/**
 * Licensed to the Apache Software Foundation (ASF) under one
 * or more contributor license agreements.  See the NOTICE file
 * distributed with this work for additional information
 * regarding copyright ownership.  The ASF licenses this file
 * to you under the Apache License, Version 2.0 (the
 * "License"); you may not use this file except in compliance
 * with the License.  You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package org.apache.sentry.api.service.thrift;

import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertTrue;
import static org.junit.Assert.fail;

import java.util.Map;
import java.util.Set;

import org.apache.sentry.core.common.exception.SentryUserException;
import org.apache.sentry.core.common.utils.SentryConstants;
import org.apache.sentry.core.common.utils.PolicyFileConstants;
import org.apache.sentry.service.thrift.SentryServiceIntegrationBase;
import org.junit.Before;
import org.junit.BeforeClass;
import org.junit.Test;

import com.google.common.collect.Maps;
import com.google.common.collect.Sets;

/**
 * Test makes sure that sentry client is gathering all the permission information from sentry server
 * while export and makes sure that sentry client is retrieving the permission information from sentry server
 * as requested.
 */
public class TestSentryServiceImportExport extends SentryServiceIntegrationBase {

  // define the privileges
  public static String PRIVILIEGE1 = "server=server1";
  public static String PRIVILIEGE2 = "server=server1->action=select->grantoption=false";
  public static String PRIVILIEGE3 = "server=server1->db=db2->action=insert->grantoption=true";
  public static String PRIVILIEGE4 = "server=server1->db=db1->table=tbl1->action=insert";
  public static String PRIVILIEGE5 = "server=server1->db=db1->table=tbl2->column=col1->action=insert";
  public static String PRIVILIEGE6 = "server=server1->db=db1->table=tbl3->column=col1->action=*->grantoption=true";
  public static String PRIVILIEGE7 = "server=server1->db=db1->table=tbl4->column=col1->action=all->grantoption=true";
  public static String PRIVILIEGE8 = "server=server1->uri=hdfs://testserver:9999/path2->action=insert";
  public static String PRIVILIEGE9 = "server=server1->db=db2->table=tbl1->action=insert";

  @BeforeClass
  public static void setup() throws Exception {
    kerberos = false;
    setupConf();
    startSentryService();
  }

  @Before
  public void preparePolicyFile() throws Exception {
    super.before();
    String requestorUserName = ADMIN_USER;
    Set<String> requestorUserGroupNames = Sets.newHashSet(ADMIN_GROUP);
    setLocalGroupMapping(requestorUserName, requestorUserGroupNames);
    writePolicyFile();
  }

  // Befor import, database is empty.
  // The following information is imported:
  // group1=role1,role2,role3
  // group2=role1,role2,role3
  // group3=role1,role2,role3
  // role1=privilege1,privilege2,privilege3,privilege4,privilege5,privilege6,privilege7,privilege8
  // role2=privilege1,privilege2,privilege3,privilege4,privilege5,privilege6,privilege7,privilege8
  // role3=privilege1,privilege2,privilege3,privilege4,privilege5,privilege6,privilege7,privilege8
  // Both import API importPolicy and export API exportPoicy are tested.
  @Test
  public void testImportExportPolicy1() throws Exception {
    runTestAsSubject(new TestOperation() {
      @Override
      public void runTestAsSubject() throws Exception {
        Map<String, Map<String, Set<String>>> policyFileMappingData = Maps.newHashMap();
        Map<String, Set<String>> groupRolesMap = Maps.newHashMap();
        Set<String> roles = Sets.newHashSet("role1", "role2", "role3");
        groupRolesMap.put("group1", roles);
        groupRolesMap.put("group2", roles);
        groupRolesMap.put("group3", roles);
        Map<String, Set<String>> rolePrivilegesMap = Maps.newHashMap();
        for (String roleName : roles) {
          rolePrivilegesMap.put(roleName, Sets.newHashSet(PRIVILIEGE1, PRIVILIEGE2, PRIVILIEGE3,
              PRIVILIEGE4, PRIVILIEGE5, PRIVILIEGE6, PRIVILIEGE7, PRIVILIEGE8));
        }
        policyFileMappingData.put(PolicyFileConstants.GROUPS, groupRolesMap);
        policyFileMappingData.put(PolicyFileConstants.ROLES, rolePrivilegesMap);
        client.importPolicy(policyFileMappingData, ADMIN_USER, false);

        Map<String, Map<String, Set<String>>> sentryMappingData = client.exportPolicy(ADMIN_USER, null);
        validateSentryMappingData(sentryMappingData,
            policyFileMappingData);
      }
    });
  }

  // call import twice, and there has no duplicate data:
  // The data for 1st import:
  // group1=role1
  // role1=privilege1,privilege2,privilege3,privilege4
  // The data for 2nd import:
  // group2=role2,role3
  // group3=role2,role3
  // role2=privilege5,privilege6,privilege7,privilege8
  // role3=privilege5,privilege6,privilege7,privilege8
  // Both import API importPolicy and export API exportPoicy are tested.
  @Test
  public void testImportExportPolicy2() throws Exception {
    runTestAsSubject(new TestOperation() {
      @Override
      public void runTestAsSubject() throws Exception {
        Map<String, Map<String, Set<String>>> policyFileMappingData1 = Maps.newHashMap();
        Map<String, Set<String>> groupRolesMap1 = Maps.newHashMap();
        groupRolesMap1.put("group1", Sets.newHashSet("role1"));
        Map<String, Set<String>> rolePrivilegesMap1 = Maps.newHashMap();
        rolePrivilegesMap1.put("role1",
            Sets.newHashSet(PRIVILIEGE1, PRIVILIEGE2, PRIVILIEGE3, PRIVILIEGE4));
        policyFileMappingData1.put(PolicyFileConstants.GROUPS, groupRolesMap1);
        policyFileMappingData1.put(PolicyFileConstants.ROLES, rolePrivilegesMap1);
        client.importPolicy(policyFileMappingData1, ADMIN_USER, false);

