#!@BASH_PATH@
#
# Copyright 2008-2022 the Pacemaker project contributors
#
# The version control history for this file may have further details.
#
# This source code is licensed under the GNU General Public License version 2
# or later (GPLv2+) WITHOUT ANY WARRANTY.
#

# Set the exit status of a command to the exit code of the last program to
# exit non-zero.  This is bash-specific.
set -o pipefail

#
# Note on portable usage of sed: GNU/POSIX/*BSD sed have a limited subset of
# compatible functionality. Do not use the -i option, alternation (\|),
# \0, or character sequences such as \n or \s.
#

USAGE_TEXT="Usage: cts-cli [<options>]
Options:
 --help          Display this text, then exit
 -V, --verbose   Display any differences from expected output
 -t 'TEST [...]' Run only specified tests
                 (default: 'daemons dates error_codes tools crm_mon acls
                            validity upgrade rules feature_set').
                 Other tests: agents (must be run in an installed environment).
 -p DIR          Look for executables in DIR (may be specified multiple times)
 -v, --valgrind  Run all commands under valgrind
 -s              Save actual output as expected output"

# If readlink supports -e (i.e. GNU), use it
readlink -e / >/dev/null 2>/dev/null
if [ $? -eq 0 ]; then
    test_home="$(dirname "$(readlink -e "$0")")"
else
    test_home="$(dirname "$0")"
fi

: ${shadow=cts-cli}
shadow_dir=$(mktemp -d ${TMPDIR:-/tmp}/cts-cli.shadow.XXXXXXXXXX)
num_errors=0
num_passed=0
verbose=0
tests="daemons dates error_codes tools crm_mon acls validity upgrade rules "
tests="$tests feature_set"
do_save=0
XMLLINT_CMD=
VALGRIND_CMD=
VALGRIND_OPTS="
    -q
    --gen-suppressions=all
    --show-reachable=no
    --leak-check=full
    --trace-children=no
    --time-stamp=yes
    --num-callers=20
    --suppressions=$test_home/valgrind-pcmk.suppressions
"

# Temp files for saving a command's stdout/stderr in _test_assert()
test_assert_outfile=$(mktemp ${TMPDIR:-/tmp}/cts-cli.ta_outfile.XXXXXXXXXX)
test_assert_errfile=$(mktemp ${TMPDIR:-/tmp}/cts-cli.ta_errfile.XXXXXXXXXX)
xmllint_outfile=$(mktemp ${TMPDIR:-/tmp}/cts-cli.xmllint_outfile.XXXXXXXXXX)

# Log test errors to stderr
export PCMK_stderr=1

# Output when PCMK_trace_functions is undefined is different from when it's
# empty. Later we save the value of PCMK_trace_functions, do work, and restore
# the original value. Getting back to the initial state is simplest if we assume
# the variable is defined.
: ${PCMK_trace_functions=""}
export PCMK_trace_functions

# These constants must track crm_exit_t values
CRM_EX_OK=0
CRM_EX_ERROR=1
CRM_EX_INVALID_PARAM=2
CRM_EX_UNIMPLEMENT_FEATURE=3
CRM_EX_INSUFFICIENT_PRIV=4
CRM_EX_NOT_CONFIGURED=6
CRM_EX_USAGE=64
CRM_EX_DATAERR=65
CRM_EX_CANTCREAT=73
CRM_EX_CONFIG=78
CRM_EX_OLD=103
CRM_EX_DIGEST=104
CRM_EX_NOSUCH=105
CRM_EX_UNSAFE=107
CRM_EX_EXISTS=108
CRM_EX_MULTIPLE=109
CRM_EX_EXPIRED=110
CRM_EX_NOT_YET_IN_EFFECT=111

reset_shadow_cib_version() {
    local SHADOWPATH

    SHADOWPATH="$(crm_shadow --file)"
    # sed -i isn't portable :-(
    cp -p "$SHADOWPATH" "${SHADOWPATH}.$$" # preserve permissions
    sed -e 's/epoch="[0-9]*"/epoch="1"/g' \
        -e 's/num_updates="[0-9]*"/num_updates="0"/g' \
        -e 's/admin_epoch="[0-9]*"/admin_epoch="0"/g' \
        "$SHADOWPATH" > "${SHADOWPATH}.$$"
    mv -- "${SHADOWPATH}.$$" "$SHADOWPATH"
}

# A newly created empty CIB might or might not have a rsc_defaults section
# depending on whether the --with-resource-stickiness-default configure
# option was used. To ensure regression tests behave the same either way,
# delete any rsc_defaults after creating or erasing a CIB.
delete_shadow_resource_defaults() {
    cibadmin --delete --xml-text '<rsc_defaults/>'

    # The above command might or might not bump the CIB version, so reset it
    # to ensure future changes result in the same version for comparison.
    reset_shadow_cib_version
}

create_shadow_cib() {
    local VALIDATE_WITH
    local SHADOW_CMD

    CREATE_ARG="$1"
    VALIDATE_WITH="$2"

    export CIB_shadow_dir="${shadow_dir}"

    SHADOW_CMD="$VALGRIND_CMD crm_shadow --batch --force $CREATE_ARG"
    if [ -z "$VALIDATE_WITH" ]; then
        $SHADOW_CMD "$shadow" 2>&1
    else
        $SHADOW_CMD "$shadow" --validate-with="${VALIDATE_WITH}" 2>&1
    fi

    export CIB_shadow="$shadow"
    delete_shadow_resource_defaults
}

function _test_assert() {
    target=$1; shift
    validate=$1; shift
    cib=$1; shift
    app=`echo "$cmd" | sed 's/\ .*//'`
    printf "* Running: $app - $desc\n" 1>&2

    printf "=#=#=#= Begin test: $desc =#=#=#=\n"

    # Capture stderr and stdout separately, then print them consecutively
    eval $VALGRIND_CMD $cmd > "$test_assert_outfile" 2> "$test_assert_errfile"
    rc=$?
    cat "$test_assert_errfile"
    cat "$test_assert_outfile"

    if [ x$cib != x0 ]; then
        printf "=#=#=#= Current cib after: $desc =#=#=#=\n"
        CIB_user=root cibadmin -Q
    fi

    # Do not validate if running under valgrind, even if told to do so.  Valgrind
    # will output a lot more stuff that is not XML, so it wouldn't validate anyway.
    if [ "$validate" = "1" ] && [ "$VALGRIND_CMD" = "" ] && [ $rc = 0 ] && [ "$XMLLINT_CMD" != "" ]; then
        # The sed command filters out the "- validates" line that xmllint will output
        # on success.  grep cannot be used here because "grep -v 'validates$'" will
        # return an exit code of 1 if its input consists entirely of "- validates".
        $XMLLINT_CMD --noout --relaxng \
            "$PCMK_schema_directory/api/api-result.rng" "$test_assert_outfile" \
            > "$xmllint_outfile" 2>&1
        rc=$?

        sed -n '/validates$/ !p' "$xmllint_outfile"

        if [ $rc = 0 ]; then
            printf "=#=#=#= End test: %s - $(crm_error --exit $rc) (%d) =#=#=#=\n" "$desc" $rc
        else
            printf "=#=#=#= End test: %s - Failed to validate (%d) =#=#=#=\n" "$desc" $rc
        fi
    else
        printf "=#=#=#= End test: %s - $(crm_error --exit $rc) (%d) =#=#=#=\n" "$desc" $rc
    fi

    if [ $rc -ne $target ]; then
        num_errors=$(( $num_errors + 1 ))
        printf "* Failed (rc=%.3d): %-14s - %s\n" $rc $app "$desc"
        printf "* Failed (rc=%.3d): %-14s - %s\n" $rc $app "$desc (`which $app`)" 1>&2
        return
        exit $CRM_EX_ERROR
    else
        printf "* Passed: %-14s - %s\n" $app "$desc"
        num_passed=$(( $num_passed + 1 ))
    fi
}

function test_assert() {
    _test_assert $1 0 $2
}

function test_assert_validate() {
    _test_assert $1 1 $2
}

# Tests that depend on resource agents and must be run in an installed
# environment
function test_agents() {
    desc="Validate a valid resource configuration"
    cmd="crm_resource --validate --class ocf --provider pacemaker --agent Dummy"
    test_assert $CRM_EX_OK 0

    desc="Validate a valid resource configuration (XML)"
    cmd="crm_resource --validate --class ocf --provider pacemaker --agent Dummy"
    cmd="$cmd --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    # Make the Dummy configuration invalid (op_sleep can't be a generic string)
    export OCF_RESKEY_op_sleep=asdf

    desc="Validate an invalid resource configuration"
    cmd="crm_resource --validate --class ocf --provider pacemaker --agent Dummy"
    test_assert $CRM_EX_NOT_CONFIGURED 0

    desc="Validate an invalid resource configuration (XML)"
    cmd="crm_resource --validate --class ocf --provider pacemaker --agent Dummy"
    cmd="$cmd --output-as=xml"
    test_assert_validate $CRM_EX_NOT_CONFIGURED 0

    unset OCF_RESKEY_op_sleep
    export OCF_RESKEY_op_sleep
}

function test_daemons() {
    desc="Get CIB manager metadata"
    cmd="pacemaker-based metadata"
    test_assert $CRM_EX_OK 0

    desc="Get controller metadata"
    cmd="pacemaker-controld metadata"
    test_assert $CRM_EX_OK 0

    desc="Get fencer metadata"
    cmd="pacemaker-fenced metadata"
    test_assert $CRM_EX_OK 0

    desc="Get scheduler metadata"
    cmd="pacemaker-schedulerd metadata"
    test_assert $CRM_EX_OK 0
}

function test_crm_mon() {
    local TMPXML
    export CIB_file="$test_home/cli/crm_mon.xml"

    desc="Basic text output"
    cmd="crm_mon -1"
    test_assert $CRM_EX_OK 0

    desc="XML output"
    cmd="crm_mon --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    desc="Basic text output without node section"
    cmd="crm_mon -1 --exclude=nodes"
    test_assert $CRM_EX_OK 0

    desc="XML output without the node section"
    cmd="crm_mon --output-as=xml --exclude=nodes"
    test_assert_validate $CRM_EX_OK 0

    desc="Text output with only the node section"
    cmd="crm_mon -1 --exclude=all --include=nodes"
    test_assert $CRM_EX_OK 0

    # The above test doesn't need to be performed for other output formats.  It's
    # really just a test to make sure that blank lines are correct.

