Can't move to or from empty policy with deprecated_rule

[Zane Bitter]

When a policy is deprecated, we allow access to requests that would be allowed by either the old or the new rule.

Currently this is implemented by sticking the string ' or ' between the old and new rules and parsing the result as a whole. That means that if either the old or new rules is an empty string then you end up with an error like:

"Failed to understand rule or role:admin: ValueError: Could not parse rule"

(With quotes that would look like "rule ' or role:admin'".)

It's possible that this works correctly with unparenthesised inputs containing and/or/not, since IIUC the 'or' operator has the lowest precedence, but I wouldn't say it was obviously correct either.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/698790

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/698790
Committed: https://git.openstack.org/cgit/openstack/oslo.policy/commit/?id=b93f51c1aa85ca4735118668d1f890ca0fbe941d
Submitter: Zuul
Branch: master

commit b93f51c1aa85ca4735118668d1f890ca0fbe941d
Author: Zane Bitter <email address hidden>
Date: Thu Dec 12 11:03:30 2019 -0500

    Don't use string processing to combine deprecated rules

    Constructing a policy string by sticking ' or ' between the new and
    deprecated check_str values is error-prone. Construct the policy
    programmatically instead by parsing the check_str values separately and
    combining them into an OrCheck.

    Change-Id: Ia2ee05aa08326c6daa214a7b1156baa6efe43dc0
    Closes-Bug: #1856207

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/oslo.policy 2.4.1 release.