# Copyright (c) 2015 Rackspace, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#    http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
# implied.
# See the License for the specific language governing permissions and
# limitations under the License.

import base64
import datetime
import sys
import time

from oslo_utils import timeutils

from barbicanclient import exceptions
from functionaltests.client import base
from functionaltests.common import cleanup
from functionaltests.common import keys
from functionaltests import utils
from testtools import testcase


secret_create_defaults_data = {
    "name": "AES key",
    "expiration": "2030-02-28T19:14:44.180394",
    "algorithm": "aes",
    "bit_length": 256,
    "mode": "cbc",
    "payload": b"gF6+lLoF3ohA9aPRpt+6bQ=="
}

secret_create_nones_data = {
    "name": None,
    "expiration": None,
    "algorithm": None,
    "bit_length": None,
    "mode": None,
    "payload": b"gF6+lLoF3ohA9aPRpt+6bQ==",
    "payload_content_type": "application/octet-stream",
    "payload_content_encoding": "base64",
}

secret_create_emptystrings_data = {
    "name": '',
    "expiration": '',
    "algorithm": '',
    "bit_length": '',
    "mode": '',
    "payload": b'',
    "payload_content_type": '',
    "payload_content_encoding": '',
}


@utils.parameterized_test_case
class SecretsTestCase(base.TestCase):

    def setUp(self):
        super(SecretsTestCase, self).setUp()
        self.cleanup = cleanup.CleanUp(self.barbicanclient)

    def tearDown(self):
        self.cleanup.delete_all_entities()
        super(SecretsTestCase, self).tearDown()

    def _create_test_secret(self):
        """Helper module to create a secret withouth consumers"""
        new_secret = self.barbicanclient.secrets.create(
            **secret_create_defaults_data)

        secret_ref = self.cleanup.add_entity(new_secret)
        self.assertIsNotNone(secret_ref)

        return secret_ref

    @testcase.attr('positive')
    def test_secret_create_defaults_check_content_types(self):
        """Check that set content-type attribute is retained in metadata."""
        secret_ref = self._create_test_secret()

        resp = self.barbicanclient.secrets.get(secret_ref)
        content_types = resp.content_types
        self.assertIsNotNone(content_types)
        self.assertIn('default', content_types)
        self.assertEqual('application/octet-stream', content_types['default'])

    @testcase.attr('positive')
    def test_secret_create_defaults_non_standard_algorithm(self):
        """Create a secret with a non standard algorithm.

         Currently the client will accept any string for the algorithm.
         """
        secret = self.barbicanclient.secrets.create(
            **secret_create_defaults_data)
        secret.algorithm = "not-an-algorithm"

        secret_ref = self.cleanup.add_entity(secret)
        self.assertIsNotNone(secret_ref)

        resp = self.barbicanclient.secrets.get(secret_ref)
        self.assertEqual(secret.algorithm, resp.algorithm)

    @testcase.attr('positive')
    def test_secret_read_with_acls(self):
        """Access default ACL settings data on recently created secret.

        By default, 'read' ACL settings are there for a secret.
         """
        secret_ref = self._create_test_secret()

        secret_entity = self.barbicanclient.secrets.get(secret_ref)
        self.assertIsNotNone(secret_entity.acls)
        self.assertIsNotNone(secret_entity.acls.read)
        self.assertEqual([], secret_entity.acls.read.users)

    @testcase.attr('positive')
    def test_secret_create_defaults_non_standard_mode(self):
        """Create a secret with a non standard mode.

        Currently the client will accept any string for the mode.
        """
        secret = self.barbicanclient.secrets.create(
            **secret_create_defaults_data)
        secret.mode = 'not-a-mode'

        secret_ref = self.cleanup.add_entity(secret)
        self.assertIsNotNone(secret_ref)

        resp = self.barbicanclient.secrets.get(secret_ref)
        self.assertEqual(secret.mode, resp.mode)

    @utils.parameterized_dataset({
        'remove_one': [[{'service': 'service_test1',
                         'resource_type': 'type_test1',
                         'resource_id': 'id_test1'},
                        {'service': 'service_test2',
                         'resource_type': 'type_test2',
                         'resource_id': 'id_test2'}],
                       [{'service': 'service_test1',
                         'resource_type': 'type_test1',
                         'resource_id': 'id_test1'}]],
        'remove_all': [[{'service': 'service_test1',
                         'resource_type': 'type_test1',
                         'resource_id': 'id_test1'},
                        {'service': 'service_test2',
                         'resource_type': 'type_test2',
                         'resource_id': 'id_test2'}],
                       [{'service': 'service_test1',
                         'resource_type': 'type_test1',
                         'resource_id': 'id_test1'},
                        {'service': 'service_test2',
                         'resource_type': 'type_test2',
                         'resource_id': 'id_test2'}]],
        'add_duplicate_remove_one': [[{'service': 'service_test1',
                                       'resource_type': 'type_test1',
                                       'resource_id': 'id_test1'},
                                      {'service': 'service_test1',
                                       'resource_type': 'type_test1',
                                       'resource_id': 'id_test1'},
                                      {'service': 'service_test2',
                                       'resource_type': 'type_test2',
                                       'resource_id': 'id_test2'}],
                                     [{'service': 'service_test1',
                                       'resource_type': 'type_test1',
                                       'resource_id': 'id_test1'}]]
    })
    @testcase.attr('positive')
    def test_secret_create_and_registering_removing_consumers(
            self,
            register_consumers,
            remove_consumers):
        """The following activities are carried:

