Merge "New API test cases for a Zone test suite."
diff --git a/designate_tempest_plugin/clients.py b/designate_tempest_plugin/clients.py
index 43ec5a7..6fbfc05 100644
--- a/designate_tempest_plugin/clients.py
+++ b/designate_tempest_plugin/clients.py
@@ -49,6 +49,8 @@
     import TsigkeyClient
 from designate_tempest_plugin.services.dns.v2.json.service_client \
     import SevriceClient
+from designate_tempest_plugin.services.dns.v2.json.designate_limit_client \
+    import DesignateLimitClient
 
 CONF = config.CONF
 
@@ -96,6 +98,7 @@
         self.transfer_accept_client = TransferAcceptClient(**params)
         self.tsigkey_client = TsigkeyClient(**params)
         self.service_client = SevriceClient(**params)
+        self.designate_limit_client = DesignateLimitClient(**params)
 
         self.query_client = QueryClient(
             nameservers=CONF.dns.nameservers,
diff --git a/designate_tempest_plugin/common/constants.py b/designate_tempest_plugin/common/constants.py
index 02a3b1f..84ee5ae 100644
--- a/designate_tempest_plugin/common/constants.py
+++ b/designate_tempest_plugin/common/constants.py
@@ -12,7 +12,12 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
-# API statuses
+# Designate statuses strings
+PENDING = 'PENDING'
+COMPLETE = 'COMPLETE'
+ERROR = 'ERROR'
+DELETED = 'DELETED'
+ACTIVE = 'ACTIVE'
 UP = 'UP'
 
 # Zone types
diff --git a/designate_tempest_plugin/services/dns/v2/json/designate_limit_client.py b/designate_tempest_plugin/services/dns/v2/json/designate_limit_client.py
new file mode 100644
index 0000000..a4e3aef
--- /dev/null
+++ b/designate_tempest_plugin/services/dns/v2/json/designate_limit_client.py
@@ -0,0 +1,27 @@
+# Copyright 2021 Red Hat.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+from designate_tempest_plugin.services.dns.v2.json import base
+
+
+class DesignateLimitClient(base.DnsClientV2Base):
+
+    @base.handle_errors
+    def list_designate_limits(self, headers=None):
+        """Show the limits for Designate fields
+
+        :param headers: (dict): The headers to use for the request.
+        :return: Dictionary of limits
+        """
+        return self._list_request(
+            'limits', headers=headers)[1]
diff --git a/designate_tempest_plugin/services/dns/v2/json/zone_imports_client.py b/designate_tempest_plugin/services/dns/v2/json/zone_imports_client.py
index 872fc13..86d9fb1 100644
--- a/designate_tempest_plugin/services/dns/v2/json/zone_imports_client.py
+++ b/designate_tempest_plugin/services/dns/v2/json/zone_imports_client.py
@@ -43,25 +43,27 @@
         return resp, body
 
     @base.handle_errors
-    def show_zone_import(self, uuid, params=None):
+    def show_zone_import(self, uuid, params=None, headers=None):
         """Gets a specific zone import.
         :param uuid: Unique identifier of the imported zone in UUID format.
         :param params: A Python dict that represents the query paramaters to
                        include in the request URI.
+        :param headers (dict): The headers to use for the request.
         :return: Serialized imported zone as a dictionary.
         """
         return self._show_request(
-            'zones/tasks/imports', uuid, params=params)
+            'zones/tasks/imports', uuid, params=params, headers=headers)
 
     @base.handle_errors
-    def list_zone_imports(self, params=None):
+    def list_zone_imports(self, params=None, headers=None):
         """Gets all the imported zones.
         :param params: A Python dict that represents the query paramaters to
                        include in the request URI.
+        :param headers (dict): The headers to use for the request.
         :return: Serialized imported zones as a list.
         """
         return self._list_request(
-            'zones/tasks/imports', params=params)
+            'zones/tasks/imports', params=params, headers=headers)
 
