anchor.diff:       {ro_admin, [],
         [{name, <<"Read Only Admin">>},
          {desc, <<"Can view ALL cluster features.">>}],
  -      [{[{bucket, all}, password], none},
  -       {[{bucket, all}, data], none},
  +      [{[{bucket, any}, password], none},
  +       {[{bucket, any}, data], none},
          {[admin, security], [read]},
          {[admin], none},
          {[], [read]}]},
  
positive.code: substitute_params(Params, ParamDefinitions, Permissions) ->
      ParamPairs = lists:zip(ParamDefinitions, Params),
      lists:map(fun ({ObjectPattern, AllowedOperations}) ->
                        {lists:map(fun ({Name, all}) ->
                                           {Name, all};
                                       ({Name, Param}) ->
                                           {Param, Subst} = lists:keyfind(Param, 1, ParamPairs),
                                           {Name, Subst};
  
negative.code:     ?assertMatch([{set, user_roles, _}], Upgraded),
      [{set, user_roles, UpgradedUserRoles}] = Upgraded,
      ?assertMatch(UserRoles, lists:sort(UpgradedUserRoles)).
  
  %% assertEqual is used instead of assert and assertNot to avoid
  %% dialyzer warnings
  object_match_test() ->
      ?assertEqual(true, object_match([o1, o2], [o1, o2])),
      ?assertEqual(false, object_match([o1], [o1, o2])),
      ?assertEqual(true, object_match([o1, o2], [o1])),
      ?assertEqual(true, object_match([{b, "a"}], [{b, "a"}])),
      ?assertEqual(false, object_match([{b, "a"}], [{b, "b"}])),
      ?assertEqual(true, object_match([{b, any}], [{b, "b"}])),
      ?assertEqual(false, object_match([{b, all}], [{b, "b"}])),
      ?assertEqual(true, object_match([{b, all}], [{b, any}])),
      ?assertEqual(true, object_match([{b, "a"}], [{b, any}])),
      ?assertEqual(true, object_match([{b, any}], [{b, any}])).
  
  admin_test() ->
      Roles = compile_roles([admin], preconfigured_roles()),
      ?assertEqual(true, menelaus_roles:is_allowed({[{bucket, all}], create}, Roles)).
  
  bucket_admin_test() ->
      Roles = compile_roles([{bucket_admin, ["default"]}], preconfigured_roles()),
      ?assertEqual(false, menelaus_roles:is_allowed({[{bucket,"test"}, data], read}, Roles)),
      ?assertEqual(false, menelaus_roles:is_allowed({[{bucket, all}], create}, Roles)).
  