    desc="Complete text output"
    cmd="crm_mon -1 --include=all"
    test_assert $CRM_EX_OK 0

    # XML includes everything already so there's no need for a complete test

    desc="Complete text output with detail"
    cmd="crm_mon -1R --include=all"
    test_assert $CRM_EX_OK 0

    # XML includes detailed output already

    desc="Complete brief text output"
    cmd="crm_mon -1 --include=all --brief"
    test_assert $CRM_EX_OK 0

    desc="Complete text output grouped by node"
    cmd="crm_mon -1 --include=all --group-by-node"
    test_assert $CRM_EX_OK 0

    # XML does not have a brief output option

    desc="Complete brief text output grouped by node"
    cmd="crm_mon -1 --include=all --group-by-node --brief"
    test_assert $CRM_EX_OK 0

    desc="XML output grouped by node"
    cmd="crm_mon -1 --output-as=xml --group-by-node"
    test_assert_validate $CRM_EX_OK 0

    desc="Complete text output filtered by node"
    cmd="crm_mon -1 --include=all --node=cluster01"
    test_assert $CRM_EX_OK 0

    desc="XML output filtered by node"
    cmd="crm_mon --output-as xml --include=all --node=cluster01"
    test_assert_validate $CRM_EX_OK 0

    desc="Complete text output filtered by tag"
    cmd="crm_mon -1 --include=all --node=even-nodes"
    test_assert $CRM_EX_OK 0

    desc="XML output filtered by tag"
    cmd="crm_mon --output-as=xml --include=all --node=even-nodes"
    test_assert_validate $CRM_EX_OK 0

    desc="Complete text output filtered by resource tag"
    cmd="crm_mon -1 --include=all --resource=fencing-rscs"
    test_assert $CRM_EX_OK 0

    desc="XML output filtered by resource tag"
    cmd="crm_mon --output-as=xml --include=all --resource=fencing-rscs"
    test_assert_validate $CRM_EX_OK 0

    desc="Basic text output filtered by node that doesn't exist"
    cmd="crm_mon -1 --node=blah"
    test_assert $CRM_EX_OK 0

    desc="XML output filtered by node that doesn't exist"
    cmd="crm_mon --output-as=xml --node=blah"
    test_assert_validate $CRM_EX_OK 0

    desc="Basic text output with inactive resources"
    cmd="crm_mon -1 -r"
    test_assert $CRM_EX_OK 0

    # XML already includes inactive resources

    desc="Basic text output with inactive resources, filtered by node"
    cmd="crm_mon -1 -r --node=cluster02"
    test_assert $CRM_EX_OK 0

    # XML already includes inactive resources

    desc="Complete text output filtered by primitive resource"
    cmd="crm_mon -1 --include=all --resource=Fencing"
    test_assert $CRM_EX_OK 0

    desc="XML output filtered by primitive resource"
    cmd="crm_mon --output-as=xml --resource=Fencing"
    test_assert_validate $CRM_EX_OK 0

    desc="Complete text output filtered by group resource"
    cmd="crm_mon -1 --include=all --resource=exim-group"
    test_assert $CRM_EX_OK 0

    desc="XML output filtered by group resource"
    cmd="crm_mon --output-as=xml --resource=exim-group"
    test_assert_validate $CRM_EX_OK 0

    desc="Complete text output filtered by group resource member"
    cmd="crm_mon -1 --include=all --resource=Public-IP"
    test_assert $CRM_EX_OK 0

    desc="XML output filtered by group resource member"
    cmd="crm_mon --output-as=xml --resource=Email"
    test_assert_validate $CRM_EX_OK 0

    desc="Complete text output filtered by clone resource"
    cmd="crm_mon -1 --include=all --resource=ping-clone"
    test_assert $CRM_EX_OK 0

    desc="XML output filtered by clone resource"
    cmd="crm_mon --output-as=xml --resource=ping-clone"
    test_assert_validate $CRM_EX_OK 0

    desc="Complete text output filtered by clone resource instance"
    cmd="crm_mon -1 --include=all --resource=ping"
    test_assert $CRM_EX_OK 0

    desc="XML output filtered by clone resource instance"
    cmd="crm_mon --output-as=xml --resource=ping"
    test_assert_validate $CRM_EX_OK 0

    desc="Complete text output filtered by exact clone resource instance"
    cmd="crm_mon -1 --include=all --show-detail --resource=ping:0"
    test_assert $CRM_EX_OK 0

    desc="XML output filtered by exact clone resource instance"
    cmd="crm_mon --output-as=xml --resource=ping:1"
    test_assert_validate $CRM_EX_OK 0

    desc="Basic text output filtered by resource that doesn't exist"
    cmd="crm_mon -1 --resource=blah"
    test_assert $CRM_EX_OK 0

    desc="XML output filtered by resource that doesn't exist"
    cmd="crm_mon --output-as=xml --resource=blah"
    test_assert_validate $CRM_EX_OK 0

    desc="Basic text output with inactive resources, filtered by tag"
    cmd="crm_mon -1 -r --resource=inactive-rscs"
    test_assert $CRM_EX_OK 0

    desc="Basic text output with inactive resources, filtered by bundle resource"
    cmd="crm_mon -1 -r --resource=httpd-bundle"
    test_assert $CRM_EX_OK 0

    desc="XML output filtered by inactive bundle resource"
    cmd="crm_mon --output-as=xml --resource=httpd-bundle"
    test_assert_validate $CRM_EX_OK 0

    desc="Basic text output with inactive resources, filtered by bundled IP address resource"
    cmd="crm_mon -1 -r --resource=httpd-bundle-ip-192.168.122.131"
    test_assert $CRM_EX_OK 0

    desc="XML output filtered by bundled IP address resource"
    cmd="crm_mon --output-as=xml --resource=httpd-bundle-ip-192.168.122.132"
    test_assert_validate $CRM_EX_OK 0

    desc="Basic text output with inactive resources, filtered by bundled container"
    cmd="crm_mon -1 -r --resource=httpd-bundle-docker-1"
    test_assert $CRM_EX_OK 0

    desc="XML output filtered by bundled container"
    cmd="crm_mon --output-as=xml --resource=httpd-bundle-docker-2"
    test_assert_validate $CRM_EX_OK 0

    desc="Basic text output with inactive resources, filtered by bundle connection"
    cmd="crm_mon -1 -r --resource=httpd-bundle-0"
    test_assert $CRM_EX_OK 0

    desc="XML output filtered by bundle connection"
    cmd="crm_mon --output-as=xml --resource=httpd-bundle-0"
    test_assert_validate $CRM_EX_OK 0

    desc="Basic text output with inactive resources, filtered by bundled primitive resource"
    cmd="crm_mon -1 -r --resource=httpd"
    test_assert $CRM_EX_OK 0

    desc="XML output filtered by bundled primitive resource"
    cmd="crm_mon --output-as=xml --resource=httpd"
    test_assert_validate $CRM_EX_OK 0

    desc="Complete text output, filtered by clone name in cloned group"
    cmd="crm_mon -1 --include=all --show-detail --resource=mysql-clone-group"
    test_assert $CRM_EX_OK 0

    desc="XML output, filtered by clone name in cloned group"
    cmd="crm_mon --output-as=xml --resource=mysql-clone-group"
    test_assert_validate $CRM_EX_OK 0

    desc="Complete text output, filtered by group name in cloned group"
    cmd="crm_mon -1 --include=all --show-detail --resource=mysql-group"
    test_assert $CRM_EX_OK 0

    desc="XML output, filtered by group name in cloned group"
    cmd="crm_mon --output-as=xml --resource=mysql-group"
    test_assert_validate $CRM_EX_OK 0

    desc="Complete text output, filtered by exact group instance name in cloned group"
    cmd="crm_mon -1 --include=all --show-detail --resource=mysql-group:1"
    test_assert $CRM_EX_OK 0

    desc="XML output, filtered by exact group instance name in cloned group"
    cmd="crm_mon --output-as=xml --resource=mysql-group:1"
    test_assert_validate $CRM_EX_OK 0

    desc="Complete text output, filtered by primitive name in cloned group"
    cmd="crm_mon -1 --include=all --show-detail --resource=mysql-proxy"
    test_assert $CRM_EX_OK 0

    desc="XML output, filtered by primitive name in cloned group"
    cmd="crm_mon --output-as=xml --resource=mysql-proxy"
    test_assert_validate $CRM_EX_OK 0

    desc="Complete text output, filtered by exact primitive instance name in cloned group"
    cmd="crm_mon -1 --include=all --show-detail --resource=mysql-proxy:1"
    test_assert $CRM_EX_OK 0

    desc="XML output, filtered by exact primitive instance name in cloned group"
    cmd="crm_mon --output-as=xml --resource=mysql-proxy:1"
    test_assert_validate $CRM_EX_OK 0

    unset CIB_file

    export CIB_file="$test_home/cli/crm_mon-partial.xml"

    desc="Text output of partially active resources"
    cmd="crm_mon -1 --show-detail"
    test_assert $CRM_EX_OK 0

    desc="XML output of partially active resources"
    cmd="crm_mon -1 --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    desc="Text output of partially active resources, with inactive resources"
    cmd="crm_mon -1 -r --show-detail"
    test_assert $CRM_EX_OK 0

    # XML already includes inactive resources

    desc="Complete brief text output, with inactive resources"
    cmd="crm_mon -1 -r --include=all --brief --show-detail"
    test_assert $CRM_EX_OK 0

    # XML does not have a brief output option

    desc="Text output of partially active group"
    cmd="crm_mon -1 --resource=partially-active-group"
    test_assert $CRM_EX_OK 0

    desc="Text output of partially active group, with inactive resources"
    cmd="crm_mon -1 --resource=partially-active-group -r"
    test_assert $CRM_EX_OK 0

    desc="Text output of active member of partially active group"
    cmd="crm_mon -1 --resource=dummy-1"
    test_assert $CRM_EX_OK 0

    desc="Text output of inactive member of partially active group"
    cmd="crm_mon -1 --resource=dummy-2 --show-detail"
    test_assert $CRM_EX_OK 0

    desc="Complete brief text output grouped by node, with inactive resources"
    cmd="crm_mon -1 -r --include=all --group-by-node --brief --show-detail"
    test_assert $CRM_EX_OK 0

    desc="Text output of partially active resources, with inactive resources, filtered by node"
    cmd="crm_mon -1 -r --node=cluster01"
    test_assert $CRM_EX_OK 0

    desc="Text output of partially active resources, filtered by node"
    cmd="crm_mon -1 --output-as=xml --node=cluster01"
    test_assert_validate $CRM_EX_OK 0

    unset CIB_file

    export CIB_file="$test_home/cli/crm_mon-unmanaged.xml"

    desc="Text output of active unmanaged resource on offline node"
    cmd="crm_mon -1"
    test_assert $CRM_EX_OK 0

    desc="XML output of active unmanaged resource on offline node"
    cmd="crm_mon -1 --output-as=xml"
    test_assert $CRM_EX_OK 0

    desc="Brief text output of active unmanaged resource on offline node"
    cmd="crm_mon -1 --brief"
    test_assert $CRM_EX_OK 0

    desc="Brief text output of active unmanaged resource on offline node, grouped by node"
    cmd="crm_mon -1 --brief --group-by-node"
    test_assert $CRM_EX_OK 0

