<NME> test_trusts.py
<BEF> ADDFILE
<MSG> Merge "Add protection tests for trusts API"
<DFF> @@ -0,0 +1,503 @@
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+import uuid
+
+from six.moves import http_client
+
+from keystone.common import provider_api
+import keystone.conf
+from keystone.tests.common import auth as common_auth
+from keystone.tests import unit
+from keystone.tests.unit import base_classes
+from keystone.tests.unit import ksfixtures
+
+CONF = keystone.conf.CONF
+PROVIDERS = provider_api.ProviderAPIs
+
+
+class TrustTests(base_classes.TestCaseWithBootstrap,
+                 common_auth.AuthTestMixin):
+    """Common functionality for all trust tests.
+
+    Sets up trustor and trustee users and trust.
+    """
+
+    def setUp(self):
+        super(TrustTests, self).setUp()
+        self.loadapp()
+        self.useFixture(ksfixtures.Policy(self.config_fixture))
+
+        domain = PROVIDERS.resource_api.create_domain(
+            uuid.uuid4().hex, unit.new_domain_ref()
+        )
+        self.domain_id = domain['id']
+
+        trustor_user = unit.new_user_ref(domain_id=self.domain_id)
+        self.trustor_user_id = PROVIDERS.identity_api.create_user(
+            trustor_user)['id']
+        trustee_user = unit.new_user_ref(domain_id=self.domain_id)
+        self.trustee_user_id = PROVIDERS.identity_api.create_user(
+            trustee_user)['id']
+        project = PROVIDERS.resource_api.create_project(
+            uuid.uuid4().hex, unit.new_project_ref(domain_id=self.domain_id)
+        )
+        self.project_id = project['id']
+        PROVIDERS.assignment_api.create_grant(
+            self.bootstrapper.member_role_id, user_id=self.trustor_user_id,
+            project_id=self.project_id
+        )
+        PROVIDERS.assignment_api.create_grant(
+            self.bootstrapper.member_role_id, user_id=self.trustee_user_id,
+            project_id=project['id']
+        )
+        self.trust_id = uuid.uuid4().hex
+        self.trust_data = {
+            'trust': {'trustor_user_id': self.trustor_user_id,
+                      'trustee_user_id': self.trustee_user_id,
+                      'project_id': self.project_id,
+                      'impersonation': False},
+            'roles': [{"id": self.bootstrapper.member_role_id}]
+        }
+        auth = self.build_authentication_request(
+            user_id=self.trustor_user_id,
+            password=trustor_user['password'],
+            project_id=project['id']
+        )
+        # Grab a token using the trustor persona we're testing and prepare
+        # headers for requests we'll be making in the tests.
+        with self.test_client() as c:
+            r = c.post('/v3/auth/tokens', json=auth)
+            self.token_id = r.headers['X-Subject-Token']
+            self.trustor_headers = {'X-Auth-Token': self.token_id}
+
+        auth = self.build_authentication_request(
+            user_id=self.trustee_user_id,
+            password=trustee_user['password'],
+            project_id=project['id']
+        )
+        # Grab a token using the trustee persona we're testing and prepare
+        # headers for requests we'll be making in the tests.
+        with self.test_client() as c:
+            r = c.post('/v3/auth/tokens', json=auth)
+            self.token_id = r.headers['X-Subject-Token']
+            self.trustee_headers = {'X-Auth-Token': self.token_id}
+
+
+class _AdminTestsMixin(object):
+    """Tests for all admin users.
+
+    This exercises both the is_admin user and users granted the admin role on
+    the system scope.
+    """
+
+    def test_admin_cannot_create_trust_for_other_user(self):
+        json = {'trust': self.trust_data['trust']}
+        json['trust']['roles'] = self.trust_data['roles']
+
+        with self.test_client() as c:
+            c.post(
+                '/v3/OS-TRUST/trusts',
+                json=json,
+                headers=self.headers,
+                expected_status_code=http_client.FORBIDDEN
+            )
+
+    def test_admin_list_all_trusts(self):
+        PROVIDERS.trust_api.create_trust(
+            self.trust_id, **self.trust_data)
+
+        with self.test_client() as c:
+            r = c.get(
+                '/v3/OS-TRUST/trusts',
+                headers=self.headers
+            )
+        self.assertEqual(1, len(r.json['trusts']))
+
+    def test_admin_cannot_get_trust_for_other_user(self):
+        PROVIDERS.trust_api.create_trust(
+            self.trust_id, **self.trust_data)
+
+        with self.test_client() as c:
+            c.get(
+                '/v3/OS-TRUST/trusts/%s' % self.trust_id,
+                headers=self.headers,
+                expected_status_code=http_client.FORBIDDEN
+            )
+
+    def test_admin_can_get_non_existent_trust_not_found(self):
+        trust_id = uuid.uuid4().hex
+        with self.test_client() as c:
+            c.get(
+                '/v3/OS-TRUST/trusts/%s' % trust_id,
+                headers=self.headers,
+                expected_status_code=http_client.NOT_FOUND
+            )
+
+    def test_admin_cannot_list_trust_roles_for_other_user(self):
+        PROVIDERS.trust_api.create_trust(
+            self.trust_id, **self.trust_data)
+
+        with self.test_client() as c:
+            c.get(
+                '/v3/OS-TRUST/trusts/%s/roles' % self.trust_id,
+                headers=self.headers,
+                expected_status_code=http_client.FORBIDDEN
+            )
+
+    def test_admin_cannot_get_trust_role_for_other_user(self):
+        PROVIDERS.trust_api.create_trust(
+            self.trust_id, **self.trust_data)
+
+        with self.test_client() as c:
+            c.get(
+                ('/v3/OS-TRUST/trusts/%s/roles/%s' %
+                 (self.trust_id, self.bootstrapper.member_role_id)),
+                headers=self.headers,
+                expected_status_code=http_client.FORBIDDEN
+            )
+
+
+class AdminTokenTests(TrustTests, _AdminTestsMixin):
+    """Tests for the is_admin user.
+
+    The Trusts API has hardcoded is_admin checks that we need to ensure are
+    preserved through the system-scope transition.
+    """
+
+    def setUp(self):
+        super(AdminTokenTests, self).setUp()
+        self.config_fixture.config(admin_token='ADMIN')
+        self.headers = {'X-Auth-Token': 'ADMIN'}
+
+    def test_admin_can_delete_trust_for_other_user(self):
+        ref = PROVIDERS.trust_api.create_trust(
+            self.trust_id, **self.trust_data)
+
+        with self.test_client() as c:
+            c.delete(
+                '/v3/OS-TRUST/trusts/%s' % ref['id'],
+                headers=self.headers,
+                expected_status_code=http_client.NO_CONTENT
+            )
+
+
+class SystemAdminTests(TrustTests, _AdminTestsMixin):
+    """Tests for system admin users."""
