)]}'
{"doc/source/overview_notifications.rst":[{"author":{"_account_id":20553,"name":"Brian Ober","email":"bober@us.ibm.com","username":"ober37"},"change_message_id":"7d90abf2a6e5bb68338a08b8b02a12bbc0487098","unresolved":false,"context_lines":[{"line_number":47,"context_line":""},{"line_number":48,"context_line":"{"},{"line_number":49,"context_line":"    \"transport\": \"kafka\","},{"line_number":50,"context_line":"    \"version\": \"v1.0\","},{"line_number":51,"context_line":"    \"user-data\": \"user specific data\","},{"line_number":52,"context_line":"    \"configuration\": {"},{"line_number":53,"context_line":"        \"topic\":\"mytopic\""}],"source_content_type":"text/x-rst","patch_set":1,"id":"fa6399be_124c6041","line":50,"range":{"start_line":50,"start_character":4,"end_line":50,"end_character":5},"updated":"2016-10-19 13:39:20.000000000","message":"It is probably worth aligning the version format between the policy and payload around a consistent format","commit_id":"773543be6136c3c1552c0812099e24e17dc224d7"},{"author":{"_account_id":20553,"name":"Brian Ober","email":"bober@us.ibm.com","username":"ober37"},"change_message_id":"314ddfa3a0cfb118bafab1b7a37757db347ce410","unresolved":false,"context_lines":[{"line_number":101,"context_line":"        \"version\": 1.0,"},{"line_number":102,"context_line":"        \"source: \"object storage\","},{"line_number":103,"context_line":"        \"user-data\": \"opaque data set on the policy\","},{"line_number":104,"context_line":"        \"status_code\": \"201\""},{"line_number":105,"context_line":"    }"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"}"}],"source_content_type":"text/x-rst","patch_set":1,"id":"fa6399be_0c9b4e73","line":104,"range":{"start_line":104,"start_character":9,"end_line":104,"end_character":20},"updated":"2016-10-20 00:39:46.000000000","message":"status-code instead of status_code","commit_id":"773543be6136c3c1552c0812099e24e17dc224d7"},{"author":{"_account_id":18186,"name":"Denis Makogon","username":"denismakogon","inactive":true},"change_message_id":"423370144327b3aa5a317da192f035303a8f633d","unresolved":false,"context_lines":[{"line_number":22,"context_line":"The middleware responsible for handling policy management and enforcement is ``notification-policy``."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"* User Notification Policies"},{"line_number":25,"context_line":"User notification policies can be set on an account or container by any user with write permissions on that resource.   In addition, any existing user notification policy can be seen by another user with read permissions on that same resource."},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"* System Notification Policies"},{"line_number":28,"context_line":"System notification policies can be set on an account or container by any user with a reseller_admin role.   These policies cannot be seen or modified by any non-reseller users."}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a71b18c_de1ad56e","line":25,"updated":"2016-12-11 16:29:41.000000000","message":"So, it is not so obvious why should i need to define notifications policy on container or whatever it would be. As user i\u0027d be interested in having an ability to subscribe to notifications feed and listen for specific notifications only.\n\nThis type of notifications are seemed to be out of scope of Swift or, probably, i\u0027m missing something.","commit_id":"e90caff542fc110d19b7ddd69d1686992bbb247d"},{"author":{"_account_id":21231,"name":"Bryan Keller","email":"kellerbr@us.ibm.com","username":"bkeller"},"change_message_id":"eed4652212cbc0af7ef4e5f6413f330f4d476eca","unresolved":false,"context_lines":[{"line_number":22,"context_line":"The middleware responsible for handling policy management and enforcement is ``notification-policy``."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"* User Notification Policies"},{"line_number":25,"context_line":"User notification policies can be set on an account or container by any user with write permissions on that resource.   In addition, any existing user notification policy can be seen by another user with read permissions on that same resource."},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"* System Notification Policies"},{"line_number":28,"context_line":"System notification policies can be set on an account or container by any user with a reseller_admin role.   These policies cannot be seen or modified by any non-reseller users."