        Map<String, Map<String, Set<String>>> policyFileMappingData2 = Maps.newHashMap();
        Map<String, Set<String>> groupRolesMap2 = Maps.newHashMap();
        groupRolesMap2.put("group2", Sets.newHashSet("role2", "role3"));
        groupRolesMap2.put("group3", Sets.newHashSet("role2", "role3"));
        Map<String, Set<String>> rolePrivilegesMap2 = Maps.newHashMap();
        rolePrivilegesMap2.put("role2",
            Sets.newHashSet(PRIVILIEGE5, PRIVILIEGE6, PRIVILIEGE7, PRIVILIEGE8));
        rolePrivilegesMap2.put("role3",
            Sets.newHashSet(PRIVILIEGE5, PRIVILIEGE6, PRIVILIEGE7, PRIVILIEGE8));
        policyFileMappingData2.put(PolicyFileConstants.GROUPS, groupRolesMap2);
        policyFileMappingData2.put(PolicyFileConstants.ROLES, rolePrivilegesMap2);
        client.importPolicy(policyFileMappingData2, ADMIN_USER, false);

        Map<String, Map<String, Set<String>>> exceptedMappingData = Maps.newHashMap();
        // for exceptedMappingData, combine policyFileMappingData1 and policyFileMappingData2
        exceptedMappingData.put(PolicyFileConstants.GROUPS,
            policyFileMappingData1.get(PolicyFileConstants.GROUPS));
        exceptedMappingData.get(PolicyFileConstants.GROUPS).putAll(
            policyFileMappingData2.get(PolicyFileConstants.GROUPS));
        exceptedMappingData.put(PolicyFileConstants.ROLES,
            policyFileMappingData1.get(PolicyFileConstants.ROLES));
        exceptedMappingData.get(PolicyFileConstants.ROLES).putAll(
            policyFileMappingData2.get(PolicyFileConstants.ROLES));

        Map<String, Map<String, Set<String>>> sentryMappingData = client.exportPolicy(ADMIN_USER, null);
        validateSentryMappingData(sentryMappingData, exceptedMappingData);
      }
    });
  }

  // Call import twice, and there has overlapping groups
  // The data for 1st import:
  // group1=role1, role2
  // group2=role1, role2
  // group3=role1, role2
  // role1=privilege1,privilege2,privilege3,privilege4,privilege5
  // role2=privilege1,privilege2,privilege3,privilege4,privilege5
  // The data for 2nd import:
  // group1=role2,role3
  // group2=role2,role3
  // group3=role2,role3
  // role2=privilege4,privilege5,privilege6,privilege7,privilege8
  // role3=privilege4,privilege5,privilege6,privilege7,privilege8
  // Both import API importPolicy and export API exportPoicy are tested.
  @Test
  public void testImportExportPolicy3() throws Exception {
    runTestAsSubject(new TestOperation() {
      @Override
      public void runTestAsSubject() throws Exception {
        Map<String, Map<String, Set<String>>> policyFileMappingData1 = Maps.newHashMap();
        Map<String, Set<String>> groupRolesMap1 = Maps.newHashMap();
        groupRolesMap1.put("group1", Sets.newHashSet("role1", "role2"));
        groupRolesMap1.put("group2", Sets.newHashSet("role1", "role2"));
        groupRolesMap1.put("group3", Sets.newHashSet("role1", "role2"));
        Map<String, Set<String>> rolePrivilegesMap1 = Maps.newHashMap();
        rolePrivilegesMap1.put("role1",
            Sets.newHashSet(PRIVILIEGE1, PRIVILIEGE2, PRIVILIEGE3, PRIVILIEGE4, PRIVILIEGE5));
        rolePrivilegesMap1.put("role2",
            Sets.newHashSet(PRIVILIEGE1, PRIVILIEGE2, PRIVILIEGE3, PRIVILIEGE4, PRIVILIEGE5));
        policyFileMappingData1.put(PolicyFileConstants.GROUPS, groupRolesMap1);
        policyFileMappingData1.put(PolicyFileConstants.ROLES, rolePrivilegesMap1);
        client.importPolicy(policyFileMappingData1, ADMIN_USER, false);

        Map<String, Map<String, Set<String>>> policyFileMappingData2 = Maps.newHashMap();
        Map<String, Set<String>> groupRolesMap2 = Maps.newHashMap();
        groupRolesMap2.put("group1", Sets.newHashSet("role2", "role3"));
        groupRolesMap2.put("group2", Sets.newHashSet("role2", "role3"));
        groupRolesMap2.put("group3", Sets.newHashSet("role2", "role3"));
        Map<String, Set<String>> rolePrivilegesMap2 = Maps.newHashMap();
        rolePrivilegesMap2.put("role2",
            Sets.newHashSet(PRIVILIEGE4, PRIVILIEGE5, PRIVILIEGE6, PRIVILIEGE7, PRIVILIEGE8));
        rolePrivilegesMap2.put("role3",
            Sets.newHashSet(PRIVILIEGE4, PRIVILIEGE5, PRIVILIEGE6, PRIVILIEGE7, PRIVILIEGE8));
        policyFileMappingData2.put(PolicyFileConstants.GROUPS, groupRolesMap2);
        policyFileMappingData2.put(PolicyFileConstants.ROLES, rolePrivilegesMap2);
        client.importPolicy(policyFileMappingData2, ADMIN_USER, false);

