Merge "Merge Neutron AutoScaling and LoadBalancer tests"
diff --git a/functional/test_conditional_exposure.py b/functional/test_conditional_exposure.py
index 99e76ee..d037712 100644
--- a/functional/test_conditional_exposure.py
+++ b/functional/test_conditional_exposure.py
@@ -66,3 +66,36 @@
template=self.unavailable_template)
self.assertIn('ResourceTypeUnavailable', ex.message)
self.assertIn('OS::Sahara::NodeGroupTemplate', ex.message)
+
+
+class RoleBasedExposureTest(functional_base.FunctionalTestsBase):
+ forbidden_resource_type = "OS::Nova::Flavor"
+ fl_tmpl = """
+heat_template_version: 2015-10-15
+
+resources:
+ not4everyone:
+ type: OS::Nova::Flavor
+ properties:
+ ram: 20000
+ vcpus: 10
+"""
+
+ def test_non_admin_forbidden_create_flavors(self):
+ """Fail to create Flavor resource w/o admin role
+
+ Integration tests job runs as normal OpenStack user,
+ and OS::Nova:Flavor is configured to require
+ admin role in default policy file of Heat.
+ """
+ stack_name = self._stack_rand_name()
+ ex = self.assertRaises(exc.Forbidden,
+ self.client.stacks.create,
+ stack_name=stack_name,
+ template=self.fl_tmpl)
+ self.assertIn(self.forbidden_resource_type, ex.message)
+
+ def test_forbidden_resource_not_listed(self):
+ resources = self.client.resource_types.list()
+ self.assertNotIn(self.forbidden_resource_type,
+ (r.resource_type for r in resources))