#!/usr/bin/python
# Copyright (c) 2015 OpenStack Foundation
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#    http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
# implied.
# See the License for the specific language governing permissions and
# limitations under the License.

import unittest
from six.moves.urllib.parse import urlparse, urlunparse
import uuid
from random import shuffle

from keystoneclient.v3 import client
from swiftclient import get_auth, http_connection

import test.functional as tf


def setUpModule():
    tf.setup_package()


def tearDownModule():
    tf.teardown_package()


TEST_CASE_FORMAT = (
    'http_method', 'header', 'account_name', 'container_name', 'object_name',
    'prep_container_header', 'reseller_prefix', 'target_user_name',
    'auth_user_name', 'service_user_name', 'expected')
# http_method           : HTTP methods such as PUT, GET, POST, HEAD and so on
# header                : headers for a request
# account_name          : Account name. Usually the name will be automatically
#                         created by keystone
# container_name        : Container name. If 'UUID' is specified, a container
#                         name will be created automatically
# object_name           : Object name. If 'UUID' is specified, a container
#                         name will be created automatically
# prep_container_header : headers which will be set on the container
# reseller_prefix       : Reseller prefix that will be used for request url.
#                         Can be None or SERVICE to select the user account
#                         prefix or the service prefix respectively
# target_user_name      : a user name which is used for getting the project id
#                         of the target
# auth_user_name        : a user name which is used for getting a token for
#                         X-Auth_Token
# service_user_name     : a user name which is used for getting a token for
#                         X-Service-Token
# expected              : expected status code
#
# a combination of account_name, container_name and object_name
# represents a target.
# +------------+--------------+-----------+---------+
# |account_name|container_name|object_name| target  |
# +------------+--------------+-----------+---------+
# |    None    |     None     |   None    | account |
# +------------+--------------+-----------+---------+
# |    None    |    'UUID'    |   None    |container|
# +------------+--------------+-----------+---------+
# |    None    |    'UUID'    |  'UUID'   | object  |
# +------------+--------------+-----------+---------+
#
# The following users are required to run this functional test.
# No.6, tester6, is added for this test.
# +----+-----------+-------+---------+-------------+
# |No. |  Domain   |Project|User name|    Role     |
# +----+-----------+-------+---------+-------------+
# | 1  |  default  | test  | tester  |    admin    |
# +----+-----------+-------+---------+-------------+
# | 2  |  default  | test2 | tester2 |    admin    |
# +----+-----------+-------+---------+-------------+
# | 3  |  default  | test  | tester3 |  _member_   |
# +----+-----------+-------+---------+-------------+
# | 4  |test-domain| test4 | tester4 |    admin    |
# +----+-----------+-------+---------+-------------+
# | 5  |  default  | test5 | tester5 |   service   |
# +----+-----------+-------+---------+-------------+
# | 6  |  default  | test  | tester6 |ResellerAdmin|
# +----+-----------+-------+---------+-------------+

# A scenario of put for account, container and object with
# several roles.
RBAC_PUT = [
    # PUT container in own account: ok
    ('PUT', None, None, 'UUID', None, None,
     None, 'tester', 'tester', None, 201),
    ('PUT', None, None, 'UUID', None, None,
     None, 'tester', 'tester', 'tester', 201),

    # PUT container in other users account: not allowed for role admin
    ('PUT', None, None, 'UUID', None, None,
     None, 'tester2', 'tester', None, 403),
    ('PUT', None, None, 'UUID', None, None,
     None, 'tester4', 'tester', None, 403),

    # PUT container in other users account: not allowed for role _member_
    ('PUT', None, None, 'UUID', None, None,
     None, 'tester3', 'tester3', None, 403),
    ('PUT', None, None, 'UUID', None, None,
     None, 'tester2', 'tester3', None, 403),
    ('PUT', None, None, 'UUID', None, None,
     None, 'tester4', 'tester3', None, 403),

    # PUT container in other users account: allowed for role ResellerAdmin
    ('PUT', None, None, 'UUID', None, None,
     None, 'tester6', 'tester6', None, 201),
    ('PUT', None, None, 'UUID', None, None,
     None, 'tester2', 'tester6', None, 201),
    ('PUT', None, None, 'UUID', None, None,
     None, 'tester4', 'tester6', None, 201),

    # PUT object in own account: ok
    ('PUT', None, None, 'UUID', 'UUID', None,
     None, 'tester', 'tester', None, 201),
    ('PUT', None, None, 'UUID', 'UUID', None,
     None, 'tester', 'tester', 'tester', 201),

    # PUT object in other users account: not allowed for role admin
    ('PUT', None, None, 'UUID', 'UUID', None,
     None, 'tester2', 'tester', None, 403),
    ('PUT', None, None, 'UUID', 'UUID', None,
     None, 'tester4', 'tester', None, 403),

    # PUT object in other users account: not allowed for role _member_
    ('PUT', None, None, 'UUID', 'UUID', None,
     None, 'tester3', 'tester3', None, 403),
    ('PUT', None, None, 'UUID', 'UUID', None,
     None, 'tester2', 'tester3', None, 403),
    ('PUT', None, None, 'UUID', 'UUID', None,
     None, 'tester4', 'tester3', None, 403),

    # PUT object in other users account: allowed for role ResellerAdmin
    ('PUT', None, None, 'UUID', 'UUID', None,
     None, 'tester6', 'tester6', None, 201),
    ('PUT', None, None, 'UUID', 'UUID', None,
     None, 'tester2', 'tester6', None, 201),
    ('PUT', None, None, 'UUID', 'UUID', None,
     None, 'tester4', 'tester6', None, 201)
]


RBAC_PUT_WITH_SERVICE_PREFIX = [
    # PUT container in own account: ok
    ('PUT', None, None, 'UUID', None, None,
     None, 'tester', 'tester', 'tester5', 201),

    # PUT container in other users account: not allowed for role service
    ('PUT', None, None, 'UUID', None, None,
     None, 'tester', 'tester3', 'tester5', 403),
    ('PUT', None, None, 'UUID', None, None,
     None, 'tester', None, 'tester5', 401),
    ('PUT', None, None, 'UUID', None, None,
     None, 'tester5', 'tester5', None, 403),
    ('PUT', None, None, 'UUID', None, None,
     None, 'tester2', 'tester5', None, 403),
    ('PUT', None, None, 'UUID', None, None,
     None, 'tester4', 'tester5', None, 403),

    # PUT object in own account: ok
    ('PUT', None, None, 'UUID', 'UUID', None,
     None, 'tester', 'tester', 'tester5', 201),

    # PUT object in other users account: not allowed for role service
    ('PUT', None, None, 'UUID', 'UUID', None,
     None, 'tester', 'tester3', 'tester5', 403),
    ('PUT', None, None, 'UUID', 'UUID', None,
     None, 'tester', None, 'tester5', 401),
    ('PUT', None, None, 'UUID', 'UUID', None,
     None, 'tester5', 'tester5', None, 403),
    ('PUT', None, None, 'UUID', 'UUID', None,
     None, 'tester2', 'tester5', None, 403),
    ('PUT', None, None, 'UUID', 'UUID', None,
     None, 'tester4', 'tester5', None, 403),

    # All following actions are using SERVICE prefix

    # PUT container in own account: ok
    ('PUT', None, None, 'UUID', None, None,
     'SERVICE', 'tester', 'tester', 'tester5', 201),

    # PUT container fails if wrong user, or only one token sent
    ('PUT', None, None, 'UUID', None, None,
     'SERVICE', 'tester', 'tester3', 'tester5', 403),
    ('PUT', None, None, 'UUID', None, None,
     'SERVICE', 'tester', 'tester', None, 403),
    ('PUT', None, None, 'UUID', None, None,
     'SERVICE', 'tester', 'tester', 'tester', 403),
    ('PUT', None, None, 'UUID', None, None,
     'SERVICE', 'tester', None, 'tester5', 401),

    # PUT object in own account: ok
    ('PUT', None, None, 'UUID', 'UUID', None,
     'SERVICE', 'tester', 'tester', 'tester5', 201),

    # PUT object fails if wrong user, or only one token sent
    ('PUT', None, None, 'UUID', 'UUID', None,
     'SERVICE', 'tester', 'tester3', 'tester5', 403),
    ('PUT', None, None, 'UUID', 'UUID', None,
     'SERVICE', 'tester', 'tester', None, 403),
    ('PUT', None, None, 'UUID', 'UUID', None,
     'SERVICE', 'tester', 'tester', 'tester', 403),
    ('PUT', None, None, 'UUID', 'UUID', None,
     'SERVICE', 'tester', None, 'tester5', 401),
]


# A scenario of delete for account, container and object with
# several roles.
RBAC_DELETE = [
    # DELETE container in own account: ok
    ('DELETE', None, None, 'UUID', None, None,
     None, 'tester', 'tester', None, 204),
    ('DELETE', None, None, 'UUID', None, None,
     None, 'tester', 'tester', 'tester', 204),

    # DELETE container in other users account: not allowed for role admin
    ('DELETE', None, None, 'UUID', None, None,
     None, 'tester2', 'tester', None, 403),
    ('DELETE', None, None, 'UUID', None, None,
     None, 'tester4', 'tester', None, 403),

    # DELETE container in other users account: not allowed for role _member_
    ('DELETE', None, None, 'UUID', None, None,
     None, 'tester3', 'tester3', None, 403),
    ('DELETE', None, None, 'UUID', None, None,
     None, 'tester2', 'tester3', None, 403),
    ('DELETE', None, None, 'UUID', None, None,
     None, 'tester4', 'tester3', None, 403),

    # DELETE container in other users account: allowed for role ResellerAdmin
    ('DELETE', None, None, 'UUID', None, None,
     None, 'tester6', 'tester6', None, 204),
    ('DELETE', None, None, 'UUID', None, None,
     None, 'tester2', 'tester6', None, 204),
    ('DELETE', None, None, 'UUID', None, None,
     None, 'tester4', 'tester6', None, 204),

    # DELETE object in own account: ok
    ('DELETE', None, None, 'UUID', 'UUID', None,
     None, 'tester', 'tester', None, 204),
    ('DELETE', None, None, 'UUID', 'UUID', None,
     None, 'tester', 'tester', 'tester', 204),

    # DELETE object in other users account: not allowed for role admin
    ('DELETE', None, None, 'UUID', 'UUID', None,
     None, 'tester2', 'tester', None, 403),
    ('DELETE', None, None, 'UUID', 'UUID', None,
     None, 'tester4', 'tester', None, 403),

    # DELETE object in other users account: not allowed for role _member_
    ('DELETE', None, None, 'UUID', 'UUID', None,
     None, 'tester3', 'tester3', None, 403),
    ('DELETE', None, None, 'UUID', 'UUID', None,
     None, 'tester2', 'tester3', None, 403),
    ('DELETE', None, None, 'UUID', 'UUID', None,
     None, 'tester4', 'tester3', None, 403),

