def _validate_change(self, change):
        change_path = change['path'][0]
        change_op = change['op']
        allowed_methods = self.allowed_operations.get(change_path)

        if not allowed_methods:
            msg = _("Attribute '{0}' is invalid").format(change_path)
            raise webob.exc.HTTPForbidden(explanation=unicode(msg))

        if change_op not in allowed_methods:
            msg = _("Method '{method}' is not allowed for a path with name "
                    "'{name}'. Allowed operations are: '{ops}'").format(
                    method=change_op,
                    name=change_path,
                    ops=', '.join(allowed_methods))

            raise webob.exc.HTTPForbidden(explanation=unicode(msg))

        property_to_update = {change_path: change['value']}

        try:
            jsonschema.validate(property_to_update, schemas.PKG_UPDATE_SCHEMA)
        except jsonschema.ValidationError as e:
            LOG.exception(e)
            raise webob.exc.HTTPBadRequest(explanation=e.message)

    def delete(self, request, environment_id, session_id):
        LOG.debug(_('Session:Delete <SessionId: {0}>').format(session_id))

        unit = db_session.get_session()
        session = unit.query(models.Session).get(session_id)

        if session is None:
            LOG.error(_('Session <SessionId {0}> '
                        'is not found').format(session_id))
            raise exc.HTTPNotFound()

        if session.environment_id != environment_id:
            LOG.error(_('Session <SessionId {0}> is not tied with Environment '
                        '<EnvId {1}>').format(session_id, environment_id))
            raise exc.HTTPNotFound()

        user_id = request.context.user
        if session.user_id != user_id:
            LOG.error(_('User <UserId {0}> is not authorized to access session'
                        '<SessionId {1}>.').format(user_id, session_id))
            raise exc.HTTPUnauthorized()

        if session.state == sessions.SessionState.deploying:
            LOG.error(_('Session <SessionId: {0}> is in deploying state and '
                        'could not be deleted').format(session_id))
            raise exc.HTTPForbidden()

        with unit.begin():
            unit.delete(session)

        return None

    def configure(self, request, environment_id):
        LOG.debug(_('Session:Configure <EnvId: {0}>').format(environment_id))

        unit = db_session.get_session()
        environment = unit.query(models.Environment).get(environment_id)

        if environment is None:
            LOG.info(_('Environment <EnvId {0}> '
                       'is not found').format(environment_id))
            raise exc.HTTPNotFound

        if environment.tenant_id != request.context.tenant:
            LOG.info(_('User is not authorized to access '
                       'this tenant resources.'))
            raise exc.HTTPUnauthorized

        # no new session can be opened if environment has deploying status
        env_status = envs.EnvironmentServices.get_status(environment_id)
        if env_status == envs.EnvironmentStatus.deploying:
            LOG.info(_('Could not open session for environment <EnvId: {0}>,'
                       'environment has deploying '
                       'status.').format(environment_id))
            raise exc.HTTPForbidden()

        user_id = request.context.user
        session = sessions.SessionServices.create(environment_id, user_id)

        return session.to_dict()

    def show(self, request, environment_id, session_id):
        LOG.debug(_('Session:Show <SessionId: {0}>').format(session_id))

        unit = db_session.get_session()
        session = unit.query(models.Session).get(session_id)

        if session is None:
            LOG.error(_('Session <SessionId {0}> '
                        'is not found').format(session_id))
            raise exc.HTTPNotFound()

        if session.environment_id != environment_id:
            LOG.error(_('Session <SessionId {0}> is not tied with Environment '
                        '<EnvId {1}>').format(session_id, environment_id))
            raise exc.HTTPNotFound()

        user_id = request.context.user
        if session.user_id != user_id:
            LOG.error(_('User <UserId {0}> is not authorized to access session'
                        '<SessionId {1}>.').format(user_id, session_id))
            raise exc.HTTPUnauthorized()

        if not sessions.SessionServices.validate(session):
            LOG.error(_('Session <SessionId {0}> '
                        'is invalid').format(session_id))
            raise exc.HTTPForbidden()

        return session.to_dict()

    def show(self, request, environment_id):
        LOG.debug(_('Environments:Show <Id: {0}>').format(environment_id))

        session = db_session.get_session()
        environment = session.query(models.Environment).get(environment_id)

        if environment is None:
            LOG.info(_('Environment <EnvId {0}> is not found').format(
                environment_id))
            raise exc.HTTPNotFound

        if environment.tenant_id != request.context.tenant:
            LOG.info(_('User is not authorized to access '
                       'this tenant resources.'))
            raise exc.HTTPUnauthorized

        env = environment.to_dict()
        env['status'] = envs.EnvironmentServices.get_status(env['id'])

        session_id = None
        if hasattr(request, 'context') and request.context.session:
            session_id = request.context.session

