func openEnviron(
	c *gc.C,
	provider environs.EnvironProvider,
	sender *azuretesting.Senders,
	attrs ...testing.Attrs,
) environs.Environ {
	// Opening the environment should not incur network communication,
	// so we don't set s.sender until after opening.
	cfg := makeTestModelConfig(c, attrs...)
	env, err := provider.Open(environs.OpenParams{
		Cloud:  fakeCloudSpec(),
		Config: cfg,
	})
	c.Assert(err, jc.ErrorIsNil)

	// Force an explicit refresh of the access token, so it isn't done
	// implicitly during the tests.
	*sender = azuretesting.Senders{
		discoverAuthSender(),
		tokenRefreshSender(),
	}
	err = azure.ForceTokenRefresh(env)
	c.Assert(err, jc.ErrorIsNil)
	return env
}

func prepareForBootstrap(
	c *gc.C,
	ctx environs.BootstrapContext,
	provider environs.EnvironProvider,
	sender *azuretesting.Senders,
	attrs ...testing.Attrs,
) environs.Environ {
	// Opening the environment should not incur network communication,
	// so we don't set s.sender until after opening.
	cfg, err := provider.PrepareConfig(environs.PrepareConfigParams{
		Config: makeTestModelConfig(c, attrs...),
		Cloud:  fakeCloudSpec(),
	})
	c.Assert(err, jc.ErrorIsNil)

	env, err := provider.Open(environs.OpenParams{
		Cloud:  fakeCloudSpec(),
		Config: cfg,
	})
	c.Assert(err, jc.ErrorIsNil)

	*sender = azuretesting.Senders{
		discoverAuthSender(),
		tokenRefreshSender(),
	}
	err = env.PrepareForBootstrap(ctx)
	c.Assert(err, jc.ErrorIsNil)
	return env
}

// AssertProviderCredentialsValid asserts that the given provider is
// able to validate the given authentication type and credential
// attributes; and that removing any one of the attributes will cause
// the validation to fail.
func AssertProviderCredentialsValid(c *gc.C, p environs.EnvironProvider, authType cloud.AuthType, attrs map[string]string) {
	schema, ok := p.CredentialSchemas()[authType]
	c.Assert(ok, jc.IsTrue, gc.Commentf("missing schema for %q auth-type", authType))
	validate := func(attrs map[string]string) error {
		_, err := schema.Finalize(attrs, func(string) ([]byte, error) {
			return nil, errors.NotSupportedf("reading files")
		})
		return err
	}

	err := validate(attrs)
	c.Assert(err, jc.ErrorIsNil)

	for excludedKey := range attrs {
		field, _ := schema.Attribute(excludedKey)
		if field.Optional {
			continue
		}
		reducedAttrs := make(map[string]string)
		for key, value := range attrs {
			if key != excludedKey {
				reducedAttrs[key] = value
			}
		}
		err := validate(reducedAttrs)
		if field.FileAttr != "" {
			c.Assert(err, gc.ErrorMatches, fmt.Sprintf(
				`either %q or %q must be specified`, excludedKey, field.FileAttr),
			)
		} else {
			c.Assert(err, gc.ErrorMatches, excludedKey+": expected string, got nothing")
		}
	}
}

func prepareForBootstrap(
	c *gc.C,
	ctx environs.BootstrapContext,
	provider environs.EnvironProvider,
	sender *azuretesting.Senders,
	attrs ...testing.Attrs,
) environs.Environ {
	// Opening the environment should not incur network communication,
	// so we don't set s.sender until after opening.
	cfg := makeTestModelConfig(c, attrs...)
	cfg, err := cfg.Remove([]string{"controller-resource-group"})
	c.Assert(err, jc.ErrorIsNil)
	*sender = azuretesting.Senders{tokenRefreshSender()}
	cfg, err = provider.BootstrapConfig(environs.BootstrapConfigParams{
		Config:               cfg,
		CloudRegion:          "westus",
		CloudEndpoint:        "https://management.azure.com",
		CloudStorageEndpoint: "https://core.windows.net",
		Credentials:          fakeUserPassCredential(),
	})
	c.Assert(err, jc.ErrorIsNil)
	env, err := provider.PrepareForBootstrap(ctx, cfg)
	c.Assert(err, jc.ErrorIsNil)
	return env
}

// AssertProviderAuthTypes asserts that the given provider has credential
// schemas for exactly the specified set of authentication types.
func AssertProviderAuthTypes(c *gc.C, p environs.EnvironProvider, expectedAuthTypes ...cloud.AuthType) {
	var authTypes []cloud.AuthType
	for authType := range p.CredentialSchemas() {
		authTypes = append(authTypes, authType)
	}
	c.Assert(authTypes, jc.SameContents, expectedAuthTypes)
}

