def test_set_child_plugin_group(self):
        """Test setting child plugin's resource_group_name while loading
        plugins
        """
        mock_engine = mock.Mock()

        parent_plugin = fake_plugins.FakeSimplePlugin(es_engine=mock_engine)
        child_plugin = fake_plugins.FakeWrongGroupChildPlugin(
            es_engine=mock_engine)
        grandchild_plugin = fake_plugins.FakeWrongGroupGrandchildPlugin(
            es_engine=mock_engine)
        mock_stevedore_parent = mock.Mock()
        mock_stevedore_parent.obj = parent_plugin
        mock_stevedore_child = mock.Mock()
        mock_stevedore_child.obj = child_plugin
        mock_stevedore_grandchild = mock.Mock()
        mock_stevedore_grandchild.obj = grandchild_plugin

        with mock.patch('stevedore.extension.ExtensionManager') as mock_stev:
            manager = mock.Mock()
            manager.extensions = [mock_stevedore_parent,
                                  mock_stevedore_child,
                                  mock_stevedore_grandchild]

            mock_stev.return_value = manager
            searchlight_utils.get_search_plugins()
            self.assertEqual(grandchild_plugin.resource_group_name,
                             child_plugin.resource_group_name)
            self.assertEqual(child_plugin.resource_group_name,
                             parent_plugin.resource_group_name)

    def test_policy_all_disallowed(self):
        request = unit_test_utils.get_fake_request(is_admin=False)
        search_deserializer = search.RequestDeserializer(
            utils.get_search_plugins(),
            policy_enforcer=self.enforcer)

        types = ['OS::Glance::Image']
        self.enforcer.add_rules(policy.policy.Rules.from_dict({
            'resource:OS::Glance::Image': '!',
            'resource:OS::Nova::Server': '!',
        }))

        expected_message = (
            "There are no resource types accessible to you to serve "
            "your request. You do not have access to the following "
            "resource types: OS::Glance::Image")
        self.assertRaisesRegex(
            webob.exc.HTTPForbidden, expected_message,
            search_deserializer._filter_types_by_policy,
            request.context, types)

        types = ['OS::Glance::Image', 'OS::Nova::Server']
        expected_message = (
            "There are no resource types accessible to you to serve "
            "your request. You do not have access to the following "
            "resource types: OS::Glance::Image, OS::Nova::Server")
        self.assertRaisesRegex(
            webob.exc.HTTPForbidden, expected_message,
            search_deserializer._filter_types_by_policy,
            request.context, types)

def create_resource():
    """Search resource factory method"""
    plugins = utils.get_search_plugins()
    deserializer = RequestDeserializer(plugins)
    serializer = ResponseSerializer()
    controller = SearchController(plugins)
    return wsgi.Resource(controller, deserializer, serializer)

    def sync(self, index=None, _type=None, force=False, clear=False):
        # Verify all indices and types have registered plugins.
        # index and _type are lists because of nargs='*'
        index = index.split(',') if index else []
        _type = _type.split(',') if _type else []

        indices_set = set(index)
        types_set = set(_type)

        plugins_to_index = []
        for resource_type, ext in six.iteritems(utils.get_search_plugins()):
            plugin_obj = ext.obj
            indices_set.discard(plugin_obj.get_index_name())
            types_set.discard(plugin_obj.get_document_type())

            skip = (index and plugin_obj.get_index_name() not in index or
                    _type and plugin_obj.get_document_type() not in _type)
            if not skip:
                plugins_to_index.append((resource_type, ext))

        if indices_set or types_set:
            print("Some index names or types do not have plugins "
                  "registered. Index names: %s. Types: %s" %
                  (",".join(indices_set) or "<None>",
                   ",".join(types_set) or "<None>"))
            print("Aborting.")
            sys.exit(1)

        if not force:
            def format_selection(selection):
                resource_type, ext = selection
                return '  %s (%s)' % (ext.obj.get_document_type(),
                                      ext.obj.get_index_name())

            print("\nResource types (and indices) matching selection:\n%s\n" %
                  '\n'.join(map(format_selection, plugins_to_index)))

            if clear:
                ans = raw_input(
                    "Indexing will delete existing data and mapping(s) before "
                    "reindexing.\nUse '--force' to suppress this "
                    "message.\nOK to continue? [y/n]: ")
            else:
                ans = raw_input(
                    "Indexing will NOT delete existing data or mapping(s). It "
                    "will reindex all resources. \nUse '--force' to suppress "
                    "this message.\nOK to continue? [y/n]: ")
            if ans.lower() != 'y':
                print("Aborting.")
                sys.exit(0)

