text: # Copyright 2016 NTT DATA
  # All Rights Reserved.
  #
  #    Licensed under the Apache License, Version 2.0 (the "License"); you may
  #    not use this file except in compliance with the License. You may obtain
  #    a copy of the License at
  #
  #         http://www.apache.org/licenses/LICENSE-2.0
  #
  #    Unless required by applicable law or agreed to in writing, software
  #    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  #    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
  #    License for the specific language governing permissions and limitations
  #    under the License.
  
  """Policy Engine For Masakari."""
  
  import logging
  
  from oslo_config import cfg
  from oslo_policy import policy
  from oslo_utils import excutils
  
  from masakari import exception
  
  
  CONF = cfg.CONF
  LOG = logging.getLogger(__name__)
  _ENFORCER = None
  
  
  def reset():
      global _ENFORCER
      if _ENFORCER:
          _ENFORCER.clear()
          _ENFORCER = None
  
  
  def init(policy_file=None, rules=None, default_rule=None, use_conf=True):
      """Init an Enforcer class.
  
         :param policy_file: Custom policy file to use, if none is specified,
                             `CONF.policy_file` will be used.
         :param rules: Default dictionary / Rules to use. It will be
                       considered just in the first instantiation.
         :param default_rule: Default rule to use, CONF.default_rule will
                              be used if none is specified.
         :param use_conf: Whether to load rules from config file.
      """
      global _ENFORCER
      if not _ENFORCER:
          _ENFORCER = policy.Enforcer(CONF,
                                      policy_file=policy_file,
                                      rules=rules,
                                      default_rule=default_rule,
                                      use_conf=use_conf)
  
  
  def set_rules(rules, overwrite=True, use_conf=False):
      """Set rules based on the provided dict of rules.
  
         :param rules: New rules to use. It should be an instance of dict.
         :param overwrite: Whether to overwrite current rules or update them
                           with the new rules.
         :param use_conf: Whether to reload rules from config file.
      """
  
      init(use_conf=False)
      _ENFORCER.set_rules(rules, overwrite, use_conf)
  
  
  def enforce(context, action, target, do_raise=True, exc=None):
      """Verifies that the action is valid on the target in this context.
  
         :param context: masakari context
         :param action: string representing the action to be checked
             this should be colon separated for clarity.
         :param target: dictionary representing the object of the action
             for object creation this should be a dictionary representing the
             location of the object e.g. ``{'project_id': context.project_id}``
         :param do_raise: if True (the default), raises PolicyNotAuthorized;
             if False, returns False
  
         :raises masakari.exception.PolicyNotAuthorized: if verification fails
             and do_raise is True.
  
         :return: returns a non-False value (not necessarily "True") if
             authorized, and the exact value False if not authorized and
             do_raise is False.
      """
      init()
      credentials = context.to_dict()
      if not exc:
          exc = exception.PolicyNotAuthorized
      try:
          result = _ENFORCER.enforce(action, target, credentials,
                                     do_raise=do_raise, exc=exc, action=action)
      except Exception:
          credentials.pop('auth_token', None)
          with excutils.save_and_reraise_exception():
              LOG.debug('Policy check for %(action)s failed with credentials '
                        '%(credentials)s',
                        {'action': action, 'credentials': credentials})
      return result
  
  
  def check_is_admin(context):
      """Whether or not roles contains 'admin' role according to policy setting.
  
      """
  
      init()
      # the target is user-self
      credentials = context.to_dict()
      target = credentials
      return _ENFORCER.enforce('context_is_admin', target, credentials)
  
  
  @policy.register('is_admin')
  class IsAdminCheck(policy.Check):
      """An explicit check for is_admin."""
  
      def __init__(self, kind, match):
          """Initialize the check."""
  
          self.expected = (match.lower() == 'true')
  
          super(IsAdminCheck, self).__init__(kind, str(self.expected))
  
      def __call__(self, target, creds, enforcer):
          """Determine whether is_admin matches the requested value."""
  
          return creds['is_admin'] == self.expected
  
  
  def get_rules():
      if _ENFORCER:
          return _ENFORCER.rules
  