)]}'
{"releasenotes/notes/trove-oslo-policy-964cc3e1c9d3cdcd.yaml":[{"author":{"_account_id":9664,"name":"amrith","email":"amrith.kumar@gmail.com","username":"amrith"},"change_message_id":"b55e7e99178f950a7d28652c3125747e4b9ea4d4","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"features:"},{"line_number":3,"context_line":"  - Add RBAC enforcement on all trove APIs."},{"line_number":4,"context_line":"    Implements blueprint trove-policy"}],"source_content_type":"text/x-yaml","patch_set":7,"id":"5a74a57a_1f77d8d3","line":4,"range":{"start_line":3,"start_character":1,"end_line":4,"end_character":37},"updated":"2016-11-26 14:34:32.000000000","message":"this content is not what one would like in a release note. Since (with reno) the content here goes directly to the release notes, it must be in language that is suited to a user.\n\nSo, you can remove the second line, and hopefully elaborate on the first one.","commit_id":"87eebe8ce102892e664112050b3a93a102b943d3"}],"releasenotes/notes/trove-oslo-policy-bbd1b911e6487c36.yaml":[{"author":{"_account_id":10215,"name":"Peter Stachowski","email":"peter@tesora.com","username":"peterstac"},"change_message_id":"375e0006d7236794818db839dd60604469a822da","unresolved":false,"context_lines":[{"line_number":1,"context_line":"features:"},{"line_number":2,"context_line":"  - Add RBAC (role-based access control)"},{"line_number":3,"context_line":"    enforcement on all trove APIs."},{"line_number":4,"context_line":"    Allows to define a role-based access rule"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"5a74a57a_fbfbda76","line":1,"updated":"2016-11-28 19:02:26.000000000","message":"I think the 1st line needs to be:\n\n  ---\n\nStill don\u0027t know why pep8 is even looking at this file ...","commit_id":"ebce37bd1bac0894aa7b3fbc207215deef41b948"},{"author":{"_account_id":10215,"name":"Peter Stachowski","email":"peter@tesora.com","username":"peterstac"},"change_message_id":"8c73d126211ac34455aa33371cb562f2bab130e7","unresolved":false,"context_lines":[{"line_number":1,"context_line":"features:"},{"line_number":2,"context_line":"  - Add RBAC (role-based access control)"},{"line_number":3,"context_line":"    enforcement on all trove APIs."},{"line_number":4,"context_line":"    Allows to define a role-based access rule"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"5a74a57a_5e3afbe7","line":1,"in_reply_to":"5a74a57a_fbfbda76","updated":"2016-11-28 20:00:53.000000000","message":"pep8 is finding this file because the name starts with \u0027trove-\u0027 - if you change the name to something else it won\u0027t pick it up (or depend on Amrith\u0027s change)","commit_id":"ebce37bd1bac0894aa7b3fbc207215deef41b948"}],"trove/cluster/service.py":[{"author":{"_account_id":9664,"name":"amrith","email":"amrith.kumar@gmail.com","username":"amrith"},"change_message_id":"82d33d10c66e0381656185d2b7a629e474c43508","unresolved":false,"context_lines":[{"line_number":40,"context_line":"    \"\"\"Controller for cluster functionality.\"\"\""},{"line_number":41,"context_line":"    schemas \u003d apischema.cluster.copy()"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"    @classmethod"},{"line_number":44,"context_line":"    def authorize_cluster_action(cls, context, cluster_rule_name, cluster):"},{"line_number":45,"context_line":"        policy.authorize_on_target(context, \u0027cluster:%s\u0027 % cluster_rule_name,"},{"line_number":46,"context_line":"                                   {\u0027tenant\u0027: cluster.tenant_id})"}],"source_content_type":"text/x-python","patch_set":10,"id":"3a71b18c_fa0dfd37","line":43,"range":{"start_line":43,"start_character":0,"end_line":43,"end_character":16},"updated":"2016-12-02 19:42:32.000000000","message":"I\u0027m curious that you chose to make this a classmethod, is there a reason for this; I can\u0027t find one obviously.\n\nThis comment applies in many places, not repeating it in each place.","commit_id":"f72c41fa2a25ffe4ef599f59a38588554c74fd94"},{"author":{"_account_id":14576,"name":"Petr Malik","email":"pmalik@tesora.com","username":"pmalik"},"change_message_id":"134010e4cdae1efbe953b959131b4d451d87e338","unresolved":false,"context_lines":[{"line_number":40,"context_line":"    \"\"\"Controller for cluster functionality.