        Map<String, Map<String, Set<String>>> exceptedMappingData = Maps.newHashMap();
        Map<String, Set<String>> exceptedRolesMap = Maps.newHashMap();
        exceptedRolesMap.put("group1", Sets.newHashSet("role1", "role2", "role3"));
        exceptedRolesMap.put("group2", Sets.newHashSet("role1", "role2", "role3"));
        exceptedRolesMap.put("group3", Sets.newHashSet("role1", "role2", "role3"));
        Map<String, Set<String>> exceptedPrivilegesMap = Maps.newHashMap();
        exceptedPrivilegesMap.put("role1",
            Sets.newHashSet(PRIVILIEGE1, PRIVILIEGE2, PRIVILIEGE3, PRIVILIEGE4, PRIVILIEGE5));
        exceptedPrivilegesMap.put("role2", Sets.newHashSet(PRIVILIEGE1, PRIVILIEGE2, PRIVILIEGE3,
            PRIVILIEGE4, PRIVILIEGE5, PRIVILIEGE6, PRIVILIEGE7, PRIVILIEGE8));
        exceptedPrivilegesMap.put("role3",
            Sets.newHashSet(PRIVILIEGE4, PRIVILIEGE5, PRIVILIEGE6, PRIVILIEGE7, PRIVILIEGE8));
        exceptedMappingData.put(PolicyFileConstants.GROUPS, exceptedRolesMap);
        exceptedMappingData.put(PolicyFileConstants.ROLES, exceptedPrivilegesMap);

        Map<String, Map<String, Set<String>>> sentryMappingData = client.exportPolicy(ADMIN_USER, null);
        validateSentryMappingData(sentryMappingData, exceptedMappingData);
      }
    });
  }

  // Only mapping data for [group,role] is imported:
  // group1=role1,role2
  @Test
  public void testImportExportPolicy4() throws Exception {
    runTestAsSubject(new TestOperation() {
      @Override
      public void runTestAsSubject() throws Exception {
        Map<String, Map<String, Set<String>>> policyFileMappingData = Maps.newHashMap();
        Map<String, Set<String>> groupRolesMap = Maps.newHashMap();
        Set<String> roles = Sets.newHashSet("role1", "role2");
        groupRolesMap.put("group1", roles);
        Map<String, Set<String>> rolePrivilegesMap = Maps.newHashMap();
        policyFileMappingData.put(PolicyFileConstants.GROUPS, groupRolesMap);
        policyFileMappingData.put(PolicyFileConstants.ROLES, rolePrivilegesMap);
        client.importPolicy(policyFileMappingData, ADMIN_USER, false);

        Map<String, Map<String, Set<String>>> sentryMappingData = client.exportPolicy(ADMIN_USER, null);
        validateSentryMappingData(sentryMappingData,
            policyFileMappingData);
      }
    });
  }

  // call import twice, and there has no duplicate data, the import will be with the overwrite mode:
  // The data for 1st import:
  // group1=role1
  // role1=privilege1
  // The data for 2nd import:
  // group2=role2,role3
  // group3=role2,role3
  // role2=privilege2
  // role3=privilege2
  // Both import API importSentryMetaData and export APIs getRolesMap, getGroupsMap,
  // getPrivilegesList are tested.
  @Test
  public void testImportExportPolicy5() throws Exception {
    runTestAsSubject(new TestOperation() {
      @Override
      public void runTestAsSubject() throws Exception {
        Map<String, Map<String, Set<String>>> policyFileMappingData1 = Maps.newHashMap();
        Map<String, Set<String>> groupRolesMap1 = Maps.newHashMap();
        groupRolesMap1.put("group1", Sets.newHashSet("role1"));
        Map<String, Set<String>> rolePrivilegesMap1 = Maps.newHashMap();
        rolePrivilegesMap1.put("role1", Sets.newHashSet(PRIVILIEGE1));
        policyFileMappingData1.put(PolicyFileConstants.GROUPS, groupRolesMap1);
        policyFileMappingData1.put(PolicyFileConstants.ROLES, rolePrivilegesMap1);
        client.importPolicy(policyFileMappingData1, ADMIN_USER, true);

        Map<String, Map<String, Set<String>>> policyFileMappingData2 = Maps.newHashMap();
        Map<String, Set<String>> groupRolesMap2 = Maps.newHashMap();
        groupRolesMap2.put("group2", Sets.newHashSet("role2", "role3"));
        groupRolesMap2.put("group3", Sets.newHashSet("role2", "role3"));
        Map<String, Set<String>> rolePrivilegesMap2 = Maps.newHashMap();
        rolePrivilegesMap2.put("role2", Sets.newHashSet(PRIVILIEGE2));
        rolePrivilegesMap2.put("role3", Sets.newHashSet(PRIVILIEGE2));
        policyFileMappingData2.put(PolicyFileConstants.GROUPS, groupRolesMap2);
        policyFileMappingData2.put(PolicyFileConstants.ROLES, rolePrivilegesMap2);
        client.importPolicy(policyFileMappingData2, ADMIN_USER, true);

        Map<String, Map<String, Set<String>>> exceptedMappingData = Maps.newHashMap();
        Map<String, Set<String>> exceptedRolesMap = Maps.newHashMap();
        exceptedRolesMap.put("group1", Sets.newHashSet("role1"));
        exceptedRolesMap.put("group2", Sets.newHashSet("role2", "role3"));
        exceptedRolesMap.put("group3", Sets.newHashSet("role2", "role3"));
        Map<String, Set<String>> exceptedPrivilegesMap = Maps.newHashMap();
        exceptedPrivilegesMap.put("role1", Sets.newHashSet(PRIVILIEGE1));
        exceptedPrivilegesMap.put("role2", Sets.newHashSet(PRIVILIEGE2));
        exceptedPrivilegesMap.put("role3", Sets.newHashSet(PRIVILIEGE2));
        exceptedMappingData.put(PolicyFileConstants.GROUPS, exceptedRolesMap);
        exceptedMappingData.put(PolicyFileConstants.ROLES, exceptedPrivilegesMap);

