Update pre-commit hook versions

update mypy, ruff versions and consume minor reformat corrections done
by the ruff.

Change-Id: I2a59eb07264ce394d93895a759c43217c6795796

.pre-commit-config.yaml

@@ -4,7 +4,7 @@ default_language_version:
   python: python3
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.6.0
+    rev: v5.0.0
     hooks:
       - id: trailing-whitespace
       - id: mixed-line-ending
@@ -23,13 +23,13 @@ repos:
   #   hooks:
   #     - id: doc8
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.6.9
+    rev: v0.11.11
     hooks:
       - id: ruff
         args: ['--fix', '--unsafe-fixes']
       - id: ruff-format
   - repo: https://github.com/PyCQA/bandit
-    rev: '1.7.9'
+    rev: '1.8.3'
     hooks:
     - id: bandit
       args: ["-x", "keystone/tests/*,devstack/*"]
@@ -41,7 +41,7 @@ repos:
           - flake8-import-order~=0.18.2
         exclude: '^(doc|releasenotes|tools|devstack)/.*$'
   - repo: https://github.com/pre-commit/mirrors-mypy
-    rev: v1.9.0
+    rev: v1.15.0
     hooks:
       - id: mypy
         additional_dependencies:

keystone/api/os_oauth1.py

@@ -259,12 +259,10 @@ class AccessTokenResource(_OAuth1ResourceBase):
                 raise exception.Unauthorized(message=msg)
             if req_token['consumer_id'] != consumer_id:
                 msg = (
-                    'Provided consumer key does not match stored consumer '
-                    'key.'
+                    'Provided consumer key does not match stored consumer key.'
                 )
                 tr_msg = _(
-                    'Provided consumer key does not match stored '
-                    'consumer key.'
+                    'Provided consumer key does not match stored consumer key.'
                 )
                 LOG.warning(msg)
                 raise exception.Unauthorized(message=tr_msg)

keystone/api/os_oauth2.py

@@ -83,9 +83,7 @@ class AccessTokenResource(ks_flask.ResourceBase):
                 http.client.responses[http.client.BAD_REQUEST],
                 _('The parameter grant_type is required.'),
             )
-            LOG.info(
-                'Get OAuth2.0 Access Token API: ' f'{error.message_format}'
-            )
+            LOG.info(f'Get OAuth2.0 Access Token API: {error.message_format}')
             raise error
         if grant_type != 'client_credentials':
             error = exception.OAuth2UnsupportedGrantType(
@@ -94,9 +92,7 @@ class AccessTokenResource(ks_flask.ResourceBase):
                 _('The parameter grant_type %s is not supported.')
                 % grant_type,
             )
-            LOG.info(
-                'Get OAuth2.0 Access Token API: ' f'{error.message_format}'
-            )
+            LOG.info(f'Get OAuth2.0 Access Token API: {error.message_format}')
             raise error
 
         auth_method = ''
@@ -202,8 +198,7 @@ class AccessTokenResource(ks_flask.ResourceBase):
                 _('Client authentication failed.'),
             )
             LOG.info(
-                'Get OAuth2.0 Access Token API: '
-                'mapping id %s is not found. ',
+                'Get OAuth2.0 Access Token API: mapping id %s is not found. ',
                 mapping_id,
             )
             raise error

keystone/api/users.py

@@ -75,9 +75,7 @@ def _format_token_entity(entity):
     if 'access_secret' in entity:
         formatted_entity.pop('access_secret')
 
-    url = (
-        f'/users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id}' '/roles'
-    )
+    url = f'/users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id}/roles'
 
     formatted_entity.setdefault('links', {})
     formatted_entity['links']['roles'] = ks_flask.base_url(url)
@@ -1027,8 +1025,7 @@ class UserAPI(ks_flask.APIBase):
         ks_flask.construct_resource_map(
             resource=UserAccessRuleGetDeleteResource,
             url=(
-                '/users/<string:user_id>/access_rules/'
-                '<string:access_rule_id>'
+                '/users/<string:user_id>/access_rules/<string:access_rule_id>'
             ),
             resource_kwargs={},
             rel='access_rule',

keystone/auth/core.py

@@ -551,8 +551,7 @@ class UserMFARulesValidator(provider_api.ProviderAPIMixin):
                 # Rule was not a list, it is invalid, drop the rule from
                 # being considered.
                 LOG.info(
-                    'Ignoring Rule %(type)r; rule must be a list of '
-                    'strings.',
+                    'Ignoring Rule %(type)r; rule must be a list of strings.',
                     {'type': type(r_list)},
                 )
                 continue

