)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"b5b48a56e4606d7b97d3c6b2082d174e25088698","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Fix OverPermission exception for keystone tests"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Extend the roles in `access_token` according to the implementation[0]"},{"line_number":10,"context_line":"of the bp basic-default-roles:"},{"line_number":11,"context_line":"    `admin` implies `member` implies `reader`"},{"line_number":12,"context_line":"Support deprecated_rule."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"[0] Ie18a269e3d1075d955fe494acaf634a393c6bd7b"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":16,"id":"9fdfeff1_db35d247","line":11,"range":{"start_line":9,"start_character":0,"end_line":11,"end_character":45},"updated":"2019-01-25 06:40:48.000000000","message":"let\u0027s separate these changes for other patch. In this patch we can just unblock the gate by keep testing the deprecated rule and slowly move to new roles/scope etc.","commit_id":"3dbecb31502c360c1d211bbd64b859a436c2b63f"}],"patrole_tempest_plugin/policy_authority.py":[{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"dec2937475222f10f9ab437b3f3eeadbe67d9dc4","unresolved":false,"context_lines":[{"line_number":247,"context_line":"    def _get_access_token(self, roles):"},{"line_number":248,"context_line":"        roles \u003d {r.lower() for r in roles if r}"},{"line_number":249,"context_line":""},{"line_number":250,"context_line":"        # Extend roles for an user with admin or member role"},{"line_number":251,"context_line":"        if \u0027admin\u0027 in roles:"},{"line_number":252,"context_line":"            roles.add(\u0027member\u0027)"},{"line_number":253,"context_line":"        if \u0027member\u0027 in roles:"},{"line_number":254,"context_line":"            roles.add(\u0027reader\u0027)"},{"line_number":255,"context_line":""},{"line_number":256,"context_line":"        access_token \u003d {"},{"line_number":257,"context_line":"            \"token\": {"}],"source_content_type":"text/x-python","patch_set":11,"id":"9fdfeff1_0f4d5c99","line":254,"range":{"start_line":250,"start_character":0,"end_line":254,"end_character":31},"updated":"2019-01-25 01:43:19.000000000","message":"I am little confused that why we need to add these extra roles. I am also testing locally with system scope only  but not completed yet.","commit_id":"a7c8cdc79e21058361c3df09cfe04b71e38829d3"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"e57a12806c58764858a3694c8d25a10556fab11f","unresolved":false,"context_lines":[{"line_number":247,"context_line":"    def _get_access_token(self, roles):"},{"line_number":248,"context_line":"        roles \u003d {r.lower() for r in roles if r}"},{"line_number":249,"context_line":""},{"line_number":250,"context_line":"        # Extend roles for an user with admin or member role"},{"line_number":251,"context_line":"        if \u0027admin\u0027 in roles:"},{"line_number":252,"context_line":"            roles.add(\u0027member\u0027)"},{"line_number":253,"context_line":"        if \u0027member\u0027 in roles:"},{"line_number":254,"context_line":"            roles.add(\u0027reader\u0027)"},{"line_number":255,"context_line":""},{"line_number":256,"context_line":"        access_token \u003d {"},{"line_number":257,"context_line":"            \"token\": {"}],"source_content_type":"text/x-python","patch_set":11,"id":"9fdfeff1_bb9ece51","line":254,"range":{"start_line":250,"start_character":0,"end_line":254,"end_character":31},"in_reply_to":"9fdfeff1_02645321","updated":"2019-01-25 06:35:44.000000000","message":"i see now. Along with system_scope addition, keystone has changed the role also for many API to reader, member, admin etc,\n\nfor example, list_domain role is changed from admin_required to reader - https://review.openstack.org/#/c/623334/2/keystone/common/policies/domain.py\n\nAdding \u0027member\u0027 for all admin and \u0027reader\u0027 fir all member will not solve the prob. Every role changed by keystone needs to be changed by patrole also. new role changed by keystone depends on API to API.