+
+    def setUp(self):
+        super(SystemAdminTests, self).setUp()
+        # TODO(cmurphy) enable enforce_scope when trust policies become
+        # system-scope aware
+        # self.config_fixture.config(group='oslo_policy', enforce_scope=True)
+
+        self.user_id = self.bootstrapper.admin_user_id
+        auth = self.build_authentication_request(
+            user_id=self.user_id,
+            password=self.bootstrapper.admin_password,
+            system=True
+        )
+
+        # Grab a token using the persona we're testing and prepare headers
+        # for requests we'll be making in the tests.
+        with self.test_client() as c:
+            r = c.post('/v3/auth/tokens', json=auth)
+            self.token_id = r.headers['X-Subject-Token']
+            self.headers = {'X-Auth-Token': self.token_id}
+
+    def test_admin_cannot_delete_trust_for_other_user(self):
+        # only the is_admin admin can do this
+        ref = PROVIDERS.trust_api.create_trust(
+            self.trust_id, **self.trust_data)
+
+        with self.test_client() as c:
+            c.delete(
+                '/v3/OS-TRUST/trusts/%s' % ref['id'],
+                headers=self.headers,
+                expected_status_code=http_client.FORBIDDEN
+            )
+
+
+class ProjectUserTests(TrustTests):
+    """Tests for all project users."""
+
+    def setUp(self):
+        super(ProjectUserTests, self).setUp()
+        other_user = unit.new_user_ref(domain_id=self.domain_id)
+        self.other_user_id = PROVIDERS.identity_api.create_user(
+            other_user)['id']
+        PROVIDERS.assignment_api.create_grant(
+            self.bootstrapper.member_role_id, user_id=self.other_user_id,
+            project_id=self.project_id
+        )
+
+        auth = self.build_authentication_request(
+            user_id=self.other_user_id,
+            password=other_user['password'],
+            project_id=self.project_id
+        )
+        # Grab a token using another persona who has no trusts associated with
+        # them
+        with self.test_client() as c:
+            r = c.post('/v3/auth/tokens', json=auth)
+            self.token_id = r.headers['X-Subject-Token']
+            self.other_headers = {'X-Auth-Token': self.token_id}
+
+    def test_user_can_list_trusts_of_whom_they_are_the_trustor(self):
+        PROVIDERS.trust_api.create_trust(
+            self.trust_id, **self.trust_data)
+
+        with self.test_client() as c:
+            r = c.get(
+                ('/v3/OS-TRUST/trusts?trustor_user_id=%s' %
+                 self.trustor_user_id),
+                headers=self.trustor_headers
+            )
+        self.assertEqual(1, len(r.json['trusts']))
+        self.assertEqual(self.trust_id, r.json['trusts'][0]['id'])
+
+    def test_user_can_list_trusts_delegated_to_them(self):
+        PROVIDERS.trust_api.create_trust(
+            self.trust_id, **self.trust_data)
+
+        with self.test_client() as c:
+            r = c.get(
+                ('/v3/OS-TRUST/trusts?trustee_user_id=%s' %
+                 self.trustee_user_id),
+                headers=self.trustee_headers
+            )
+        self.assertEqual(1, len(r.json['trusts']))
+        self.assertEqual(self.trust_id, r.json['trusts'][0]['id'])
+
+    def test_trustor_cannot_list_trusts_for_trustee(self):
+        PROVIDERS.trust_api.create_trust(
+            self.trust_id, **self.trust_data)
+
+        with self.test_client() as c:
+            c.get(
+                ('/v3/OS-TRUST/trusts?trustee_user_id=%s' %
+                 self.trustee_user_id),
+                headers=self.trustor_headers,
+                expected_status_code=http_client.FORBIDDEN
+            )
+
+    def test_trustee_cannot_list_trusts_for_trustor(self):
+        PROVIDERS.trust_api.create_trust(
+            self.trust_id, **self.trust_data)
+
+        with self.test_client() as c:
+            c.get(
+                ('/v3/OS-TRUST/trusts?trustor_user_id=%s' %
+                 self.trustor_user_id),
+                headers=self.trustee_headers,
+                expected_status_code=http_client.FORBIDDEN
+            )
+
+    def test_user_cannot_list_trusts_for_other_trustor(self):
+        PROVIDERS.trust_api.create_trust(
+            self.trust_id, **self.trust_data)
+
+        with self.test_client() as c:
+            c.get(
+                ('/v3/OS-TRUST/trusts?trustor_user_id=%s' %
+                 self.trustor_user_id),
+                headers=self.other_headers,
+                expected_status_code=http_client.FORBIDDEN
+            )
+
+    def test_user_cannot_list_trusts_for_other_trustee(self):
+        PROVIDERS.trust_api.create_trust(
+            self.trust_id, **self.trust_data)
+
+        with self.test_client() as c:
+            c.get(
+                ('/v3/OS-TRUST/trusts?trustee_user_id=%s' %
+                 self.trustee_user_id),
+                headers=self.other_headers,
+                expected_status_code=http_client.FORBIDDEN
+            )
+
+    def test_user_cannot_list_all_trusts(self):
+        PROVIDERS.trust_api.create_trust(
+            self.trust_id, **self.trust_data)
+
+        with self.test_client() as c:
+            c.get(
+                '/v3/OS-TRUST/trusts',
+                headers=self.trustee_headers,
+                expected_status_code=http_client.FORBIDDEN
+            )
+
+    def test_user_cannot_get_another_users_trust(self):
+        ref = PROVIDERS.trust_api.create_trust(
+            self.trust_id, **self.trust_data)
+
+        with self.test_client() as c:
+            c.get(
+                '/v3/OS-TRUST/trusts/%s' % ref['id'],
+                headers=self.other_headers,
+                expected_status_code=http_client.FORBIDDEN
+            )
+
+    def test_user_can_get_non_existent_trust_not_found(self):
+        trust_id = uuid.uuid4().hex
+        with self.test_client() as c:
+            c.get(
+                '/v3/OS-TRUST/trusts/%s' % trust_id,
+                headers=self.other_headers,
+                expected_status_code=http_client.NOT_FOUND
+            )
+
+    def test_user_can_get_trust_of_whom_they_are_the_trustor(self):
+        ref = PROVIDERS.trust_api.create_trust(
+            self.trust_id, **self.trust_data)
+
+        with self.test_client() as c:
+            c.get(
+                '/v3/OS-TRUST/trusts/%s' % ref['id'],
+                headers=self.trustor_headers
+            )
+
+    def test_user_can_get_trust_delegated_to_them(self):
+        ref = PROVIDERS.trust_api.create_trust(
+            self.trust_id, **self.trust_data)
+
+        with self.test_client() as c:
+            r = c.get(
+                '/v3/OS-TRUST/trusts/%s' % ref['id'],
+                headers=self.trustee_headers
+            )
