)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":17896,"name":"Rick Bartra","email":"rickbartra@microsoft.com","username":"rb560u"},"change_message_id":"472530a2edfe7c1e1ea22fdd77d885f1d2840736","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Felipe Monteiro \u003cfelipe.monteiro@att.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2018-07-31 20:10:05 -0400"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"docs: Add sections about context is admin/custom policy checks"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This documentation adds oslo.policy/policy related information"},{"line_number":10,"context_line":"to Patrole RBAC documentation so users understand some limitations"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"3f79a3b5_75870d11","line":7,"range":{"start_line":7,"start_character":25,"end_line":7,"end_character":41},"updated":"2018-08-08 19:40:56.000000000","message":"maybe it is better understood if it is written as \"context_is_admin\" as it is written that way in policy","commit_id":"a3f5865529fa7bcd7f2aa3ebe552590cc8cf9e04"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"686e3c03fe0fbee84aa5bdad6e0beb306c4877d0","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Felipe Monteiro \u003cfelipe.monteiro@att.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2018-07-31 20:10:05 -0400"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"docs: Add sections about context is admin/custom policy checks"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This documentation adds oslo.policy/policy related information"},{"line_number":10,"context_line":"to Patrole RBAC documentation so users understand some limitations"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"3f79a3b5_42da114c","line":7,"range":{"start_line":7,"start_character":25,"end_line":7,"end_character":41},"in_reply_to":"3f79a3b5_75870d11","updated":"2018-08-11 18:12:13.000000000","message":"Done","commit_id":"a3f5865529fa7bcd7f2aa3ebe552590cc8cf9e04"},{"author":{"_account_id":17896,"name":"Rick Bartra","email":"rickbartra@microsoft.com","username":"rb560u"},"change_message_id":"472530a2edfe7c1e1ea22fdd77d885f1d2840736","unresolved":false,"context_lines":[{"line_number":12,"context_line":"and some limitations around edge case policy testing w.r.t custom"},{"line_number":13,"context_line":"oslo.policy rulechecks."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"* Currently admin context policy rule is used to skip over oslo.policy"},{"line_number":16,"context_line":"  authorization checks in many services -- this is important to note"},{"line_number":17,"context_line":"  as this means Patrole can\u0027t properly validate admin against oslo.policy"},{"line_number":18,"context_line":"* Currently it is not possible to test policy rules that rely on"},{"line_number":19,"context_line":"  generic checks/oslo.policy checks defined in services themselves"},{"line_number":20,"context_line":"  like Neutron\u0027s FieldCheck [0] as Patrole has no way of importing such"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"3f79a3b5_15cc9968","line":17,"range":{"start_line":15,"start_character":0,"end_line":17,"end_character":73},"updated":"2018-08-08 19:40:56.000000000","message":"would be helpful to link to this example in Neutron:\nhttps://github.com/openstack/neutron/blob/master/neutron/policy.py#L374","commit_id":"a3f5865529fa7bcd7f2aa3ebe552590cc8cf9e04"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"686e3c03fe0fbee84aa5bdad6e0beb306c4877d0","unresolved":false,"context_lines":[{"line_number":12,"context_line":"and some limitations around edge case policy testing w.r.t custom"},{"line_number":13,"context_line":"oslo.policy rulechecks."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"* Currently admin context policy rule is used to skip over oslo.policy"},{"line_number":16,"context_line":"  authorization checks in many services -- this is important to note"},{"line_number":17,"context_line":"  as this means Patrole can\u0027t properly validate admin against oslo.policy"},{"line_number":18,"context_line":"* Currently it is not possible to test policy rules that rely on"},{"line_number":19,"context_line":"  generic checks/oslo.policy checks defined in services themselves"},{"line_number":20,"context_line":"  like Neutron\u0027s FieldCheck [0] as Patrole has no way of importing such"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"3f79a3b5_e2da3d49","line":17,"range":{"start_line":15,"start_character":0,"end_line":17,"end_character":73},"in_reply_to":"3f79a3b5_15cc9968","updated":"2018-08-11 18:12:13.000000000","message":"Done","commit_id":"a3f5865529fa7bcd7f2aa3ebe552590cc8cf9e04"}],"doc/source/rbac-overview.rst":[{"author":{"_account_id":17896,"name":"Rick Bartra","email":"rickbartra@microsoft.com","username":"rb560u"},"change_message_id":"472530a2edfe7c1e1ea22fdd77d885f1d2840736","unresolved":false,"context_lines":[{"line_number":169,"context_line":""},{"line_number":170,"context_line":"This type of behavior is currently present in many services. Thus, Patrole"},{"line_number":171,"context_line":"currently isn\u0027t really testing that admin role works from an ``oslo.policy``"},{"line_number":172,"context_line":"perspective for many services due to this behavior. Fortunately, when"},{"line_number":173,"context_line":"OpenStack services begin removing admin context checks from their code,"},{"line_number":174,"context_line":"then Patrole can be used to validate that admin role works correctly with"},{"line_number":175,"context_line":"``oslo.policy``."},{"line_number":176,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"3f79a3b5_d5daa115","line":173,"range":{"start_line":172,"start_character":52,"end_line":173,"end_character":71},"updated":"2018-08-08 19:40:56.000000000","message":"I don\u0027t know if this will ever be the case. In the case of Neutron, they didn\u0027t skip policy checks for \"context_is_admin\" in Kilo, but later on they added it - so it may be entirely intentional.","commit_id":"a3f5865529fa7bcd7f2aa3ebe552590cc8cf9e04"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"686e3c03fe0fbee84aa5bdad6e0beb306c4877d0","unresolved":false,"context_lines":[{"line_number":169,"context_line":""},{"line_number":170,"context_line":"This type of behavior is currently present in many services. Thus, Patrole"},{"line_number":171,"context_line":"currently isn\u0027t really testing that admin role works from an ``oslo.policy``"},{"line_number":172,"context_line":"perspective for many services due to this behavior. Fortunately, when"},{"line_number":173,"context_line":"OpenStack services begin removing admin context checks from their code,"},{"line_number":174,"context_line":"then Patrole can be used to validate that admin role works correctly with"},{"line_number":175,"context_line":"``oslo.policy``."},{"line_number":176,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"3f79a3b5_22d5951c","line":173,"range":{"start_line":172,"start_character":52,"end_line":173,"end_character":71},"in_reply_to":"3f79a3b5_d5daa115","updated":"2018-08-11 18:12:13.000000000","message":"Done","commit_id":"a3f5865529fa7bcd7f2aa3ebe552590cc8cf9e04"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"ec96653466b73a95b4925b734c301076ef374025","unresolved":false,"context_lines":[{"line_number":162,"context_line":"  def enforce(context, action, target, [...]):"},{"line_number":163,"context_line":"    # Here this condition, if True, skips over the enforce call below which"},{"line_number":164,"context_line":"    # is what calls oslo.policy."},{"line_number":165,"context_line":"    if context.is_admin:"},{"line_number":166,"context_line":"        return True"},{"line_number":167,"context_line":"    _ENFORCER.enforce([...])  # This is what can be skipped over."},{"line_number":168,"context_line":"    [...]"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f79a3b5_af6bc619","line":165,"range":{"start_line":165,"start_character":0,"end_line":165,"end_character":24},"updated":"2018-10-12 10:44:21.000000000","message":"we have one example of this check on nova also :)\n\n- https://review.openstack.org/#/c/608474/4/nova/objects/flavor.py@274","commit_id":"0170c998278da82d02ee7b8b1be05326f40e5025"}]}