}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a6eadb0_b8f48887","line":25,"in_reply_to":"3a71b18c_de1ad56e","updated":"2016-12-13 22:53:16.000000000","message":"We\u0027re planning to add the ability to specify filters in policies for what objects should trigger notifications but that will be later in another patch.","commit_id":"e90caff542fc110d19b7ddd69d1686992bbb247d"},{"author":{"_account_id":18186,"name":"Denis Makogon","username":"denismakogon","inactive":true},"change_message_id":"423370144327b3aa5a317da192f035303a8f633d","unresolved":false,"context_lines":[{"line_number":35,"context_line":""},{"line_number":36,"context_line":"User Notification Policies   - X-Container-Meta-Notification-${policy_id}"},{"line_number":37,"context_line":"System Notification Policies - X-Container-Sysmeta-Notification-${policy_id}"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"The policy body is constructed with the following elements:"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"transport - The transport used for the notification"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a71b18c_9f576d59","line":38,"updated":"2016-12-11 16:29:41.000000000","message":"So, seeing all this type of policies a bit confuses me, i know that there are use cases for specific policies, but i don\u0027t see here regular OpenStack notifications patterns/policies.\n\nIt is good to have capability to turn on/off notifications on specific resource (container and files), but i think it would be more useful to expect that swift will emit notification by default, because when user is responsible to turn on/off notification it would require to setup Identity trusts in order to allow 3rd-party services to do exactly the same as users capable of.\n\nOther thing, it would be useful to have capability to define pattern-based notifications, like: send notification once in container A files bigger than 25 megs will appear.","commit_id":"e90caff542fc110d19b7ddd69d1686992bbb247d"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"4c083b680df96c9acd36c41089a3e476d12885b5","unresolved":false,"context_lines":[{"line_number":35,"context_line":""},{"line_number":36,"context_line":"User Notification Policies   - X-Container-Meta-Notification-${policy_id}"},{"line_number":37,"context_line":"System Notification Policies - X-Container-Sysmeta-Notification-${policy_id}"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"The policy body is constructed with the following elements:"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"transport - The transport used for the notification"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a6eadb0_01afc494","line":38,"in_reply_to":"1a6eadb0_18901c43","updated":"2016-12-14 03:31:53.000000000","message":"that said, since the support for Cluster policies is not in this patch, that item should be removed in the docs.  We can add that item to the ideas page to document what other features might be implemented next.","commit_id":"e90caff542fc110d19b7ddd69d1686992bbb247d"},{"author":{"_account_id":21231,"name":"Bryan Keller","email":"kellerbr@us.ibm.com","username":"bkeller"},"change_message_id":"eed4652212cbc0af7ef4e5f6413f330f4d476eca","unresolved":false,"context_lines":[{"line_number":35,"context_line":""},{"line_number":36,"context_line":"User Notification Policies   - X-Container-Meta-Notification-${policy_id}"},{"line_number":37,"context_line":"System Notification Policies - X-Container-Sysmeta-Notification-${policy_id}"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"The policy body is constructed with the following elements:"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"transport - The transport used for the notification"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a6eadb0_18901c43","line":38,"in_reply_to":"3a71b18c_9f576d59","updated":"2016-12-13 22:53:16.000000000","message":"We have three general types of policies we\u0027d like to see:\n* User policies, which a user sets on a container or their account. An example would be an AWS Lambda-like service where a user sets up their own serverless scripts that would be triggered via notifications.\n* System policies. They work just like user policies but are hidden from users (by being put in sysmeta). \n* Cluster policies. These would be configured in a config file and apply to the whole system.\n\nIt sounds like your use case wants cluster policies, but we aren\u0027t including them at the moment. We\u0027ll be looking into them later for a followup patch.