)]}'
{"specs/liberty/events-rbac.rst":[{"author":{"_account_id":6537,"name":"gordon chung","email":"gord@live.ca","username":"chungg"},"change_message_id":"87bd4ac7fdcd0b876267ff4b541396896ca0791b","unresolved":false,"context_lines":[{"line_number":56,"context_line":"There may be events for which no project/user information is recorded. Most if"},{"line_number":57,"context_line":"not all of these should have project/user information, and will need to be"},{"line_number":58,"context_line":"updated to include that. In the interim, these events will be returned along"},{"line_number":59,"context_line":"with events corresponding to the token’s project."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"For the first implementation, common name-reserved traits will be used to store"},{"line_number":62,"context_line":"project/user information."}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a50d1a3_70e4df0b","line":59,"updated":"2015-07-29 21:23:28.000000000","message":"i think events without project/user should not be returned unless super-admin. i think we should err on the side of more restrictive then less.","commit_id":"b48684596dfa3f372331bbaa260ccff390686f4d"},{"author":{"_account_id":6537,"name":"gordon chung","email":"gord@live.ca","username":"chungg"},"change_message_id":"7d3bebab1e7553b8497505aaaa9d4e60d17e6ec5","unresolved":false,"context_lines":[{"line_number":56,"context_line":"There may be events for which no project/user information is recorded. Most if"},{"line_number":57,"context_line":"not all of these should have project/user information, and will need to be"},{"line_number":58,"context_line":"updated to include that. In the interim, these events will be returned along"},{"line_number":59,"context_line":"with events corresponding to the token’s project."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"For the first implementation, common name-reserved traits will be used to store"},{"line_number":62,"context_line":"project/user information."}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a50d1a3_610ffe2e","line":59,"in_reply_to":"3a50d1a3_460d4ae7","updated":"2015-07-30 21:20:16.000000000","message":"hmm. i was hoping there was a super admin role... although now that i read it, it\u0027s probably a crazy role to have.\n\ni take it there\u0027s no way to have an admin scoped beyond a single project?\n\nhaving a CONF option to set a super admin user is probably not ideal. seems like a strange workflow but i\u0027ll leave that option on the table.","commit_id":"b48684596dfa3f372331bbaa260ccff390686f4d"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"35818b5b74d30e0f3e9bc1c1d49ca38f916b60d8","unresolved":false,"context_lines":[{"line_number":56,"context_line":"There may be events for which no project/user information is recorded. Most if"},{"line_number":57,"context_line":"not all of these should have project/user information, and will need to be"},{"line_number":58,"context_line":"updated to include that. In the interim, these events will be returned along"},{"line_number":59,"context_line":"with events corresponding to the token’s project."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"For the first implementation, common name-reserved traits will be used to store"},{"line_number":62,"context_line":"project/user information."}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a4dcd0f_0225faa9","line":59,"in_reply_to":"3a50d1a3_53593f5a","updated":"2015-08-03 21:29:07.000000000","message":"The way this is written, even normal users would be able to view events with no project/user info, but I am more than happy to change this to restrict that to admins. I\u0027ll have another patch up with that change shortly.","commit_id":"b48684596dfa3f372331bbaa260ccff390686f4d"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"35818b5b74d30e0f3e9bc1c1d49ca38f916b60d8","unresolved":false,"context_lines":[{"line_number":56,"context_line":"There may be events for which no project/user information is recorded. Most if"},{"line_number":57,"context_line":"not all of these should have project/user information, and will need to be"},{"line_number":58,"context_line":"updated to include that. In the interim, these events will be returned along"},{"line_number":59,"context_line":"with events corresponding to the token’s project."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"For the first implementation, common name-reserved traits will be used to store"},{"line_number":62,"context_line":"project/user information."}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a4dcd0f_87035c0f","line":59,"in_reply_to":"3a50d1a3_610ffe2e","updated":"2015-08-03 21:29:07.000000000","message":"it would be a conf option to set the top-level domain, which could have more than one admin user. Each of those admin users of that top-level domain would be able to see all events not only in that domain but also in other domains and projects under/within that domain. This spec currently proposes that we punt on that for now, and can add it later if need be.","commit_id":"b48684596dfa3f372331bbaa260ccff390686f4d"},{"author":{"_account_id":6537,"name":"gordon chung","email":"gord@live.ca","username":"chungg"},"change_message_id":"d43f0a58bf40b0d6e970c058ef2732191ee495b5","unresolved":false,"context_lines":[{"line_number":56,"context_line":"There may be events for which no project/user information is recorded. Most if"},{"line_number":57,"context_line":"not all of these should have project/user information, and will need to be"},{"line_number":58,"context_line":"updated to include that. In the interim, these events will be returned along"},{"line_number":59,"context_line":"with events corresponding to the token’s project."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"For the first implementation, common name-reserved traits will be used to store"},{"line_number":62,"context_line":"project/user information."}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a50d1a3_53593f5a","line":59,"in_reply_to":"3a50d1a3_610ffe2e","updated":"2015-07-31 21:47:41.000000000","message":"so i think i didn\u0027t understand the super-admin stuff... i was under impression it was a distinct role.\n\ni\u0027m ok with having:\nnormal user -\u003e only events with matching user.