def get_bgp_peers(self, context, fields=None, filters=None, sorts=None,
                   limit=None, marker=None, page_reverse=False):
     policy.check_is_admin(context)
     return super(BgpPlugin, self).get_bgp_peers(
                                              context, fields=fields,
                                              filters=filters, sorts=sorts,
                                              limit=limit, marker=marker,
                                              page_reverse=page_reverse)

 def delete_bgp_speaker(self, context, bgp_speaker_id):
     policy.check_is_admin(context)
     hosted_bgp_dragents = self.get_dragents_hosting_bgp_speakers(
                                                          context,
                                                          [bgp_speaker_id])
     super(BgpPlugin, self).delete_bgp_speaker(context, bgp_speaker_id)
     for agent in hosted_bgp_dragents:
         self._bgp_rpc.bgp_speaker_removed(context,
                                           bgp_speaker_id,
                                           agent.host)

 def add_bgp_peer(self, context, bgp_speaker_id, bgp_peer_info):
     policy.check_is_admin(context)
     ret_value = super(BgpPlugin, self).add_bgp_peer(context,
                                                     bgp_speaker_id,
                                                     bgp_peer_info)
     hosted_bgp_dragents = self.get_dragents_hosting_bgp_speakers(
                                                          context,
                                                          [bgp_speaker_id])
     for agent in hosted_bgp_dragents:
         self._bgp_rpc.bgp_peer_associated(context, bgp_speaker_id,
                                           ret_value['bgp_peer_id'],
                                           agent.host)
     return ret_value

    def __init__(self, user_id, tenant_id, is_admin=None, read_deleted="no",
                 roles=None, timestamp=None, **kwargs):
        """Object initialization.

        :param read_deleted: 'no' indicates deleted records are hidden, 'yes'
            indicates deleted records are visible, 'only' indicates that
            *only* deleted records are visible.
        """
        if kwargs:
            LOG.warn(_('Arguments dropped when creating '
                       'context: %s'), kwargs)
        super(ContextBase, self).__init__(user=user_id, tenant=tenant_id,
                                          is_admin=is_admin)
        self.read_deleted = read_deleted
        if not timestamp:
            timestamp = datetime.utcnow()
        self.timestamp = timestamp
        self._session = None
        self.roles = roles or []
        if self.is_admin is None:
            self.is_admin = policy.check_is_admin(self)
        elif self.is_admin:
            # Ensure context is populated with admin roles
            # TODO(salvatore-orlando): It should not be necessary
            # to populate roles in artificially-generated contexts
            # address in bp/make-authz-orthogonal
            admin_roles = policy.get_admin_roles()
            if admin_roles:
                self.roles = list(set(self.roles) | set(admin_roles))

    def __init__(self, user_id, tenant_id, is_admin=None, read_deleted="no",
                 roles=None, timestamp=None, load_admin_roles=True, **kwargs):
        """Object initialization.

        :param read_deleted: 'no' indicates deleted records are hidden, 'yes'
            indicates deleted records are visible, 'only' indicates that
            *only* deleted records are visible.
        """
        if kwargs:
            LOG.warn(_('Arguments dropped when creating '
                       'context: %s'), kwargs)
        super(ContextBase, self).__init__(user=user_id, tenant=tenant_id,
                                          is_admin=is_admin)
        self.read_deleted = read_deleted
        if not timestamp:
            timestamp = datetime.utcnow()
        self.timestamp = timestamp
        self._session = None
        self.roles = roles or []
        if self.is_admin is None:
            self.is_admin = policy.check_is_admin(self)
        elif self.is_admin and load_admin_roles:
            # Ensure context is populated with admin roles
            admin_roles = policy.get_admin_roles()
            if admin_roles:
                self.roles = list(set(self.roles) | set(admin_roles))

    def load_context(self, req):
        super(NeutronContextFilter, self).load_context(req)
        tenant_id = req.headers.get('X_TENANT_ID')
        user_id = req.headers.get('X_USER_ID')
        if tenant_id is None or user_id is None:
            if self.require_auth_info:
                return False
            # get_admin_context() does not provide a parameter to set
            # overwrite=True
            # set overwrite=True to avoid duplicate request-id's
            ctx = self.neutron_ctx.Context(user_id=None,
                                           tenant_id=None,
                                           is_admin=True,
                                           overwrite=True)
        else:
            # set overwrite=True to avoid duplicate request-id's
            ctx = self.neutron_ctx.Context(user_id=user_id,
                                           tenant_id=tenant_id,
                                           overwrite=True)
        self.context = ctx
        self._process_roles(req.headers.get('X_ROLES', ''))

