)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"8ba568b9735aea56311e50043cc2db1c48a5f407","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Chi Lo \u003ccl566n@att.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2018-06-01 16:28:04 -0500"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Updated RBac test cases for update/delete volume image metadata"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Add logic to check for \u0027volume_image_metadata\u0027 attribute in the response as the"},{"line_number":10,"context_line":"server will still respond with 200 if the user does not have the permission to"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"5f7c97a3_224f5935","line":7,"range":{"start_line":7,"start_character":8,"end_line":7,"end_character":12},"updated":"2018-06-05 00:12:35.000000000","message":"RBAC","commit_id":"2f6db61b66d302a8057e101b24d4f40b5aa9cfd6"}],"patrole_tempest_plugin/tests/api/volume/test_volume_metadata_rbac.py":[{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"3deb6be3825f8cd0f93ac1c6e9330f9849993bdc","unresolved":false,"context_lines":[{"line_number":138,"context_line":"        rule\u003d\"volume_extension:volume_image_metadata\")"},{"line_number":139,"context_line":"    def test_update_volume_image_metadata(self):"},{"line_number":140,"context_line":"        with self.rbac_utils.override_role(self):"},{"line_number":141,"context_line":"            self.volumes_client.update_volume_image_metadata("},{"line_number":142,"context_line":"                self.volume[\u0027id\u0027], image_id\u003dself.image_id)"},{"line_number":143,"context_line":"        self.addCleanup(self.volumes_client.delete_volume_image_metadata,"},{"line_number":144,"context_line":"                        self.volume[\u0027id\u0027], \u0027image_id\u0027)"}],"source_content_type":"text/x-python","patch_set":1,"id":"5f7c97a3_b24f4069","line":141,"updated":"2018-06-04 17:51:49.000000000","message":"This should raise an exception if it fails: https://github.com/openstack/cinder/blob/5d4dfebb7ffb77984798b3fabeaf7c82371915dd/cinder/api/contrib/volume_image_metadata.py#L93\n\ncontext.authorize() automatically throws an exception following policy failure except when fatal\u003dFalse (which it isn\u0027t in this case).","commit_id":"2f6db61b66d302a8057e101b24d4f40b5aa9cfd6"},{"author":{"_account_id":19391,"name":"Chi Lo","email":"cl566n@att.com","username":"cl566n"},"change_message_id":"558d6cfad7257a9c05bdcaac65cae303087c41d1","unresolved":false,"context_lines":[{"line_number":138,"context_line":"        rule\u003d\"volume_extension:volume_image_metadata\")"},{"line_number":139,"context_line":"    def test_update_volume_image_metadata(self):"},{"line_number":140,"context_line":"        with self.rbac_utils.override_role(self):"},{"line_number":141,"context_line":"            self.volumes_client.update_volume_image_metadata("},{"line_number":142,"context_line":"                self.volume[\u0027id\u0027], image_id\u003dself.image_id)"},{"line_number":143,"context_line":"        self.addCleanup(self.volumes_client.delete_volume_image_metadata,"},{"line_number":144,"context_line":"                        self.volume[\u0027id\u0027], \u0027image_id\u0027)"}],"source_content_type":"text/x-python","patch_set":1,"id":"5f7c97a3_b43fd5b3","line":141,"in_reply_to":"5f7c97a3_b24f4069","updated":"2018-06-07 19:29:50.000000000","message":"Changing the create() function in Ocata cinder/api/contrib/volume_image_metadata.py module does not work.  A 200 response with an empty body still happening. The test is done as admin role.","commit_id":"2f6db61b66d302a8057e101b24d4f40b5aa9cfd6"},{"author":{"_account_id":19391,"name":"Chi Lo","email":"cl566n@att.com","username":"cl566n"},"change_message_id":"2f8fcd2c68041a6e7791039bc35ee767fe3e362f","unresolved":false,"context_lines":[{"line_number":138,"context_line":"        rule\u003d\"volume_extension:volume_image_metadata\")"},{"line_number":139,"context_line":"    def test_update_volume_image_metadata(self):"},{"line_number":140,"context_line":"        with self.rbac_utils.override_role(self):"},{"line_number":141,"context_line":"            self.volumes_client.update_volume_image_metadata("},{"line_number":142,"context_line":"                self.volume[\u0027id\u0027], image_id\u003dself.image_id)"},{"line_number":143,"context_line":"        self.addCleanup(self.volumes_client.delete_volume_image_metadata,"},{"line_number":144,"context_line":"                        self.volume[\u0027id\u0027], \u0027image_id\u0027)"}],"source_content_type":"text/x-python","patch_set":1,"id":"5f7c97a3_cf38b83c","line":141,"in_reply_to":"5f7c97a3_b43fd5b3","updated":"2018-06-07 20:24:26.000000000","message":"To sum up, with the change of create() function to use hard authorize, the following is observed:\n1) roles that have permission to perform the update action, a 200 response with an empty body will be received. However, the client code will proceed to load the empty body. Subsequently a ValueError(\"No JSON object could be decoded\") exception is raised.