#!/usr/bin/env python3
"""
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements.  See the NOTICE file
distributed with this work for additional information
regarding copyright ownership.  The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License.  You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
"""

import os
import importlib
import sys

from ambari_commons.exceptions import FatalException
from mock.mock import patch, MagicMock, call

with patch.object(os, "geteuid", new=MagicMock(return_value=0)):
  from resource_management.core import sudo

  importlib.reload(sudo)

import operator
import distro
import io
from unittest import TestCase

os.environ["ROOT"] = ""

from only_for_platform import get_platform, os_distro_value, PLATFORM_WINDOWS
from ambari_commons import os_utils

if get_platform() != PLATFORM_WINDOWS:
  pass

import shutil

project_dir = os.path.join(
  os.path.abspath(os.path.dirname(__file__)), os.path.normpath("../../../../")
)
shutil.copyfile(
  project_dir + "/ambari-server/conf/unix/ambari.properties", "/tmp/ambari.properties"
)

# We have to use this import HACK because the filename contains a dash
_search_file = os_utils.search_file


def search_file_proxy(filename, searchpatch, pathsep=os.pathsep):
  global _search_file

  if "ambari.properties" in filename:
    return "/tmp/ambari.properties"

  return _search_file(filename, searchpatch, pathsep)


os_utils.search_file = search_file_proxy
with patch.object(
  distro,
  "linux_distribution",
  return_value=MagicMock(return_value=("Redhat", "6.4", "Final")),
):
  with patch("os.path.isdir", return_value=MagicMock(return_value=True)):
    with patch("os.access", return_value=MagicMock(return_value=True)):
      with patch.object(
        os_utils,
        "parse_log4j_file",
        return_value={"ambari.log.dir": "/var/log/ambari-server"},
      ):
        with patch("distro.linux_distribution", return_value=os_distro_value):
          with patch("os.symlink"):
            with patch("glob.glob", return_value=["/etc/init.d/postgresql-9.3"]):
              _ambari_server_ = __import__("ambari-server")
              with patch("builtins.open"):
                from ambari_server.properties import Properties
                from ambari_server.serverConfiguration import (
                  configDefaults,
                  JDBC_RCA_PASSWORD_FILE_PROPERTY,
                  JDBC_PASSWORD_PROPERTY,
                  JDBC_RCA_PASSWORD_ALIAS,
                  SSL_TRUSTSTORE_PASSWORD_PROPERTY,
                  SECURITY_IS_ENCRYPTION_ENABLED,
                  SECURITY_SENSITIVE_DATA_ENCRYPTON_ENABLED,
                  SSL_TRUSTSTORE_PASSWORD_ALIAS,
                  SECURITY_KEY_ENV_VAR_NAME,
                )
                from ambari_server.setupSecurity import (
                  get_alias_string,
                  setup_sensitive_data_encryption,
                  sensitive_data_encryption,
                )
                from ambari_server.serverClassPath import ServerClassPath


@patch.object(
  distro, "linux_distribution", new=MagicMock(return_value=("Redhat", "6.4", "Final"))
)
@patch(
  "ambari_server.dbConfiguration_linux.get_postgre_hba_dir",
  new=MagicMock(return_value="/var/lib/pgsql/data"),
)
@patch(
  "ambari_server.dbConfiguration_linux.get_postgre_running_status",
  new=MagicMock(return_value="running"),
)
class TestSensitiveDataEncryption(TestCase):
  def setUp(self):
    out = io.StringIO()
    sys.stdout = out

  def tearDown(self):
    sys.stdout = sys.__stdout__

  @patch("os.path.isdir", new=MagicMock(return_value=True))
  @patch("os.access", new=MagicMock(return_value=True))
  @patch.object(
    ServerClassPath,
    "get_full_ambari_classpath_escaped_for_shell",
    new=MagicMock(return_value="test" + os.pathsep + "path12"),
  )
  @patch("ambari_server.serverConfiguration.find_properties_file")
  @patch("ambari_server.setupSecurity.find_jdk")
  @patch("ambari_server.setupSecurity.get_ambari_properties")
  @patch("ambari_server.setupSecurity.run_os_command")
  def test_sensitive_data_encryption(
    self,
    run_os_command_mock,
    get_ambari_properties_method,
    find_jdk_mock,
    find_properties_file_mock,
  ):
    find_jdk_mock.return_value = "/"
    find_properties_file_mock.return_value = "/tmp/ambari.properties"
    environ = os.environ.copy()