        Create a secret, then register each consumer
        in the register_consumers list, then remove each consumer
        in the remove_consumers list.
        """
        secret_ref = self._create_test_secret()

        for consumer in register_consumers:
            secret = self.barbicanclient.secrets.register_consumer(
                secret_ref, **consumer)
            self.assertEqual(secret_ref, secret.secret_ref)

        # We expect that duplicate calls to register_consumers don't
        # create new consumers even though the API returns HTTP 200 OK
        deduplicated_consumers_count = len(set(
            [c['resource_id'] for c in register_consumers]))

        self.assertEqual(deduplicated_consumers_count,
                         len(secret.consumers))

        for consumer in remove_consumers:
            self.barbicanclient.secrets.remove_consumer(
                secret_ref, **consumer)

        secret = self.barbicanclient.secrets.get(secret_ref)

        removed_ids = set([v['resource_id'] for v in remove_consumers])
        remaining_consumers = [v for v in register_consumers
                               if v['resource_id'] not in removed_ids]
        self.assertCountEqual(remaining_consumers, secret.consumers)

    @utils.parameterized_dataset({
        'no_args': [[{}]],
        'one_arg_1': [[{'service': 'service1'}]],
        'one_arg_2': [[{'resource_type': 'type1'}]],
        'one_arg_3': [[{'resource_id': 'id1'}]],
        'two_args_1': [[{'service': 'service1',
                         'resource_type': 'type1'}]],
        'two_args_2': [[{'service': 'service1',
                         'resource_id': 'id1'}]],
        'two_args_3': [[{'resource_type': 'type1',
                         'resource_id': 'id'}]]
    })
    @testcase.attr('negative')
    def test_consumer_register_missing_positional_arguments(
            self,
            register_consumers):
        """Missing Positional Arguments - Registration

        Tries to register a secret consumer without
        providing all of the required positional arguments
        (service, resource_type, resource_id).
        """
        secret_ref = self._create_test_secret()

        for consumer in register_consumers:
            e = self.assertRaises(
                TypeError,
                self.barbicanclient.secrets.register_consumer,
                secret_ref, **consumer
            )
        self.assertIn('register_consumer() missing', str(e))

    @utils.parameterized_dataset({
        'no_args': [[{}]],
        'one_arg_1': [[{'service': 'service1'}]],
        'one_arg_2': [[{'resource_type': 'type1'}]],
        'one_arg_3': [[{'resource_id': 'id1'}]],
        'two_args_1': [[{'service': 'service1',
                         'resource_type': 'type1'}]],
        'two_args_2': [[{'service': 'service1',
                         'resource_id': 'id1'}]],
        'two_args_3': [[{'resource_type': 'type1',
                         'resource_id': 'id'}]]
    })
    @testcase.attr('negative')
    def test_consumer_remove_missing_positional_arguments(
            self,
            register_consumers):
        """Missing Positional Arguments - Removal

        Tries to remove a secret consumer without
        providing all of the required positional arguments
        (service, resource_type, resource_id).
        """
        secret_ref = self._create_test_secret()

        secret = self.barbicanclient.secrets.register_consumer(
            secret_ref,
            service="service1",
            resource_type="type1",
            resource_id="id1"
        )
        self.assertEqual(secret_ref, secret.secret_ref)
        for consumer in register_consumers:
            e = self.assertRaises(
                TypeError,
                self.barbicanclient.secrets.remove_consumer,
                secret_ref, **consumer
            )
        self.assertIn('remove_consumer() missing', str(e))

    @testcase.attr('positive')
    def test_secret_delete_without_consumers_no_force(self):
        secret_ref = self._create_test_secret()

        self.barbicanclient.secrets.delete(secret_ref, force=False)
        resp = self.barbicanclient.secrets.get(secret_ref)
        self.assertRaises(exceptions.HTTPClientError, getattr, resp, "name")
        self.cleanup.delete_entity(secret_ref)

    @testcase.attr('positive')
    def test_secret_delete_without_consumers_with_force(self):
        secret_ref = self._create_test_secret()

        self.barbicanclient.secrets.delete(secret_ref, force=True)
        resp = self.barbicanclient.secrets.get(secret_ref)
        self.assertRaises(exceptions.HTTPClientError, getattr, resp, "name")
        self.cleanup.delete_entity(secret_ref)

    @testcase.attr('negative')
    def test_secret_delete_with_consumers_no_force_version_1_1(self):
        """Deleting a secret with consumers using microversion 1.1

        Tries to delete a secret with consumers, but
        without providing the 'force' parameter.
        """
        self.barbicanclient._set_microversion('1.1')
        secret_ref = self._create_test_secret()

        secret = self.barbicanclient.secrets.register_consumer(
            secret_ref,
            service="service1",
            resource_type="type1",
            resource_id="id1"
        )
        self.assertEqual(secret_ref, secret.secret_ref)

        self.assertRaises(exceptions.SecretHasConsumers,
                          self.barbicanclient.secrets.delete,
                          secret.secret_ref)

    @testcase.attr('positive')
    def test_secret_delete_with_consumers_with_force_version_1_1(self):
        """Deleting a secret with consumers using microversion 1.1