        Map<String, Map<String, Set<String>>> sentryMappingData = client.exportPolicy(ADMIN_USER, null);
        validateSentryMappingData(sentryMappingData, exceptedMappingData);
      }
    });
  }

  // call import twice, and there has data overlap, the import will be with the overwrite mode:
  // The data for 1st import:
  // group1=role1, role2
  // group2=role1, role2
  // group3=role1, role2
  // role1=privilege1,privilege2,privilege3,privilege4,privilege5
  // role2=privilege1,privilege2,privilege3,privilege4,privilege5
  // The data for 2nd import:
  // group1=role2,role3
  // group2=role2,role3
  // group3=role2,role3
  // role2=privilege4,privilege5,privilege6,privilege7,privilege8
  // role3=privilege4,privilege5,privilege6,privilege7,privilege8
  // Both import API importSentryMetaData and export APIs getRolesMap, getGroupsMap,
  // getPrivilegesList are tested.
  @Test
  public void testImportExportPolicy6() throws Exception {
    runTestAsSubject(new TestOperation() {
      @Override
      public void runTestAsSubject() throws Exception {
        Map<String, Map<String, Set<String>>> policyFileMappingData1 = Maps.newHashMap();
        Map<String, Set<String>> groupRolesMap1 = Maps.newHashMap();
        groupRolesMap1.put("group1", Sets.newHashSet("role1", "role2"));
        groupRolesMap1.put("group2", Sets.newHashSet("role1", "role2"));
        groupRolesMap1.put("group3", Sets.newHashSet("role1", "role2"));
        Map<String, Set<String>> rolePrivilegesMap1 = Maps.newHashMap();
        rolePrivilegesMap1.put("role1",
            Sets.newHashSet(PRIVILIEGE1, PRIVILIEGE2, PRIVILIEGE3, PRIVILIEGE4, PRIVILIEGE5));
        rolePrivilegesMap1.put("role2",
            Sets.newHashSet(PRIVILIEGE1, PRIVILIEGE2, PRIVILIEGE3, PRIVILIEGE4, PRIVILIEGE5));
        policyFileMappingData1.put(PolicyFileConstants.GROUPS, groupRolesMap1);
        policyFileMappingData1.put(PolicyFileConstants.ROLES, rolePrivilegesMap1);
        client.importPolicy(policyFileMappingData1, ADMIN_USER, true);

        Map<String, Map<String, Set<String>>> policyFileMappingData2 = Maps.newHashMap();
        Map<String, Set<String>> groupRolesMap2 = Maps.newHashMap();
        groupRolesMap2.put("group1", Sets.newHashSet("role2", "role3"));
        groupRolesMap2.put("group2", Sets.newHashSet("role2", "role3"));
        groupRolesMap2.put("group3", Sets.newHashSet("role2", "role3"));
        Map<String, Set<String>> rolePrivilegesMap2 = Maps.newHashMap();
        rolePrivilegesMap2.put("role2",
            Sets.newHashSet(PRIVILIEGE4, PRIVILIEGE5, PRIVILIEGE6, PRIVILIEGE7, PRIVILIEGE8));
        rolePrivilegesMap2.put("role3",
            Sets.newHashSet(PRIVILIEGE4, PRIVILIEGE5, PRIVILIEGE6, PRIVILIEGE7, PRIVILIEGE8));
        policyFileMappingData2.put(PolicyFileConstants.GROUPS, groupRolesMap2);
        policyFileMappingData2.put(PolicyFileConstants.ROLES, rolePrivilegesMap2);
        client.importPolicy(policyFileMappingData2, ADMIN_USER, true);

        Map<String, Map<String, Set<String>>> exceptedMappingData = Maps.newHashMap();
        Map<String, Set<String>> exceptedRolesMap = Maps.newHashMap();
        exceptedRolesMap.put("group1", Sets.newHashSet("role1", "role2", "role3"));
        exceptedRolesMap.put("group2", Sets.newHashSet("role1", "role2", "role3"));
        exceptedRolesMap.put("group3", Sets.newHashSet("role1", "role2", "role3"));
        Map<String, Set<String>> exceptedPrivilegesMap = Maps.newHashMap();
        exceptedPrivilegesMap.put("role1",
            Sets.newHashSet(PRIVILIEGE1, PRIVILIEGE2, PRIVILIEGE3, PRIVILIEGE4, PRIVILIEGE5));
        exceptedPrivilegesMap.put("role2",
            Sets.newHashSet(PRIVILIEGE4, PRIVILIEGE5, PRIVILIEGE6, PRIVILIEGE7, PRIVILIEGE8));
        exceptedPrivilegesMap.put("role3",
            Sets.newHashSet(PRIVILIEGE4, PRIVILIEGE5, PRIVILIEGE6, PRIVILIEGE7, PRIVILIEGE8));
        exceptedMappingData.put(PolicyFileConstants.GROUPS, exceptedRolesMap);
        exceptedMappingData.put(PolicyFileConstants.ROLES, exceptedPrivilegesMap);

        Map<String, Map<String, Set<String>>> sentryMappingData = client.exportPolicy(ADMIN_USER, null);
        validateSentryMappingData(sentryMappingData, exceptedMappingData);
      }
    });
  }