    run_os_command_mock.return_value = 0, "", ""
    properties = Properties()
    get_ambari_properties_method.return_value = properties
    options = self._create_empty_options_mock()
    sensitive_data_encryption(options, "encription")
    run_os_command_mock.assert_called_with(
      "None -cp test:path12 org.apache.ambari.server.security.encryption.SensitiveDataEncryption encription > /var/log/ambari-server/ambari-server.out 2>&1",
      environ,
    )
    pass

  @patch("ambari_server.setupSecurity.print_error_msg")
  @patch("ambari_server.setupSecurity.find_jdk")
  def test_sensitive_data_encryption_nojdk(self, find_jdk_mock, print_mock):
    find_jdk_mock.return_value = None

    options = self._create_empty_options_mock()
    code = sensitive_data_encryption(options, "encription")
    self.assertEqual(code, 1)
    print_mock.assert_called_with(
      'No JDK found, please run the "setup" '
      "command to install a JDK automatically or install any "
      "JDK manually to " + configDefaults.JDK_INSTALL_DIR
    )
    pass

  @patch("os.path.isdir", new=MagicMock(return_value=True))
  @patch("os.access", new=MagicMock(return_value=True))
  @patch.object(
    ServerClassPath,
    "get_full_ambari_classpath_escaped_for_shell",
    new=MagicMock(return_value="test" + os.pathsep + "path12"),
  )
  @patch("ambari_server.serverConfiguration.find_properties_file")
  @patch("ambari_server.setupSecurity.find_jdk")
  @patch("ambari_server.setupSecurity.get_ambari_properties")
  @patch("ambari_server.setupSecurity.run_os_command")
  def test_sensitive_data_decryption_not_persisted(
    self,
    run_os_command_mock,
    get_ambari_properties_method,
    find_jdk_mock,
    find_properties_file_mock,
  ):
    find_jdk_mock.return_value = "/"
    find_properties_file_mock.return_value = "/tmp/ambari.properties"
    environ = os.environ.copy()
    master = "master"
    environ[SECURITY_KEY_ENV_VAR_NAME] = master

    run_os_command_mock.return_value = 0, "", ""
    properties = Properties()
    get_ambari_properties_method.return_value = properties
    options = self._create_empty_options_mock()
    sensitive_data_encryption(options, "decryption", master)
    run_os_command_mock.assert_called_with(
      "None -cp test:path12 org.apache.ambari.server.security.encryption.SensitiveDataEncryption decryption > /var/log/ambari-server/ambari-server.out 2>&1",
      environ,
    )
    pass

  @patch("ambari_server.setupSecurity.get_is_persisted")
  @patch("ambari_server.setupSecurity.get_is_secure")
  @patch("os.path.exists")
  @patch("ambari_server.setupSecurity.read_ambari_user")
  @patch("ambari_server.setupSecurity.save_passwd_for_alias")
  @patch("ambari_server.setupSecurity.read_passwd_for_alias")
  @patch("ambari_server.setupSecurity.update_properties_2")
  @patch("ambari_server.setupSecurity.save_master_key")
  @patch("ambari_server.setupSecurity.get_validated_string_input")
  @patch("ambari_server.setupSecurity.get_YN_input")
  @patch("ambari_server.setupSecurity.search_file")
  @patch("ambari_server.setupSecurity.get_ambari_properties")
  @patch("ambari_server.setupSecurity.is_root")
  @patch("ambari_server.setupSecurity.sensitive_data_encryption")
  @patch("ambari_server.setupSecurity.get_original_master_key")
  def test_reset_master_key_not_persisted(
    self,
    get_original_master_key_mock,
    sensitive_data_encryption_metod,
    is_root_method,
    get_ambari_properties_method,
    search_file_message,
    get_YN_input_method,
    get_validated_string_input_method,
    save_master_key_method,
    update_properties_method,
    read_passwd_for_alias_method,
    save_passwd_for_alias_method,
    read_ambari_user_method,
    exists_mock,
    get_is_secure_method,
    get_is_persisted_method,
  ):
    is_root_method.return_value = True
    search_file_message.return_value = False
    read_ambari_user_method.return_value = None

