def test_generate_temp_url_bad_seconds(self):
        with self.assertRaises(ValueError) as exc_manager:
            u.generate_temp_url(self.url, 'not_an_int', self.key, self.method)
        self.assertEqual(exc_manager.exception.args[0],
                         'seconds must be a whole number')

        with self.assertRaises(ValueError) as exc_manager:
            u.generate_temp_url(self.url, -1, self.key, self.method)
        self.assertEqual(exc_manager.exception.args[0],
                         'seconds must be a whole number')

        with self.assertRaises(ValueError) as exc_manager:
            u.generate_temp_url(self.url, 1.1, self.key, self.method)
        self.assertEqual(exc_manager.exception.args[0],
                         'seconds must be a whole number')

        with self.assertRaises(ValueError) as exc_manager:
            u.generate_temp_url(self.url, '-1', self.key, self.method)
        self.assertEqual(exc_manager.exception.args[0],
                         'seconds must be a whole number')

        with self.assertRaises(ValueError) as exc_manager:
            u.generate_temp_url(self.url, '1.1', self.key, self.method)
        self.assertEqual(exc_manager.exception.args[0],
                         'seconds must be a whole number')

    def test_generate_temp_url_bad_path(self):
        with self.assertRaises(ValueError) as exc_manager:
            u.generate_temp_url('/v1/a/c', 60, self.key, self.method)
        self.assertEqual(exc_manager.exception.args[0],
                         'path must be full path to an object e.g. /v1/a/c/o')

        with self.assertRaises(ValueError) as exc_manager:
            u.generate_temp_url('v1/a/c/o', 60, self.key, self.method)
        self.assertEqual(exc_manager.exception.args[0],
                         'path must be full path to an object e.g. /v1/a/c/o')

        with self.assertRaises(ValueError) as exc_manager:
            u.generate_temp_url('blah/v1/a/c/o', 60, self.key, self.method)
        self.assertEqual(exc_manager.exception.args[0],
                         'path must be full path to an object e.g. /v1/a/c/o')

        with self.assertRaises(ValueError) as exc_manager:
            u.generate_temp_url('/v1//c/o', 60, self.key, self.method)
        self.assertEqual(exc_manager.exception.args[0],
                         'path must be full path to an object e.g. /v1/a/c/o')

        with self.assertRaises(ValueError) as exc_manager:
            u.generate_temp_url('/v1/a/c/', 60, self.key, self.method)
        self.assertEqual(exc_manager.exception.args[0],
                         'path must be full path to an object e.g. /v1/a/c/o')

    def test_generate_temp_url_prefix(self, time_mock, hmac_mock):
        hmac_mock().hexdigest.return_value = 'temp_url_signature'
        prefixes = ['', 'o', 'p0/p1/']
        for p in prefixes:
            hmac_mock.reset_mock()
            path = '/v1/AUTH_account/c/' + p
            expected_url = path + ('?temp_url_sig=temp_url_signature'
                                   '&temp_url_expires=1400003600'
                                   '&temp_url_prefix=' + p)
            expected_body = '\n'.join([
                self.method,
                '1400003600',
                'prefix:' + path,
            ]).encode('utf-8')
            url = u.generate_temp_url(path, self.seconds,
                                      self.key, self.method, prefix=True)
            key = self.key
            if not isinstance(key, six.binary_type):
                key = key.encode('utf-8')
            self.assertEqual(url, expected_url)
            self.assertEqual(hmac_mock.mock_calls, [
                mock.call(key, expected_body, sha1),
                mock.call().hexdigest(),
            ])

            self.assertIsInstance(url, type(path))

 def test_generate_absolute_expiry_temp_url(self, hmac_mock):
     expected_url = ('/v1/AUTH_account/c/o?'
                     'temp_url_sig=temp_url_signature&'
                     'temp_url_expires=2146636800')
     url = u.generate_temp_url(self.url, 2146636800, self.key, self.method,
                               absolute=True)
     self.assertEqual(url, expected_url)

        def generate_presigned_url(self, key):
            """
            Generates temporary public URL from given full key
            to swift object

            :param key: Full path to the object.
            :return: Full URL to the object for unauthenticated used to
                     being able to download object.
            """
            full_path = "/v1/{}/{}/{}".format(
                    self.account,
                    self.config.bucket,
                    key
                    )
            url = generate_temp_url(
                        full_path,
                        self.config.expires,
                        self.temporary_url_key,
                        'GET'
                    ).split(self.config.bucket)[1]
            if not self.config.swift_url_prefix.endswith('/'):
                if url.startswith('/'):
                    return "{}{}".format(self.config.swift_url_prefix, url)
                else:
                    return "{}/{}".format(self.config.swift_url_prefix, url)
            return self.config.swift_url_prefix[:-1] + url