keystone/catalog/backends/sql.py

@@ -462,8 +462,7 @@ class Catalog(base.CatalogDriverBase):
         )
         if endpoint_filter_ref is None:
             msg = _(
-                'Endpoint %(endpoint_id)s not found in project '
-                '%(project_id)s'
+                'Endpoint %(endpoint_id)s not found in project %(project_id)s'
             ) % {'endpoint_id': endpoint_id, 'project_id': project_id}
             raise exception.NotFound(msg)
         return endpoint_filter_ref

keystone/cmd/bootstrap.py

@@ -309,8 +309,7 @@ class Bootstrapper:
             )
         except exception.Conflict:
             LOG.info(
-                'User %(username)s already has role %(role)s on '
-                'the system.',
+                'User %(username)s already has role %(role)s on the system.',
                 {
                     'username': self.admin_username,
                     'role': self.admin_role_name,

keystone/cmd/cli.py

@@ -1115,10 +1115,7 @@ class MappingPurge(BaseApp):
                 return resource_manager.get_domain_by_name(name)['id']
             except KeyError:
                 raise ValueError(
-                    _(
-                        "Unknown domain '%(name)s' specified by "
-                        "--domain-name"
-                    )
+                    _("Unknown domain '%(name)s' specified by --domain-name")
                     % {'name': name}
                 )
 
@@ -1618,8 +1615,7 @@ class MappingPopulate(BaseApp):
             default=None,
             required=True,
             help=(
-                "Name of the domain configured to use "
-                "domain-specific backend"
+                "Name of the domain configured to use domain-specific backend"
             ),
         )
         return parser

keystone/common/policies/base.py

@@ -49,7 +49,7 @@ SYSTEM_ADMIN = 'role:admin and system_scope:all'
 DOMAIN_READER = 'role:reader and domain_id:%(target.domain_id)s'
 RULE_SYSTEM_ADMIN_OR_OWNER = '(' + SYSTEM_ADMIN + ') or rule:owner'
 ADMIN_OR_SYSTEM_READER_OR_OWNER = (
-    '(' + RULE_ADMIN_REQUIRED + ') or ' '(' + SYSTEM_READER + ') or rule:owner'
+    '(' + RULE_ADMIN_REQUIRED + ') or (' + SYSTEM_READER + ') or rule:owner'
 )
 RULE_ADMIN_OR_SYSTEM_READER = 'rule:admin_required or (' + SYSTEM_READER + ')'
 
@@ -60,7 +60,7 @@ ADMIN_OR_SYSTEM_READER_OR_CRED_OWNER = (
     'or user_id:%(target.credential.user_id)s'
 )
 ADMIN_OR_CRED_OWNER = (
-    '(' + RULE_ADMIN_REQUIRED + ') ' 'or user_id:%(target.credential.user_id)s'
+    '(' + RULE_ADMIN_REQUIRED + ') or user_id:%(target.credential.user_id)s'
 )
 
 # This rule template is meant for restricting role assignments done by domain

keystone/common/policies/policy_association.py

@@ -219,8 +219,7 @@ policy_association_policies = [
         check_str=base.RULE_ADMIN_REQUIRED,
         scope_types=['system', 'project'],
         description=(
-            'Associate a policy to a specific region and service '
-            'combination.'
+            'Associate a policy to a specific region and service combination.'
         ),
         operations=[
             {

keystone/common/policies/protocol.py

@@ -109,8 +109,7 @@ protocol_policies = [
         operations=[
             {
                 'path': (
-                    '/v3/OS-FEDERATION/identity_providers/{idp_id}/'
-                    'protocols'
+                    '/v3/OS-FEDERATION/identity_providers/{idp_id}/protocols'
                 ),
                 'method': 'GET',
             }

keystone/common/policies/service_provider.py

@@ -60,8 +60,7 @@ service_provider_policies = [
         operations=[
             {
                 'path': (
-                    '/v3/OS-FEDERATION/service_providers/'
-                    '{service_provider_id}'
+                    '/v3/OS-FEDERATION/service_providers/{service_provider_id}'
                 ),
                 'method': 'PUT',
             }
@@ -87,15 +86,13 @@ service_provider_policies = [
         operations=[
             {
                 'path': (
-                    '/v3/OS-FEDERATION/service_providers/'
-                    '{service_provider_id}'
+                    '/v3/OS-FEDERATION/service_providers/{service_provider_id}'
                 ),
                 'method': 'GET',
             },
             {
                 'path': (
-                    '/v3/OS-FEDERATION/service_providers/'
-                    '{service_provider_id}'
+                    '/v3/OS-FEDERATION/service_providers/{service_provider_id}'
                 ),
                 'method': 'HEAD',
             },
@@ -110,8 +107,7 @@ service_provider_policies = [
         operations=[
             {
                 'path': (
-                    '/v3/OS-FEDERATION/service_providers/'
-                    '{service_provider_id}'
+                    '/v3/OS-FEDERATION/service_providers/{service_provider_id}'
                 ),
                 'method': 'PATCH',
             }
@@ -126,8 +122,7 @@ service_provider_policies = [
         operations=[
             {
                 'path': (
-                    '/v3/OS-FEDERATION/service_providers/'
-                    '{service_provider_id}'
+                    '/v3/OS-FEDERATION/service_providers/{service_provider_id}'
                 ),
                 'method': 'DELETE',
             }