    p = Properties()
    FAKE_PWD_STRING = "${alias=fakealias}"
    p.process_pair(JDBC_PASSWORD_PROPERTY, FAKE_PWD_STRING)
    p.process_pair(SSL_TRUSTSTORE_PASSWORD_PROPERTY, FAKE_PWD_STRING)
    p.process_pair(JDBC_RCA_PASSWORD_FILE_PROPERTY, FAKE_PWD_STRING)
    get_ambari_properties_method.return_value = p

    master_key = "aaa"
    get_YN_input_method.side_effect = [False, True, False]
    get_validated_string_input_method.return_value = master_key
    get_original_master_key_mock.return_value = master_key
    read_passwd_for_alias_method.return_value = "fakepassword"
    save_passwd_for_alias_method.return_value = 0
    exists_mock.return_value = False
    get_is_secure_method.return_value = True
    get_is_persisted_method.return_value = (False, "")

    options = self._create_empty_options_mock()
    setup_sensitive_data_encryption(options)
    calls = [
      call(options, "decryption", master_key),
      call(options, "encryption", master_key),
    ]
    sensitive_data_encryption_metod.assert_has_calls(calls)

    self.assertFalse(save_master_key_method.called)
    self.assertTrue(get_original_master_key_mock.called)
    self.assertTrue(get_YN_input_method.called)
    self.assertTrue(get_validated_string_input_method.called)
    self.assertTrue(update_properties_method.called)
    self.assertTrue(read_passwd_for_alias_method.called)
    self.assertTrue(2, read_passwd_for_alias_method.call_count)
    self.assertTrue(2, save_passwd_for_alias_method.call_count)
    self.assertFalse(save_master_key_method.called)

    result_expected = {
      JDBC_PASSWORD_PROPERTY: get_alias_string(JDBC_RCA_PASSWORD_ALIAS),
      JDBC_RCA_PASSWORD_FILE_PROPERTY: get_alias_string(JDBC_RCA_PASSWORD_ALIAS),
      SSL_TRUSTSTORE_PASSWORD_PROPERTY: get_alias_string(SSL_TRUSTSTORE_PASSWORD_ALIAS),
      SECURITY_IS_ENCRYPTION_ENABLED: "true",
      SECURITY_SENSITIVE_DATA_ENCRYPTON_ENABLED: "true",
    }

    sorted_x = sorted(result_expected.items(), key=operator.itemgetter(0))
    sorted_y = sorted(
      update_properties_method.call_args[0][1].items(), key=operator.itemgetter(0)
    )
    self.assertEqual(sorted_x, sorted_y)
    pass

  @patch("ambari_server.setupSecurity.get_is_persisted")
  @patch("ambari_server.setupSecurity.get_is_secure")
  @patch("os.path.exists")
  @patch("ambari_server.setupSecurity.read_ambari_user")
  @patch("ambari_server.setupSecurity.save_passwd_for_alias")
  @patch("ambari_server.setupSecurity.read_passwd_for_alias")
  @patch("ambari_server.setupSecurity.update_properties_2")
  @patch("ambari_server.setupSecurity.save_master_key")
  @patch("ambari_server.setupSecurity.get_YN_input")
  @patch("ambari_server.setupSecurity.search_file")
  @patch("ambari_server.setupSecurity.get_ambari_properties")
  @patch("ambari_server.setupSecurity.is_root")
  @patch("ambari_server.setupSecurity.sensitive_data_encryption")
  @patch("ambari_server.setupSecurity.get_original_master_key")
  def test_encrypt_part_not_persisted(
    self,
    get_original_master_key_mock,
    sensitive_data_encryption_metod,
    is_root_method,
    get_ambari_properties_method,
    search_file_message,
    get_YN_input_method,
    save_master_key_method,
    update_properties_method,
    read_passwd_for_alias_method,
    save_passwd_for_alias_method,
    read_ambari_user_method,
    exists_mock,
    get_is_secure_method,
    get_is_persisted_method,
  ):
    is_root_method.return_value = True
    search_file_message.return_value = False
    read_ambari_user_method.return_value = None