+        self.assertEqual(r.json['trust']['id'], self.trust_id)
+
+    def test_trustor_can_create_trust(self):
+        json = {'trust': self.trust_data['trust']}
+        json['trust']['roles'] = self.trust_data['roles']
+
+        with self.test_client() as c:
+            c.post(
+                '/v3/OS-TRUST/trusts',
+                json=json,
+                headers=self.trustor_headers
+            )
+
+    def test_trustee_cannot_create_trust(self):
+        json = {'trust': self.trust_data['trust']}
+        json['trust']['roles'] = self.trust_data['roles']
+
+        with self.test_client() as c:
+            c.post(
+                '/v3/OS-TRUST/trusts',
+                json=json,
+                headers=self.trustee_headers,
+                expected_status_code=http_client.FORBIDDEN
+            )
+
+    def test_trustor_can_delete_trust(self):
+        ref = PROVIDERS.trust_api.create_trust(
+            self.trust_id, **self.trust_data)
+
+        with self.test_client() as c:
+            c.delete(
+                '/v3/OS-TRUST/trusts/%s' % ref['id'],
+                headers=self.trustor_headers
+            )
+
+    def test_trustee_cannot_delete_trust(self):
+        ref = PROVIDERS.trust_api.create_trust(
+            self.trust_id, **self.trust_data)
+
+        with self.test_client() as c:
+            c.delete(
+                '/v3/OS-TRUST/trusts/%s' % ref['id'],
+                headers=self.trustee_headers,
+                expected_status_code=http_client.FORBIDDEN
+            )
+
+    def test_user_cannot_delete_trust_for_other_user(self):
+        ref = PROVIDERS.trust_api.create_trust(
+            self.trust_id, **self.trust_data)
+
+        with self.test_client() as c:
+            c.delete(
+                '/v3/OS-TRUST/trusts/%s' % ref['id'],
+                headers=self.other_headers,
+                expected_status_code=http_client.FORBIDDEN
+            )
+
+    def test_trustor_can_list_trust_roles(self):
+        PROVIDERS.trust_api.create_trust(
+            self.trust_id, **self.trust_data)
+
+        with self.test_client() as c:
+            r = c.get(
+                '/v3/OS-TRUST/trusts/%s/roles' % self.trust_id,
+                headers=self.trustor_headers
+            )
+        self.assertEqual(r.json['roles'][0]['id'],
+                         self.bootstrapper.member_role_id)
+
+    def test_trustee_can_list_trust_roles(self):
+        PROVIDERS.trust_api.create_trust(
+            self.trust_id, **self.trust_data)
+
+        with self.test_client() as c:
+            r = c.get(
+                '/v3/OS-TRUST/trusts/%s/roles' % self.trust_id,
+                headers=self.trustee_headers
+            )
+        self.assertEqual(r.json['roles'][0]['id'],
+                         self.bootstrapper.member_role_id)
+
+    def test_user_cannot_list_trust_roles_for_other_user(self):
+        PROVIDERS.trust_api.create_trust(
+            self.trust_id, **self.trust_data)
+
+        with self.test_client() as c:
+            c.get(
+                '/v3/OS-TRUST/trusts/%s/roles' % self.trust_id,
+                headers=self.other_headers,
+                expected_status_code=http_client.FORBIDDEN
+            )
+
+    def test_trustor_can_get_trust_role(self):
+        PROVIDERS.trust_api.create_trust(
+            self.trust_id, **self.trust_data)
+
+        with self.test_client() as c:
+            c.head(
+                ('/v3/OS-TRUST/trusts/%s/roles/%s' %
+                 (self.trust_id, self.bootstrapper.member_role_id)),
+                headers=self.trustor_headers
+            )
+
+    def test_trustee_can_get_trust_role(self):
+        PROVIDERS.trust_api.create_trust(
+            self.trust_id, **self.trust_data)
+
+        with self.test_client() as c:
+            c.head(
+                ('/v3/OS-TRUST/trusts/%s/roles/%s' %
+                 (self.trust_id, self.bootstrapper.member_role_id)),
+                headers=self.trustee_headers
+            )
+
+    def test_user_cannot_get_trust_role_for_other_user(self):
+        PROVIDERS.trust_api.create_trust(
+            self.trust_id, **self.trust_data)
+
+        with self.test_client() as c:
+            c.head(
+                ('/v3/OS-TRUST/trusts/%s/roles/%s' %
+                 (self.trust_id, self.bootstrapper.member_role_id)),
+                headers=self.other_headers,
+                expected_status_code=http_client.FORBIDDEN
+            )

{'commit': 'diff --git a/keystone/api/trusts.py b/keystone/api/trusts.py\nindex 1573e209d..9ac171800 100644\n--- a/keystone/api/trusts.py\n+++ b/keystone/api/trusts.py\n@@ -85,6 +85,8 @@ class TrustResource(ks_flask.ResourceBase):\n     json_home_parameter_rel_func = _build_parameter_relation\n \n     def _check_unrestricted(self):\n+        if self.oslo_context.is_admin:\n+            return\n         token = self.auth_context[\'token\']\n         if \'application_credential\' in token.methods:\n             if not token.application_credential[\'unrestricted\']:\ndiff --git a/keystone/tests/unit/protection/v3/test_trusts.py b/keystone/tests/unit/protection/v3/test_trusts.py\nnew file mode 100644\nindex 000000000..15b090273\n--- /dev/null\n+++ b/keystone/tests/unit/protection/v3/test_trusts.py\n@@ -0,0 +1,503 @@\n+#    Licensed under the Apache License, Version 2.0 (the "License"); you may\n+#    not use this file except in compliance with the License. You may obtain\n+#    a copy of the License at\n+#\n+#         http://www.apache.org/licenses/LICENSE-2.0\n+#\n+#    Unless required by applicable law or agreed to in writing, software\n+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT\n+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the\n+#    License for the specific language governing permissions and limitations\n+#    under the License.\n+\n+import uuid\n+\n+from six.moves import http_client\n+\n+from keystone.common import provider_api\n+import keystone.conf\n+from keystone.tests.common import auth as common_auth\n+from keystone.tests import unit\n+from keystone.tests.unit import base_classes\n+from keystone.tests.unit import ksfixtures\n+\n+CONF = keystone.conf.CONF\n+PROVIDERS = provider_api.ProviderAPIs\n+\n+\n+class TrustTests(base_classes.TestCaseWithBootstrap,\n+                 common_auth.AuthTestMixin):\n+    """Common functionality for all trust tests.\n+\n+    Sets up trustor and trustee users and trust.