openstack project cleanup could delete stacks outside the targeted project

The command "project cleanup" could delete stacks outside the targeted project

openstack project cleanup --project <project_id>

if the user executing this command has the role "admin" in <project_id> this command *could* DELETE heat stacks outside the targeted project.

Openstack: Train and Wallaby (EOL)

Example :
$ openstack --version
openstack 6.6.0

# admin operator's ENV var.
OS_REGION_NAME=RegionOne
OS_INTERFACE=public
OS_AUTH_URL=https://xxx:5000/v3
OS_PROJECT_DOMAIN_NAME=Default
OS_TENANT_NAME=admin
OS_USERNAME=admin
OS_USER_DOMAIN_NAME=Default
OS_PROJECT_NAME=admin
OS_PASSWORD=xxx
OS_IDENTITY_API_VERSION=3

# Target project ID: 7faf1ccceeeb42e48273fa5d572a843b
# 1 network : net_deleteme
# 1 subnet : sub_deleteme
# 1 instance : vm_deleteme
# 1 volume : <no_name>
# no router
# no heat stack

$ openstack stack list -f value -c ID -c Project
1aa3b658-ab86-4aab-9e67-1aafc4f6b216 803b6afac14f473eb5a580170b2533d3
d879d894-a40b-4e36-b264-ca745e1f0bc9 803b6afac14f473eb5a580170b2533d3
ddb2c804-77dd-4497-bbe8-c15280d9ea40 803b6afac14f473eb5a580170b2533d3
bb9acd57-80af-41ed-ad22-35e83638bf71 cae06487048b4458a0f0a4f667a6f11b
a0caad5e-9af2-4bc0-b9f6-94d39d16d00e cae06487048b4458a0f0a4f667a6f11b
96241fd6-a2cf-40ba-9185-9cfa7e42b110 cae06487048b4458a0f0a4f667a6f11b
cb739a08-d992-4a9e-97b5-ed159fcb39ce cae06487048b4458a0f0a4f667a6f11b

- Case 1: admin is not a member of target (OK: rejected)

$ openstack role assignment list --user admin --names -f value -c Role -c Project --project 7faf1ccceeeb42e48273fa5d572a843b
<empty output>

$ openstack project cleanup --project 7faf1ccceeeb42e48273fa5d572a843b
The request you have made requires authentication. (HTTP 401) (...)

- Case 2: admin is a member of target (OK: as expected)

$ openstack role assignment list --user admin --names -f value -c Role -c Project --project 7faf1ccceeeb42e48273fa5d572a843b
_member_ XXXXX-TEST-DELETEME@Default

$ openstack project cleanup --project 7faf1ccceeeb42e48273fa5d572a843b
+---------+--------------------------------------+--------------+
| Type | ID | Name |
+---------+--------------------------------------+--------------+
| Server | ba6c1d73-6c46-472d-bf5a-c2c6347e3602 | vm_deleteme |
| Volume | f5d7a142-2d0a-4544-bfcf-c70d851ef787 | |
| Subnet | 1e9c54b4-806f-40df-b874-c5c858af3d80 | sub_deleteme |
| Network | ba2bb7e2-a94d-4b4b-a494-3045bcd8f208 | net_deleteme |
+---------+--------------------------------------+--------------+

- Case 3: admin has the role "admin" on the target (KO: will clean resources outside target)

$ openstack role assignment list --user admin --names -f value -c Role -c Project --project 7faf1ccceeeb42e48273fa5d572a843b
admin XXXXX-TEST-DELETEME@Default

$ openstack project cleanup --project 7faf1ccceeeb42e48273fa5d572a843b
+---------+--------------------------------------+-------------------+
| Type | ID | Name |
+---------+--------------------------------------+-------------------+
| Stack | 1aa3b658-ab86-4aab-9e67-1aafc4f6b216 | wallaby_recette | <==
| Stack | d879d894-a40b-4e36-b264-ca745e1f0bc9 | train_recette | <==
| Stack | bb9acd57-80af-41ed-ad22-35e83638bf71 | nc_train_luks_vol | <==
| Stack | ddb2c804-77dd-4497-bbe8-c15280d9ea40 | nc_train_nubi2 | <==
| Stack | a0caad5e-9af2-4bc0-b9f6-94d39d16d00e | nc_train | <==
| Stack | 96241fd6-a2cf-40ba-9185-9cfa7e42b110 | r1 | <==
| Stack | cb739a08-d992-4a9e-97b5-ed159fcb39ce | nc | <==
| Server | ba6c1d73-6c46-472d-bf5a-c2c6347e3602 | vm_deleteme |
| Volume | f5d7a142-2d0a-4544-bfcf-c70d851ef787 | |
| Subnet | 1e9c54b4-806f-40df-b874-c5c858af3d80 | sub_deleteme |
| Network | ba2bb7e2-a94d-4b4b-a494-3045bcd8f208 | net_deleteme |
+---------+--------------------------------------+-------------------+

ALERT: the stacks listed here ("<==") don't belong to the target but they will be deleted by project cleanup
This behaviour affects only heat stacks.
With admin role in target, one can list all available resources in neutron and cinder (like "openstack network list" or "openstack volume list") -- this is the expected result -- but those resources are filtered correctly by cleanup and they won't be deleted.

Note : no specific policy has been defined for heat-api
the default policy still contains "system/SYSTEM"
"""
# heat/policies/stacks.py
    policy.DocumentedRuleDefault(
        name=POLICY_ROOT % 'index',
        check_str=base.SYSTEM_OR_PROJECT_READER,
        scope_types=['system', 'project'],
        description='List stacks.',
        operations=[
            {
                'path': '/v1/{tenant_id}/stacks',
                'method': 'GET'
            }
        ],
        deprecated_rule=deprecated_index
    ),
"""