        for resource_type, ext in plugins_to_index:
            plugin_obj = ext.obj
            try:
                plugin_obj.initial_indexing(clear=clear)
            except Exception as e:
                LOG.error(_LE("Failed to setup index extension "
                              "%(ext)s: %(e)s") % {'ext': ext.name,
                                                   'e': e})

    def test_facets_resource_policy(self):
        request = unit_test_utils.get_fake_request()
        search_deserializer = search.RequestDeserializer(
            utils.get_search_plugins(),
            policy_enforcer=self.enforcer)

        with mock.patch.object(self.enforcer, 'check') as mock_enforce:
            search_deserializer.facets(request)
            self.assertIn(mock.call(request.context,
                                    'resource:OS::Nova::Server',
                                    request.context.policy_target),
                          mock_enforce.mock_calls)
            self.assertIn(mock.call(request.context,
                                    'resource:OS::Glance::Image',
                                    request.context.policy_target),
                          mock_enforce.mock_calls)
            self.assertEqual(len(utils.get_search_plugins()),
                             len(mock_enforce.call_args_list))

    def test_default_facet_options(self):
        request = unit_test_utils.get_fake_request(path='/v1/search/facets')
        output = self.deserializer.facets(request)

        output['doc_type'] = sorted(output['doc_type'])
        expected_doc_types = sorted(utils.get_search_plugins().keys())
        expected = {'index_name': None, 'doc_type': expected_doc_types,
                    'all_projects': False, 'limit_terms': 0}
        self.assertEqual(expected, output)

    def test_facet_exclude_options(self):
        path = '/v1/search/facets?exclude_options=True'
        request = unit_test_utils.get_fake_request(path=path)
        output = self.deserializer.facets(request)

        output['doc_type'] = sorted(output['doc_type'])
        expected_doc_types = sorted(utils.get_search_plugins().keys())
        expected = {'index_name': None, 'doc_type': expected_doc_types,
                    'all_projects': False, 'limit_terms': 0,
                    'include_fields': True, 'exclude_options': True}
        self.assertEqual(expected, output)

    def test_search_resource_policy_checks(self, mock_request_body):
        request = unit_test_utils.get_fake_request()
        search_deserializer = search.RequestDeserializer(
            utils.get_search_plugins(),
            policy_enforcer=self.enforcer)

        with mock.patch.object(self.enforcer, 'check') as mock_enforce:
            mock_request_body.return_value = {'type': 'OS::Nova::Server'}
            search_deserializer.search(request)
            mock_enforce.assert_called_with(request.context,
                                            'resource:OS::Nova::Server',
                                            request.context.policy_target)

    def test_facets_resource_policy(self):
        request = unit_test_utils.get_fake_request()
        search_deserializer = search.RequestDeserializer(
            utils.get_search_plugins(),
            policy_enforcer=self.enforcer)

        with mock.patch.object(self.enforcer, 'enforce') as mock_enforce:
            search_deserializer.facets(request)
            mock_enforce.assert_has_calls([
                mock.call(request.context,
                          'resource:OS::Nova::Server:allow', {}),
                mock.call(request.context,
                          'resource:OS::Nova::Server:facets', {})
            ])

    def test_search_service_policies(self):
        request = unit_test_utils.get_fake_request(is_admin=False)
        search_deserializer = search.RequestDeserializer(
            utils.get_search_plugins(),
            policy_enforcer=self.enforcer)

        types = ['OS::Glance::Image', 'OS::Nova::Server']
        glance_enforce = mock.Mock()
        nova_enforce = mock.Mock()
        glance_enforce.enforce.return_value = False
        nova_enforce.enforce.return_value = True
        service_enforcers = {
            'image': glance_enforce,
            'compute': nova_enforce
        }

        expect_creds = {
            'tenant_id': request.context.tenant,
            'project_id': request.context.tenant,
            'user_id': request.context.user,
            'roles': ['member'],
            'is_admin_project': True,
            'is_admin': False,
            'domain_id': None,
            'user_domain_id': None,
            'project_domain_id': None,
            'service_user_id': None,
            'service_user_domain_id': None,
            'service_project_id': None,
            'service_project_domain_id': None,
            'service_roles': [],
            'system_scope': None
        }