\n\nAs long as keystone still support the deprecated roles, we should still use that role to verify the operation and slowly we change patrole tests to adopt the new role during the deprecation phase.","commit_id":"a7c8cdc79e21058361c3df09cfe04b71e38829d3"},{"author":{"_account_id":8911,"name":"Sergey Vilgelm","email":"sergey@vilgelm.info","username":"sergey.vilgelm"},"change_message_id":"153ae8c6e442231572c029b3a28e4fc3d32c332f","unresolved":false,"context_lines":[{"line_number":247,"context_line":"    def _get_access_token(self, roles):"},{"line_number":248,"context_line":"        roles \u003d {r.lower() for r in roles if r}"},{"line_number":249,"context_line":""},{"line_number":250,"context_line":"        # Extend roles for an user with admin or member role"},{"line_number":251,"context_line":"        if \u0027admin\u0027 in roles:"},{"line_number":252,"context_line":"            roles.add(\u0027member\u0027)"},{"line_number":253,"context_line":"        if \u0027member\u0027 in roles:"},{"line_number":254,"context_line":"            roles.add(\u0027reader\u0027)"},{"line_number":255,"context_line":""},{"line_number":256,"context_line":"        access_token \u003d {"},{"line_number":257,"context_line":"            \"token\": {"}],"source_content_type":"text/x-python","patch_set":11,"id":"9fdfeff1_02645321","line":254,"range":{"start_line":250,"start_character":0,"end_line":254,"end_character":31},"in_reply_to":"9fdfeff1_0f4d5c99","updated":"2019-01-25 03:15:11.000000000","message":"So, now the keystone creates an admin role which implies member and reader, and member role with reader. It means, that if an API has a rule like `role:reader` then a user with member role will be able to query that API. BUT the direct check will fail, because member !\u003d reader. So we need to check against all roles. Probably, there is a better way - we need to query https://developer.openstack.org/api-ref/identity/v3/?expanded\u003dlist-implied-inference-roles-for-role-detail#list-implied-inference-roles-for-role to get all roles","commit_id":"a7c8cdc79e21058361c3df09cfe04b71e38829d3"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"a0ca641d79c9e9260dc663024b72a6c76d319341","unresolved":false,"context_lines":[{"line_number":259,"context_line":"                \"project_id\": self.project_id,"},{"line_number":260,"context_line":"                \"tenant_id\": self.project_id,"},{"line_number":261,"context_line":"                \"user_id\": self.user_id,"},{"line_number":262,"context_line":"                \"system_scope\": \u0027all\u0027"},{"line_number":263,"context_line":"            }"},{"line_number":264,"context_line":"        }"},{"line_number":265,"context_line":"        return access_token"}],"source_content_type":"text/x-python","patch_set":11,"id":"9fdfeff1_4d63831b","line":262,"range":{"start_line":262,"start_character":17,"end_line":262,"end_character":29},"updated":"2019-01-24 03:01:37.000000000","message":"Tempest can\u0027t currently auth with system scope so this would be fixing up the expected result, but not sure if it would the actual.","commit_id":"a7c8cdc79e21058361c3df09cfe04b71e38829d3"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"dec2937475222f10f9ab437b3f3eeadbe67d9dc4","unresolved":false,"context_lines":[{"line_number":259,"context_line":"                \"project_id\": self.project_id,"},{"line_number":260,"context_line":"                \"tenant_id\": self.project_id,"},{"line_number":261,"context_line":"                \"user_id\": self.user_id,"},{"line_number":262,"context_line":"                \"system_scope\": \u0027all\u0027"},{"line_number":263,"context_line":"            }"},{"line_number":264,"context_line":"        }"},{"line_number":265,"context_line":"        return access_token"}],"source_content_type":"text/x-python","patch_set":11,"id":"9fdfeff1_8f770cd5","line":262,"range":{"start_line":262,"start_character":17,"end_line":262,"end_character":29},"in_reply_to":"9fdfeff1_4d63831b","updated":"2019-01-25 01:43:19.000000000","message":"but this is what oslo.policy verify right?  