     @base.handle_errors
     def delete_zone_import(self, uuid, params=None):
diff --git a/designate_tempest_plugin/tests/api/v2/test_designate_limits.py b/designate_tempest_plugin/tests/api/v2/test_designate_limits.py
new file mode 100644
index 0000000..a2c92dc
--- /dev/null
+++ b/designate_tempest_plugin/tests/api/v2/test_designate_limits.py
@@ -0,0 +1,52 @@
+# Copyright 2021 Red Hat.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+from oslo_log import log as logging
+from tempest.lib import decorators
+
+from designate_tempest_plugin.tests import base
+
+LOG = logging.getLogger(__name__)
+
+
+class DesignateLimit(base.BaseDnsV2Test):
+    credentials = ['admin']
+
+    @classmethod
+    def setup_credentials(cls):
+        # Do not create network resources for these test.
+        cls.set_network_resources()
+        super(DesignateLimit, cls).setup_credentials()
+
+    @classmethod
+    def setup_clients(cls):
+        super(DesignateLimit, cls).setup_clients()
+
+        cls.admin_client = cls.os_admin.designate_limit_client
+
+    @decorators.idempotent_id('828572be-8662-11eb-8ff2-74e5f9e2a801')
+    def test_list_designate_limits(self):
+        expected_default_limits_fields = [
+            "max_page_limit", "max_recordset_name_length",
+            "max_recordset_records", "max_zone_name_length",
+            "max_zone_records", "max_zone_recordsets",
+            "max_zones", "min_ttl"].sort()
+        project_limits = self.admin_client.list_designate_limits()
+        LOG.info(
+            'Retrieved designate limits are: {} '.format(project_limits))
+        self.assertEqual(
+            expected_default_limits_fields,
+            list(project_limits.keys()).sort(),
+            'Retrieved fields: {} are not as expected: {} '.format(
+                list(project_limits.keys()).sort(),
+                expected_default_limits_fields))
diff --git a/designate_tempest_plugin/tests/api/v2/test_zones_imports.py b/designate_tempest_plugin/tests/api/v2/test_zones_imports.py
index dcbcd13..6c71306 100644
--- a/designate_tempest_plugin/tests/api/v2/test_zones_imports.py
+++ b/designate_tempest_plugin/tests/api/v2/test_zones_imports.py
@@ -16,8 +16,10 @@
 from tempest.lib import decorators
 from tempest.lib import exceptions as lib_exc
 
+from designate_tempest_plugin.common import constants as const
 from designate_tempest_plugin.common import waiters
 from designate_tempest_plugin.tests import base
+from designate_tempest_plugin import data_utils as dns_data_utils
 
 LOG = logging.getLogger(__name__)
 
@@ -28,6 +30,8 @@
 
 
 class ZonesImportTest(BaseZonesImportTest):
+    credentials = ['primary', 'admin', 'alt']
+
     @classmethod
     def setup_credentials(cls):
         # Do not create network resources for these test.
@@ -39,14 +43,19 @@
         super(ZonesImportTest, cls).setup_clients()
 
         cls.client = cls.os_primary.zone_imports_client
+        cls.alt_client = cls.os_alt.zone_imports_client
+        cls.admin_client = cls.os_admin.zone_imports_client
         cls.zone_client = cls.os_primary.zones_client
 
     def clean_up_resources(self, zone_import_id):
-        waiters.wait_for_zone_import_status(self.client, zone_import_id,
-                                            "COMPLETE")
-        _, zone_import = self.client.show_zone_import(zone_import_id)
-        self.client.delete_zone_import(zone_import['id'])
-        self.wait_zone_delete(self.zone_client, zone_import['zone_id'])
+        zone_import = self.client.show_zone_import(zone_import_id)[1]
+        if zone_import['zone_id']:  # A zone was actually created.
+            waiters.wait_for_zone_import_status(
+                self.client, zone_import_id, const.COMPLETE)
+            self.client.delete_zone_import(zone_import['id'])
+            self.wait_zone_delete(self.zone_client, zone_import['zone_id'])
+        else:  # Import has failed and zone wasn't created.
+            self.client.delete_zone_import(zone_import['id'])
 
     @decorators.idempotent_id('2e2d907d-0609-405b-9c96-3cb2b87e3dce')
     def test_create_zone_import(self):
@@ -55,7 +64,29 @@
         self.addCleanup(self.clean_up_resources, zone_import['id'])
 
         LOG.info('Ensure we respond with PENDING')
-        self.assertEqual('PENDING', zone_import['status'])
+        self.assertEqual(const.PENDING, zone_import['status'])
+
+    @decorators.idempotent_id('31eaf25a-9532-11eb-a55d-74e5f9e2a801')
+    def test_create_zone_import_invalid_ttl(self):
+        LOG.info('Try to create a zone import using invalid TTL value')
+        zone_import = self.client.create_zone_import(
+            zonefile_data=dns_data_utils.rand_zonefile_data(ttl='zahlabut'))[1]
+        self.addCleanup(self.clean_up_resources, zone_import['id'])
+        self.assertEqual(
+            const.ERROR,
+            self.client.show_zone_import(zone_import['id'])[1]['status'],
+            'Failed, expected status is: ERROR')
+
+    @decorators.idempotent_id('31eaf25a-9532-11eb-a55d-74e5f9e2a801')
+    def test_create_zone_import_invalid_name(self):
+        LOG.info('Try to create a zone import using invalid name')
+        zone_import = self.client.create_zone_import(
+            zonefile_data=dns_data_utils.rand_zonefile_data(name='@@@'))[1]
+        self.addCleanup(self.clean_up_resources, zone_import['id'])
+        self.assertEqual(
+            const.ERROR,
+            self.client.show_zone_import(zone_import['id'])[1]['status'],
+            'Failed, expected status is: ERROR')
 