\n\nSame as above for filtering.","commit_id":"e90caff542fc110d19b7ddd69d1686992bbb247d"},{"author":{"_account_id":18186,"name":"Denis Makogon","username":"denismakogon","inactive":true},"change_message_id":"423370144327b3aa5a317da192f035303a8f633d","unresolved":false,"context_lines":[{"line_number":48,"context_line":"{"},{"line_number":49,"context_line":"    \"transport\": \"kafka\","},{"line_number":50,"context_line":"    \"version\": \"1.0\","},{"line_number":51,"context_line":"    \"user-data\": \"user specific data\","},{"line_number":52,"context_line":"    \"configuration\": {"},{"line_number":53,"context_line":"        \"topic\":\"mytopic\""},{"line_number":54,"context_line":"    }"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a71b18c_df556550","line":51,"updated":"2016-12-11 16:29:41.000000000","message":"from userdata definition, it is not clear what it may be, is it set up resource attributes to be included into notification payload?","commit_id":"e90caff542fc110d19b7ddd69d1686992bbb247d"},{"author":{"_account_id":21231,"name":"Bryan Keller","email":"kellerbr@us.ibm.com","username":"bkeller"},"change_message_id":"eed4652212cbc0af7ef4e5f6413f330f4d476eca","unresolved":false,"context_lines":[{"line_number":48,"context_line":"{"},{"line_number":49,"context_line":"    \"transport\": \"kafka\","},{"line_number":50,"context_line":"    \"version\": \"1.0\","},{"line_number":51,"context_line":"    \"user-data\": \"user specific data\","},{"line_number":52,"context_line":"    \"configuration\": {"},{"line_number":53,"context_line":"        \"topic\":\"mytopic\""},{"line_number":54,"context_line":"    }"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a6eadb0_185f3ce6","line":51,"in_reply_to":"3a71b18c_df556550","updated":"2016-12-13 22:53:16.000000000","message":"It\u0027s an extra field that the policy creator can put extra information in to use when they\u0027re receiving the notification. For example if they\u0027re hooking it up to a third-party service you could use this to tie the notifications on a particular policy to that user in the service.","commit_id":"e90caff542fc110d19b7ddd69d1686992bbb247d"},{"author":{"_account_id":18186,"name":"Denis Makogon","username":"denismakogon","inactive":true},"change_message_id":"423370144327b3aa5a317da192f035303a8f633d","unresolved":false,"context_lines":[{"line_number":95,"context_line":"    \"payload\": {"},{"line_number":96,"context_line":"        \"etag\": \"44a4ea286e611897b2b126f8a2cbb203\","},{"line_number":97,"context_line":"        \"x-trans-id\": \"tx36fc359d6c13443ba5215-0057e194c7\","},{"line_number":98,"context_line":"        \"path\": \"/v1/myaccount/mycontainer/obj\","},{"line_number":99,"context_line":"        \"req-method\": \"POST\","},{"line_number":100,"context_line":"        \"orig-req-method\": \"POST\","},{"line_number":101,"context_line":"        \"version\": \"1.0\","}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a71b18c_7fcd3130","line":98,"updated":"2016-12-11 16:29:41.000000000","message":"more useful will be:\n   \u003cservice-endpoint\u003e:/v1/myaccount/mycontainer/obj","commit_id":"e90caff542fc110d19b7ddd69d1686992bbb247d"},{"author":{"_account_id":21231,"name":"Bryan Keller","email":"kellerbr@us.ibm.com","username":"bkeller"},"change_message_id":"eed4652212cbc0af7ef4e5f6413f330f4d476eca","unresolved":false,"context_lines":[{"line_number":95,"context_line":"    \"payload\": {"},{"line_number":96,"context_line":"        \"etag\": \"44a4ea286e611897b2b126f8a2cbb203\","},{"line_number":97,"context_line":"        \"x-trans-id\": \"tx36fc359d6c13443ba5215-0057e194c7\","},{"line_number":98,"context_line":"        \"path\": \"/v1/myaccount/mycontainer/obj\","},{"line_number":99,"context_line":"        \"req-method\": \"POST\","},{"line_number":100,"context_line":"        \"orig-req-method\": \"POST\","},{"line_number":101,"context_line":"        \"version\": \"1.0\","}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a6eadb0_d3ba0723","line":98,"in_reply_to":"3a71b18c_7fcd3130","updated":"2016-12-13 22:53:16.000000000","message":"We can do this but I\u0027m not sure we\u0027d be able to guarantee that it would work. If you using Nginx or Apache as a proxy in front of Swift then you might simply see localhost:xxxx as the endpoint URL.\n\nAlso if we did have the service endpoint it would be as a separate property. We could also include a URI/URL field.","commit_id":"e90caff542fc110d19b7ddd69d1686992bbb247d"},{"author":{"_account_id":18186,"name":"Denis Makogon","username":"denismakogon","inactive":true},"change_message_id":"423370144327b3aa5a317da192f035303a8f633d","unresolved":false,"context_lines":[{"line_number":97,"context_line":"        \"x-trans-id\": \"tx36fc359d6c13443ba5215-0057e194c7\","},{"line_number":98,"context_line":"        \"path\": \"/v1/myaccount/mycontainer/obj\","},{"line_number":99,"context_line":"        \"req-method\": \"POST\","},{"line_number":100,"context_line":"        \"orig-req-method\": \"POST\","},{"line_number":101,"context_line":"        \"version\": \"1.0\","},{"line_number":102,"context_line":"        \"source: \"object storage\","},{"line_number":103,"context_line":"        \"user-data\": \"opaque data set on the