here we are using this access_token to verify the role access directly via oslo.policy @L314.","commit_id":"a7c8cdc79e21058361c3df09cfe04b71e38829d3"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"e57a12806c58764858a3694c8d25a10556fab11f","unresolved":false,"context_lines":[{"line_number":259,"context_line":"                \"project_id\": self.project_id,"},{"line_number":260,"context_line":"                \"tenant_id\": self.project_id,"},{"line_number":261,"context_line":"                \"user_id\": self.user_id,"},{"line_number":262,"context_line":"                \"system_scope\": \u0027all\u0027"},{"line_number":263,"context_line":"            }"},{"line_number":264,"context_line":"        }"},{"line_number":265,"context_line":"        return access_token"}],"source_content_type":"text/x-python","patch_set":11,"id":"9fdfeff1_bbc7ae45","line":262,"range":{"start_line":262,"start_character":17,"end_line":262,"end_character":29},"in_reply_to":"9fdfeff1_65e20932","updated":"2019-01-25 06:35:44.000000000","message":"+1 on this approach of keep testing the deprecated rule (which is nothing but without system scope) and slowly change to new scope.","commit_id":"a7c8cdc79e21058361c3df09cfe04b71e38829d3"},{"author":{"_account_id":8911,"name":"Sergey Vilgelm","email":"sergey@vilgelm.info","username":"sergey.vilgelm"},"change_message_id":"153ae8c6e442231572c029b3a28e4fc3d32c332f","unresolved":false,"context_lines":[{"line_number":259,"context_line":"                \"project_id\": self.project_id,"},{"line_number":260,"context_line":"                \"tenant_id\": self.project_id,"},{"line_number":261,"context_line":"                \"user_id\": self.user_id,"},{"line_number":262,"context_line":"                \"system_scope\": \u0027all\u0027"},{"line_number":263,"context_line":"            }"},{"line_number":264,"context_line":"        }"},{"line_number":265,"context_line":"        return access_token"}],"source_content_type":"text/x-python","patch_set":11,"id":"9fdfeff1_65e20932","line":262,"range":{"start_line":262,"start_character":17,"end_line":262,"end_character":29},"in_reply_to":"9fdfeff1_8f770cd5","updated":"2019-01-25 03:15:11.000000000","message":"Yes, but now I really don\u0027t understand how to use scopes correctly, with my latest changes the gate should be unblocked and we can spend more time to figure out how it should be.\nI removed system_scope. So all checks for rules with system_scope will fail, but because I added support for deprecated rules the checks will pass. I mean we will have a time to work on system_scope","commit_id":"a7c8cdc79e21058361c3df09cfe04b71e38829d3"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"36604915cce0bfdb047788c0dd473ec009de2aa6","unresolved":false,"context_lines":[{"line_number":208,"context_line":"            if self.service in policy_generator:"},{"line_number":209,"context_line":"                for rule in policy_generator[self.service]:"},{"line_number":210,"context_line":"                    if rule.name not in rules:"},{"line_number":211,"context_line":"                        if rule.deprecated_rule:"},{"line_number":212,"context_line":"                            rule \u003d self._handle_deprecated_rule(rule)"},{"line_number":213,"context_line":"                        rules[rule.name] \u003d rule.check"},{"line_number":214,"context_line":"                    elif str(rule.check) !\u003d str(rules[rule.name]):"}],"source_content_type":"text/x-python","patch_set":16,"id":"9fdfeff1_3b189ed1","line":211,"range":{"start_line":211,"start_character":0,"end_line":211,"end_character":48},"updated":"2019-01-25 06:41:59.000000000","message":"when we will fix test to start using the new roles/scope then we need some flag from test side to tell here that we do not need to go with deprecated rule check here. But that can be done when migrating to new roles.","commit_id":"3dbecb31502c360c1d211bbd64b859a436c2b63f"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"b5b48a56e4606d7b97d3c6b2082d174e25088698","unresolved":false,"context_lines":[{"line_number":207,"context_line":"            policy_generator \u003d {plc.name: plc.obj for plc in mgr}"},{"line_number":208,"context_line":"            if self.service in policy_generator:"},{"line_number":209,"context_line":"                for rule in policy_generator[self.service]:"},{"line_number":210,"context_line":"                    if rule.name not in rules:"},{"line_number":211,"context_line":"                        if rule.deprecated_rule:"},{"line_number":212,"context_line":"                            rule \u003d self._handle_deprecated_rule(rule)"},{"line_number":213,"context_line":"                        rules[rule.name] \u003d rule.check"},{"line_number":214,"context_line":"                    elif str(rule.check) !