        Tries to delete a secret with consumers,
        making the 'force' parameter equals True.
        """
        self.barbicanclient._set_microversion('1.1')
        secret_ref = self._create_test_secret()

        secret = self.barbicanclient.secrets.register_consumer(
            secret_ref,
            service="service1",
            resource_type="type1",
            resource_id="id1"
        )
        self.assertEqual(secret_ref, secret.secret_ref)

        self.barbicanclient.secrets.delete(secret.secret_ref, True)
        resp = self.barbicanclient.secrets.get(secret_ref)
        self.assertRaises(exceptions.HTTPClientError, getattr, resp, "name")
        self.cleanup.delete_entity(secret_ref)

    @testcase.attr('negative')
    def test_secret_delete_with_consumers_no_force_version_1_2(self):
        """Deleting a secret with consumers using microversion 1.2

        Tries to delete a secret with consumers, but
        without providing the 'force' parameter.
        """
        self.barbicanclient._set_microversion('1.2')
        secret_ref = self._create_test_secret()

        secret = self.barbicanclient.secrets.register_consumer(
            secret_ref,
            service="service1",
            resource_type="type1",
            resource_id="id1"
        )
        self.assertEqual(secret_ref, secret.secret_ref)

        self.assertRaises(exceptions.SecretHasConsumers,
                          self.barbicanclient.secrets.delete,
                          secret.secret_ref)

    @testcase.attr('positive')
    def test_secret_delete_with_consumers_with_force_version_1_2(self):
        """Deleting a secret with consumers using microversion 1.2

        Tries to delete a secret with consumers,
        making the 'force' parameter equals True.
        """
        self.barbicanclient._set_microversion('1.2')
        secret_ref = self._create_test_secret()

        secret = self.barbicanclient.secrets.register_consumer(
            secret_ref,
            service="service1",
            resource_type="type1",
            resource_id="id1"
        )
        self.assertEqual(secret_ref, secret.secret_ref)

        self.barbicanclient.secrets.delete(secret.secret_ref, True)
        resp = self.barbicanclient.secrets.get(secret_ref)
        self.assertRaises(exceptions.HTTPClientError, getattr, resp, "name")
        self.cleanup.delete_entity(secret_ref)

    @testcase.attr('positive')
    def test_consumers_list_secret_without_consumers(self):
        """Lists consumers from a secret without consumers"""
        secret_ref = self._create_test_secret()

        consumers_list = self.barbicanclient.secrets.list_consumers(
            secret_ref)
        self.assertTrue(len(consumers_list) == 0)

        self.cleanup.delete_entity(secret_ref)
        self.barbicanclient.secrets.delete(secret_ref, True)

    @testcase.attr('positive')
    def test_consumers_list_secret_with_consumers(self):
        """Lists consumers from a secret with consumers"""
        secret_ref = self._create_test_secret()

        consumers = [{
            'service': 'service1',
            'resource_type': 'type1',
            'resource_id': 'id1'}, {
            'service': 'service2',
            'resource_type': 'type2',
            'resource_id': 'id2'}]

        for consumer in consumers:
            _ = self.barbicanclient.secrets.register_consumer(
                secret_ref,
                service=consumer['service'],
                resource_type=consumer['resource_type'],
                resource_id=consumer['resource_id']
            )

        consumers_list = self.barbicanclient.secrets.list_consumers(
            secret_ref)

        for elem in range(len(consumers)):
            self.assertTrue(
                consumers_list[elem].service ==
                consumers[elem]['service'])
            self.assertTrue(
                consumers_list[elem].resource_type ==
                consumers[elem]['resource_type'])
            self.assertTrue(
                consumers_list[elem].resource_id ==
                consumers[elem]['resource_id'])

        self.cleanup.delete_entity(secret_ref)
        self.barbicanclient.secrets.delete(secret_ref, True)

    @testcase.attr('negative')
    def test_consumers_list_secret_doesnt_exist(self):
        """Tries to list consumers from a non-existent secret"""
        e = self.assertRaises(exceptions.HTTPClientError,
                              self.barbicanclient.secrets.list_consumers,
                              '9999999f-f99f-49f9-9fff-f99f999ff9ff')

        self.assertIn("Secret not found", str(e))

    @testcase.attr('negative')
    def test_consumers_list_secret_invalid_uuid(self):
        """Tries to list consumers providing an invalid secret UUID"""
        e = self.assertRaises(exceptions.HTTPClientError,
                              self.barbicanclient.secrets.list_consumers,
                              '9999999f-ffff-ffff-9fff-f99f999ff9ff')

        self.assertIn("Provided secret id is invalid.", str(e))

    @testcase.attr('negative')
    def test_consumers_list_invalid_secret(self):
        """Tries to list consumers providing an invalid secret"""
        e = self.assertRaises(ValueError,
                              self.barbicanclient.secrets.list_consumers,
                              'abcde')

        self.assertIn("secret incorrectly specified.", str(e))

    @testcase.attr('negative')
    def test_secret_delete_doesnt_exist(self):
        """Deletes a non-existent secret.

        This delete uses a reference with an invalid UUID format
        """
        url = self.barbicanclient.secrets._api.endpoint_override + \
            '/secrets/notauuid'

        e = self.assertRaises(ValueError, self.barbicanclient.secrets.delete,
                              url)

        self.assertEqual('Secret incorrectly specified.', str(e))

    @testcase.attr('negative')
    def test_secret_delete_doesnt_exist_valid_uuid_format(self):
        """Deletes a non-existent secret.

