# Copyright 2016 NEC Corporation.  All rights reserved.
#
#    Licensed under the Apache License, Version 2.0 (the "License"); you may
#    not use this file except in compliance with the License. You may obtain
#    a copy of the License at
#
#         http://www.apache.org/licenses/LICENSE-2.0
#
#    Unless required by applicable law or agreed to in writing, software
#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
#    License for the specific language governing permissions and limitations
#    under the License.
from oslo_log import log as logging
from oslo_utils import versionutils
from tempest import config
from tempest.lib import decorators
from tempest.lib import exceptions as lib_exc
from tempest.lib.common.utils import data_utils

from designate_tempest_plugin.tests import base
from designate_tempest_plugin.common import constants as const

from designate_tempest_plugin.common import waiters
from designate_tempest_plugin import data_utils as dns_data_utils

CONF = config.CONF
LOG = logging.getLogger(__name__)


class BaseRecordsetsTest(base.BaseDnsV2Test):
    excluded_keys = ['created_at', 'updated_at', 'version', 'links',
                     'type']

    @classmethod
    def setup_clients(cls):
        super(BaseRecordsetsTest, cls).setup_clients()
        cls.admin_tld_client = cls.os_admin.dns_v2.TldClient()

    @classmethod
    def resource_setup(cls):
        super(BaseRecordsetsTest, cls).resource_setup()

        # Make sure we have an allowed TLD available
        tld_name = dns_data_utils.rand_zone_name(name="BaseRecordsetsTest")
        cls.tld_name = f".{tld_name}"
        cls.class_tld = cls.admin_tld_client.create_tld(tld_name=tld_name[:-1])

        # All the recordset tests need a zone, create one to share
        zone_name = dns_data_utils.rand_zone_name(name="TestZone",
                                              suffix=cls.tld_name)
        LOG.info('Create a zone: %s', zone_name)
        cls.zone = cls.zones_client.create_zone(name=zone_name)[1]

    @classmethod
    def resource_cleanup(cls):
        cls.zones_client.delete_zone(
            cls.zone['id'], ignore_errors=lib_exc.NotFound)
        cls.admin_tld_client.delete_tld(cls.class_tld[1]['id'])
        super(BaseRecordsetsTest, cls).resource_cleanup()


class RecordsetsTest(BaseRecordsetsTest):

    credentials = ["admin", "primary", "alt",
                   "project_member", "project_reader"]

    @classmethod
    def setup_credentials(cls):
        # Do not create network resources for these test.
        cls.set_network_resources()
        super(RecordsetsTest, cls).setup_credentials()

    @classmethod
    def setup_clients(cls):
        super(RecordsetsTest, cls).setup_clients()
        cls.admin_client = cls.os_admin.dns_v2.RecordsetClient()
        cls.admin_zone_client = cls.os_admin.dns_v2.ZonesClient()
        cls.client = cls.os_primary.dns_v2.RecordsetClient()
        cls.alt_client = cls.os_alt.dns_v2.RecordsetClient()
        cls.alt_zone_client = cls.os_alt.dns_v2.ZonesClient()

    @decorators.attr(type='smoke')
    @decorators.idempotent_id('631d74fd-6909-4684-a61b-5c4d2f92c3e7')
    def test_create_recordset(self):
        recordset_data = dns_data_utils.rand_recordset_data(
            record_type='A', zone_name=self.zone['name'])

        # Test RBAC
        expected_allowed = ['os_admin', 'os_primary', 'os_alt']
        if CONF.dns_feature_enabled.enforce_new_defaults:
            expected_allowed.append('os_project_member')

        self.check_CUD_RBAC_enforcement(
            'RecordsetClient', 'create_recordset', expected_allowed, True,
            self.zone['id'], recordset_data)

        LOG.info('Create a Recordset')
        resp, body = self.client.create_recordset(
            self.zone['id'], recordset_data)
        self.addCleanup(
            self.wait_recordset_delete, self.client,
            self.zone['id'], body['id'])

        LOG.info('Ensure we respond with PENDING')
        self.assertEqual(const.PENDING, body['status'])

    # We cannot use DDT here as these tests are part of the refstack
    # interoperability test suite and need to be unique for traceability.
    def _test_create_recordset_type(self, name, type, records):
        if name is not None:
            recordset_name = name + "." + self.zone['name']

        else:
            recordset_name = self.zone['name']

        recordset_data = {
            'name': recordset_name,
            'type': type,
            'records': records,
        }

        LOG.info('Create a Recordset')
        resp, body = self.client.create_recordset(
            self.zone['id'], recordset_data)
        self.addCleanup(
            self.wait_recordset_delete, self.client,
            self.zone['id'], body['id'])

        LOG.info('Ensure we respond with PENDING')
        self.assertEqual(const.PENDING, body['status'])

    @decorators.idempotent_id('d03b69a5-5052-43bc-a38a-b511b6b34304')
    def test_create_recordset_type_A(self):
        self._test_create_recordset_type(
            "www", "A", ["192.0.2.1", "192.0.2.2", "192.0.2.3"])

    @decorators.idempotent_id('ac110198-d58a-4a18-aceb-414d7e513d49')
    def test_create_recordset_type_AAAA(self):
        self._test_create_recordset_type(
            "www", "AAAA", ["2001:db8::1", "2001:db8::1", "2001:db8::"])

    @decorators.idempotent_id('6c22a3f9-3f4d-4b32-bdf2-5237851ed25e')
    def test_create_recordset_type_SRV_TCP(self):
        self._test_create_recordset_type(
            "_sip._tcp", "SRV", [
                "10 60 5060 server1.example{}".format(self.tld_name),
                "20 60 5060 server2.example{}".format(self.tld_name),
                "20 30 5060 server3.example{}".format(self.tld_name)])

    @decorators.idempotent_id('59c1aa42-278e-4f7b-a6a1-4320d5daf1fd')
    def test_create_recordset_type_SRV_UDP(self):
        self._test_create_recordset_type(
            "_sip._udp", "SRV", [
                "10 60 5060 server1.example{}".format(self.tld_name),
                "10 60 5060 server2.example{}".format(self.tld_name),
                "20 30 5060 server3.example{}".format(self.tld_name)])

    @decorators.idempotent_id('1ac46f94-f03a-4f85-b84f-826a2660b927')
    def test_create_recordset_type_CNAME(self):
        self._test_create_recordset_type(
            "alias-of-target", "CNAME", ["target.example.org."])

    @decorators.idempotent_id('bf872487-7975-4a96-bb03-d24e393a0ce8')
    def test_create_recordset_type_MX_at_APEX(self):
        self._test_create_recordset_type(
            None, "MX", ["10 mail1.example.org.", "20 mail2.example.org."])

    @decorators.idempotent_id('96fe72a4-a81c-4a01-a81f-39ebafad115c')
    def test_create_recordset_type_MX_under_APEX(self):
        self._test_create_recordset_type(
            "under", "MX", ["10 mail.example.org."])