    # Maintenance mode tests

    export CIB_file=$(mktemp ${TMPDIR:-/tmp}/cts-cli.crm_mon.xml.XXXXXXXXXX)
    cp "$test_home/cli/crm_mon.xml" "$CIB_file"

    crm_attribute -n maintenance-mode -v true

    desc="Text output of all resources with maintenance-mode enabled"
    cmd="crm_mon -1 -r"
    test_assert $CRM_EX_OK 0

    desc="XML output of all resources with maintenance-mode enabled"
    cmd="crm_mon -1 -r --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    crm_attribute -n maintenance-mode -v false

    crm_attribute -n maintenance -N cluster02 -v true

    desc="Text output of all resources with maintenance enabled for a node"
    cmd="crm_mon -1 -r"
    test_assert $CRM_EX_OK 0

    desc="XML output of all resources with maintenance enabled for a node"
    cmd="crm_mon -1 -r --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    rm -f "$CIB_file"
    unset CIB_file

    export CIB_file="$test_home/cli/crm_mon-rsc-maint.xml"

    # The fence resource is excluded, for comparison
    desc="Text output of all resources with maintenance meta attribute true"
    cmd="crm_mon -1 -r"
    test_assert $CRM_EX_OK 0

    desc="XML output of all resources with maintenance meta attribute true"
    cmd="crm_mon -1 -r --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    unset CIB_file

    export CIB_file="$test_home/cli/crm_mon-T180.xml"

    desc="Text output of guest node's container on different node from its"
    desc="$desc remote resource"
    cmd="crm_mon -1"
    test_assert $CRM_EX_OK 0

    desc="Complete text output of guest node's container on different node from"
    desc="$desc its remote resource"
    cmd="crm_mon -1 --show-detail"
    test_assert $CRM_EX_OK 0

    unset CIB_file
}

function test_error_codes() {
    # Note: At the time of this writing, crm_error returns success even for
    # unknown error codes. We don't want to cause a regression by changing that.

    # Due to the way _test_assert() formats output, we need "crm_error" to be
    # the first token of cmd. We can't start with a parenthesis or variable
    # assignment. However, in the "list result codes" tests, we also need to
    # save some output for later processing. We'll use a temp file for this.
    local TMPFILE
    TMPFILE=$(mktemp ${TMPDIR:-/tmp}/cts-cli.crm_error_out.XXXXXXXXXX)

    # Legacy return codes
    #
    # Don't test unknown legacy code. FreeBSD includes a colon in strerror(),
    # while other distros do not.
    desc="Get legacy return code"
    cmd="crm_error -- 201"
    test_assert $CRM_EX_OK 0

    desc="Get legacy return code (XML)"
    cmd="crm_error --output-as=xml -- 201"
    test_assert_validate $CRM_EX_OK 0

    desc="Get legacy return code (with name)"
    cmd="crm_error -n -- 201"
    test_assert $CRM_EX_OK 0

    desc="Get legacy return code (with name) (XML)"
    cmd="crm_error -n --output-as=xml -- 201"
    test_assert_validate $CRM_EX_OK 0

    desc="Get multiple legacy return codes"
    cmd="crm_error -- 201 202"
    test_assert $CRM_EX_OK 0

    desc="Get multiple legacy return codes (XML)"
    cmd="crm_error --output-as=xml -- 201 202"
    test_assert_validate $CRM_EX_OK 0

    desc="Get multiple legacy return codes (with names)"
    cmd="crm_error -n -- 201 202"
    test_assert $CRM_EX_OK 0

    desc="Get multiple legacy return codes (with names) (XML)"
    cmd="crm_error -n --output-as=xml -- 201 202"
    test_assert_validate $CRM_EX_OK 0

    # We can only rely on our custom codes, so we'll spot-check codes 201-209
    desc="List legacy return codes (spot check)"
    cmd="crm_error -l | grep 20[1-9]"
    test_assert $CRM_EX_OK 0

    desc="List legacy return codes (spot check) (XML)"
    cmd="crm_error -l --output-as=xml > $TMPFILE; rc=$?"
    cmd="$cmd; grep -Ev '<result-code.*code=\"([^2]|2[^0]|20[^1-9])' $TMPFILE"
    cmd="$cmd; (exit $rc)"
    test_assert_validate $CRM_EX_OK 0

    desc="List legacy return codes (spot check) (with names)"
    cmd="crm_error -n -l | grep 20[1-9]"
    test_assert $CRM_EX_OK 0

    desc="List legacy return codes (spot check) (with names) (XML)"
    cmd="crm_error -n -l --output-as=xml > $TMPFILE; rc=$?"
    cmd="$cmd; grep -Ev '<result-code.*code=\"([^2]|2[^0]|20[^1-9])' $TMPFILE"
    cmd="$cmd; (exit $rc)"
    test_assert_validate $CRM_EX_OK 0

    # Standard Pacemaker return codes
    #
    # Don't test positive (system) error codes, which may vary by OS

    desc="Get unknown Pacemaker return code"
    cmd="crm_error -r -- -10000"
    test_assert $CRM_EX_OK 0

    desc="Get unknown Pacemaker return code (XML)"
    cmd="crm_error -r --output-as=xml -- -10000"
    test_assert_validate $CRM_EX_OK 0

    desc="Get unknown Pacemaker return code (with name)"
    cmd="crm_error -n -r -- -10000"
    test_assert $CRM_EX_OK 0

    desc="Get unknown Pacemaker return code (with name) (XML)"
    cmd="crm_error -n -r --output-as=xml -- -10000"
    test_assert_validate $CRM_EX_OK 0

    # Negative return codes require parsing out the "--" explicitly, so we need
    # to test them as a separate case
    desc="Get negative Pacemaker return code"
    cmd="crm_error -r -- -1005"
    test_assert $CRM_EX_OK 0

    desc="Get negative Pacemaker return code (XML)"
    cmd="crm_error -r --output-as=xml -- -1005"
    test_assert_validate $CRM_EX_OK 0

    # Testing name lookups for negative return codes only is sufficient
    desc="Get negative Pacemaker return code (with name)"
    cmd="crm_error -n -r -- -1005"
    test_assert $CRM_EX_OK 0

    desc="Get negative Pacemaker return code (with name) (XML)"
    cmd="crm_error -n -r --output-as=xml -- -1005"
    test_assert_validate $CRM_EX_OK 0

    # We can only rely on our custom codes (negative and zero)
    desc="List Pacemaker return codes (non-positive)"
    cmd="crm_error -l -r | grep -E '^[[:blank:]]*(-[[:digit:]]+|0):'"
    test_assert $CRM_EX_OK 0

    desc="List Pacemaker return codes (non-positive) (XML)"
    cmd="crm_error -l -r --output-as=xml > $TMPFILE; rc=$?"
    cmd="$cmd; grep -E -v '<result-code.*code=\"[[:digit:]]' $TMPFILE"
    cmd="$cmd; (exit $rc)"
    test_assert_validate $CRM_EX_OK 0

    desc="List Pacemaker return codes (non-positive) (with names)"
    cmd="crm_error -n -l -r | grep -E '^[[:blank:]]*(-[[:digit:]]+|0):'"
    test_assert $CRM_EX_OK 0

    desc="List Pacemaker return codes (non-positive) (with names) (XML)"
    cmd="crm_error -n -l -r --output-as=xml > $TMPFILE; rc=$?"
    cmd="$cmd; grep -E -v '<result-code.*code=\"[[:digit:]]' $TMPFILE"
    cmd="$cmd; (exit $rc)"
    test_assert_validate $CRM_EX_OK 0

    # crm_exit_t exit codes

    desc="Get unknown crm_exit_t exit code"
    cmd="crm_error -X -- -10000"
    test_assert $CRM_EX_OK 0

    desc="Get unknown crm_exit_t exit code (XML)"
    cmd="crm_error -X --output-as=xml -- -10000"
    test_assert_validate $CRM_EX_OK 0

    desc="Get unknown crm_exit_t exit code (with name)"
    cmd="crm_error -n -X -- -10000"
    test_assert $CRM_EX_OK 0

    desc="Get unknown crm_exit_t exit code (with name) (XML)"
    cmd="crm_error -n -X --output-as=xml -- -10000"
    test_assert_validate $CRM_EX_OK 0

    desc="Get crm_exit_t exit code"
    cmd="crm_error -X -- 1"
    test_assert $CRM_EX_OK 0

    desc="Get crm_exit_t exit code (XML)"
    cmd="crm_error -X --output-as=xml -- 1"
    test_assert_validate $CRM_EX_OK 0

    desc="Get crm_exit_t exit code (with name)"
    cmd="crm_error -n -X -- 1"
    test_assert $CRM_EX_OK 0

    desc="Get crm_exit_t exit code (with name) (XML)"
    cmd="crm_error -n -X --output-as=xml -- 1"
    test_assert_validate $CRM_EX_OK 0

    desc="Get all crm_exit_t exit codes"
    cmd="crm_error -l -X"
    test_assert $CRM_EX_OK 0

    desc="Get all crm_exit_t exit codes (XML)"
    cmd="crm_error -l -X --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    desc="Get all crm_exit_t exit codes (with name)"
    cmd="crm_error -l -n -X"
    test_assert $CRM_EX_OK 0

    desc="Get all crm_exit_t exit codes (with name) (XML)"
    cmd="crm_error -l -n -X --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    rm -f "$TMPFILE"
}

function test_tools() {
    local TMPXML
    local TMPORIG

    TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
    TMPORIG=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.existing.xml.XXXXXXXXXX)

    create_shadow_cib --create-empty

    desc="Validate CIB"
    cmd="cibadmin -Q"
    test_assert $CRM_EX_OK

    desc="Query the value of an attribute that does not exist"
    cmd="crm_attribute -n ABCD --query --quiet"
    test_assert $CRM_EX_NOSUCH 0

    desc="Configure something before erasing"
    cmd="crm_attribute -n cluster-delay -v 60s"
    test_assert $CRM_EX_OK

    desc="Require --force for CIB erasure"
    cmd="cibadmin -E"
    test_assert $CRM_EX_UNSAFE

    desc="Allow CIB erasure with --force"
    cmd="cibadmin -E --force"
    test_assert $CRM_EX_OK 0

