)]}'
{"doc/source/authentication.rst":[{"author":{"_account_id":7665,"name":"Travis Tripp","email":"os.travis.tripp@gmail.com","username":"travis.tripp"},"change_message_id":"cec10160d5289253bb5de5d8a8b757efd9dc9f09","unresolved":false,"context_lines":[{"line_number":138,"context_line":"Where a request is disallowed on this basis, the user will receive a"},{"line_number":139,"context_line":"403 Forbidden response."},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"Note that policy rules are applied on the fly; no server restart is required."},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"Access to resources"},{"line_number":144,"context_line":"-------------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5aef4532_80769804","line":141,"updated":"2016-03-11 05:44:57.000000000","message":"Should we state that the above takes precedence over the below? Based on the code, that seems to be true...\n\nSo, if you can\u0027t see facets, you can\u0027t override it for one type.","commit_id":"a168c3cb289248ed145d6f8a87ab5a347fab4247"},{"author":{"_account_id":10063,"name":"Steve McLellan","email":"steven.j.mclellan@gmail.com","username":"sjmc7"},"change_message_id":"9299e1bfe843451816d0d5796ecf55375f7cd0db","unresolved":false,"context_lines":[{"line_number":138,"context_line":"Where a request is disallowed on this basis, the user will receive a"},{"line_number":139,"context_line":"403 Forbidden response."},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"Note that policy rules are applied on the fly; no server restart is required."},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"Access to resources"},{"line_number":144,"context_line":"-------------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3afc51ec_f764704a","line":141,"in_reply_to":"5aef4532_80769804","updated":"2016-03-11 17:23:32.000000000","message":"Done","commit_id":"a168c3cb289248ed145d6f8a87ab5a347fab4247"},{"author":{"_account_id":7665,"name":"Travis Tripp","email":"os.travis.tripp@gmail.com","username":"travis.tripp"},"change_message_id":"3cd406b89d511cedc44b808db60321659178cc15","unresolved":false,"context_lines":[{"line_number":144,"context_line":"-------------------"},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"Perhaps more interesting is restricting access to specific resource types."},{"line_number":147,"context_line":"For every operation (query, facets, plugins_info) it is possible to set a"},{"line_number":148,"context_line":"rule for any resource types. In addition, the `allow` operation acts as a"},{"line_number":149,"context_line":"default for a resource type. To allow access to Server resources only to"},{"line_number":150,"context_line":"administrators, and disallow faceting for that resource type entirely::"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3afc51ec_48e4ac0c","line":147,"updated":"2016-03-11 15:18:13.000000000","message":"put each type in ` ` like line 133 above.","commit_id":"a168c3cb289248ed145d6f8a87ab5a347fab4247"},{"author":{"_account_id":10063,"name":"Steve McLellan","email":"steven.j.mclellan@gmail.com","username":"sjmc7"},"change_message_id":"9299e1bfe843451816d0d5796ecf55375f7cd0db","unresolved":false,"context_lines":[{"line_number":144,"context_line":"-------------------"},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"Perhaps more interesting is restricting access to specific resource types."},{"line_number":147,"context_line":"For every operation (query, facets, plugins_info) it is possible to set a"},{"line_number":148,"context_line":"rule for any resource types. In addition, the `allow` operation acts as a"},{"line_number":149,"context_line":"default for a resource type. To allow access to Server resources only to"},{"line_number":150,"context_line":"administrators, and disallow faceting for that resource type entirely::"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3afc51ec_77ffc034","line":147,"in_reply_to":"3afc51ec_48e4ac0c","updated":"2016-03-11 17:23:32.000000000","message":"Done","commit_id":"a168c3cb289248ed145d6f8a87ab5a347fab4247"},{"author":{"_account_id":7665,"name":"Travis Tripp","email":"os.travis.tripp@gmail.com","username":"travis.tripp"},"change_message_id":"3cd406b89d511cedc44b808db60321659178cc15","unresolved":false,"context_lines":[{"line_number":150,"context_line":"administrators, and disallow faceting for that resource type entirely::"},{"line_number":151,"context_line":""},{"line_number":152,"context_line":"    \"resource:OS::Nova::Server:allow\": \"role:admin\","},{"line_number":153,"context_line":"    \"resource:OS::Nova::Server:facets\": \"!