\u003d str(rules[rule.name]):"},{"line_number":215,"context_line":"                        msg \u003d (\"The same policy name: %s was found in the \""}],"source_content_type":"text/x-python","patch_set":16,"id":"9fdfeff1_5bf48286","line":212,"range":{"start_line":210,"start_character":0,"end_line":212,"end_character":69},"updated":"2019-01-25 06:40:48.000000000","message":"only this code can fix the gate now. Other changes can be done separately.","commit_id":"3dbecb31502c360c1d211bbd64b859a436c2b63f"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"7b352e421e3c07077cdf2043d50d943cfa6ac4b0","unresolved":false,"context_lines":[{"line_number":207,"context_line":"            policy_generator \u003d {plc.name: plc.obj for plc in mgr}"},{"line_number":208,"context_line":"            if self.service in policy_generator:"},{"line_number":209,"context_line":"                for rule in policy_generator[self.service]:"},{"line_number":210,"context_line":"                    if rule.name not in rules:"},{"line_number":211,"context_line":"                        if rule.deprecated_rule:"},{"line_number":212,"context_line":"                            rule \u003d self._handle_deprecated_rule(rule)"},{"line_number":213,"context_line":"                        rules[rule.name] \u003d rule.check"},{"line_number":214,"context_line":"                    elif str(rule.check) !\u003d str(rules[rule.name]):"},{"line_number":215,"context_line":"                        msg \u003d (\"The same policy name: %s was found in the \""}],"source_content_type":"text/x-python","patch_set":16,"id":"9fdfeff1_5e8d34d1","line":212,"range":{"start_line":210,"start_character":0,"end_line":212,"end_character":69},"in_reply_to":"9fdfeff1_0b2d30fd","updated":"2019-01-28 07:43:21.000000000","message":"I got it now, keystone gives access of \u0027reader\u0027 to all \u0027member\u0027 like [1].\n\nI also see your followup patch to do proper implied role things  - https://review.openstack.org/#/c/633255\n\n\n[1] https://github.com/openstack/keystone/blob/f1697d06d23809ac91558b798fa730997ed36d03/keystone/cmd/bootstrap.py#L152","commit_id":"3dbecb31502c360c1d211bbd64b859a436c2b63f"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"43ae03874ef69ba74a23d0c77d4ef722be0c0784","unresolved":false,"context_lines":[{"line_number":207,"context_line":"            policy_generator \u003d {plc.name: plc.obj for plc in mgr}"},{"line_number":208,"context_line":"            if self.service in policy_generator:"},{"line_number":209,"context_line":"                for rule in policy_generator[self.service]:"},{"line_number":210,"context_line":"                    if rule.name not in rules:"},{"line_number":211,"context_line":"                        if rule.deprecated_rule:"},{"line_number":212,"context_line":"                            rule \u003d self._handle_deprecated_rule(rule)"},{"line_number":213,"context_line":"                        rules[rule.name] \u003d rule.check"},{"line_number":214,"context_line":"                    elif str(rule.check) !\u003d str(rules[rule.name]):"},{"line_number":215,"context_line":"                        msg \u003d (\"The same policy name: %s was found in the \""}],"source_content_type":"text/x-python","patch_set":16,"id":"9fdfeff1_0b2d30fd","line":212,"range":{"start_line":210,"start_character":0,"end_line":212,"end_character":69},"in_reply_to":"9fdfeff1_4fc5975a","updated":"2019-01-28 04:59:19.000000000","message":"humm, keystone added new roles with deprecation of old roles. That is very much needed from user perspective so that changes does not break upgrade. Old roles/system_scope things should work for deprecation phase. And that is what patrole make sure which means adding the suport of deprecated rules should work for these APIs. \n\n- https://review.openstack.org/#/c/622524/1/keystone/common/policies/role.py","commit_id":"3dbecb31502c360c1d211bbd64b859a436c2b63f"},{"author":{"_account_id":8911,"name":"Sergey