    @decorators.idempotent_id('481496f1-917a-40d5-89fd-4a3794c24215')
    def test_create_recordset_type_SSHFP(self):
        self._test_create_recordset_type(
            "www", "SSHFP", ["2 1 123456789abcdef67890123456789abcdef67890"])

    @decorators.idempotent_id('8e7ecedb-5c35-46f8-ae0e-39e4aaabc97d')
    def test_create_recordset_type_TXT(self):
        self._test_create_recordset_type(
            "sample", "TXT", ["\"Any Old Text Goes Here\""])

    @decorators.idempotent_id('521ae1b0-f115-4d3c-8bcd-e54ef53bb2b9')
    def test_create_recordset_type_SVCB(self):
        if not versionutils.is_compatible('2.2', self.api_version,
                                          same_major=False):
            raise self.skipException(
                'SVCB record tests require Designate API version 2.2 or '
                'newer. Skipping test_create_recordset_type_SVCB test.')

        ipv61 = '2001:db8:3333:4444:5555:6666:7777:8888'
        ipv6hint = f'{ipv61},2001:db8:3333:4444:cccc:dddd:eeee:ffff'
        ipv4hint = "1.2.3.4,9.8.7.6"
        alpn = "h3,h2,http/1.1"
        port = "888"
        target = "sample.example.org."
        doh = '/dns-query{?dns}'
        self._test_create_recordset_type(
            None,
            "SVCB",
            [f"1 {target} alpn={alpn} ipv4hint={ipv4hint}"
             f" ipv6hint={ipv6hint} port={port} dohpath={doh}"]
        )

    @decorators.idempotent_id('ebb3c1e2-fa33-4520-bba5-2888886d84f5')
    def test_create_recordset_type_HTTPS(self):
        if not versionutils.is_compatible('2.2', self.api_version,
                                          same_major=False):
            raise self.skipException(
                'HTTPS record tests require Designate API version 2.2 or '
                'newer. Skipping test_create_recordset_type_HTTPS test.')

        ipv61 = '2001:db8:3333:4444:5555:6666:7777:8888'
        ipv6hint = f'{ipv61},2001:db8:3333:4444:cccc:dddd:eeee:ffff'
        ipv4hint = "1.2.3.4,9.8.7.6"
        alpn = "h3,h2,http/1.1"
        port = "888"
        target = "sample.example.org."
        self._test_create_recordset_type(
            "sample",
            "HTTPS",
            [f"1 {target} alpn={alpn} ipv4hint={ipv4hint}"
             f" ipv6hint={ipv6hint} port={port}"]
        )

    @decorators.idempotent_id('64f3a41b-065c-47f8-8a73-2a0cd62ed196')
    def test_create_recordset_type_HTTPS_no_default_alpn(self):
        if not versionutils.is_compatible('2.2', self.api_version,
                                          same_major=False):
            raise self.skipException(
                'HTTPS record tests require Designate API version 2.2 or '
                'newer. Skipping '
                'test_create_recordset_type_HTTPS_no_default_alpntest.')

        self._test_create_recordset_type(
            "sample", "HTTPS", ['1 sample.example.org. alpn=http/1.1 '
                                'no-default-alpn port=8000']
        )

    @decorators.idempotent_id('4d399592-5d37-43ba-99ac-e7665c2c1f8f')
    def test_create_recordset_type_HTTPS_mandatory(self):
        if not versionutils.is_compatible('2.2', self.api_version,
                                          same_major=False):
            raise self.skipException(
                'HTTPS record tests require Designate API version 2.2 or '
                'newer. Skipping test_create_recordset_type_HTTPS_mandatory '
                'test.')

        ipv6 = "2001:db8:3333:4444:5555:6666:7777:8888"
        self._test_create_recordset_type(
            "sample",
            "HTTPS",
            [f'1 sample.example.org. ipv4hint=192.168.1.2 ipv6hint={ipv6}'
             f' alpn=h2 mandatory=alpn'
             ]
        )

    def _test_create_wildcard_recordset(self, name, type, records):
        if name is not None:
            recordset_name = name + "." + self.zone['name']

        else:
            recordset_name = "*." + self.zone['name']

        recordset_data = {
            'name': recordset_name,
            'type': type,
            'records': records,
        }

        LOG.info('Create a Recordset')
        resp, body = self.client.create_recordset(
            self.zone['id'], recordset_data)
        self.addCleanup(
            self.wait_recordset_delete, self.client,
            self.zone['id'], body['id'])

        LOG.info('Ensure we respond with PENDING')
        self.assertEqual(const.PENDING, body['status'])

    @decorators.idempotent_id('69f002e5-6511-43d3-abae-7abdd45ae03e')
    def test_create_wildcard_recordset_A_at_APEX(self):
        self._test_create_wildcard_recordset(
            "*", "A", ["192.0.2.1", "192.0.2.2", "192.0.2.3"])

    @decorators.idempotent_id('d97ee452-0dc3-11ee-8b75-201e8823901f')
    def test_create_wildcard_recordset_A_under_APEX(self):
        self._test_create_wildcard_recordset(
            "*.sub", "A", ["192.0.2.1", "192.0.2.2", "192.0.2.3"])

    @decorators.idempotent_id('1b3c1cc0-0dc4-11ee-8b75-201e8823901f')
    def test_create_wildcard_recordset_AAAA_at_APEX(self):
        self._test_create_wildcard_recordset(
            "*", "AAAA", ["2001:db8::1", "2001:db8::1", "2001:db8::"])

    @decorators.idempotent_id('928e735e-0dc4-11ee-8b75-201e8823901f')
    def test_create_wildcard_recordset_AAAA_under_APEX(self):
        self._test_create_wildcard_recordset(
            "*.sub", "AAAA", ["2001:db8::1", "2001:db8::1", "2001:db8::"])

    @decorators.idempotent_id('d96138f2-0dc4-11ee-8b75-201e8823901f')
    def test_create_wildcard_recordset_MX_at_APEX(self):
        self._test_create_wildcard_recordset(
            "*", "MX", ["10 mail1.example.org.", "20 mail2.example.org."])

    @decorators.idempotent_id('ff273c94-0dc4-11ee-8b75-201e8823901f')
    def test_create_wildcard_recordset_MX_under_APEX(self):
        self._test_create_wildcard_recordset(
            "*.sub", "MX", ["10 mail.example.org."])