\""},{"line_number":154,"context_line":""},{"line_number":155,"context_line":".. note::"},{"line_number":156,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3afc51ec_c8d71c22","line":153,"updated":"2016-03-11 15:18:13.000000000","message":"I think should show query and plugins_info example here.  My eyes go to it much more quickly than reading the paragraph above.","commit_id":"a168c3cb289248ed145d6f8a87ab5a347fab4247"},{"author":{"_account_id":10063,"name":"Steve McLellan","email":"steven.j.mclellan@gmail.com","username":"sjmc7"},"change_message_id":"9299e1bfe843451816d0d5796ecf55375f7cd0db","unresolved":false,"context_lines":[{"line_number":150,"context_line":"administrators, and disallow faceting for that resource type entirely::"},{"line_number":151,"context_line":""},{"line_number":152,"context_line":"    \"resource:OS::Nova::Server:allow\": \"role:admin\","},{"line_number":153,"context_line":"    \"resource:OS::Nova::Server:facets\": \"!\""},{"line_number":154,"context_line":""},{"line_number":155,"context_line":".. note::"},{"line_number":156,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3afc51ec_d7585459","line":153,"in_reply_to":"3afc51ec_c8d71c22","updated":"2016-03-11 17:23:32.000000000","message":"Done","commit_id":"a168c3cb289248ed145d6f8a87ab5a347fab4247"},{"author":{"_account_id":8959,"name":"Lakshmi N Sampath","email":"lakshmi.sampath@hp.com","username":"lakshmi"},"change_message_id":"bfcf679c5547bc054f77898a76d3c534a708979f","unresolved":false,"context_lines":[{"line_number":139,"context_line":"Where a request is disallowed on this basis, the user will receive a"},{"line_number":140,"context_line":"403 Forbidden response."},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"Note that policy rules are applied on the fly; no server restart is required."},{"line_number":143,"context_line":"Policy rules denying access to operations take precedence over the per-resource"},{"line_number":144,"context_line":"access described below."},{"line_number":145,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1af94dfe_42855dab","line":142,"range":{"start_line":142,"start_character":76,"end_line":142,"end_character":77},"updated":"2016-03-16 18:14:57.000000000","message":"Changes to policy are not picked up without a restart of the api server.","commit_id":"3005d443efacaa99ebc9e83e6277eaf5c4bc10d5"},{"author":{"_account_id":7665,"name":"Travis Tripp","email":"os.travis.tripp@gmail.com","username":"travis.tripp"},"change_message_id":"36f3ee0755b68182481ccfda3b5e83d7c1f431c8","unresolved":false,"context_lines":[{"line_number":139,"context_line":"Where a request is disallowed on this basis, the user will receive a"},{"line_number":140,"context_line":"403 Forbidden response."},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"Note that policy rules are applied on the fly; no server restart is required."},{"line_number":143,"context_line":"Policy rules denying access to operations take precedence over the per-resource"},{"line_number":144,"context_line":"access described below."},{"line_number":145,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1af94dfe_5d037c42","line":142,"range":{"start_line":142,"start_character":76,"end_line":142,"end_character":77},"in_reply_to":"1af94dfe_42855dab","updated":"2016-03-16 18:16:54.000000000","message":"I don\u0027t see that, Lakshmi. I was able to make modifications without restart.","commit_id":"3005d443efacaa99ebc9e83e6277eaf5c4bc10d5"}],"etc/policy.json":[{"author":{"_account_id":7665,"name":"Travis Tripp","email":"os.travis.tripp@gmail.com","username":"travis.tripp"},"change_message_id":"20ffcaf21e8c9ae14e21bc6097a6beb74612e584","unresolved":false,"context_lines":[{"line_number":5,"context_line":"    \"query\": \"\","},{"line_number":6,"context_line":"    \"plugins_info\": \"\","},{"line_number":7,"context_line":"    \"facets\": \"\""},{"line_number":8,"context_line":"}"}],"source_content_type":"application/json","patch_set":3,"id":"3afc51ec_cf86edb8","line":8,"updated":"2016-03-11 23:55:00.000000000","message":"I think it is common process to also put in example rules set to \"\" for policies.  