def POST(self, req):
     """HTTP POST request handler."""
     error_response = \
         self.clean_acls(req) or check_metadata(req, 'container')
     if error_response:
         return error_response
     if not req.environ.get('swift_owner'):
         for key in self.app.swift_owner_headers:
             req.headers.pop(key, None)
     if req.environ.get('reseller_request', False) and \
             'X-Container-Sharding' in req.headers:
         req.headers[get_sys_meta_prefix('container') + 'Sharding'] = \
             str(config_true_value(req.headers['X-Container-Sharding']))
     account_partition, accounts, container_count = \
         self.account_info(self.account_name, req)
     if not accounts:
         return HTTPNotFound(request=req)
     container_partition, containers = self.app.container_ring.get_nodes(
         self.account_name, self.container_name)
     headers = self.generate_request_headers(req, transfer=True)
     clear_info_cache(self.app, req.environ,
                      self.account_name, self.container_name)
     resp = self.make_requests(
         req, self.app.container_ring, container_partition, 'POST',
         req.swift_entity_path, [headers] * len(containers))
     return resp

 def test_headers_to_object_info_sys_meta(self):
     prefix = get_sys_meta_prefix("object")
     headers = {"%sWhatevs" % prefix: 14, "%ssomethingelse" % prefix: 0}
     resp = headers_to_object_info(headers.items(), 200)
     self.assertEquals(len(resp["sysmeta"]), 2)
     self.assertEquals(resp["sysmeta"]["whatevs"], 14)
     self.assertEquals(resp["sysmeta"]["somethingelse"], 0)

    def client_to_sysmeta(self, req, req_type):
        subresources = {
            'account': ('container', 'object'),
            'container': ('object', ),
        }.get(req_type, ())

        header_formats = (
            ('x-remove-default-%s-', True),
            ('x-default-%s-', False),
        )
        for header_format, clear in header_formats:
            for header, value in req.headers.items():
                for subresource in subresources:
                    prefix = header_format % subresource
                    if header.lower().startswith(prefix):
                        header_to_default = header[len(prefix):].lower()
                        if header_to_default.startswith(BLACKLIST_PREFIXES):
                            continue
                        if header_to_default in BLACKLIST:
                            continue
                        sysmeta_header = '%sdefault-%s-%s' % (
                            get_sys_meta_prefix(req_type),
                            subresource,
                            header_to_default)
                        req.headers[sysmeta_header] = '' if clear else value

    def extract_acl_and_report_errors(self, req):
        """
        Return a user-readable string indicating the errors in the input ACL,
        or None if there are no errors.
        """
        acl_header = 'x-account-access-control'
        acl_data = req.headers.get(acl_header)
        result = parse_acl(version=2, data=acl_data)
        if result is None:
            return 'Syntax error in input (%r)' % acl_data

        tempauth_acl_keys = 'admin read-write read-only'.split()
        for key in result:
            # While it is possible to construct auth systems that collaborate
            # on ACLs, TempAuth is not such an auth system.  At this point,
            # it thinks it is authoritative.
            if key not in tempauth_acl_keys:
                return 'Key %r not recognized' % key

        for key in tempauth_acl_keys:
            if key not in result:
                continue
            if not isinstance(result[key], list):
                return 'Value for key %r must be a list' % key
            for grantee in result[key]:
                if not isinstance(grantee, str):
                    return 'Elements of %r list must be strings' % key

