)]}'
{"id":"openstack%2Fpython-openstackclient~174908","triplet_id":"openstack%2Fpython-openstackclient~master~Id95a8520e935c1092d5a22ecd8ea01f572334ac8","project":"openstack/python-openstackclient","branch":"master","topic":"role_assignment_domain_admin","hashtags":[],"change_id":"Id95a8520e935c1092d5a22ecd8ea01f572334ac8","subject":"Role operations should not require list object permission","status":"MERGED","created":"2015-04-17 14:52:19.000000000","updated":"2015-04-19 13:55:35.000000000","submitted":"2015-04-19 13:55:33.000000000","submitter":{"_account_id":3,"name":"Jenkins","username":"jenkins"},"total_comment_count":2,"unresolved_comment_count":0,"has_review_started":true,"meta_rev_id":"c0d21bc8e058f30bbf332c56b024e575533cf681","_number":174908,"virtual_id_number":174908,"owner":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":3,"name":"Jenkins","username":"jenkins"},"all":[{"value":0,"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},{"value":2,"date":"2015-04-19 13:55:33.000000000","_account_id":3,"name":"Jenkins","username":"jenkins"},{"value":0,"date":"2015-04-17 22:01:16.000000000","_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},{"value":0,"_account_id":970,"name":"Dean Troyer","email":"dtroyer@gmail.com","username":"dtroyer"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"all":[{"value":2,"date":"2015-04-19 05:59:25.000000000","_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},{"value":0,"_account_id":3,"name":"Jenkins","username":"jenkins"},{"value":0,"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},{"value":2,"date":"2015-04-19 13:06:54.000000000","_account_id":970,"name":"Dean Troyer","email":"dtroyer@gmail.com","username":"dtroyer"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":970,"name":"Dean Troyer","email":"dtroyer@gmail.com","username":"dtroyer"},"all":[{"value":0,"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},{"value":0,"_account_id":3,"name":"Jenkins","username":"jenkins"},{"value":0,"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},{"value":1,"date":"2015-04-19 13:06:54.000000000","_account_id":970,"name":"Dean Troyer","email":"dtroyer@gmail.com","username":"dtroyer"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":3,"name":"Jenkins","username":"jenkins"},{"_account_id":970,"name":"Dean Troyer","email":"dtroyer@gmail.com","username":"dtroyer"},{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2015-04-19 05:59:25.000000000","updated_by":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"reviewer":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"state":"REVIEWER"},{"updated":"2015-04-19 13:06:54.000000000","updated_by":{"_account_id":970,"name":"Dean Troyer","email":"dtroyer@gmail.com","username":"dtroyer"},"reviewer":{"_account_id":970,"name":"Dean Troyer","email":"dtroyer@gmail.com","username":"dtroyer"},"state":"REVIEWER"},{"updated":"2015-04-19 13:55:33.000000000","updated_by":{"_account_id":3,"name":"Jenkins","username":"jenkins"},"reviewer":{"_account_id":3,"name":"Jenkins","username":"jenkins"},"state":"REVIEWER"}],"messages":[{"id":"75d478e0798200c77d8b25d0e63d6ecf79518b10","author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"date":"2015-04-17 14:52:19.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"e4878918f62393a81b72ebaba8c2d47ed690bd2b","author":{"_account_id":3,"name":"Jenkins","username":"jenkins"},"date":"2015-04-17 16:16:10.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see http://docs.openstack.org/infra/manual/developers.html#automated-testing\n\n- gate-python-openstackclient-python26 http://logs.openstack.org/08/174908/1/check/gate-python-openstackclient-python26/e3abceb/ : SUCCESS in 1m 18s\n- gate-python-openstackclient-pep8 http://logs.openstack.org/08/174908/1/check/gate-python-openstackclient-pep8/de21e9a/ : FAILURE in 1m 24s\n- gate-python-openstackclient-docs http://docs-draft.openstack.org/08/174908/1/check/gate-python-openstackclient-docs/e942d7d//doc/build/html/ : SUCCESS in 2m 01s\n- gate-python-openstackclient-python27 http://logs.openstack.org/08/174908/1/check/gate-python-openstackclient-python27/c516fba/ : SUCCESS in 1m 16s\n- gate-python-openstackclient-python34 http://logs.openstack.org/08/174908/1/check/gate-python-openstackclient-python34/89bac81/ : SUCCESS in 2m 49s\n- gate-tempest-dsvm-neutron-src-python-openstackclient http://logs.openstack.org/08/174908/1/check/gate-tempest-dsvm-neutron-src-python-openstackclient/75c8491/ : SUCCESS in 53m 34s\n- check-osc-dsvm-functional http://logs.openstack.org/08/174908/1/check/check-osc-dsvm-functional/bf3f5df/ : SUCCESS in 18m 29s","accounts_in_message":[],"_revision_number":1},{"id":"ca744c1db80a813f8d3de9fd2c818982b1073c2c","author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"date":"2015-04-17 17:15:07.000000000","message":"Uploaded patch set 2.","accounts_in_message":[],"_revision_number":2},{"id":"a9f4d32b8806e8b5f7c7a38871c5c67b5af5f936","author":{"_account_id":3,"name":"Jenkins","username":"jenkins"},"date":"2015-04-17 18:28:09.