Vilgelm","email":"sergey@vilgelm.info","username":"sergey.vilgelm"},"change_message_id":"3d5c71c4ad77098522642653715ec1b61e6b4464","unresolved":false,"context_lines":[{"line_number":207,"context_line":"            policy_generator \u003d {plc.name: plc.obj for plc in mgr}"},{"line_number":208,"context_line":"            if self.service in policy_generator:"},{"line_number":209,"context_line":"                for rule in policy_generator[self.service]:"},{"line_number":210,"context_line":"                    if rule.name not in rules:"},{"line_number":211,"context_line":"                        if rule.deprecated_rule:"},{"line_number":212,"context_line":"                            rule \u003d self._handle_deprecated_rule(rule)"},{"line_number":213,"context_line":"                        rules[rule.name] \u003d rule.check"},{"line_number":214,"context_line":"                    elif str(rule.check) !\u003d str(rules[rule.name]):"},{"line_number":215,"context_line":"                        msg \u003d (\"The same policy name: %s was found in the \""}],"source_content_type":"text/x-python","patch_set":16,"id":"9fdfeff1_4fc5975a","line":212,"range":{"start_line":210,"start_character":0,"end_line":212,"end_character":69},"in_reply_to":"9fdfeff1_5bf48286","updated":"2019-01-25 15:51:52.000000000","message":"Unfortunately, not only this code.We need to extend the roles. Here is my attempt with deprecated rules only: https://review.openstack.org/#/c/633023/\nThere are another changes, for example: https://github.com/openstack/keystone/commit/567f305b41414f1468147e5eba903871bfbe7392\nThis commit replace rule for list_roles from admin only to reader. So keystone allows to get roles for member, but again, the Patrole fails, because reader !\u003d member.\n\nSo, let\u0027s merge this patch to unblock gate and I will provide a follow up commit with proper implementation of role interferences.","commit_id":"3dbecb31502c360c1d211bbd64b859a436c2b63f"},{"author":{"_account_id":8911,"name":"Sergey Vilgelm","email":"sergey@vilgelm.info","username":"sergey.vilgelm"},"change_message_id":"d7318547393c53322aa0641706eb707c3a51fc09","unresolved":false,"context_lines":[{"line_number":207,"context_line":"            policy_generator \u003d {plc.name: plc.obj for plc in mgr}"},{"line_number":208,"context_line":"            if self.service in policy_generator:"},{"line_number":209,"context_line":"                for rule in policy_generator[self.service]:"},{"line_number":210,"context_line":"                    if rule.name not in rules:"},{"line_number":211,"context_line":"                        if rule.deprecated_rule:"},{"line_number":212,"context_line":"                            rule \u003d self._handle_deprecated_rule(rule)"},{"line_number":213,"context_line":"                        rules[rule.name] \u003d rule.check"},{"line_number":214,"context_line":"                    elif str(rule.check) !\u003d str(rules[rule.name]):"},{"line_number":215,"context_line":"                        msg \u003d (\"The same policy name: %s was found in the \""}],"source_content_type":"text/x-python","patch_set":16,"id":"9fdfeff1_d17cb220","line":212,"range":{"start_line":210,"start_character":0,"end_line":212,"end_character":69},"in_reply_to":"9fdfeff1_5e8d34d1","updated":"2019-01-28 13:46:06.000000000","message":"yeah, we need to extend roles","commit_id":"3dbecb31502c360c1d211bbd64b859a436c2b63f"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"863d0a9a29eef40dbac7407ec10af2a0f8b24e07","unresolved":false,"context_lines":[{"line_number":247,"context_line":"    def _get_access_token(self, roles):"},{"line_number":248,"context_line":"        roles \u003d {r.lower() for r in roles if r}"},{"line_number":249,"context_line":""},{"line_number":250,"context_line":"        # Extend roles for an user with admin or member role"},{"line_number":251,"context_line":"        if \u0027admin\u0027 in roles:"},{"line_number":252,"context_line":"            roles.add(\u0027member\u0027)"},{"line_number":253,"context_line":"        if \u0027member\u0027 in roles:"},{"line_number":254,"context_line":"            roles.add(\u0027reader\u0027)"},{"line_number":255,"context_line":""},{"line_number":256,"context_line":"        access_token \u003d {"},{"line_number":257,"context_line":"            \"token\": {"}],"source_content_type":"text/x-python","patch_set":17,"id":"9fdfeff1_3e3162ed","line":254,"range":{"start_line":250,"start_character":0,"end_line":254,"end_character":31},"updated":"2019-01-25 23:54:11.000000000","message":"Just making sure, but this is technically a hack since this role inference mapping is not universally true; it\u0027s just true in Keystone for now.","commit_id":"895bb71ffa5e8f5276e632a2358530525bc98471"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"863d0a9a29eef40dbac7407ec10af2a0f8b24e07","unresolved":false,"context_lines":[{"line_number":171,"context_line":""},{"line_number":172,"context_line":"    def _handle_deprecated_rule(self, rule):"},{"line_number":173,"context_line":"        check_str \u003d \u0027(%s) or (%s)\u0027 % (rule.check_str,"},{"line_number":174,"context_line":"                                      rule.deprecated_rule.check_str)"},{"line_number":175,"context_line":"        return policy.RuleDefault(rule.name, check_str)"},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"    def get_rules(self):"}],"source_content_type":"text/x-python","patch_set":18,"id":"9fdfeff1_8dab8287","line":174,"range":{"start_line":174,"start_character":37,"end_line":174,"end_character":68},"updated":"2019-01-25 23:54:11.000000000","message":"This is a clever way of temporarily fixing gates but I think we should log something here (like a LOG.warn) as it\u0027s passing for the deprecated rule, not the current rule.","commit_id":"4b7ef1af5bc251d1599d7bce06a04ce7fd09aa7a"},{"author":{"_account_id":8911,"name":"Sergey Vilgelm","email":"sergey@vilgelm.info","username":"sergey.vilgelm"},"change_message_id":"c56900b1739ff93bc7e397d625b6f3ff6cff6a86","unresolved":false,"context_lines":[{"line_number":171,"context_line":""},{"line_number":172,"context_line":"    def _handle_deprecated_rule(self, rule):"},{"line_number":173,"context_line":"        check_str \u003d \u0027(%s) or (%s)\u0027 % (rule.check_str,"},{"line_number":174,"context_line":"                                      rule.deprecated_rule.check_str)"},{"line_number":175,"context_line":"        return policy.RuleDefault(rule.name, check_str)"},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"    def get_rules(self):"}],"source_content_type":"text/x-python","patch_set":18,"id":"9fdfeff1_8d006269","line":174,"range":{"start_line":174,"start_character":37,"end_line":174,"end_character":68},"in_reply_to":"9fdfeff1_8dab8287","updated":"2019-01-26 00:06:56.000000000","message":"The oslo.policy will emit such messages and we will see them in openstack logs. But I can add similar log messages here.","commit_id":"4b7ef1af5bc251d1599d7bce06a04ce7fd09aa7a"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"863d0a9a29eef40dbac7407ec10af2a0f8b24e07","unresolved":false,"context_lines":[{"line_number":250,"context_line":"        roles \u003d {r.lower() for r in roles if r}"},{"line_number":251,"context_line":""},{"line_number":252,"context_line":"        # Extend roles for an user with admin or member role"},{"line_number":253,"context_line":"        if \u0027admin\u0027 in roles:"},{"line_number":254,"context_line":"            roles.add(\u0027member\u0027)"},{"line_number":255,"context_line":"        if \u0027member\u0027 in roles:"},{"line_number":256,"context_line":"            roles.add(\u0027reader\u0027)"},{"line_number":257,"context_line":""},{"line_number":258,"context_line":"        access_token \u003d {"},{"line_number":259,"context_line":"            \"token\": {"}],"source_content_type":"text/x-python","patch_set":18,"id":"9fdfeff1_2dc5b65b","line":256,"range":{"start_line":253,"start_character":0,"end_line":256,"end_character":31},"updated":"2019-01-25 23:54:11.000000000","message":"I don\u0027t know if I commented on this elsewhere but this mapping is not universally a given; it is only true in Keystone. So, I think we should wrap this in a conditional check for Keystone service:\n\n    if self.service \u003d\u003d \u0027keystone\u0027:\n        ...