    def get_temp_url(self, container_name, obj_name, timeout=None,
                     method='PUT'):
        '''
        Return a Swift TempURL.
        '''
        def tenant_uuid():
            access = self.context.auth_token_info['access']
            for role in access['user']['roles']:
                if role['name'] == 'object-store:default':
                    return role['tenantId']

        key_header = 'x-account-meta-temp-url-key'
        if key_header in self.client().head_account():
            key = self.client().head_account()[key_header]
        else:
            key = hashlib.sha224(str(random.getrandbits(256))).hexdigest()[:32]
            self.client().post_account({key_header: key})

        path = '/v1/%s/%s/%s' % (tenant_uuid(), container_name, obj_name)
        if timeout is None:
            timeout = swift.MAX_EPOCH - 60 - time.time()
        tempurl = swiftclient_utils.generate_temp_url(path, timeout, key,
                                                      method)
        sw_url = parse.urlparse(self.client().url)
        return '%s://%s%s' % (sw_url.scheme, sw_url.netloc, tempurl)

    def get_temp_url(self, container, object, timeout):
        """Returns the temp url for the given Swift object.

        :param container: The name of the container in which Swift object
            is placed.
        :param object: The name of the Swift object.
        :param timeout: The timeout in seconds after which the generated url
            should expire.
        :returns: The temp url for the object.
        :raises: SwiftOperationError, if any operation with Swift fails.
        """
        try:
            account_info = self.connection.head_account()
        except swift_exceptions.ClientException as e:
            operation = _("head account")
            raise exception.SwiftOperationError(operation=operation,
                                                error=e)

        storage_url, token = self.connection.get_auth()
        parse_result = parse.urlparse(storage_url)
        swift_object_path = '/'.join((parse_result.path, container, object))
        temp_url_key = account_info['x-account-meta-temp-url-key']
        url_path = swift_utils.generate_temp_url(swift_object_path, timeout,
                                                 temp_url_key, 'GET')
        return parse.urlunparse((parse_result.scheme,
                                 parse_result.netloc,
                                 url_path,
                                 None,
                                 None,
                                 None))

    def publish_template(self, name, contents):
        oc = self.object_client

        # post the object
        oc.put_object(self.object_container_name, name, contents)
        # TODO(asalkeld) see if this is causing problems.
        # self.addCleanup(self.object_client.delete_object,
        #                self.object_container_name, name)

        # make the tempurl
        key_header = 'x-account-meta-temp-url-key'
        if key_header not in oc.head_account():
            swift_key = hashlib.sha224(
                str(random.getrandbits(256))).hexdigest()[:32]
            LOG.warn('setting swift key to %s' % swift_key)
            oc.post_account({key_header: swift_key})
        key = oc.head_account()[key_header]
        path = '/v1/AUTH_%s/%s/%s' % (self.project_id,
                                      self.object_container_name, name)
        timeout = self.conf.build_timeout * 10
        tempurl = swiftclient_utils.generate_temp_url(path, timeout,
                                                      key, 'GET')
        sw_url = parse.urlparse(oc.url)
        full_url = '%s://%s%s' % (sw_url.scheme, sw_url.netloc, tempurl)

        def download():
            r = requests.get(full_url)
            LOG.info('GET: %s -> %s' % (full_url, r.status_code))
            return r.status_code == requests.codes.ok

        # make sure that the object is available.
        test.call_until_true(self.conf.build_timeout,
                             self.conf.build_interval, download)

        return full_url

 def test_generate_temp_url(self, time_mock, hmac_mock):
     expected_url = (
         '/v1/AUTH_account/c/o?'
         'temp_url_sig=temp_url_signature&'
         'temp_url_expires=1400003600')
     url = u.generate_temp_url(self.url, self.seconds, self.key,
                               self.method)
     self.assertEqual(url, expected_url)

 def test_generate_absolute_expiry_temp_url(self, hmac_mock):
     if isinstance(self.expected_url, six.binary_type):
         expected_url = self.expected_url.replace(
             b'1400003600', b'2146636800')
     else:
         expected_url = self.expected_url.replace(
             u'1400003600', u'2146636800')
     url = u.generate_temp_url(self.url, 2146636800, self.key, self.method,
                               absolute=True)
     self.assertEqual(url, expected_url)

 def test_generate_temp_url(self, time_mock, hmac_mock):
     hmac_mock().hexdigest.return_value = 'temp_url_signature'
     url = u.generate_temp_url(self.url, self.seconds,
                               self.key, self.method)
     key = self.key
     if not isinstance(key, six.binary_type):
         key = key.encode('utf-8')
     self.assertEqual(url, self.expected_url)
     self.assertEqual(hmac_mock.mock_calls, [
         mock.call(),
         mock.call(key, self.expected_body, sha1),
         mock.call().hexdigest(),
     ])
     self.assertIsInstance(url, type(self.url))

    def swift_temp_url(self, image_info):
        """Generate a no-auth Swift temporary URL.