    @decorators.idempotent_id('3097f16a-0dc5-11ee-8b75-201e8823901f')
    def test_create_wildcard_recordset_SPF_at_APEX(self):
        self._test_create_wildcard_recordset(
            "*", "SPF", ["\"v=spf1; a -all\""])

    @decorators.idempotent_id('50b3f390-0dc5-11ee-8b75-201e8823901f')
    def test_create_wildcard_recordset_SPF_under_APEX(self):
        self._test_create_wildcard_recordset(
            "*.sub", "SPF", ["\"v=spf1; a -all\""])

    @decorators.idempotent_id('5b73981c-0dc5-11ee-8b75-201e8823901f')
    def test_create_wildcard_recordset_TXT_at_APEX(self):
        self._test_create_wildcard_recordset(
            "*", "TXT", ["\"Can you read me?\""])

    @decorators.idempotent_id('5b73981c-0dc5-11ee-8b75-201e8823901f')
    def test_create_wildcard_recordset_TXT_under_APEX(self):
        self._test_create_wildcard_recordset(
            "*.sub", "TXT", ["\"Can you read me?\""])

    @decorators.idempotent_id('5964f730-5546-46e6-9105-5030e9c492b2')
    def test_list_recordsets(self):
        recordset_data = dns_data_utils.rand_recordset_data(
            record_type='A', zone_name=self.zone['name'])

        LOG.info('Create a Recordset')
        resp, body = self.client.create_recordset(
            self.zone['id'], recordset_data)
        recordset_id = body['id']
        self.addCleanup(
            self.wait_recordset_delete, self.client,
            self.zone['id'], recordset_id)

        LOG.info('List zone recordsets')
        body = self.client.list_recordset(self.zone['id'])[1]

        self.assertGreater(len(body), 0)

        # Test RBAC
        expected_allowed = ['os_primary']
        if CONF.dns_feature_enabled.enforce_new_defaults:
            expected_allowed.extend(['os_project_reader',
                                     'os_project_member'])

        self.check_list_show_RBAC_enforcement(
            'RecordsetClient', 'list_recordset', expected_allowed, True,
            self.zone['id'])

        # Test that users who should see the zone, can see it.
        expected_allowed = ['os_primary']
        if CONF.dns_feature_enabled.enforce_new_defaults:
            expected_allowed.extend(['os_project_reader',
                                     'os_project_member'])

        self.check_list_IDs_RBAC_enforcement(
            'RecordsetClient', 'list_recordset',
            expected_allowed, [recordset_id], self.zone['id'])

        # Test RBAC with x-auth-all-projects and x-auth-sudo-project-id header
        expected_allowed = ['os_admin']

        self.check_list_IDs_RBAC_enforcement(
            'RecordsetClient', 'list_recordset', expected_allowed,
            [recordset_id], self.zone['id'], headers=self.all_projects_header)
        self.check_list_IDs_RBAC_enforcement(
            'RecordsetClient', 'list_recordset',
            expected_allowed, [recordset_id], self.zone['id'],
            headers={'x-auth-sudo-project-id': self.client.project_id})

    @decorators.idempotent_id('84c13cb2-9020-4c1e-aeb0-c348d9a70caa')
    def test_show_recordsets(self):
        recordset_data = dns_data_utils.rand_recordset_data(
            record_type='A', zone_name=self.zone['name'])

        LOG.info('Create a Recordset')
        resp, body = self.client.create_recordset(
            self.zone['id'], recordset_data)
        recordset_id = body['id']
        self.addCleanup(
            self.wait_recordset_delete, self.client,
            self.zone['id'], recordset_id)

        LOG.info('Re-Fetch the Recordset')
        record = self.client.show_recordset(self.zone['id'], recordset_id)[1]

        LOG.info('Ensure the fetched response matches the expected one')
        self.assertExpected(body, record, self.excluded_keys)

        # Test RBAC
        expected_allowed = ['os_primary']
        if CONF.dns_feature_enabled.enforce_new_defaults:
            expected_allowed.extend(['os_project_member',
                                     'os_project_reader'])

        self.check_list_show_RBAC_enforcement(
            'RecordsetClient', 'show_recordset', expected_allowed, True,
            self.zone['id'], recordset_id)

        # Test RBAC with x-auth-all-projects and x-auth-sudo-project-id header
        expected_allowed = ['os_admin']

        self.check_list_show_RBAC_enforcement(
            'RecordsetClient', 'show_recordset', expected_allowed, True,
            self.zone['id'], recordset_id, headers=self.all_projects_header)
        self.check_list_show_RBAC_enforcement(
            'RecordsetClient', 'show_recordset', expected_allowed, True,
            self.zone['id'], recordset_id,
            headers={'x-auth-sudo-project-id': self.client.project_id})

    @decorators.idempotent_id('855399c1-8806-4ae5-aa31-cb8a6f35e218')
    def test_delete_recordset(self):
        recordset_data = dns_data_utils.rand_recordset_data(
            record_type='A', zone_name=self.zone['name'])

        LOG.info('Create a Recordset')
        record = self.client.create_recordset(
            self.zone['id'], recordset_data)[1]
        recordset_id = record['id']
        self.addCleanup(
            self.wait_recordset_delete, self.client,
            self.zone['id'], recordset_id)

        # Test RBAC
        expected_allowed = ['os_admin', 'os_primary']
        if CONF.dns_feature_enabled.enforce_new_defaults:
            expected_allowed.extend(['os_project_member'])

        self.check_CUD_RBAC_enforcement(
            'RecordsetClient', 'delete_recordset', expected_allowed, True,
            self.zone['id'], recordset_id)

        # Test RBAC with x-auth-all-projects and x-auth-sudo-project-id header
        expected_allowed = ['os_admin', 'os_primary']

        self.check_CUD_RBAC_enforcement(
            'RecordsetClient', 'delete_recordset', expected_allowed, False,
            self.zone['id'], recordset_id, headers=self.all_projects_header)

        self.check_CUD_RBAC_enforcement(
            'RecordsetClient', 'delete_recordset', expected_allowed, False,
            self.zone['id'], recordset_id,
            headers={'x-auth-sudo-project-id': self.client.project_id})

        LOG.info('Delete a Recordset')
        self.client.delete_recordset(self.zone['id'], recordset_id)

        LOG.info('Ensure successful deletion of Recordset')
        self.assertRaises(lib_exc.NotFound,
            lambda: self.client.show_recordset(self.zone['id'], recordset_id))

    @decorators.idempotent_id('8d41c85f-09f9-48be-a202-92d1bdf5c796')
    def test_update_recordset(self):
        recordset_data = dns_data_utils.rand_recordset_data(
            record_type='A', zone_name=self.zone['name'])

        LOG.info('Create a recordset')
        record = self.client.create_recordset(
            self.zone['id'], recordset_data)[1]
        recordset_id = record['id']
        self.addCleanup(
            self.wait_recordset_delete, self.client,
            self.zone['id'], recordset_id)

        recordset_data = dns_data_utils.rand_recordset_data(
            record_type='A', zone_name=self.zone['name'], name=record['name'])

        LOG.info('Update the recordset')
        update = self.client.update_recordset(self.zone['id'],
            recordset_id, recordset_data)[1]

        self.assertEqual(record['name'], update['name'])
        self.assertNotEqual(record['records'], update['records'])

        # Test RBAC
        expected_allowed = ['os_admin', 'os_primary']
        if CONF.dns_feature_enabled.enforce_new_defaults:
            expected_allowed.extend(['os_project_member'])

        self.check_CUD_RBAC_enforcement(
            'RecordsetClient', 'update_recordset', expected_allowed, True,
            self.zone['id'], recordset_id, recordset_data)

