)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"3d20bbee28ddedfad8962543fa8d696c4a85530f","unresolved":false,"context_lines":[{"line_number":17,"context_line":" - only place \u0027swift.authorize\u0027 if it is the reseller [0]."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Because it\u0027ll clean the env, after a failed authtoken, the keystoneauths"},{"line_number":20,"context_line":"need to be paired in the pipeline:"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"  ... authtokenA keystoneauthA authtokenB KeystoneauthB ..."},{"line_number":23,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"3f79a3b5_cf552552","line":20,"updated":"2018-08-21 17:44:15.000000000","message":"This reminds me -- I keep meaning to propose a change like https://github.com/openstack/swift/blob/2.18.0/swift/common/middleware/s3api/s3token.py#L197-L199 for ksm around https://github.com/openstack/keystonemiddleware/blob/5.1.0/keystonemiddleware/auth_token/__init__.py#L619 ... like, if our job seems to have already been done for us, there\u0027s no point in doing extra work.\n\nOr maybe it goes _inside_ https://github.com/openstack/keystonemiddleware/blob/5.1.0/keystonemiddleware/auth_token/_request.py#L228-L231 ? Or maybe way up in __call__ around https://github.com/openstack/keystonemiddleware/blob/5.1.0/keystonemiddleware/auth_token/__init__.py#L329-L336 and we just no-op the whole middleware? IDK... I\u0027m starting to remember why I hadn\u0027t proposed anything yet...","commit_id":"f74c685fb36f3c76a9b8f07b43aeb75f2c2913ad"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"3d20bbee28ddedfad8962543fa8d696c4a85530f","unresolved":false,"context_lines":[{"line_number":19,"context_line":"Because it\u0027ll clean the env, after a failed authtoken, the keystoneauths"},{"line_number":20,"context_line":"need to be paired in the pipeline:"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"  ... authtokenA keystoneauthA authtokenB KeystoneauthB ..."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"[0] - if there currently isn\u0027t a \u0027swift.authorize\u0027 the first"},{"line_number":25,"context_line":"keystoneauth will add itself as the \u0027swift.authorize\u0027 so we can deal"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"3f79a3b5_5add5112","line":22,"updated":"2018-08-21 17:44:15.000000000","message":"I think there\u0027s a side-benefit to this that may be worth pointing out: since they\u0027re paired up, the reseller_prefix/operator_roles/etc. defined in keystoneauthA will only apply for the tokens that validate with authtokenA, and keystoneauthB is only used for the tokens that work with authtokenB. Separate keystone instances presumably would use different roles etc. so that seems like exactly what we\u0027d want.\n\n\nThis makes me wonder if long term we ought to roll up authtoken and keystoneauth into a single middleware... but that might have implications for s3token...","commit_id":"f74c685fb36f3c76a9b8f07b43aeb75f2c2913ad"}],"swift/common/middleware/keystoneauth.py":[{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"3d20bbee28ddedfad8962543fa8d696c4a85530f","unresolved":false,"context_lines":[{"line_number":208,"context_line":""},{"line_number":209,"context_line":"        try:"},{"line_number":210,"context_line":"            part \u003d split_path(environ[\u0027PATH_INFO\u0027], 1, 4, True)"},{"line_number":211,"context_line":"            version, account, container, obj \u003d part"},{"line_number":212,"context_line":"        except (ValueError, KeyError):"},{"line_number":213,"context_line":"            account \u003d None"},{"line_number":214,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_fa0d3d35","line":211,"range":{"start_line":211,"start_character":12,"end_line":211,"end_character":19},"updated":"2018-08-21 17:44:15.000000000","message":"Might want to check\n\n valid_api_version(version)\n\nbefore making too many assumptions...\n\nnit: container and obj aren\u0027t used, yeah? Maybe throw an underscore in front to make it obvious that they\u0027re only there to satisfy tuple unpacking. Or just use part[:2]","commit_id":"f74c685fb36f3c76a9b8f07b43aeb75f2c2913ad"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"3d20bbee28ddedfad8962543fa8d696c4a85530f","unresolved":false,"context_lines":[{"line_number":209,"context_line":"        try:"},{"line_number":210,"context_line":"            part \u003d split_path(environ[\u0027PATH_INFO\u0027], 1, 4, True)"},{"line_number":211,"context_line":"            version, account, container, obj \u003d part"},{"line_number":212,"context_line":"        except (ValueError, KeyError):"},{"line_number":213,"context_line":"            account \u003d None"},{"line_number":214,"context_line":""},{"line_number":215,"context_line":"        is_reseller \u003d self._get_account_prefix(account) is not None"}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_3aa895d9","line":212,"range":{"start_line":212,"start_character":28,"end_line":212,"end_character":36},"updated":"2018-08-21 17:44:15.000000000","message":"Huh, I\u0027ll be damned -- the spec really does make it sound like PATH_INFO may be missing...