        This delete has a valid UUID format but there is no secret
        associated with this UUID
        """
        uuid = 'de20ad54-85b4-421b-adb2-eb7b9e546013'
        url = self.barbicanclient.secrets._api.endpoint_override + \
            '/secrets/' + uuid

        e = self.assertRaises(
            exceptions.HTTPClientError,
            self.barbicanclient.secrets.delete,
            url
        )

        self.assertEqual(404, e.status_code)

    @testcase.attr('negative')
    def test_secret_get_secret_doesnt_exist(self):
        """GET an invalid secret ref.

        Will get value error secret incorrectly specified since "notauuid"
        is not a properly formatted uuid.
        """
        url = self.barbicanclient.secrets._api.endpoint_override + \
            '/secrets/notauuid'

        e = self.assertRaises(ValueError, self.barbicanclient.secrets.get,
                              url, 'text/plain')

        self.assertIn("Secret incorrectly specified", str(e))

    @testcase.attr('negative')
    def test_secret_create_defaults_expiration_passed(self):
        """Create a secret with an expiration that has already passed.

        Returns a 400.
        """
        secret = self.barbicanclient.secrets.create(
            **secret_create_defaults_data)
        secret.expiration = '2000-01-10T14:58:52.546795'

        e = self.assertRaises(
            exceptions.HTTPClientError,
            secret.store
        )
        self.assertEqual(400, e.status_code)

    @testcase.attr('negative')
    def test_secret_create_emptystrings(self):
        """Secret create with empty Strings for all attributes.

        Fails with a value error, Payload incorrectly specified.
        """
        secret = self.barbicanclient.secrets.create(
            **secret_create_emptystrings_data)

        self.assertRaises(
            exceptions.PayloadException,
            secret.store
        )

    @testcase.attr('negative')
    def test_secret_create_defaults_oversized_payload(self):
        """Create a secret with a payload that is larger than the allowed size.

        Should return a 413 if the secret size is greater than the
        maximum allowed size.
        """
        secret = self.barbicanclient.secrets.create(
            **secret_create_defaults_data)
        secret.payload = str(self.oversized_payload)

        e = self.assertRaises(
            exceptions.HTTPClientError,
            secret.store
        )
        self.assertEqual(413, e.status_code)

    @utils.parameterized_dataset({
        'alphanumeric': ['1f34ds'],
        'punctuation': ['~!@#$%^&*()_+`-={}[]|:;<>,.?'],
        'uuid': ['54262d9d-4bc7-4821-8df0-dc2ca8e112bb'],
        'len_255': [base.TestCase.max_sized_field],
        'empty': [''],
        'null': [None]
    })
    @testcase.attr('positive')
    def test_secret_create_defaults_valid_name(self, name):
        """Covers cases of creating secrets with valid names."""
        secret = self.barbicanclient.secrets.create(
            **secret_create_defaults_data)
        secret.name = name

        secret_ref = self.cleanup.add_entity(secret)
        self.assertIsNotNone(secret_ref)

        resp = self.barbicanclient.secrets.get(secret_ref)
        self.assertEqual(secret.name, resp.name)

    @utils.parameterized_dataset({
        'int': [400]
    })
    @testcase.attr('negative')
    def test_secret_create_defaults_invalid_name(self, name):
        """Create secrets with various invalid names.

        Should return 400.
        """
        secret = self.barbicanclient.secrets.create(
            **secret_create_defaults_data)
        secret.name = name

        e = self.assertRaises(
            exceptions.HTTPClientError,
            secret.store
        )

        self.assertEqual(400, e.status_code)

    @utils.parameterized_dataset({
        'aes': ['aes']
    })
    @testcase.attr('positive')
    def test_secret_create_defaults_valid_algorithms(self, algorithm):
        """Creates secrets with various valid algorithms."""
        secret = self.barbicanclient.secrets.create(
            **secret_create_defaults_data)
        secret.algorithm = algorithm

        secret_ref = self.cleanup.add_entity(secret)
        self.assertIsNotNone(secret_ref)

        resp = self.barbicanclient.secrets.get(secret_ref)
        self.assertEqual(secret.algorithm, resp.algorithm)

    @utils.parameterized_dataset({
        'int': [400]
    })
    @testcase.attr('negative')
    def test_secret_create_defaults_invalid_algorithms(self, algorithm):
        """Creates secrets with various invalid algorithms."""

        secret = self.barbicanclient.secrets.create(
            **secret_create_defaults_data)
        secret.algorithm = algorithm

        # We are currently testing for exception with http_code
        # launchpad bug 1431514 will address the change to this functionality
        e = self.assertRaises(
            exceptions.HTTPClientError,
            secret.store
        )

        self.assertEqual(400, e.status_code)

    @utils.parameterized_dataset({
        'symmetric': ['symmetric',
                      'aes',
                      128,
                      (b'\x00\x01\x02\x03\x04\x05\x06\x07'
                       b'\x00\x01\x02\x03\x04\x05\x06\x07')],
        'private': ['private',
                    'rsa',
                    2048,
                    keys.get_private_key_pem()],
        'public': ['public',
                   'rsa',
                   2048,
                   keys.get_public_key_pem()],
        'certificate': ['certificate',
                        'rsa',
                        2048,
                        keys.get_certificate_pem()],
        'opaque': ['opaque',
                   None,
                   None,
                   (b'\x00\x01\x02\x03\x04\x05\x06\x07')],
        'passphrase': ['passphrase',
                       None,
                       None,
                       keys.get_passphrase_txt()],
    })
    @testcase.attr('positive')
    def test_secret_create_defaults_valid_secret_type(
            self, secret_type, algorithm, bit_length, payload):
        """Covers cases of creating secrets with valid secret types."""
        secret = self.barbicanclient.secrets.create(
            **secret_create_defaults_data)
        secret.secret_type = secret_type
        secret.algorithm = algorithm
        secret.bit_length = bit_length
        # payload should not be encoded.
        secret.payload = payload

        secret_ref = self.cleanup.add_entity(secret)
        self.assertIsNotNone(secret_ref)

        resp = self.barbicanclient.secrets.get(secret_ref)
        self.assertEqual(secret_type, resp.secret_type)