policy\","}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a71b18c_9fce8d2b","line":100,"updated":"2016-12-11 16:29:41.000000000","message":"this one is not listed in payload description above","commit_id":"e90caff542fc110d19b7ddd69d1686992bbb247d"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"4c083b680df96c9acd36c41089a3e476d12885b5","unresolved":false,"context_lines":[{"line_number":97,"context_line":"        \"x-trans-id\": \"tx36fc359d6c13443ba5215-0057e194c7\","},{"line_number":98,"context_line":"        \"path\": \"/v1/myaccount/mycontainer/obj\","},{"line_number":99,"context_line":"        \"req-method\": \"POST\","},{"line_number":100,"context_line":"        \"orig-req-method\": \"POST\","},{"line_number":101,"context_line":"        \"version\": \"1.0\","},{"line_number":102,"context_line":"        \"source: \"object storage\","},{"line_number":103,"context_line":"        \"user-data\": \"opaque data set on the policy\","}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a6eadb0_88523012","line":100,"in_reply_to":"3a71b18c_9fce8d2b","updated":"2016-12-14 03:31:53.000000000","message":"Agreed, this should be added.  If you are interested in knowing what it is, it exists mainly for the COPY action and for post-as-copy.  For example, the current request method triggering the notification might be a PUT, whereas the client request generating that PUT was really a COPY request (that is a GET/PUT under the hood).  To make things even more fun, that same scenario could be a COPY due to the client requesting a POST while having post-as-copy mode running.","commit_id":"e90caff542fc110d19b7ddd69d1686992bbb247d"},{"author":{"_account_id":18186,"name":"Denis Makogon","username":"denismakogon","inactive":true},"change_message_id":"423370144327b3aa5a317da192f035303a8f633d","unresolved":false,"context_lines":[{"line_number":105,"context_line":"    }"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"}"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"-------------------"},{"line_number":110,"context_line":"Direct API Examples"},{"line_number":111,"context_line":"-------------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a71b18c_ff006136","line":108,"updated":"2016-12-11 16:29:41.000000000","message":"I like the way how AWS S3 treats its notifications http://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html#how-to-enable-disable-notification-intro\n\nIf we\u0027d talk about AWS-lambda-like functionality, it would be useful to have on container level:\n - ACL policy - define who and how can access your container or object, by default all containers and objects are secure, but if it would be possible to set insecure read capabilities we\u0027d enable scenarios like:\n\n on image upload create thumbnail if it and place aside.\n\nSo using ACL policy we\u0027d be able to read/write to container by given path in notifications.\n\n - Filtering (pattern-based notifications). As i already mentioned filtering on notifications will allow to emit them only when pattern match:\n\n emit notifications on new object which is 20Mb or greater\n\nFiltering can be very different: by size, by type, etc.","commit_id":"e90caff542fc110d19b7ddd69d1686992bbb247d"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"4c083b680df96c9acd36c41089a3e476d12885b5","unresolved":false,"context_lines":[{"line_number":105,"context_line":"    }"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"}"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"-------------------"},{"line_number":110,"context_line":"Direct API Examples"},{"line_number":111,"context_line":"-------------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a6eadb0_281bdc1c","line":108,"in_reply_to":"3a71b18c_ff006136","updated":"2016-12-14 03:31:53.000000000","message":"ACL\u0027s are already implemented in swift http://docs.openstack.org/developer/swift/overview_acl.html.  Maybe you are suggesting integration with the existing ACL implementation?\n\nCurrently for this patch:\n- user policies require operation or reseller role in the auth system, or ACL to the associated account with write permissions.\n- system policies require reseller role \n\nNote Swift does not support object ACLs so it\u0027s somewhat different than S3 in this case.\n\nNo access control assumptions are made on the receiver of the notification.  