    # DELETE object in other users account: allowed for role ResellerAdmin
    ('DELETE', None, None, 'UUID', 'UUID', None,
     None, 'tester6', 'tester6', None, 204),
    ('DELETE', None, None, 'UUID', 'UUID', None,
     None, 'tester2', 'tester6', None, 204),
    ('DELETE', None, None, 'UUID', 'UUID', None,
     None, 'tester4', 'tester6', None, 204)
]


RBAC_DELETE_WITH_SERVICE_PREFIX = [
    # DELETE container in own account: ok
    ('DELETE', None, None, 'UUID', None, None,
     None, 'tester', 'tester', 'tester5', 204),

    # DELETE container in other users account: not allowed for role service
    ('DELETE', None, None, 'UUID', None, None,
     None, 'tester', 'tester3', 'tester5', 403),
    ('DELETE', None, None, 'UUID', None, None,
     None, 'tester', None, 'tester5', 401),
    ('DELETE', None, None, 'UUID', None, None,
     None, 'tester5', 'tester5', None, 403),
    ('DELETE', None, None, 'UUID', None, None,
     None, 'tester2', 'tester5', None, 403),
    ('DELETE', None, None, 'UUID', None, None,
     None, 'tester4', 'tester5', None, 403),

    # DELETE object in own account: ok
    ('DELETE', None, None, 'UUID', 'UUID', None,
     None, 'tester', 'tester', 'tester5', 204),

    # DELETE object in other users account: not allowed for role service
    ('DELETE', None, None, 'UUID', 'UUID', None,
     None, 'tester', 'tester3', 'tester5', 403),
    ('DELETE', None, None, 'UUID', 'UUID', None,
     None, 'tester', None, 'tester5', 401),
    ('DELETE', None, None, 'UUID', 'UUID', None,
     None, 'tester5', 'tester5', None, 403),
    ('DELETE', None, None, 'UUID', 'UUID', None,
     None, 'tester2', 'tester5', None, 403),
    ('DELETE', None, None, 'UUID', 'UUID', None,
     None, 'tester4', 'tester5', None, 403),

    # All following actions are using SERVICE prefix

    # DELETE container in own account: ok
    ('DELETE', None, None, 'UUID', None, None,
     'SERVICE', 'tester', 'tester', 'tester5', 204),

    # DELETE container fails if wrong user, or only one token sent
    ('DELETE', None, None, 'UUID', None, None,
     'SERVICE', 'tester', 'tester3', 'tester5', 403),
    ('DELETE', None, None, 'UUID', None, None,
     'SERVICE', 'tester', 'tester', None, 403),
    ('DELETE', None, None, 'UUID', None, None,
     'SERVICE', 'tester', 'tester', 'tester', 403),
    ('DELETE', None, None, 'UUID', None, None,
     'SERVICE', 'tester', None, 'tester5', 401),

    # DELETE object in own account: ok
    ('DELETE', None, None, 'UUID', 'UUID', None,
     'SERVICE', 'tester', 'tester', 'tester5', 204),

    # DELETE object fails if wrong user, or only one token sent
    ('DELETE', None, None, 'UUID', 'UUID', None,
     'SERVICE', 'tester', 'tester3', 'tester5', 403),
    ('DELETE', None, None, 'UUID', 'UUID', None,
     'SERVICE', 'tester', 'tester', None, 403),
    ('DELETE', None, None, 'UUID', 'UUID', None,
     'SERVICE', 'tester', 'tester', 'tester', 403),
    ('DELETE', None, None, 'UUID', 'UUID', None,
     'SERVICE', 'tester', None, 'tester5', 401)
]


# A scenario of get for account, container and object with
# several roles.
RBAC_GET = [
    # GET own account: ok
    ('GET', None, None, None, None, None,
     None, 'tester', 'tester', None, 200),
    ('GET', None, None, None, None, None,
     None, 'tester', 'tester', 'tester', 200),

    # GET other users account: not allowed for role admin
    ('GET', None, None, None, None, None,
     None, 'tester2', 'tester', None, 403),
    ('GET', None, None, None, None, None,
     None, 'tester4', 'tester', None, 403),

    # GET other users account: not allowed for role _member_
    ('GET', None, None, None, None, None,
     None, 'tester3', 'tester3', None, 403),
    ('GET', None, None, None, None, None,
     None, 'tester2', 'tester3', None, 403),
    ('GET', None, None, None, None, None,
     None, 'tester4', 'tester3', None, 403),

    # GET other users account: allowed for role ResellerAdmin
    ('GET', None, None, None, None, None,
     None, 'tester6', 'tester6', None, 200),
    ('GET', None, None, None, None, None,
     None, 'tester2', 'tester6', None, 200),
    ('GET', None, None, None, None, None,
     None, 'tester4', 'tester6', None, 200),

    # GET container in own account: ok
    ('GET', None, None, 'UUID', None, None,
     None, 'tester', 'tester', None, 200),
    ('GET', None, None, 'UUID', None, None,
     None, 'tester', 'tester', 'tester', 200),

    # GET container in other users account: not allowed for role admin
    ('GET', None, None, 'UUID', None, None,
     None, 'tester2', 'tester', None, 403),
    ('GET', None, None, 'UUID', None, None,
     None, 'tester4', 'tester', None, 403),

    # GET container in other users account: not allowed for role _member_
    ('GET', None, None, 'UUID', None, None,
     None, 'tester3', 'tester3', None, 403),
    ('GET', None, None, 'UUID', None, None,
     None, 'tester2', 'tester3', None, 403),
    ('GET', None, None, 'UUID', None, None,
     None, 'tester4', 'tester3', None, 403),

    # GET container in other users account: allowed for role ResellerAdmin
    ('GET', None, None, 'UUID', None, None,
     None, 'tester6', 'tester6', None, 200),
    ('GET', None, None, 'UUID', None, None,
     None, 'tester2', 'tester6', None, 200),
    ('GET', None, None, 'UUID', None, None,
     None, 'tester4', 'tester6', None, 200),

    # GET object in own account: ok
    ('GET', None, None, 'UUID', 'UUID', None,
     None, 'tester', 'tester', None, 200),
    ('GET', None, None, 'UUID', 'UUID', None,
     None, 'tester', 'tester', 'tester', 200),

    # GET object in other users account: not allowed for role admin
    ('GET', None, None, 'UUID', 'UUID', None,
     None, 'tester2', 'tester', None, 403),
    ('GET', None, None, 'UUID', 'UUID', None,
     None, 'tester4', 'tester', None, 403),

    # GET object in other users account: not allowed for role _member_
    ('GET', None, None, 'UUID', 'UUID', None,
     None, 'tester3', 'tester3', None, 403),
    ('GET', None, None, 'UUID', 'UUID', None,
     None, 'tester2', 'tester3', None, 403),
    ('GET', None, None, 'UUID', 'UUID', None,
     None, 'tester4', 'tester3', None, 403),

    # GET object in other users account: allowed for role ResellerAdmin
    ('GET', None, None, 'UUID', 'UUID', None,
     None, 'tester6', 'tester6', None, 200),
    ('GET', None, None, 'UUID', 'UUID', None,
     None, 'tester2', 'tester6', None, 200),
    ('GET', None, None, 'UUID', 'UUID', None,
     None, 'tester4', 'tester6', None, 200)
]


RBAC_GET_WITH_SERVICE_PREFIX = [
    # GET own account: ok
    ('GET', None, None, None, None, None,
     None, 'tester', 'tester', 'tester5', 200),

    # GET other account: not allowed for role service
    ('GET', None, None, None, None, None,
     None, 'tester', 'tester3', 'tester5', 403),
    ('GET', None, None, None, None, None,
     None, 'tester', None, 'tester5', 401),
    ('GET', None, None, None, None, None,
     None, 'tester5', 'tester5', None, 403),
    ('GET', None, None, None, None, None,
     None, 'tester2', 'tester5', None, 403),
    ('GET', None, None, None, None, None,
     None, 'tester4', 'tester5', None, 403),

    # GET container in own account: ok
    ('GET', None, None, 'UUID', None, None,
     None, 'tester', 'tester', 'tester5', 200),

    # GET container in other users account: not allowed for role service
    ('GET', None, None, 'UUID', None, None,
     None, 'tester', 'tester3', 'tester5', 403),
    ('GET', None, None, 'UUID', None, None,
     None, 'tester', None, 'tester5', 401),
    ('GET', None, None, 'UUID', None, None,
     None, 'tester5', 'tester5', None, 403),
    ('GET', None, None, 'UUID', None, None,
     None, 'tester2', 'tester5', None, 403),
    ('GET', None, None, 'UUID', None, None,
     None, 'tester4', 'tester5', None, 403),

    # GET object in own account: ok
    ('GET', None, None, 'UUID', 'UUID', None,
     None, 'tester', 'tester', 'tester5', 200),

    # GET object fails if wrong user, or only one token sent
    ('GET', None, None, 'UUID', 'UUID', None,
     None, 'tester', 'tester3', 'tester5', 403),
    ('GET', None, None, 'UUID', 'UUID', None,
     None, 'tester', None, 'tester5', 401),
    ('GET', None, None, 'UUID', 'UUID', None,
     None, 'tester5', 'tester5', None, 403),
    ('GET', None, None, 'UUID', 'UUID', None,
     None, 'tester2', 'tester5', None, 403),
    ('GET', None, None, 'UUID', 'UUID', None,
     None, 'tester4', 'tester5', None, 403),

    # All following actions are using SERVICE prefix

    # GET own account: ok
    ('GET', None, None, None, None, None,
     'SERVICE', 'tester', 'tester', 'tester5', 200),

    # GET other account: not allowed for role service
    ('GET', None, None, None, None, None,
     'SERVICE', 'tester', 'tester3', 'tester5', 403),
    ('GET', None, None, None, None, None,
     'SERVICE', 'tester', 'tester', None, 403),
    ('GET', None, None, None, None, None,
     'SERVICE', 'tester', 'tester', 'tester', 403),
    ('GET', None, None, None, None, None,
     'SERVICE', 'tester', None, 'tester5', 401),

    # GET container in own account: ok
    ('GET', None, None, 'UUID', None, None,
     'SERVICE', 'tester', 'tester', 'tester5', 200),

    # GET container fails if wrong user, or only one token sent
    ('GET', None, None, 'UUID', None, None,
     'SERVICE', 'tester', 'tester3', 'tester5', 403),
    ('GET', None, None, 'UUID', None, None,
     'SERVICE', 'tester', 'tester', None, 403),
    ('GET', None, None, 'UUID', None, None,
     'SERVICE', 'tester', 'tester', 'tester', 403),
    ('GET', None, None, 'UUID', None, None,
     'SERVICE', 'tester', None, 'tester5', 401),