  // test the import privileges with the action: All, *, select, insert
  // All and * should replace the select and insert
  // The data for import:
  // group1=role1, role2
  // role1=testPrivilege1,testPrivilege2,testPrivilege3,testPrivilege4
  // role2=testPrivilege5, testPrivilege6,testPrivilege7,testPrivilege8
  @Test
  public void testImportExportPolicy7() throws Exception {
    runTestAsSubject(new TestOperation() {
      @Override
      public void runTestAsSubject() throws Exception {
        String testPrivilege1 = "server=server1->db=db1->table=tbl1->action=select->grantoption=true";
        String testPrivilege2 = "server=server1->db=db1->table=tbl1->action=insert->grantoption=false";
        String testPrivilege3 = "server=server1->db=db1->table=tbl1->action=all->grantoption=true";
        String testPrivilege4 = "server=server1->db=db1->table=tbl1->action=insert->grantoption=true";
        String testPrivilege5 = "server=server1->db=db1->table=tbl2->action=select->grantoption=true";
        String testPrivilege6 = "server=server1->db=db1->table=tbl2->action=insert->grantoption=false";
        String testPrivilege7 = "server=server1->db=db1->table=tbl2->action=*->grantoption=true";
        String testPrivilege8 = "server=server1->db=db1->table=tbl2->action=insert->grantoption=true";

        Map<String, Map<String, Set<String>>> policyFileMappingData1 = Maps.newHashMap();
        Map<String, Set<String>> groupRolesMap1 = Maps.newHashMap();
        groupRolesMap1.put("group1", Sets.newHashSet("role1", "role2"));
        Map<String, Set<String>> rolePrivilegesMap1 = Maps.newHashMap();
        rolePrivilegesMap1.put("role1",
            Sets.newHashSet(testPrivilege1, testPrivilege2, testPrivilege3, testPrivilege4));
        rolePrivilegesMap1.put("role2",
            Sets.newHashSet(testPrivilege5, testPrivilege6, testPrivilege7, testPrivilege8));
        policyFileMappingData1.put(PolicyFileConstants.GROUPS, groupRolesMap1);
        policyFileMappingData1.put(PolicyFileConstants.ROLES, rolePrivilegesMap1);
        client.importPolicy(policyFileMappingData1, ADMIN_USER, true);

        Map<String, Map<String, Set<String>>> exceptedMappingData = Maps.newHashMap();
        Map<String, Set<String>> exceptedRolesMap = Maps.newHashMap();
        exceptedRolesMap.put("group1", Sets.newHashSet("role1", "role2"));
        Map<String, Set<String>> exceptedPrivilegesMap = Maps.newHashMap();
        exceptedPrivilegesMap.put("role1", Sets.newHashSet(testPrivilege2, testPrivilege3));
        exceptedPrivilegesMap.put("role2", Sets.newHashSet(testPrivilege6, testPrivilege7));
        exceptedMappingData.put(PolicyFileConstants.GROUPS, exceptedRolesMap);
        exceptedMappingData.put(PolicyFileConstants.ROLES, exceptedPrivilegesMap);

        Map<String, Map<String, Set<String>>> sentryMappingData = client.exportPolicy(ADMIN_USER, null);
        validateSentryMappingData(sentryMappingData, exceptedMappingData);
      }
    });
  }

  // Call import twice, and there has overlapping actions, all and * should replace the select and
  // insert
  // The data for 1st import:
  // group1=role1, role2
  // role1=privilege1(with select action),privilege2(with insert action)
  // role2=privilege4(with select action),privilege5(with insert action)
  // The data for 2nd import:
  // group1=role1, role2
  // role1=privilege3(with all action)
  // role2=privilege6(with * action)
  @Test
  public void testImportExportPolicy8() throws Exception {
    runTestAsSubject(new TestOperation() {
      @Override
      public void runTestAsSubject() throws Exception {
        String testPrivilege1 = "server=server1->db=db1->table=tbl1->action=select->grantoption=true";
        String testPrivilege2 = "server=server1->db=db1->table=tbl1->action=insert->grantoption=true";
        String testPrivilege3 = "server=server1->db=db1->table=tbl1->action=all->grantoption=true";
        String testPrivilege4 = "server=server1->db=db1->table=tbl2->action=select->grantoption=true";
        String testPrivilege5 = "server=server1->db=db1->table=tbl2->action=insert->grantoption=true";
        String testPrivilege6 = "server=server1->db=db1->table=tbl2->action=*->grantoption=true";

        Map<String, Map<String, Set<String>>> policyFileMappingData1 = Maps.newHashMap();
        Map<String, Set<String>> groupRolesMap1 = Maps.newHashMap();
        groupRolesMap1.put("group1", Sets.newHashSet("role1", "role2"));
        Map<String, Set<String>> rolePrivilegesMap1 = Maps.newHashMap();
        rolePrivilegesMap1.put("role1", Sets.newHashSet(testPrivilege1, testPrivilege2));
        rolePrivilegesMap1.put("role2", Sets.newHashSet(testPrivilege4, testPrivilege5));
        policyFileMappingData1.put(PolicyFileConstants.GROUPS, groupRolesMap1);
        policyFileMappingData1.put(PolicyFileConstants.ROLES, rolePrivilegesMap1);
        client.importPolicy(policyFileMappingData1, ADMIN_USER, false);

        Map<String, Map<String, Set<String>>> policyFileMappingData2 = Maps.newHashMap();
        Map<String, Set<String>> groupRolesMap2 = Maps.newHashMap();
        groupRolesMap2.put("group1", Sets.newHashSet("role1", "role2"));
        Map<String, Set<String>> rolePrivilegesMap2 = Maps.newHashMap();
        rolePrivilegesMap2.put("role1", Sets.newHashSet(testPrivilege3));
        rolePrivilegesMap2.put("role2", Sets.newHashSet(testPrivilege6));
        policyFileMappingData2.put(PolicyFileConstants.GROUPS, groupRolesMap2);
        policyFileMappingData2.put(PolicyFileConstants.ROLES, rolePrivilegesMap2);
        client.importPolicy(policyFileMappingData2, ADMIN_USER, false);

        Map<String, Map<String, Set<String>>> exceptedMappingData = policyFileMappingData2;
        Map<String, Map<String, Set<String>>> sentryMappingData = client.exportPolicy(ADMIN_USER, null);
        // all and * should replace the select and insert
        validateSentryMappingData(sentryMappingData, exceptedMappingData);
      }
    });
  }