        fake_target = {
            'user_id': request.context.user,
            'project_id': request.context.tenant,
            'tenant_id': request.context.tenant
        }

        with mock.patch('searchlight.service_policies._get_enforcers',
                        return_value=service_enforcers):
            filtered_types = search_deserializer._filter_types_by_policy(
                request.context, types)
            self.assertEqual(['OS::Nova::Server'], filtered_types)
            glance_enforce.enforce.assert_called_with(
                'get_images', fake_target, expect_creds)
            nova_enforce.enforce.assert_called_with(
                'os_compute_api:servers:index', fake_target, expect_creds)

    def test_resource_policy_allows_admin(self):
        request = unit_test_utils.get_fake_request(is_admin=True)
        search_deserializer = search.RequestDeserializer(
            utils.get_search_plugins(),
            policy_enforcer=self.enforcer)
        types = ['OS::Glance::Image', 'OS::Nova::Server']

        self.enforcer.add_rules(policy.policy.Rules.from_dict({
            'resource:OS::Glance::Image': 'role:admin',
            'resource:OS::Nova::Server': 'role:admin'
        }))

        filtered_types = search_deserializer._filter_types_by_policy(
            request.context, types)
        self.assertEqual(types, filtered_types)

    def test_aggregation_policy(self, mock_request_body):
        request = unit_test_utils.get_fake_request(is_admin=False)
        search_deserializer = search.RequestDeserializer(
            utils.get_search_plugins(),
            policy_enforcer=self.enforcer)

        with mock.patch.object(self.enforcer, 'enforce') as mock_enforce:
            mock_request_body.return_value = {
                'query': {'match_all': {}},
                'aggregations': {'terms': {'field': 'some_field'}}
            }
            search_deserializer.search(request)
            mock_enforce.assert_called_with(request.context,
                                            'search:query:aggregations',
                                            request.context.policy_target)

    def test_mapping_field_types(self):
        """Fields with identical names but different types cause problems
        because lucene doesn't differentiate on doc_type. Elasticsearch 2.x
        enforces rules during mapping that 1.x did not. This test ensures that
        for any plugins present, mappings don't conflict.
        """
        # Keep track of field names and types
        encountered = {}
        encountered_in = collections.defaultdict(list)

        # Some properties are allowed to be different.
        # See https://www.elastic.co/guide/en/elasticsearch/reference/current/
        #             breaking_20_mapping_changes.html
        ignore_props = ['copy_to', 'dynamic', 'enabled', 'ignore_above',
                        'include_in_all', 'properties']

        def merge_and_assert_conflict(resource_type, properties):
            for field_name, field_type in six.iteritems(properties):

                # Ignore some properties (see above)
                for prop in ignore_props:
                    field_type.pop(prop, None)

                existing = encountered.get(field_name, {})

                if existing:
                    previous = ",".join(encountered_in[field_name])
                    params = {
                        'field_name': field_name, 'field_type': field_type,
                        'resource_type': resource_type, 'previous': previous,
                        'existing': existing}
                    message = (
                        "Field definition for '%(field_name)s' in "
                        "%(resource_type)s (%(field_type)s) does not match "
                        "that found in %(previous)s (%(existing)s") % params
                    self.assertEqual(existing, field_type, message)
                else:
                    encountered[field_name] = field_type

                encountered_in[field_name].append(resource_type)

        index_base = 'searchlight.elasticsearch.plugins.base.IndexBase'
        with mock.patch(index_base + '.enabled',
                        new_callable=mock.PropertyMock, return_value=True):
            plugins = searchlight_utils.get_search_plugins()
            for resource_type, plugin in six.iteritems(plugins):
                props = plugin.obj.get_mapping()['properties']
                merge_and_assert_conflict(resource_type, props)

    def test_search_resource_policy_checks(self, mock_request_body):
        request = unit_test_utils.get_fake_request()
        search_deserializer = search.RequestDeserializer(
            utils.get_search_plugins(),
            policy_enforcer=self.enforcer)

        with mock.patch.object(self.enforcer, 'enforce') as mock_enforce:
            mock_request_body.return_value = {'type': 'OS::Nova::Server'}
            search_deserializer.search(request)
            self.assertEqual(2, mock_enforce.call_count)
            mock_enforce.assert_has_calls([
                mock.call(request.context,
                          'resource:OS::Nova::Server:allow', {}),
                mock.call(request.context,
                          'resource:OS::Nova::Server:query', {})
            ])