    @testcase.attr('negative')
    def test_secret_create_defaults_invalid_secret_type(self):
        """Covers cases of creating secrets with invalid secret types."""
        secret = self.barbicanclient.secrets.create(
            **secret_create_defaults_data)
        secret.secret_type = 'not a valid secret type'

        e = self.assertRaises(
            exceptions.HTTPClientError,
            secret.store
        )

        self.assertEqual(400, e.status_code)

    @utils.parameterized_dataset({
        '512': [512],
        'sixteen': [16],
        'fifteen': [15],
        'eight': [8],
        'seven': [7],
        'one': [1],
        'none': [None]
    })
    @testcase.attr('positive')
    def test_secret_create_defaults_valid_bit_length(self, bit_length):
        """Covers cases of creating secrets with valid bit lengths."""
        secret = self.barbicanclient.secrets.create(
            **secret_create_defaults_data)
        secret.bit_length = bit_length

        secret_ref = self.cleanup.add_entity(secret)
        self.assertIsNotNone(secret_ref)

        resp = self.barbicanclient.secrets.get(secret_ref)
        self.assertEqual(secret.bit_length, resp.bit_length)

    @utils.parameterized_dataset({
        'str_type': ['not-an-int'],
        'empty': [''],
        'blank': [' '],
        'negative_maxsize': [-sys.maxsize],
        'negative_one': [-1],
        'zero': [0]
    })
    @testcase.attr('negative')
    def test_secret_create_defaults_invalid_bit_length(self, bit_length):
        """Covers cases of creating secrets with invalid bit lengths."""
        secret = self.barbicanclient.secrets.create(
            **secret_create_defaults_data)
        secret.bit_length = bit_length

        e = self.assertRaises(
            exceptions.HTTPClientError,
            secret.store
        )

        self.assertEqual(400, e.status_code)

    @utils.parameterized_dataset({
        'cbc': ['cbc']
    })
    @testcase.attr('positive')
    def test_secret_create_defaults_valid_mode(self, mode):
        """Covers cases of creating secrets with valid modes."""
        secret = self.barbicanclient.secrets.create(
            **secret_create_defaults_data)
        secret.mode = mode

        secret_ref = self.cleanup.add_entity(secret)
        self.assertIsNotNone(secret_ref)

        resp = self.barbicanclient.secrets.get(secret_ref)
        self.assertEqual(secret.mode, resp.mode)

    @utils.parameterized_dataset({
        'zero': [0],
        'oversized_string': [base.TestCase.oversized_field],
        'int': [400]
    })
    @testcase.attr('negative')
    def test_secret_create_defaults_invalid_mode(self, mode):
        """Covers cases of creating secrets with invalid modes."""
        secret = self.barbicanclient.secrets.create(
            **secret_create_defaults_data)
        secret.mode = mode

        e = self.assertRaises(
            exceptions.HTTPClientError,
            secret.store
        )

        self.assertEqual(400, e.status_code)

    @utils.parameterized_dataset({
        'text_content_type_none_encoding': {
            'payload_content_type': 'text/plain',
            'payload_content_encoding': None},

        'utf8_text_content_type_none_encoding': {
            'payload_content_type': 'text/plain; charset=utf-8',
            'payload_content_encoding': None},

        'no_space_utf8_text_content_type_none_encoding': {
            'payload_content_type': 'text/plain;charset=utf-8',
            'payload_content_encoding': None},

        'octet_content_type_base64_encoding': {
            'payload_content_type': 'application/octet-stream',
            'payload_content_encoding': 'base64'}
    })
    @testcase.attr('positive')
    def test_secret_create_deprecated_types_and_encoding(
            self,
            payload_content_type,
            payload_content_encoding):
        """Creates secrets with various content types and encodings."""
        secret = self.barbicanclient.secrets.create(
            **secret_create_defaults_data)
        secret.payload_content_type = payload_content_type
        secret.payload_content_encoding = payload_content_encoding

        secret_ref = self.cleanup.add_entity(secret)
        self.assertIsNotNone(secret_ref)

        resp = self.barbicanclient.secrets.get(secret_ref)
        if secret.payload_content_encoding == 'base64':
            self.assertEqual(
                base64.b64decode(secret.payload),
                resp.payload
            )
        else:
            self.assertEqual(secret.payload, resp.payload.encode('utf-8'))

    @utils.parameterized_dataset({
        'large_string_content_type_and_encoding': {
            'payload_content_type': base.TestCase.oversized_field,
            'payload_content_encoding': base.TestCase.oversized_field},

        'int_content_type_and_encoding': {
            'payload_content_type': 123,
            'payload_content_encoding': 123},

        'text_content_type_none_content_encoding': {
            'payload_content_type': 'text/plain',
            'payload_content_encoding': ''},