    p = Properties()
    FAKE_PWD_STRING = "${alias=fakealias}"
    p.process_pair(JDBC_PASSWORD_PROPERTY, get_alias_string(JDBC_RCA_PASSWORD_ALIAS))
    p.process_pair(SSL_TRUSTSTORE_PASSWORD_PROPERTY, FAKE_PWD_STRING)
    p.process_pair(JDBC_RCA_PASSWORD_FILE_PROPERTY, FAKE_PWD_STRING)
    get_ambari_properties_method.return_value = p

    master_key = "aaa"
    get_YN_input_method.side_effect = [False, False, False]
    get_original_master_key_mock.return_value = master_key
    read_passwd_for_alias_method.return_value = "fakepassword"
    save_passwd_for_alias_method.return_value = 0
    exists_mock.return_value = False
    get_is_secure_method.return_value = True
    get_is_persisted_method.return_value = (False, "filePath")

    options = self._create_empty_options_mock()
    setup_sensitive_data_encryption(options)
    calls = [call(options, "encryption", master_key)]
    sensitive_data_encryption_metod.assert_has_calls(calls)

    self.assertFalse(save_master_key_method.called)
    self.assertTrue(get_YN_input_method.called)
    self.assertTrue(get_original_master_key_mock.called)
    self.assertTrue(update_properties_method.called)
    self.assertTrue(read_passwd_for_alias_method.called)
    self.assertTrue(2, read_passwd_for_alias_method.call_count)
    self.assertTrue(2, save_passwd_for_alias_method.call_count)
    self.assertFalse(save_master_key_method.called)

    result_expected = {
      JDBC_PASSWORD_PROPERTY: get_alias_string(JDBC_RCA_PASSWORD_ALIAS),
      JDBC_RCA_PASSWORD_FILE_PROPERTY: get_alias_string(JDBC_RCA_PASSWORD_ALIAS),
      SSL_TRUSTSTORE_PASSWORD_PROPERTY: get_alias_string(SSL_TRUSTSTORE_PASSWORD_ALIAS),
      SECURITY_IS_ENCRYPTION_ENABLED: "true",
      SECURITY_SENSITIVE_DATA_ENCRYPTON_ENABLED: "true",
    }

    sorted_x = sorted(result_expected.items(), key=operator.itemgetter(0))
    sorted_y = sorted(
      update_properties_method.call_args[0][1].items(), key=operator.itemgetter(0)
    )
    self.assertEqual(sorted_x, sorted_y)
    pass

  @patch("ambari_server.setupSecurity.get_is_persisted")
  @patch("ambari_server.setupSecurity.get_is_secure")
  @patch("os.path.exists")
  @patch("ambari_server.setupSecurity.read_ambari_user")
  @patch("ambari_server.setupSecurity.save_passwd_for_alias")
  @patch("ambari_server.setupSecurity.read_passwd_for_alias")
  @patch("ambari_server.setupSecurity.save_master_key")
  @patch("ambari_server.setupSecurity.get_YN_input")
  @patch("ambari_server.setupSecurity.search_file")
  @patch("ambari_server.setupSecurity.get_ambari_properties")
  @patch("ambari_server.setupSecurity.is_root")
  @patch("ambari_server.setupSecurity.get_original_master_key")
  def test_decrypt_missed_masterkey_not_persisted(
    self,
    get_original_master_key_mock,
    is_root_method,
    get_ambari_properties_method,
    search_file_message,
    get_YN_input_method,
    save_master_key_method,
    read_passwd_for_alias_method,
    save_passwd_for_alias_method,
    read_ambari_user_method,
    exists_mock,
    get_is_secure_method,
    get_is_persisted_method,
  ):
    is_root_method.return_value = True
    search_file_message.return_value = False
    read_ambari_user_method.return_value = None

    p = Properties()
    FAKE_PWD_STRING = "${alias=fakealias}"
    p.process_pair(JDBC_PASSWORD_PROPERTY, get_alias_string(JDBC_RCA_PASSWORD_ALIAS))
    p.process_pair(SSL_TRUSTSTORE_PASSWORD_PROPERTY, FAKE_PWD_STRING)
    p.process_pair(JDBC_RCA_PASSWORD_FILE_PROPERTY, FAKE_PWD_STRING)
    get_ambari_properties_method.return_value = p

    get_YN_input_method.side_effect = [True, False]
    get_original_master_key_mock.return_value = None
    read_passwd_for_alias_method.return_value = "fakepassword"
    save_passwd_for_alias_method.return_value = 0
    exists_mock.return_value = False
    get_is_secure_method.return_value = True
    get_is_persisted_method.return_value = (False, "filePath")

    options = self._create_empty_options_mock()
    self.assertTrue(setup_sensitive_data_encryption(options) == 1)

    self.assertFalse(save_master_key_method.called)
    self.assertTrue(get_YN_input_method.called)
    pass