\n\n2) roles that do not have permission to perform the update action, a correct 403 Forbidden response will be received.","commit_id":"2f6db61b66d302a8057e101b24d4f40b5aa9cfd6"},{"author":{"_account_id":19391,"name":"Chi Lo","email":"cl566n@att.com","username":"cl566n"},"change_message_id":"bd9c3ed80a7db32ab6410b261fae45d6c378e77c","unresolved":false,"context_lines":[{"line_number":138,"context_line":"        rule\u003d\"volume_extension:volume_image_metadata\")"},{"line_number":139,"context_line":"    def test_update_volume_image_metadata(self):"},{"line_number":140,"context_line":"        with self.rbac_utils.override_role(self):"},{"line_number":141,"context_line":"            self.volumes_client.update_volume_image_metadata("},{"line_number":142,"context_line":"                self.volume[\u0027id\u0027], image_id\u003dself.image_id)"},{"line_number":143,"context_line":"        self.addCleanup(self.volumes_client.delete_volume_image_metadata,"},{"line_number":144,"context_line":"                        self.volume[\u0027id\u0027], \u0027image_id\u0027)"}],"source_content_type":"text/x-python","patch_set":1,"id":"5f7c97a3_f91e8f6e","line":141,"in_reply_to":"5f7c97a3_cf38b83c","updated":"2018-06-08 17:42:32.000000000","message":"If soft authorize is used as in current case, a 200 response will come back for any role.  Roles that have permission to perform action will have a valid metadata body.  Roles that does not have permission will have an empty body.","commit_id":"2f6db61b66d302a8057e101b24d4f40b5aa9cfd6"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"3deb6be3825f8cd0f93ac1c6e9330f9849993bdc","unresolved":false,"context_lines":[{"line_number":162,"context_line":"                        self.volume[\u0027id\u0027], \u0027image_id\u0027)"},{"line_number":163,"context_line":""},{"line_number":164,"context_line":"        with self.rbac_utils.override_role(self):"},{"line_number":165,"context_line":"            self.volumes_client.delete_volume_image_metadata(self.volume[\u0027id\u0027],"},{"line_number":166,"context_line":"                                                             \u0027image_id\u0027)"},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"        resp_body \u003d self.volumes_client.show_volume(self.volume[\u0027id\u0027])["}],"source_content_type":"text/x-python","patch_set":1,"id":"5f7c97a3_5254acfe","line":165,"updated":"2018-06-04 17:51:49.000000000","message":"This should raise an exception if it fails: https://github.com/openstack/cinder/blob/5d4dfebb7ffb77984798b3fabeaf7c82371915dd/cinder/api/contrib/volume_image_metadata.py#L135\n\ncontext.authorize() automatically throws an exception following policy failure except when fatal\u003dFalse (which it isn\u0027t in this case).","commit_id":"2f6db61b66d302a8057e101b24d4f40b5aa9cfd6"},{"author":{"_account_id":19391,"name":"Chi Lo","email":"cl566n@att.com","username":"cl566n"},"change_message_id":"558d6cfad7257a9c05bdcaac65cae303087c41d1","unresolved":false,"context_lines":[{"line_number":162,"context_line":"                        self.volume[\u0027id\u0027], \u0027image_id\u0027)"},{"line_number":163,"context_line":""},{"line_number":164,"context_line":"        with self.rbac_utils.override_role(self):"},{"line_number":165,"context_line":"            self.volumes_client.delete_volume_image_metadata(self.volume[\u0027id\u0027],"},{"line_number":166,"context_line":"                                                             \u0027image_id\u0027)"},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"        resp_body \u003d self.volumes_client.show_volume(self.volume[\u0027id\u0027])["}],"source_content_type":"text/x-python","patch_set":1,"id":"5f7c97a3_7947f6bd","line":165,"in_reply_to":"5f7c97a3_5254acfe","updated":"2018-06-07 19:29:50.000000000","message":"Changing the delete() function in Ocata cinder/api/contrib/volume_image_metadata.py module to hard authorize will work for all roles; however, the create() function in the same module cannot be changed to use hard authorize. Otherwise the call to update_volume_image_metadata in L158 will return with a 500 ServerFault.","commit_id":"2f6db61b66d302a8057e101b24d4f40b5aa9cfd6"},{"author":{"_account_id":19391,"name":"Chi Lo","email":"cl566n@att.com","username":"cl566n"},"change_message_id":"bd9c3ed80a7db32ab6410b261fae45d6c378e77c","unresolved":false,"context_lines":[{"line_number":162,"context_line":"                        self.volume[\u0027id\u0027], \u0027image_id\u0027)"},{"line_number":163,"context_line":""},{"line_number":164,"context_line":"        with self.rbac_utils.override_role(self):"},{"line_number":165,"context_line":"            self.volumes_client.delete_volume_image_metadata(self.volume[\u0027id\u0027],"},{"line_number":166,"context_line":"                                                             \u0027image_id\u0027)"},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"        resp_body \u003d self.volumes_client.show_volume(self.volume[\u0027id\u0027])["}],"source_content_type":"text/x-python","patch_set":1,"id":"5f7c97a3_595f8340","line":165,"in_reply_to":"5f7c97a3_7947f6bd","updated":"2018-06-08 17:42:32.000000000","message":"Correction: Otherwise the call to update_volime_image_metadata in L158 will throw a ValueError(\"No JSON object could be decoded\") Exception since the 200 response does not have the body.","commit_id":"2f6db61b66d302a8057e101b24d4f40b5aa9cfd6"}]}