        'text_no_subtype_content_type_none_content_encoding': {
            'payload_content_type': 'text',
            'payload_content_encoding': None},

        'text_slash_no_subtype_content_type_none_content_encoding': {
            'payload_content_type': 'text/',
            'payload_content_encoding': None},

        'text_content_type_empty_content_encoding': {
            'payload_content_type': 'text/plain',
            'payload_content_encoding': ' '},

        'text_content_type_spaces_content_encoding': {
            'payload_content_type': 'text/plain',
            'payload_content_encoding': ' '},

        'text_content_type_base64_content_encoding': {
            'payload_content_type': 'text/plain',
            'payload_content_encoding': 'base64'},

        'text_and_utf88_content_type_none_content_encoding': {
            'payload_content_type': 'text/plain; charset=utf-88',
            'payload_content_encoding': None},

        'invalid_content_type_base64_content_encoding': {
            'payload_content_type': 'invalid',
            'payload_content_encoding': 'base64'},

        'invalid_content_type_none_content_encoding': {
            'payload_content_type': 'invalid',
            'payload_content_encoding': None},

        'octet_content_type_invalid_content_encoding': {
            'payload_content_type': 'application/octet-stream',
            'payload_content_encoding': 'invalid'},

        'text_content_type_invalid_content_encoding': {
            'payload_content_type': 'text/plain',
            'payload_content_encoding': 'invalid'},

        'none_content_type_invalid_content_encoding': {
            'payload_content_type': None,
            'payload_content_encoding': 'invalid'},

        'none_content_type_base64_content_encoding': {
            'payload_content_type': None,
            'payload_content_encoding': 'base64'}
    })
    @testcase.attr('negative')
    def test_secret_create_defaults_invalid_types_and_encoding(self, **kwargs):
        """Creating secrets with invalid payload types and encodings."""
        secret = self.barbicanclient.secrets.create(
            **secret_create_defaults_data)
        secret.payload_content_encoding = kwargs[
            'payload_content_encoding']
        secret.payload_content_type = kwargs[
            'payload_content_type']

        e = self.assertRaises(
            exceptions.HTTPClientError,
            secret.store
        )

        self.assertEqual(400, e.status_code)

    @utils.parameterized_dataset({
        'max_payload_string': [base.TestCase.max_sized_payload]
    })
    @testcase.attr('positive')
    def test_secret_create_defaults_valid_payload(self, payload):
        """Create secrets with a various valid payloads."""

        secret = self.barbicanclient.secrets.create(
            **secret_create_defaults_data)
        secret.payload = payload

        secret_ref = self.cleanup.add_entity(secret)
        self.assertIsNotNone(secret_ref)

        resp = self.barbicanclient.secrets.get(secret_ref)
        self.assertEqual(secret.payload, resp.payload)

    @utils.parameterized_dataset({
        'list': [['boom']],
        'int': [123]
    })
    @testcase.attr('negative')
    def test_secret_create_with_invalid_payload_(self, payload):
        """Covers attempting to create secret with invalid payload types

        Tests the negative cases of invalid types (list and int).
        """
        secret = self.barbicanclient.secrets.create(
            **secret_create_defaults_data)
        secret.payload = payload

        self.assertRaises(
            exceptions.PayloadException,
            secret.store
        )

    @utils.parameterized_dataset({
        'empty': [''],
        'zero': [0]
    })
    @testcase.attr('negative')
    def test_secret_with_no_payload_exception(self, payload):
        """Covers creating secrets with various invalid payloads.

        These requests will fail with a value error before the request to the
        server is made
        """
        secret = self.barbicanclient.secrets.create(
            **secret_create_defaults_data)
        secret.payload = payload

        self.assertRaises(
            exceptions.PayloadException,
            secret.store
        )

    @utils.parameterized_dataset({
        'negative_five_long_expire': {
            'timezone': '-05:00',
            'days': 5},

        'positive_five_long_expire': {
            'timezone': '+05:00',
            'days': 5},

        'negative_one_short_expire': {
            'timezone': '-01',
            'days': 1},

        'positive_one_short_expire': {
            'timezone': '+01',
            'days': 1}
    })
    @testcase.attr('positive')
    def test_secret_create_defaults_valid_expiration(self, **kwargs):
        """Create secrets with a various valid expiration data."""

        timestamp = utils.create_timestamp_w_tz_and_offset(**kwargs)
        secret = self.barbicanclient.secrets.create(
            **secret_create_defaults_data)
        secret.expiration = timestamp

        secret_ref = self.cleanup.add_entity(secret)
        self.assertIsNotNone(secret_ref)

        resp = self.barbicanclient.secrets.get(secret_ref)
        self.assertIsNotNone(resp)
        self.assertEqual(secret.name, resp.name)

    @utils.parameterized_dataset({
        'malformed_timezone': {
            'timezone': '-5:00',
            'days': 0}
    })
    @testcase.attr('negative')
    def test_secret_create_defaults_invalid_expiration(self, **kwargs):
        """Create secrets with various invalid expiration data."""
        timestamp = utils.create_timestamp_w_tz_and_offset(**kwargs)
        secret = self.barbicanclient.secrets.create(
            **secret_create_defaults_data)
        secret.expiration = timestamp

        e = self.assertRaises(
            exceptions.HTTPClientError,
            secret.store
        )

        self.assertEqual(400, e.status_code)

