anchor.diff:      ?assertEqual(
          lists:sort(Formatted),
          lists:sort(format_permissions(Permissions))).
  -
  -forbidden_response(Permissions) when is_list(Permissions) ->
  -    {[{message, <<"Forbidden. User needs one of the following permissions">>},
  -      {permissions, format_permissions(Permissions)}]};
  -forbidden_response(Permission) ->
  -    forbidden_response([Permission]).
  -
  -handle_get_password_policy(Req) ->
  -    menelaus_web:assert_is_spock(),
  -    {MinLength, MustPresent} = get_password_policy(),
  -    menelaus_util:reply_json(Req,
  -                             {[{minLength, MinLength},
  -                               {enforceUppercase, lists:member(uppercase, MustPresent)},
  -                               {enforceLowercase, lists:member(lowercase, MustPresent)},
  -                               {enforceDigits, lists:member(digits, MustPresent)},
  -                               {enforceSpecialChars, lists:member(special, MustPresent)}]}).
  -
  -validate_post_password_policy(Args) ->
  -    R0 = menelaus_util:validate_has_params({Args, [], []}),
  -    R1 = menelaus_util:validate_required(minLength, R0),
  -    R2 = menelaus_util:validate_integer(minLength, R1),
  -    R3 = menelaus_util:validate_range(minLength, 0, 100, R2),
  -    R4 = menelaus_util:validate_boolean(enforceUppercase, R3),
  -    R5 = menelaus_util:validate_boolean(enforceLowercase, R4),
  -    R6 = menelaus_util:validate_boolean(enforceDigits, R5),
  -    R7 = menelaus_util:validate_boolean(enforceSpecialChars, R6),
  -    menelaus_util:validate_unsupported_params(R7).
  -
  -must_present_value(JsonField, MustPresentAtom, Args) ->
  -    case proplists:get_value(JsonField, Args) of
  -        true ->
  -            [MustPresentAtom];
  -        _ ->
  -            []
  -    end.
  -
  -handle_post_password_policy(Req) ->
  -    menelaus_util:execute_if_validated(
  -      fun (Values) ->
  -              Policy = [{min_length, proplists:get_value(minLength, Values)},
  -                        {must_present,
  -                         must_present_value(enforceUppercase, uppercase, Values) ++
  -                             must_present_value(enforceLowercase, lowercase, Values) ++
  -                             must_present_value(enforceDigits, digits, Values) ++
  -                             must_present_value(enforceSpecialChars, special, Values)}],
  -              ns_config:set(password_policy, Policy),
  -              ns_audit:password_policy(Req, Policy),
  -              menelaus_util:reply(Req, 200)
  -      end, Req, validate_post_password_policy(Req:parse_post())).
  -
  -assert_no_users_upgrade() ->
  -    case menelaus_users:upgrade_status() of
  -        undefined ->
  -            ok;
  -        started ->
  -            erlang:throw({web_exception,
  -                          503,
  -                          "Not allowed during cluster upgrade.",
  -                          []})
  -    end.
  
positive.code:                       {Trimmed, parse_permission(Trimmed)}
                end, RawPermissions).
  
  parse_permissions_test() ->
      ?assertMatch(
         [{"cluster.admin!write", {[admin], write}},
          {"cluster.admin", error},
          {"admin!write", error}],
         parse_permissions("cluster.admin!write, cluster.admin, admin!write")),
      ?assertMatch(
         [{"cluster.bucket[test.test]!read", {[{bucket, "test.test"}], read}},
          {"cluster.bucket[test.test].stats!read", {[{bucket, "test.test"}, stats], read}}],
         parse_permissions(" cluster.bucket[test.test]!read, cluster.bucket[test.test].stats!read ")),
      ?assertMatch(
         [{"cluster.no_such_atom!no_such_atom", {['_unknown_'], '_unknown_'}}],
         parse_permissions("cluster.no_such_atom!no_such_atom")).
  
  handle_check_permissions_post(Req) ->
      Body = Req:recv_body(),
      case Body of
  
negative.code:                         [iolist_to_binary(permission_to_iolist(Permission)) | Acc]
                  end, [], Permissions).
  