\"\"\""},{"line_number":41,"context_line":"    schemas \u003d apischema.cluster.copy()"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"    @classmethod"},{"line_number":44,"context_line":"    def authorize_cluster_action(cls, context, cluster_rule_name, cluster):"},{"line_number":45,"context_line":"        policy.authorize_on_target(context, \u0027cluster:%s\u0027 % cluster_rule_name,"},{"line_number":46,"context_line":"                                   {\u0027tenant\u0027: cluster.tenant_id})"}],"source_content_type":"text/x-python","patch_set":10,"id":"3a71b18c_9a61693c","line":43,"range":{"start_line":43,"start_character":0,"end_line":43,"end_character":16},"in_reply_to":"3a71b18c_fa0dfd37","updated":"2016-12-02 20:21:50.000000000","message":"Since the method is more like a utility call. It does not use any of the instance fields of the controller. I did not want to \u0027a priori\u0027 limit it to the instance as anybody may want to perform a policy check on a given cluster object...","commit_id":"f72c41fa2a25ffe4ef599f59a38588554c74fd94"}],"trove/extensions/common/service.py":[{"author":{"_account_id":9664,"name":"amrith","email":"amrith.kumar@gmail.com","username":"amrith"},"change_message_id":"82d33d10c66e0381656185d2b7a629e474c43508","unresolved":false,"context_lines":[{"line_number":85,"context_line":"        return None"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"class DefaultRootController(BaseDatastoreRootController):"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"    def root_index(self, req, tenant_id, instance_id, is_cluster):"},{"line_number":91,"context_line":"        \"\"\"Returns True if root is enabled; False otherwise.\"\"\""}],"source_content_type":"text/x-python","patch_set":10,"id":"3a71b18c_af67c923","line":88,"range":{"start_line":88,"start_character":6,"end_line":88,"end_character":27},"updated":"2016-12-02 19:42:32.000000000","message":"no policy checking here?","commit_id":"f72c41fa2a25ffe4ef599f59a38588554c74fd94"},{"author":{"_account_id":14576,"name":"Petr Malik","email":"pmalik@tesora.com","username":"pmalik"},"change_message_id":"134010e4cdae1efbe953b959131b4d451d87e338","unresolved":false,"context_lines":[{"line_number":85,"context_line":"        return None"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"class DefaultRootController(BaseDatastoreRootController):"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"    def root_index(self, req, tenant_id, instance_id, is_cluster):"},{"line_number":91,"context_line":"        \"\"\"Returns True if root is enabled; False otherwise.\"\"\""}],"source_content_type":"text/x-python","patch_set":10,"id":"3a71b18c_15dfea69","line":88,"range":{"start_line":88,"start_character":6,"end_line":88,"end_character":27},"in_reply_to":"3a71b18c_af67c923","updated":"2016-12-02 20:21:50.000000000","message":"The way this code is structured these Default and Cluster root controllers are invoked by the (routing) \u0027RootController\u0027.\n\nThe \u0027RootController\u0027 loads one of these implementations (based on the CONF for the particular datastore) and invokes its methods.\n\nIt is hence sufficient to do the check there (it really is the RootController who defines the API, the other classes just provide implementations).","commit_id":"f72c41fa2a25ffe4ef599f59a38588554c74fd94"},{"author":{"_account_id":9664,"name":"amrith","email":"amrith.kumar@gmail.com","username":"amrith"},"change_message_id":"82d33d10c66e0381656185d2b7a629e474c43508","unresolved":false,"context_lines":[{"line_number":128,"context_line":"        return wsgi.Result(None, 200)"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"class ClusterRootController(DefaultRootController):"},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"    def root_index(self, req, tenant_id, instance_id, is_cluster):"},{"line_number":134,"context_line":"        \"\"\"Returns True if root is enabled; False otherwise.\"\"\""}],"source_content_type":"text/x-python","patch_set":10,"id":"3a71b18c_8f64cd22","line":131,"updated":"2016-12-02 19:42:32.000000000","message":"no policy checking here?","commit_id":"f72c41fa2a25ffe4ef599f59a38588554c74fd94"},{"author":{"_account_id":14576,"name":"Petr Malik","email":"pmalik@tesora.com","username":"pmalik"},"change_message_id":"134010e4cdae1efbe953b959131b4d451d87e338","unresolved":false,"context_lines":[{"line_number":128,"context_line":"        return wsgi.Result(None, 200)"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"class ClusterRootController(DefaultRootController):"},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"    def root_index(self, req, tenant_id, instance_id, is_cluster):"},{"line_number":134,"context_line":"        \"\"\"Returns True if root is enabled; False otherwise.