    @utils.parameterized_dataset({
        'text/plain':
            [
                'meowwwwwwwmeowwwwwww',
                'text/plain'],
        'application/octet-stream':
            [
                base64.b64encode(
                    b'F\x130\x89f\x8e\xd9\xa1\x0e\x1f\r\xf67uu\x8b'),
                'application/octet-stream'
            ]
    })
    @testcase.attr('positive')
    def test_secret_update_nones(self, payload, payload_content_type):
        """Cover case of updating with all nones in the Secret object."""
        secret = self.barbicanclient.secrets.create(**secret_create_nones_data)
        secret.payload = None
        secret.payload_content_type = None

        secret_ref = self.cleanup.add_entity(secret)
        self.assertIsNotNone(secret_ref)

        secret.payload = payload
        secret.update()

        resp = self.barbicanclient.secrets.get(secret_ref)
        self.assertEqual(payload, resp.payload)
        self.assertEqual(payload_content_type, resp.payload_content_type)

    @utils.parameterized_dataset({
        'alphanumeric': ['1f34ds'],
        'punctuation': ['~!@#$%^&*()_+`-={}[]|:;<>,.?'],
        'uuid': ['54262d9d-4bc7-4821-8df0-dc2ca8e112bb'],
        'len_255': ['a' * 255],
        'empty': [''],
        'null': [None]
    })
    @testcase.attr('positive')
    def test_secret_get_defaults_metadata_w_valid_name(self, name):
        """Covers getting and checking a secret's metadata."""
        secret = self.barbicanclient.secrets.create(
            **secret_create_defaults_data)
        secret.name = name

        secret_ref = self.cleanup.add_entity(secret)
        self.assertIsNotNone(secret_ref)

        resp = self.barbicanclient.secrets.get(secret_ref)
        self.assertEqual("ACTIVE", resp.status)
        self.assertEqual(name, resp.name)
        self.assertEqual(secret.mode, resp.mode)
        self.assertEqual(secret.algorithm, resp.algorithm)
        self.assertEqual(secret.bit_length, resp.bit_length)

    @utils.parameterized_dataset({
        'symmetric': ['symmetric',
                      'aes',
                      128,
                      ('\x00\x01\x02\x03\x04\x05\x06\x07'
                       '\x00\x01\x02\x03\x04\x05\x06\x07')],
        'private': ['private',
                    'rsa',
                    2048,
                    keys.get_private_key_pem()],
        'public': ['public',
                   'rsa',
                   2048,
                   keys.get_public_key_pem()],
        'certificate': ['certificate',
                        'rsa',
                        2048,
                        keys.get_certificate_pem()],
        'opaque': ['opaque',
                   None,
                   None,
                   (b'\x00\x01\x02\x03\x04\x05\x06\x07')],
        'passphrase': ['passphrase',
                       None,
                       None,
                       keys.get_passphrase_txt()],
    })
    @testcase.attr('positive')
    def test_secret_get_defaults_secret_type(self, secret_type, algorithm,
                                             bit_length, payload):
        """Covers getting and checking a secret's metadata."""
        secret = self.barbicanclient.secrets.create(
            **secret_create_defaults_data)
        secret.secret_type = secret_type
        secret.algorithm = algorithm
        secret.bit_length = bit_length
        # payload should not be encoded.
        secret.payload = payload

        secret_ref = self.cleanup.add_entity(secret)
        self.assertIsNotNone(secret_ref)

        resp = self.barbicanclient.secrets.get(secret_ref)
        self.assertEqual("ACTIVE", resp.status)
        self.assertEqual(secret_type, resp.secret_type)

    @utils.parameterized_dataset({
        'query_by_name': {
            'secret_1_dict': dict(name="name1"),
            'secret_2_dict': dict(name="name2"),
            'query_dict': dict(name="name1")
        },
        'query_by_algorithm': {
            'secret_1_dict': dict(algorithm="algorithm1"),
            'secret_2_dict': dict(algorithm="algorithm2"),
            'query_dict': dict(algorithm="algorithm1")
        },
        'query_by_mode': {
            'secret_1_dict': dict(mode="mode1"),
            'secret_2_dict': dict(mode="mode2"),
            'query_dict': dict(mode="mode1")
        },
        'query_by_bit_length': {
            'secret_1_dict': dict(bit_length=1024),
            'secret_2_dict': dict(bit_length=2048),
            'query_dict': dict(bits=1024)
        },
        'query_by_secret_type': {
            'secret_1_dict': dict(secret_type='opaque'),
            'secret_2_dict': dict(secret_type='symmetric'),
            'query_dict': dict(secret_type='opaque')
        },
    })
    @testcase.attr('positive')
    def test_secret_list_with_filter(self, secret_1_dict, secret_2_dict,
                                     query_dict):
        secret_1 = self.barbicanclient.secrets.create(**secret_1_dict)
        secret_1_ref = self.cleanup.add_entity(secret_1)
        self.assertIsNotNone(secret_1_ref)
        secret_2 = self.barbicanclient.secrets.create(**secret_2_dict)
        secret_2_ref = self.cleanup.add_entity(secret_2)
        self.assertIsNotNone(secret_2_ref)

        secret_list = self.barbicanclient.secrets.list(**query_dict)

        self.assertEqual(1, len(secret_list))

