":68},"updated":"2018-06-07 15:52:25.000000000","message":"I think a test case is needed for verifying the case where the user expects a different error code than 403 (404 instead).  Also, would like to see how this change in the framework would handle a different error being thrown by the service for different roles, depending on the validation of a second rule.  For example, if you have two rules, update_action, and get_action. When the update_action is executed, the service returns 403 for the roles that are allowed to execute the get_action, and returns 404 for the roles that are not allowed to execute the get_action. A service (like Neutron) might do this to disguise the existence of data that it manages.","commit_id":"44d77848b5e1be53072281f77e6324cde15c3caa"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"ca39dd56b9e6de5a96a7fd83c4c9640a19389607","unresolved":false,"context_lines":[{"line_number":414,"context_line":"            \"Allowed\")"},{"line_number":415,"context_line":""},{"line_number":416,"context_line":""},{"line_number":417,"context_line":"class RBACRuleValidationTestMultiPolicy(BaseRBACRuleValidationTest):"},{"line_number":418,"context_line":"    \"\"\"Test suite for validating multi-policy support for the"},{"line_number":419,"context_line":"    ``rbac_rule_validation`` decorator."},{"line_number":420,"context_line":"    \"\"\""}],"source_content_type":"text/x-python","patch_set":10,"id":"5f7c97a3_8de09028","line":417,"range":{"start_line":417,"start_character":0,"end_line":417,"end_character":68},"in_reply_to":"5f7c97a3_8d2f3087","updated":"2018-06-07 16:00:53.000000000","message":"There\u0027s no capability to do that currently. That would require further building upon this to achieve that end goal. The general idea would be to include the list of policy actions enforced by the cloud in order (in your example, get_action followed by update_action). \n\nAfterward, Patrole would evaluate whether the user has permissions to perform get_action AND update_action. It could also keep track of get_action failing but update_action passing. It\u0027s only a small step thereafter to make it know to fail with a 404 for the get_action but fail with a 403 for the update_action.\n\nThe error code evaluation could be implemented myriad ways, but I think it\u0027s important to consider multi-policy enforcement with respect to determining whether an API that enforces multiple policies raises either a 403 or 404.\n\nIt just doesn\u0027t currently make sense why some API endpoints return a 404 versus a 403 without this consideration. It feels entirely arbitrary right now.","commit_id":"44d77848b5e1be53072281f77e6324cde15c3caa"}]}