        #add services to env
        get_data = core_services.CoreServices.get_data
        env['services'] = get_data(environment_id, '/services', session_id)

        return env

    def deploy(self, request, environment_id, session_id):
        LOG.debug(_('Session:Deploy <SessionId: {0}>').format(session_id))

        unit = db_session.get_session()
        session = unit.query(models.Session).get(session_id)

        if session is None:
            LOG.error(_('Session <SessionId {0}> '
                        'is not found').format(session_id))
            raise exc.HTTPNotFound()

        if session.environment_id != environment_id:
            LOG.error(_('Session <SessionId {0}> is not tied with Environment '
                        '<EnvId {1}>').format(session_id, environment_id))
            raise exc.HTTPNotFound()

        if not sessions.SessionServices.validate(session):
            LOG.error(_('Session <SessionId {0}> '
                        'is invalid').format(session_id))
            raise exc.HTTPForbidden()

        if session.state != sessions.SessionState.open:
            LOG.error(_('Session <SessionId {0}> is already deployed or '
                        'deployment is in progress').format(session_id))
            raise exc.HTTPForbidden()

        sessions.SessionServices.deploy(session,
                                        unit,
                                        request.context.auth_token)

    def __inner(self, request, *args, **kwargs):
        if hasattr(request, 'context') and not request.context.session:
            LOG.info(_('Session is required for this call'))
            raise exc.HTTPForbidden()

        session_id = request.context.session

        unit = db_session.get_session()
        session = unit.query(models.Session).get(session_id)

        if session is None:
            LOG.info(_('Session <SessionId {0}> '
                       'is not found').format(session_id))
            raise exc.HTTPForbidden()

        if not sessions.SessionServices.validate(session):
            LOG.info(_('Session <SessionId {0}> '
                       'is invalid').format(session_id))
            raise exc.HTTPForbidden()

        if session.state == sessions.SessionState.deploying:
            LOG.info(_('Session <SessionId {0}> is already in '
                       'deployment state').format(session_id))
            raise exc.HTTPForbidden()
        return func(self, request, *args, **kwargs)

 def _from_json(self, datastring):
     value = datastring
     try:
         LOG.debug(_("Trying deserialize '{0}' to json".format(datastring)))
         value = jsonutils.loads(datastring)
     except ValueError:
         LOG.debug(_("Unable deserialize to json, using raw text"))
     return value

    def process_result(context, result):
        secure_result = token_sanitizer.TokenSanitizer().sanitize(result)
        LOG.debug(_('Got result from orchestration '
                    'engine:\n{0}').format(secure_result))

        result_id = result['Objects']['?']['id']

        if 'deleted' in result:
            LOG.debug(_('Result for environment {0} is dropped. Environment '
                        'is deleted').format(result_id))
            return

        unit = session.get_session()
        environment = unit.query(models.Environment).get(result_id)

        if not environment:
            LOG.warning(_('Environment result could not be handled, specified '
                          'environment was not found in database'))
            return

        environment.description = result
        environment.description['Objects']['services'] = \
            environment.description['Objects'].get('applications', [])
        del environment.description['Objects']['applications']
        environment.networking = result.get('networking', {})
        environment.version += 1
        environment.save(unit)

        #close session
        conf_session = unit.query(models.Session).filter_by(
            **{'environment_id': environment.id, 'state': 'deploying'}).first()
        conf_session.state = 'deployed'
        conf_session.save(unit)

        #close deployment
        deployment = get_last_deployment(unit, environment.id)
        deployment.finished = timeutils.utcnow()

        num_errors = unit.query(models.Status)\
            .filter_by(level='error', deployment_id=deployment.id).count()
        num_warnings = unit.query(models.Status)\
            .filter_by(level='warning', deployment_id=deployment.id).count()

        final_status_text = "Deployment finished"
        if num_errors:
            final_status_text += " with errors"

        elif num_warnings:
            final_status_text += " with warnings"

        status = models.Status()
        status.deployment_id = deployment.id
        status.text = final_status_text
        status.level = 'info'
        deployment.statuses.append(status)
        deployment.save(unit)

def _authorize_package(package, context, allow_public=False):
    if context.is_admin:
        return

    if package.owner_id != context.tenant:
        if not allow_public:
            msg = _("Package '{0}' is not owned by "
                    "tenant '{1}'").format(package.id, context.tenant)
            LOG.error(msg)
            raise exc.HTTPForbidden(msg)
        if not package.is_public:
            msg = _("Package '{0}' is not public and not owned by "
                    "tenant '{1}' ").format(package.id, context.tenant)
            LOG.error(msg)
            raise exc.HTTPForbidden(msg)

def _get_not_supported_column(col_name_col_instance, column_name):
    try:
        column = col_name_col_instance[column_name]
    except KeyError:
        msg = _("Please specify column %s in col_name_col_instance "
                "param. It is required because column has unsupported "
                "type by sqlite).")
        raise ColumnError(msg % column_name)

    if not isinstance(column, Column):
        msg = _("col_name_col_instance param has wrong type of "
                "column instance for column %s It should be instance "
                "of sqlalchemy.Column.")
        raise ColumnError(msg % column_name)
    return column

def db_sync(engine, abs_path, version=None, init_version=0):
    """Upgrade or downgrade a database.