        # Test RBAC with x-auth-all-projects and x-auth-sudo-project-id header
        expected_allowed = ['os_admin', 'os_primary']
        if CONF.dns_feature_enabled.enforce_new_defaults:
            expected_allowed.extend(['os_project_member'])

        self.check_CUD_RBAC_enforcement(
            'RecordsetClient', 'update_recordset', expected_allowed, False,
            self.zone['id'], recordset_id, recordset_data,
            headers=self.all_projects_header)
        self.check_CUD_RBAC_enforcement(
            'RecordsetClient', 'update_recordset', expected_allowed, False,
            self.zone['id'], recordset_id, recordset_data,
            headers={'x-auth-sudo-project-id': self.client.project_id})

    @decorators.idempotent_id('60904cc5-148b-4e3b-a0c6-35656dc8d44c')
    def test_update_recordset_one_field(self):
        recordset_data = dns_data_utils.rand_recordset_data(
            record_type='A', zone_name=self.zone['name'])

        LOG.info('Create a recordset')
        record = self.client.create_recordset(
            self.zone['id'], recordset_data)[1]
        self.addCleanup(
            self.wait_recordset_delete, self.client,
            self.zone['id'], record['id'])

        recordset_data = {
            'ttl': dns_data_utils.rand_ttl(start=record['ttl'] + 1)
        }

        LOG.info('Update the recordset')
        update = self.client.update_recordset(self.zone['id'],
            record['id'], recordset_data)[1]

        self.assertEqual(record['name'], update['name'])
        self.assertEqual(record['records'], update['records'])
        self.assertEqual(record['description'], update['description'])
        self.assertNotEqual(record['ttl'], update['ttl'])

    @decorators.idempotent_id('3f3575a0-a28b-11eb-ab42-74e5f9e2a801')
    def test_show_recordsets_impersonate_another_project(self):

        LOG.info('Create a Recordset')
        recordset_data = dns_data_utils.rand_recordset_data(
            record_type='A', zone_name=self.zone['name'])
        resp, body = self.client.create_recordset(
            self.zone['id'], recordset_data)
        self.addCleanup(
            self.wait_recordset_delete, self.client,
            self.zone['id'], body['id'])
        self.assertEqual(const.PENDING, body['status'],
                         'Failed, expected status is PENDING')
        LOG.info('Wait until the recordset is active')
        waiters.wait_for_recordset_status(
            self.client, self.zone['id'],
            body['id'], const.ACTIVE)

        LOG.info('Re-Fetch the Recordset as Alt tenant with '
                 '"x-auth-sudo-project-id" HTTP header included in request. '
                 'Expected: 403')
        self.assertRaises(
            lib_exc.Forbidden, lambda: self.alt_client.show_recordset(
                self.zone['id'], body['id'], headers={
                    'x-auth-sudo-project-id': body['project_id']}))

        LOG.info('Re-Fetch the Recordset as Admin tenant without '
                 '"x-auth-sudo-project-id" HTTP header. Expected: 404')
        self.assertRaises(lib_exc.NotFound,
                          lambda: self.admin_client.show_recordset(
                              self.zone['id'], body['id']))

        record = self.admin_client.show_recordset(
            self.zone['id'], body['id'],
            headers={'x-auth-sudo-project-id': body['project_id']})[1]

        LOG.info('Ensure the fetched response matches the expected one')
        self.assertExpected(body, record,
                            self.excluded_keys + ['action', 'status'])

    @decorators.idempotent_id('9f364a64-a2aa-11eb-aad4-74e5f9e2a801')
    def test_admin_list_all_recordsets_for_a_project(self):

        LOG.info('Create a Recordset as Primary tenant')
        recordset_data_primary_1 = dns_data_utils.rand_recordset_data(
            record_type='A', zone_name=self.zone['name'])
        body_pr_1 = self.client.create_recordset(
            self.zone['id'], recordset_data_primary_1)[1]
        self.addCleanup(
            self.wait_recordset_delete, self.client,
            self.zone['id'], body_pr_1['id'])
        self.assertEqual(const.PENDING, body_pr_1['status'],
                         'Failed, expected status is PENDING')
        recordset_data_primary_2 = dns_data_utils.rand_recordset_data(
            record_type='A', zone_name=self.zone['name'])
        body_pr_2 = self.client.create_recordset(
            self.zone['id'], recordset_data_primary_2)[1]
        self.addCleanup(
            self.wait_recordset_delete, self.client,
            self.zone['id'], body_pr_2['id'])
        self.assertEqual(const.PENDING, body_pr_2['status'],
                         'Failed, expected status is PENDING')

        LOG.info('Re-Fetch Recordsets as Alt tenant for a Primary project. '
                 'Expected: 404')
        self.assertRaises(lib_exc.NotFound,
            lambda: self.alt_client.list_recordset(
                self.zone['id']))

        LOG.info('Re-Fetch Recordsets as Alt tenant for a Primary project '
                 'using "x-auth-all-projects" HTTP header. Expected: 403')
        self.assertRaises(lib_exc.Forbidden,
            lambda: self.alt_client.list_recordset(
                self.zone['id'],
                headers=self.all_projects_header))

        LOG.info('Re-Fetch Recordsets as Admin tenant for a Primary project '
                 'using "x-auth-all-projects" HTTP header.')
        # Note: This is an all-projects list call, so other tests running
        #       in parallel will impact the list result set. Since the default
        #       pagination limit is only 20, we set a param limit of 1000 here.
        primary_recordsets_ids = [
            item['id'] for item in self.admin_client.list_recordset(
                self.zone['id'],
                headers=self.all_projects_header,
                params={'limit': 1000})[1]['recordsets']]

        for recordset_id in [body_pr_1['id'], body_pr_2['id']]:
            self.assertIn(
                recordset_id, primary_recordsets_ids,
                'Failed, recordset ID:{} was not found in listed '
                'recordsets: {}'.format(recordset_id, primary_recordsets_ids))

    @decorators.idempotent_id('48013b7c-f526-11eb-b04f-74e5f9e2a801')
    def test_create_A_recordset_multiply_ips(self):
        LOG.info('Create A type Recordset using a list of random IPs')
        recordset_data = dns_data_utils.rand_a_recordset(
            zone_name=self.zone['name'],
            ips=[dns_data_utils.rand_ip() for _ in range(10)])
        resp, body = self.client.create_recordset(
            self.zone['id'], recordset_data)
        self.addCleanup(
            self.wait_recordset_delete, self.client,
            self.zone['id'], body['id'])
        LOG.info('Ensure we respond with PENDING')
        self.assertEqual(const.PENDING, body['status'])
        LOG.info('Wait until the recordset is active')
        waiters.wait_for_recordset_status(
            self.client, self.zone['id'],
            body['id'], const.ACTIVE)

    @decorators.idempotent_id('f15e583e-e479-11eb-8e5a-74e5f9e2a801')
    def test_delete_zone_with_existing_recordset(self):