        # Everything looks fine, no errors found
        internal_hdr = get_sys_meta_prefix('account') + 'core-access-control'
        req.headers[internal_hdr] = req.headers.pop(acl_header)
        return None

    def GETorHEAD(self, req):
        """Handler for HTTP GET/HEAD requests."""
        ai = self.account_info(self.account_name, req)
        auto_account = self.account_name.startswith(
            self.app.auto_create_account_prefix)
        if not (auto_account or ai[1]):
            if 'swift.authorize' in req.environ:
                aresp = req.environ['swift.authorize'](req)
                if aresp:
                    # Don't cache this. It doesn't reflect the state of the
                    # container, just that the user can't access it.
                    return aresp
            # Don't cache this. The lack of account will be cached, and that
            # is sufficient.
            return HTTPNotFound(request=req)
        part = self.app.container_ring.get_part(
            self.account_name, self.container_name)
        concurrency = self.app.container_ring.replica_count \
            if self.app.concurrent_gets else 1
        node_iter = self.app.iter_nodes(self.app.container_ring, part)
        params = req.params
        params['format'] = 'json'
        record_type = req.headers.get('X-Backend-Record-Type', '').lower()
        if not record_type:
            record_type = 'auto'
            req.headers['X-Backend-Record-Type'] = 'auto'
            params['states'] = 'listing'
        req.params = params
        resp = self.GETorHEAD_base(
            req, _('Container'), node_iter, part,
            req.swift_entity_path, concurrency)
        resp_record_type = resp.headers.get('X-Backend-Record-Type', '')
        if all((req.method == "GET", record_type == 'auto',
               resp_record_type.lower() == 'shard')):
            resp = self._get_from_shards(req, resp)

        # Cache this. We just made a request to a storage node and got
        # up-to-date information for the container.
        resp.headers['X-Backend-Recheck-Container-Existence'] = str(
            self.app.recheck_container_existence)
        set_info_cache(self.app, req.environ, self.account_name,
                       self.container_name, resp)
        if 'swift.authorize' in req.environ:
            req.acl = resp.headers.get('x-container-read')
            aresp = req.environ['swift.authorize'](req)
            if aresp:
                # Don't cache this. It doesn't reflect the state of the
                # container, just that the user can't access it.
                return aresp
        if not req.environ.get('swift_owner', False):
            for key in self.app.swift_owner_headers:
                if key in resp.headers:
                    del resp.headers[key]
        # Expose sharding state in reseller requests
        if req.environ.get('reseller_request', False):
            resp.headers['X-Container-Sharding'] = config_true_value(
                resp.headers.get(get_sys_meta_prefix('container') + 'Sharding',
                                 'False'))
        return resp

 def add_acls_from_sys_metadata(self, resp):
     if resp.environ["REQUEST_METHOD"] in ("HEAD", "GET", "PUT", "POST"):
         prefix = get_sys_meta_prefix("account") + "core-"
         name = "access-control"
         (extname, intname) = ("x-account-" + name, prefix + name)
         acl_dict = parse_acl(version=2, data=resp.headers.pop(intname))
         if acl_dict:  # treat empty dict as empty header
             resp.headers[extname] = format_acl(version=2, acl_dict=acl_dict)

 def test_headers_to_object_info_sys_meta(self):
     prefix = get_sys_meta_prefix('object')
     headers = {'%sWhatevs' % prefix: 14,
                '%ssomethingelse' % prefix: 0}
     resp = headers_to_object_info(headers.items(), 200)
     self.assertEqual(len(resp['sysmeta']), 2)
     self.assertEqual(resp['sysmeta']['whatevs'], 14)
     self.assertEqual(resp['sysmeta']['somethingelse'], 0)

 def add_acls_from_sys_metadata(self, resp):
     if resp.environ['REQUEST_METHOD'] in ('HEAD', 'GET', 'PUT', 'POST'):
         prefix = get_sys_meta_prefix('account') + 'core-'
         name = 'access-control'
         (extname, intname) = ('x-account-' + name, prefix + name)
         acl_dict = parse_acl(version=2, data=resp.headers.pop(intname))
         if acl_dict:  # treat empty dict as empty header
             resp.headers[extname] = format_acl(
                 version=2, acl_dict=acl_dict)