    # Skip outputting the resulting CIB in the previous command, and delete
    # rsc_defaults now, so tests behave the same regardless of build options.
    delete_shadow_resource_defaults

    # Verify the output after erasure
    desc="Query CIB"
    cmd="cibadmin -Q"
    test_assert $CRM_EX_OK

    # Save a copy of the CIB for a later test
    cibadmin -Q > "$TMPORIG"

    desc="Set cluster option"
    cmd="crm_attribute -n cluster-delay -v 60s"
    test_assert $CRM_EX_OK

    desc="Query new cluster option"
    cmd="cibadmin -Q -o crm_config | grep cib-bootstrap-options-cluster-delay"
    test_assert $CRM_EX_OK

    desc="Query cluster options"
    cmd="cibadmin -Q -o crm_config > $TMPXML"
    test_assert $CRM_EX_OK

    desc="Set no-quorum policy"
    cmd="crm_attribute -n no-quorum-policy -v ignore"
    test_assert $CRM_EX_OK

    desc="Delete nvpair"
    cmd="cibadmin -D -o crm_config --xml-text '<nvpair id=\"cib-bootstrap-options-cluster-delay\"/>'"
    test_assert $CRM_EX_OK

    desc="Create operation should fail"
    cmd="cibadmin -C -o crm_config --xml-file $TMPXML"
    test_assert $CRM_EX_EXISTS

    desc="Modify cluster options section"
    cmd="cibadmin -M -o crm_config --xml-file $TMPXML"
    test_assert $CRM_EX_OK

    desc="Query updated cluster option"
    cmd="cibadmin -Q -o crm_config | grep cib-bootstrap-options-cluster-delay"
    test_assert $CRM_EX_OK

    desc="Set duplicate cluster option"
    cmd="crm_attribute -n cluster-delay -v 40s -s duplicate"
    test_assert $CRM_EX_OK

    desc="Setting multiply defined cluster option should fail"
    cmd="crm_attribute -n cluster-delay -v 30s"
    test_assert $CRM_EX_MULTIPLE

    desc="Set cluster option with -s"
    cmd="crm_attribute -n cluster-delay -v 30s -s duplicate"
    test_assert $CRM_EX_OK

    desc="Delete cluster option with -i"
    cmd="crm_attribute -n cluster-delay -D -i cib-bootstrap-options-cluster-delay"
    test_assert $CRM_EX_OK

    desc="Create node1 and bring it online"
    cmd="crm_simulate --live-check --in-place --node-up=node1"
    test_assert $CRM_EX_OK

    desc="Create node attribute"
    cmd="crm_attribute -n ram -v 1024M -N node1 -t nodes"
    test_assert $CRM_EX_OK

    desc="Query new node attribute"
    cmd="cibadmin -Q -o nodes | grep node1-ram"
    test_assert $CRM_EX_OK

    desc="Create second node attribute"
    cmd="crm_attribute -n rattr -v XYZ -N node1 -t nodes"
    test_assert $CRM_EX_OK

    desc="Query node attributes by pattern"
    cmd="crm_attribute -t nodes -P 'ra.*' -N node1 --query"
    test_assert $CRM_EX_OK 0

    desc="Update node attributes by pattern"
    cmd="crm_attribute -t nodes -P 'rat.*' -N node1 -v 10"
    test_assert $CRM_EX_OK

    desc="Delete node attributes by pattern"
    cmd="crm_attribute -t nodes -P 'rat.*' -N node1 -D"
    test_assert $CRM_EX_OK

    desc="Set a transient (fail-count) node attribute"
    cmd="crm_attribute -n fail-count-foo -v 3 -N node1 -t status"
    test_assert $CRM_EX_OK

    desc="Query a fail count"
    cmd="crm_failcount --query -r foo -N node1"
    test_assert $CRM_EX_OK

    desc="Show node attributes with crm_simulate"
    cmd="crm_simulate --live-check --show-attrs"
    test_assert $CRM_EX_OK 0

    desc="Set a second transient node attribute"
    cmd="crm_attribute -n fail-count-bar -v 5 -N node1 -t status"
    test_assert $CRM_EX_OK

    desc="Query transient node attributes by pattern"
    cmd="crm_attribute -t status -P fail-count -N node1 --query"
    test_assert $CRM_EX_OK 0

    desc="Update transient node attributes by pattern"
    cmd="crm_attribute -t status -P fail-count -N node1 -v 10"
    test_assert $CRM_EX_OK

    desc="Delete transient node attributes by pattern"
    cmd="crm_attribute -t status -P fail-count -N node1 -D"
    test_assert $CRM_EX_OK

    desc="crm_attribute given invalid delete usage"
    cmd="crm_attribute -t nodes -N node1 -D"
    test_assert $CRM_EX_USAGE 0

    desc="Set a utilization node attribute"
    cmd="crm_attribute -n cpu -v 1 -N node1 -z"
    test_assert $CRM_EX_OK

    desc="Query utilization node attribute"
    cmd="crm_attribute --query -n cpu -N node1 -z"
    test_assert $CRM_EX_OK 0

    desc="Digest calculation"
    cmd="cibadmin -Q | cibadmin -5 -p 2>&1 > /dev/null"
    test_assert $CRM_EX_OK

    # This update will fail because it has version numbers
    desc="Replace operation should fail"
    cmd="cibadmin -R --xml-file $TMPORIG"
    test_assert $CRM_EX_OLD

    desc="Default standby value"
    cmd="crm_standby -N node1 -G"
    test_assert $CRM_EX_OK

    desc="Set standby status"
    cmd="crm_standby -N node1 -v true"
    test_assert $CRM_EX_OK

    desc="Query standby value"
    cmd="crm_standby -N node1 -G"
    test_assert $CRM_EX_OK

    desc="Delete standby value"
    cmd="crm_standby -N node1 -D"
    test_assert $CRM_EX_OK

    desc="Create a resource"
    cmd="cibadmin -C -o resources --xml-text '<primitive id=\"dummy\" class=\"ocf\" provider=\"pacemaker\" type=\"Dummy\"/>'"
    test_assert $CRM_EX_OK

    desc="crm_resource run with extra arguments"
    cmd="crm_resource foo bar"
    test_assert $CRM_EX_USAGE 0

    desc="crm_resource given both -r and resource config"
    cmd="crm_resource -r xyz --class ocf --provider pacemaker --agent Dummy"
    test_assert $CRM_EX_USAGE 0

    desc="crm_resource given resource config with invalid action"
    cmd="crm_resource --class ocf --provider pacemaker --agent Dummy -D"
    test_assert $CRM_EX_USAGE 0

    desc="Create a resource meta attribute"
    cmd="crm_resource -r dummy --meta -p is-managed -v false"
    test_assert $CRM_EX_OK

    desc="Query a resource meta attribute"
    cmd="crm_resource -r dummy --meta -g is-managed"
    test_assert $CRM_EX_OK

    desc="Remove a resource meta attribute"
    cmd="crm_resource -r dummy --meta -d is-managed"
    test_assert $CRM_EX_OK

    desc="Create another resource meta attribute"
    cmd="crm_resource -r dummy --meta -p target-role -v Stopped --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    desc="Show why a resource is not running"
    cmd="crm_resource -Y -r dummy --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    desc="Remove another resource meta attribute"
    cmd="crm_resource -r dummy --meta -d target-role --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    desc="Get a non-existent attribute from a resource element with output-as=xml"
    cmd="crm_resource -r dummy --get-parameter nonexistent --element --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    desc="Get a non-existent attribute from a resource element without output-as=xml"
    cmd="crm_resource -r dummy --get-parameter nonexistent --element"
    test_assert $CRM_EX_OK

    desc="Get an existent attribute from a resource element with output-as=xml"
    cmd="crm_resource -r dummy --get-parameter class --element --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    desc="Get an existent attribute from a resource element without output-as=xml"
    cmd="crm_resource -r dummy --get-parameter class --element"
    test_assert $CRM_EX_OK

    desc="Set a non-existent attribute for a resource element with output-as=xml"
    cmd="crm_resource -r dummy --set-parameter=description -v test_description --element --output-as=xml"
    test_assert $CRM_EX_OK

    desc="Set an existent attribute for a resource element with output-as=xml"
    cmd="crm_resource -r dummy --set-parameter=description -v test_description --element --output-as=xml"
    test_assert $CRM_EX_OK

    desc="Delete an existent attribute for a resource element with output-as=xml"
    cmd="crm_resource -r dummy -d description --element --output-as=xml"
    test_assert $CRM_EX_OK

    desc="Delete a non-existent attribute for a resource element with output-as=xml"
    cmd="crm_resource -r dummy -d description --element --output-as=xml"
    test_assert $CRM_EX_OK

    desc="Set a non-existent attribute for a resource element without output-as=xml"
    cmd="crm_resource -r dummy --set-parameter=description -v test_description --element"
    test_assert $CRM_EX_OK

    desc="Set an existent attribute for a resource element without output-as=xml"
    cmd="crm_resource -r dummy --set-parameter=description -v test_description --element"
    test_assert $CRM_EX_OK

    desc="Delete an existent attribute for a resource element without output-as=xml"
    cmd="crm_resource -r dummy -d description --element"
    test_assert $CRM_EX_OK

    desc="Delete a non-existent attribute for a resource element without output-as=xml"
    cmd="crm_resource -r dummy -d description --element"
    test_assert $CRM_EX_OK

    desc="Create a resource attribute"
    cmd="crm_resource -r dummy -p delay -v 10s"
    test_assert $CRM_EX_OK

    desc="List the configured resources"
    cmd="crm_resource -L"
    test_assert $CRM_EX_OK