    # GET object in own account: ok
    ('GET', None, None, 'UUID', 'UUID', None,
     'SERVICE', 'tester', 'tester', 'tester5', 200),

    # GET object fails if wrong user, or only one token sent
    ('GET', None, None, 'UUID', 'UUID', None,
     'SERVICE', 'tester', 'tester3', 'tester5', 403),
    ('GET', None, None, 'UUID', 'UUID', None,
     'SERVICE', 'tester', 'tester', None, 403),
    ('GET', None, None, 'UUID', 'UUID', None,
     'SERVICE', 'tester', 'tester', 'tester', 403),
    ('GET', None, None, 'UUID', 'UUID', None,
     'SERVICE', 'tester', None, 'tester5', 401)
]


# A scenario of head for account, container and object with
# several roles.
RBAC_HEAD = [
    # HEAD own account: ok
    ('HEAD', None, None, None, None, None,
     None, 'tester', 'tester', None, 204),
    ('HEAD', None, None, None, None, None,
     None, 'tester', 'tester', 'tester', 204),

    # HEAD other users account: not allowed for role admin
    ('HEAD', None, None, None, None, None,
     None, 'tester2', 'tester', None, 403),
    ('HEAD', None, None, None, None, None,
     None, 'tester4', 'tester', None, 403),

    # HEAD other users account: not allowed for role _member_
    ('HEAD', None, None, None, None, None,
     None, 'tester3', 'tester3', None, 403),
    ('HEAD', None, None, None, None, None,
     None, 'tester2', 'tester3', None, 403),
    ('HEAD', None, None, None, None, None,
     None, 'tester4', 'tester3', None, 403),

    # HEAD other users account: allowed for role ResellerAdmin
    ('HEAD', None, None, None, None, None,
     None, 'tester6', 'tester6', None, 204),
    ('HEAD', None, None, None, None, None,
     None, 'tester2', 'tester6', None, 204),
    ('HEAD', None, None, None, None, None,
     None, 'tester4', 'tester6', None, 204),

    # HEAD container in own account: ok
    ('HEAD', None, None, 'UUID', None, None,
     None, 'tester', 'tester', None, 204),
    ('HEAD', None, None, 'UUID', None, None,
     None, 'tester', 'tester', 'tester', 204),

    # HEAD container in other users account: not allowed for role admin
    ('HEAD', None, None, 'UUID', None, None,
     None, 'tester2', 'tester', None, 403),
    ('HEAD', None, None, 'UUID', None, None,
     None, 'tester4', 'tester', None, 403),

    # HEAD container in other users account: not allowed for role _member_
    ('HEAD', None, None, 'UUID', None, None,
     None, 'tester3', 'tester3', None, 403),
    ('HEAD', None, None, 'UUID', None, None,
     None, 'tester2', 'tester3', None, 403),
    ('HEAD', None, None, 'UUID', None, None,
     None, 'tester4', 'tester3', None, 403),

    # HEAD container in other users account: allowed for role ResellerAdmin
    ('HEAD', None, None, 'UUID', None, None,
     None, 'tester6', 'tester6', None, 204),
    ('HEAD', None, None, 'UUID', None, None,
     None, 'tester2', 'tester6', None, 204),
    ('HEAD', None, None, 'UUID', None, None,
     None, 'tester4', 'tester6', None, 204),


    # HEAD object in own account: ok
    ('HEAD', None, None, 'UUID', 'UUID', None,
     None, 'tester', 'tester', None, 200),
    ('HEAD', None, None, 'UUID', 'UUID', None,
     None, 'tester', 'tester', 'tester', 200),

    # HEAD object in other users account: not allowed for role admin
    ('HEAD', None, None, 'UUID', 'UUID', None,
     None, 'tester2', 'tester', None, 403),
    ('HEAD', None, None, 'UUID', 'UUID', None,
     None, 'tester4', 'tester', None, 403),

    # HEAD object in other users account: not allowed for role _member_
    ('HEAD', None, None, 'UUID', 'UUID', None,
     None, 'tester3', 'tester3', None, 403),
    ('HEAD', None, None, 'UUID', 'UUID', None,
     None, 'tester2', 'tester3', None, 403),
    ('HEAD', None, None, 'UUID', 'UUID', None,
     None, 'tester4', 'tester3', None, 403),

    # HEAD object in other users account: allowed for role ResellerAdmin
    ('HEAD', None, None, 'UUID', 'UUID', None,
     None, 'tester6', 'tester6', None, 200),
    ('HEAD', None, None, 'UUID', 'UUID', None,
     None, 'tester2', 'tester6', None, 200),
    ('HEAD', None, None, 'UUID', 'UUID', None,
     None, 'tester4', 'tester6', None, 200)
]


RBAC_HEAD_WITH_SERVICE_PREFIX = [
    # HEAD own account: ok
    ('HEAD', None, None, None, None, None,
     None, 'tester', 'tester', 'tester5', 204),

    # HEAD other account: not allowed for role service
    ('HEAD', None, None, None, None, None,
     None, 'tester', 'tester3', 'tester5', 403),
    ('HEAD', None, None, None, None, None,
     None, 'tester', None, 'tester5', 401),
    ('HEAD', None, None, None, None, None,
     None, 'tester5', 'tester5', None, 403),
    ('HEAD', None, None, None, None, None,
     None, 'tester2', 'tester5', None, 403),
    ('HEAD', None, None, None, None, None,
     None, 'tester4', 'tester5', None, 403),

    # HEAD container in own account: ok
    ('HEAD', None, None, 'UUID', None, None,
     None, 'tester', 'tester', 'tester5', 204),

    # HEAD container in other users account: not allowed for role service
    ('HEAD', None, None, 'UUID', None, None,
     None, 'tester', 'tester3', 'tester5', 403),
    ('HEAD', None, None, 'UUID', None, None,
     None, 'tester', None, 'tester5', 401),
    ('HEAD', None, None, 'UUID', None, None,
     None, 'tester5', 'tester5', None, 403),
    ('HEAD', None, None, 'UUID', None, None,
     None, 'tester2', 'tester5', None, 403),
    ('HEAD', None, None, 'UUID', None, None,
     None, 'tester4', 'tester5', None, 403),

    # HEAD object in own account: ok
    ('HEAD', None, None, 'UUID', 'UUID', None,
     None, 'tester', 'tester', 'tester5', 200),

    # HEAD object fails if wrong user, or only one token sent
    ('HEAD', None, None, 'UUID', 'UUID', None,
     None, 'tester', 'tester3', 'tester5', 403),
    ('HEAD', None, None, 'UUID', 'UUID', None,
     None, 'tester', None, 'tester5', 401),
    ('HEAD', None, None, 'UUID', 'UUID', None,
     None, 'tester5', 'tester5', None, 403),
    ('HEAD', None, None, 'UUID', 'UUID', None,
     None, 'tester2', 'tester5', None, 403),
    ('HEAD', None, None, 'UUID', 'UUID', None,
     None, 'tester4', 'tester5', None, 403),

    # All following actions are using SERVICE prefix

    # HEAD own account: ok
    ('HEAD', None, None, None, None, None,
     'SERVICE', 'tester', 'tester', 'tester5', 204),

    # HEAD other account: not allowed for role service
    ('HEAD', None, None, None, None, None,
     'SERVICE', 'tester', 'tester3', 'tester5', 403),
    ('HEAD', None, None, None, None, None,
     'SERVICE', 'tester', 'tester', None, 403),
    ('HEAD', None, None, None, None, None,
     'SERVICE', 'tester', 'tester', 'tester', 403),
    ('HEAD', None, None, None, None, None,
     'SERVICE', 'tester', None, 'tester5', 401),

    # HEAD container in own account: ok
    ('HEAD', None, None, 'UUID', None, None,
     'SERVICE', 'tester', 'tester', 'tester5', 204),

    # HEAD container in other users account: not allowed for role service
    ('HEAD', None, None, 'UUID', None, None,
     'SERVICE', 'tester', 'tester3', 'tester5', 403),
    ('HEAD', None, None, 'UUID', None, None,
     'SERVICE', 'tester', 'tester', None, 403),
    ('HEAD', None, None, 'UUID', None, None,
     'SERVICE', 'tester', 'tester', 'tester', 403),
    ('HEAD', None, None, 'UUID', None, None,
     'SERVICE', 'tester', None, 'tester5', 401),

    # HEAD object in own account: ok
    ('HEAD', None, None, 'UUID', 'UUID', None,
     'SERVICE', 'tester', 'tester', 'tester5', 200),

    # HEAD object fails if wrong user, or only one token sent
    ('HEAD', None, None, 'UUID', 'UUID', None,
     'SERVICE', 'tester', 'tester3', 'tester5', 403),
    ('HEAD', None, None, 'UUID', 'UUID', None,
     'SERVICE', 'tester', 'tester', None, 403),
    ('HEAD', None, None, 'UUID', 'UUID', None,
     'SERVICE', 'tester', 'tester', 'tester', 403),
    ('HEAD', None, None, 'UUID', 'UUID', None,
     'SERVICE', 'tester', None, 'tester5', 401)
]


# A scenario of post for account, container and object with
# several roles.
RBAC_POST = [
    # POST own account: ok
    ('POST', None, None, None, None, None,
     None, 'tester', 'tester', None, 204),
    ('POST', None, None, None, None, None,
     None, 'tester', 'tester', 'tester', 204),

    # POST other users account: not allowed for role admin
    ('POST', None, None, None, None, None,
     None, 'tester2', 'tester', None, 403),
    ('POST', None, None, None, None, None,
     None, 'tester4', 'tester', None, 403),

    # POST other users account: not allowed for role _member_
    ('POST', None, None, None, None, None,
     None, 'tester3', 'tester3', None, 403),
    ('POST', None, None, None, None, None,
     None, 'tester2', 'tester3', None, 403),
    ('POST', None, None, None, None, None,
     None, 'tester4', 'tester3', None, 403),

    # POST other users account: allowed for role ResellerAdmin
    ('POST', None, None, None, None, None,
     None, 'tester6', 'tester6', None, 204),
    ('POST', None, None, None, None, None,
     None, 'tester2', 'tester6', None, 204),
    ('POST', None, None, None, None, None,
     None, 'tester4', 'tester6', None, 204),

    # POST container in own account: ok
    ('POST', None, None, 'UUID', None, None,
     None, 'tester', 'tester', None, 204),
    ('POST', None, None, 'UUID', None, None,
     None, 'tester', 'tester', 'tester', 204),

    # POST container in other users account: not allowed for role admin
    ('POST', None, None, 'UUID', None, None,
     None, 'tester2', 'tester', None, 403),
    ('POST', None, None, 'UUID', None, None,
     None, 'tester4', 'tester', None, 403),