        LOG.info('Create a Zone')
        zone_name = dns_data_utils.rand_zone_name(name="TestZone",
                                              suffix=self.tld_name)
        zone = self.zones_client.create_zone(name=zone_name,
                                             wait_until=const.ACTIVE)[1]
        self.addCleanup(self.wait_zone_delete, self.zones_client, zone['id'])

        LOG.info('Create a Recordset')
        recordset_data = dns_data_utils.rand_recordset_data(
            record_type='A', zone_name=zone['name'])
        record = self.client.create_recordset(
            zone['id'], recordset_data, wait_until=const.ACTIVE)[1]

        LOG.info("Delete a Zone and wait till it's done")
        body = self.zones_client.delete_zone(zone['id'])[1]
        LOG.info('Ensure we respond with DELETE+PENDING')
        self.assertEqual(const.DELETE, body['action'])
        self.assertEqual(const.PENDING, body['status'])

        LOG.info('Ensure successful deletion of Zone')
        waiters.wait_for_zone_404(self.zones_client, zone['id'])

        LOG.info('Ensure successful deletion of Recordset')
        self.assertRaises(lib_exc.NotFound,
            lambda: self.client.show_recordset(zone['id'], record['id']))


class RecordsetsNegativeTest(BaseRecordsetsTest):

    credentials = ["admin", "primary", "alt"]

    @classmethod
    def setup_credentials(cls):
        # Do not create network resources for these test.
        cls.set_network_resources()
        super(RecordsetsNegativeTest, cls).setup_credentials()

    @classmethod
    def setup_clients(cls):
        super(RecordsetsNegativeTest, cls).setup_clients()
        cls.client = cls.os_primary.dns_v2.RecordsetClient()
        cls.alt_client = cls.os_alt.dns_v2.RecordsetClient()

    def _test_create_recordset_invalid(self, name, type, records):
        if name is not None:
            recordset_name = name + "." + self.zone['name']

        else:
            recordset_name = self.zone['name']

        recordset_data = {
            'name': recordset_name,
            'type': type,
            'records': records,
        }

        LOG.info('Attempt to create a invalid Recordset')
        self.assertRaises(lib_exc.BadRequest,
            lambda: self.client.create_recordset(
                self.zone['id'], recordset_data))

    @decorators.idempotent_id('98c94f8c-217a-4056-b996-b1f856d0753e')
    def test_create_recordset_invalid_CNAME_multiple(self):
        self._test_create_recordset_invalid(
            'www', 'CNAME', ["target1.example.org.", "target2.example.org."])

    @decorators.idempotent_id('43385ce8-0dd3-11ee-8b75-201e8823901f')
    def test_create_recordset_invalid_CNAME_at_Apex(self):
        self._test_create_recordset_invalid(
            None, 'CNAME', ["target1.example.org."])

    @decorators.idempotent_id('b6dad57e-5ce9-4fa5-8d66-aebbcd23b4ad')
    def test_get_nonexistent_recordset(self):
        LOG.info('Attempt to get an invalid Recordset')
        with self.assertRaisesDns(
                lib_exc.NotFound, 'recordset_not_found', 404):
            self.client.show_recordset(self.zone['id'],
                                       data_utils.rand_uuid())

    @decorators.idempotent_id('93d744a8-0dfd-4650-bcef-1e6ad632ad72')
    def test_get_nonexistent_recordset_invalid_id(self):
        LOG.info('Attempt to get an invalid Recordset')
        with self.assertRaisesDns(lib_exc.BadRequest, 'invalid_uuid', 400):
            self.client.show_recordset(self.zone['id'], 'invalid')

    @decorators.idempotent_id('da08f19a-7f10-47cc-8b41-994507190812')
    def test_update_nonexistent_recordset(self):
        recordset_data = dns_data_utils.rand_recordset_data(
            'A', self.zone['name'])

        LOG.info('Attempt to update an invalid Recordset')
        with self.assertRaisesDns(
                lib_exc.NotFound, 'recordset_not_found', 404):
            self.client.update_recordset(
                self.zone['id'], data_utils.rand_uuid(), recordset_data)

    @decorators.idempotent_id('158340a1-3f69-4aaa-9968-956190563768')
    def test_update_nonexistent_recordset_invalid_id(self):
        recordset_data = dns_data_utils.rand_recordset_data(
            'A', self.zone['name'])

        LOG.info('Attempt to update an invalid Recordset')
        with self.assertRaisesDns(lib_exc.BadRequest, 'invalid_uuid', 400):
            self.client.update_recordset(
                self.zone['id'], 'invalid', recordset_data)

    @decorators.idempotent_id('64bd94d4-54bd-4bee-b6fd-92ede063234e')
    def test_delete_nonexistent_recordset(self):
        LOG.info('Attempt to delete an invalid Recordset')
        with self.assertRaisesDns(
                lib_exc.NotFound, 'recordset_not_found', 404):
            self.client.delete_recordset(
                self.zone['id'], data_utils.rand_uuid())

    @decorators.idempotent_id('5948b599-a332-4dcb-840b-afc825075ba3')
    def test_delete_nonexistent_recordset_invalid_id(self):
        LOG.info('Attempt to get an invalid Recordset')
        with self.assertRaisesDns(lib_exc.BadRequest, 'invalid_uuid', 400):
            self.client.delete_recordset(self.zone['id'], 'invalid')

    @decorators.idempotent_id('64e01dc4-a2a8-11eb-aad4-74e5f9e2a801')
    def test_show_recordsets_invalid_ids(self):

        LOG.info('Create a Recordset')
        recordset_data = dns_data_utils.rand_recordset_data(
            record_type='A', zone_name=self.zone['name'])
        resp, body = self.client.create_recordset(
            self.zone['id'], recordset_data)
        self.addCleanup(
            self.wait_recordset_delete, self.client,
            self.zone['id'], body['id'])
        self.assertEqual(const.PENDING, body['status'],
                         'Failed, expected status is PENDING')
        LOG.info('Wait until the recordset is active')
        waiters.wait_for_recordset_status(
            self.client, self.zone['id'],
            body['id'], const.ACTIVE)

        LOG.info('Ensure 404 NotFound status code is received if '
                 'recordset ID is invalid.')
        self.assertRaises(
            lib_exc.NotFound, lambda: self.client.show_recordset(
                zone_uuid=self.zone['id'],
                recordset_uuid=data_utils.rand_uuid()))

        LOG.info('Ensure 404 NotFound status code is received if '
                 'zone ID is invalid.')
        self.assertRaises(
            lib_exc.NotFound, lambda: self.client.show_recordset(
                zone_uuid=data_utils.rand_uuid(),
                recordset_uuid=body['id']))

    @decorators.idempotent_id('c1d9f046-a2b1-11eb-aad4-74e5f9e2a801')
    def test_create_recordset_for_other_tenant(self):
        recordset_data = dns_data_utils.rand_recordset_data(
            record_type='A', zone_name=self.zone['name'])