        This function will generate the temporary Swift URL using the image
        id from Glance and the config options: 'swift_endpoint_url',
        'swift_api_version', 'swift_account' and 'swift_container'.
        The temporary URL will be valid for 'swift_temp_url_duration' seconds.
        This allows Ironic to download a Glance image without passing around
        an auth_token.

        :param image_info: The return from a GET request to Glance for a
            certain image_id. Should be a dictionary, with keys like 'name' and
            'checksum'. See
            http://docs.openstack.org/developer/glance/glanceapi.html for
            examples.
        :returns: A signed Swift URL from which an image can be downloaded,
            without authentication.

        :raises: InvalidParameterValue if Swift config options are not set
            correctly.
        :raises: MissingParameterValue if a required parameter is not set.
        :raises: ImageUnacceptable if the image info from Glance does not
            have a image ID.
        """
        self._validate_temp_url_config()

        if ('id' not in image_info or not
                utils.is_uuid_like(image_info['id'])):
            raise exc.ImageUnacceptable(_(
                'The given image info does not have a valid image id: %s')
                % image_info)

        url_fragments = {
            'endpoint_url': CONF.glance.swift_endpoint_url,
            'api_version': CONF.glance.swift_api_version,
            'account': CONF.glance.swift_account,
            'container': self._get_swift_container(image_info['id']),
            'object_id': image_info['id']
        }

        template = '/{api_version}/{account}/{container}/{object_id}'
        url_path = template.format(**url_fragments)
        path = swift_utils.generate_temp_url(
            path=url_path,
            seconds=CONF.glance.swift_temp_url_duration,
            key=CONF.glance.swift_temp_url_key,
            method='GET')

        return '{endpoint_url}{url_path}'.format(
            endpoint_url=url_fragments['endpoint_url'], url_path=path)

    def _path(self, name):
        try:
            name = name.encode('utf-8')
        except UnicodeDecodeError:
            pass
        url = urlparse.urljoin(self.base_url, urlparse.quote(name))

        # Are we building a temporary url?
        if self.use_temp_urls:
            expires = int(time() + int(self.temp_url_duration))
            path = urlparse.unquote(urlparse.urlsplit(url).path)
            tmp_path = generate_temp_url(path, expires, self.temp_url_key, 'GET', absolute=True)
            url = urlparse.urljoin(self.base_url, tmp_path)

        return url

    def test_generate_temp_url_iso8601_argument(self, hmac_mock):
        hmac_mock().hexdigest.return_value = 'temp_url_signature'
        url = u.generate_temp_url(self.url, '2014-05-13T17:53:20Z',
                                  self.key, self.method)
        self.assertEqual(url, self.expected_url)

        # Don't care about absolute arg.
        url = u.generate_temp_url(self.url, '2014-05-13T17:53:20Z',
                                  self.key, self.method, absolute=True)
        self.assertEqual(url, self.expected_url)

        lt = localtime()
        expires = strftime(u.EXPIRES_ISO8601_FORMAT[:-1], lt)

        if not isinstance(self.expected_url, six.string_types):
            expected_url = self.expected_url.replace(
                b'1400003600', bytes(str(int(mktime(lt))), encoding='ascii'))
        else:
            expected_url = self.expected_url.replace(
                '1400003600', str(int(mktime(lt))))
        url = u.generate_temp_url(self.url, expires,
                                  self.key, self.method)
        self.assertEqual(url, expected_url)

        expires = strftime(u.SHORT_EXPIRES_ISO8601_FORMAT, lt)
        lt = strptime(expires, u.SHORT_EXPIRES_ISO8601_FORMAT)

        if not isinstance(self.expected_url, six.string_types):
            expected_url = self.expected_url.replace(
                b'1400003600', bytes(str(int(mktime(lt))), encoding='ascii'))
        else:
            expected_url = self.expected_url.replace(
                '1400003600', str(int(mktime(lt))))
        url = u.generate_temp_url(self.url, expires,
                                  self.key, self.method)
        self.assertEqual(url, expected_url)

    def publish_template(self, contents, cleanup=True):
        oc = self.object_client