keystone/common/rbac_enforcer/enforcer.py

@@ -452,8 +452,7 @@ class RBACEnforcer:
                 # if there is an error getting the target, log it and move
                 # on. Raise an explicit 403, we have failed policy checks.
                 LOG.warning(
-                    'Unable to extract inferred target data during '
-                    'enforcement'
+                    'Unable to extract inferred target data during enforcement'
                 )
                 LOG.debug(e, exc_info=True)
                 raise exception.ForbiddenAction(action=action)

keystone/common/resource_options/core.py

@@ -89,7 +89,7 @@ def resource_options_ref_to_mapper(ref, option_class):
     clear_options = set_options.difference(
         ref.resource_options_registry.option_ids
     )
-    options.update({x: None for x in clear_options})
+    options.update(dict.fromkeys(clear_options))
 
     # Set the resource options for user in the Attribute Mapping.
     for r_opt_id, r_opt_value in options.items():

keystone/common/sql/migrations/manage.py

@@ -125,7 +125,7 @@ def do_upgrade(config, cmd):
             if delta < 0:
                 msg = _('Negative delta (downgrade) not supported')
                 raise SystemExit(msg)
-            revision = '%s+%d' % (revision, delta)
+            revision = f"{revision}+{delta}"
 
         # leave branchless 'head' revision request backward compatible by
         # applying all heads in all available branches.

keystone/common/utils.py

@@ -219,12 +219,12 @@ def get_unix_user(user=None):
             try:
                 user_info = pwd.getpwuid(i)
             except KeyError:
-                raise KeyError("user id %d not found" % i)
+                raise KeyError(f"user id {i} not found")
     elif isinstance(user, int):
         try:
             user_info = pwd.getpwuid(user)
         except KeyError:
-            raise KeyError("user id %d not found" % user)
+            raise KeyError("user id {user} not found")
     elif user is None:
         user_info = pwd.getpwuid(os.geteuid())
     else:
@@ -279,12 +279,12 @@ def get_unix_group(group=None):
             try:
                 group_info = grp.getgrgid(i)
             except KeyError:
-                raise KeyError("group id %d not found" % i)
+                raise KeyError("group id {i} not found")
     elif isinstance(group, int):
         try:
             group_info = grp.getgrgid(group)
         except KeyError:
-            raise KeyError("group id %d not found" % group)
+            raise KeyError("group id {group} not found")
     elif group is None:
         group_info = grp.getgrgid(os.getegid())
     else:

keystone/exception.py

@@ -394,8 +394,7 @@ class Forbidden(SecurityError):
 
 class ForbiddenAction(Forbidden):
     message_format = _(
-        "You are not authorized to perform the"
-        " requested action: %(action)s."
+        "You are not authorized to perform the requested action: %(action)s."
     )
 
 
@@ -584,8 +583,7 @@ class LimitNotFound(NotFound):
 
 class NoLimitReference(Forbidden):
     message_format = _(
-        "Unable to create a limit that has no corresponding "
-        "registered limit."
+        "Unable to create a limit that has no corresponding registered limit."
     )
 
 
@@ -612,8 +610,7 @@ class ConfigRegistrationNotFound(Exception):
 
 class ApplicationCredentialNotFound(NotFound):
     message_format = _(
-        "Could not find Application Credential: "
-        "%(application_credential_id)s."
+        "Could not find Application Credential: %(application_credential_id)s."
     )
 
 
@@ -705,8 +702,7 @@ class NotImplemented(Error):
 
 class Gone(Error):
     message_format = _(
-        "The service you have requested is no"
-        " longer available on this server."
+        "The service you have requested is no longer available on this server."
     )
     code = int(http.client.GONE)
     title = http.client.responses[http.client.GONE]
@@ -714,8 +710,7 @@ class Gone(Error):
 
 class ConfigFileNotFound(UnexpectedError):
     debug_message_format = _(
-        "The Keystone configuration file %(config_file)s "
-        "could not be found."
+        "The Keystone configuration file %(config_file)s could not be found."
     )
 