        LOG.info('Create a Recordset as Alt tenant for a zone created by '
                 'Primary tenant. Expected: 404 NotFound')
        self.assertRaises(
            lib_exc.NotFound, lambda: self.alt_client.create_recordset(
                self.zone['id'], recordset_data))

    @decorators.idempotent_id('f236a24a-a3c6-4a0c-a54c-ebf8a312b908')
    def test_create_recordset_invalid_HTTPS_alpn(self):
        if not versionutils.is_compatible('2.2', self.api_version,
                                          same_major=False):
            raise self.skipException(
                'HTTPS record tests require Designate API version 2.2 or '
                'newer. Skipping test_create_recordset_invalid_HTTPS_alpn '
                'test.')

        self._test_create_recordset_invalid(
            None, 'HTTPS', ["1 sample.example.org. alpn=foo"])

    @decorators.idempotent_id('d680ef3a-4406-47c5-a994-483138c5e975')
    def test_create_recordset_invalid_HTTPS_port(self):
        if not versionutils.is_compatible('2.2', self.api_version,
                                          same_major=False):
            raise self.skipException(
                'HTTPS record tests require Designate API version 2.2 or '
                'newer. Skipping test_create_recordset_invalid_HTTPS_port '
                'test.')

        self._test_create_recordset_invalid(
            None, 'HTTPS', ["1 sample.example.org. port=foo"])

    @decorators.idempotent_id('a33fc327-8d37-4582-9d2b-be83f6ee38d3')
    def test_create_recordset_invalid_HTTPS_ech(self):
        if not versionutils.is_compatible('2.2', self.api_version,
                                          same_major=False):
            raise self.skipException(
                'HTTPS record tests require Designate API version 2.2 or '
                'newer. Skipping test_create_recordset_invalid_HTTPS_ech '
                'test.')

        self._test_create_recordset_invalid(
            None, 'HTTPS', ["1 sample.example.org. port=8888 ech=foo//"])

    @decorators.idempotent_id('1869737f-1a1b-4712-93da-2d680cd45cd8')
    def test_create_recordset_invalid_SVCB_mandatory(self):
        if not versionutils.is_compatible('2.2', self.api_version,
                                          same_major=False):
            raise self.skipException(
                'SVCB record tests require Designate API version 2.2 or '
                'newer. Skipping test_create_recordset_invalid_SVCB_mandatory '
                'test.')

        ipv6hint = "2001:db8:3333:4444:5555:6666:7777:8888"
        self._test_create_recordset_invalid(
            None, 'SVCB', [
                f"1 sample.example.org."
                f" ipv6hint={ipv6hint} mandatory=alpn,ipv4hint"
            ]
        )

    @decorators.idempotent_id('5bae6c22-7a37-48a5-b6b3-089d83a8f2ce')
    def test_create_recordset_invalid_SVCB_ipv4hint(self):
        if not versionutils.is_compatible('2.2', self.api_version,
                                          same_major=False):
            raise self.skipException(
                'SVCB record tests require Designate API version 2.2 or '
                'newer. Skipping test_create_recordset_invalid_SVCB_ipv4hint '
                'test.')

        self._test_create_recordset_invalid(
            None, 'SVCB',
            ['1 sample.example.org. ipv4hint=foo,192.168.1.2'])

    @decorators.idempotent_id('72dce8ca-f2fa-4054-b2b7-7bccfe3a02c1')
    def test_create_recordset_invalid_SVCB_ipv6hint(self):
        if not versionutils.is_compatible('2.2', self.api_version,
                                          same_major=False):
            raise self.skipException(
                'SVCB record tests require Designate API version 2.2 or '
                'newer. Skipping test_create_recordset_invalid_SVCB_ipv6hint'
                'test.')

        self._test_create_recordset_invalid(
            None, 'SVCB', ['1 sample.example.org. ipv6hint=foo']
        )


class RootRecordsetsTests(BaseRecordsetsTest):
    credentials = ["admin", "primary", "alt"]

    @classmethod
    def setup_credentials(cls):
        # Do not create network resources for these test.
        cls.set_network_resources()
        super(RootRecordsetsTests, cls).setup_credentials()

    @classmethod
    def setup_clients(cls):
        super(RootRecordsetsTests, cls).setup_clients()
        cls.client = cls.os_primary.dns_v2.RecordsetClient()

    @classmethod
    def skip_checks(cls):
        super(RootRecordsetsTests, cls).skip_checks()

        if not CONF.dns_feature_enabled.api_v2_root_recordsets:
            skip_msg = ("%s skipped as designate V2 recordsets API is not "
                        "available" % cls.__name__)
            raise cls.skipException(skip_msg)

    @decorators.idempotent_id('48a081b9-4474-4da0-9b1a-6359a80456ce')
    def test_list_zones_recordsets(self):
        LOG.info('List recordsets')
        body = self.client.list_zones_recordsets()[1]

        self.assertGreater(len(body['recordsets']), 0)

    @decorators.idempotent_id('65ec0495-81d9-4cfb-8007-9d93b32ae883')
    def test_get_single_zones_recordsets(self):
        recordset_data = dns_data_utils.rand_recordset_data(
            record_type='A', zone_name=self.zone['name'], records=['10.1.0.2'])

        LOG.info('Create a Recordset')
        resp, zone_recordset = self.client.create_recordset(
            self.zone['id'], recordset_data)
        self.addCleanup(
            self.wait_recordset_delete, self.client,
            self.zone['id'], zone_recordset['id'])

        self.client.show_zones_recordset(zone_recordset['id'])

    @decorators.idempotent_id('a8e41020-65be-453b-a8c1-2497d539c345')
    def test_list_filter_zones_recordsets(self):
        recordset_data = dns_data_utils.rand_recordset_data(
            record_type='A', zone_name=self.zone['name'], records=['10.0.1.2'])

        LOG.info('Create a Recordset')
        resp, zone_recordset = self.client.create_recordset(
            self.zone['id'], recordset_data)
        self.addCleanup(
            self.wait_recordset_delete, self.client,
            self.zone['id'], zone_recordset['id'])

        LOG.info('Create another zone')
        zone_name = dns_data_utils.rand_zone_name(name="list-filter",
                                              suffix=self.tld_name)
        zone2 = self.zones_client.create_zone(name=zone_name)[1]
        self.addCleanup(self.wait_zone_delete, self.zones_client, zone2['id'])

        LOG.info('Create another Recordset')
        recordset_data = dns_data_utils.rand_recordset_data(
            record_type='A', zone_name=zone2['name'],
            records=['10.0.1.3'])
        resp, zone_recordset2 = self.client.create_recordset(
            zone2['id'], recordset_data)
        self.addCleanup(
            self.wait_recordset_delete, self.client,
            self.zone['id'], zone_recordset2['id'])

        LOG.info('List recordsets')
        body = self.client.list_zones_recordsets(params={"data": "10.0.*"})[1]

        recordsets = body['recordsets']

        ids = [r['id'] for r in recordsets]
        self.assertIn(zone_recordset['id'], ids)
        self.assertIn(zone_recordset2['id'], ids)
        # Ensure that every rrset has a record with the filtered data
        for r in recordsets:
            one_record_has_data = False
            for record in r['records']:
                if record.startswith('10.0.'):
                    one_record_has_data = True
            self.assertTrue(one_record_has_data)