\nadmin user -\u003e events with matching project or no project/user info\n\nif that\u0027s what\u0027s being proposed, have at it. :)","commit_id":"b48684596dfa3f372331bbaa260ccff390686f4d"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"11c4989497809cc3de5d5854bb1a374973af7616","unresolved":false,"context_lines":[{"line_number":56,"context_line":"There may be events for which no project/user information is recorded. Most if"},{"line_number":57,"context_line":"not all of these should have project/user information, and will need to be"},{"line_number":58,"context_line":"updated to include that. In the interim, these events will be returned along"},{"line_number":59,"context_line":"with events corresponding to the token’s project."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"For the first implementation, common name-reserved traits will be used to store"},{"line_number":62,"context_line":"project/user information."}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a50d1a3_ab267c64","line":59,"in_reply_to":"3a50d1a3_70e4df0b","updated":"2015-07-29 21:47:45.000000000","message":"Ideas on how to do that? Add something like this (taken from keystone) in the policy.json:\n    \"cloud_admin\": \"rule:admin_required and domain_id:admin_domain_id\"\nAnd then code a check for that rule into our filtering? Would also need to consider the case where a cloud admin doesn\u0027t want all events... so probably need some kind of query param to indicate you do or don\u0027t want this (and default one way or the other without the query param specified)?","commit_id":"b48684596dfa3f372331bbaa260ccff390686f4d"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"2436246e0fe9501fc4011d16879d51cfa2d8cfe8","unresolved":false,"context_lines":[{"line_number":56,"context_line":"There may be events for which no project/user information is recorded. Most if"},{"line_number":57,"context_line":"not all of these should have project/user information, and will need to be"},{"line_number":58,"context_line":"updated to include that. In the interim, these events will be returned along"},{"line_number":59,"context_line":"with events corresponding to the token’s project."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"For the first implementation, common name-reserved traits will be used to store"},{"line_number":62,"context_line":"project/user information."}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a50d1a3_460d4ae7","line":59,"in_reply_to":"3a50d1a3_ab267c64","updated":"2015-07-30 14:20:19.000000000","message":"actually, having \"cloud_admin\" defined in policy.json seems like a bad idea... the user could really screw that up there. I think it would be better to have a CONF property for admin_domain_id and then hardcode the check around that and the context_is_admin policy rule.","commit_id":"b48684596dfa3f372331bbaa260ccff390686f4d"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"77cd5a38cbcd915e63bf16398fa749d5cc6366c3","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":"The events REST API will be processed only if the user passes a project-scoped"},{"line_number":53,"context_line":"token. This is required to filter the events based on the project. If the user"},{"line_number":54,"context_line":"passes an unscoped or domain-scoped token, a 401 error will be thrown."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"There may be events for which no project/user information is recorded. Most if"},{"line_number":57,"context_line":"not all of these should have project/user information, and will need to be"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a4dcd0f_a78aeabd","line":54,"updated":"2015-08-04 14:49:49.000000000","message":"This sounds like a 403 would perhaps be more correct. The request has provide credential, they are authentic, but they are insufficient to allow the desired request, so 403. Isn\u0027t it the case that 401 is what is sent when there are no credentials or the credentials not authentic?","commit_id":"cb6397064681d9f55ec91a05d6c6f728dcf0c5cf"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"77cd5a38cbcd915e63bf16398fa749d5cc6366c3","unresolved":false,"context_lines":[{"line_number":57,"context_line":"not all of these should have project/user information, and will need to be"},{"line_number":58,"context_line":"updated to include that. In the interim, these events will be returned along"},{"line_number":59,"context_line":"with events corresponding to the token’s project, if the token\u0027s user is an"},{"line_number":60,"context_line":"admin on that project."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"For the first implementation, common name-reserved traits will be used to store"},{"line_number":63,"context_line":"project/user information."}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a4dcd0f_e73b12ea","line":60,"updated":"2015-08-04 14:49:49.000000000","message":"It\u0027s not completely clear in this paragraph that or if you mean the code which creates events will need to be updated.\n\nAt first glance it sounds like you mean events in the database will need to be updated, someday.","commit_id":"cb6397064681d9f55ec91a05d6c6f728dcf0c5cf"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"77cd5a38cbcd915e63bf16398fa749d5cc6366c3","unresolved":false,"context_lines":[{"line_number":132,"context_line":"Allowing events that do not have project/user information via the same API"},{"line_number":133,"context_line":"queries will mean making 2 internal calls (one to get events scoped to the"},{"line_number":134,"context_line":"project/user and another to get events not scoped to a project/user) and then"},{"line_number":135,"context_line":"merging them. This may have a slight performance impact."},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"Other deployer impact"},{"line_number":138,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a4dcd0f_c264c4e6","line":135,"updated":"2015-08-04 14:49:49.000000000","message":"Presumably there\u0027s also the performance impact of the change to filter on project/user information that isn\u0027t currently there?","commit_id":"cb6397064681d9f55ec91a05d6c6f728dcf0c5cf"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"77cd5a38cbcd915e63bf16398fa749d5cc6366c3","unresolved":false,"context_lines":[{"line_number":193,"context_line":"Documentation Impact"},{"line_number":194,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":195,"context_line":""},{"line_number":196,"context_line":"None"},{"line_number":197,"context_line":""},{"line_number":198,"context_line":""},{"line_number":199,"context_line":"References"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a4dcd0f_c26e0496","line":196,"updated":"2015-08-04 14:49:49.000000000","message":"Presumably the docs don\u0027t already make reference to the fact that returned result sets are broader than one might reasonable expect?","commit_id":"cb6397064681d9f55ec91a05d6c6f728dcf0c5cf"}]}