  @patch("ambari_server.setupSecurity.get_ambari_properties")
  @patch("ambari_server.setupSecurity.is_root")
  def test_setup_sensitive_data_encryption_no_ambari_prop_not_root(
    self, is_root_method, get_ambari_properties_method
  ):
    is_root_method.return_value = False
    get_ambari_properties_method.return_value = -1
    options = self._create_empty_options_mock()

    try:
      setup_sensitive_data_encryption(options)
      self.fail("Should throw exception")
    except FatalException as fe:
      self.assertTrue("Failed to read properties file." == fe.reason)
      pass
    pass

  @patch("os.path.exists")
  @patch("ambari_server.setupSecurity.get_is_secure")
  @patch("ambari_server.setupSecurity.get_is_persisted")
  @patch("ambari_server.setupSecurity.remove_password_file")
  @patch("ambari_server.setupSecurity.save_passwd_for_alias")
  @patch("ambari_server.setupSecurity.read_master_key")
  @patch("ambari_server.setupSecurity.read_ambari_user")
  @patch("ambari_server.setupSecurity.update_properties_2")
  @patch("ambari_server.setupSecurity.save_master_key")
  @patch("ambari_server.setupSecurity.get_YN_input")
  @patch("ambari_server.setupSecurity.get_ambari_properties")
  @patch("ambari_server.setupSecurity.is_root")
  @patch("ambari_server.setupSecurity.sensitive_data_encryption")
  @patch("ambari_server.setupSecurity.adjust_directory_permissions")
  def test_setup_sensitive_data_encryption_not_persist(
    self,
    adjust_directory_permissions_mock,
    sensitive_data_encryption_metod,
    is_root_method,
    get_ambari_properties_method,
    get_YN_input_method,
    save_master_key_method,
    update_properties_method,
    read_ambari_user_method,
    read_master_key_method,
    save_passwd_for_alias_method,
    remove_password_file_method,
    get_is_persisted_method,
    get_is_secure_method,
    exists_mock,
  ):
    is_root_method.return_value = True

    p = Properties()
    FAKE_PWD_STRING = "fakepasswd"
    p.process_pair(JDBC_PASSWORD_PROPERTY, FAKE_PWD_STRING)
    p.process_pair(SSL_TRUSTSTORE_PASSWORD_PROPERTY, FAKE_PWD_STRING)
    p.process_pair(JDBC_RCA_PASSWORD_FILE_PROPERTY, FAKE_PWD_STRING)
    get_ambari_properties_method.return_value = p

    master_key = "aaa"
    read_master_key_method.return_value = master_key
    get_YN_input_method.return_value = False
    read_ambari_user_method.return_value = "asd"
    save_passwd_for_alias_method.return_value = 0
    get_is_persisted_method.return_value = (True, "filepath")
    get_is_secure_method.return_value = False
    exists_mock.return_value = False

    options = self._create_empty_options_mock()
    setup_sensitive_data_encryption(options)

    self.assertTrue(get_YN_input_method.called)
    self.assertTrue(read_master_key_method.called)
    self.assertTrue(read_ambari_user_method.called)
    self.assertTrue(update_properties_method.called)
    self.assertFalse(save_master_key_method.called)
    self.assertTrue(save_passwd_for_alias_method.called)
    self.assertEqual(2, save_passwd_for_alias_method.call_count)
    self.assertTrue(remove_password_file_method.called)
    self.assertTrue(adjust_directory_permissions_mock.called)
    sensitive_data_encryption_metod.assert_called_with(
      options, "encryption", master_key
    )