    # POST container in other users account: not allowed for role _member_
    ('POST', None, None, 'UUID', None, None,
     None, 'tester3', 'tester3', None, 403),
    ('POST', None, None, 'UUID', None, None,
     None, 'tester2', 'tester3', None, 403),
    ('POST', None, None, 'UUID', None, None,
     None, 'tester4', 'tester3', None, 403),

    # POST container in other users account: allowed for role ResellerAdmin
    ('POST', None, None, 'UUID', None, None,
     None, 'tester6', 'tester6', None, 204),
    ('POST', None, None, 'UUID', None, None,
     None, 'tester2', 'tester6', None, 204),
    ('POST', None, None, 'UUID', None, None,
     None, 'tester4', 'tester6', None, 204),

    # POST object in own account: ok
    ('POST', None, None, 'UUID', 'UUID', None,
     None, 'tester', 'tester', None, 202),
    ('POST', None, None, 'UUID', 'UUID', None,
     None, 'tester', 'tester', 'tester', 202),

    # POST object in other users account: not allowed for role admin
    ('POST', None, None, 'UUID', 'UUID', None,
     None, 'tester2', 'tester', None, 403),
    ('POST', None, None, 'UUID', 'UUID', None,
     None, 'tester4', 'tester', None, 403),

    # POST object in other users account: not allowed for role _member_
    ('POST', None, None, 'UUID', 'UUID', None,
     None, 'tester3', 'tester3', None, 403),
    ('POST', None, None, 'UUID', 'UUID', None,
     None, 'tester2', 'tester3', None, 403),
    ('POST', None, None, 'UUID', 'UUID', None,
     None, 'tester4', 'tester3', None, 403),

    # POST object in other users account: allowed for role ResellerAdmin
    ('POST', None, None, 'UUID', 'UUID', None,
     None, 'tester6', 'tester6', None, 202),
    ('POST', None, None, 'UUID', 'UUID', None,
     None, 'tester2', 'tester6', None, 202),
    ('POST', None, None, 'UUID', 'UUID', None,
     None, 'tester4', 'tester6', None, 202)
]


RBAC_POST_WITH_SERVICE_PREFIX = [
    # POST own account: ok
    ('POST', None, None, None, None, None,
     None, 'tester', 'tester', 'tester5', 204),

    # POST own account: ok
    ('POST', None, None, None, None, None,
     None, 'tester', 'tester3', 'tester5', 403),
    ('POST', None, None, None, None, None,
     None, 'tester', None, 'tester5', 401),
    ('POST', None, None, None, None, None,
     None, 'tester5', 'tester5', None, 403),
    ('POST', None, None, None, None, None,
     None, 'tester2', 'tester5', None, 403),
    ('POST', None, None, None, None, None,
     None, 'tester4', 'tester5', None, 403),

    # POST container in own account: ok
    ('POST', None, None, 'UUID', None, None,
     None, 'tester', 'tester', 'tester5', 204),

    # POST container in other users account: not allowed for role service
    ('POST', None, None, 'UUID', None, None,
     None, 'tester', 'tester3', 'tester5', 403),
    ('POST', None, None, 'UUID', None, None,
     None, 'tester', None, 'tester5', 401),
    ('POST', None, None, 'UUID', None, None,
     None, 'tester5', 'tester5', None, 403),
    ('POST', None, None, 'UUID', None, None,
     None, 'tester2', 'tester5', None, 403),
    ('POST', None, None, 'UUID', None, None,
     None, 'tester4', 'tester5', None, 403),

    # POST object in own account: ok
    ('POST', None, None, 'UUID', 'UUID', None,
     None, 'tester', 'tester', 'tester5', 202),

    # POST object fails if wrong user, or only one token sent
    ('POST', None, None, 'UUID', 'UUID', None,
     None, 'tester', 'tester3', 'tester5', 403),
    ('POST', None, None, 'UUID', 'UUID', None,
     None, 'tester', None, 'tester5', 401),
    ('POST', None, None, 'UUID', 'UUID', None,
     None, 'tester5', 'tester5', None, 403),
    ('POST', None, None, 'UUID', 'UUID', None,
     None, 'tester2', 'tester5', None, 403),
    ('POST', None, None, 'UUID', 'UUID', None,
     None, 'tester4', 'tester5', None, 403),

    # All following actions are using SERVICE prefix

    # POST own account: ok
    ('POST', None, None, None, None, None,
     'SERVICE', 'tester', 'tester', 'tester5', 204),

    # POST other account: not allowed for role service
    ('POST', None, None, None, None, None,
     'SERVICE', 'tester', 'tester3', 'tester5', 403),
    ('POST', None, None, None, None, None,
     'SERVICE', 'tester', 'tester', None, 403),
    ('POST', None, None, None, None, None,
     'SERVICE', 'tester', 'tester', 'tester', 403),
    ('POST', None, None, None, None, None,
     'SERVICE', 'tester', None, 'tester5', 401),

    # POST container in own account: ok
    ('POST', None, None, 'UUID', None, None,
     'SERVICE', 'tester', 'tester', 'tester5', 204),

    # POST container in other users account: not allowed for role service
    ('POST', None, None, 'UUID', None, None,
     'SERVICE', 'tester', 'tester3', 'tester5', 403),
    ('POST', None, None, 'UUID', None, None,
     'SERVICE', 'tester', 'tester', None, 403),
    ('POST', None, None, 'UUID', None, None,
     'SERVICE', 'tester', 'tester', 'tester', 403),
    ('POST', None, None, 'UUID', None, None,
     'SERVICE', 'tester', None, 'tester5', 401),

    # POST object in own account: ok
    ('POST', None, None, 'UUID', 'UUID', None,
     'SERVICE', 'tester', 'tester', 'tester5', 202),

    # POST object fails if wrong user, or only one token sent
    ('POST', None, None, 'UUID', 'UUID', None,
     'SERVICE', 'tester', 'tester3', 'tester5', 403),
    ('POST', None, None, 'UUID', 'UUID', None,
     'SERVICE', 'tester', 'tester', None, 403),
    ('POST', None, None, 'UUID', 'UUID', None,
     'SERVICE', 'tester', 'tester', 'tester', 403),
    ('POST', None, None, 'UUID', 'UUID', None,
     'SERVICE', 'tester', None, 'tester5', 401)
]


# A scenario of options for account, container and object with
# several roles.
RBAC_OPTIONS = [
    # OPTIONS request is always ok

    ('OPTIONS', None, None, None, None, None,
     None, 'tester', 'tester', None, 200),
    ('OPTIONS', None, None, None, None, None,
     None, 'tester', 'tester', 'tester', 200),
    ('OPTIONS', None, None, None, None, None,
     None, 'tester2', 'tester', None, 200),
    ('OPTIONS', None, None, None, None, None,
     None, 'tester4', 'tester', None, 200),
    ('OPTIONS', None, None, None, None, None,
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS', None, None, None, None, None,
     None, 'tester2', 'tester3', None, 200),
    ('OPTIONS', None, None, None, None, None,
     None, 'tester4', 'tester3', None, 200),
    ('OPTIONS', None, None, None, None, None,
     None, 'tester6', 'tester6', None, 200),
    ('OPTIONS', None, None, None, None, None,
     None, 'tester2', 'tester6', None, 200),
    ('OPTIONS', None, None, None, None, None,
     None, 'tester4', 'tester6', None, 200),
    ('OPTIONS', None, None, 'UUID', None, None,
     None, 'tester', 'tester', None, 200),
    ('OPTIONS', None, None, 'UUID', None, None,
     None, 'tester', 'tester', 'tester', 200),
    ('OPTIONS', None, None, 'UUID', None, None,
     None, 'tester2', 'tester', None, 200),
    ('OPTIONS', None, None, 'UUID', None, None,
     None, 'tester4', 'tester', None, 200),
    ('OPTIONS', None, None, 'UUID', None, None,
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS', None, None, 'UUID', None, None,
     None, 'tester2', 'tester3', None, 200),
    ('OPTIONS', None, None, 'UUID', None, None,
     None, 'tester4', 'tester3', None, 200),
    ('OPTIONS', None, None, 'UUID', None, None,
     None, 'tester6', 'tester6', None, 200),
    ('OPTIONS', None, None, 'UUID', None, None,
     None, 'tester2', 'tester6', None, 200),
    ('OPTIONS', None, None, 'UUID', None, None,
     None, 'tester4', 'tester6', None, 200),
    ('OPTIONS', None, None, 'UUID', 'UUID', None,
     None, 'tester', 'tester', None, 200),
    ('OPTIONS', None, None, 'UUID', 'UUID', None,
     None, 'tester', 'tester', 'tester', 200),
    ('OPTIONS', None, None, 'UUID', 'UUID', None,
     None, 'tester2', 'tester', None, 200),
    ('OPTIONS', None, None, 'UUID', 'UUID', None,
     None, 'tester4', 'tester', None, 200),
    ('OPTIONS', None, None, 'UUID', 'UUID', None,
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS', None, None, 'UUID', 'UUID', None,
     None, 'tester2', 'tester3', None, 200),
    ('OPTIONS', None, None, 'UUID', 'UUID', None,
     None, 'tester4', 'tester3', None, 200),
    ('OPTIONS', None, None, 'UUID', 'UUID', None,
     None, 'tester6', 'tester6', None, 200),
    ('OPTIONS', None, None, 'UUID', 'UUID', None,
     None, 'tester2', 'tester6', None, 200),
    ('OPTIONS', None, None, 'UUID', 'UUID', None,
     None, 'tester4', 'tester6', None, 200),
    ('OPTIONS', None, None, None, None,
     {"X-Container-Meta-Access-Control-Allow-Origin": "*"},
     None, 'tester', 'tester', None, 200),
    ('OPTIONS', None, None, None, None,
     {"X-Container-Meta-Access-Control-Allow-Origin": "http://invalid.com"},
     None, 'tester', 'tester', None, 200),
    ('OPTIONS', None, None, 'UUID', None,
     {"X-Container-Meta-Access-Control-Allow-Origin": "*"},
     None, 'tester', 'tester', None, 200),
    ('OPTIONS', None, None, 'UUID', None,
     {"X-Container-Meta-Access-Control-Allow-Origin": "http://invalid.com"},
     None, 'tester', 'tester', None, 200),
    ('OPTIONS', None, None, 'UUID', 'UUID',
     {"X-Container-Meta-Access-Control-Allow-Origin": "*"},
     None, 'tester', 'tester', None, 200),
    ('OPTIONS', None, None, 'UUID', 'UUID',
     {"X-Container-Meta-Access-Control-Allow-Origin": "http://invalid.com"},
     None, 'tester', 'tester', None, 200),
    ('OPTIONS',
     {"Origin": "http://localhost", "Access-Control-Request-Method": "GET"},
     None, None, None, None, None, 'tester', 'tester', None, 200),
    ('OPTIONS',
     {"Origin": "http://localhost", "Access-Control-Request-Method": "GET"},
     None, None, None,
     {"X-Container-Meta-Access-Control-Allow-Origin": "*"},
     None, 'tester', 'tester', None, 200),
    ('OPTIONS',
     {"Origin": "http://localhost", "Access-Control-Request-Method": "GET"},
     None, None, None,
     {"X-Container-Meta-Access-Control-Allow-Origin": "http://invalid.com"},
     None, 'tester', 'tester', None, 200),
    ('OPTIONS',
     {"Origin": "http://localhost", "Access-Control-Request-Method": "GET"},
     None, 'UUID', None, None, None, 'tester', 'tester', None, 401),
    ('OPTIONS',
     {"Origin": "http://localhost", "Access-Control-Request-Method": "GET"},
     None, 'UUID', None,
     {"X-Container-Meta-Access-Control-Allow-Origin": "*"},
     None, 'tester', 'tester', None, 200),