    @decorators.idempotent_id('7f4970bf-9aeb-4a3c-9afd-02f5a7178d35')
    def test_list_zones_recordsets_zone_names(self):
        LOG.info('List recordsets')
        zone_name = dns_data_utils.rand_zone_name(name="zone_names",
                                              suffix=self.tld_name)
        alt_zone = self.zones_client.create_zone(
            name=zone_name, wait_until=const.ACTIVE)[1]
        self.addCleanup(self.wait_zone_delete,
                        self.zones_client,
                        alt_zone['id'])

        body = self.client.list_zones_recordsets()[1]

        recordsets = body['recordsets']
        zone_names = set()
        for r in recordsets:
            zone_names.add(r['zone_name'])

        self.assertGreaterEqual(len(zone_names), 2)


class RecordsetOwnershipTest(BaseRecordsetsTest):

    credentials = ["primary", "alt", "admin"]

    @classmethod
    def setup_credentials(cls):
        # Do not create network resources for these test.
        cls.set_network_resources()
        super(RecordsetOwnershipTest, cls).setup_credentials()

    @classmethod
    def setup_clients(cls):
        super(RecordsetOwnershipTest, cls).setup_clients()
        cls.admin_client = cls.os_admin.dns_v2.RecordsetClient()
        cls.client = cls.os_primary.dns_v2.RecordsetClient()
        cls.alt_client = cls.os_alt.dns_v2.RecordsetClient()
        cls.alt_zone_client = cls.os_alt.dns_v2.ZonesClient()

    def _create_client_recordset(self, clients_list):
        """Create a zone and asoociated recordset using given credentials
        :param clients_list: supported credentials are: 'primary' and 'alt'.
        :return: dictionary of created recordsets.
        """
        recordsets_created = {}
        for client in clients_list:
            if client == 'primary':
                # Create a zone and wait till it's ACTIVE
                zone_name = dns_data_utils.rand_zone_name(name="primary",
                                                      suffix=self.tld_name)
                zone = self.zones_client.create_zone(name=zone_name)[1]
                self.addCleanup(self.wait_zone_delete,
                                self.zones_client,
                                zone['id'])
                waiters.wait_for_zone_status(
                    self.zones_client, zone['id'], const.ACTIVE)

                # Create a recordset and wait till it's ACTIVE
                recordset_data = dns_data_utils.rand_recordset_data(
                    record_type='A', zone_name=zone['name'])
                resp, body = self.client.create_recordset(
                    zone['id'], recordset_data)

                self.addCleanup(
                    self.wait_recordset_delete, self.client,
                    self.zone['id'], body['id'])
                self.assertEqual(const.PENDING, body['status'],
                                 'Failed, expected status is PENDING')

                LOG.info('Wait until the recordset is active')
                waiters.wait_for_recordset_status(
                    self.client, zone['id'],
                    body['id'], const.ACTIVE)

                # Add "project_id" into the recordset_data
                recordset_data['project_id'] = zone['project_id']
                recordsets_created['primary'] = recordset_data

            if client == 'alt':
                # Create a zone and wait till it's ACTIVE
                zone_name = dns_data_utils.rand_zone_name(name="alt",
                                                      suffix=self.tld_name)
                alt_zone = self.alt_zone_client.create_zone(name=zone_name)[1]
                self.addCleanup(self.wait_zone_delete,
                                self.alt_zone_client,
                                alt_zone['id'])
                waiters.wait_for_zone_status(
                    self.alt_zone_client, alt_zone['id'], const.ACTIVE)

                # Create a recordset and wait till it's ACTIVE
                recordset_data = dns_data_utils.rand_recordset_data(
                    record_type='A', zone_name=alt_zone['name'])
                resp, body = self.alt_client.create_recordset(
                    alt_zone['id'], recordset_data)

                self.addCleanup(
                    self.wait_recordset_delete, self.client,
                    self.zone['id'], body['id'])
                self.assertEqual(const.PENDING, body['status'],
                                 'Failed, expected status is PENDING')

                LOG.info('Wait until the recordset is active')
                waiters.wait_for_recordset_status(
                    self.alt_client, alt_zone['id'],
                    body['id'], const.ACTIVE)

                # Add "project_id" into the recordset_data
                recordset_data['project_id'] = alt_zone['project_id']
                recordsets_created['alt'] = recordset_data

        LOG.info('Created resordsets are {}:'.format(recordsets_created))
        return recordsets_created

    @decorators.idempotent_id('9c0f58ad-1b31-4899-b184-5380720604e5')
    def test_no_create_recordset_by_alt_tenant(self):
        # try with name=A123456.zone.com.
        recordset_data = dns_data_utils.rand_recordset_data(
            record_type='A', zone_name=self.zone['name'])
        resp, rrset = self.client.create_recordset(
            self.zone['id'], recordset_data)
        self.addCleanup(
            self.wait_recordset_delete, self.client,
            self.zone['id'], rrset['id'])
        self.assertRaises(
            lib_exc.RestClientException,
            lambda: self.alt_client.create_recordset(
                self.zone['id'], recordset_data)
        )

    @decorators.idempotent_id('d4a9aad9-c778-429b-9a0c-4cd2b61a0a01')
    def test_no_create_super_recordsets(self):
        zone_name = dns_data_utils.rand_zone_name(suffix=self.tld_name)

        LOG.info('Create a zone as a default user')
        zone = self.zones_client.create_zone(name='a.b.' + zone_name)[1]
        self.addCleanup(self.wait_zone_delete, self.zones_client, zone['id'])

        rrset_data = dns_data_utils.rand_recordset_data(
            record_type='A', zone_name=zone_name)

        LOG.info('Create a zone as an alt user with existing superdomain')
        self.assertRaises(
            lib_exc.NotFound,
            self.alt_client.create_recordset,
            self.zone['id'], rrset_data)

    @decorators.idempotent_id('3dbe244d-fa85-4afc-869b-0306388d8746')
    def test_no_create_recordset_via_alt_domain(self):
        zone_name = dns_data_utils.rand_zone_name(name="alt-domain",
                                              suffix=self.tld_name)
        alt_zone = self.alt_zone_client.create_zone(name=zone_name)[1]
        self.addCleanup(self.wait_zone_delete,
                        self.alt_zone_client,
                        alt_zone['id'])

        # alt attempts to create record with name A12345.{zone}
        recordset_data = dns_data_utils.rand_recordset_data(
            record_type='A', zone_name=self.zone['name'])

        self.assertRaises(
            lib_exc.RestClientException,
            lambda: self.alt_client.create_recordset(
                self.zone['id'],
                recordset_data
            )
        )
        self.assertRaises(
            lib_exc.RestClientException,
            lambda: self.alt_client.create_recordset(
                alt_zone['id'],
                recordset_data
            )
        )