What do you think about going ahead and adding a set of example rules for resources?","commit_id":"121e13dab9e160f5994139eb916224971436b87e"},{"author":{"_account_id":7665,"name":"Travis Tripp","email":"os.travis.tripp@gmail.com","username":"travis.tripp"},"change_message_id":"1b11887ebc574d3bcc27725d16d9c537b7f544d6","unresolved":false,"context_lines":[{"line_number":6,"context_line":"    \"plugins_info\": \"\","},{"line_number":7,"context_line":"    \"facets\": \"\","},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"    \"resource:OS::Glance::Image:allow\": \"!\""},{"line_number":10,"context_line":"}"}],"source_content_type":"application/json","patch_set":5,"id":"1af94dfe_124ab1c5","line":9,"updated":"2016-03-16 03:11:22.000000000","message":"default example rule should be permissive.  \"\"","commit_id":"65f60c95442fb570572f5e2cd7df07660f4d5b10"}],"searchlight/api/policy.py":[{"author":{"_account_id":7665,"name":"Travis Tripp","email":"os.travis.tripp@gmail.com","username":"travis.tripp"},"change_message_id":"cec10160d5289253bb5de5d8a8b757efd9dc9f09","unresolved":false,"context_lines":[{"line_number":102,"context_line":"        self.policy \u003d search_policy"},{"line_number":103,"context_line":"        self.search_repo \u003d search_repo"},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"    def search(self, *args, **kwargs):"},{"line_number":106,"context_line":"        self.policy.enforce(self.context, \u0027query\u0027, {})"},{"line_number":107,"context_line":"        return self.search_repo.search(*args, **kwargs)"},{"line_number":108,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"5aef4532_40dad0ea","line":105,"updated":"2016-03-11 05:44:57.000000000","message":"definite nice change.","commit_id":"a168c3cb289248ed145d6f8a87ab5a347fab4247"},{"author":{"_account_id":10063,"name":"Steve McLellan","email":"steven.j.mclellan@gmail.com","username":"sjmc7"},"change_message_id":"9299e1bfe843451816d0d5796ecf55375f7cd0db","unresolved":false,"context_lines":[{"line_number":102,"context_line":"        self.policy \u003d search_policy"},{"line_number":103,"context_line":"        self.search_repo \u003d search_repo"},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"    def search(self, *args, **kwargs):"},{"line_number":106,"context_line":"        self.policy.enforce(self.context, \u0027query\u0027, {})"},{"line_number":107,"context_line":"        return self.search_repo.search(*args, **kwargs)"},{"line_number":108,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"3afc51ec_573ba4eb","line":105,"in_reply_to":"5aef4532_40dad0ea","updated":"2016-03-11 17:23:32.000000000","message":"Thanks!","commit_id":"a168c3cb289248ed145d6f8a87ab5a347fab4247"}],"searchlight/api/v1/search.py":[{"author":{"_account_id":7665,"name":"Travis Tripp","email":"os.travis.tripp@gmail.com","username":"travis.tripp"},"change_message_id":"1b11887ebc574d3bcc27725d16d9c537b7f544d6","unresolved":false,"context_lines":[{"line_number":186,"context_line":"            disallowed_str \u003d \", \".join(sorted(disallowed))"},{"line_number":187,"context_line":"            msg \u003d _(\"There are no resource types accessible to you to serve \""},{"line_number":188,"context_line":"                    \"your request. You do not have access to the \""},{"line_number":189,"context_line":"                    \"following resource types: %s\") % disallowed_str"},{"line_number":190,"context_line":"            raise webob.exc.HTTPForbidden(explanation\u003dmsg)"},{"line_number":191,"context_line":"        return allowed_types"},{"line_number":192,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"1af94dfe_d254c955","line":189,"updated":"2016-03-16 03:11:22.000000000","message":"you forgot the \"because you are not trustworthy\" part.