    @utils.parameterized_dataset({
        'query_by_name': {
            'secret_1_dict': dict(name="name1"),
            'secret_2_dict': dict(name="name2"),
            'sort': 'name'
        },
        'query_by_algorithm': {
            'secret_1_dict': dict(algorithm="algorithm1"),
            'secret_2_dict': dict(algorithm="algorithm2"),
            'sort': 'algorithm'
        },
        'query_by_mode': {
            'secret_1_dict': dict(mode="mode1"),
            'secret_2_dict': dict(mode="mode2"),
            'sort': 'mode'
        },
        'query_by_bit_length': {
            'secret_1_dict': dict(bit_length=1024),
            'secret_2_dict': dict(bit_length=2048),
            'sort': 'bit_length'
        },
        'query_by_secret_type': {
            'secret_1_dict': dict(secret_type='opaque'),
            'secret_2_dict': dict(secret_type='symmetric'),
            'sort': 'secret_type'
        },
    })
    @testcase.attr('positive')
    def test_secret_list_with_sort(self, secret_1_dict, secret_2_dict, sort):
        secret_1 = self.barbicanclient.secrets.create(**secret_1_dict)
        secret_1_ref = self.cleanup.add_entity(secret_1)
        self.assertIsNotNone(secret_1_ref)
        secret_2 = self.barbicanclient.secrets.create(**secret_2_dict)
        secret_2_ref = self.cleanup.add_entity(secret_2)
        self.assertIsNotNone(secret_2_ref)

        query_dict = {'sort': sort + ":asc"}
        secret_list = self.barbicanclient.secrets.list(**query_dict)

        self.assertEqual(2, len(secret_list))
        self.assertEqual(secret_1_ref, secret_list[0].secret_ref)

        query_dict = {'sort': sort + ":desc"}
        secret_list = self.barbicanclient.secrets.list(**query_dict)

        self.assertEqual(2, len(secret_list))
        self.assertEqual(secret_2_ref, secret_list[0].secret_ref)

    @utils.parameterized_dataset({
        'created': {
            'date_type': 'created',
        },
        'updated': {
            'date_type': 'updated',
        },
        'expiration': {
            'date_type': 'expiration',
        },
    })
    @testcase.attr('positive')
    def test_secret_list_with_date_filter(self, date_type):
        now = timeutils.utcnow()
        expiration_1 = (now + datetime.timedelta(days=3)).isoformat()
        expiration_2 = (now + datetime.timedelta(days=5)).isoformat()
        secret_1 = self.barbicanclient.secrets.create(expiration=expiration_1)
        secret_1_ref = self.cleanup.add_entity(secret_1)
        self.assertIsNotNone(secret_1_ref)
        payload = "gF6+lLoF3ohA9aPRpt+6bQ=="
        self.barbicanclient.secrets.update(secret_1_ref, payload)

        time.sleep(1)

        secret_2 = self.barbicanclient.secrets.create(expiration=expiration_2)
        secret_2_ref = self.cleanup.add_entity(secret_2)
        self.assertIsNotNone(secret_2_ref)

        time_to_search_1 = getattr(secret_1, date_type).isoformat()
        time_to_search_2 = getattr(secret_2, date_type).isoformat()

        # Search for secrets with secret 1's time
        query_dict = {date_type: time_to_search_1}
        secret_list = self.barbicanclient.secrets.list(**query_dict)

        self.assertEqual(1, len(secret_list))
        self.assertEqual(secret_1_ref, secret_list[0].secret_ref)

        # Search for secrets with time < secret 2, i.e. secret 1
        query_dict = {date_type: 'lt:' + time_to_search_2}
        secret_list = self.barbicanclient.secrets.list(**query_dict)

        self.assertEqual(1, len(secret_list))
        self.assertEqual(secret_1_ref, secret_list[0].secret_ref)

        # Search for secrets with time < secret 1, i.e. none
        query_dict = {date_type: 'lt:' + time_to_search_1}
        secret_list = self.barbicanclient.secrets.list(**query_dict)

        self.assertEqual(0, len(secret_list))

        # Search for secrets with time <= secret 2, i.e. both secrets
        query_dict = {date_type: 'lte:' + time_to_search_2}
        secret_list = self.barbicanclient.secrets.list(**query_dict)

        self.assertEqual(2, len(secret_list))

        # Search for secrets with time > secret 1, i.e. secret 2
        query_dict = {date_type: 'gt:' + time_to_search_1}
        secret_list = self.barbicanclient.secrets.list(**query_dict)

        self.assertEqual(1, len(secret_list))
        self.assertEqual(secret_2_ref, secret_list[0].secret_ref)

        # Search for secrets with time > secret 2, i.e. none
        query_dict = {date_type: 'gt:' + time_to_search_2}
        secret_list = self.barbicanclient.secrets.list(**query_dict)

        self.assertEqual(0, len(secret_list))

        # Search for secrets with time >= secret 1, i.e. both secrets
        query_dict = {date_type: 'gte:' + time_to_search_1}
        secret_list = self.barbicanclient.secrets.list(**query_dict)

        self.assertEqual(2, len(secret_list))

        # Sort secrets by date
        query_dict = {'sort': date_type + ":asc"}
        secret_list = self.barbicanclient.secrets.list(**query_dict)

        self.assertEqual(2, len(secret_list))
        self.assertEqual(secret_1_ref, secret_list[0].secret_ref)

        # Sort secrets by date
        query_dict = {'sort': date_type + ":desc"}
        secret_list = self.barbicanclient.secrets.list(**query_dict)

        self.assertEqual(2, len(secret_list))
        self.assertEqual(secret_2_ref, secret_list[0].secret_ref)