  // test the user not in the admin group can't do the import/export
  @Test
  public void testImportExportPolicy9() throws Exception {
    runTestAsSubject(new TestOperation() {
      @Override
      public void runTestAsSubject() throws Exception {
        Map<String, Map<String, Set<String>>> policyFileMappingData1 = Maps.newHashMap();
        Map<String, Set<String>> groupRolesMap1 = Maps.newHashMap();
        Map<String, Set<String>> rolePrivilegesMap1 = Maps.newHashMap();
        policyFileMappingData1.put(PolicyFileConstants.GROUPS, groupRolesMap1);
        policyFileMappingData1.put(PolicyFileConstants.ROLES, rolePrivilegesMap1);
        try {
          client.importPolicy(policyFileMappingData1, "no-admin-user", false);
          fail("non-admin can't do the import.");
        } catch (Exception e) {
          // excepted exception
        }

        try {
          client.exportPolicy("no-admin-user", null);
          fail("non-admin can't do the export.");
        } catch (Exception e) {
          // excepted exception
        }
      }
    });
  }

  // The following data is imported:
  // group1=role1
  // group2=role1,role2
  // group3=role2,role3
  // group4=role1,role2,role3
  // role1=privilege3,privilege4,privilege9
  // role2=privilege3,privilege4,privilege5,privilege6,privilege7
  // role3=privilege4,privilege5,privilege6,privilege7,privilege8
  // Export APIs getRoleNameTPrivilegesMap, getGroupNameRoleNamesMap are tested.
  @Test
  public void testExportPolicyWithSpecificObject() throws Exception {
    runTestAsSubject(new TestOperation() {
      @Override
      public void runTestAsSubject() throws Exception {
        // import the test data
        Map<String, Map<String, Set<String>>> policyFileMappingData = Maps.newHashMap();
        Map<String, Set<String>> groupRolesMap = Maps.newHashMap();
        groupRolesMap.put("group1", Sets.newHashSet("role1"));
        groupRolesMap.put("group2", Sets.newHashSet("role1", "role2"));
        groupRolesMap.put("group3", Sets.newHashSet("role2", "role3"));
        groupRolesMap.put("group4", Sets.newHashSet("role1", "role2", "role3"));
        Map<String, Set<String>> rolePrivilegesMap1 = Maps.newHashMap();
        rolePrivilegesMap1.put("role1",
            Sets.newHashSet(PRIVILIEGE3, PRIVILIEGE4, PRIVILIEGE9));
        rolePrivilegesMap1.put("role2",
            Sets.newHashSet(PRIVILIEGE3, PRIVILIEGE4, PRIVILIEGE5,
            PRIVILIEGE6, PRIVILIEGE7));
        rolePrivilegesMap1.put("role3",
            Sets.newHashSet(PRIVILIEGE4, PRIVILIEGE5, PRIVILIEGE6,
            PRIVILIEGE7, PRIVILIEGE8));
        policyFileMappingData.put(PolicyFileConstants.GROUPS, groupRolesMap);
        policyFileMappingData.put(PolicyFileConstants.ROLES, rolePrivilegesMap1);
        client.importPolicy(policyFileMappingData, ADMIN_USER, true);

        // verify the rolePrivilegesMap and groupRolesMap with null objectPath
        Map<String, Map<String, Set<String>>> expectedMappingData = Maps.newHashMap();
        Map<String, Set<String>> expectedGroupRoles = Maps.newHashMap();
        expectedGroupRoles.put("group1", Sets.newHashSet("role1"));
        expectedGroupRoles.put("group2", Sets.newHashSet("role1", "role2"));
        expectedGroupRoles.put("group3", Sets.newHashSet("role2", "role3"));
        expectedGroupRoles.put("group4", Sets.newHashSet("role1", "role2", "role3"));
        Map<String, Set<String>> expectedRolePrivileges = Maps.newHashMap();
        expectedRolePrivileges.put("role1", Sets.newHashSet(
            PRIVILIEGE3, PRIVILIEGE4, PRIVILIEGE9));
        expectedRolePrivileges.put("role2", Sets.newHashSet(PRIVILIEGE3, PRIVILIEGE4,
            PRIVILIEGE5, PRIVILIEGE6, PRIVILIEGE7));
        expectedRolePrivileges.put("role3", Sets.newHashSet(PRIVILIEGE4,
            PRIVILIEGE5, PRIVILIEGE6, PRIVILIEGE7, PRIVILIEGE8));
        expectedMappingData.put(PolicyFileConstants.GROUPS, expectedGroupRoles);
        expectedMappingData.put(PolicyFileConstants.ROLES, expectedRolePrivileges);

        Map<String, Map<String, Set<String>>> sentryMappingData = client.exportPolicy(ADMIN_USER, null);
        validateSentryMappingData(sentryMappingData, expectedMappingData);

        // verify the rolePrivilegesMap and groupRolesMap with empty objectPath
        expectedMappingData = Maps.newHashMap();
        expectedGroupRoles = Maps.newHashMap();
        expectedGroupRoles.put("group1", Sets.newHashSet("role1"));
        expectedGroupRoles.put("group2", Sets.newHashSet("role1", "role2"));
        expectedGroupRoles.put("group3", Sets.newHashSet("role2", "role3"));
        expectedGroupRoles.put("group4", Sets.newHashSet("role1", "role2", "role3"));
        expectedRolePrivileges = Maps.newHashMap();
        expectedRolePrivileges.put("role1", Sets.newHashSet(
            PRIVILIEGE3, PRIVILIEGE4, PRIVILIEGE9));
        expectedRolePrivileges.put("role2", Sets.newHashSet(PRIVILIEGE3, PRIVILIEGE4,
            PRIVILIEGE5, PRIVILIEGE6, PRIVILIEGE7));
        expectedRolePrivileges.put("role3", Sets.newHashSet(PRIVILIEGE4,
            PRIVILIEGE5, PRIVILIEGE6, PRIVILIEGE7, PRIVILIEGE8));
        expectedMappingData.put(PolicyFileConstants.GROUPS, expectedGroupRoles);
        expectedMappingData.put(PolicyFileConstants.ROLES, expectedRolePrivileges);

        sentryMappingData = client.exportPolicy(ADMIN_USER, "");
        validateSentryMappingData(sentryMappingData, expectedMappingData);