 

keystone/federation/idp.py

@@ -590,12 +590,10 @@ class MetadataGenerator:
                 return sigver.read_cert_from_file(CONF.saml.certfile, 'pem')
             except (OSError, sigver.CertificateError) as e:
                 msg = (
-                    f'Cannot open certificate {CONF.saml.certfile}.'
-                    f'Reason: {e}'
+                    f'Cannot open certificate {CONF.saml.certfile}.Reason: {e}'
                 )
                 tr_msg = _(
-                    'Cannot open certificate %(cert_file)s.'
-                    'Reason: %(reason)s'
+                    'Cannot open certificate %(cert_file)s.Reason: %(reason)s'
                 ) % {'cert_file': CONF.saml.certfile, 'reason': e}
                 LOG.error(msg)
                 raise OSError(tr_msg)

keystone/identity/backends/ldap/common.py

@@ -1151,8 +1151,7 @@ class KeystoneLDAPHandler(LDAPHandler):
         if attrlist is not None:
             attrlist = [attr for attr in attrlist if attr is not None]
         LOG.debug(
-            'LDAP search: base=%s scope=%s filterstr=%s '
-            'attrs=%s attrsonly=%s',
+            'LDAP search: base=%s scope=%s filterstr=%s attrs=%s attrsonly=%s',
             base,
             scope,
             filterstr,
@@ -1732,7 +1731,7 @@ class BaseLdap:
         if not attr:
             attr_name = f'{self.options_name}_{self.attribute_options_names[ldap_attr_name]}_attribute'
             raise ValueError(
-                f'"{attr}" is not a valid value for' f' "{attr_name}"'
+                f'"{attr}" is not a valid value for "{attr_name}"'
             )
 
         # consider attr = "cn" and
@@ -1766,9 +1765,7 @@ class BaseLdap:
 
     def _ldap_get(self, object_id, ldap_filter=None):
         query = (
-            '(&({id_attr}={id})'
-            '{filter}'
-            '(objectClass={object_class}))'.format(
+            '(&({id_attr}={id}){filter}(objectClass={object_class}))'.format(
                 id_attr=self.id_attr,
                 id=ldap.filter.escape_filter_chars(str(object_id)),
                 filter=ldap_filter or self.ldap_filter or '',

keystone/identity/backends/sql.py

@@ -387,10 +387,7 @@ class Identity(base.IdentityDriverBase):
                 self.get_group(group_id)
                 self.get_user(user_id)
                 raise exception.NotFound(
-                    _(
-                        "User '%(user_id)s' not found in"
-                        " group '%(group_id)s'"
-                    )
+                    _("User '%(user_id)s' not found in group '%(group_id)s'")
                     % {'user_id': user_id, 'group_id': group_id}
                 )
             session.delete(membership_ref)

keystone/identity/core.py

@@ -1075,8 +1075,7 @@ class Manager(manager.Manager):
                 )
                 if project_ref['is_domain'] is True:
                     msg = _(
-                        "User's default project ID cannot be a "
-                        "domain ID: %s"
+                        "User's default project ID cannot be a domain ID: %s"
                     )
                     raise exception.ValidationError(
                         message=(msg % default_project_id)

keystone/models/token_model.py

@@ -474,8 +474,7 @@ class TokenModel:
                 'disabled'
             )
             tr_msg = _(
-                'Unable to validate token because project %(id)s is '
-                'disabled'
+                'Unable to validate token because project %(id)s is disabled'
             ) % {'id': self.project_id}
             LOG.warning(msg)
             raise exception.ProjectNotFound(tr_msg)

keystone/notifications.py

@@ -816,7 +816,9 @@ class CadfRoleAssignmentNotificationWrapper:
             Using named arguments, i.e.::
 
                 create_grant(
-                    user_id=user['id'], domain_id=domain['id'], role_id=role['id']
+                    user_id=user['id'],
+                    domain_id=domain['id'],
+                    role_id=role['id'],
                 )
 