    # Not OK for container: wrong origin
    ('OPTIONS',
     {"Origin": "http://localhost", "Access-Control-Request-Method": "GET"},
     None, 'UUID', None,
     {"X-Container-Meta-Access-Control-Allow-Origin": "http://invalid.com"},
     None, 'tester', 'tester', None, 401),

    # Not OK for object: missing X-Container-Meta-Access-Control-Allow-Origin
    ('OPTIONS',
     {"Origin": "http://localhost", "Access-Control-Request-Method": "GET"},
     None, 'UUID', 'UUID', None, None, 'tester', 'tester', None, 401),
    ('OPTIONS',
     {"Origin": "http://localhost", "Access-Control-Request-Method": "GET"},
     None, 'UUID', 'UUID',
     {"X-Container-Meta-Access-Control-Allow-Origin": "*"},
     None, 'tester', None, None, 200),

    # Not OK for object: wrong origin
    ('OPTIONS',
     {"Origin": "http://localhost", "Access-Control-Request-Method": "GET"},
     None, 'UUID', 'UUID',
     {"X-Container-Meta-Access-Control-Allow-Origin": "http://invalid.com"},
     None, 'tester', 'tester', None, 401)
]


RBAC_OPTIONS_WITH_SERVICE_PREFIX = [
    # OPTIONS request is always ok

    ('OPTIONS', None, None, None, None, None,
     None, 'tester', 'tester', 'tester5', 200),
    ('OPTIONS', None, None, None, None, None,
     None, 'tester', 'tester3', 'tester5', 200),
    ('OPTIONS', None, None, None, None, None,
     None, 'tester', None, 'tester5', 200),
    ('OPTIONS', None, None, None, None, None,
     None, 'tester5', 'tester5', None, 200),
    ('OPTIONS', None, None, None, None, None,
     None, 'tester2', 'tester5', None, 200),
    ('OPTIONS', None, None, None, None, None,
     None, 'tester4', 'tester5', None, 200),
    ('OPTIONS', None, None, 'UUID', None, None,
     None, 'tester', 'tester', 'tester5', 200),
    ('OPTIONS', None, None, 'UUID', None, None,
     None, 'tester', 'tester3', 'tester5', 200),
    ('OPTIONS', None, None, 'UUID', None, None,
     None, 'tester', None, 'tester5', 200),
    ('OPTIONS', None, None, 'UUID', None, None,
     None, 'tester5', 'tester5', None, 200),
    ('OPTIONS', None, None, 'UUID', None, None,
     None, 'tester2', 'tester5', None, 200),
    ('OPTIONS', None, None, 'UUID', None, None,
     None, 'tester4', 'tester5', None, 200),
    ('OPTIONS', None, None, 'UUID', 'UUID', None,
     None, 'tester', 'tester', 'tester5', 200),
    ('OPTIONS', None, None, 'UUID', 'UUID', None,
     None, 'tester', 'tester3', 'tester5', 200),
    ('OPTIONS', None, None, 'UUID', 'UUID', None,
     None, 'tester', None, 'tester5', 200),
    ('OPTIONS', None, None, 'UUID', 'UUID', None,
     None, 'tester5', 'tester5', None, 200),
    ('OPTIONS', None, None, 'UUID', 'UUID', None,
     None, 'tester2', 'tester5', None, 200),
    ('OPTIONS', None, None, 'UUID', 'UUID', None,
     None, 'tester4', 'tester5', None, 200),
    ('OPTIONS', None, None, None, None, None,
     'SERVICE', 'tester', 'tester', 'tester5', 200),
    ('OPTIONS', None, None, None, None, None,
     'SERVICE', 'tester', 'tester3', 'tester5', 200),
    ('OPTIONS', None, None, None, None, None,
     'SERVICE', 'tester', 'tester', None, 200),
    ('OPTIONS', None, None, None, None, None,
     'SERVICE', 'tester', 'tester', 'tester', 200),
    ('OPTIONS', None, None, None, None, None,
     'SERVICE', 'tester', None, 'tester5', 200),
    ('OPTIONS', None, None, 'UUID', None, None,
     'SERVICE', 'tester', 'tester', 'tester5', 200),
    ('OPTIONS', None, None, 'UUID', None, None,
     'SERVICE', 'tester', 'tester3', 'tester5', 200),
    ('OPTIONS', None, None, 'UUID', None, None,
     'SERVICE', 'tester', 'tester', None, 200),
    ('OPTIONS', None, None, 'UUID', None, None,
     'SERVICE', 'tester', 'tester', 'tester', 200),
    ('OPTIONS', None, None, 'UUID', None, None,
     'SERVICE', 'tester', None, 'tester5', 200),
    ('OPTIONS', None, None, 'UUID', 'UUID', None,
     'SERVICE', 'tester', 'tester', 'tester5', 200),
    ('OPTIONS', None, None, 'UUID', 'UUID', None,
     'SERVICE', 'tester', 'tester3', 'tester5', 200),
    ('OPTIONS', None, None, 'UUID', 'UUID', None,
     'SERVICE', 'tester', 'tester', None, 200),
    ('OPTIONS', None, None, 'UUID', 'UUID', None,
     'SERVICE', 'tester', 'tester', 'tester', 200),
    ('OPTIONS', None, None, 'UUID', 'UUID', None,
     'SERVICE', 'tester', None, 'tester5', 200)
]


# A scenario of put for container ACL
ACL_PUT = [
    ('PUT',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test:tester3'},
     None, 'tester3', 'tester3', None, 403),
    ('PUT',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test:%(tester3_id)s'},
     None, 'tester3', 'tester3', None, 403),
    ('PUT',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '%(test_id)s:tester3'},
     None, 'tester3', 'tester3', None, 403),
    ('PUT',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '%(test_id)s:%(tester3_id)s'},
     None, 'tester3', 'tester3', None, 403),
    ('PUT',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('PUT',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test:*'},
     None, 'tester3', 'tester3', None, 403),
    ('PUT',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test'},
     None, 'tester3', 'tester3', None, 403),
    ('PUT',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '%(test_id)s'},
     None, 'tester3', 'tester3', None, 403),
    ('PUT',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test2:tester3'},
     None, 'tester3', 'tester3', None, 403),
    ('PUT',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test2:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('PUT',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test2:*'},
     None, 'tester3', 'tester3', None, 403),
    ('PUT',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test2'},
     None, 'tester3', 'tester3', None, 403),
    ('PUT',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '*:tester3'},
     None, 'tester3', 'tester3', None, 403),
    ('PUT',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '*:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('PUT',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '*:*'},
     None, 'tester3', 'tester3', None, 403),
    ('PUT',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '*'},
     None, 'tester3', 'tester3', None, 403),
    ('PUT',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '.r:*'},
     None, 'tester3', 'tester3', None, 403),
    ('PUT',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '.r:*,.rlistings'},
     None, 'tester3', 'tester3', None, 403),
    ('PUT',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '.r:invalid.domain.com'},
     None, 'tester3', 'tester3', None, 403),
    ('PUT',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '.r:invalid.domain.com,.rlistings'},
     None, 'tester3', 'tester3', None, 403),
    ('PUT',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '.rlistings'},
     None, 'tester3', 'tester3', None, 403),
    ('PUT',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test:tester3'},
     None, 'tester3', 'tester3', None, 201),
    ('PUT',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test:%(tester3_id)s'},
     None, 'tester3', 'tester3', None, 201),
    ('PUT',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '%(test_id)s:tester3'},
     None, 'tester3', 'tester3', None, 201),
    ('PUT',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '%(test_id)s:%(tester3_id)s'},
     None, 'tester3', 'tester3', None, 201),
    ('PUT',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('PUT',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test:*'},
     None, 'tester3', 'tester3', None, 201),
    ('PUT',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test'},
     None, 'tester3', 'tester3', None, 403),
    ('PUT',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '%(test_id)s'},
     None, 'tester3', 'tester3', None, 403),
    ('PUT',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test2:tester3'},
     None, 'tester3', 'tester3', None, 403),
    ('PUT',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test2:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('PUT',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test2:*'},
     None, 'tester3', 'tester3', None, 403),
    ('PUT',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test2'},
     None, 'tester3', 'tester3', None, 403),
    ('PUT',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '*:tester3'},
     None, 'tester3', 'tester3', None, 201),
    ('PUT',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '*:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('PUT',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '*:*'},
     None, 'tester3', 'tester3', None, 201),
    ('PUT',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '*'},
     None, 'tester3', 'tester3', None, 403),
    ('PUT',
     None,
     None, 'UUID', 'UUID',
     None,
     None, 'tester3', 'tester3', None, 403)
]


