'Test deleting a group grant revokes tokens.
Test Plan:
- Get a token for user1, scoped to ProjectA
- Get a token for user2, scoped to ProjectA
- Get a token for user3, scoped to ProjectA
- Delete the grant group1 has on ProjectA
- Check tokens for user1 & user2 are no longer valid,
since user1 and user2 are members of group1
- Check token for user3 is invalid too'

def test_deleting_group_grant_revokes_tokens(self):

    auth_data = self.build_authentication_request(user_id=self.user1['id'], password=self.user1['password'], project_id=self.projectA['id'])
    token1 = self.get_requested_token(auth_data)
    auth_data = self.build_authentication_request(user_id=self.user2['id'], password=self.user2['password'], project_id=self.projectA['id'])
    token2 = self.get_requested_token(auth_data)
    auth_data = self.build_authentication_request(user_id=self.user3['id'], password=self.user3['password'], project_id=self.projectA['id'])
    token3 = self.get_requested_token(auth_data)
    self.head('/auth/tokens', headers={'X-Subject-Token': token1}, expected_status=http_client.OK)
    self.head('/auth/tokens', headers={'X-Subject-Token': token2}, expected_status=http_client.OK)
    self.head('/auth/tokens', headers={'X-Subject-Token': token3}, expected_status=http_client.OK)
    grant_url = ('/projects/%(project_id)s/groups/%(group_id)s/roles/%(role_id)s' % {'project_id': self.projectA['id'], 'group_id': self.group1['id'], 'role_id': self.role1['id']})
    self.delete(grant_url)
    self.assignment_api.delete_grant(role_id=self.role1['id'], project_id=self.projectA['id'], user_id=self.user1['id'])
    self.assignment_api.delete_grant(role_id=self.role1['id'], project_id=self.projectA['id'], user_id=self.user2['id'])
    self.head('/auth/tokens', token=token1, expected_status=http_client.UNAUTHORIZED)
    self.head('/auth/tokens', token=token2, expected_status=http_client.UNAUTHORIZED)
    self.head('/auth/tokens', headers={'X-Subject-Token': token3}, expected_status=http_client.OK)