 def _make_user_and_sys_acl_headers_data(self):
     acl = {
         'admin': ['AUTH_alice', 'AUTH_bob'],
         'read-write': ['AUTH_carol'],
         'read-only': [],
     }
     user_prefix = 'x-account-'  # external, user-facing
     user_headers = {(user_prefix + 'access-control'): format_acl(
         version=2, acl_dict=acl)}
     sys_prefix = get_sys_meta_prefix('account')   # internal, system-facing
     sys_headers = {(sys_prefix + 'core-access-control'): format_acl(
         version=2, acl_dict=acl)}
     return user_headers, sys_headers

 def PUT(self, req):
     """HTTP PUT request handler."""
     error_response = \
         self.clean_acls(req) or check_metadata(req, 'container')
     if error_response:
         return error_response
     policy_index = self._convert_policy_to_index(req)
     if not req.environ.get('swift_owner'):
         for key in self.app.swift_owner_headers:
             req.headers.pop(key, None)
     if req.environ.get('reseller_request', False) and \
             'X-Container-Sharding' in req.headers:
         req.headers[get_sys_meta_prefix('container') + 'Sharding'] = \
             str(config_true_value(req.headers['X-Container-Sharding']))
     length_limit = self.get_name_length_limit()
     if len(self.container_name) > length_limit:
         body = 'Container name length of %d longer than %d' % (
             len(self.container_name), length_limit)
         resp = HTTPBadRequest(request=req, body=body)
         return resp
     account_partition, accounts, container_count = \
         self.account_info(self.account_name, req)
     if not accounts and self.app.account_autocreate:
         if not self.autocreate_account(req, self.account_name):
             return HTTPServiceUnavailable(request=req)
         account_partition, accounts, container_count = \
             self.account_info(self.account_name, req)
     if not accounts:
         return HTTPNotFound(request=req)
     if 0 < self.app.max_containers_per_account <= container_count and \
             self.account_name not in self.app.max_containers_whitelist:
         container_info = \
             self.container_info(self.account_name, self.container_name,
                                 req)
         if not is_success(container_info.get('status')):
             body = 'Reached container limit of %s' % (
                 self.app.max_containers_per_account, )
             resp = HTTPForbidden(request=req, body=body)
             return resp
     container_partition, containers = self.app.container_ring.get_nodes(
         self.account_name, self.container_name)
     headers = self._backend_requests(req, len(containers),
                                      account_partition, accounts,
                                      policy_index)
     resp = self.make_requests(
         req, self.app.container_ring,
         container_partition, 'PUT', req.swift_entity_path, headers)
     clear_info_cache(self.app, req.environ,
                      self.account_name, self.container_name)
     return resp

    def test_sys_meta_headers_PUT(self):
        sys_meta_key = '%stest' % get_sys_meta_prefix('container')
        sys_meta_key = sys_meta_key.title()
        user_meta_key = 'X-Container-Meta-Test'

        hdrs_in = {sys_meta_key: 'foo',
                   user_meta_key: 'bar',
                   'x-timestamp': '1.0'}
        req = Request.blank('/v1/a/c', headers=hdrs_in, method='PUT')
        self.storage.container.container_create = Mock()
        req.get_response(self.app)
        meta = \
            self.storage.container.container_create.call_args[1]['properties']
        self.assertEqual(meta[sys_meta_key], 'foo')
        self.assertEqual(meta[user_meta_key], 'bar')

 def test_sys_meta_headers_POST(self):
     # check that headers in sys meta namespace make it through
     # the proxy controller
     sys_meta_key = '%stest' % get_sys_meta_prefix('account')
     sys_meta_key = sys_meta_key.title()
     user_meta_key = 'X-Account-Meta-Test'
     hdrs_in = {sys_meta_key: 'foo',
                user_meta_key: 'bar',
                'x-timestamp': '1.0'}
     req = Request.blank('/v1/a', headers=hdrs_in, method='POST')
     self.storage.account_set_properties = Mock()
     req.get_response(self.app)
     meta = self.storage.account_set_properties.call_args[1]['properties']
     self.assertEqual(meta[sys_meta_key], 'foo')
     self.assertEqual(meta[user_meta_key], 'bar')