# A scenario of delete for container ACL
ACL_DELETE = [
    ('DELETE',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test:tester3'},
     None, 'tester3', 'tester3', None, 403),
    ('DELETE',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test:%(tester3_id)s'},
     None, 'tester3', 'tester3', None, 403),
    ('DELETE',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '%(test_id)s:tester3'},
     None, 'tester3', 'tester3', None, 403),
    ('DELETE',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '%(test_id)s:%(tester3_id)s'},
     None, 'tester3', 'tester3', None, 403),
    ('DELETE',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('DELETE',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test:*'},
     None, 'tester3', 'tester3', None, 403),
    ('DELETE',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test'},
     None, 'tester3', 'tester3', None, 403),
    ('DELETE',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '%(test_id)s'},
     None, 'tester3', 'tester3', None, 403),
    ('DELETE',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test2:tester3'},
     None, 'tester3', 'tester3', None, 403),
    ('DELETE',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test2:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('DELETE',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test2:*'},
     None, 'tester3', 'tester3', None, 403),
    ('DELETE',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test2'},
     None, 'tester3', 'tester3', None, 403),
    ('DELETE',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '*:tester3'},
     None, 'tester3', 'tester3', None, 403),
    ('DELETE',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '*:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('DELETE',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '*:*'},
     None, 'tester3', 'tester3', None, 403),
    ('DELETE',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '*'},
     None, 'tester3', 'tester3', None, 403),
    ('DELETE',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '.r:*'},
     None, 'tester3', 'tester3', None, 403),
    ('DELETE',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '.r:*,.rlistings'},
     None, 'tester3', 'tester3', None, 403),
    ('DELETE',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '.r:invalid.domain.com'},
     None, 'tester3', 'tester3', None, 403),
    ('DELETE',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '.r:invalid.domain.com,.rlistings'},
     None, 'tester3', 'tester3', None, 403),
    ('DELETE',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '.rlistings'},
     None, 'tester3', 'tester3', None, 403),
    ('DELETE',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test:tester3'},
     None, 'tester3', 'tester3', None, 204),
    ('DELETE',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test:%(tester3_id)s'},
     None, 'tester3', 'tester3', None, 204),
    ('DELETE',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '%(test_id)s:tester3'},
     None, 'tester3', 'tester3', None, 204),
    ('DELETE',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '%(test_id)s:%(tester3_id)s'},
     None, 'tester3', 'tester3', None, 204),
    ('DELETE',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('DELETE',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test:*'},
     None, 'tester3', 'tester3', None, 204),
    ('DELETE',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test'},
     None, 'tester3', 'tester3', None, 403),
    ('DELETE',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '%(test_id)s'},
     None, 'tester3', 'tester3', None, 403),
    ('DELETE',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test2:tester3'},
     None, 'tester3', 'tester3', None, 403),
    ('DELETE',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test2:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('DELETE',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test2:*'},
     None, 'tester3', 'tester3', None, 403),
    ('DELETE',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test2'},
     None, 'tester3', 'tester3', None, 403),
    ('DELETE',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '*:tester3'},
     None, 'tester3', 'tester3', None, 204),
    ('DELETE',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '*:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('DELETE',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '*:*'},
     None, 'tester3', 'tester3', None, 204),
    ('DELETE',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '*'},
     None, 'tester3', 'tester3', None, 403),
    ('DELETE',
     None,
     None, 'UUID', 'UUID',
     None,
     None, 'tester3', 'tester3', None, 403)
]


# A scenario of get for container ACL
ACL_GET = [
    ('GET',
     None,
     None, 'UUID', None,
     {'X-Container-Read': 'test:tester3'},
     None, 'tester3', 'tester3', None, 200),
    ('GET',
     None,
     None, 'UUID', None,
     {'X-Container-Read': 'test:%(tester3_id)s'},
     None, 'tester3', 'tester3', None, 200),
    ('GET',
     None,
     None, 'UUID', None,
     {'X-Container-Read': '%(test_id)s:tester3'},
     None, 'tester3', 'tester3', None, 200),
    ('GET',
     None,
     None, 'UUID', None,
     {'X-Container-Read': '%(test_id)s:%(tester3_id)s'},
     None, 'tester3', 'tester3', None, 200),
    ('GET',
     None,
     None, 'UUID', None,
     {'X-Container-Read': 'test:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', None,
     {'X-Container-Read': 'test:*'},
     None, 'tester3', 'tester3', None, 200),
    ('GET',
     None,
     None, 'UUID', None,
     {'X-Container-Read': 'test'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', None,
     {'X-Container-Read': '%(test_id)s'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', None,
     {'X-Container-Read': 'test2:tester3'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', None,
     {'X-Container-Read': 'test2:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', None,
     {'X-Container-Read': 'test2:*'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', None,
     {'X-Container-Read': 'test2'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', None,
     {'X-Container-Read': '*:tester3'},
     None, 'tester3', 'tester3', None, 200),
    ('GET',
     None,
     None, 'UUID', None,
     {'X-Container-Read': '*:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', None,
     {'X-Container-Read': '*:*'},
     None, 'tester3', 'tester3', None, 200),
    ('GET',
     None,
     None, 'UUID', None,
     {'X-Container-Read': '*'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', None,
     {'X-Container-Read': '.r:*'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', None,
     {'X-Container-Read': '.r:*,.rlistings'},
     None, 'tester3', 'tester3', None, 200),
    ('GET',
     None,
     None, 'UUID', None,
     {'X-Container-Read': '.r:invalid.domain.com'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', None,
     {'X-Container-Read': '.r:invalid.domain.com,.rlistings'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', None,
     {'X-Container-Read': '.rlistings'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', None,
     {'X-Container-Write': 'test:tester3'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', None,
     {'X-Container-Write': 'test:%(tester3_id)s'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', None,
     {'X-Container-Write': '%(test_id)s:tester3'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', None,
     {'X-Container-Write': '%(test_id)s:%(tester3_id)s'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', None,
     {'X-Container-Write': 'test:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', None,
     {'X-Container-Write': 'test:*'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', None,
     {'X-Container-Write': 'test'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', None,
     {'X-Container-Write': '%(test_id)s'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', None,
     {'X-Container-Write': 'test2:tester3'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', None,
     {'X-Container-Write': 'test2:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', None,
     {'X-Container-Write': 'test2:*'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', None,
     {'X-Container-Write': 'test2'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', None,
     {'X-Container-Write': '*:tester3'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', None,
     {'X-Container-Write': '*:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', None,
     {'X-Container-Write': '*:*'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', None,
     {'X-Container-Write': '*'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', None,
     None,
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test:tester3'},
     None, 'tester3', 'tester3', None, 200),
    ('GET',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test:%(tester3_id)s'},
     None, 'tester3', 'tester3', None, 200),
    ('GET',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '%(test_id)s:tester3'},
     None, 'tester3', 'tester3', None, 200),
    ('GET',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '%(test_id)s:%(tester3_id)s'},
     None, 'tester3', 'tester3', None, 200),
    ('GET',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test:*'},
     None, 'tester3', 'tester3', None, 200),
    ('GET',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '%(test_id)s'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test2:tester3'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test2:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test2:*'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test2'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '*:tester3'},
     None, 'tester3', 'tester3', None, 200),
    ('GET',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '*:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '*:*'},
     None, 'tester3', 'tester3', None, 200),
    ('GET',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '*'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '.r:*'},
     None, 'tester3', 'tester3', None, 200),
    ('GET',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '.r:*,.rlistings'},
     None, 'tester3', 'tester3', None, 200),
    ('GET',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '.r:invalid.domain.com'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '.r:invalid.domain.com,.rlistings'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '.rlistings'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test:tester3'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test:%(tester3_id)s'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '%(test_id)s:tester3'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '%(test_id)s:%(tester3_id)s'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test:*'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '%(test_id)s'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test2:tester3'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test2:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test2:*'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test2'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '*:tester3'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '*:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '*:*'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '*'},
     None, 'tester3', 'tester3', None, 403),
    ('GET',
     None,
     None, 'UUID', 'UUID',
     None,
     None, 'tester3', 'tester3', None, 403)
]


# A scenario of head for container ACL
ACL_HEAD = [
    ('HEAD',
     None,
     None, 'UUID', None,
     {'X-Container-Read': 'test:tester3'},
     None, 'tester3', 'tester3', None, 204),
    ('HEAD',
     None,
     None, 'UUID', None,
     {'X-Container-Read': 'test:%(tester3_id)s'},
     None, 'tester3', 'tester3', None, 204),
    ('HEAD',
     None,
     None, 'UUID', None,
     {'X-Container-Read': '%(test_id)s:tester3'},
     None, 'tester3', 'tester3', None, 204),
    ('HEAD',
     None,
     None, 'UUID', None,
     {'X-Container-Read': '%(test_id)s:%(tester3_id)s'},
     None, 'tester3', 'tester3', None, 204),
    ('HEAD',
     None,
     None, 'UUID', None,
     {'X-Container-Read': 'test:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', None,
     {'X-Container-Read': 'test:*'},
     None, 'tester3', 'tester3', None, 204),
    ('HEAD',
     None,
     None, 'UUID', None,
     {'X-Container-Read': 'test'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', None,
     {'X-Container-Read': '%(test_id)s'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', None,
     {'X-Container-Read': 'test2:tester3'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', None,
     {'X-Container-Read': 'test2:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', None,
     {'X-Container-Read': 'test2:*'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', None,
     {'X-Container-Read': 'test2'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', None,
     {'X-Container-Read': '*:tester3'},
     None, 'tester3', 'tester3', None, 204),
    ('HEAD',
     None,
     None, 'UUID', None,
     {'X-Container-Read': '*:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', None,
     {'X-Container-Read': '*:*'},
     None, 'tester3', 'tester3', None, 204),
    ('HEAD',
     None,
     None, 'UUID', None,
     {'X-Container-Read': '*'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', None,
     {'X-Container-Read': '.r:*'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', None,
     {'X-Container-Read': '.r:*,.rlistings'},
     None, 'tester3', 'tester3', None, 204),
    ('HEAD',
     None,
     None, 'UUID', None,
     {'X-Container-Read': '.r:invalid.domain.com'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', None,
     {'X-Container-Read': '.r:invalid.domain.com,.rlistings'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', None,
     {'X-Container-Read': '.rlistings'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', None,
     {'X-Container-Write': 'test:tester3'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', None,
     {'X-Container-Write': 'test:%(tester3_id)s'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', None,
     {'X-Container-Write': '%(test_id)s:tester3'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', None,
     {'X-Container-Write': '%(test_id)s:%(tester3_id)s'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', None,
     {'X-Container-Write': 'test:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', None,
     {'X-Container-Write': 'test:*'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', None,
     {'X-Container-Write': 'test'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', None,
     {'X-Container-Write': '%(test_id)s'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', None,
     {'X-Container-Write': 'test2:tester3'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', None,
     {'X-Container-Write': 'test2:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', None,
     {'X-Container-Write': 'test2:*'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', None,
     {'X-Container-Write': 'test2'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', None,
     {'X-Container-Write': '*:tester3'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', None,
     {'X-Container-Write': '*:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', None,
     {'X-Container-Write': '*:*'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', None,
     {'X-Container-Write': '*'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', None,
     None,
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test:tester3'},
     None, 'tester3', 'tester3', None, 200),
    ('HEAD',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test:%(tester3_id)s'},
     None, 'tester3', 'tester3', None, 200),
    ('HEAD',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '%(test_id)s:tester3'},
     None, 'tester3', 'tester3', None, 200),
    ('HEAD',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '%(test_id)s:%(tester3_id)s'},
     None, 'tester3', 'tester3', None, 200),
    ('HEAD',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test:*'},
     None, 'tester3', 'tester3', None, 200),
    ('HEAD',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '%(test_id)s'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test2:tester3'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test2:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test2:*'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test2'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '*:tester3'},
     None, 'tester3', 'tester3', None, 200),
    ('HEAD',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '*:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '*:*'},
     None, 'tester3', 'tester3', None, 200),
    ('HEAD',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '*'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '.r:*'},
     None, 'tester3', 'tester3', None, 200),
    ('HEAD',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '.r:*,.rlistings'},
     None, 'tester3', 'tester3', None, 200),
    ('HEAD',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '.r:invalid.domain.com'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '.r:invalid.domain.com,.rlistings'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '.rlistings'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test:tester3'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test:%(tester3_id)s'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '%(test_id)s:tester3'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '%(test_id)s:%(tester3_id)s'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test:*'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '%(test_id)s'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test2:tester3'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test2:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test2:*'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test2'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '*:tester3'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '*:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '*:*'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '*'},
     None, 'tester3', 'tester3', None, 403),
    ('HEAD',
     None,
     None, 'UUID', 'UUID',
     None,
     None, 'tester3', 'tester3', None, 403)
]