\n+    """\n+\n+    def setUp(self):\n+        super(TrustTests, self).setUp()\n+        self.loadapp()\n+        self.useFixture(ksfixtures.Policy(self.config_fixture))\n+\n+        domain = PROVIDERS.resource_api.create_domain(\n+            uuid.uuid4().hex, unit.new_domain_ref()\n+        )\n+        self.domain_id = domain[\'id\']\n+\n+        trustor_user = unit.new_user_ref(domain_id=self.domain_id)\n+        self.trustor_user_id = PROVIDERS.identity_api.create_user(\n+            trustor_user)[\'id\']\n+        trustee_user = unit.new_user_ref(domain_id=self.domain_id)\n+        self.trustee_user_id = PROVIDERS.identity_api.create_user(\n+            trustee_user)[\'id\']\n+        project = PROVIDERS.resource_api.create_project(\n+            uuid.uuid4().hex, unit.new_project_ref(domain_id=self.domain_id)\n+        )\n+        self.project_id = project[\'id\']\n+        PROVIDERS.assignment_api.create_grant(\n+            self.bootstrapper.member_role_id, user_id=self.trustor_user_id,\n+            project_id=self.project_id\n+        )\n+        PROVIDERS.assignment_api.create_grant(\n+            self.bootstrapper.member_role_id, user_id=self.trustee_user_id,\n+            project_id=project[\'id\']\n+        )\n+        self.trust_id = uuid.uuid4().hex\n+        self.trust_data = {\n+            \'trust\': {\'trustor_user_id\': self.trustor_user_id,\n+                      \'trustee_user_id\': self.trustee_user_id,\n+                      \'project_id\': self.project_id,\n+                      \'impersonation\': False},\n+            \'roles\': [{"id": self.bootstrapper.member_role_id}]\n+        }\n+        auth = self.build_authentication_request(\n+            user_id=self.trustor_user_id,\n+            password=trustor_user[\'password\'],\n+            project_id=project[\'id\']\n+        )\n+        # Grab a token using the trustor persona we\'re testing and prepare\n+        # headers for requests we\'ll be making in the tests.\n+        with self.test_client() as c:\n+            r = c.post(\'/v3/auth/tokens\', json=auth)\n+            self.token_id = r.headers[\'X-Subject-Token\']\n+            self.trustor_headers = {\'X-Auth-Token\': self.token_id}\n+\n+        auth = self.build_authentication_request(\n+            user_id=self.trustee_user_id,\n+            password=trustee_user[\'password\'],\n+            project_id=project[\'id\']\n+        )\n+        # Grab a token using the trustee persona we\'re testing and prepare\n+        # headers for requests we\'ll be making in the tests.\n+        with self.test_client() as c:\n+            r = c.post(\'/v3/auth/tokens\', json=auth)\n+            self.token_id = r.headers[\'X-Subject-Token\']\n+            self.trustee_headers = {\'X-Auth-Token\': self.token_id}\n+\n+\n+class _AdminTestsMixin(object):\n+    """Tests for all admin users.\n+\n+    This exercises both the is_admin user and users granted the admin role on\n+    the system scope.\n+    """\n+\n+    def test_admin_cannot_create_trust_for_other_user(self):\n+        json = {\'trust\': self.trust_data[\'trust\']}\n+        json[\'trust\'][\'roles\'] = self.trust_data[\'roles\']\n+\n+        with self.test_client() as c:\n+            c.post(\n+                \'/v3/OS-TRUST/trusts\',\n+                json=json,\n+                headers=self.headers,\n+                expected_status_code=http_client.FORBIDDEN\n+            )\n+\n+    def test_admin_list_all_trusts(self):\n+        PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            r = c.get(\n+                \'/v3/OS-TRUST/trusts\',\n+                headers=self.headers\n+            )\n+        self.assertEqual(1, len(r.json[\'trusts\']))\n+\n+    def test_admin_cannot_get_trust_for_other_user(self):\n+        PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            c.get(\n+                \'/v3/OS-TRUST/trusts/%s\' % self.trust_id,\n+                headers=self.headers,\n+                expected_status_code=http_client.FORBIDDEN\n+            )\n+\n+    def test_admin_can_get_non_existent_trust_not_found(self):\n+        trust_id = uuid.uuid4().hex\n+        with self.test_client() as c:\n+            c.get(\n+                \'/v3/OS-TRUST/trusts/%s\' % trust_id,\n+                headers=self.headers,\n+                expected_status_code=http_client.NOT_FOUND\n+            )\n+\n+    def test_admin_cannot_list_trust_roles_for_other_user(self):\n+        PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            c.get(\n+                \'/v3/OS-TRUST/trusts/%s/roles\' % self.trust_id,\n+                headers=self.headers,\n+                expected_status_code=http_client.FORBIDDEN\n+            )\n+\n+    def test_admin_cannot_get_trust_role_for_other_user(self):\n+        PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            c.get(\n+                (\'/v3/OS-TRUST/trusts/%s/roles/%s\' %\n+                 (self.trust_id, self.bootstrapper.member_role_id)),\n+                headers=self.headers,\n+                expected_status_code=http_client.FORBIDDEN\n+            )\n+\n+\n+class AdminTokenTests(TrustTests, _AdminTestsMixin):\n+    """Tests for the is_admin user.\n+\n+    The Trusts API has hardcoded is_admin checks that we need to ensure are\n+    preserved through the system-scope transition.\n+    """\n+\n+    def setUp(self):\n+        super(AdminTokenTests, self).setUp()\n+        self.config_fixture.config(admin_token=\'ADMIN\')\n+        self.headers = {\'X-Auth-Token\': \'ADMIN\'}\n+\n+    def test_admin_can_delete_trust_for_other_user(self):\n+        ref = PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            c.delete(\n+                \'/v3/OS-TRUST/trusts/%s\' % ref[\'id\'],\n+                headers=self.headers,\n+                expected_status_code=http_client.NO_CONTENT\n+            )\n+\n+\n+class SystemAdminTests(TrustTests, _AdminTestsMixin):\n+    """Tests for system admin users."""\n+\n+    def setUp(self):\n+        super(SystemAdminTests, self).setUp()\n+        # TODO(cmurphy) enable enforce_scope when trust policies become\n+        # system-scope aware\n+        # self.config_fixture.config(group=\'oslo_policy\', enforce_scope=True)\n+\n+        self.user_id = self.bootstrapper.admin_user_id\n+        auth = self.build_authentication_request(\n+            user_id=self.user_id,\n+            password=self.bootstrapper.admin_password,\n+            system=True\n+        )\n+\n+        # Grab a token using the persona we\'re testing and prepare headers\n+        # for requests we\'ll be making in the tests.\n+        with self.test_client() as c:\n+            r = c.post(\'/v3/auth/tokens\', json=auth)\n+            self.token_id = r.headers[\'X-Subject-Token\']\n+            self.headers = {\'X-Auth-Token\': self.token_id}\n+\n+    def test_admin_cannot_delete_trust_for_other_user(self):\n+        # only the is_admin admin can do this\n+        ref = PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            c.delete(\n+                \'/v3/OS-TRUST/trusts/%s\' % ref[\'id\'],\n+                headers=self.headers,\n+                expected_status_code=http_client.FORBIDDEN\n+            )\n+\n+\n+class ProjectUserTests(TrustTests):\n+    """Tests for all project users."""