 def test_sys_meta_headers_POST(self):
     # check that headers in sys meta namespace make it through
     # the container controller
     sys_meta_key = '%stest' % get_sys_meta_prefix('container')
     sys_meta_key = sys_meta_key.title()
     user_meta_key = 'X-Container-Meta-Test'
     hdrs_in = {sys_meta_key: 'foo',
                user_meta_key: 'bar',
                'x-timestamp': '1.0'}
     req = Request.blank('/v1/a/c', headers=hdrs_in, method='POST')
     self.storage.container.container_set_properties = Mock(
             return_value="")
     req.get_response(self.app)
     meta = self.storage.container.container_set_properties.call_args[0][2]
     self.assertEqual(meta[sys_meta_key], 'foo')
     self.assertEqual(meta[user_meta_key], 'bar')

    def handle_container_request(self, env, start_response):
        app_resp = self._app_call(env)
        if self._response_headers is None:
            self._response_headers = []
        sysmeta_version_hdr = get_sys_meta_prefix('container') + \
            'versions-location'
        location = ''
        for key, val in self._response_headers:
            if key.lower() == sysmeta_version_hdr:
                location = val

        if location:
            self._response_headers.extend([('X-Versions-Location', location)])

        start_response(self._response_status,
                       self._response_headers,
                       self._response_exc_info)
        return app_resp

    def container_request(self, req, start_response, enabled):
        sysmeta_version_hdr = get_sys_meta_prefix('container') + \
            'versions-location'

        # set version location header as sysmeta
        if 'X-Versions-Location' in req.headers:
            val = req.headers.get('X-Versions-Location')
            if val:
                # differently from previous version, we are actually
                # returning an error if user tries to set versions location
                # while feature is explicitly disabled.
                if not config_true_value(enabled) and \
                        req.method in ('PUT', 'POST'):
                    raise HTTPPreconditionFailed(
                        request=req, content_type='text/plain',
                        body='Versioned Writes is disabled')

                location = check_container_format(req, val)
                req.headers[sysmeta_version_hdr] = location

                # reset original header to maintain sanity
                # now only sysmeta is source of Versions Location
                req.headers['X-Versions-Location'] = ''

                # if both headers are in the same request
                # adding location takes precedence over removing
                if 'X-Remove-Versions-Location' in req.headers:
                    del req.headers['X-Remove-Versions-Location']
            else:
                # empty value is the same as X-Remove-Versions-Location
                req.headers['X-Remove-Versions-Location'] = 'x'

        # handle removing versions container
        val = req.headers.get('X-Remove-Versions-Location')
        if val:
            req.headers.update({sysmeta_version_hdr: ''})
            req.headers.update({'X-Versions-Location': ''})
            del req.headers['X-Remove-Versions-Location']

        # send request and translate sysmeta headers from response
        vw_ctx = VersionedWritesContext(self.app, self.logger)
        return vw_ctx.handle_container_request(req.environ, start_response)

 def test_sys_meta_headers_POST(self):
     # check that headers in sys meta namespace make it through
     # the container controller
     sys_meta_key = "%stest" % get_sys_meta_prefix("container")
     sys_meta_key = sys_meta_key.title()
     user_meta_key = "X-Container-Meta-Test"
     controller = proxy_server.ContainerController(self.app, "a", "c")
     context = {}
     callback = self._make_callback_func(context)
     hdrs_in = {sys_meta_key: "foo", user_meta_key: "bar", "x-timestamp": "1.0"}
     req = Request.blank("/v1/a/c", headers=hdrs_in)
     with mock.patch(
         "swift.proxy.controllers.base.http_connect", fake_http_connect(200, 200, give_connect=callback)
     ):
         controller.POST(req)
     self.assertEqual(context["method"], "POST")
     self.assertTrue(sys_meta_key in context["headers"])
     self.assertEqual(context["headers"][sys_meta_key], "foo")
     self.assertTrue(user_meta_key in context["headers"])
     self.assertEqual(context["headers"][user_meta_key], "bar")
     self.assertNotEqual(context["headers"]["x-timestamp"], "1.0")