\n\nWe could always use .get(\u0027PATH_INFO\u0027, \u0027\u0027) above, though... *shrug*","commit_id":"f74c685fb36f3c76a9b8f07b43aeb75f2c2913ad"},{"author":{"_account_id":7233,"name":"Matthew Oliver","email":"matt@oliver.net.au","username":"mattoliverau"},"change_message_id":"be9b415b56318dfe39d840fc68f9e31d6f26ac16","unresolved":false,"context_lines":[{"line_number":209,"context_line":"        try:"},{"line_number":210,"context_line":"            part \u003d split_path(environ[\u0027PATH_INFO\u0027], 1, 4, True)"},{"line_number":211,"context_line":"            version, account, container, obj \u003d part"},{"line_number":212,"context_line":"        except (ValueError, KeyError):"},{"line_number":213,"context_line":"            account \u003d None"},{"line_number":214,"context_line":""},{"line_number":215,"context_line":"        is_reseller \u003d self._get_account_prefix(account) is not None"}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_352e5cfa","line":212,"range":{"start_line":212,"start_character":28,"end_line":212,"end_character":36},"in_reply_to":"3f79a3b5_3aa895d9","updated":"2018-08-22 00:31:46.000000000","message":"Yeah, the keyerror was added because of some of our existing tests. It made them pass. Not the best reason for adding but I wanted to get it up :)","commit_id":"f74c685fb36f3c76a9b8f07b43aeb75f2c2913ad"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"3d20bbee28ddedfad8962543fa8d696c4a85530f","unresolved":false,"context_lines":[{"line_number":219,"context_line":"        if is_reseller or environ.get(\u0027swift.authorize\u0027) is None:"},{"line_number":220,"context_line":"            if env_identity:"},{"line_number":221,"context_line":"                self.logger.debug(\u0027Using identity: %r\u0027, env_identity)"},{"line_number":222,"context_line":"                environ[\u0027REMOTE_USER\u0027] \u003d env_identity.get(\u0027tenant\u0027)"},{"line_number":223,"context_line":"                environ[\u0027keystone.identity\u0027] \u003d env_identity"},{"line_number":224,"context_line":"                environ[\u0027swift.authorize\u0027] \u003d functools.partial("},{"line_number":225,"context_line":"                    self.authorize, env_identity)"}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_9a0209b4","line":222,"range":{"start_line":222,"start_character":41,"end_line":222,"end_character":67},"updated":"2018-08-21 17:44:15.000000000","message":"Way off-topic: It bugs me that this is a tuple -- I know I\u0027ve bumped into troubles as a result when writing other auth middlewares... I wonder how much work it would be to make it a NUL separated list or something...","commit_id":"f74c685fb36f3c76a9b8f07b43aeb75f2c2913ad"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"3d20bbee28ddedfad8962543fa8d696c4a85530f","unresolved":false,"context_lines":[{"line_number":249,"context_line":"                # auths in the pipeline."},{"line_number":250,"context_line":"                environ[\u0027swift.authorize_override\u0027] \u003d True"},{"line_number":251,"context_line":"                return self.app(environ, keystone_start_response)"},{"line_number":252,"context_line":"            self._clean_keystone_env(environ)"},{"line_number":253,"context_line":"            return self.app(environ, start_response)"},{"line_number":254,"context_line":"        else:"},{"line_number":255,"context_line":"            # not the reseller so continue."}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_dae64117","line":252,"range":{"start_line":252,"start_character":17,"end_line":252,"end_character":36},"updated":"2018-08-21 17:44:15.000000000","message":"Is that actually necessary? Won\u0027t the next authtoken in the pipeline take care of cleaning up \"client\" headers?","commit_id":"f74c685fb36f3c76a9b8f07b43aeb75f2c2913ad"},{"author":{"_account_id":7233,"name":"Matthew Oliver","email":"matt@oliver.net.au","username":"mattoliverau"},"change_message_id":"be9b415b56318dfe39d840fc68f9e31d6f26ac16","unresolved":false,"context_lines":[{"line_number":249,"context_line":"                # auths in the pipeline."},{"line_number":250,"context_line":"                environ[\u0027swift.authorize_override\u0027] \u003d True"},{"line_number":251,"context_line":"                return self.app(environ, keystone_start_response)"},{"line_number":252,"context_line":"            self._clean_keystone_env(environ)"},{"line_number":253,"context_line":"            return self.app(environ, start_response)"},{"line_number":254,"context_line":"        else:"},{"line_number":255,"context_line":"            # not the reseller so continue."}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_7571340c","line":252,"range":{"start_line":252,"start_character":17,"end_line":252,"end_character":36},"in_reply_to":"3f79a3b5_dae64117","updated":"2018-08-22 00:31:46.000000000","message":"I just worried about potential contamination, what if the next one _didn\u0027t_ place a certain peice to the env (maybe different auth version or something), which someone lead to weird errors. Cleaning up after it self seemed sensible. Plus I don\u0027t know what other auths (some not even written yet) may want to look for in the env, so could effect them too.","commit_id":"f74c685fb36f3c76a9b8f07b43aeb75f2c2913ad"}]}