             Or, using positional arguments, i.e.::

keystone/resource/core.py

@@ -318,10 +318,7 @@ class Manager(manager.Manager):
         for project in parents_list:
             if not project.get('enabled', True):
                 raise exception.ForbiddenNotSecurity(
-                    _(
-                        'Cannot enable project %s since it has disabled '
-                        'parents'
-                    )
+                    _('Cannot enable project %s since it has disabled parents')
                     % project_id
                 )
 

keystone/server/flask/common.py

@@ -481,8 +481,7 @@ class APIBase(metaclass=abc.ABCMeta):
         for r in self.resource_mapping:
             alt_url_json_home_data = []
             LOG.debug(
-                'Adding resource routes to API %(name)s: '
-                '[%(url)r %(kwargs)r]',
+                'Adding resource routes to API %(name)s: [%(url)r %(kwargs)r]',
                 {'name': self._name, 'url': r.url, 'kwargs': r.kwargs},
             )
             urls = [r.url]

keystone/server/flask/request_processing/middleware/auth_context.py

@@ -175,7 +175,10 @@ def render_response(body=None, status=None, headers=None, method=None):
     headers = _convert_to_str(headers)
 
     resp = webob.Response(
-        body=body, status='%d %s' % status, headerlist=headers, charset='utf-8'
+        body=body,
+        status=f"{status[0]} {status[1]}",
+        headerlist=headers,
+        charset='utf-8',
     )
 
     if method and method.upper() == 'HEAD':

keystone/tests/unit/common/test_database_conflicts.py

@@ -224,8 +224,7 @@ class DuplicateTestCase(test_v3.RestfulTestCase):
             )
         else:
             self.fail(
-                "Create duplicate federation_protocol did not raise "
-                "a conflict"
+                "Create duplicate federation_protocol did not raise a conflict"
             )
 
     def test_federation_protocol_duplicate_conflict_with_id_in_id(self):

keystone/tests/unit/common/test_utils.py

@@ -390,13 +390,11 @@ class FernetUtilsTestCase(unit.BaseTestCase):
         )
         fernet_utilities.load_keys()
         expected_debug_message = (
-            'Loaded 2 Fernet keys from %(dir)s, but `[fernet_tokens] '
-            'max_active_keys = %(max)d`; perhaps there have not been enough '
-            'key rotations to reach `max_active_keys` yet?'
-        ) % {
-            'dir': CONF.fernet_tokens.key_repository,
-            'max': CONF.fernet_tokens.max_active_keys,
-        }
+            f'Loaded 2 Fernet keys from {CONF.fernet_tokens.key_repository}, '
+            f'but `[fernet_tokens] max_active_keys = '
+            f'{CONF.fernet_tokens.max_active_keys}`; perhaps there have not '
+            'been enough key rotations to reach `max_active_keys` yet?'
+        )
         self.assertIn(expected_debug_message, logging_fixture.output)
 
     def test_debug_message_not_logged_when_loading_fernet_credential_key(self):
@@ -415,11 +413,9 @@ class FernetUtilsTestCase(unit.BaseTestCase):
         )
         fernet_utilities.load_keys()
         debug_message = (
-            'Loaded 2 Fernet keys from %(dir)s, but `[credential] '
-            'max_active_keys = %(max)d`; perhaps there have not been enough '
-            'key rotations to reach `max_active_keys` yet?'
-        ) % {
-            'dir': CONF.credential.key_repository,
-            'max': credential_fernet.MAX_ACTIVE_KEYS,
-        }
+            f'Loaded 2 Fernet keys from {CONF.credential.key_repository}, but '
+            '`[credential] max_active_keys = '
+            f'{credential_fernet.MAX_ACTIVE_KEYS}`; perhaps there have not '
+            'been enough key rotations to reach `max_active_keys` yet?'
+        )
         self.assertNotIn(debug_message, logging_fixture.output)

keystone/tests/unit/rest.py

@@ -111,8 +111,8 @@ class RestfulTestCase(unit.TestCase):
         """
         self.assertTrue(
             200 <= response.status_code <= 299,
-            'Status code %d is outside of the expected range (2xx)\n\n%s'
-            % (response.status, response.body),
+            f'Status code {response.status} is outside of the expected range '
+            f'(2xx)\n\n${response.body}',
         )
 
     def assertResponseStatus(self, response, expected_status):

keystone/tests/unit/server/test_keystone_flask.py

@@ -609,8 +609,9 @@ class TestKeystoneFlaskCommon(rest.RestfulTestCase):
             },
             'https://docs.openstack.org/api/openstack-identity/3/'
             'rel/arguments': {'href': '/v3/arguments'},
-            'https://docs.openstack.org/api/openstack-identity/3/'
-            'rel/test': {'href': '/v3/test_api'},
+            'https://docs.openstack.org/api/openstack-identity/3/rel/test': {
+                'href': '/v3/test_api'
+            },
         }
 
         resource_map = flask_common.construct_resource_map(

keystone/tests/unit/test_associate_project_endpoint_extension.py

@@ -1128,7 +1128,7 @@ class EndpointGroupCRUDTestCase(EndpointFilterTestCase):
         )
 
