René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"google.api_core.iam.Policy.__getitem__ does not correctly save empty bindings","articleBody":"We recently tried to upgrade a tool from 1.15.0 to 1.26.1 and found it breaks some code that handles IAM policies.  The commit that introduces the bug was released in 1.16.0: https://github.com/googleapis/python-api-core/commit/fd47fda5e3f5eca63522c8d81cffa22bc2a29ab6#diff-7cc73ea72342c139ff54060be9ff25b2f792f9225e0cc0f501dca9dbed9c4741 - \r\n\r\nThe new `__getitem__` implementation returns a new empty `set()` for roles not in the current policy.  But it doesn't save that set in the bindings.  So if the user manipulates it, the policy isn't actually updated.  That breaks code written like this:\r\n```python\r\npolicy = resource.get_iam_policy()\r\npolicy['roles/storage.objectAdmin'].add(principal)\r\nbucket.set_iam_policy(policy)\r\n```\r\nThis worked fine on v1.15.0 because of the use of `defaultdict`.  But now, this adds the principal to a set that's not used by the policy.\r\n\r\nSomething like the following (untested) patch should do the trick:\r\n```diff\r\ndiff --git a/google/api_core/iam.py b/google/api_core/iam.py\r\nindex f130936..d650336 100644\r\n--- a/google/api_core/iam.py\r\n+++ b/google/api_core/iam.py\r\n@@ -136,7 +136,9 @@ class Policy(collections_abc.MutableMapping):\r\n         for b in self._bindings:\r\n             if b[\"role\"] == key:\r\n                 return b[\"members\"]\r\n-        return set()\r\n+\r\n+        self[key] = set()\r\n+        return self[key]\r\n\r\n     def __setitem__(self, key, value):\r\n         self.__check_version__()\r\n\r\n```","author":{"url":"https://github.com/rvandegrift","@type":"Person","name":"rvandegrift"},"datePublished":"2021-03-18T19:55:20.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":2},"url":"https://github.com/154/python-api-core/issues/154"}