Therefore, if they attempt to access Swift post-notification they must do so with a token with the appropriate level of access control (which is why the actual notification payload must contain limited information)","commit_id":"e90caff542fc110d19b7ddd69d1686992bbb247d"},{"author":{"_account_id":18186,"name":"Denis Makogon","username":"denismakogon","inactive":true},"change_message_id":"423370144327b3aa5a317da192f035303a8f633d","unresolved":false,"context_lines":[{"line_number":125,"context_line":"        \"topic\":\"mytopic\""},{"line_number":126,"context_line":"    }"},{"line_number":127,"context_line":"}\u0027 \\"},{"line_number":128,"context_line":"${URL}/v1/AUTH_account/my_container"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"* Remove a user notification policy on my_container"},{"line_number":131,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a71b18c_bfa18948","line":128,"updated":"2016-12-11 16:29:41.000000000","message":"this is so tricky part, because, it is somehow will expose your internal controller networking configuration.\n\nmore safe varian here will be providing information where can my 3rd-party notification system listen for events\n\nSo, this comes from use case of Aodh, Zaqar and any notifications in OpenStack, for example, you can\u0027t read notification directly from AMQP, but you\u0027re able to query events from Aodh, or listen for messages in Zaqar.\n\nSo, there are too many edge cases when you allow to provide information where to publish events. Basically, i can create network spoofing attack to internal network of controller using next steps:\n\n - define real transport for notifications\n - discover from where notifications are coming from\n - define new transport configuration that will create load to internal network","commit_id":"e90caff542fc110d19b7ddd69d1686992bbb247d"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"4c083b680df96c9acd36c41089a3e476d12885b5","unresolved":false,"context_lines":[{"line_number":125,"context_line":"        \"topic\":\"mytopic\""},{"line_number":126,"context_line":"    }"},{"line_number":127,"context_line":"}\u0027 \\"},{"line_number":128,"context_line":"${URL}/v1/AUTH_account/my_container"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"* Remove a user notification policy on my_container"},{"line_number":131,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a6eadb0_e8cac44e","line":128,"in_reply_to":"3a71b18c_bfa18948","updated":"2016-12-14 03:31:53.000000000","message":"I am not sure if I fully understand which part is being discussed.  I assume that you are speaking to the \u0027configuration\u0027 item?  If so, the implementation currently doesn\u0027t support changing the connection configuration.  So, that part of the docs should be removed unless the support is implemented.  \n\nIf this config section does end up being supported, then  the use case could be like this:\n\nThere is a larger messaging system (Zaqar / logical cloud notifications), then one would create a system notification policy (which cannot be seen / modified by normal users only \"reseller\" roles) and the user would interact with that larger messaging system directly.   For example, you could do this with openwhisk (where the only knowledge of the \"transport\" is in the logical notification service (in our case openwhisk).\n\nThe benefit of this approach is that there are cases where end-users actually own the lower level message queue construct (like a tenant instance of kafka) and want the capability to dictate networking / etc.\n\nThe desire is for this solution to support both use cases.\n\nAs for the attack scenario, keep in mind that sensitive data is already provided on requests to swift, such as the token required to authenticate the request.  Network traffic into a proxy should be encrypted in production clusters.\n\nHowever, the policy information will be written to disc.  Even with encryption on, the system policies which use sysmeta would not encrypt the policy without those updates to the encryption feature.","commit_id":"e90caff542fc110d19b7ddd69d1686992bbb247d"}],"swift/common/middleware/notifications/policy.py":[{"author":{"_account_id":18186,"name":"Denis Makogon","username":"denismakogon","inactive":true},"change_message_id":"423370144327b3aa5a317da192f035303a8f633d","unresolved":false,"context_lines":[{"line_number":69,"context_line":"        user_data \u003d self.policy.get(\u0027user_data\u0027)"},{"line_number":70,"context_line":"        if user_data is not None:"},{"line_number":71,"context_line":"            payload[\u0027user_data\u0027] \u003d user_data"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"        # Encode payload to JSON"},{"line_number":74,"context_line":"        return json.dumps(payload, indent\u003d2)"},{"line_number":75,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"3a71b18c_36f03b91","line":72,"updated":"2016-12-11 16:29:41.000000000","message":"It is unclear what `user_data` is. According to how you treat it, user data nothing but static data that comes from config, or am i missing something.","commit_id":"e90caff542fc110d19b7ddd69d1686992bbb247d"}]}