         # recover list of projects associated with endpoint group
-        url = f'/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}' '/projects'
+        url = f'/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}/projects'
         self.get(url, expected_status=http.client.OK)
         self.head(url, expected_status=http.client.OK)
 
@@ -1164,7 +1164,7 @@ class EndpointGroupCRUDTestCase(EndpointFilterTestCase):
         )
 
         # recover list of endpoints associated with endpoint group
-        url = f'/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}' '/endpoints'
+        url = f'/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}/endpoints'
         r = self.get(url, expected_status=http.client.OK)
         self.assertNotEmpty(r.result['endpoints'])
         self.assertEqual(endpoint_id, r.result['endpoints'][0].get('id'))
@@ -1315,7 +1315,7 @@ class EndpointGroupCRUDTestCase(EndpointFilterTestCase):
         # remove endpoint group, the associated endpoint_group project will
         # be removed as well.
         endpoint_group_url = (
-            '/OS-EP-FILTER/endpoint_groups/' f'{endpoint_group_id}'
+            f'/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}'
         )
         self.delete(endpoint_group_url)
         self.get(endpoint_group_url, expected_status=http.client.NOT_FOUND)

keystone/tests/unit/test_v3.py

@@ -1708,7 +1708,7 @@ class PaginationTestCaseBase(RestfulTestCase):
 
         # Try fetching with explicitly very high page size
         response = self.get(
-            f"/{self.resource_name}s?limit={count_resources+100}"
+            f"/{self.resource_name}s?limit={count_resources + 100}"
         )
         res_list = response.json_body[f"{self.resource_name}s"]
         res_links = response.json_body["links"]

keystone/tests/unit/test_v3_assignment.py

@@ -2236,7 +2236,7 @@ class AssignmentInheritanceTestCase(
         self.assertRoleAssignmentInListResponse(result, assignment)
 
         collection_url = (
-            '/role_assignments?include_names&' 'user.id={user_id}'.format(
+            '/role_assignments?include_names&user.id={user_id}'.format(
                 user_id=user['id']
             )
         )
@@ -2928,8 +2928,7 @@ class AssignmentInheritanceTestCase(
         # With subtree=0, we should also only get the one assignment on the
         # root project
         collection_url = (
-            f'/role_assignments?scope.project.id={root_id}'
-            '&include_subtree=0'
+            f'/role_assignments?scope.project.id={root_id}&include_subtree=0'
         )
         r = self.get(collection_url)
         self.assertValidRoleAssignmentListResponse(
@@ -3889,8 +3888,7 @@ class UserSystemRoleAssignmentTestCase(
         # make sure the role_assignment API doesn't include the system role
         # assignment when we filter based on project
         path = (
-            '/role_assignments?scope.project.id={project_id}&'
-            'user.id={user_id}'
+            '/role_assignments?scope.project.id={project_id}&user.id={user_id}'
         ).format(project_id=self.project['id'], user_id=self.user['id'])
         response = self.get(path)
         self.assertEqual(len(response.json_body['role_assignments']), 1)
@@ -3951,8 +3949,7 @@ class UserSystemRoleAssignmentTestCase(
         # make sure the role_assignment API doesn't include the system role
         # assignment when we filter based on domain
         path = (
-            '/role_assignments?scope.domain.id={domain_id}&'
-            'user.id={user_id}'
+            '/role_assignments?scope.domain.id={domain_id}&user.id={user_id}'
         ).format(domain_id=self.user['domain_id'], user_id=self.user['id'])
         response = self.get(path)
         self.assertEqual(len(response.json_body['role_assignments']), 1)
@@ -4201,7 +4198,7 @@ class GroupSystemRoleAssignmentTestCase(
 
         # assign a role to the group on a domain
         domain_member_url = (
-            '/domains/{domain_id}/groups/{group_id}/' 'roles/{role_id}'.format(
+            '/domains/{domain_id}/groups/{group_id}/roles/{role_id}'.format(
                 domain_id=group['domain_id'],
                 group_id=group['id'],
                 role_id=domain_role_id,