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\n\n- gate-python-openstackclient-python26 http://logs.openstack.org/08/174908/2/check/gate-python-openstackclient-python26/3c6b13b/ : SUCCESS in 1m 30s\n- gate-python-openstackclient-pep8 http://logs.openstack.org/08/174908/2/check/gate-python-openstackclient-pep8/925257c/ : SUCCESS in 1m 05s\n- gate-python-openstackclient-docs http://docs-draft.openstack.org/08/174908/2/check/gate-python-openstackclient-docs/b891e7d//doc/build/html/ : SUCCESS in 1m 40s\n- gate-python-openstackclient-python27 http://logs.openstack.org/08/174908/2/check/gate-python-openstackclient-python27/9427dba/ : SUCCESS in 1m 23s\n- gate-python-openstackclient-python34 http://logs.openstack.org/08/174908/2/check/gate-python-openstackclient-python34/9da5be4/ : SUCCESS in 2m 40s\n- gate-tempest-dsvm-neutron-src-python-openstackclient http://logs.openstack.org/08/174908/2/check/gate-tempest-dsvm-neutron-src-python-openstackclient/50172a5/ : SUCCESS in 57m 44s\n- check-osc-dsvm-functional http://logs.openstack.org/08/174908/2/check/check-osc-dsvm-functional/abb0d7b/ : SUCCESS in 20m 33s","accounts_in_message":[],"_revision_number":2},{"id":"508dd9c0bff795094e8c5518c1f5b645a90a5278","author":{"_account_id":970,"name":"Dean Troyer","email":"dtroyer@gmail.com","username":"dtroyer"},"date":"2015-04-17 19:33:14.000000000","message":"Patch Set 2: Code-Review-1\n\n(1 comment)\n\nGreat idea, but replicating that find_resource() wrapper for each object type seems sub-optimal to me.\n\nAIUI the caller is really only interested in the id (the passed-in string) if the object is not found.  Does the returned object need to be of the resource type?","accounts_in_message":[],"_revision_number":2},{"id":"db4321d07c90c05e7768b4a1fc5d3ff5e83ca2e5","author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"date":"2015-04-17 22:01:16.000000000","message":"Patch Set 2:\n\n@dtroyer\n\nI believe it depends on the caller.  For example, the \"role assignment list\" command, it attempts to us the \"name\", while other callers use the \"id\".","accounts_in_message":[],"_revision_number":2},{"id":"5b1ed8e1cca11fd43b93dd248a17ddf0647d3c4b","author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"date":"2015-04-19 05:59:25.000000000","message":"Patch Set 2: Code-Review+2\n\n(1 comment)\n\nthe code that nathan is adding looks fine, i added a refactoring patch","accounts_in_message":[],"_revision_number":2},{"id":"ca3885f2cbd3298bf4a30b586e5b232d48663c6f","author":{"_account_id":970,"name":"Dean Troyer","email":"dtroyer@gmail.com","username":"dtroyer"},"date":"2015-04-19 13:06:54.000000000","message":"Patch Set 2: Code-Review+2 Workflow+1\n\nThanks Steve, we can iterate on the new review.","accounts_in_message":[],"_revision_number":2},{"id":"d31c7e9060793325d49316e0108b161232ea344d","author":{"_account_id":3,"name":"Jenkins","username":"jenkins"},"date":"2015-04-19 13:06:59.000000000","message":"Patch Set 2: -Verified\n\nStarting gate jobs.\nhttp://status.openstack.org/zuul/","accounts_in_message":[],"_revision_number":2},{"id":"1fb463282445cbce9f121a0f1e40667df7bf215e","author":{"_account_id":3,"name":"Jenkins","username":"jenkins"},"date":"2015-04-19 13:55:33.000000000","message":"Patch Set 2: Verified+2\n\nBuild succeeded (gate pipeline).\n\n- gate-python-openstackclient-python26 http://logs.openstack.org/08/174908/2/gate/gate-python-openstackclient-python26/ad470dc/ : SUCCESS in 1m 26s\n- gate-python-openstackclient-docs http://docs-draft.openstack.org/08/174908/2/gate/gate-python-openstackclient-docs/00016b2//doc/build/html/ : SUCCESS in 1m 55s\n- gate-python-openstackclient-pep8 http://logs.openstack.org/08/174908/2/gate/gate-python-openstackclient-pep8/1bedc8b/ : SUCCESS in 1m 05s\n- gate-python-openstackclient-python27 http://logs.openstack.org/08/174908/2/gate/gate-python-openstackclient-python27/bc10dfc/ : SUCCESS in 1m 20s\n- gate-python-openstackclient-python34 http://logs.openstack.org/08/174908/2/gate/gate-python-openstackclient-python34/c7d2746/ : SUCCESS in 2m 40s\n- gate-tempest-dsvm-neutron-src-python-openstackclient http://logs.openstack.org/08/174908/2/gate/gate-tempest-dsvm-neutron-src-python-openstackclient/9a4bead/ : SUCCESS in 48m 32s\n- gate-osc-dsvm-functional http://logs.openstack.org/08/174908/2/gate/gate-osc-dsvm-functional/45c44e4/ : SUCCESS in 18m 28s","accounts_in_message":[],"_revision_number":2},{"id":"d8243bc714fdb3119582cca8fd4c5268f59b857d","author":{"_account_id":3,"name":"Jenkins","username":"jenkins"},"date":"2015-04-19 13:55:35.000000000","message":"Change has been successfully merged into the git repository.","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"4c107e6f1b1913988e208b31206c84ab851b780c","revisions":{"32b9886d27381f739178377e9f3520f23f688fc4":{"kind":"REWORK","_number":1,"created":"2015-04-17 