\n\n;-)","commit_id":"65f60c95442fb570572f5e2cd7df07660f4d5b10"}],"searchlight/elasticsearch/__init__.py":[{"author":{"_account_id":8959,"name":"Lakshmi N Sampath","email":"lakshmi.sampath@hp.com","username":"lakshmi"},"change_message_id":"bfcf679c5547bc054f77898a76d3c534a708979f","unresolved":false,"context_lines":[{"line_number":76,"context_line":"            index\u003ddefault_index,"},{"line_number":77,"context_line":"            doc_type\u003ddefault_type,"},{"line_number":78,"context_line":"            actions\u003dactions)"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"    def plugins_info(self):"},{"line_number":81,"context_line":"        return self.plugins_info_dict"},{"line_number":82,"context_line":""}],"source_content_type":"text/x-python","patch_set":6,"id":"1af94dfe_7dc4785e","side":"PARENT","line":79,"range":{"start_line":79,"start_character":0,"end_line":79,"end_character":0},"updated":"2016-03-16 18:14:57.000000000","message":"Its ok to remove index operation now but we will reintroduce it later when we have to add functionality for allowing direct indexing from client api(ex. swift)","commit_id":"2949618316798732761903a47281cf99a6d63464"},{"author":{"_account_id":7665,"name":"Travis Tripp","email":"os.travis.tripp@gmail.com","username":"travis.tripp"},"change_message_id":"2585f38c61ddb39c79ffb4be7d7be82bb2345f22","unresolved":false,"context_lines":[{"line_number":76,"context_line":"            index\u003ddefault_index,"},{"line_number":77,"context_line":"            doc_type\u003ddefault_type,"},{"line_number":78,"context_line":"            actions\u003dactions)"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"    def plugins_info(self):"},{"line_number":81,"context_line":"        return self.plugins_info_dict"},{"line_number":82,"context_line":""}],"source_content_type":"text/x-python","patch_set":6,"id":"1af94dfe_9dab441d","side":"PARENT","line":79,"range":{"start_line":79,"start_character":0,"end_line":79,"end_character":0},"in_reply_to":"1af94dfe_7dc4785e","updated":"2016-03-16 18:17:28.000000000","message":"I think we have to remove from a security standpoint for now, though.","commit_id":"2949618316798732761903a47281cf99a6d63464"}],"searchlight/tests/functional/test_api.py":[{"author":{"_account_id":7665,"name":"Travis Tripp","email":"os.travis.tripp@gmail.com","username":"travis.tripp"},"change_message_id":"cec10160d5289253bb5de5d8a8b757efd9dc9f09","unresolved":false,"context_lines":[{"line_number":445,"context_line":"        existing_policy[\"resource:OS::Nova::Server:allow\"] \u003d \"role:admin\""},{"line_number":446,"context_line":"        existing_policy[\"resource:OS::Nova::Server:facets\"] \u003d \"!\""},{"line_number":447,"context_line":""},{"line_number":448,"context_line":"        existing_policy[\"resource:OS::Glance::Image:facets\"] \u003d \"!\""},{"line_number":449,"context_line":""},{"line_number":450,"context_line":"        with open(self.policy_file, \u0027w\u0027) as policy_file:"},{"line_number":451,"context_line":"            json.dump(existing_policy, policy_file)"}],"source_content_type":"text/x-python","patch_set":2,"id":"5aef4532_e03e7cd9","line":448,"updated":"2016-03-11 05:44:57.000000000","message":"A missing scenario is one where facets are allowed for users for a given resource type and  they show up in the results, but the user doesn\u0027t see the admin facets.  I think if you just add another resource type here that users can get their facets and assert they are in the results.","commit_id":"a168c3cb289248ed145d6f8a87ab5a347fab4247"},{"author":{"_account_id":10063,"name":"Steve McLellan","email":"steven.j.mclellan@gmail.com","username":"sjmc7"},"change_message_id":"9299e1bfe843451816d0d5796ecf55375f7cd0db","unresolved":false,"context_lines":[{"line_number":445,"context_line":"        existing_policy[\"resource:OS::Nova::Server:allow\"] \u003d \"role:admin\""},{"line_number":446,"context_line":"        existing_policy[\"resource:OS::Nova::Server:facets\"] \u003d \"!\""},{"line_number":447,"context_line":""},{"line_number":448,"context_line":"        existing_policy[\"resource:OS::Glance::Image:facets\"] \u003d \"!\""},{"line_number":449,"context_line":""},{"line_number":450,"context_line":"        with open(self.policy_file, \u0027w\u0027) as policy_file:"},{"line_number":451,"context_line":"            json.dump(existing_policy, policy_file)"}],"source_content_type":"text/x-python","patch_set":2,"id":"3afc51ec_2281784b","line":448,"in_reply_to":"5aef4532_e03e7cd9","updated":"2016-03-11 17:23:32.000000000","message":"I think you\u0027re asking for a check of facets \u003d role:admin? Which i will add. There is a check making sure neither server nor image facets show up at all","commit_id":"a168c3cb289248ed145d6f8a87ab5a347fab4247"}]}