    def test_policy_precedence(self):
        request = unit_test_utils.get_fake_request(is_admin=False)
        search_deserializer = search.RequestDeserializer(
            utils.get_search_plugins(),
            policy_enforcer=self.enforcer)
        types = ['OS::Nova::Server', 'OS::Glance::Image']
        self.enforcer.add_rules(policy.policy.Rules.from_dict({
            'resource:OS::Nova::Server:allow': '',
            'resource:OS::Nova::Server:query': '!'
        }))

        # Query should be disallowed by the specific policy
        filtered_types = search_deserializer._filter_types_by_policy(
            request.context, types, "query")
        self.assertEqual(['OS::Glance::Image'], filtered_types)

        # Facet should be allowed since there is no specific exclusion
        filtered_types = search_deserializer._filter_types_by_policy(
            request.context, types, "facets")
        self.assertEqual(set(['OS::Nova::Server', 'OS::Glance::Image']),
                         set(filtered_types))

    def test_faulty_policy_precedence(self):
        """Unfortunately the ordering that might make most sense isn't
        possible. Rules can only become more restrictive
         """
        request = unit_test_utils.get_fake_request(is_admin=False)
        search_deserializer = search.RequestDeserializer(
            utils.get_search_plugins(),
            policy_enforcer=self.enforcer)
        types = ['OS::Glance::Image', 'OS::Nova::Server']
        self.enforcer.add_rules(policy.policy.Rules.from_dict({
            'resource:OS::Glance::Image:allow': '!',
            'resource:OS::Glance::Image:query': ''
        }))

        filtered_types = search_deserializer._filter_types_by_policy(
            request.context, types, "facets")
        self.assertEqual(['OS::Nova::Server'], filtered_types)

        filtered_types = search_deserializer._filter_types_by_policy(
            request.context, types, "query")
        self.assertEqual(['OS::Nova::Server'], filtered_types)

    def test_resource_policy_disallow_non_admin(self):
        request = unit_test_utils.get_fake_request(is_admin=False)
        search_deserializer = search.RequestDeserializer(
            utils.get_search_plugins(),
            policy_enforcer=self.enforcer)
        types = ['OS::Glance::Image', 'OS::Nova::Server',
                 'OS::Glance::Metadef']

        self.enforcer.add_rules(policy.policy.Rules.from_dict({
            'resource:OS::Glance::Image:allow': 'role:admin'
        }))
        filtered_types = search_deserializer._filter_types_by_policy(
            request.context, types, "query")
        self.assertEqual(set(['OS::Nova::Server', 'OS::Glance::Metadef']),
                         set(filtered_types))

        self.enforcer.add_rules(policy.policy.Rules.from_dict({
            'resource:OS::Nova::Server:query': 'role:admin'
        }))

        filtered_types = search_deserializer._filter_types_by_policy(
            request.context, types, "query")
        self.assertEqual(['OS::Glance::Metadef'], filtered_types)

    def test_resource_policy_disallow(self):
        request = unit_test_utils.get_fake_request(is_admin=False)
        search_deserializer = search.RequestDeserializer(
            utils.get_search_plugins(),
            policy_enforcer=self.enforcer)
        types = ['OS::Glance::Image', 'OS::Nova::Server']

        # And try disabling access for everyone
        self.enforcer.add_rules(policy.policy.Rules.from_dict({
            'resource:OS::Glance::Image': '!'
        }))

        self.assertEqual(
            ['OS::Nova::Server'],
            search_deserializer._filter_types_by_policy(request.context, types)
        )

        # Same for admin
        request = unit_test_utils.get_fake_request(is_admin=False)
        self.assertEqual(
            ['OS::Nova::Server'],
            search_deserializer._filter_types_by_policy(request.context, types)
        )

 def __init__(self, *args, **kwargs):
     super(ListenerService, self).__init__(*args, **kwargs)
     self.plugins = utils.get_search_plugins()
     self.listeners = []
     self.topics_exchanges_set = self.topics_and_exchanges()

 def __init__(self, context, es_api):
     self.context = context
     self.es_api = es_api
     self.plugins = common_utils.get_search_plugins()
     self._plugins_list = self._get_plugin_list()