)]}'
{"patrole_tempest_plugin/tests/api/network/test_routers_rbac.py":[{"author":{"_account_id":23140,"name":"Jess Egler","email":"jess.egler@gmail.com","username":"jessegler"},"change_message_id":"496fa892966cc32b15d50ac5a2034dae929e4ad1","unresolved":false,"context_lines":[{"line_number":415,"context_line":"        \"\"\""},{"line_number":416,"context_line":"        with self.rbac_utils.override_role(self):"},{"line_number":417,"context_line":"            routers \u003d self.routers_client.list_routers(id\u003dself.router[\u0027id\u0027])"},{"line_number":418,"context_line":"            # routers should be empty"},{"line_number":419,"context_line":"            if not routers[\u0027routers\u0027]:"},{"line_number":420,"context_line":"                raise rbac_exceptions.RbacMalformedResponse(empty\u003dTrue)"}],"source_content_type":"text/x-python","patch_set":8,"id":"3f79a3b5_5a55cec0","line":418,"updated":"2018-09-20 23:56:41.000000000","message":"List routers will return an empty list when their are no routers or when the user doesn\u0027t have permission to view the router. We need to make sure that we\u0027re covering the second case, so I don\u0027t think we can just check for an empty list of routers.\n\nI\u0027ve got a patchset that covers a list:\nhttps://review.openstack.org/#/c/597216/3/patrole_tempest_plugin/tests/api/network/test_flavors_rbac.py\n\nAnd so does Mykola:\nhttps://review.openstack.org/#/c/600257/9/patrole_tempest_plugin/tests/api/network/test_networks_rbac.py\n\nYou might take a look a those.","commit_id":"e6ec14df157de0ddba520540bb41a7f26e021bc6"},{"author":{"_account_id":8911,"name":"Sergey Vilgelm","email":"sergey@vilgelm.info","username":"sergey.vilgelm"},"change_message_id":"8917201471beb003eb70c530c1f34e611ec10cac","unresolved":false,"context_lines":[{"line_number":415,"context_line":"        \"\"\""},{"line_number":416,"context_line":"        with self.rbac_utils.override_role(self):"},{"line_number":417,"context_line":"            routers \u003d self.routers_client.list_routers(id\u003dself.router[\u0027id\u0027])"},{"line_number":418,"context_line":"            # routers should be empty"},{"line_number":419,"context_line":"            if not routers[\u0027routers\u0027]:"},{"line_number":420,"context_line":"                raise rbac_exceptions.RbacMalformedResponse(empty\u003dTrue)"}],"source_content_type":"text/x-python","patch_set":8,"id":"3f79a3b5_d05e9d11","line":418,"in_reply_to":"3f79a3b5_5a55cec0","updated":"2018-09-21 02:17:39.000000000","message":"In this case we don\u0027t need to compare the list of routers before and after. Router is created in `resource_setup` function, so we just need to check that admin will see the router (list is not empty) and member will not see the router (list is empty). This router is always present, otherwise the `test_show_router`, `test_update_router` , `test_update_router_external_gateway_info`, `test_update_router_external_gateway_info_network_id`, `test_update_router_enable_snat`,  `test_update_router_external_fixed_ips`, `test_update_high_availability_router` and `test_update_distributed_router` tests will fail.\n\nSo I think, in this case, we can check for the empty list, because we use filter. And if router is visible for the user then the list is not empty and if router is not visible for the user then the list is empty.","commit_id":"e6ec14df157de0ddba520540bb41a7f26e021bc6"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"cd2d359668bcdc780c2e55d5cd70528f0e232756","unresolved":false,"context_lines":[{"line_number":415,"context_line":"        \"\"\""},{"line_number":416,"context_line":"        with self.rbac_utils.override_role(self):"},{"line_number":417,"context_line":"            routers \u003d self.routers_client.list_routers(id\u003dself.router[\u0027id\u0027])"},{"line_number":418,"context_line":"            # routers should be empty"},{"line_number":419,"context_line":"            if not routers[\u0027routers\u0027]:"},{"line_number":420,"context_line":"                raise rbac_exceptions.RbacMalformedResponse(empty\u003dTrue)"}],"source_content_type":"text/x-python","patch_set":8,"id":"3f79a3b5_c737774b","line":418,"in_reply_to":"3f79a3b5_94be8bac","updated":"2018-09-25 20:52:00.000000000","message":"Actually the filter thing is a good idea that I didn\u0027t of to test list. If you create a router in the test using os_alt credentials then pass in that router via id\u003drouter[\u0027id\u0027] then it should return an empty list without permissions and exactly 1 router if you have permissions.\n\nUsing os_alt (alternative primary credentials) then RBAC role which is not admin should fail but admin role should pass, as I assume that admin can read routers across all tenants.","commit_id":"e6ec14df157de0ddba520540bb41a7f26e021bc6"},{"author":{"_account_id":8911,"name":"Sergey Vilgelm","email":"sergey@vilgelm.info","username":"sergey.vilgelm"},"change_message_id":"0b4b93212ec8251ce7170cf3130e5ac17192b30d","unresolved":false,"context_lines":[{"line_number":415,"context_line":"        \"\"\""},{"line_number":416,"context_line":"        with self.rbac_utils.override_role(self):"},{"line_number":417,"context_line":"            routers \u003d self.routers_client.list_routers(id\u003dself.router[\u0027id\u0027])"},{"line_number":418,"context_line":"            # routers should be empty"},{"line_number":419,"context_line":"            if not routers[\u0027routers\u0027]:"},{"line_number":420,"context_line":"                raise rbac_exceptions.RbacMalformedResponse(empty\u003dTrue)"}],"source_content_type":"text/x-python","patch_set":8,"id":"3f79a3b5_401b4d7f","line":418,"in_reply_to":"3f79a3b5_c737774b","updated":"2018-09-26 00:10:13.000000000","message":"Jess, Felipe,\nI use the router created by `resource_setup` L48. This test works totally same like test_show_router, so if I need to use os_alt, then show_router test and probably other are wrong, and we need to fix them.","commit_id":"e6ec14df157de0ddba520540bb41a7f26e021bc6"},{"author":{"_account_id":23140,"name":"Jess Egler","email":"jess.egler@gmail.com","username":"jessegler"},"change_message_id":"7f1ef1121bad5b78a6aca5a0003b7b89bee3728a","unresolved":false,"context_lines":[{"line_number":415,"context_line":"        \"\"\""},{"line_number":416,"context_line":"        with self.rbac_utils.override_role(self):"},{"line_number":417,"context_line":"            routers \u003d self.routers_client.list_routers(id\u003dself.router[\u0027id\u0027])"},{"line_number":418,"context_line":"            # routers should be empty"},{"line_number":419,"context_line":"            if not routers[\u0027routers\u0027]:"},{"line_number":420,"context_line":"                raise rbac_exceptions.RbacMalformedResponse(empty\u003dTrue)"}],"source_content_type":"text/x-python","patch_set":8,"id":"3f79a3b5_94be8bac","line":418,"in_reply_to":"3f79a3b5_d05e9d11","updated":"2018-09-25 20:33:21.000000000","message":"But we should be able to see routers that we (as a user) own, so we should check for that. I also don\u0027t think that we\u0027re guaranteed to not have routers that already exist in the cloud. I think it\u0027s a valid usecase for patrole to be run against existing clouds which may or may not already have routers.","commit_id":"e6ec14df157de0ddba520540bb41a7f26e021bc6"}]}