    desc="List the configured resources in XML"
    cmd="crm_resource -L --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    desc="Implicitly list the configured resources"
    cmd="crm_resource"
    test_assert $CRM_EX_OK 0

    desc="List IDs of instantiated resources"
    cmd="crm_resource -l"
    test_assert $CRM_EX_OK 0

    desc="Show XML configuration of resource"
    cmd="crm_resource -q -r dummy"
    test_assert $CRM_EX_OK 0

    desc="Show XML configuration of resource, output as XML"
    cmd="crm_resource -q -r dummy --output-as=xml"
    test_assert $CRM_EX_OK 0

    desc="Require a destination when migrating a resource that is stopped"
    cmd="crm_resource -r dummy -M"
    test_assert $CRM_EX_USAGE

    desc="Don't support migration to non-existent locations"
    cmd="crm_resource -r dummy -M -N i.do.not.exist"
    test_assert $CRM_EX_NOSUCH

    desc="Create a fencing resource"
    cmd="cibadmin -C -o resources --xml-text '<primitive id=\"Fence\" class=\"stonith\" type=\"fence_true\"/>'"
    test_assert $CRM_EX_OK

    desc="Bring resources online"
    cmd="crm_simulate --live-check --in-place -S"
    test_assert $CRM_EX_OK

    desc="Try to move a resource to its existing location"
    cmd="crm_resource -r dummy --move --node node1"
    test_assert $CRM_EX_EXISTS

    desc="Try to move a resource that doesn't exist"
    cmd="crm_resource -r xyz --move --node node1"
    test_assert $CRM_EX_NOSUCH 0

    desc="Move a resource from its existing location"
    cmd="crm_resource -r dummy --move"
    test_assert $CRM_EX_OK

    desc="Clear out constraints generated by --move"
    cmd="crm_resource -r dummy --clear"
    test_assert $CRM_EX_OK

    desc="Default ticket granted state"
    cmd="crm_ticket -t ticketA -G granted -d false"
    test_assert $CRM_EX_OK

    desc="Set ticket granted state"
    cmd="crm_ticket -t ticketA -r --force"
    test_assert $CRM_EX_OK

    desc="Query ticket granted state"
    cmd="crm_ticket -t ticketA -G granted"
    test_assert $CRM_EX_OK

    desc="Delete ticket granted state"
    cmd="crm_ticket -t ticketA -D granted --force"
    test_assert $CRM_EX_OK

    desc="Make a ticket standby"
    cmd="crm_ticket -t ticketA -s"
    test_assert $CRM_EX_OK

    desc="Query ticket standby state"
    cmd="crm_ticket -t ticketA -G standby"
    test_assert $CRM_EX_OK

    desc="Activate a ticket"
    cmd="crm_ticket -t ticketA -a"
    test_assert $CRM_EX_OK

    desc="Delete ticket standby state"
    cmd="crm_ticket -t ticketA -D standby"
    test_assert $CRM_EX_OK

    desc="Ban a resource on unknown node"
    cmd="crm_resource -r dummy -B -N host1"
    test_assert $CRM_EX_NOSUCH

    desc="Create two more nodes and bring them online"
    cmd="crm_simulate --live-check --in-place --node-up=node2 --node-up=node3"
    test_assert $CRM_EX_OK

    desc="Ban dummy from node1"
    cmd="crm_resource -r dummy -B -N node1"
    test_assert $CRM_EX_OK

    desc="Show where a resource is running"
    cmd="crm_resource -r dummy -W"
    test_assert $CRM_EX_OK 0

    desc="Show constraints on a resource"
    cmd="crm_resource -a -r dummy"
    test_assert $CRM_EX_OK 0

    desc="Ban dummy from node2"
    cmd="crm_resource -r dummy -B -N node2 --output-as=xml"
    test_assert_validate $CRM_EX_OK

    desc="Relocate resources due to ban"
    cmd="crm_simulate --live-check --in-place -S"
    test_assert $CRM_EX_OK

    desc="Move dummy to node1"
    cmd="crm_resource -r dummy -M -N node1 --output-as=xml"
    test_assert_validate $CRM_EX_OK

    desc="Clear implicit constraints for dummy on node2"
    cmd="crm_resource -r dummy -U -N node2"
    test_assert $CRM_EX_OK

    desc="Drop the status section"
    cmd="cibadmin -R -o status --xml-text '<status/>'"
    test_assert $CRM_EX_OK 0

    desc="Create a clone"
    cmd="cibadmin -C -o resources --xml-text '<clone id=\"test-clone\"><primitive id=\"test-primitive\" class=\"ocf\" provider=\"pacemaker\" type=\"Dummy\"/></clone>'"
    test_assert $CRM_EX_OK 0

    desc="Create a resource meta attribute"
    cmd="crm_resource -r test-primitive --meta -p is-managed -v false"
    test_assert $CRM_EX_OK

    desc="Create a resource meta attribute in the primitive"
    cmd="crm_resource -r test-primitive --meta -p is-managed -v false --force"
    test_assert $CRM_EX_OK

    desc="Update resource meta attribute with duplicates"
    cmd="crm_resource -r test-clone --meta -p is-managed -v true"
    test_assert $CRM_EX_OK

    desc="Update resource meta attribute with duplicates (force clone)"
    cmd="crm_resource -r test-clone --meta -p is-managed -v true --force"
    test_assert $CRM_EX_OK

    desc="Update child resource meta attribute with duplicates"
    cmd="crm_resource -r test-primitive --meta -p is-managed -v false"
    test_assert $CRM_EX_OK

    desc="Delete resource meta attribute with duplicates"
    cmd="crm_resource -r test-clone --meta -d is-managed"
    test_assert $CRM_EX_OK

    desc="Delete resource meta attribute in parent"
    cmd="crm_resource -r test-primitive --meta -d is-managed"
    test_assert $CRM_EX_OK

    desc="Create a resource meta attribute in the primitive"
    cmd="crm_resource -r test-primitive --meta -p is-managed -v false --force"
    test_assert $CRM_EX_OK

    desc="Update existing resource meta attribute"
    cmd="crm_resource -r test-clone --meta -p is-managed -v true"
    test_assert $CRM_EX_OK

    desc="Create a resource meta attribute in the parent"
    cmd="crm_resource -r test-clone --meta -p is-managed -v true --force"
    test_assert $CRM_EX_OK

    desc="Copy resources"
    cmd="cibadmin -Q -o resources > $TMPXML"
    test_assert $CRM_EX_OK 0

    desc="Delete resource parent meta attribute (force)"
    cmd="crm_resource -r test-clone --meta -d is-managed --force"
    test_assert $CRM_EX_OK

    desc="Restore duplicates"
    cmd="cibadmin -R -o resources --xml-file $TMPXML"
    test_assert $CRM_EX_OK

    desc="Delete resource child meta attribute"
    cmd="crm_resource -r test-primitive --meta -d is-managed"
    test_assert $CRM_EX_OK

    desc="Create the dummy-group resource group"
    cmd="cibadmin -C -o resources --xml-text '<group id=\"dummy-group\">"
    cmd="$cmd <primitive id=\"dummy1\" class=\"ocf\" provider=\"pacemaker\""
    cmd="$cmd     type=\"Dummy\"/>"
    cmd="$cmd <primitive id=\"dummy2\" class=\"ocf\" provider=\"pacemaker\""
    cmd="$cmd     type=\"Dummy\"/>"
    cmd="$cmd </group>'"
    test_assert $CRM_EX_OK

    desc="Create a resource meta attribute in dummy1"
    cmd="crm_resource -r dummy1 --meta -p is-managed -v true"
    test_assert $CRM_EX_OK

    desc="Create a resource meta attribute in dummy-group"
    cmd="crm_resource -r dummy-group --meta -p is-managed -v false"
    test_assert $CRM_EX_OK

    desc="Delete the dummy-group resource group"
    cmd="cibadmin -D -o resources --xml-text '<group id=\"dummy-group\">'"
    test_assert $CRM_EX_OK

    desc="Specify a lifetime when moving a resource"
    cmd="crm_resource -r dummy --move --node node2 --lifetime=PT1H"
    test_assert $CRM_EX_OK

    desc="Try to move a resource previously moved with a lifetime"
    cmd="crm_resource -r dummy --move --node node1"
    test_assert $CRM_EX_OK

    desc="Ban dummy from node1 for a short time"
    cmd="crm_resource -r dummy -B -N node1 --lifetime=PT1S"
    test_assert $CRM_EX_OK

    desc="Remove expired constraints"
    sleep 2
    cmd="crm_resource --clear --expired"
    test_assert $CRM_EX_OK

    # Clear has already been tested elsewhere, but we need to get rid of the
    # constraints so testing delete works.  It won't delete if there's still
    # a reference to the resource somewhere.
    desc="Clear all implicit constraints for dummy"
    cmd="crm_resource -r dummy -U"
    test_assert $CRM_EX_OK

    desc="Set a node health strategy"
    cmd="crm_attribute -n node-health-strategy -v migrate-on-red"
    test_assert $CRM_EX_OK

    desc="Set a node health attribute"
    cmd="crm_attribute -N node3 -n '#health-cts-cli' -v red"
    test_assert $CRM_EX_OK

    desc="Show why a resource is not running on an unhealthy node"
    cmd="crm_resource -N node3 -Y -r dummy --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    desc="Delete a resource"
    cmd="crm_resource -D -r dummy -t primitive"
    test_assert $CRM_EX_OK

    unset CIB_shadow
    unset CIB_shadow_dir

    desc="Create an XML patchset"
    cmd="crm_diff -o $test_home/cli/crm_diff_old.xml -n $test_home/cli/crm_diff_new.xml"
    test_assert $CRM_EX_ERROR 0

    export CIB_file="$test_home/cli/constraints.xml"

    for rsc in prim1 prim2 prim3 prim4 prim5 prim6 prim7 prim8 prim9 \
               prim10 prim11 prim12 prim13 group clone; do
        desc="Check locations and constraints for $rsc"
        cmd="crm_resource -a -r $rsc"
        test_assert $CRM_EX_OK 0

        desc="Recursively check locations and constraints for $rsc"
        cmd="crm_resource -A -r $rsc"
        test_assert $CRM_EX_OK 0

        desc="Check locations and constraints for $rsc in XML"
        cmd="crm_resource -a -r $rsc --output-as=xml"
        test_assert_validate $CRM_EX_OK 0

        desc="Recursively check locations and constraints for $rsc in XML"
        cmd="crm_resource -A -r $rsc --output-as=xml"
        test_assert_validate $CRM_EX_OK 0
    done

    desc="Check locations and constraints for group member (referring to group)"
    cmd="crm_resource -a -r gr2"
    test_assert $CRM_EX_OK 0

    desc="Check locations and constraints for group member (without referring to group)"
    cmd="crm_resource -a -r gr2 --force"
    test_assert $CRM_EX_OK 0