    Function runs the upgrade() or downgrade() functions in change scripts.

    :param engine:       SQLAlchemy engine instance for a given database
    :param abs_path:     Absolute path to migrate repository.
    :param version:      Database will upgrade/downgrade until this version.
                         If None - database will update to the latest
                         available version.
    :param init_version: Initial database version
    """
    if version is not None:
        try:
            version = int(version)
        except ValueError:
            raise exception.DbMigrationError(
                message=_("version should be an integer"))

    current_version = db_version(engine, abs_path, init_version)
    repository = _find_migrate_repo(abs_path)
    _db_schema_sanity_check(engine)
    if version is None or version > current_version:
        return versioning_api.upgrade(engine, repository, version)
    else:
        return versioning_api.downgrade(engine, repository,
                                        version)

def untrack_instance(payload):
    LOG.debug(_('Got untrack instance request from orchestration '
                'engine:\n{0}').format(payload))
    instance_id = payload['instance']
    environment_id = payload['environment']
    instances.InstanceStatsServices.destroy_instance(
        instance_id, environment_id)

    def deprecated(self, msg, *args, **kwargs):
        """Call this method when a deprecated feature is used.

        If the system is configured for fatal deprecations then the message
        is logged at the 'critical' level and :class:`DeprecatedConfig` will
        be raised.

        Otherwise, the message will be logged (once) at the 'warn' level.

        :raises: :class:`DeprecatedConfig` if the system is configured for
                 fatal deprecations.

        """
        stdmsg = _("Deprecated: %s") % msg
        if CONF.fatal_deprecations:
            self.critical(stdmsg, *args, **kwargs)
            raise DeprecatedConfig(msg=stdmsg)

        # Using a list because a tuple with dict can't be stored in a set.
        sent_args = self._deprecated_messages_sent.setdefault(msg, list())

        if args in sent_args:
            # Already logged this message, so don't log it again.
            return

        sent_args.append(args)
        self.warn(stdmsg, *args, **kwargs)

    def create(self, request, body):
        LOG.debug(_('Environments:Create <Body {0}>').format(body))

        environment = envs.EnvironmentServices.create(body.copy(),
                                                      request.context.tenant)

        return environment.to_dict()

    def _validate_limit(value):
        if value is None:
            return
        try:
            value = int(value)
        except ValueError:
            msg = _("limit param must be an integer")
            LOG.error(msg)
            raise exc.HTTPBadRequest(explanation=msg)

        if value < 0:
            msg = _("limit param must be positive")
            LOG.error(msg)
            raise exc.HTTPBadRequest(explanation=msg)

        return value

def _check_content_type(req, content_type):
    try:
        req.get_content_type((content_type,))
    except exception.InvalidContentType:
        msg = _("Content-Type must be '{0}'").format(content_type)
        LOG.error(msg)
        raise exc.HTTPBadRequest(explanation=msg)

    def acquire(self):
        basedir = os.path.dirname(self.fname)

        if not os.path.exists(basedir):
            fileutils.ensure_tree(basedir)
            LOG.info(_LI('Created lock path: %s'), basedir)

        self.lockfile = open(self.fname, 'w')

        while True:
            try:
                # Using non-blocking locks since green threads are not
                # patched to deal with blocking locking calls.
                # Also upon reading the MSDN docs for locking(), it seems
                # to have a laughable 10 attempts "blocking" mechanism.
                self.trylock()
                LOG.debug('Got file lock "%s"', self.fname)
                return True
            except IOError as e:
                if e.errno in (errno.EACCES, errno.EAGAIN):
                    # external locks synchronise things like iptables
                    # updates - give it some time to prevent busy spinning
                    time.sleep(0.01)
                else:
                    raise threading.ThreadError(_("Unable to acquire lock on"
                                                  " `%(filename)s` due to"
                                                  " %(exception)s") %
                                                {
                                                    'filename': self.fname,
                                                    'exception': e,
                                                })

def _read_deleted_filter(query, db_model, read_deleted):
    if 'deleted' not in db_model.__table__.columns:
        raise ValueError(_("There is no `deleted` column in `%s` table. "
                           "Project doesn't use soft-deleted feature.")
                         % db_model.__name__)

    default_deleted_value = db_model.__table__.c.deleted.default.arg
    if read_deleted == 'no':
        query = query.filter(db_model.deleted == default_deleted_value)
    elif read_deleted == 'yes':
        pass  # omit the filter to include deleted and active
    elif read_deleted == 'only':
        query = query.filter(db_model.deleted != default_deleted_value)
    else:
        raise ValueError(_("Unrecognized read_deleted value '%s'")
                         % read_deleted)
    return query

 def _wrap(*args, **kw):
     try:
         return f(*args, **kw)
     except Exception as e:
         if not isinstance(e, Error):
             logging.exception(_('Uncaught exception'))
             raise Error(str(e))
         raise