# A scenario of post for container ACL
ACL_POST = [
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test:tester3'},
     None, 'tester3', 'tester3', None, 403),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test:%(tester3_id)s'},
     None, 'tester3', 'tester3', None, 403),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '%(test_id)s:tester3'},
     None, 'tester3', 'tester3', None, 403),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '%(test_id)s:%(tester3_id)s'},
     None, 'tester3', 'tester3', None, 403),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test:*'},
     None, 'tester3', 'tester3', None, 403),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test'},
     None, 'tester3', 'tester3', None, 403),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '%(test_id)s'},
     None, 'tester3', 'tester3', None, 403),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test2:tester3'},
     None, 'tester3', 'tester3', None, 403),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test2:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test2:*'},
     None, 'tester3', 'tester3', None, 403),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test2'},
     None, 'tester3', 'tester3', None, 403),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '*:tester3'},
     None, 'tester3', 'tester3', None, 403),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '*:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '*:*'},
     None, 'tester3', 'tester3', None, 403),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '*'},
     None, 'tester3', 'tester3', None, 403),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '.r:*'},
     None, 'tester3', 'tester3', None, 403),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '.r:*,.rlistings'},
     None, 'tester3', 'tester3', None, 403),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '.r:invalid.domain.com'},
     None, 'tester3', 'tester3', None, 403),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '.r:invalid.domain.com,.rlistings'},
     None, 'tester3', 'tester3', None, 403),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '.rlistings'},
     None, 'tester3', 'tester3', None, 403),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test:tester3'},
     None, 'tester3', 'tester3', None, 202),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test:%(tester3_id)s'},
     None, 'tester3', 'tester3', None, 202),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '%(test_id)s:tester3'},
     None, 'tester3', 'tester3', None, 202),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '%(test_id)s:%(tester3_id)s'},
     None, 'tester3', 'tester3', None, 202),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test:*'},
     None, 'tester3', 'tester3', None, 202),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test'},
     None, 'tester3', 'tester3', None, 403),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '%(test_id)s'},
     None, 'tester3', 'tester3', None, 403),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test2:tester3'},
     None, 'tester3', 'tester3', None, 403),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test2:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test2:*'},
     None, 'tester3', 'tester3', None, 403),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test2'},
     None, 'tester3', 'tester3', None, 403),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '*:tester3'},
     None, 'tester3', 'tester3', None, 202),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '*:tester2'},
     None, 'tester3', 'tester3', None, 403),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '*:*'},
     None, 'tester3', 'tester3', None, 202),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '*'},
     None, 'tester3', 'tester3', None, 403),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     None,
     None, 'tester3', 'tester3', None, 403),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test',
      'X-Container-Write': 'test:tester3'},
     None, 'tester3', 'tester3', None, 202),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test:tester3',
      'X-Container-Write': 'test:tester3'},
     None, 'tester3', 'tester3', None, 202),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test:tester2',
      'X-Container-Write': 'test:tester3'},
     None, 'tester3', 'tester3', None, 202),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test:%(tester3_id)s',
      'X-Container-Write': 'test:tester3'},
     None, 'tester3', 'tester3', None, 202),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test:*',
      'X-Container-Write': 'test:tester3'},
     None, 'tester3', 'tester3', None, 202),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test2',
      'X-Container-Write': 'test:tester3'},
     None, 'tester3', 'tester3', None, 202),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test2:tester3',
      'X-Container-Write': 'test:tester3'},
     None, 'tester3', 'tester3', None, 202),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test2:tester2',
      'X-Container-Write': 'test:tester3'},
     None, 'tester3', 'tester3', None, 202),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test2:*',
      'X-Container-Write': 'test:tester3'},
     None, 'tester3', 'tester3', None, 202),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '%(test_id)s',
      'X-Container-Write': 'test:tester3'},
     None, 'tester3', 'tester3', None, 202),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '%(test_id)s:tester3',
      'X-Container-Write': 'test:tester3'},
     None, 'tester3', 'tester3', None, 202),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '%(test_id)s:%(tester3_id)s',
      'X-Container-Write': 'test:tester3'},
     None, 'tester3', 'tester3', None, 202),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '*',
      'X-Container-Write': 'test:tester3'},
     None, 'tester3', 'tester3', None, 202),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '*:tester3',
      'X-Container-Write': 'test:tester3'},
     None, 'tester3', 'tester3', None, 202),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '*:tester2',
      'X-Container-Write': 'test:tester3'},
     None, 'tester3', 'tester3', None, 202),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '*:*',
      'X-Container-Write': 'test:tester3'},
     None, 'tester3', 'tester3', None, 202),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '.rlistings',
      'X-Container-Write': 'test:tester3'},
     None, 'tester3', 'tester3', None, 202),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '.r:*',
      'X-Container-Write': 'test:tester3'},
     None, 'tester3', 'tester3', None, 202),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '.r:*,.rlistings',
      'X-Container-Write': 'test:tester3'},
     None, 'tester3', 'tester3', None, 202),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '.r:invalid.domain.com',
      'X-Container-Write': 'test:tester3'},
     None, 'tester3', 'tester3', None, 202),
    ('POST',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '.r:invalid.domain.com,.rlistings',
      'X-Container-Write': 'test:tester3'},
     None, 'tester3', 'tester3', None, 202)
]


# A scenario of options for container ACL
ACL_OPTIONS = [
    ('OPTIONS',
     None,
     None, 'UUID', None,
     {'X-Container-Read': 'test:tester3'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', None,
     {'X-Container-Read': 'test:%(tester3_id)s'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', None,
     {'X-Container-Read': '%(test_id)s:tester3'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', None,
     {'X-Container-Read': '%(test_id)s:%(tester3_id)s'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', None,
     {'X-Container-Read': 'test:tester2'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', None,
     {'X-Container-Read': 'test:*'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', None,
     {'X-Container-Read': 'test'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', None,
     {'X-Container-Read': '%(test_id)s'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', None,
     {'X-Container-Read': 'test2:tester3'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', None,
     {'X-Container-Read': 'test2:tester2'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', None,
     {'X-Container-Read': 'test2:*'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', None,
     {'X-Container-Read': 'test2'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', None,
     {'X-Container-Read': '*:tester3'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', None,
     {'X-Container-Read': '*:tester2'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', None,
     {'X-Container-Read': '*:*'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', None,
     {'X-Container-Read': '*'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', None,
     {'X-Container-Read': '.r:*'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', None,
     {'X-Container-Read': '.r:*,.rlistings'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', None,
     {'X-Container-Read': '.r:invalid.domain.com'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', None,
     {'X-Container-Read': '.r:invalid.domain.com,.rlistings'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', None,
     {'X-Container-Read': '.rlistings'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', None,
     {'X-Container-Write': 'test:tester3'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', None,
     {'X-Container-Write': 'test:%(tester3_id)s'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', None,
     {'X-Container-Write': '%(test_id)s:tester3'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', None,
     {'X-Container-Write': '%(test_id)s:%(tester3_id)s'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', None,
     {'X-Container-Write': 'test:tester2'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', None,
     {'X-Container-Write': 'test:*'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', None,
     {'X-Container-Write': 'test'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', None,
     {'X-Container-Write': '%(test_id)s'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', None,
     {'X-Container-Write': 'test2:tester3'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', None,
     {'X-Container-Write': 'test2:tester2'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', None,
     {'X-Container-Write': 'test2:*'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', None,
     {'X-Container-Write': 'test2'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', None,
     {'X-Container-Write': '*:tester3'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', None,
     {'X-Container-Write': '*:tester2'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', None,
     {'X-Container-Write': '*:*'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', None,
     {'X-Container-Write': '*'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', None,
     None,
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test:tester3'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test:%(tester3_id)s'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '%(test_id)s:tester3'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '%(test_id)s:%(tester3_id)s'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test:tester2'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test:*'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '%(test_id)s'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test2:tester3'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test2:tester2'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test2:*'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': 'test2'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '*:tester3'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '*:tester2'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '*:*'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '*'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '.r:*'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '.r:*,.rlistings'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '.r:invalid.domain.com'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '.r:invalid.domain.com,.rlistings'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Read': '.rlistings'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test:tester3'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test:%(tester3_id)s'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '%(test_id)s:tester3'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '%(test_id)s:%(tester3_id)s'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test:tester2'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test:*'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '%(test_id)s'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test2:tester3'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test2:tester2'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test2:*'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': 'test2'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '*:tester3'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '*:tester2'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '*:*'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', 'UUID',
     {'X-Container-Write': '*'},
     None, 'tester3', 'tester3', None, 200),
    ('OPTIONS',
     None,
     None, 'UUID', 'UUID',
     None,
     None, 'tester3', 'tester3', None, 200)
]


# http_method           : HTTP methods such as PUT, GET, POST, HEAD and so on
# auth_user_name        : a user name which is used for getting a token for
# expected              : expected status code
TEST_CASE_INFO_FORMAT = ('http_method', 'auth_user_name', 'expected')


RBAC_INFO_GET = [
    ('GET', 'tester', 200),
    ('GET', 'tester6', 200),
    ('GET', 'tester3', 200),
    ('GET', None, 200)
]


RBAC_INFO_HEAD = [
    ('HEAD', 'tester', 200),
    ('HEAD', 'tester6', 200),
    ('HEAD', 'tester3', 200),
    ('HEAD', None, 200)
]


RBAC_INFO_OPTIONS = [
    ('OPTIONS', 'tester', 200),
    ('OPTIONS', 'tester6', 200),
    ('OPTIONS', 'tester3', 200),
    ('OPTIONS', None, 200)
]


RBAC_INFO_GET_WITH_SERVICE_PREFIX = [
    ('GET', 'tester5', 200)
]


RBAC_INFO_HEAD_WITH_SERVICE_PREFIX = [
    ('HEAD', 'tester5', 200)
]