    result_expected = {
      JDBC_PASSWORD_PROPERTY: get_alias_string(JDBC_RCA_PASSWORD_ALIAS),
      JDBC_RCA_PASSWORD_FILE_PROPERTY: get_alias_string(JDBC_RCA_PASSWORD_ALIAS),
      SSL_TRUSTSTORE_PASSWORD_PROPERTY: get_alias_string(SSL_TRUSTSTORE_PASSWORD_ALIAS),
      SECURITY_IS_ENCRYPTION_ENABLED: "true",
      SECURITY_SENSITIVE_DATA_ENCRYPTON_ENABLED: "true",
    }

    sorted_x = sorted(result_expected.items(), key=operator.itemgetter(0))
    sorted_y = sorted(
      update_properties_method.call_args[0][1].items(), key=operator.itemgetter(0)
    )
    self.assertEqual(sorted_x, sorted_y)
    pass

  @patch("ambari_server.setupSecurity.save_passwd_for_alias")
  @patch("os.path.exists")
  @patch("ambari_server.setupSecurity.get_is_secure")
  @patch("ambari_server.setupSecurity.get_is_persisted")
  @patch("ambari_server.setupSecurity.read_master_key")
  @patch("ambari_server.setupSecurity.read_ambari_user")
  @patch("ambari_server.setupSecurity.update_properties_2")
  @patch("ambari_server.setupSecurity.save_master_key")
  @patch("ambari_server.setupSecurity.get_YN_input")
  @patch("ambari_server.serverConfiguration.search_file")
  @patch("ambari_server.setupSecurity.get_ambari_properties")
  @patch("ambari_server.setupSecurity.is_root")
  @patch("ambari_server.setupSecurity.sensitive_data_encryption")
  def test_setup_sensitive_data_encryption_persist(
    self,
    sensitive_data_encryption_metod,
    is_root_method,
    get_ambari_properties_method,
    search_file_message,
    get_YN_input_method,
    save_master_key_method,
    update_properties_method,
    read_ambari_user_method,
    read_master_key_method,
    get_is_persisted_method,
    get_is_secure_method,
    exists_mock,
    save_passwd_for_alias_method,
  ):
    is_root_method.return_value = True

    p = Properties()
    FAKE_PWD_STRING = "fakepasswd"
    p.process_pair(JDBC_PASSWORD_PROPERTY, FAKE_PWD_STRING)
    get_ambari_properties_method.return_value = p

    search_file_message.return_value = "propertiesfile"

    master_key = "aaa"
    read_master_key_method.return_value = master_key
    get_YN_input_method.return_value = True
    read_ambari_user_method.return_value = None
    get_is_persisted_method.return_value = (True, "filepath")
    get_is_secure_method.return_value = False
    exists_mock.return_value = False
    save_passwd_for_alias_method.return_value = 0

    options = self._create_empty_options_mock()
    setup_sensitive_data_encryption(options)

    self.assertTrue(get_YN_input_method.called)
    self.assertTrue(read_master_key_method.called)
    self.assertTrue(read_ambari_user_method.called)
    self.assertTrue(update_properties_method.called)
    self.assertTrue(save_master_key_method.called)
    sensitive_data_encryption_metod.assert_called_with(options, "encryption")

    result_expected = {
      JDBC_PASSWORD_PROPERTY: get_alias_string(JDBC_RCA_PASSWORD_ALIAS),
      SECURITY_IS_ENCRYPTION_ENABLED: "true",
      SECURITY_SENSITIVE_DATA_ENCRYPTON_ENABLED: "true",
    }

    sorted_x = sorted(result_expected.items(), key=operator.itemgetter(0))
    sorted_y = sorted(
      update_properties_method.call_args[0][1].items(), key=operator.itemgetter(0)
    )
    self.assertEqual(sorted_x, sorted_y)
    pass