keystone/tests/unit/test_v3_auth.py

@@ -3474,7 +3474,7 @@ class TestTokenRevokeById(test_v3.RestfulTestCase):
         )
         # Delete the grant, which should invalidate the token
         grant_url = (
-            '/projects/{project_id}/users/{user_id}/' 'roles/{role_id}'.format(
+            '/projects/{project_id}/users/{user_id}/roles/{role_id}'.format(
                 project_id=self.project['id'],
                 user_id=self.user['id'],
                 role_id=self.role['id'],
@@ -3668,7 +3668,7 @@ class TestTokenRevokeById(test_v3.RestfulTestCase):
         )
         # Assign a role, which should not affect the token
         grant_url = (
-            '/domains/{domain_id}/users/{user_id}/' 'roles/{role_id}'.format(
+            '/domains/{domain_id}/users/{user_id}/roles/{role_id}'.format(
                 domain_id=self.domainB['id'],
                 user_id=self.user1['id'],
                 role_id=self.role1['id'],
@@ -3805,8 +3805,7 @@ class TestTokenRevokeById(test_v3.RestfulTestCase):
         # Delete the group grant, which should invalidate the
         # tokens for user1 and user2
         grant_url = (
-            '/projects/{project_id}/groups/{group_id}/'
-            'roles/{role_id}'.format(
+            '/projects/{project_id}/groups/{group_id}/roles/{role_id}'.format(
                 project_id=self.projectA['id'],
                 group_id=self.group1['id'],
                 role_id=self.role1['id'],
@@ -3865,7 +3864,7 @@ class TestTokenRevokeById(test_v3.RestfulTestCase):
         )
         # Delete the grant, which should invalidate the token
         grant_url = (
-            '/domains/{domain_id}/groups/{group_id}/' 'roles/{role_id}'.format(
+            '/domains/{domain_id}/groups/{group_id}/roles/{role_id}'.format(
                 domain_id=self.domainB['id'],
                 group_id=self.group1['id'],
                 role_id=self.role1['id'],
@@ -4979,7 +4978,7 @@ class TrustAPIBehavior(test_v3.RestfulTestCase):
         PROVIDERS.role_api.create_role(role['id'], role)
 
         grant_url = (
-            '/projects/{project_id}/users/{user_id}/' 'roles/{role_id}'.format(
+            '/projects/{project_id}/users/{user_id}/roles/{role_id}'.format(
                 project_id=self.project_id,
                 user_id=self.user_id,
                 role_id=role['id'],

keystone/tests/unit/test_v3_endpoint_policy.py

@@ -82,15 +82,14 @@ class EndpointPolicyTestCase(test_v3.RestfulTestCase):
     def test_crud_for_policy_for_explicit_endpoint(self):
         """PUT, HEAD and DELETE for explicit endpoint policy."""
         url = (
-            '/policies/{policy_id}/OS-ENDPOINT-POLICY'
-            '/endpoints/{endpoint_id}'
+            '/policies/{policy_id}/OS-ENDPOINT-POLICY/endpoints/{endpoint_id}'
         ).format(policy_id=self.policy['id'], endpoint_id=self.endpoint['id'])
         self._crud_test(url)
 
     def test_crud_for_policy_for_service(self):
         """PUT, HEAD and DELETE for service endpoint policy."""
         url = (
-            '/policies/{policy_id}/OS-ENDPOINT-POLICY' '/services/{service_id}'
+            '/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id}'
         ).format(policy_id=self.policy['id'], service_id=self.service['id'])
         self._crud_test(url)
 
@@ -116,14 +115,14 @@ class EndpointPolicyTestCase(test_v3.RestfulTestCase):
         )
 
         self.head(
-            '/endpoints/{endpoint_id}/OS-ENDPOINT-POLICY' '/policy'.format(
+            '/endpoints/{endpoint_id}/OS-ENDPOINT-POLICY/policy'.format(
                 endpoint_id=self.endpoint['id']
             ),
             expected_status=http.client.OK,
         )
 
         r = self.get(
-            '/endpoints/{endpoint_id}/OS-ENDPOINT-POLICY' '/policy'.format(
+            '/endpoints/{endpoint_id}/OS-ENDPOINT-POLICY/policy'.format(
                 endpoint_id=self.endpoint['id']
             )
         )
@@ -142,8 +141,7 @@ class EndpointPolicyTestCase(test_v3.RestfulTestCase):
 
     def test_endpoint_association_cleanup_when_endpoint_deleted(self):
         url = (
-            '/policies/{policy_id}/OS-ENDPOINT-POLICY'
-            '/endpoints/{endpoint_id}'
+            '/policies/{policy_id}/OS-ENDPOINT-POLICY/endpoints/{endpoint_id}'
         ).format(policy_id=self.policy['id'], endpoint_id=self.endpoint['id'])
 
         self.put(url)
@@ -193,7 +191,7 @@ class EndpointPolicyTestCase(test_v3.RestfulTestCase):
 
     def test_service_association_cleanup_when_service_deleted(self):
         url = (
-            '/policies/{policy_id}/OS-ENDPOINT-POLICY' '/services/{service_id}'
+            '/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id}'
         ).format(policy_id=self.policy['id'], service_id=self.service['id'])
 