    # Create a shadow CIB based on constraints.xml
    create_shadow_cib --create
    unset CIB_file

    desc="Set a meta-attribute for primitive and resources colocated with it"
    cmd="crm_resource -r prim5 --meta --set-parameter=target-role -v Stopped --recursive"
    test_assert $CRM_EX_OK 0

    desc="Set a meta-attribute for group and resource colocated with it"
    cmd="crm_resource -r group --meta --set-parameter=target-role -v Stopped --recursive"
    test_assert $CRM_EX_OK 0

    desc="Set a meta-attribute for clone and resource colocated with it"
    cmd="crm_resource -r clone --meta --set-parameter=target-role -v Stopped --recursive"
    test_assert $CRM_EX_OK 0

    unset CIB_shadow
    unset CIB_shadow_dir

    export CIB_file="$test_home/cli/crm_resource_digests.xml"

    desc="Show resource digests"
    cmd="crm_resource --digests -r rsc1 -N node1 --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    desc="Show resource digests with overrides"
    cmd="$cmd CRM_meta_interval=10000 CRM_meta_timeout=20000"
    test_assert $CRM_EX_OK 0

    desc="Show resource operations"
    cmd="crm_resource --list-operations"
    test_assert $CRM_EX_OK 0

    desc="Show resource operations (XML)"
    cmd="crm_resource --list-operations --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    unset CIB_file

    export CIB_file="$test_home/cli/crmadmin-cluster-remote-guest-nodes.xml"

    desc="List all nodes"
    cmd="crmadmin -N"
    test_assert $CRM_EX_OK 0

    desc="Minimally list all nodes"
    cmd="crmadmin -N -q"
    test_assert $CRM_EX_OK 0

    desc="List all nodes as bash exports"
    cmd="crmadmin -N -B"
    test_assert $CRM_EX_OK 0

    desc="List cluster nodes"
    cmd="crmadmin -N cluster | wc -l | grep 6"
    test_assert $CRM_EX_OK 0

    desc="List guest nodes"
    cmd="crmadmin -N guest | wc -l | grep 2"
    test_assert $CRM_EX_OK 0

    desc="List remote nodes"
    cmd="crmadmin -N remote | wc -l | grep 3"
    test_assert $CRM_EX_OK 0

    desc="List cluster,remote nodes"
    cmd="crmadmin -N cluster,remote | wc -l | grep 9"
    test_assert $CRM_EX_OK 0

    desc="List guest,remote nodes"
    cmd="crmadmin -N guest,remote | wc -l | grep 5"
    test_assert $CRM_EX_OK 0

    unset CIB_file

    export CIB_file="$test_home/cli/crm_mon.xml"
    export CIB_shadow_dir="${shadow_dir}"

    desc="Show allocation scores with crm_simulate"
    cmd="crm_simulate -x $CIB_file --show-scores --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    desc="Show utilization with crm_simulate"
    cmd="crm_simulate -x $CIB_file --show-utilization"
    test_assert $CRM_EX_OK 0

    desc="Simulate injecting a failure"
    cmd="crm_simulate -x $CIB_file -S -i ping_monitor_10000@cluster02=1"
    test_assert $CRM_EX_OK 0

    desc="Simulate bringing a node down"
    cmd="crm_simulate -x $CIB_file -S --node-down=cluster01"
    test_assert $CRM_EX_OK 0

    desc="Simulate a node failing"
    cmd="crm_simulate -x $CIB_file -S --node-fail=cluster02"
    test_assert $CRM_EX_OK 0

    unset CIB_shadow_dir

    desc="List a promotable clone resource"
    cmd="crm_resource --locate -r promotable-clone"
    test_assert $CRM_EX_OK 0

    desc="List the primitive of a promotable clone resource"
    cmd="crm_resource --locate -r promotable-rsc"
    test_assert $CRM_EX_OK 0

    desc="List a single instance of a promotable clone resource"
    cmd="crm_resource --locate -r promotable-rsc:0"
    test_assert $CRM_EX_OK 0

    desc="List another instance of a promotable clone resource"
    cmd="crm_resource --locate -r promotable-rsc:1"
    test_assert $CRM_EX_OK 0

    desc="List a promotable clone resource in XML"
    cmd="crm_resource --locate -r promotable-clone --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    desc="List the primitive of a promotable clone resource in XML"
    cmd="crm_resource --locate -r promotable-rsc --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    desc="List a single instance of a promotable clone resource in XML"
    cmd="crm_resource --locate -r promotable-rsc:0 --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    desc="List another instance of a promotable clone resource in XML"
    cmd="crm_resource --locate -r promotable-rsc:1 --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    desc="Try to move an instance of a cloned resource"
    cmd="crm_resource -r promotable-rsc:0 --move --node node1"
    test_assert $CRM_EX_INVALID_PARAM 0

    # Create a sandbox copy of crm_mon.xml
    cibadmin -Q > "$TMPXML"
    export CIB_file="$TMPXML"

    desc="Query a nonexistent promotable score attribute"
    cmd="crm_attribute -N cluster01 -p promotable-rsc -G"
    test_assert $CRM_EX_NOSUCH 0

    desc="Query a nonexistent promotable score attribute (XML)"
    cmd="crm_attribute -N cluster01 -p promotable-rsc -G --output-as=xml"
    test_assert_validate $CRM_EX_NOSUCH 0

    desc="Delete a nonexistent promotable score attribute"
    cmd="crm_attribute -N cluster01 -p promotable-rsc -D"
    test_assert $CRM_EX_OK 0

    desc="Delete a nonexistent promotable score attribute (XML)"
    cmd="crm_attribute -N cluster01 -p promotable-rsc -D --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    desc="Query after deleting a nonexistent promotable score attribute"
    cmd="crm_attribute -N cluster01 -p promotable-rsc -G"
    test_assert $CRM_EX_NOSUCH 0

    desc="Query after deleting a nonexistent promotable score attribute (XML)"
    cmd="crm_attribute -N cluster01 -p promotable-rsc -G --output-as=xml"
    test_assert_validate $CRM_EX_NOSUCH 0

    desc="Update a nonexistent promotable score attribute"
    cmd="crm_attribute -N cluster01 -p promotable-rsc -v 1"
    test_assert $CRM_EX_OK 0

    desc="Update a nonexistent promotable score attribute (XML)"
    cmd="crm_attribute -N cluster01 -p promotable-rsc -v 1 --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    desc="Query after updating a nonexistent promotable score attribute"
    cmd="crm_attribute -N cluster01 -p promotable-rsc -G"
    test_assert $CRM_EX_OK 0

    desc="Query after updating a nonexistent promotable score attribute (XML)"
    cmd="crm_attribute -N cluster01 -p promotable-rsc -G --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    desc="Update an existing promotable score attribute"
    cmd="crm_attribute -N cluster01 -p promotable-rsc -v 5"
    test_assert $CRM_EX_OK 0

    desc="Update an existing promotable score attribute (XML)"
    cmd="crm_attribute -N cluster01 -p promotable-rsc -v 5 --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    desc="Query after updating an existing promotable score attribute"
    cmd="crm_attribute -N cluster01 -p promotable-rsc -G"
    test_assert $CRM_EX_OK 0

    desc="Query after updating an existing promotable score attribute (XML)"
    cmd="crm_attribute -N cluster01 -p promotable-rsc -G --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    desc="Delete an existing promotable score attribute"
    cmd="crm_attribute -N cluster01 -p promotable-rsc -D"
    test_assert $CRM_EX_OK 0

    desc="Delete an existing promotable score attribute (XML)"
    cmd="crm_attribute -N cluster01 -p promotable-rsc -D --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    desc="Query after deleting an existing promotable score attribute"
    cmd="crm_attribute -N cluster01 -p promotable-rsc -G"
    test_assert $CRM_EX_NOSUCH 0

    desc="Query after deleting an existing promotable score attribute (XML)"
    cmd="crm_attribute -N cluster01 -p promotable-rsc -G --output-as=xml"
    test_assert_validate $CRM_EX_NOSUCH 0

    # Test for an issue with legacy command line parsing when the resource is
    # specified in the environment (CLBZ#5509)
    export OCF_RESOURCE_INSTANCE=promotable-rsc

    desc="Update a promotable score attribute to -INFINITY"
    cmd="crm_attribute -N cluster01 -p -v -INFINITY"
    test_assert $CRM_EX_OK 0

    desc="Update a promotable score attribute to -INFINITY (XML)"
    cmd="crm_attribute -N cluster01 -p -v -INFINITY --output-as=xml"
    test_assert $CRM_EX_OK 0

    desc="Query after updating a promotable score attribute to -INFINITY"
    cmd="crm_attribute -N cluster01 -p -G"
    test_assert $CRM_EX_OK 0

    desc="Query after updating a promotable score attribute to -INFINITY (XML)"
    cmd="crm_attribute -N cluster01 -p -G --output-as=xml"
    test_assert $CRM_EX_OK 0

    desc="Try OCF_RESOURCE_INSTANCE if -p is specified with an empty string"
    cmd="crm_attribute -N cluster01 -p '' -G"
    test_assert $CRM_EX_OK 0

    export OCF_RESOURCE_INSTANCE=""

    desc="Return usage error if both -p and OCF_RESOURCE_INSTANCE are empty strings"
    cmd="crm_attribute -N cluster01 -p '' -G"
    test_assert $CRM_EX_USAGE 0

    unset CIB_file
    unset OCF_RESOURCE_INSTANCE

    export CIB_file="-"

    desc="Check that CIB_file=\"-\" works - crm_mon"
    cmd="cat $test_home/cli/crm_mon.xml | crm_mon -1"
    test_assert $CRM_EX_OK 0

    desc="Check that CIB_file=\"-\" works - crm_resource"
    cmd="cat $test_home/cli/crm_resource_digests.xml | crm_resource --digests -r rsc1 -N node1 --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    desc="Check that CIB_file=\"-\" works - crmadmin"
    cmd="cat $test_home/cli/crmadmin-cluster-remote-guest-nodes.xml | crmadmin -N | wc -l | grep 11"
    test_assert $CRM_EX_OK 0

    unset CIB_file
    rm -f "$TMPXML" "$TMPORIG"