     @decorators.attr(type='smoke')
     @decorators.idempotent_id('c8909558-0dc6-478a-9e91-eb97b52e59e0')
@@ -75,7 +106,7 @@
         LOG.info('Create a zone import')
         _, zone_import = self.client.create_zone_import()
         waiters.wait_for_zone_import_status(self.client, zone_import['id'],
-                                            "COMPLETE")
+                                            const.COMPLETE)
         _, zone_import = self.client.show_zone_import(zone_import['id'])
         self.addCleanup(self.wait_zone_delete,
                         self.zone_client,
@@ -98,3 +129,78 @@
         _, body = self.client.list_zone_imports()
 
         self.assertGreater(len(body['imports']), 0)
+
+    @decorators.idempotent_id('2c1fa20e-9554-11eb-a55d-74e5f9e2a801')
+    def test_show_import_impersonate_another_project(self):
+
+        LOG.info('Import zone "A" using primary client')
+        zone_import = self.client.create_zone_import()[1]
+        self.addCleanup(self.clean_up_resources, zone_import['id'])
+
+        LOG.info('Ensure we respond with PENDING')
+        self.assertEqual(const.PENDING, zone_import['status'])
+
+        LOG.info('Show a zone import for a Primary tenant, using Alt tenant. '
+                 'Expected:404 NotFound')
+        self.assertRaises(lib_exc.NotFound,
+                          lambda: self.alt_client.show_zone_import(
+                              zone_import['id']))
+
+        LOG.info('Show a zone import for a Primary tenant using Alt tenant '
+                 'and "x-auth-sudo-project-id" HTTP header. '
+                 'Expected:403 Forbidden')
+        self.assertRaises(
+            lib_exc.Forbidden,
+            lambda: self.alt_client.show_zone_import(
+                zone_import['id'],
+                headers={'x-auth-sudo-project-id': zone_import[
+                    'project_id']}))
+
+        LOG.info('Show a zone import for a Primary tenant, using Admin '
+                 'tenant and "x-auth-sudo-project-id" HTTP header.')
+        resp_body = self.admin_client.show_zone_import(uuid=None, headers={
+                'x-auth-sudo-project-id': zone_import['project_id']})[1]
+
+        LOG.info('Show a zone import for a Primary tenant, using Admin '
+                 'tenant without "x-auth-sudo-project-id" HTTP header. '
+                 'Expected:404 NotFound')
+        self.assertRaises(
+            lib_exc.NotFound, lambda: self.admin_client.show_zone_import(
+                zone_import['id']))
+
+        LOG.info('Ensure that the shown response matches the expected one')
+        self.assertExpected(
+            zone_import, resp_body['imports'][0], self.excluded_keys)
+
+    @decorators.idempotent_id('7bd06ec6-9556-11eb-a55d-74e5f9e2a801')
+    def test_list_import_zones_all_projects(self):
+        LOG.info('Create import zone "A" using primary client')
+        zone_import = self.client.create_zone_import()[1]
+        self.addCleanup(self.clean_up_resources, zone_import['id'])
+
+        LOG.info('As Alt user list import zones for a Primary tenant, '
+                 'using "x-auth-sudo-project-id" HTTP header. '
+                 'Expected: 403 Forbidden')
+        self.assertRaises(
+            lib_exc.Forbidden, lambda: self.alt_client.list_zone_imports(
+                headers={
+                    'x-auth-sudo-project-id': zone_import['project_id']}))
+
+        LOG.info('As Alt tenant list zone imports for all projects, using '
+                 '"x-auth-all-projects" HTTP header, Expected: 403 Forbidden')
+        self.assertRaises(
+            lib_exc.Forbidden, lambda: self.alt_client.list_zone_imports(
+                headers={'x-auth-all-projects': True}))
+
+        LOG.info('As Admin tenant list import zones for all projects')
+        body = self.admin_client.list_zone_imports(headers={
+                'x-auth-all-projects': True})[1]['imports']
+
+        LOG.info('Ensure the fetched response includes previously '
+                 'created import ID')
+        listed_zone_import_ids = [item['id'] for item in body]
+        self.assertIn(
+            zone_import['id'], listed_zone_import_ids,
+            "Failed, expected import ID:{} wasn't found in "
+            "listed import IDs".format(
+                zone_import['id'], listed_zone_import_ids))