         self.put(url)
@@ -207,7 +205,7 @@ class EndpointPolicyTestCase(test_v3.RestfulTestCase):
 
     def test_service_association_cleanup_when_policy_deleted(self):
         url = (
-            '/policies/{policy_id}/OS-ENDPOINT-POLICY' '/services/{service_id}'
+            '/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id}'
         ).format(policy_id=self.policy['id'], service_id=self.service['id'])
 
         self.put(url)

keystone/tests/unit/test_v3_federation.py

@@ -1514,18 +1514,18 @@ class FederatedIdentityProviderTests(test_v3.RestfulTestCase):
             # DELETE/PATCH/PUT on non-trailing `/` results in
             # METHOD_NOT_ALLOWED
             c.delete(
-                f'/v3/OS-FEDERATION/identity_providers/{idp_id}' '/protocols',
+                f'/v3/OS-FEDERATION/identity_providers/{idp_id}/protocols',
                 headers={'X-Auth-Token': token},
                 expected_status_code=http.client.METHOD_NOT_ALLOWED,
             )
             c.patch(
-                f'/v3/OS-FEDERATION/identity_providers/{idp_id}' '/protocols/',
+                f'/v3/OS-FEDERATION/identity_providers/{idp_id}/protocols/',
                 json={'protocol': protocol},
                 headers={'X-Auth-Token': token},
                 expected_status_code=http.client.METHOD_NOT_ALLOWED,
             )
             c.put(
-                f'/v3/OS-FEDERATION/identity_providers/{idp_id}' '/protocols',
+                f'/v3/OS-FEDERATION/identity_providers/{idp_id}/protocols',
                 json={'protocol': protocol},
                 headers={'X-Auth-Token': token},
                 expected_status_code=http.client.METHOD_NOT_ALLOWED,
@@ -1535,18 +1535,18 @@ class FederatedIdentityProviderTests(test_v3.RestfulTestCase):
             # remapped to without the trailing '/' by the normalization
             # middleware.
             c.delete(
-                f'/v3/OS-FEDERATION/identity_providers/{idp_id}' '/protocols/',
+                f'/v3/OS-FEDERATION/identity_providers/{idp_id}/protocols/',
                 headers={'X-Auth-Token': token},
                 expected_status_code=http.client.METHOD_NOT_ALLOWED,
             )
             c.patch(
-                f'/v3/OS-FEDERATION/identity_providers/{idp_id}' '/protocols/',
+                f'/v3/OS-FEDERATION/identity_providers/{idp_id}/protocols/',
                 json={'protocol': protocol},
                 headers={'X-Auth-Token': token},
                 expected_status_code=http.client.METHOD_NOT_ALLOWED,
             )
             c.put(
-                f'/v3/OS-FEDERATION/identity_providers/{idp_id}' '/protocols/',
+                f'/v3/OS-FEDERATION/identity_providers/{idp_id}/protocols/',
                 json={'protocol': protocol},
                 headers={'X-Auth-Token': token},
                 expected_status_code=http.client.METHOD_NOT_ALLOWED,

keystone/tests/unit/test_versions.py

@@ -157,8 +157,7 @@ BASE_ACCESS_TOKEN = (
 )
 
 FEDERATED_AUTH_URL = (
-    '/OS-FEDERATION/identity_providers/{idp_id}'
-    '/protocols/{protocol_id}/auth'
+    '/OS-FEDERATION/identity_providers/{idp_id}/protocols/{protocol_id}/auth'
 )
 FEDERATED_IDP_SPECIFIC_WEBSSO = (
     '/auth/OS-FEDERATION/identity_providers/'
@@ -849,7 +848,7 @@ class VersionTestCase(unit.TestCase):
         self.public_port = random.randint(40000, 60000)
 
         self.config_fixture.config(
-            public_endpoint='http://localhost:%d' % self.public_port
+            public_endpoint=f"http://localhost:{self.public_port}"
         )
 
     def config_overrides(self):
@@ -1036,7 +1035,7 @@ class VersionSingleAppTestCase(unit.TestCase):
         self.public_port = random.randint(40000, 60000)
 
         self.config_fixture.config(
-            public_endpoint='http://localhost:%d' % self.public_port
+            public_endpoint=f"http://localhost:{self.public_port}"
         )
 
     def config_overrides(self):

keystone/tests/unit/utils.py

@@ -101,7 +101,7 @@ def wip(message, expected_exception=Exception, bug=None):
                 )
 
             raise AssertionError(
-                f'Work In Progress Test Passed{bugstr}: ' f'{message}'
+                f'Work In Progress Test Passed{bugstr}: {message}'
             )
 
         return run_test