        // verify the rolePrivilegesMap and groupRolesMap for db=db1
        expectedMappingData = Maps.newHashMap();
        expectedGroupRoles = Maps.newHashMap();
        expectedGroupRoles.put("group1", Sets.newHashSet("role1"));
        expectedGroupRoles.put("group2", Sets.newHashSet("role1", "role2"));
        expectedGroupRoles.put("group3", Sets.newHashSet("role2", "role3"));
        expectedGroupRoles.put("group4", Sets.newHashSet("role1", "role2", "role3"));
        expectedRolePrivileges = Maps.newHashMap();
        expectedRolePrivileges.put("role1", Sets.newHashSet(PRIVILIEGE4));
        expectedRolePrivileges.put("role2", Sets.newHashSet(PRIVILIEGE4,
            PRIVILIEGE5, PRIVILIEGE6, PRIVILIEGE7));
        expectedRolePrivileges.put("role3", Sets.newHashSet(PRIVILIEGE4,
            PRIVILIEGE5, PRIVILIEGE6, PRIVILIEGE7));
        expectedMappingData.put(PolicyFileConstants.GROUPS, expectedGroupRoles);
        expectedMappingData.put(PolicyFileConstants.ROLES, expectedRolePrivileges);

        sentryMappingData = client.exportPolicy(ADMIN_USER, "db=db1");
        validateSentryMappingData(sentryMappingData, expectedMappingData);

        // verify the rolePrivilegesMap and groupRolesMap for db=db2
        expectedMappingData = Maps.newHashMap();
        expectedGroupRoles = Maps.newHashMap();
        expectedGroupRoles.put("group1", Sets.newHashSet("role1"));
        expectedGroupRoles.put("group2", Sets.newHashSet("role1", "role2"));
        expectedGroupRoles.put("group3", Sets.newHashSet("role2"));
        expectedGroupRoles.put("group4", Sets.newHashSet("role1", "role2"));
        expectedRolePrivileges = Maps.newHashMap();
        expectedRolePrivileges.put("role1", Sets.newHashSet(PRIVILIEGE3, PRIVILIEGE9));
        expectedRolePrivileges.put("role2", Sets.newHashSet(PRIVILIEGE3));
        expectedMappingData.put(PolicyFileConstants.GROUPS, expectedGroupRoles);
        expectedMappingData.put(PolicyFileConstants.ROLES, expectedRolePrivileges);

        sentryMappingData = client.exportPolicy(ADMIN_USER, "db=db2");
        validateSentryMappingData(sentryMappingData, expectedMappingData);

        // verify the rolePrivilegesMap and groupRolesMap for db=db1->table=tbl1
        expectedMappingData = Maps.newHashMap();
        expectedGroupRoles = Maps.newHashMap();
        expectedGroupRoles.put("group1", Sets.newHashSet("role1"));
        expectedGroupRoles.put("group2", Sets.newHashSet("role1", "role2"));
        expectedGroupRoles.put("group3", Sets.newHashSet("role2", "role3"));
        expectedGroupRoles.put("group4", Sets.newHashSet("role1", "role2", "role3"));
        expectedRolePrivileges = Maps.newHashMap();
        expectedRolePrivileges.put("role1", Sets.newHashSet(PRIVILIEGE4));
        expectedRolePrivileges.put("role2", Sets.newHashSet(PRIVILIEGE4));
        expectedRolePrivileges.put("role3", Sets.newHashSet(PRIVILIEGE4));
        expectedMappingData.put(PolicyFileConstants.GROUPS, expectedGroupRoles);
        expectedMappingData.put(PolicyFileConstants.ROLES, expectedRolePrivileges);

        sentryMappingData = client.exportPolicy(ADMIN_USER, "db=db1->table=tbl1");
        validateSentryMappingData(sentryMappingData, expectedMappingData);

        sentryMappingData = client.exportPolicy(ADMIN_USER, "db=db1->table=tbl1,db=db3->table=tbl2");
        // Verify that client is able to take comma separated objects and still gets the results only for the first object
        validateSentryMappingData(sentryMappingData, expectedMappingData);

        // verify the rolePrivilegesMap and groupRolesMap for db=db1->table=tbl2
        expectedMappingData = Maps.newHashMap();
        expectedGroupRoles = Maps.newHashMap();
        expectedGroupRoles.put("group2", Sets.newHashSet("role2"));
        expectedGroupRoles.put("group3", Sets.newHashSet("role2", "role3"));
        expectedGroupRoles.put("group4", Sets.newHashSet("role2", "role3"));
        expectedRolePrivileges = Maps.newHashMap();
        expectedRolePrivileges.put("role2", Sets.newHashSet(PRIVILIEGE5));
        expectedRolePrivileges.put("role3", Sets.newHashSet(PRIVILIEGE5));
        expectedMappingData.put(PolicyFileConstants.GROUPS, expectedGroupRoles);
        expectedMappingData.put(PolicyFileConstants.ROLES, expectedRolePrivileges);

        sentryMappingData = client.exportPolicy(ADMIN_USER, "db=db1->table=tbl2");
        validateSentryMappingData(sentryMappingData, expectedMappingData);