\n+\n+    def setUp(self):\n+        super(ProjectUserTests, self).setUp()\n+        other_user = unit.new_user_ref(domain_id=self.domain_id)\n+        self.other_user_id = PROVIDERS.identity_api.create_user(\n+            other_user)[\'id\']\n+        PROVIDERS.assignment_api.create_grant(\n+            self.bootstrapper.member_role_id, user_id=self.other_user_id,\n+            project_id=self.project_id\n+        )\n+\n+        auth = self.build_authentication_request(\n+            user_id=self.other_user_id,\n+            password=other_user[\'password\'],\n+            project_id=self.project_id\n+        )\n+        # Grab a token using another persona who has no trusts associated with\n+        # them\n+        with self.test_client() as c:\n+            r = c.post(\'/v3/auth/tokens\', json=auth)\n+            self.token_id = r.headers[\'X-Subject-Token\']\n+            self.other_headers = {\'X-Auth-Token\': self.token_id}\n+\n+    def test_user_can_list_trusts_of_whom_they_are_the_trustor(self):\n+        PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            r = c.get(\n+                (\'/v3/OS-TRUST/trusts?trustor_user_id=%s\' %\n+                 self.trustor_user_id),\n+                headers=self.trustor_headers\n+            )\n+        self.assertEqual(1, len(r.json[\'trusts\']))\n+        self.assertEqual(self.trust_id, r.json[\'trusts\'][0][\'id\'])\n+\n+    def test_user_can_list_trusts_delegated_to_them(self):\n+        PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            r = c.get(\n+                (\'/v3/OS-TRUST/trusts?trustee_user_id=%s\' %\n+                 self.trustee_user_id),\n+                headers=self.trustee_headers\n+            )\n+        self.assertEqual(1, len(r.json[\'trusts\']))\n+        self.assertEqual(self.trust_id, r.json[\'trusts\'][0][\'id\'])\n+\n+    def test_trustor_cannot_list_trusts_for_trustee(self):\n+        PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            c.get(\n+                (\'/v3/OS-TRUST/trusts?trustee_user_id=%s\' %\n+                 self.trustee_user_id),\n+                headers=self.trustor_headers,\n+                expected_status_code=http_client.FORBIDDEN\n+            )\n+\n+    def test_trustee_cannot_list_trusts_for_trustor(self):\n+        PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            c.get(\n+                (\'/v3/OS-TRUST/trusts?trustor_user_id=%s\' %\n+                 self.trustor_user_id),\n+                headers=self.trustee_headers,\n+                expected_status_code=http_client.FORBIDDEN\n+            )\n+\n+    def test_user_cannot_list_trusts_for_other_trustor(self):\n+        PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            c.get(\n+                (\'/v3/OS-TRUST/trusts?trustor_user_id=%s\' %\n+                 self.trustor_user_id),\n+                headers=self.other_headers,\n+                expected_status_code=http_client.FORBIDDEN\n+            )\n+\n+    def test_user_cannot_list_trusts_for_other_trustee(self):\n+        PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            c.get(\n+                (\'/v3/OS-TRUST/trusts?trustee_user_id=%s\' %\n+                 self.trustee_user_id),\n+                headers=self.other_headers,\n+                expected_status_code=http_client.FORBIDDEN\n+            )\n+\n+    def test_user_cannot_list_all_trusts(self):\n+        PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            c.get(\n+                \'/v3/OS-TRUST/trusts\',\n+                headers=self.trustee_headers,\n+                expected_status_code=http_client.FORBIDDEN\n+            )\n+\n+    def test_user_cannot_get_another_users_trust(self):\n+        ref = PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            c.get(\n+                \'/v3/OS-TRUST/trusts/%s\' % ref[\'id\'],\n+                headers=self.other_headers,\n+                expected_status_code=http_client.FORBIDDEN\n+            )\n+\n+    def test_user_can_get_non_existent_trust_not_found(self):\n+        trust_id = uuid.uuid4().hex\n+        with self.test_client() as c:\n+            c.get(\n+                \'/v3/OS-TRUST/trusts/%s\' % trust_id,\n+                headers=self.other_headers,\n+                expected_status_code=http_client.NOT_FOUND\n+            )\n+\n+    def test_user_can_get_trust_of_whom_they_are_the_trustor(self):\n+        ref = PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            c.get(\n+                \'/v3/OS-TRUST/trusts/%s\' % ref[\'id\'],\n+                headers=self.trustor_headers\n+            )\n+\n+    def test_user_can_get_trust_delegated_to_them(self):\n+        ref = PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            r = c.get(\n+                \'/v3/OS-TRUST/trusts/%s\' % ref[\'id\'],\n+                headers=self.trustee_headers\n+            )\n+        self.assertEqual(r.json[\'trust\'][\'id\'], self.trust_id)\n+\n+    def test_trustor_can_create_trust(self):\n+        json = {\'trust\': self.trust_data[\'trust\']}\n+        json[\'trust\'][\'roles\'] = self.trust_data[\'roles\']\n+\n+        with self.test_client() as c:\n+            c.post(\n+                \'/v3/OS-TRUST/trusts\',\n+                json=json,\n+                headers=self.trustor_headers\n+            )\n+\n+    def test_trustee_cannot_create_trust(self):\n+        json = {\'trust\': self.trust_data[\'trust\']}\n+        json[\'trust\'][\'roles\'] = self.trust_data[\'roles\']\n+\n+        with self.test_client() as c:\n+            c.post(\n+                \'/v3/OS-TRUST/trusts\',\n+                json=json,\n+                headers=self.trustee_headers,\n+                expected_status_code=http_client.FORBIDDEN\n+            )\n+\n+    def test_trustor_can_delete_trust(self):\n+        ref = PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            c.delete(\n+                \'/v3/OS-TRUST/trusts/%s\' % ref[\'id\'],\n+                headers=self.trustor_headers\n+            )\n+\n+    def test_trustee_cannot_delete_trust(self):\n+        ref = PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            c.delete(\n+                \'/v3/OS-TRUST/trusts/%s\' % ref[\'id\'],\n+                headers=self.trustee_headers,\n+                expected_status_code=http_client.FORBIDDEN\n+            )\n+\n+    def test_user_cannot_delete_trust_for_other_user(self):\n+        ref = PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            c.delete(\n+                \'/v3/OS-TRUST/trusts/%s\' % ref[\'id\'],\n+                headers=self.other_headers,\n+                expected_status_code=http_client.FORBIDDEN\n+            )\n+\n+    def test_trustor_can_list_trust_roles(self):\n+        PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            r = c.get(\n+                \'/v3/OS-TRUST/trusts/%s/roles\' % self.trust_id,\n+                headers=self.trustor_headers\n+            )\n+        self.assertEqual(r.json[\'roles\'][0][\'id\'],\n+                         self.bootstrapper.member_role_id)\n+\n+    def test_trustee_can_list_trust_roles(self):\n+        PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            r = c.get(\n+                \'/v3/OS-TRUST/trusts/%s/roles\' % self.trust_id,\n+                headers=self.trustee_headers\n+            )\n+        self.assertEqual(r.json[\'roles\'][0][\'id\'],\n+                         self.bootstrapper.member_role_id)\n+\n+    def test_user_cannot_list_trust_roles_for_other_user(self):\n+        PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            c.get(\n+                \'/v3/OS-TRUST/trusts/%s/roles\' % self.trust_id,\n+                headers=self.other_headers,\n+                expected_status_code=http_client.FORBIDDEN\n+            )\n+\n+    def test_trustor_can_get_trust_role(self):\n+        PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            c.head(\n+                (\'/v3/OS-TRUST/trusts/%s/roles/%s\' %\n+                 (self.trust_id, self.bootstrapper.member_role_id)),\n+                headers=self.trustor_headers\n+            )\n+\n+    def test_trustee_can_get_trust_role(self):\n+        PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            c.head(\n+                (\'/v3/OS-TRUST/trusts/%s/roles/%s\' %\n+                 (self.trust_id, self.bootstrapper.member_role_id)),\n+                headers=self.trustee_headers\n+            )\n+\n+    def test_user_cannot_get_trust_role_for_other_user(self):\n+        PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            c.head(\n+                (\'/v3/OS-TRUST/trusts/%s/roles/%s\' %\n+                 (self.trust_id, self.bootstrapper.member_role_id)),\n+                headers=self.other_headers,\n+                expected_status_code=http_client.FORBIDDEN\n+            )\n', 'commit_subject': 'Merge "Add protection tests for trusts API"', 'repo_name': 'openstack/keystone', 'committer': {'name': 'Gerrit Code Review', 'email': '61e62b213a1a56f7695845df4fc372a10cb0a73e@openstack.org', 'time_sec': '1566189910', 'tz_offset': '0', 'date': {'seconds': '1566189910'}}, 'commit_tree': 'dafcf92187dd1ea3990898e79ab9d0a02a7d472c', 'commit_message': 'Merge "Add protection tests for trusts API"', 'language_name': 'Shell', 'license': 'apache-2.0', 'hunks': '@@ -0,0 +1,503 @@\n+#    Licensed under the Apache License, Version 2.0 (the "License"); you may\n+#    not use this file except in compliance with the License. You may obtain\n+#    a copy of the License at\n+#\n+#         http://www.apache.org/licenses/LICENSE-2.0\n+#\n+#    Unless required by applicable law or agreed to in writing, software\n+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT\n+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the\n+#    License for the specific language governing permissions and limitations\n+#    under the License.\n+\n+import uuid\n+\n+from six.moves import http_client\n+\n+from keystone.common import provider_api\n+import keystone.conf\n+from keystone.tests.common import auth as common_auth\n+from keystone.tests import unit\n+from keystone.tests.unit import base_classes\n+from keystone.tests.unit import ksfixtures\n+\n+CONF = keystone.conf.CONF\n+PROVIDERS = provider_api.ProviderAPIs\n+\n+\n+class TrustTests(base_classes.TestCaseWithBootstrap,\n+                 common_auth.AuthTestMixin):\n+    """Common functionality for all trust tests.\n+\n+    Sets up trustor and trustee users and trust.\n+    """\n+\n+    def setUp(self):\n+        super(TrustTests, self).setUp()\n+        self.loadapp()\n+        self.useFixture(ksfixtures.Policy(self.config_fixture))\n+\n+        domain = PROVIDERS.resource_api.create_domain(\n+            uuid.uuid4().hex, unit.new_domain_ref()\n+        )\n+        self.domain_id = domain[\'id\']\n+\n+        trustor_user = unit.new_user_ref(domain_id=self.domain_id)\n+        self.trustor_user_id = PROVIDERS.identity_api.create_user(\n+            trustor_user)[\'id\']\n+        trustee_user = unit.new_user_ref(domain_id=self.domain_id)\n+        self.trustee_user_id = PROVIDERS.identity_api.create_user(\n+            trustee_user)[\'id\']\n+        project = PROVIDERS.resource_api.create_project(\n+            uuid.uuid4().hex, unit.new_project_ref(domain_id=self.domain_id)\n+        )\n+        self.project_id = project[\'id\']\n+        PROVIDERS.assignment_api.create_grant(\n+            self.bootstrapper.member_role_id, user_id=self.trustor_user_id,\n+            project_id=self.project_id\n+        )\n+        PROVIDERS.assignment_api.create_grant(\n+            self.bootstrapper.member_role_id, user_id=self.trustee_user_id,\n+            project_id=project[\'id\']\n+        )\n+        self.trust_id = uuid.uuid4().hex\n+        self.trust_data = {\n+            \'trust\': {\'trustor_user_id\': self.trustor_user_id,\n+                      \'trustee_user_id\': self.trustee_user_id,\n+                      \'project_id\': self.project_id,\n+                      \'impersonation\': False},\n+            \'roles\': [{"id": self.bootstrapper.member_role_id}]\n+        }\n+        auth = self.build_authentication_request(\n+            user_id=self.trustor_user_id,\n+            password=trustor_user[\'password\'],\n+            project_id=project[\'id\']\n+        )\n+        # Grab a token using the trustor persona we\'re testing and prepare\n+        # headers for requests we\'ll be making in the tests.\n+        with self.test_client() as c:\n+            r = c.post(\'/v3/auth/tokens\', json=auth)\n+            self.token_id = r.headers[\'X-Subject-Token\']\n+            self.trustor_headers = {\'X-Auth-Token\': self.token_id}\n+\n+        auth = self.build_authentication_request(\n+            user_id=self.trustee_user_id,\n+            password=trustee_user[\'password\'],\n+            project_id=project[\'id\']\n+        )\n+        # Grab a token using the trustee persona we\'re testing and prepare\n+        # headers for requests we\'ll be making in the tests.\n+        with self.test_client() as c:\n+            r = c.post(\'/v3/auth/tokens\', json=auth)\n+            self.token_id = r.headers[\'X-Subject-Token\']\n+            self.trustee_headers = {\'X-Auth-Token\': self.token_id}\n+\n+\n+class _AdminTestsMixin(object):\n+    """Tests for all admin users.\n+\n+    This exercises both the is_admin user and users granted the admin role on\n+    the system scope.