'Test assignment isolation.
Revoking a group role from one project should not invalidate all group
users\' tokens'

def test_removing_role_assignment_keeps_other_project_token_groups(self):

    self.assignment_api.create_grant(self.role1['id'], group_id=self.group1['id'], project_id=self.projectB['id'])
    project_token = self.get_requested_token(self.build_authentication_request(user_id=self.user1['id'], password=self.user1['password'], project_id=self.projectB['id']))
    other_project_token = self.get_requested_token(self.build_authentication_request(user_id=self.user1['id'], password=self.user1['password'], project_id=self.projectA['id']))
    self.assignment_api.delete_grant(self.role1['id'], group_id=self.group1['id'], project_id=self.projectB['id'])
    self.head('/auth/tokens', headers={'X-Subject-Token': other_project_token}, expected_status=http_client.OK)
    self.head('/auth/tokens', headers={'X-Subject-Token': project_token}, expected_status=http_client.NOT_FOUND)
    revoked_tokens = [t['id'] for t in self.token_provider_api.list_revoked_tokens()]
    self.assertIn(project_token, revoked_tokens)