RBAC_INFO_OPTIONS_WITH_SERVICE_PREFIX = [
    ('OPTIONS', 'tester5', 200)
]


class BaseClient(object):
    def __init__(self):
        self._set_users()
        self.auth_url = tf.swift_test_auth
        self.insecure = tf.insecure
        self.auth_version = tf.swift_test_auth_version

    def _set_users(self):
        self.users = {}
        for index in range(6):
            self.users[tf.swift_test_user[index]] = {
                'account': tf.swift_test_tenant[index],
                'password': tf.swift_test_key[index],
                'domain': tf.swift_test_domain[index]}


class KeystoneClient(BaseClient):
    def get_id_info(self):
        id_info = {}
        for user_name, user_info in self.users.items():
            if user_name != '':
                user_id, project_id = self._get_id(user_name)
                id_info[user_name + '_id'] = user_id
                id_info[user_info['account'] + '_id'] = project_id
        return id_info

    def _get_id(self, user_name):
        info = self.users.get(user_name)
        keystone_client = client.Client(
            auth_url=self.auth_url,
            version=(self.auth_version,),
            username=user_name,
            password=info['password'],
            project_name=info['account'],
            project_domain_name=info['domain'],
            user_domain_name=info['domain'])
        return keystone_client.user_id, keystone_client.project_id


class SwiftClient(BaseClient):
    _tokens = {}

    def _get_auth(self, user_name):
        info = self.users.get(user_name)
        if info is None:
            return None, None

        os_options = {'user_domain_name': info['domain'],
                      'project_domain_name': info['domain']}
        authargs = dict(snet=False, tenant_name=info['account'],
                        auth_version=self.auth_version, os_options=os_options,
                        insecure=self.insecure)
        storage_url, token = get_auth(
            self.auth_url, user_name, info['password'], **authargs)

        return storage_url, token

    def auth(self, user_name):
        storage_url, token = SwiftClient._tokens.get(user_name, (None, None))
        if not token:
            SwiftClient._tokens[user_name] = self._get_auth(user_name)
            storage_url, token = SwiftClient._tokens.get(user_name)
        return storage_url, token

    def send_request(self, method, url, token=None, headers=None,
                     service_token=None):
        headers = {} if headers is None else headers.copy()
        headers.update({'Content-Type': 'application/json',
                       'Accept': 'application/json'})
        if token:
            headers['X-Auth-Token'] = token
        if service_token:
            headers['X-Service-Token'] = service_token
        if self.insecure:
            parsed, conn = http_connection(url, insecure=self.insecure)
        else:
            parsed, conn = http_connection(url)

        conn.request(method, parsed.path, headers=headers)
        resp = conn.getresponse()

        return resp


class BaseTestAC(unittest.TestCase):
    def setUp(self):
        self.reseller_admin = tf.swift_test_user[5]
        self.client = SwiftClient()

    def _create_resource_url(self, storage_url, account=None,
                             container=None, obj=None, reseller_prefix=None):
        # e.g.
        #   storage_url = 'http://localhost/v1/AUTH_xxx'
        #   storage_url_list[:-1] is ['http:', '', 'localhost', 'v1']
        #   storage_url_list[-1] is 'AUTH_xxx'
        storage_url_list = storage_url.rstrip('/').split('/')
        base_url = '/'.join(storage_url_list[:-1])

        if account is None:
            account = storage_url_list[-1]
            if reseller_prefix == 'SERVICE':
                # replace endpoint reseller prefix with service reseller prefix
                i = (account.index('_') + 1) if '_' in account else 0
                account = tf.swift_test_service_prefix + account[i:]

        return '/'.join([part for part in (base_url, account, container, obj)
                         if part])

    def _put_container(self, storage_url, token, test_case):
        resource_url = self._create_resource_url(
            storage_url,
            test_case['account_name'],
            test_case['container_name'],
            reseller_prefix=test_case['reseller_prefix'])
        self.created_resources.append(resource_url)
        self.client.send_request('PUT', resource_url, token,
                                 headers=test_case['prep_container_header'])

    def _put_object(self, storage_url, token, test_case):
        resource_url = self._create_resource_url(
            storage_url,
            test_case['account_name'],
            test_case['container_name'],
            test_case['object_name'],
            reseller_prefix=test_case['reseller_prefix'])
        self.created_resources.append(resource_url)
        self.client.send_request('PUT', resource_url, token)

    def _get_storage_url_and_token(self, storage_url_user, token_user):
        storage_url, _junk = self.client.auth(storage_url_user)
        _junk, token = self.client.auth(token_user)

        return storage_url, token

    def _prepare(self, test_case):
        storage_url, reseller_token = self._get_storage_url_and_token(
            test_case['target_user_name'], self.reseller_admin)

        if test_case['http_method'] in ('GET', 'POST', 'DELETE', 'HEAD',
                                        'OPTIONS'):
            temp_test_case = test_case.copy()
            if test_case['container_name'] is None:
                # When the target is for account, dummy container will be
                # created to create an account. This account is created by
                # account_autocreate.
                temp_test_case['container_name'] = uuid.uuid4().hex
            self._put_container(storage_url, reseller_token, temp_test_case)

            if test_case['object_name']:
                self._put_object(storage_url, reseller_token, test_case)

        elif test_case['http_method'] in ('PUT',):
            if test_case['object_name']:
                self._put_container(storage_url, reseller_token, test_case)

    def _execute(self, test_case):
        storage_url, token = self._get_storage_url_and_token(
            test_case['target_user_name'], test_case['auth_user_name'])

        service_user = test_case['service_user_name']
        service_token = (None if service_user is None
                         else self.client.auth(service_user)[1])

        resource_url = self._create_resource_url(
            storage_url,
            test_case['account_name'],
            test_case['container_name'],
            test_case['object_name'],
            test_case['reseller_prefix'])

        if test_case['http_method'] in ('PUT'):
            self.created_resources.append(resource_url)

        resp = self.client.send_request(test_case['http_method'],
                                        resource_url,
                                        token,
                                        headers=test_case['header'],
                                        service_token=service_token)

        return resp.status

    def _cleanup(self):
        _junk, reseller_token = self.client.auth(self.reseller_admin)
        for resource_url in reversed(self.created_resources):
            resp = self.client.send_request('DELETE', resource_url,
                                            reseller_token)
            self.assertIn(resp.status, (204, 404))

    def _convert_data(self, data):
        test_case = dict(zip(TEST_CASE_FORMAT, data))
        if test_case['container_name'] == 'UUID':
            test_case['container_name'] = uuid.uuid4().hex
        if test_case['object_name'] == 'UUID':
            test_case['object_name'] = uuid.uuid4().hex
        return test_case

    def _run_scenario(self, scenario):
        for data in scenario:
            test_case = self._convert_data(data)
            self.created_resources = []
            try:
                self._prepare(test_case)
                result = self._execute(test_case)
                self.assertEqual(test_case['expected'],
                                 result,
                                 'Expected %s but got %s for test case %s' %
                                 (test_case['expected'], result, test_case))
            finally:
                self._cleanup()


class TestRBAC(BaseTestAC):

    def test_rbac(self):
        if any((tf.skip, tf.skip2, tf.skip3, tf.skip_if_not_v3,
                tf.skip_if_no_reseller_admin)):
            raise unittest.SkipTest
        scenario_rbac = RBAC_PUT + RBAC_DELETE + RBAC_GET +\
            RBAC_HEAD + RBAC_POST + RBAC_OPTIONS
        shuffle(scenario_rbac)
        self._run_scenario(scenario_rbac)

    def test_rbac_with_service_prefix(self):
        if any((tf.skip, tf.skip2, tf.skip3, tf.skip_if_not_v3,
                tf.skip_service_tokens, tf.skip_if_no_reseller_admin)):
            raise unittest.SkipTest
        scenario_rbac = RBAC_PUT_WITH_SERVICE_PREFIX +\
            RBAC_DELETE_WITH_SERVICE_PREFIX +\
            RBAC_GET_WITH_SERVICE_PREFIX +\
            RBAC_HEAD_WITH_SERVICE_PREFIX +\
            RBAC_POST_WITH_SERVICE_PREFIX +\
            RBAC_OPTIONS_WITH_SERVICE_PREFIX
        shuffle(scenario_rbac)
        self._run_scenario(scenario_rbac)


class TestRBACInfo(BaseTestAC):
    def _get_info_url(self):
        storage_url, _junk = self.client.auth(self.reseller_admin)
        parsed_url = urlparse(storage_url)
        info_url_parts = (
            parsed_url.scheme, parsed_url.netloc, '/info', '', '', '')
        return urlunparse(info_url_parts)

    def _prepare(self, test_case):
        pass

    def _execute(self, test_case):
        _junk, token = \
            self.client.auth(test_case['auth_user_name'])
        resp = self.client.send_request(test_case['http_method'],
                                        self.info_url, token)
        return resp.status

    def _cleanup(self):
        pass

    def _convert_data(self, data):
        test_case = dict(zip(TEST_CASE_INFO_FORMAT, data))
        return test_case

    def test_rbac_info(self):
        if any((tf.skip, tf.skip2, tf.skip3, tf.skip_if_not_v3,
                tf.skip_if_no_reseller_admin)):
            raise unittest.SkipTest
        self.info_url = self._get_info_url()
        scenario_rbac_info = RBAC_INFO_GET + RBAC_INFO_HEAD + RBAC_INFO_OPTIONS
        shuffle(scenario_rbac_info)
        self._run_scenario(scenario_rbac_info)

    def test_rbac_info_with_service_prefix(self):
        if any((tf.skip, tf.skip2, tf.skip3, tf.skip_if_not_v3,
                tf.skip_service_tokens, tf.skip_if_no_reseller_admin)):
            raise unittest.SkipTest
        self.info_url = self._get_info_url()
        scenario_rbac_info = RBAC_INFO_GET_WITH_SERVICE_PREFIX +\
            RBAC_INFO_HEAD_WITH_SERVICE_PREFIX +\
            RBAC_INFO_OPTIONS_WITH_SERVICE_PREFIX
        shuffle(scenario_rbac_info)
        self._run_scenario(scenario_rbac_info)


class TestContainerACL(BaseTestAC):

    def _convert_data(self, data):
        test_case = super(TestContainerACL, self)._convert_data(data)
        prep_container_header = test_case['prep_container_header']
        if prep_container_header is not None:
            for header, header_val in prep_container_header.items():
                prep_container_header[header] = header_val % self.id_info
        return test_case

    def test_container_acl(self):
        if any((tf.skip, tf.skip2, tf.skip3, tf.skip_if_not_v3,
                tf.skip_if_no_reseller_admin)):
            raise unittest.SkipTest
        self.id_info = KeystoneClient().get_id_info()
        scenario_container_acl = ACL_PUT + ACL_DELETE + ACL_GET +\
            ACL_HEAD + ACL_POST + ACL_OPTIONS
        shuffle(scenario_container_acl)
        self._run_scenario(scenario_container_acl)


if __name__ == '__main__':
    unittest.main()