\n+    """\n+\n+    def test_admin_cannot_create_trust_for_other_user(self):\n+        json = {\'trust\': self.trust_data[\'trust\']}\n+        json[\'trust\'][\'roles\'] = self.trust_data[\'roles\']\n+\n+        with self.test_client() as c:\n+            c.post(\n+                \'/v3/OS-TRUST/trusts\',\n+                json=json,\n+                headers=self.headers,\n+                expected_status_code=http_client.FORBIDDEN\n+            )\n+\n+    def test_admin_list_all_trusts(self):\n+        PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            r = c.get(\n+                \'/v3/OS-TRUST/trusts\',\n+                headers=self.headers\n+            )\n+        self.assertEqual(1, len(r.json[\'trusts\']))\n+\n+    def test_admin_cannot_get_trust_for_other_user(self):\n+        PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            c.get(\n+                \'/v3/OS-TRUST/trusts/%s\' % self.trust_id,\n+                headers=self.headers,\n+                expected_status_code=http_client.FORBIDDEN\n+            )\n+\n+    def test_admin_can_get_non_existent_trust_not_found(self):\n+        trust_id = uuid.uuid4().hex\n+        with self.test_client() as c:\n+            c.get(\n+                \'/v3/OS-TRUST/trusts/%s\' % trust_id,\n+                headers=self.headers,\n+                expected_status_code=http_client.NOT_FOUND\n+            )\n+\n+    def test_admin_cannot_list_trust_roles_for_other_user(self):\n+        PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            c.get(\n+                \'/v3/OS-TRUST/trusts/%s/roles\' % self.trust_id,\n+                headers=self.headers,\n+                expected_status_code=http_client.FORBIDDEN\n+            )\n+\n+    def test_admin_cannot_get_trust_role_for_other_user(self):\n+        PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            c.get(\n+                (\'/v3/OS-TRUST/trusts/%s/roles/%s\' %\n+                 (self.trust_id, self.bootstrapper.member_role_id)),\n+                headers=self.headers,\n+                expected_status_code=http_client.FORBIDDEN\n+            )\n+\n+\n+class AdminTokenTests(TrustTests, _AdminTestsMixin):\n+    """Tests for the is_admin user.\n+\n+    The Trusts API has hardcoded is_admin checks that we need to ensure are\n+    preserved through the system-scope transition.\n+    """\n+\n+    def setUp(self):\n+        super(AdminTokenTests, self).setUp()\n+        self.config_fixture.config(admin_token=\'ADMIN\')\n+        self.headers = {\'X-Auth-Token\': \'ADMIN\'}\n+\n+    def test_admin_can_delete_trust_for_other_user(self):\n+        ref = PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            c.delete(\n+                \'/v3/OS-TRUST/trusts/%s\' % ref[\'id\'],\n+                headers=self.headers,\n+                expected_status_code=http_client.NO_CONTENT\n+            )\n+\n+\n+class SystemAdminTests(TrustTests, _AdminTestsMixin):\n+    """Tests for system admin users."""\n+\n+    def setUp(self):\n+        super(SystemAdminTests, self).setUp()\n+        # TODO(cmurphy) enable enforce_scope when trust policies become\n+        # system-scope aware\n+        # self.config_fixture.config(group=\'oslo_policy\', enforce_scope=True)\n+\n+        self.user_id = self.bootstrapper.admin_user_id\n+        auth = self.build_authentication_request(\n+            user_id=self.user_id,\n+            password=self.bootstrapper.admin_password,\n+            system=True\n+        )\n+\n+        # Grab a token using the persona we\'re testing and prepare headers\n+        # for requests we\'ll be making in the tests.\n+        with self.test_client() as c:\n+            r = c.post(\'/v3/auth/tokens\', json=auth)\n+            self.token_id = r.headers[\'X-Subject-Token\']\n+            self.headers = {\'X-Auth-Token\': self.token_id}\n+\n+    def test_admin_cannot_delete_trust_for_other_user(self):\n+        # only the is_admin admin can do this\n+        ref = PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            c.delete(\n+                \'/v3/OS-TRUST/trusts/%s\' % ref[\'id\'],\n+                headers=self.headers,\n+                expected_status_code=http_client.FORBIDDEN\n+            )\n+\n+\n+class ProjectUserTests(TrustTests):\n+    """Tests for all project users."""\n+\n+    def setUp(self):\n+        super(ProjectUserTests, self).setUp()\n+        other_user = unit.new_user_ref(domain_id=self.domain_id)\n+        self.other_user_id = PROVIDERS.identity_api.create_user(\n+            other_user)[\'id\']\n+        PROVIDERS.assignment_api.create_grant(\n+            self.bootstrapper.member_role_id, user_id=self.other_user_id,\n+            project_id=self.project_id\n+        )\n+\n+        auth = self.build_authentication_request(\n+            user_id=self.other_user_id,\n+            password=other_user[\'password\'],\n+            project_id=self.project_id\n+        )\n+        # Grab a token using another persona who has no trusts associated with\n+        # them\n+        with self.test_client() as c:\n+            r = c.post(\'/v3/auth/tokens\', json=auth)\n+            self.token_id = r.headers[\'X-Subject-Token\']\n+            self.other_headers = {\'X-Auth-Token\': self.token_id}\n+\n+    def test_user_can_list_trusts_of_whom_they_are_the_trustor(self):\n+        PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            r = c.get(\n+                (\'/v3/OS-TRUST/trusts?trustor_user_id=%s\' %\n+                 self.trustor_user_id),\n+                headers=self.trustor_headers\n+            )\n+        self.assertEqual(1, len(r.json[\'trusts\']))\n+        self.assertEqual(self.trust_id, r.json[\'trusts\'][0][\'id\'])\n+\n+    def test_user_can_list_trusts_delegated_to_them(self):\n+        PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            r = c.get(\n+                (\'/v3/OS-TRUST/trusts?trustee_user_id=%s\' %\n+                 self.trustee_user_id),\n+                headers=self.trustee_headers\n+            )\n+        self.assertEqual(1, len(r.json[\'trusts\']))\n+        self.assertEqual(self.trust_id, r.json[\'trusts\'][0][\'id\'])\n+\n+    def test_trustor_cannot_list_trusts_for_trustee(self):\n+        PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            c.get(\n+                (\'/v3/OS-TRUST/trusts?trustee_user_id=%s\' %\n+                 self.trustee_user_id),\n+                headers=self.trustor_headers,\n+                expected_status_code=http_client.FORBIDDEN\n+            )\n+\n+    def test_trustee_cannot_list_trusts_for_trustor(self):\n+        PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            c.get(\n+                (\'/v3/OS-TRUST/trusts?trustor_user_id=%s\' %\n+                 