    @decorators.idempotent_id('4d0ff972-7c19-11eb-b331-74e5f9e2a801')
    def test_list_all_recordsets_for_project(self):
        # Create recordsets using "primary" and "alt" credentials.
        # Execute "list_owned_recordsets" API to list "primary" recordsets.
        # Validate that the only "project_id" retrieved within the API is
        # a "primary" project.
        primary_project_id = self._create_client_recordset(
            ['primary', 'alt'])['primary']['project_id']
        recordsets = self.client.list_owned_recordsets()
        LOG.info('Received by API recordsets are {} '.format(recordsets))
        project_ids_api = set([item['project_id'] for item in recordsets])
        self.assertEqual(
            {primary_project_id}, project_ids_api,
            'Failed, unique project_ids {} are not as expected {}'.format(
                project_ids_api, primary_project_id))

    @decorators.idempotent_id('bc0af248-7b4f-11eb-98a5-74e5f9e2a801')
    def test_list_all_projects_recordsets(self):
        # Create recordsets using "primary" and "alt" credentials.
        # Execute "list_owned_recordsets" API using admin client to list
        # recordsets for all projects.
        # Validate that project_ids of: "primary" and "alt" projects
        # are both listed in received API response.
        project_ids_used = [
            item['project_id'] for item in self._create_client_recordset(
                ['primary', 'alt']).values()]
        # Note: This is an all-projects list call, so other tests running
        #       in parallel will impact the list result set. Since the default
        #       pagination limit is only 20, we set a param limit of 1000 here.
        recordsets = self.admin_client.list_owned_recordsets(
            headers=self.all_projects_header, params={'limit': 1000})
        LOG.info('Received by API recordsets are {} '.format(recordsets))
        project_ids_api = set([item['project_id'] for item in recordsets])
        for prj_id in project_ids_used:
            self.assertIn(
                prj_id, project_ids_api,
                'Failed, project_id:{} is missing in received recordsets'
                ' for all projects {} '.format(prj_id, project_ids_api))

    @decorators.idempotent_id('910eb17e-7c3a-11eb-a40b-74e5f9e2a801')
    def test_list_recordsets_impersonate_project(self):
        # Create recordsets using "primary" and "alt" credentials.
        # Use admin client to impersonate "primary" project.
        # Validate that received recordsets are all associated with
        # expected("primary") project only.
        primary_project_id = self._create_client_recordset(
            ['primary', 'alt'])['primary']['project_id']
        recordsets = self.admin_client.list_owned_recordsets(
            headers={'x-auth-sudo-project-id': primary_project_id})
        LOG.info('Received by API recordsets are {} '.format(recordsets))
        project_ids_api = set([item['project_id'] for item in recordsets])
        self.assertEqual(
            {primary_project_id}, project_ids_api,
            'Failed, unique project_ids {} are not as expected {}'.format(
                project_ids_api, primary_project_id))


class AdminManagedRecordsetTest(BaseRecordsetsTest):

    credentials = ["primary", "admin"]

    @classmethod
    def setup_credentials(cls):
        # Do not create network resources for these test.
        cls.set_network_resources()
        super(AdminManagedRecordsetTest, cls).setup_credentials()

    @classmethod
    def setup_clients(cls):
        super(AdminManagedRecordsetTest, cls).setup_clients()
        cls.admin_client = cls.os_admin.dns_v2.RecordsetClient()
        cls.client = cls.os_primary.dns_v2.RecordsetClient()

    @decorators.idempotent_id('84164ff4-8e68-11ec-983f-201e8823901f')
    def test_admin_updates_soa_and_ns_recordsets(self):
        # HTTP headers to be used in the test
        sudo_header = {'X-Auth-All-Projects': True}
        managed_records_header = {'X-Designate-Edit-Managed-Records': True}
        sudo_managed_headers = sudo_header.copy()
        sudo_managed_headers.update(managed_records_header)

        LOG.info('Primary user creates a Zone')
        zone_name = dns_data_utils.rand_zone_name(name="update_soa_ns",
                                              suffix=self.tld_name)
        zone = self.zones_client.create_zone(
            name=zone_name,
            description='Zone for "managed recordsets update" test',
            wait_until=const.ACTIVE)[1]
        self.addCleanup(self.wait_zone_delete, self.zones_client, zone['id'])
        recordsets = self.admin_client.list_recordset(
            zone['id'], headers=sudo_header)[1]['recordsets']

        LOG.info('As Admin try to update SOA and NS recordsets,'
                 ' Expected not allowed')
        for recordset in recordsets:
            if recordset['type'] == 'NS':
                self.assertRaisesDns(
                    lib_exc.BadRequest, 'bad_request', 400,
                    self.admin_client.update_recordset,
                    zone['id'], recordset['id'],
                    recordset_data=dns_data_utils.rand_ns_records(),
                    headers=sudo_managed_headers, extra_headers=True)

            if recordset['type'] == 'SOA':
                self.assertRaisesDns(
                    lib_exc.BadRequest, 'bad_request', 400,
                    self.admin_client.update_recordset,
                    zone['id'], recordset['id'],
                    recordset_data=dns_data_utils.rand_soa_recordset(
                        zone['name']),
                    headers=sudo_managed_headers, extra_headers=True)


class RecordsetsManagedRecordsNegativeTest(BaseRecordsetsTest):

    credentials = ["admin", "primary"]

    @classmethod
    def setup_clients(cls):
        super(RecordsetsManagedRecordsNegativeTest, cls).setup_clients()
        cls.admin_client = cls.os_admin.dns_v2.RecordsetClient()
        cls.admin_tld_client = cls.os_admin.dns_v2.TldClient()
        cls.recordset_client = cls.os_primary.dns_v2.RecordsetClient()

    @decorators.idempotent_id('083fa738-bb1b-11ec-b581-201e8823901f')
    def test_delete_ns_record_not_permitted(self):
        LOG.info('Get NS type recordset ID')
        recordsets = self.recordset_client.list_recordset(
            self.zone['id'])[1]['recordsets']
        for recordset in recordsets:
            if recordset['type'] == 'NS':
                ns_record_id = recordset['id']
                break

        LOG.info('Primary user tries to delete NS Recordset')
        self.assertRaises(
            lib_exc.Forbidden,
            self.recordset_client.delete_recordset,
            self.zone['id'], ns_record_id, headers=self.managed_records)

    @decorators.idempotent_id('1e78a742-66ee-11ec-8dc3-201e8823901f')
    def test_create_soa_record_not_permitted(self):
        soa_record = ("s1.devstack.org. admin.example.net. 1510721487 3510"
                      " 600 86400 3600")
        LOG.info('Primary tries to create a Recordset on '
                 'the existing zone')
        self.assertRaises(
            lib_exc.BadRequest,
            self.recordset_client.create_recordset,
            self.zone['id'], soa_record)
        LOG.info('Admin tries to create a Recordset on the existing zone')
        self.assertRaises(
            lib_exc.BadRequest,
            self.admin_client.create_recordset,
            self.zone['id'], soa_record)
