# Path: monasca_api/common/policy/policy_engine.py
# CONF = cfg.CONF
# LOG = logging.getLogger(__name__)
# POLICIES = None
# USER_BASED_RESOURCES = ['os-keypairs']
# KEY_EXPR = re.compile(r'%\((\w+)\)s')
# _ENFORCER = None
# DEFAULT_POLICY_FILE = 'policy.yaml'
#         _ENFORCER = None
#         _ENFORCER = policy.Enforcer(CONF,
#                                     policy_file=policy_file,
#                                     rules=rules,
#                                     default_rule=default_rule,
#                                     use_conf=use_conf
#                                     )
# def reset():
# def init(policy_file=None, rules=None, default_rule=None, use_conf=True):
# def _serialize_rules(rules):
# def _warning_for_deprecated_user_based_rules(rules):
# def register_rules(enforcer):
# def authorize(context, action, target, do_raise=True):
# def check_is_admin(context):
# def set_rules(rules, overwrite=True, use_conf=False):  # pragma: no cover
# def verify_deprecated_policy(old_policy, new_policy, default_rule, context):
# def get_rules():
# def get_enforcer():
#     def __init__(self, kind, match):
#     def __call__(self, target, creds, enforcer):
# class IsAdminCheck(policy.Check):


import requests_mock
from unittest import mock
from oslo_context import context
from oslo_policy import policy as os_policy
from monasca_api.common.policy import policy_engine
from monasca_api.tests.policy import base
            os_policy.RuleDefault("true", "@"),
            os_policy.RuleDefault("example:allowed", "@"),
            os_policy.RuleDefault("example:denied", "!"),
            os_policy.RuleDefault("old_action_not_default", "@"),
            os_policy.RuleDefault("new_action", "@"),
            os_policy.RuleDefault("old_action_default", "rule:admin_api"),
            os_policy.RuleDefault("example:lowercase_admin",
                                  "role:admin or role:sysadmin"),
            os_policy.RuleDefault("example:uppercase_admin",
                                  "role:ADMIN or role:sysadmin"),
            os_policy.RuleDefault("example:get_http",
                                  "http://www.example.com"),
            os_policy.RuleDefault("example:my_file",
                                  "role:compute_admin or "
                                  "project_id:%(project_id)s"),
            os_policy.RuleDefault("example:early_and_fail", "! and @"),
            os_policy.RuleDefault("example:early_or_success", "@ or !"),
        ]
        policy_engine.reset()
        policy_engine.init()

        self.context = context.RequestContext(user='fake',
                                              tenant='fake',
                                              is_admin=False)
        policy_engine._ENFORCER.register_defaults(rules)
        self.target = {}

    def test_authorize_nonexistent_action_throws(self):

        action = 'example:noexists'

# Path: monasca_api/common/policy/policy_engine.py
# CONF = cfg.CONF
# LOG = logging.getLogger(__name__)
# POLICIES = None
# USER_BASED_RESOURCES = ['os-keypairs']
# KEY_EXPR = re.compile(r'%\((\w+)\)s')
# _ENFORCER = None
# DEFAULT_POLICY_FILE = 'policy.yaml'
#         _ENFORCER = None
#         _ENFORCER = policy.Enforcer(CONF,
#                                     policy_file=policy_file,
#                                     rules=rules,
#                                     default_rule=default_rule,
#                                     use_conf=use_conf
#                                     )
# def reset():
# def init(policy_file=None, rules=None, default_rule=None, use_conf=True):
# def _serialize_rules(rules):
# def _warning_for_deprecated_user_based_rules(rules):
# def register_rules(enforcer):
# def authorize(context, action, target, do_raise=True):
# def check_is_admin(context):
# def set_rules(rules, overwrite=True, use_conf=False):  # pragma: no cover
# def verify_deprecated_policy(old_policy, new_policy, default_rule, context):
# def get_rules():
# def get_enforcer():
#     def __init__(self, kind, match):
#     def __call__(self, target, creds, enforcer):
# class IsAdminCheck(policy.Check):


# Path: monasca_api/tests/policy/test_policy.py
import requests_mock
from unittest import mock
from oslo_context import context
from oslo_policy import policy as os_policy
from monasca_api.common.policy import policy_engine
from monasca_api.tests.policy import base

            os_policy.RuleDefault("true", "@"),
            os_policy.RuleDefault("example:allowed", "@"),
            os_policy.RuleDefault("example:denied", "!"),
            os_policy.RuleDefault("old_action_not_default", "@"),
            os_policy.RuleDefault("new_action", "@"),
            os_policy.RuleDefault("old_action_default", "rule:admin_api"),
            os_policy.RuleDefault("example:lowercase_admin",
                                  "role:admin or role:sysadmin"),
            os_policy.RuleDefault("example:uppercase_admin",
                                  "role:ADMIN or role:sysadmin"),
            os_policy.RuleDefault("example:get_http",
                                  "http://www.example.com"),
            os_policy.RuleDefault("example:my_file",
                                  "role:compute_admin or "
                                  "project_id:%(project_id)s"),
            os_policy.RuleDefault("example:early_and_fail", "! and @"),
            os_policy.RuleDefault("example:early_or_success", "@ or !"),
        ]
        policy_engine.reset()
        policy_engine.init()

        self.context = context.RequestContext(user='fake',
                                              tenant='fake',
                                              is_admin=False)
        policy_engine._ENFORCER.register_defaults(rules)
        self.target = {}

    def test_authorize_nonexistent_action_throws(self):

        action = 'example:noexists'

        self.assertRaises(os_policy.PolicyNotRegistered, policy_engine.authorize,