// AssertProviderCredentialsAttributesHidden asserts that the provider
// credentials schema for the given provider and authentication type
// marks the specified attributes (and only those attributes) as being
// hidden.
func AssertProviderCredentialsAttributesHidden(c *gc.C, p environs.EnvironProvider, authType cloud.AuthType, expectedHidden ...string) {
	var hidden []string
	schema, ok := p.CredentialSchemas()[authType]
	c.Assert(ok, jc.IsTrue, gc.Commentf("missing schema for %q auth-type", authType))
	for _, field := range schema {
		if field.Hidden {
			hidden = append(hidden, field.Name)
		}
	}
	c.Assert(hidden, jc.SameContents, expectedHidden)
}

func prepareForBootstrap(
	c *gc.C,
	ctx environs.BootstrapContext,
	provider environs.EnvironProvider,
	sender *azuretesting.Senders,
	attrs ...testing.Attrs,
) environs.Environ {
	// Opening the environment should not incur network communication,
	// so we don't set s.sender until after opening.
	cfg := makeTestModelConfig(c, attrs...)
	cfg, err := cfg.Remove([]string{"controller-resource-group"})
	c.Assert(err, jc.ErrorIsNil)
	*sender = azuretesting.Senders{tokenRefreshSender()}
	env, err := provider.PrepareForBootstrap(ctx, cfg)
	c.Assert(err, jc.ErrorIsNil)
	return env
}

// finalizeConfig creates the config object from attributes,
// and calls EnvironProvider.PrepareConfig.
func finalizeConfig(
	provider environs.EnvironProvider,
	cloud environs.CloudSpec,
	attrs map[string]interface{},
) (*config.Config, error) {
	cfg, err := config.New(config.UseDefaults, attrs)
	if err != nil {
		return nil, errors.Annotate(err, "creating config from values failed")
	}
	cfg, err = provider.PrepareConfig(environs.PrepareConfigParams{
		Cloud:  cloud,
		Config: cfg,
	})
	if err != nil {
		return nil, errors.Annotate(err, "provider config preparation failed")
	}
	cfg, err = provider.Validate(cfg, nil)
	if err != nil {
		return nil, errors.Annotate(err, "provider config validation failed")
	}
	return cfg, nil
}

func prepare(
	ctx environs.BootstrapContext,
	p environs.EnvironProvider,
	args PrepareParams,
) (environs.Environ, prepareDetails, error) {
	var details prepareDetails

	cfg, err := config.New(config.NoDefaults, args.ModelConfig)
	if err != nil {
		return nil, details, errors.Trace(err)
	}

	cfg, err = p.PrepareConfig(environs.PrepareConfigParams{args.Cloud, cfg})
	if err != nil {
		return nil, details, errors.Trace(err)
	}
	env, err := p.Open(environs.OpenParams{
		Cloud:  args.Cloud,
		Config: cfg,
	})
	if err != nil {
		return nil, details, errors.Trace(err)
	}
	if err := env.PrepareForBootstrap(ctx); err != nil {
		return nil, details, errors.Trace(err)
	}

	// We store the base configuration only; we don't want the
	// default attributes, generated secrets/certificates, or
	// UUIDs stored in the bootstrap config. Make a copy, so
	// we don't disturb the caller's config map.
	details.Config = make(map[string]interface{})
	for k, v := range args.ModelConfig {
		details.Config[k] = v
	}
	delete(details.Config, config.UUIDKey)

	// TODO(axw) change signature of CACert() to not return a bool.
	// It's no longer possible to have a controller config without
	// a CA certificate.
	caCert, ok := args.ControllerConfig.CACert()
	if !ok {
		return nil, details, errors.New("controller config is missing CA certificate")
	}

	// We want to store attributes describing how a controller has been configured.
	// These do not include the CACert or UUID since they will be replaced with new
	// values when/if we need to use this configuration.
	details.ControllerConfig = make(controller.Config)
	for k, v := range args.ControllerConfig {
		if k == controller.CACertKey || k == controller.ControllerUUIDKey {
			continue
		}
		details.ControllerConfig[k] = v
	}
	for k, v := range args.ControllerConfig {
		if k == controller.CACertKey || k == controller.ControllerUUIDKey {
			continue
		}
		details.ControllerConfig[k] = v
	}
	details.CACert = caCert
	details.ControllerUUID = args.ControllerConfig.ControllerUUID()
	details.ControllerModelUUID = args.ModelConfig[config.UUIDKey].(string)
	details.User = environs.AdminUser
	details.Password = args.AdminSecret
	details.LastKnownAccess = string(permission.SuperuserAccess)
	details.ModelUUID = cfg.UUID()
	details.ControllerDetails.Cloud = args.Cloud.Name
	details.ControllerDetails.CloudRegion = args.Cloud.Region
	details.BootstrapConfig.CloudType = args.Cloud.Type
	details.BootstrapConfig.Cloud = args.Cloud.Name
	details.BootstrapConfig.CloudRegion = args.Cloud.Region
	details.CloudEndpoint = args.Cloud.Endpoint
	details.CloudIdentityEndpoint = args.Cloud.IdentityEndpoint
	details.CloudStorageEndpoint = args.Cloud.StorageEndpoint
	details.Credential = args.CredentialName

	return env, details, nil
}