    # crm_shadow tests

    unset CIB_shadow
    unset CIB_shadow_dir

    # Query with no active shadow instance
    desc="Get active shadow instance (no active instance)"
    cmd="crm_shadow --which"
    test_assert $CRM_EX_NOSUCH 0

    desc="Get active shadow instance (no active instance) (XML)"
    cmd="crm_shadow --which --output-as=xml"
    test_assert_validate $CRM_EX_NOSUCH 0

    desc="Get active shadow instance's file name (no active instance)"
    cmd="crm_shadow --file"
    test_assert $CRM_EX_NOSUCH 0

    desc="Get active shadow instance's file name (no active instance) (XML)"
    cmd="crm_shadow --file --output-as=xml"
    test_assert_validate $CRM_EX_NOSUCH 0

    desc="Get active shadow instance's contents (no active instance)"
    cmd="crm_shadow --display"
    test_assert $CRM_EX_NOSUCH 0

    desc="Get active shadow instance's contents (no active instance) (XML)"
    cmd="crm_shadow --display --output-as=xml"
    test_assert_validate $CRM_EX_NOSUCH 0

    desc="Get active shadow instance's diff (no active instance)"
    cmd="crm_shadow --diff"
    test_assert $CRM_EX_NOSUCH 0

    desc="Get active shadow instance's diff (no active instance) (XML)"
    cmd="crm_shadow --diff --output-as=xml"
    test_assert_validate $CRM_EX_NOSUCH 0

    # Create new shadow instance based on active CIB
    # Don't use create_shadow_cib() here; test explicitly
    export CIB_file="$test_home/cli/crm_mon.xml"
    export CIB_shadow="$shadow"
    export CIB_shadow_dir="$shadow_dir"

    # Delete the shadow file if it already exists
    crm_shadow --delete "$shadow" --force >/dev/null 2>&1

    desc="Create copied shadow instance"
    cmd="crm_shadow --create $shadow --batch"
    test_assert $CRM_EX_OK 0

    crm_shadow --delete "$shadow" --force >/dev/null 2>&1

    desc="Create copied shadow instance (XML)"
    cmd="crm_shadow --create $shadow --batch --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    # Query shadow instance based on active CIB
    desc="Get active shadow instance (copied)"
    cmd="crm_shadow --which"
    test_assert $CRM_EX_OK 0

    desc="Get active shadow instance (copied) (XML)"
    cmd="crm_shadow --which --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    desc="Get active shadow instance's file name (copied)"
    cmd="crm_shadow --file"
    test_assert $CRM_EX_OK 0

    desc="Get active shadow instance's file name (copied) (XML)"
    cmd="crm_shadow --file --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    desc="Get active shadow instance's contents (copied)"
    cmd="crm_shadow --display"
    test_assert $CRM_EX_OK 0

    desc="Get active shadow instance's contents (copied) (XML)"
    cmd="crm_shadow --display --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    desc="Get active shadow instance's diff (copied)"
    cmd="crm_shadow --diff"
    test_assert $CRM_EX_OK 0

    desc="Get active shadow instance's diff (copied) (XML)"
    cmd="crm_shadow --diff --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    # Make some changes to the shadow file
    export CIB_file="$(crm_shadow --file)"

    cibadmin --modify --xml-text '<primitive id="dummy" description="desc"/>'
    cibadmin --delete --xml-text '<op_defaults/>'
    cibadmin --create -o resources --xml-text \
        '<primitive id="dummy1" class="ocf" provider="pacemaker" type="Dummy"/>'

    state="<node_state id=\"3\" uname=\"cluster03\" in_ccm=\"true\""
    state="$state crmd=\"online\" crm-debug-origin=\"do_update_resource\""
    state="$state join=\"member\" expected=\"member\">"

    cibadmin --create -o status --xml-text "$state"
    unset state

    export CIB_file="$test_home/cli/crm_mon.xml"

    desc="Get active shadow instance's diff (after changes)"
    cmd="crm_shadow --diff"
    test_assert $CRM_EX_ERROR 0

    desc="Get active shadow instance's diff (after changes) (XML)"
    cmd="crm_shadow --diff --output-as=xml"
    test_assert_validate $CRM_EX_ERROR 0

    # Commit the modified shadow CIB to a temp active CIB file
    cp "$test_home/cli/crm_mon.xml" "$TMPXML"
    export CIB_file="$TMPXML"

    desc="Commit shadow instance"
    cmd="crm_shadow --commit $shadow"
    test_assert $CRM_EX_USAGE 0

    desc="Commit shadow instance (force)"
    cmd="crm_shadow --commit $shadow --force"
    test_assert $CRM_EX_OK 0

    desc="Get active shadow instance's diff (after commit)"
    cmd="crm_shadow --diff"
    test_assert $CRM_EX_ERROR 0

    desc="Commit shadow instance (force) (all)"
    cmd="crm_shadow --commit $shadow --force --all"
    test_assert $CRM_EX_OK 0

    desc="Get active shadow instance's diff (after commit all)"
    cmd="crm_shadow --diff"
    test_assert $CRM_EX_ERROR 0

    # Repeat sequence with XML output
    cp "$test_home/cli/crm_mon.xml" "$TMPXML"
    export CIB_file="$TMPXML"

    desc="Commit shadow instance (XML)"
    cmd="crm_shadow --commit $shadow --output-as=xml"
    test_assert_validate $CRM_EX_USAGE 0

    desc="Commit shadow instance (force) (XML)"
    cmd="crm_shadow --commit $shadow --force --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    desc="Get active shadow instance's diff (after commit) (XML)"
    cmd="crm_shadow --diff --output-as=xml"
    test_assert_validate $CRM_EX_ERROR 0

    desc="Commit shadow instance (force) (all) (XML)"
    cmd="crm_shadow --commit $shadow --force --all --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    desc="Get active shadow instance's diff (after commit all) (XML)"
    cmd="crm_shadow --diff --output-as=xml"
    test_assert_validate $CRM_EX_ERROR 0

    # Commit an inactive shadow instance with no active instance
    unset CIB_shadow

    desc="Commit shadow instance (no active instance)"
    cmd="crm_shadow --commit $shadow"
    test_assert $CRM_EX_USAGE 0

    desc="Commit shadow instance (no active instance) (force)"
    cmd="crm_shadow --commit $shadow --force"
    test_assert $CRM_EX_OK 0

    desc="Commit shadow instance (no active instance) (XML)"
    cmd="crm_shadow --commit $shadow --output-as=xml"
    test_assert_validate $CRM_EX_USAGE 0

    desc="Commit shadow instance (no active instance) (force) (XML)"
    cmd="crm_shadow --commit $shadow --force --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    # Commit an inactive shadow instance with an active instance
    export CIB_shadow="nonexistent_shadow"

    desc="Commit shadow instance (mismatch)"
    cmd="crm_shadow --commit $shadow"
    test_assert $CRM_EX_USAGE 0

    desc="Commit shadow instance (mismatch) (force)"
    cmd="crm_shadow --commit $shadow --force"
    test_assert $CRM_EX_OK 0

    desc="Commit shadow instance (mismatch) (XML)"
    cmd="crm_shadow --commit $shadow --output-as=xml"
    test_assert_validate $CRM_EX_USAGE 0

    desc="Commit shadow instance (mismatch) (force) (XML)"
    cmd="crm_shadow --commit $shadow --force --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    # Commit an active shadow instance whose shadow file is missing
    desc="Commit shadow instance (nonexistent shadow file)"
    cmd="crm_shadow --commit $CIB_shadow"
    test_assert $CRM_EX_USAGE 0

    desc="Commit shadow instance (nonexistent shadow file) (force)"
    cmd="crm_shadow --commit $CIB_shadow --force"
    test_assert $CRM_EX_NOSUCH 0

    desc="Get active shadow instance's diff (nonexistent shadow file)"
    cmd="crm_shadow --diff"
    test_assert $CRM_EX_NOSUCH 0

    desc="Commit shadow instance (nonexistent shadow file) (XML)"
    cmd="crm_shadow --commit $CIB_shadow --output-as=xml"
    test_assert_validate $CRM_EX_USAGE 0

    desc="Commit shadow instance (nonexistent shadow file) (force) (XML)"
    cmd="crm_shadow --commit $CIB_shadow --force --output-as=xml"
    test_assert_validate $CRM_EX_NOSUCH 0

    desc="Get active shadow instance's diff (nonexistent shadow file) (XML)"
    cmd="crm_shadow --diff --output-as=xml"
    test_assert_validate $CRM_EX_NOSUCH 0

    # Commit an active shadow instance when the CIB file is missing
    export CIB_file="$test_home/cli/nonexistent_cib.xml"
    export CIB_shadow="$shadow"

    desc="Commit shadow instance (nonexistent CIB file)"
    cmd="crm_shadow --commit $shadow"
    test_assert $CRM_EX_USAGE 0

    desc="Commit shadow instance (nonexistent CIB file) (force)"
    cmd="crm_shadow --commit $shadow --force"
    test_assert $CRM_EX_NOSUCH 0

    desc="Get active shadow instance's diff (nonexistent CIB file)"
    cmd="crm_shadow --diff"
    test_assert $CRM_EX_NOSUCH 0

    desc="Commit shadow instance (nonexistent CIB file) (XML)"
    cmd="crm_shadow --commit $shadow --output-as=xml"
    test_assert_validate $CRM_EX_USAGE 0

    desc="Commit shadow instance (nonexistent CIB file) (force) (XML)"
    cmd="crm_shadow --commit $shadow --force --output-as=xml"
    test_assert_validate $CRM_EX_NOSUCH 0

    desc="Get active shadow instance's diff (nonexistent CIB file) (XML)"
    cmd="crm_shadow --diff --output-as=xml"
    test_assert_validate $CRM_EX_NOSUCH 0

    rm -f "$TMPXML"