        // verify the rolePrivilegesMap and groupRolesMap for db=db1->table=tbl1
        expectedMappingData = Maps.newHashMap();
        expectedGroupRoles = Maps.newHashMap();
        expectedGroupRoles.put("group1", Sets.newHashSet("role1"));
        expectedGroupRoles.put("group2", Sets.newHashSet("role1", "role2"));
        expectedGroupRoles.put("group3", Sets.newHashSet("role2", "role3"));
        expectedGroupRoles.put("group4", Sets.newHashSet("role1", "role2", "role3"));
        expectedRolePrivileges = Maps.newHashMap();
        expectedRolePrivileges.put("role1", Sets.newHashSet(PRIVILIEGE4, PRIVILIEGE9));
        expectedRolePrivileges.put("role2", Sets.newHashSet(PRIVILIEGE4));
        expectedRolePrivileges.put("role3", Sets.newHashSet(PRIVILIEGE4));
        expectedMappingData.put(PolicyFileConstants.GROUPS, expectedGroupRoles);
        expectedMappingData.put(PolicyFileConstants.ROLES, expectedRolePrivileges);

        sentryMappingData = client.exportPolicy(ADMIN_USER, "table=tbl1");
        validateSentryMappingData(sentryMappingData, expectedMappingData);

        // verify the invalid exportObject string
        try {
          client.exportPolicy(ADMIN_USER, "invalidString");
          fail("RuntimeException should be thrown.");
        } catch (SentryUserException userException) {
          // excepted exception
        }
      }
    });
  }

  // Befor import, database is empty.
  // The following information is imported:
  // group1=role1,role2,role3
  // group2=role1,role2,role3
  // user1=role1,role2,role3
  // user2=role1,role2,role3
  // role1=privilege1,privilege2,privilege3,privilege4
  // role2=privilege1,privilege2,privilege3,privilege4
  // role3=privilege1,privilege2,privilege3,privilege4
  @Test
  public void testImportExportPolicyWithUser() throws Exception {
    runTestAsSubject(new TestOperation() {
      @Override
      public void runTestAsSubject() throws Exception {
        Map<String, Map<String, Set<String>>> policyFileMappingData = Maps.newHashMap();
        Map<String, Set<String>> groupRolesMap = Maps.newHashMap();
        Map<String, Set<String>> userRolesMap = Maps.newHashMap();
        Set<String> roles = Sets.newHashSet("role1", "role2", "role3");
        groupRolesMap.put("group1", roles);
        groupRolesMap.put("group2", roles);
        userRolesMap.put("user1", roles);
        userRolesMap.put("user2", roles);
        Map<String, Set<String>> rolePrivilegesMap = Maps.newHashMap();
        for (String roleName : roles) {
          rolePrivilegesMap.put(roleName, Sets.newHashSet(PRIVILIEGE1,
              PRIVILIEGE2, PRIVILIEGE3, PRIVILIEGE4));
        }
        policyFileMappingData.put(PolicyFileConstants.USER_ROLES, userRolesMap);
        policyFileMappingData.put(PolicyFileConstants.GROUPS, groupRolesMap);
        policyFileMappingData.put(PolicyFileConstants.ROLES, rolePrivilegesMap);
        client.importPolicy(policyFileMappingData, ADMIN_USER, false);

        Map<String, Map<String, Set<String>>> sentryMappingData =
            client.exportPolicy(ADMIN_USER, null);
        // validate the [user, role] mapping
        validateRolesMap(sentryMappingData.get(PolicyFileConstants.USER_ROLES),
            policyFileMappingData.get(PolicyFileConstants.USER_ROLES));
        validateSentryMappingData(sentryMappingData,
            policyFileMappingData);
      }
    });
  }

  // verify the mapping data
  public void validateSentryMappingData(
      Map<String, Map<String, Set<String>>> actualMappingData,
      Map<String, Map<String, Set<String>>> expectedMappingData) {
    validateRolesMap(actualMappingData.get(PolicyFileConstants.GROUPS),
        expectedMappingData.get(PolicyFileConstants.GROUPS));
    validateRolePrivilegesMap(actualMappingData.get(PolicyFileConstants.ROLES),
        expectedMappingData.get(PolicyFileConstants.ROLES));
  }

  // verify the mapping data for [group,role] and [user,role]
  private void validateRolesMap(Map<String, Set<String>> actualMap,
      Map<String, Set<String>> expectedMap) {
    assertEquals(expectedMap.keySet().size(), actualMap.keySet().size());
    for (String name : actualMap.keySet()) {
      Set<String> actualRoles = actualMap.get(name);
      Set<String> expectedRoles = expectedMap.get(name);
      assertEquals(actualRoles.size(), expectedRoles.size());
      assertTrue(actualRoles.equals(expectedRoles));
    }
  }

  // verify the mapping data for [role,privilege]
  private void validateRolePrivilegesMap(Map<String, Set<String>> actualMap,
      Map<String, Set<String>> expectedMap) {
    assertEquals(expectedMap.keySet().size(), actualMap.keySet().size());
    for (String roleName : actualMap.keySet()) {
      Set<String> actualPrivileges = actualMap.get(roleName);
      Set<String> exceptedPrivileges = expectedMap.get(roleName);
      assertEquals(exceptedPrivileges.size(), actualPrivileges.size());
      for (String actualPrivilege : actualPrivileges) {
        boolean isFound = exceptedPrivileges.contains(actualPrivilege);
        if (!isFound) {
          String withOptionPrivilege = SentryConstants.AUTHORIZABLE_JOINER.join(actualPrivilege,
              SentryConstants.KV_JOINER.join(PolicyFileConstants.PRIVILEGE_GRANT_OPTION_NAME,
                  "false"));
          isFound = exceptedPrivileges.contains(withOptionPrivilege);
        }
        assertTrue(isFound);
      }
    }
  }
}