  @patch("ambari_server.setupSecurity.read_master_key")
  @patch("os.path.exists")
  @patch("ambari_server.setupSecurity.read_ambari_user")
  @patch("ambari_server.setupSecurity.save_passwd_for_alias")
  @patch("ambari_server.setupSecurity.read_passwd_for_alias")
  @patch("ambari_server.setupSecurity.update_properties_2")
  @patch("ambari_server.setupSecurity.save_master_key")
  @patch("ambari_server.setupSecurity.get_YN_input")
  @patch("ambari_server.setupSecurity.search_file")
  @patch("ambari_server.setupSecurity.get_ambari_properties")
  @patch("ambari_server.setupSecurity.is_root")
  @patch("ambari_server.setupSecurity.sensitive_data_encryption")
  @patch("ambari_server.setupSecurity.get_is_secure")
  @patch("ambari_server.setupSecurity.get_is_persisted")
  def test_reset_master_key_persisted(
    self,
    get_is_persisted_method,
    get_is_secure_method,
    sensitive_data_encryption_metod,
    is_root_method,
    get_ambari_properties_method,
    search_file_message,
    get_YN_input_method,
    save_master_key_method,
    update_properties_method,
    read_passwd_for_alias_method,
    save_passwd_for_alias_method,
    read_ambari_user_method,
    exists_mock,
    read_master_key_method,
  ):
    # Testing call under root
    is_root_method.return_value = True

    search_file_message.return_value = "filepath"
    read_ambari_user_method.return_value = None

    p = Properties()
    FAKE_PWD_STRING = "${alias=fakealias}"
    p.process_pair(JDBC_PASSWORD_PROPERTY, FAKE_PWD_STRING)
    p.process_pair(SSL_TRUSTSTORE_PASSWORD_PROPERTY, FAKE_PWD_STRING)
    p.process_pair(JDBC_RCA_PASSWORD_FILE_PROPERTY, FAKE_PWD_STRING)
    get_ambari_properties_method.return_value = p

    master_key = "aaa"

    get_is_persisted_method.return_value = (True, "filepath")
    get_is_secure_method.return_value = True
    get_YN_input_method.side_effect = [False, True, True]
    read_master_key_method.return_value = master_key
    read_passwd_for_alias_method.return_value = "fakepassword"
    save_passwd_for_alias_method.return_value = 0
    exists_mock.return_value = False

    options = self._create_empty_options_mock()
    setup_sensitive_data_encryption(options)
    calls = [call(options, "decryption"), call(options, "encryption")]
    sensitive_data_encryption_metod.assert_has_calls(calls)

    self.assertTrue(save_master_key_method.called)
    self.assertTrue(get_YN_input_method.called)
    self.assertTrue(read_master_key_method.called)
    self.assertTrue(update_properties_method.called)
    self.assertTrue(read_passwd_for_alias_method.called)
    self.assertTrue(2, read_passwd_for_alias_method.call_count)
    self.assertTrue(2, save_passwd_for_alias_method.call_count)

    result_expected = {
      JDBC_PASSWORD_PROPERTY: get_alias_string(JDBC_RCA_PASSWORD_ALIAS),
      JDBC_RCA_PASSWORD_FILE_PROPERTY: get_alias_string(JDBC_RCA_PASSWORD_ALIAS),
      SSL_TRUSTSTORE_PASSWORD_PROPERTY: get_alias_string(SSL_TRUSTSTORE_PASSWORD_ALIAS),
      SECURITY_IS_ENCRYPTION_ENABLED: "true",
      SECURITY_SENSITIVE_DATA_ENCRYPTON_ENABLED: "true",
    }

    sorted_x = sorted(result_expected.items(), key=operator.itemgetter(0))
    sorted_y = sorted(
      update_properties_method.call_args[0][1].items(), key=operator.itemgetter(0)
    )
    self.assertEqual(sorted_x, sorted_y)
    pass

  @patch("os.path.exists")
  @patch("ambari_server.setupSecurity.read_ambari_user")
  @patch("ambari_server.setupSecurity.save_passwd_for_alias")
  @patch("ambari_server.setupSecurity.read_passwd_for_alias")
  @patch("ambari_server.setupSecurity.update_properties_2")
  @patch("ambari_server.setupSecurity.get_YN_input")
  @patch("ambari_server.setupSecurity.search_file")
  @patch("ambari_server.setupSecurity.get_ambari_properties")
  @patch("ambari_server.setupSecurity.is_root")
  @patch("ambari_server.setupSecurity.sensitive_data_encryption")
  @patch("ambari_server.setupSecurity.get_is_secure")
  @patch("ambari_server.setupSecurity.get_is_persisted")
  def test_decrypt_sensitive_data_persister(
    self,
    get_is_persisted_method,
    get_is_secure_method,
    sensitive_data_encryption_metod,
    is_root_method,
    get_ambari_properties_method,
    search_file_message,
    get_YN_input_method,
    update_properties_method,
    read_passwd_for_alias_method,
    save_passwd_for_alias_method,
    read_ambari_user_method,
    exists_mock,
  ):
    # Testing call under root
    is_root_method.return_value = True