 def test_sys_meta_headers_POST(self):
     # check that headers in sys meta namespace make it through
     # the proxy controller
     sys_meta_key = '%stest' % get_sys_meta_prefix('account')
     sys_meta_key = sys_meta_key.title()
     user_meta_key = 'X-Account-Meta-Test'
     controller = proxy_server.AccountController(self.app, 'a')
     context = {}
     callback = self._make_callback_func(context)
     hdrs_in = {sys_meta_key: 'foo',
                user_meta_key: 'bar',
                'x-timestamp': '1.0'}
     req = Request.blank('/v1/a', headers=hdrs_in)
     with mock.patch('swift.proxy.controllers.base.http_connect',
                     fake_http_connect(200, 200, give_connect=callback)):
         controller.POST(req)
     self.assertEqual(context['method'], 'POST')
     self.assertTrue(sys_meta_key in context['headers'])
     self.assertEqual(context['headers'][sys_meta_key], 'foo')
     self.assertTrue(user_meta_key in context['headers'])
     self.assertEqual(context['headers'][user_meta_key], 'bar')
     self.assertNotEqual(context['headers']['x-timestamp'], '1.0')

from swift.common.http import HTTP_NOT_FOUND, HTTP_UNAUTHORIZED, is_success
from swift.common.wsgi import WSGIContext, make_subrequest
from swift.common.middleware.bulk import get_response_body, \
    ACCEPTABLE_FORMATS, Bulk


DEFAULT_RATE_LIMIT_UNDER_SIZE = 1024 * 1024  # 1 MiB
DEFAULT_MAX_MANIFEST_SEGMENTS = 1000
DEFAULT_MAX_MANIFEST_SIZE = 1024 * 1024 * 2  # 2 MiB


REQUIRED_SLO_KEYS = set(['path'])
OPTIONAL_SLO_KEYS = set(['range', 'etag', 'size_bytes'])
ALLOWED_SLO_KEYS = REQUIRED_SLO_KEYS | OPTIONAL_SLO_KEYS

SYSMETA_SLO_ETAG = get_sys_meta_prefix('object') + 'slo-etag'
SYSMETA_SLO_SIZE = get_sys_meta_prefix('object') + 'slo-size'


def parse_and_validate_input(req_body, req_path):
    """
    Given a request body, parses it and returns a list of dictionaries.

    The output structure is nearly the same as the input structure, but it
    is not an exact copy. Given a valid input dictionary `d_in`, its
    corresponding output dictionary `d_out` will be as follows:

      * d_out['etag'] == d_in['etag']

      * d_out['path'] == d_in['path']

swift.defaulter_hook
   This is a callback that may be used to populate defaults for subrequests.
   It will only modify PUT requests. It accepts a swob.Request as an argument.
"""
from swift.common.request_helpers import get_sys_meta_prefix
from swift.common.swob import wsgify
from swift.common.utils import config_true_value
from swift.common.utils import register_swift_info
from swift.proxy.controllers.base import get_account_info
from swift.proxy.controllers.base import get_container_info


BLACKLIST = set('x-timestamp')
BLACKLIST_PREFIXES = (
    get_sys_meta_prefix('account'),
    get_sys_meta_prefix('container'),
    get_sys_meta_prefix('object'),
    'x-backend-',
)
CALLBACK_ENV_KEY = 'swift.defaulter_hook'
HEADERS_ENV_KEY = 'swift.defaulter_headers'


class DefaulterMiddleware(object):
    def __init__(self, app, config):
        self.app = app
        self.conf = config

    @wsgify
    def __call__(self, req):

 def sysmeta_to_client(self, resp, req_type):
     prefix = get_sys_meta_prefix(req_type) + 'default-'
     for header, value in resp.headers.items():
         if header.lower().startswith(prefix):
             client_header = 'x-default-%s' % header[len(prefix):]
             resp.headers[client_header] = value