        # By default, the normal neutron context will set is_advcsvc to True if
        # it is an admin context.  This resets it to what the actual policy
        # says it should be.  This must be done after _process_roles is called
        # because the policy check relies on the roles.
        # TODO(blogan): remove this if upstream changes the behavior
        # of is_advsvc to only depend on the policy.
        self.context.is_advsvc = policy.check_is_advsvc(self.context)
        # If not admin, check if current roles provide admin status.
        if not self.context.is_admin:
            self.context.is_admin = policy.check_is_admin(self.context)
        req.environ['neutron.context'] = self.context
        return True

    def __init__(self, user_id=None, tenant_id=None, is_admin=None,
                 timestamp=None, tenant_name=None, user_name=None,
                 is_advsvc=None, **kwargs):
        """Object initialization.

        :param overwrite: Set to False to ensure that the greenthread local
            copy of the index is not overwritten.
        """
        # NOTE(jamielennox): We maintain these arguments in order for tests
        # that pass arguments positionally.
        kwargs.setdefault('user', user_id)
        kwargs.setdefault('tenant', tenant_id)
        super(ContextBase, self).__init__(is_admin=is_admin, **kwargs)

        self.user_name = user_name
        self.tenant_name = tenant_name

        if not timestamp:
            timestamp = datetime.datetime.utcnow()
        self.timestamp = timestamp
        self.is_advsvc = is_advsvc
        if self.is_advsvc is None:
            self.is_advsvc = self.is_admin or policy.check_is_advsvc(self)
        if self.is_admin is None:
            self.is_admin = policy.check_is_admin(self)

    def __init__(self, user_id, tenant_id, is_admin=None, roles=None,
                 timestamp=None, request_id=None, tenant_name=None,
                 user_name=None, overwrite=True, auth_token=None,
                 is_advsvc=None, **kwargs):
        """Object initialization.

        :param overwrite: Set to False to ensure that the greenthread local
            copy of the index is not overwritten.

        :param kwargs: Extra arguments that might be present, but we ignore
            because they possibly came in from older rpc messages.
        """
        super(ContextBase, self).__init__(auth_token=auth_token,
                                          user=user_id, tenant=tenant_id,
                                          is_admin=is_admin,
                                          request_id=request_id,
                                          overwrite=overwrite)
        self.user_name = user_name
        self.tenant_name = tenant_name

        if not timestamp:
            timestamp = datetime.datetime.utcnow()
        self.timestamp = timestamp
        self.roles = roles or []
        self.is_advsvc = is_advsvc
        if self.is_advsvc is None:
            self.is_advsvc = self.is_admin or policy.check_is_advsvc(self)
        if self.is_admin is None:
            self.is_admin = policy.check_is_admin(self)

    def __init__(
        self,
        user_id,
        tenant_id,
        is_admin=None,
        read_deleted="no",
        roles=None,
        timestamp=None,
        load_admin_roles=True,
        request_id=None,
        tenant_name=None,
        user_name=None,
        overwrite=True,
        auth_token=None,
        **kwargs
    ):
        """Object initialization.

        :param read_deleted: 'no' indicates deleted records are hidden, 'yes'
            indicates deleted records are visible, 'only' indicates that
            *only* deleted records are visible.

        :param overwrite: Set to False to ensure that the greenthread local
            copy of the index is not overwritten.