    search_file_message.return_value = "filepath"
    read_ambari_user_method.return_value = None

    p = Properties()
    FAKE_PWD_STRING = "${alias=fakealias}"
    p.process_pair(JDBC_PASSWORD_PROPERTY, FAKE_PWD_STRING)
    p.process_pair(SSL_TRUSTSTORE_PASSWORD_PROPERTY, FAKE_PWD_STRING)
    p.process_pair(JDBC_RCA_PASSWORD_FILE_PROPERTY, FAKE_PWD_STRING)
    get_ambari_properties_method.return_value = p

    get_is_persisted_method.return_value = (True, "filepath")
    get_is_secure_method.return_value = True
    get_YN_input_method.side_effect = [True, False]
    read_passwd_for_alias_method.return_value = "fakepassword"
    save_passwd_for_alias_method.return_value = 0
    exists_mock.return_value = False

    options = self._create_empty_options_mock()
    setup_sensitive_data_encryption(options)
    calls = [call(options, "decryption")]
    sensitive_data_encryption_metod.assert_has_calls(calls)

    self.assertTrue(get_YN_input_method.called)
    self.assertTrue(update_properties_method.called)
    self.assertTrue(read_passwd_for_alias_method.called)
    self.assertTrue(2, read_passwd_for_alias_method.call_count)
    self.assertTrue(2, save_passwd_for_alias_method.call_count)

    result_expected = {
      JDBC_PASSWORD_PROPERTY: "fakepassword",
      JDBC_RCA_PASSWORD_FILE_PROPERTY: "fakepassword",
      SSL_TRUSTSTORE_PASSWORD_PROPERTY: "fakepassword",
      SECURITY_IS_ENCRYPTION_ENABLED: "false",
      SECURITY_SENSITIVE_DATA_ENCRYPTON_ENABLED: "false",
    }

    sorted_x = sorted(result_expected.items(), key=operator.itemgetter(0))
    sorted_y = sorted(
      update_properties_method.call_args[0][1].items(), key=operator.itemgetter(0)
    )
    self.assertEqual(sorted_x, sorted_y)
    pass

  def _create_empty_options_mock(self):
    options = MagicMock()
    options.ldap_enabled = None
    options.ldap_enabled_ambari = None
    options.ldap_manage_services = None
    options.ldap_enabled_services = None
    options.ldap_url = None
    options.ldap_primary_host = None
    options.ldap_primary_port = None
    options.ldap_secondary_url = None
    options.ldap_secondary_host = None
    options.ldap_secondary_port = None
    options.ldap_ssl = None
    options.ldap_user_class = None
    options.ldap_user_attr = None
    options.ldap_user_group_member_attr = None
    options.ldap_group_class = None
    options.ldap_group_attr = None
    options.ldap_member_attr = None
    options.ldap_dn = None
    options.ldap_base_dn = None
    options.ldap_manager_dn = None
    options.ldap_manager_password = None
    options.ldap_save_settings = None
    options.ldap_referral = None
    options.ldap_bind_anonym = None
    options.ldap_force_setup = None
    options.ambari_admin_username = None
    options.ambari_admin_password = None
    options.ldap_sync_admin_name = None
    options.ldap_sync_username_collisions_behavior = None
    options.ldap_sync_disable_endpoint_identification = None
    options.ldap_force_lowercase_usernames = None
    options.ldap_pagination_enabled = None
    options.ldap_sync_admin_password = None
    options.custom_trust_store = None
    options.trust_store_type = None
    options.trust_store_path = None
    options.trust_store_password = None
    options.security_option = None
    options.api_ssl = None
    options.api_ssl_port = None
    options.import_cert_path = None
    options.import_cert_alias = None
    options.pem_password = None
    options.import_key_path = None
    options.master_key = None
    options.master_key_persist = None
    options.jaas_principal = None
    options.jaas_keytab = None
    return options