14:52:19.000000000","uploader":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"ref":"refs/changes/08/174908/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/python-openstackclient","ref":"refs/changes/08/174908/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/python-openstackclient refs/changes/08/174908/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/python-openstackclient refs/changes/08/174908/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/python-openstackclient refs/changes/08/174908/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/python-openstackclient refs/changes/08/174908/1"}}},"commit":{"parents":[{"commit":"b72f2fb7eead6287fbdd07c369c0462586f37785","subject":"Merge \"Add support to specify volume quotas per volume type\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/python-openstackclient/commit/b72f2fb7eead6287fbdd07c369c0462586f37785"}]}],"author":{"name":"Nathan Kinder","email":"nkinder@redhat.com","date":"2015-04-17 02:12:45.000000000","tz":-420},"committer":{"name":"Nathan Kinder","email":"nkinder@redhat.com","date":"2015-04-17 14:46:07.000000000","tz":-420},"subject":"Role operations should not require list object permission","message":"Role operations should not require list object permission\n\nWhen using Keystone\u0027s policy.v3cloudsample.json policy file, a project admin is\nsupposed to be able to manage role assignments.  Unfortunately, a project admin\nisn\u0027t allowed to perform these operations using python-openstackclient, as we\nattempt to perform list operations for any of the object types specified (users,\ngroups, projects). This is done in an attempt to lookup the id of the object by\nname, but we perform this list operation even when the user specifies everything\nby id. This causes 403 errors.\n\nThis patch still attempts to look up the object id by name, but we catch the 403\nand assume that the user specified an id if the list operation is not allowed.\nThis is similar to what we do with the --domain option for other commands.\n\nCloses-bug: #1445528\nChange-Id: Id95a8520e935c1092d5a22ecd8ea01f572334ac8\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/python-openstackclient/commit/32b9886d27381f739178377e9f3520f23f688fc4"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/python-openstackclient/commit/32b9886d27381f739178377e9f3520f23f688fc4"}]},"branch":"refs/heads/master"},"4c107e6f1b1913988e208b31206c84ab851b780c":{"kind":"REWORK","_number":2,"created":"2015-04-17 17:15:07.000000000","uploader":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"ref":"refs/changes/08/174908/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/python-openstackclient","ref":"refs/changes/08/174908/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/python-openstackclient refs/changes/08/174908/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/python-openstackclient refs/changes/08/174908/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/python-openstackclient refs/changes/08/174908/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/python-openstackclient refs/changes/08/174908/2"}}},"commit":{"parents":[{"commit":"b72f2fb7eead6287fbdd07c369c0462586f37785","subject":"Merge \"Add support to specify volume quotas per volume type\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/python-openstackclient/commit/b72f2fb7eead6287fbdd07c369c0462586f37785"}]}],"author":{"name":"Nathan Kinder","email":"nkinder@redhat.com","date":"2015-04-17 02:12:45.000000000","tz":-420},"committer":{"name":"Nathan Kinder","email":"nkinder@redhat.com","date":"2015-04-17 17:14:57.000000000","tz":-420},"subject":"Role operations should not require list object permission","message":"Role operations should not require list object permission\n\nWhen using Keystone\u0027s policy.v3cloudsample.json policy file, a project admin is\nsupposed to be able to manage role assignments.  Unfortunately, a project admin\nisn\u0027t allowed to perform these operations using python-openstackclient, as we\nattempt to perform list operations for any of the object types specified (users,\ngroups, projects). This is done in an attempt to lookup the id of the object by\nname, but we perform this list operation even when the user specifies everything\nby id. This causes 403 errors.\n\nThis patch still attempts to look up the object id by name, but we catch the 403\nand assume that the user specified an id if the list operation is not allowed.\nThis is similar to what we do with the --domain option for other commands.\n\nCloses-bug: #1445528\nChange-Id: Id95a8520e935c1092d5a22ecd8ea01f572334ac8\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/python-openstackclient/commit/4c107e6f1b1913988e208b31206c84ab851b780c"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/python-openstackclient/commit/4c107e6f1b1913988e208b31206c84ab851b780c"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[],"submit_requirements":[]}