        :param kwargs: Extra arguments that might be present, but we ignore
            because they possibly came in from older rpc messages.
        """
        super(ContextBase, self).__init__(
            auth_token=auth_token, user=user_id, tenant=tenant_id, is_admin=is_admin, request_id=request_id
        )
        self.user_name = user_name
        self.tenant_name = tenant_name

        self.read_deleted = read_deleted
        if not timestamp:
            timestamp = datetime.datetime.utcnow()
        self.timestamp = timestamp
        self._session = None
        self.roles = roles or []
        self.is_advsvc = policy.check_is_advsvc(self)
        if self.is_admin is None:
            self.is_admin = policy.check_is_admin(self)
        elif self.is_admin and load_admin_roles:
            # Ensure context is populated with admin roles
            admin_roles = policy.get_admin_roles()
            if admin_roles:
                self.roles = list(set(self.roles) | set(admin_roles))
        # Allow openstack.common.log to access the context
        if overwrite or not hasattr(local.store, "context"):
            local.store.context = self

        # Log only once the context has been configured to prevent
        # format errors.
        if kwargs:
            LOG.debug(_("Arguments dropped when creating " "context: %s"), kwargs)

    def __init__(self, user_id, tenant_id, is_admin=None, read_deleted="no",
                 roles=None, timestamp=None, load_admin_roles=True,
                 request_id=None, tenant_name=None, user_name=None,
                 overwrite=True, auth_token=None, **kwargs):
        """Object initialization.

        :param read_deleted: 'no' indicates deleted records are hidden, 'yes'
            indicates deleted records are visible, 'only' indicates that
            *only* deleted records are visible.

        :param overwrite: Set to False to ensure that the greenthread local
            copy of the index is not overwritten.

        :param kwargs: Extra arguments that might be present, but we ignore
            because they possibly came in from older rpc messages.
        """
        super(ContextBase, self).__init__(auth_token=auth_token,
                                          user=user_id, tenant=tenant_id,
                                          is_admin=is_admin,
                                          request_id=request_id,
                                          overwrite=overwrite)
        self.user_name = user_name
        self.tenant_name = tenant_name

        self.read_deleted = read_deleted
        if not timestamp:
            timestamp = datetime.datetime.utcnow()
        self.timestamp = timestamp
        self._session = None
        self.roles = roles or []
        self.is_advsvc = policy.check_is_advsvc(self)
        if self.is_admin is None:
            self.is_admin = policy.check_is_admin(self)
        elif self.is_admin and load_admin_roles:
            # Ensure context is populated with admin roles
            admin_roles = policy.get_admin_roles()
            if admin_roles:
                self.roles = list(set(self.roles) | set(admin_roles))

 def list_bgp_speaker_on_dragent(self, context, agent_id):
     policy.check_is_admin(context)
     return super(BgpPlugin, self).list_bgp_speaker_on_dragent(context,
                                                               agent_id)

 def get_bgp_peer(self, context, bgp_peer_id, fields=None):
     policy.check_is_admin(context)
     return super(BgpPlugin, self).get_bgp_peer(context,
                                                bgp_peer_id,
                                                fields=fields)

 def test_check_is_admin_with_admin_context_succeeds(self):
     admin_context = context.get_admin_context()
     self.assertTrue(policy.check_is_admin(admin_context))

 def update_bgp_peer(self, context, bgp_peer_id, bgp_peer):
     policy.check_is_admin(context)
     return super(BgpPlugin, self).update_bgp_peer(context,
                                                   bgp_peer_id,
                                                   bgp_peer)

 def delete_bgp_peer(self, context, bgp_peer_id):
     policy.check_is_admin(context)
     super(BgpPlugin, self).delete_bgp_peer(context, bgp_peer_id)

 def add_bgp_speaker_to_dragent(self, context, agent_id, speaker_id):
     policy.check_is_admin(context)
     super(BgpPlugin, self).add_bgp_speaker_to_dragent(context,
                                                       agent_id,
                                                       speaker_id)

 def remove_bgp_speaker_from_dragent(self, context, agent_id, speaker_id):
     policy.check_is_admin(context)
     super(BgpPlugin, self).remove_bgp_speaker_from_dragent(context,
                                                            agent_id,
                                                            speaker_id)

 def test_check_is_admin_with_user_context_fails(self):
     self.assertFalse(policy.check_is_admin(self.context))

 def test_check_is_admin_with_admin_context_succeeds(self):
     admin_context = context.get_admin_context()
     # explicitly set roles as this test verifies user credentials
     # with the policy engine
     admin_context.roles = ['admin']
     self.assertTrue(policy.check_is_admin(admin_context))

 def list_dragent_hosting_bgp_speaker(self, context, speaker_id):
     policy.check_is_admin(context)
     return super(BgpPlugin, self).list_dragent_hosting_bgp_speaker(
                                                                context,
                                                                speaker_id)