\"\"\""}],"source_content_type":"text/x-python","patch_set":10,"id":"3a71b18c_ba1c6578","line":131,"in_reply_to":"3a71b18c_8f64cd22","updated":"2016-12-02 20:21:50.000000000","message":"ditto","commit_id":"f72c41fa2a25ffe4ef599f59a38588554c74fd94"}],"trove/guestagent/guest_log.py":[{"author":{"_account_id":9664,"name":"amrith","email":"amrith.kumar@gmail.com","username":"amrith"},"change_message_id":"82d33d10c66e0381656185d2b7a629e474c43508","unresolved":false,"context_lines":[{"line_number":209,"context_line":"                \u0027metafile\u0027: self._metafile_name()"},{"line_number":210,"context_line":"            }"},{"line_number":211,"context_line":"        else:"},{"line_number":212,"context_line":"            raise exception.LogAccessForbidden(action\u003d\u0027show\u0027, log\u003dself._name)"},{"line_number":213,"context_line":""},{"line_number":214,"context_line":"    def _refresh_details(self):"},{"line_number":215,"context_line":""}],"source_content_type":"text/x-python","patch_set":10,"id":"3a71b18c_0f27ddca","line":212,"updated":"2016-12-02 19:42:32.000000000","message":"mild raising of eyebrow on scope of change","commit_id":"f72c41fa2a25ffe4ef599f59a38588554c74fd94"},{"author":{"_account_id":14576,"name":"Petr Malik","email":"pmalik@tesora.com","username":"pmalik"},"change_message_id":"134010e4cdae1efbe953b959131b4d451d87e338","unresolved":false,"context_lines":[{"line_number":209,"context_line":"                \u0027metafile\u0027: self._metafile_name()"},{"line_number":210,"context_line":"            }"},{"line_number":211,"context_line":"        else:"},{"line_number":212,"context_line":"            raise exception.LogAccessForbidden(action\u003d\u0027show\u0027, log\u003dself._name)"},{"line_number":213,"context_line":""},{"line_number":214,"context_line":"    def _refresh_details(self):"},{"line_number":215,"context_line":""}],"source_content_type":"text/x-python","patch_set":10,"id":"3a71b18c_1528cae1","line":212,"in_reply_to":"3a71b18c_0f27ddca","updated":"2016-12-02 20:21:50.000000000","message":"I originally used unauthorized as the policy exception but that is actually wrong as the operation is authorized but forbidden.\nSo I made new exceptions for both (like we have already for ModuleAccessForbidden etc).\n\nBTW, the log code should eventually be using policies as well.","commit_id":"f72c41fa2a25ffe4ef599f59a38588554c74fd94"}],"trove/instance/service.py":[{"author":{"_account_id":10215,"name":"Peter Stachowski","email":"peter@tesora.com","username":"peterstac"},"change_message_id":"f95b62ed95ba7e3efba85c5d2f0c04ba939680a1","unresolved":false,"context_lines":[{"line_number":163,"context_line":""},{"line_number":164,"context_line":"    def _action_reset_password(self, context, instance, body):"},{"line_number":165,"context_line":"        self.authorize_instance_action(context, \u0027reset_password\u0027, instance)"},{"line_number":166,"context_line":"        raise webob.exc.HTTPNotImplemented()  # TODO(pmalik): keep this? :P"},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"    def _action_promote_to_replica_source(self, context, req, instance, body):"},{"line_number":169,"context_line":"        self.authorize_instance_action("}],"source_content_type":"text/x-python","patch_set":9,"id":"5a74a57a_8d76ec04","line":166,"range":{"start_line":166,"start_character":46,"end_line":166,"end_character":75},"updated":"2016-11-29 20:42:17.000000000","message":"My guess is removing this (even if the right thing) is out of scope of your work.  Maybe put a bug in if you think it doesn\u0027t belong - adding a comment won\u0027t compel anyone to fix it if it\u0027s required.","commit_id":"a5138fa51a36586f4ff50a45e23bbc35c787b32b"}],"trove/module/service.py":[{"author":{"_account_id":10215,"name":"Peter Stachowski","email":"peter@tesora.com","username":"peterstac"},"change_message_id":"f95b62ed95ba7e3efba85c5d2f0c04ba939680a1","unresolved":false,"context_lines":[{"line_number":165,"context_line":"        context \u003d req.environ[wsgi.CONTEXT_KEY]"},{"line_number":166,"context_line":""},{"line_number":167,"context_line":"        module \u003d models.Module.load(context, id)"},{"line_number":168,"context_line":"        self.authorize_module_action(context, \u0027update\u0027, module)"},{"line_number":169,"context_line":""},{"line_number":170,"context_line":"        instance_modules, marker \u003d models.InstanceModules.load("},{"line_number":171,"context_line":"            context, module_id\u003did)"}],"source_content_type":"text/x-python","patch_set":9,"id":"5a74a57a_4d8854c7","line":168,"range":{"start_line":168,"start_character":47,"end_line":168,"end_character":53},"updated":"2016-11-29 20:42:17.000000000","message":"(-1) this should be \u0027instances\u0027","commit_id":"a5138fa51a36586f4ff50a45e23bbc35c787b32b"}]}