\n\nAlthough this kind of thing is where inheritance comes into play quite nicely. Like subclassing PolicyAuthority to have a Keystone version that then does this role expansion and then using the right class of policy authority as needed, but this can be addressed separately IMO.","commit_id":"4b7ef1af5bc251d1599d7bce06a04ce7fd09aa7a"},{"author":{"_account_id":8911,"name":"Sergey Vilgelm","email":"sergey@vilgelm.info","username":"sergey.vilgelm"},"change_message_id":"c56900b1739ff93bc7e397d625b6f3ff6cff6a86","unresolved":false,"context_lines":[{"line_number":250,"context_line":"        roles \u003d {r.lower() for r in roles if r}"},{"line_number":251,"context_line":""},{"line_number":252,"context_line":"        # Extend roles for an user with admin or member role"},{"line_number":253,"context_line":"        if \u0027admin\u0027 in roles:"},{"line_number":254,"context_line":"            roles.add(\u0027member\u0027)"},{"line_number":255,"context_line":"        if \u0027member\u0027 in roles:"},{"line_number":256,"context_line":"            roles.add(\u0027reader\u0027)"},{"line_number":257,"context_line":""},{"line_number":258,"context_line":"        access_token \u003d {"},{"line_number":259,"context_line":"            \"token\": {"}],"source_content_type":"text/x-python","patch_set":18,"id":"9fdfeff1_ed2ecef8","line":256,"range":{"start_line":253,"start_character":0,"end_line":256,"end_character":31},"in_reply_to":"9fdfeff1_2dc5b65b","updated":"2019-01-26 00:06:56.000000000","message":"It\u0027s just a workaround to unblock the gate. I already prepared a patch set to do this right. See https://review.openstack.org/#/c/633255/","commit_id":"4b7ef1af5bc251d1599d7bce06a04ce7fd09aa7a"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"cf4c73211b9d9ac26b34652b9da8452406854031","unresolved":false,"context_lines":[{"line_number":250,"context_line":"        roles \u003d {r.lower() for r in roles if r}"},{"line_number":251,"context_line":""},{"line_number":252,"context_line":"        # Extend roles for an user with admin or member role"},{"line_number":253,"context_line":"        if \u0027admin\u0027 in roles:"},{"line_number":254,"context_line":"            roles.add(\u0027member\u0027)"},{"line_number":255,"context_line":"        if \u0027member\u0027 in roles:"},{"line_number":256,"context_line":"            roles.add(\u0027reader\u0027)"},{"line_number":257,"context_line":""},{"line_number":258,"context_line":"        access_token \u003d {"},{"line_number":259,"context_line":"            \"token\": {"}],"source_content_type":"text/x-python","patch_set":18,"id":"9fdfeff1_4b46d8c2","line":256,"range":{"start_line":253,"start_character":0,"end_line":256,"end_character":31},"in_reply_to":"9fdfeff1_ed2ecef8","updated":"2019-01-28 05:02:40.000000000","message":"may be it might be valid for nova when I will add the new role there but My question is, old roles etc should be supported till deprecation phase which is what keystone did in their changes while adding new roles.","commit_id":"4b7ef1af5bc251d1599d7bce06a04ce7fd09aa7a"}],"patrole_tempest_plugin/tests/unit/test_policy_authority.py":[{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"f166aaca859fa64c83b752c4f9883eb63f8ec294","unresolved":false,"context_lines":[{"line_number":277,"context_line":"            }"},{"line_number":278,"context_line":""},{"line_number":279,"context_line":"            expected_access_data \u003d {"},{"line_number":280,"context_line":"                \"roles\": sorted([\u0027member\u0027, \u0027reader\u0027]),"},{"line_number":281,"context_line":"                \"is_admin\": False,"},{"line_number":282,"context_line":"                \"is_admin_project\": True,"},{"line_number":283,"context_line":"                \"user_id\": mock.sentinel.user_id,"}],"source_content_type":"text/x-python","patch_set":20,"id":"9fdfeff1_ebb8ece5","line":280,"range":{"start_line":280,"start_character":24,"end_line":280,"end_character":32},"updated":"2019-01-28 04:20:43.000000000","message":"nit: already sorted, so not needed","commit_id":"c5f354fcbd525286b642e73283e1ba97027ef55d"},{"author":{"_account_id":8911,"name":"Sergey Vilgelm","email":"sergey@vilgelm.info","username":"sergey.vilgelm"},"change_message_id":"d7318547393c53322aa0641706eb707c3a51fc09","unresolved":false,"context_lines":[{"line_number":277,"context_line":"            }"},{"line_number":278,"context_line":""},{"line_number":279,"context_line":"            expected_access_data \u003d {"},{"line_number":280,"context_line":"                \"roles\": sorted([\u0027member\u0027, \u0027reader\u0027]),"},{"line_number":281,"context_line":"                \"is_admin\": False,"},{"line_number":282,"context_line":"                \"is_admin_project\": True,"},{"line_number":283,"context_line":"                \"user_id\": mock.sentinel.user_id,"}],"source_content_type":"text/x-python","patch_set":20,"id":"9fdfeff1_f196963e","line":280,"range":{"start_line":280,"start_character":24,"end_line":280,"end_character":32},"in_reply_to":"9fdfeff1_ebb8ece5","updated":"2019-01-28 13:46:06.000000000","message":"no, it\u0027s not sorted, it just converted from set to list and the order can be different in different pythons. py25 fails if I don\u0027t sort it","commit_id":"c5f354fcbd525286b642e73283e1ba97027ef55d"}],"releasenotes/notes/support-deprecated-roles-eae9dc742cb4fa33.yaml":[{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"f166aaca859fa64c83b752c4f9883eb63f8ec294","unresolved":false,"context_lines":[{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    Patrole will validate the deprecated policy rules (if applicable) alongside"},{"line_number":5,"context_line":"    the current policy rule."},{"line_number":6,"context_line":"    Add `validate_deprecated_rules` enabled by default to validate the"},{"line_number":7,"context_line":"    deprecated rules."}],"source_content_type":"text/x-yaml","patch_set":20,"id":"9fdfeff1_cba8888d","line":6,"updated":"2019-01-28 04:20:43.000000000","message":"nit: use double ticks; in sphinx single ticks renders as italics. Double ticks renders it as a keyword.","commit_id":"c5f354fcbd525286b642e73283e1ba97027ef55d"},{"author":{"_account_id":8911,"name":"Sergey Vilgelm","email":"sergey@vilgelm.info","username":"sergey.vilgelm"},"change_message_id":"d7318547393c53322aa0641706eb707c3a51fc09","unresolved":false,"context_lines":[{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    Patrole will validate the deprecated policy rules (if applicable) alongside"},{"line_number":5,"context_line":"    the current policy rule."},{"line_number":6,"context_line":"    Add `validate_deprecated_rules` enabled by default to validate the"},{"line_number":7,"context_line":"    deprecated rules."}],"source_content_type":"text/x-yaml","patch_set":20,"id":"9fdfeff1_f1a8d68c","line":6,"in_reply_to":"9fdfeff1_cba8888d","updated":"2019-01-28 13:46:06.000000000","message":"Done","commit_id":"c5f354fcbd525286b642e73283e1ba97027ef55d"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"e6866a056aa85a877a1e471a2fe54afd99a4f8ec","unresolved":false,"context_lines":[{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    Patrole will validate the deprecated policy rules (if applicable) alongside"},{"line_number":5,"context_line":"    the current policy rule."},{"line_number":6,"context_line":"    Add `validate_deprecated_rules` enabled by default to validate the"},{"line_number":7,"context_line":"    deprecated rules."}],"source_content_type":"text/x-yaml","patch_set":20,"id":"9fdfeff1_6bf87c48","line":7,"range":{"start_line":6,"start_character":0,"end_line":7,"end_character":21},"updated":"2019-01-28 05:26:34.000000000","message":"where we are using this config option ? or you are planning to use it in follow up patch.","commit_id":"c5f354fcbd525286b642e73283e1ba97027ef55d"},{"author":{"_account_id":8911,"name":"Sergey Vilgelm","email":"sergey@vilgelm.info","username":"sergey.vilgelm"},"change_message_id":"d7318547393c53322aa0641706eb707c3a51fc09","unresolved":false,"context_lines":[{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    Patrole will validate the deprecated policy rules (if applicable) alongside"},{"line_number":5,"context_line":"    the current policy rule."},{"line_number":6,"context_line":"    Add `validate_deprecated_rules` enabled by default to validate the"},{"line_number":7,"context_line":"    deprecated rules."}],"source_content_type":"text/x-yaml","patch_set":20,"id":"9fdfeff1_51a8c28b","line":7,"range":{"start_line":6,"start_character":0,"end_line":7,"end_character":21},"in_reply_to":"9fdfeff1_6bf87c48","updated":"2019-01-28 13:46:06.000000000","message":"Nice catch, i forgot :)","commit_id":"c5f354fcbd525286b642e73283e1ba97027ef55d"}]}