self.trustor_user_id),\n+                headers=self.trustee_headers,\n+                expected_status_code=http_client.FORBIDDEN\n+            )\n+\n+    def test_user_cannot_list_trusts_for_other_trustor(self):\n+        PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            c.get(\n+                (\'/v3/OS-TRUST/trusts?trustor_user_id=%s\' %\n+                 self.trustor_user_id),\n+                headers=self.other_headers,\n+                expected_status_code=http_client.FORBIDDEN\n+            )\n+\n+    def test_user_cannot_list_trusts_for_other_trustee(self):\n+        PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            c.get(\n+                (\'/v3/OS-TRUST/trusts?trustee_user_id=%s\' %\n+                 self.trustee_user_id),\n+                headers=self.other_headers,\n+                expected_status_code=http_client.FORBIDDEN\n+            )\n+\n+    def test_user_cannot_list_all_trusts(self):\n+        PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            c.get(\n+                \'/v3/OS-TRUST/trusts\',\n+                headers=self.trustee_headers,\n+                expected_status_code=http_client.FORBIDDEN\n+            )\n+\n+    def test_user_cannot_get_another_users_trust(self):\n+        ref = PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            c.get(\n+                \'/v3/OS-TRUST/trusts/%s\' % ref[\'id\'],\n+                headers=self.other_headers,\n+                expected_status_code=http_client.FORBIDDEN\n+            )\n+\n+    def test_user_can_get_non_existent_trust_not_found(self):\n+        trust_id = uuid.uuid4().hex\n+        with self.test_client() as c:\n+            c.get(\n+                \'/v3/OS-TRUST/trusts/%s\' % trust_id,\n+                headers=self.other_headers,\n+                expected_status_code=http_client.NOT_FOUND\n+            )\n+\n+    def test_user_can_get_trust_of_whom_they_are_the_trustor(self):\n+        ref = PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            c.get(\n+                \'/v3/OS-TRUST/trusts/%s\' % ref[\'id\'],\n+                headers=self.trustor_headers\n+            )\n+\n+    def test_user_can_get_trust_delegated_to_them(self):\n+        ref = PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            r = c.get(\n+                \'/v3/OS-TRUST/trusts/%s\' % ref[\'id\'],\n+                headers=self.trustee_headers\n+            )\n+        self.assertEqual(r.json[\'trust\'][\'id\'], self.trust_id)\n+\n+    def test_trustor_can_create_trust(self):\n+        json = {\'trust\': self.trust_data[\'trust\']}\n+        json[\'trust\'][\'roles\'] = self.trust_data[\'roles\']\n+\n+        with self.test_client() as c:\n+            c.post(\n+                \'/v3/OS-TRUST/trusts\',\n+                json=json,\n+                headers=self.trustor_headers\n+            )\n+\n+    def test_trustee_cannot_create_trust(self):\n+        json = {\'trust\': self.trust_data[\'trust\']}\n+        json[\'trust\'][\'roles\'] = self.trust_data[\'roles\']\n+\n+        with self.test_client() as c:\n+            c.post(\n+                \'/v3/OS-TRUST/trusts\',\n+                json=json,\n+                headers=self.trustee_headers,\n+                expected_status_code=http_client.FORBIDDEN\n+            )\n+\n+    def test_trustor_can_delete_trust(self):\n+        ref = PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            c.delete(\n+                \'/v3/OS-TRUST/trusts/%s\' % ref[\'id\'],\n+                headers=self.trustor_headers\n+            )\n+\n+    def test_trustee_cannot_delete_trust(self):\n+        ref = PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            c.delete(\n+                \'/v3/OS-TRUST/trusts/%s\' % ref[\'id\'],\n+                headers=self.trustee_headers,\n+                expected_status_code=http_client.FORBIDDEN\n+            )\n+\n+    def test_user_cannot_delete_trust_for_other_user(self):\n+        ref = PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            c.delete(\n+                \'/v3/OS-TRUST/trusts/%s\' % ref[\'id\'],\n+                headers=self.other_headers,\n+                expected_status_code=http_client.FORBIDDEN\n+            )\n+\n+    def test_trustor_can_list_trust_roles(self):\n+        PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            r = c.get(\n+                \'/v3/OS-TRUST/trusts/%s/roles\' % self.trust_id,\n+                headers=self.trustor_headers\n+            )\n+        self.assertEqual(r.json[\'roles\'][0][\'id\'],\n+                         self.bootstrapper.member_role_id)\n+\n+    def test_trustee_can_list_trust_roles(self):\n+        PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            r = c.get(\n+                \'/v3/OS-TRUST/trusts/%s/roles\' % self.trust_id,\n+                headers=self.trustee_headers\n+            )\n+        self.assertEqual(r.json[\'roles\'][0][\'id\'],\n+                         self.bootstrapper.member_role_id)\n+\n+    def test_user_cannot_list_trust_roles_for_other_user(self):\n+        PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            c.get(\n+                \'/v3/OS-TRUST/trusts/%s/roles\' % self.trust_id,\n+                headers=self.other_headers,\n+                expected_status_code=http_client.FORBIDDEN\n+            )\n+\n+    def test_trustor_can_get_trust_role(self):\n+        PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            c.head(\n+                (\'/v3/OS-TRUST/trusts/%s/roles/%s\' %\n+                 (self.trust_id, self.bootstrapper.member_role_id)),\n+                headers=self.trustor_headers\n+            )\n+\n+    def test_trustee_can_get_trust_role(self):\n+        PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            c.head(\n+                (\'/v3/OS-TRUST/trusts/%s/roles/%s\' %\n+                 (self.trust_id, self.bootstrapper.member_role_id)),\n+                headers=self.trustee_headers\n+            )\n+\n+    def test_user_cannot_get_trust_role_for_other_user(self):\n+        PROVIDERS.trust_api.create_trust(\n+            self.trust_id, **self.trust_data)\n+\n+        with self.test_client() as c:\n+            c.head(\n+                (\'/v3/OS-TRUST/trusts/%s/roles/%s\' %\n+                 (self.trust_id, self.bootstrapper.member_role_id)),\n+                headers=self.other_headers,\n+                expected_status_code=http_client.FORBIDDEN\n+            )\n', 'addition_count': 503, 'deletion_count': 0, 'src_file': '/dev/null', 'tgt_file': 'b/keystone/tests/unit/protection/v3/test_trusts.py', 'file_extension': '.py', 'before_file': 'ADDFILE', 'message': 'Merge "Add protection tests for trusts API"', 'author_name': 'Gerrit Code Review', 'lang': 'py'}