        # post the object
        oc.put_object(self.object_container_name, 'template.yaml', contents)
        if cleanup:
            self.addCleanup(oc.delete_object,
                            self.object_container_name,
                            'template.yaml')
        path = '/v1/AUTH_%s/%s/%s' % (self.project_id,
                                      self.object_container_name,
                                      'template.yaml')
        timeout = self.conf.build_timeout * 10
        tempurl = swiftclient_utils.generate_temp_url(path, timeout,
                                                      self.swift_key, 'GET')
        sw_url = parse.urlparse(oc.url)
        return '%s://%s%s' % (sw_url.scheme, sw_url.netloc, tempurl)

    def run(self, context):
        swift_client = self.get_object_client(context)

        try:
            cont_stat = swift_client.head_container(self.container)
        except swiftexceptions.ClientException:
            cont_stat = {}

        key = cont_stat.get('x-container-meta-temp-url-key')
        if not key:
            key = str(uuid.uuid4())
            cont_stat = swift_client.put_container(
                self.container, {'X-Container-Meta-Temp-Url-Key': key})
        parsed = urllib.parse.urlparse(swift_client.url)
        path = "%s/%s/%s" % (parsed.path, self.container, self.obj)
        temp_path = generate_temp_url(path, self.valid, key, self.method)
        return "%s://%s%s" % (parsed.scheme, parsed.netloc, temp_path)

    def get_temp_download_url(self, fname, expires):
        """ return the temporary download url """
        file_uri = '%s/%s/%s' % (self.storageurl, self.container_name, fname)
        file_path = urlparse(file_uri).path
        key = getattr(self, self.chosen_temp_url_key)
        try:
            temp_url = generate_temp_url(file_path, expires, key, 'GET')
        except Exception as err:
            logging.error(
                'swift-file-server: Generating temp url for %s failed %s', fname, err)
            raise

        download_url = self.storageurl.replace(
            urlparse(self.storageurl).path, temp_url)
        print(
            'swift-file-server: Temporary download URL for file %s: %s', fname, download_url)
        return download_url

    def test_generate_temp_url_ip_range(self, time_mock, hmac_mock):
        hmac_mock().hexdigest.return_value = 'temp_url_signature'
        ip_ranges = [
            '1.2.3.4', '1.2.3.4/24', '2001:db8::',
            b'1.2.3.4', b'1.2.3.4/24', b'2001:db8::',
        ]
        path = '/v1/AUTH_account/c/o/'
        expected_url = path + ('?temp_url_sig=temp_url_signature'
                               '&temp_url_expires=1400003600'
                               '&temp_url_ip_range=')
        for ip_range in ip_ranges:
            hmac_mock.reset_mock()
            url = u.generate_temp_url(path, self.seconds,
                                      self.key, self.method,
                                      ip_range=ip_range)
            key = self.key
            if not isinstance(key, six.binary_type):
                key = key.encode('utf-8')

            if isinstance(ip_range, six.binary_type):
                ip_range_expected_url = (
                    expected_url + ip_range.decode('utf-8')
                )
                expected_body = '\n'.join([
                    'ip=' + ip_range.decode('utf-8'),
                    self.method,
                    '1400003600',
                    path,
                ]).encode('utf-8')
            else:
                ip_range_expected_url = expected_url + ip_range
                expected_body = '\n'.join([
                    'ip=' + ip_range,
                    self.method,
                    '1400003600',
                    path,
                ]).encode('utf-8')

            self.assertEqual(url, ip_range_expected_url)

            self.assertEqual(hmac_mock.mock_calls, [
                mock.call(key, expected_body, sha1),
                mock.call().hexdigest(),
            ])
            self.assertIsInstance(url, type(path))

    def test_generate_temp_url_iso8601_output(self, time_mock, hmac_mock):
        hmac_mock().hexdigest.return_value = 'temp_url_signature'
        url = u.generate_temp_url(self.url, self.seconds,
                                  self.key, self.method,
                                  iso8601=True)
        key = self.key
        if not isinstance(key, six.binary_type):
            key = key.encode('utf-8')

        expires = strftime(u.EXPIRES_ISO8601_FORMAT, gmtime(1400003600))
        if not isinstance(self.url, six.string_types):
            self.assertTrue(url.endswith(bytes(expires, 'utf-8')))
        else:
            self.assertTrue(url.endswith(expires))
        self.assertEqual(hmac_mock.mock_calls, [
            mock.call(),
            mock.call(key, self.expected_body, sha1),
            mock.call().hexdigest(),
        ])
        self.assertIsInstance(url, type(self.url))

    def get_temp_url(self, container_name, obj_name, timeout=None,
                     method='PUT'):
        '''
        Return a Swift TempURL.
        '''
        key_header = 'x-account-meta-temp-url-key'
        if key_header in self.client().head_account():
            key = self.client().head_account()[key_header]
        else:
            key = hashlib.sha224(str(random.getrandbits(256))).hexdigest()[:32]
            self.client().post_account({key_header: key})

        path = '/v1/AUTH_%s/%s/%s' % (self.context.tenant_id, container_name,
                                      obj_name)
        if timeout is None:
            timeout = MAX_EPOCH - 60 - time.time()
        tempurl = swiftclient_utils.generate_temp_url(path, timeout, key,
                                                      method)
        sw_url = urlparse.urlparse(self.client().url)
        return '%s://%s%s' % (sw_url.scheme, sw_url.netloc, tempurl)