  forbidden_response(Permissions) when is_list(Permissions) ->
      {[{message, <<"Forbidden. User needs one of the following permissions">>},
        {permissions, format_permissions(Permissions)}]};
  forbidden_response(Permission) ->
      forbidden_response([Permission]).
  
  handle_get_password_policy(Req) ->
      menelaus_web:assert_is_spock(),
      {MinLength, MustPresent} = get_password_policy(),
      menelaus_util:reply_json(Req,
                               {[{minLength, MinLength},
                                 {enforceUppercase, lists:member(uppercase, MustPresent)},
                                 {enforceLowercase, lists:member(lowercase, MustPresent)},
                                 {enforceDigits, lists:member(digits, MustPresent)},
                                 {enforceSpecialChars, lists:member(special, MustPresent)}]}).
  
  validate_post_password_policy(Args) ->
      R0 = menelaus_util:validate_has_params({Args, [], []}),
      R1 = menelaus_util:validate_required(minLength, R0),
      R2 = menelaus_util:validate_integer(minLength, R1),
      R3 = menelaus_util:validate_range(minLength, 0, 100, R2),
      R4 = menelaus_util:validate_boolean(enforceUppercase, R3),
      R5 = menelaus_util:validate_boolean(enforceLowercase, R4),
      R6 = menelaus_util:validate_boolean(enforceDigits, R5),
      R7 = menelaus_util:validate_boolean(enforceSpecialChars, R6),
      menelaus_util:validate_unsupported_params(R7).
  
  must_present_value(JsonField, MustPresentAtom, Args) ->
      case proplists:get_value(JsonField, Args) of
          true ->
              [MustPresentAtom];
          _ ->
              []
      end.
  
  handle_post_password_policy(Req) ->
      menelaus_util:execute_if_validated(
        fun (Values) ->
                Policy = [{min_length, proplists:get_value(minLength, Values)},
                          {must_present,
                           must_present_value(enforceUppercase, uppercase, Values) ++
                               must_present_value(enforceLowercase, lowercase, Values) ++
                               must_present_value(enforceDigits, digits, Values) ++
                               must_present_value(enforceSpecialChars, special, Values)}],
                ns_config:set(password_policy, Policy),
                ns_audit:password_policy(Req, Policy),
                menelaus_util:reply(Req, 200)
        end, Req, validate_post_password_policy(Req:parse_post())).
  
  assert_no_users_upgrade() ->
      case menelaus_users:upgrade_status() of
          undefined ->
              ok;
          started ->
              erlang:throw({web_exception,
                            503,
                            "Not allowed during cluster upgrade.",
                            []})
      end.
  
  %% Tests
  parse_roles_test() ->
      Res = parse_roles("admin, bucket_admin[test.test], bucket_admin[*], no_such_atom, bucket_admin[default"),
      ?assertMatch([admin,
                    {bucket_admin, ["test.test"]},
                    {bucket_admin, [any]},
                    {error, "no_such_atom"},
                    {error, "bucket_admin[default"}], Res).
  
  parse_permissions_test() ->
      ?assertMatch(
         [{"cluster.admin!write", {[admin], write}},
          {"cluster.admin", error},
          {"admin!write", error}],
         parse_permissions("cluster.admin!write, cluster.admin, admin!write")),
      ?assertMatch(
         [{"cluster.bucket[test.test]!read", {[{bucket, "test.test"}], read}},
          {"cluster.bucket[test.test].stats!read", {[{bucket, "test.test"}, stats], read}}],
         parse_permissions(" cluster.bucket[test.test]!read, cluster.bucket[test.test].stats!read ")),
      ?assertMatch(
         [{"cluster.no_such_atom!no_such_atom", {['_unknown_'], '_unknown_'}}],
         parse_permissions("cluster.no_such_atom!no_such_atom")).
  
  format_permissions_test() ->
      Permissions = [{[{bucket, any}, views], write},
                     {[{bucket, "default"}], all},
  