Fix to not use empty IN clause

When an empty IN clause is used with sqlalchemy, a warning is
printed:

 SAWarning: The IN-predicate on "assignment.actor_id" was invoked
 with an empty sequence. ...

With this fix, these warnings should no longer be printed.

The tests are changed to convert these warnings into errors.

Change-Id: I58c7e5f11fdac9bbc1e9a970ce690ea113e2bd95
Closes-Bug: #1404354

keystone/assignment/backends/sql.py

@@ -418,6 +418,10 @@ class Assignment(keystone_assignment.Driver):
 
     def _get_group_project_roles(self, session, groups, project_id,
                                  project_domain_id):
+        if not groups:
+            # If there's no groups then there will be no project roles.
+            return []
+
         # NOTE(rodrigods): First, we always include projects with
         # non-inherited assignments
         sql_constraints = sqlalchemy.and_(
@@ -436,12 +440,13 @@ class Assignment(keystone_assignment.Driver):
             # Inherited roles from projects
             project_parents = [x['id']
                                for x in self.list_project_parents(project_id)]
-            sql_constraints = sqlalchemy.or_(
-                sql_constraints,
-                sqlalchemy.and_(
-                    RoleAssignment.type == AssignmentType.GROUP_PROJECT,
-                    RoleAssignment.inherited,
-                    RoleAssignment.target_id.in_(project_parents)))
+            if project_parents:
+                sql_constraints = sqlalchemy.or_(
+                    sql_constraints,
+                    sqlalchemy.and_(
+                        RoleAssignment.type == AssignmentType.GROUP_PROJECT,
+                        RoleAssignment.inherited,
+                        RoleAssignment.target_id.in_(project_parents)))
         sql_constraints = sqlalchemy.and_(sql_constraints,
                                           RoleAssignment.actor_id.in_(groups))
 

keystone/tests/core.py

@@ -30,6 +30,7 @@ from oslo.config import fixture as config_fixture
 import oslotest.base as oslotest
 from oslotest import mockpatch
 import six
+from sqlalchemy import exc
 from testtools import testcase
 import webob
 
@@ -479,6 +480,9 @@ class TestCase(BaseTestCase):
                 logger.setLevel(level_name)
 
         warnings.filterwarnings('ignore', category=DeprecationWarning)
+        warnings.simplefilter('error', exc.SAWarning)
+        self.addCleanup(warnings.resetwarnings)
+
         self.useFixture(ksfixtures.Cache())
 
         # Clear the registry of providers so that providers from previous

keystone/tests/unit/test_core.py

@@ -13,7 +13,9 @@
 #   under the License.
 
 import sys
+import warnings
 
+from sqlalchemy import exc
 from testtools import matchers
 
 from keystone.openstack.common import log
@@ -35,3 +37,8 @@ class TestTestCase(tests.TestCase):
         self.assertThat(
             lambda: LOG.warn('String %(p1)s %(p2)s', {'p1': 'something'}),
             matchers.raises(tests.BadLog))
+
+    def test_sa_warning(self):
+        self.assertThat(
+            lambda: warnings.warn('test sa warning error', exc.SAWarning),
+            matchers.raises(exc.SAWarning))