    # Delete an active shadow instance
    export CIB_file="$test_home/cli/crm_mon.xml"
    export CIB_shadow="$shadow"

    desc="Delete shadow instance"
    cmd="crm_shadow --delete $shadow"
    test_assert $CRM_EX_USAGE 0

    desc="Delete shadow instance (force)"
    cmd="crm_shadow --delete $shadow --force"
    test_assert $CRM_EX_OK 0

    create_shadow_cib --create

    desc="Delete shadow instance (XML)"
    cmd="crm_shadow --delete $shadow --output-as=xml"
    test_assert_validate $CRM_EX_USAGE 0

    desc="Delete shadow instance (force) (XML)"
    cmd="crm_shadow --delete $shadow --force --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    # Delete an inactive shadow instance with no active instance
    create_shadow_cib --create
    unset CIB_shadow

    desc="Delete shadow instance (no active instance)"
    cmd="crm_shadow --delete $shadow"
    test_assert $CRM_EX_USAGE 0

    desc="Delete shadow instance (no active instance) (force)"
    cmd="crm_shadow --delete $shadow --force"
    test_assert $CRM_EX_OK 0

    create_shadow_cib --create
    unset CIB_shadow

    desc="Delete shadow instance (no active instance) (XML)"
    cmd="crm_shadow --delete $shadow --output-as=xml"
    test_assert_validate $CRM_EX_USAGE 0

    desc="Delete shadow instance (no active instance) (force) (XML)"
    cmd="crm_shadow --delete $shadow --force --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    # Delete an inactive shadow instance with an active instance
    create_shadow_cib --create
    export CIB_shadow="nonexistent_shadow"

    desc="Delete shadow instance (mismatch)"
    cmd="crm_shadow --delete $shadow"
    test_assert $CRM_EX_USAGE 0

    desc="Delete shadow instance (mismatch) (force)"
    cmd="crm_shadow --delete $shadow --force"
    test_assert $CRM_EX_OK 0

    create_shadow_cib --create
    export CIB_shadow="nonexistent_shadow"

    desc="Delete shadow instance (mismatch) (XML)"
    cmd="crm_shadow --delete $shadow --output-as=xml"
    test_assert_validate $CRM_EX_USAGE 0

    desc="Delete shadow instance (mismatch) (force) (XML)"
    cmd="crm_shadow --delete $shadow --force --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    # Delete an active shadow instance whose shadow file is missing
    desc="Delete shadow instance (nonexistent shadow file)"
    cmd="crm_shadow --delete $CIB_shadow"
    test_assert $CRM_EX_USAGE 0

    desc="Delete shadow instance (nonexistent shadow file) (force)"
    cmd="crm_shadow --delete $CIB_shadow --force"
    test_assert $CRM_EX_OK 0

    desc="Delete shadow instance (nonexistent shadow file) (XML)"
    cmd="crm_shadow --delete $CIB_shadow --output-as=xml"
    test_assert_validate $CRM_EX_USAGE 0

    desc="Delete shadow instance (nonexistent shadow file) (force) (XML)"
    cmd="crm_shadow --delete $CIB_shadow --force --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    # Delete an active shadow instance when the CIB file is missing
    export CIB_file="$test_home/cli/crm_mon.xml"
    create_shadow_cib --create
    export CIB_file="$test_home/cli/nonexistent_cib.xml"

    desc="Delete shadow instance (nonexistent CIB file)"
    cmd="crm_shadow --delete $shadow"
    test_assert $CRM_EX_USAGE 0

    desc="Delete shadow instance (nonexistent CIB file) (force)"
    cmd="crm_shadow --delete $shadow --force"
    test_assert $CRM_EX_OK 0

    export CIB_file="$test_home/cli/crm_mon.xml"
    create_shadow_cib --create
    export CIB_file="$test_home/cli/nonexistent_cib.xml"

    desc="Delete shadow instance (nonexistent CIB file) (XML)"
    cmd="crm_shadow --delete $shadow --output-as=xml"
    test_assert_validate $CRM_EX_USAGE 0

    desc="Delete shadow instance (nonexistent CIB file) (force) (XML)"
    cmd="crm_shadow --delete $shadow --force --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    # Create new shadow instance based on active CIB with no instance active
    export CIB_file="$test_home/cli/crm_mon.xml"

    crm_shadow --delete "$shadow" --force >/dev/null 2>&1
    unset CIB_shadow

    desc="Create copied shadow instance (no active instance)"
    cmd="crm_shadow --create $shadow --batch"
    test_assert $CRM_EX_OK 0

    crm_shadow --delete "$shadow" --force >/dev/null 2>&1
    unset CIB_shadow

    desc="Create copied shadow instance (no active instance) (XML)"
    cmd="crm_shadow --create $shadow --batch --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    # Create new shadow instance based on active CIB with other instance active
    export CIB_file="$test_home/cli/crm_mon.xml"
    export CIB_shadow="nonexistent_shadow"

    crm_shadow --delete "$shadow" --force >/dev/null 2>&1

    desc="Create copied shadow instance (mismatch)"
    cmd="crm_shadow --create $shadow --batch"
    test_assert $CRM_EX_OK 0

    crm_shadow --delete "$shadow" --force >/dev/null 2>&1

    desc="Create copied shadow instance (mismatch) (XML)"
    cmd="crm_shadow --create $shadow --batch --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    # Create new shadow instance based on CIB (shadow file already exists)
    export CIB_file="$test_home/cli/crm_mon.xml"

    desc="Create copied shadow instance (file already exists)"
    cmd="crm_shadow --create $shadow --batch"
    test_assert $CRM_EX_CANTCREAT 0

    desc="Create copied shadow instance (file already exists) (force)"
    cmd="crm_shadow --create $shadow --batch --force"
    test_assert $CRM_EX_OK 0

    desc="Create copied shadow instance (file already exists) (XML)"
    cmd="crm_shadow --create $shadow --batch --output-as=xml"
    test_assert_validate $CRM_EX_CANTCREAT 0

    desc="Create copied shadow instance (file already exists) (force) (XML)"
    cmd="crm_shadow --create $shadow --batch --force --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    # Create new shadow instance based on active CIB when the CIB file is missing
    export CIB_file="$test_home/cli/nonexistent_cib.xml"
    export CIB_shadow="$shadow"

    crm_shadow --delete "$shadow" --force >/dev/null 2>&1

    desc="Create copied shadow instance (nonexistent CIB file) (force)"
    cmd="crm_shadow --create $shadow --batch --force"
    test_assert $CRM_EX_NOSUCH 0

    desc="Create copied shadow instance (nonexistent CIB file) (force) (XML)"
    cmd="crm_shadow --create $shadow --batch --force --output-as=xml"
    test_assert_validate $CRM_EX_NOSUCH 0

    # Create new empty shadow instance
    export CIB_shadow="$shadow"

    crm_shadow --delete "$shadow" --force >/dev/null 2>&1

    desc="Create empty shadow instance"
    cmd="crm_shadow --create-empty $shadow --batch"
    test_assert $CRM_EX_OK 0

    crm_shadow --delete "$shadow" --force >/dev/null 2>&1

    desc="Create empty shadow instance (XML)"
    cmd="crm_shadow --create-empty $shadow --batch --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    # Create empty shadow instance with no active instance
    unset CIB_shadow

    crm_shadow --delete "$shadow" --force >/dev/null 2>&1

    desc="Create empty shadow instance (no active instance)"
    cmd="crm_shadow --create-empty $shadow --batch"
    test_assert $CRM_EX_OK 0

    crm_shadow --delete "$shadow" --force >/dev/null 2>&1

    desc="Create empty shadow instance (no active instance) (XML)"
    cmd="crm_shadow --create-empty $shadow --batch --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    # Create empty shadow instance with other instance active
    export CIB_shadow="nonexistent_shadow"

    crm_shadow --delete "$shadow" --force >/dev/null 2>&1

    desc="Create empty shadow instance (mismatch)"
    cmd="crm_shadow --create-empty $shadow --batch"
    test_assert $CRM_EX_OK 0

    crm_shadow --delete "$shadow" --force >/dev/null 2>&1

    desc="Create empty shadow instance (mismatch) (XML)"
    cmd="crm_shadow --create-empty $shadow --batch --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    # Create empty shadow instance when the CIB file is missing
    export CIB_file="$test_home/cli/nonexistent_cib.xml"
    export CIB_shadow="$shadow"

    crm_shadow --delete "$shadow" --force >/dev/null 2>&1

    desc="Create empty shadow instance (nonexistent CIB file)"
    cmd="crm_shadow --create-empty $shadow --batch"
    test_assert $CRM_EX_OK 0

    crm_shadow --delete "$shadow" --force >/dev/null 2>&1

    desc="Create empty shadow instance (nonexistent CIB file) (XML)"
    cmd="crm_shadow --create-empty $shadow --batch --force --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    # Create empty shadow instance (shadow file already exists)
    export CIB_file="$test_home/cli/crm_mon.xml"

    desc="Create empty shadow instance (file already exists)"
    cmd="crm_shadow --create-empty $shadow --batch"
    test_assert $CRM_EX_CANTCREAT 0

    desc="Create empty shadow instance (file already exists) (force)"
    cmd="crm_shadow --create-empty $shadow --batch --force"
    test_assert $CRM_EX_OK 0

    desc="Create empty shadow instance (file already exists) (XML)"
    cmd="crm_shadow --create-empty $shadow --batch --output-as=xml"
    test_assert_validate $CRM_EX_CANTCREAT 0

    desc="Create empty shadow instance (file already exists) (force) (XML)"
    cmd="crm_shadow --create-empty $shadow --batch --force --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    # Query shadow instance with an empty CIB.
    # --which and --file queries were done earlier.
    delete_shadow_resource_defaults

    desc="Get active shadow instance's contents (empty CIB)"
    cmd="crm_shadow --display"
    test_assert $CRM_EX_OK 0

    desc="Get active shadow instance's contents (empty CIB) (XML)"
    cmd="crm_shadow --display --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    desc="Get active shadow instance's diff (empty CIB)"
    cmd="crm_shadow --diff"
    test_assert $CRM_EX_ERROR 0

    desc="Get active shadow instance's diff (empty CIB) (XML)"
    cmd="crm_shadow --diff --output-as=xml"
    test_assert_validate $CRM_EX_ERROR 0

    # Reset shadow instance (overwrite existing shadow file based on active CIB)
    export CIB_file="$test_home/cli/crm_mon.xml"
    export CIB_shadow="$shadow"

    desc="Reset shadow instance"
    cmd="crm_shadow --reset $shadow --batch"
    test_assert $CRM_EX_OK 0

    desc="Get active shadow instance's diff (after reset)"
    cmd="crm_shadow --diff"
    test_assert $CRM_EX_OK 0

    create_shadow_cib --create-empty

    desc="Reset shadow instance (XML)"
    cmd="crm_shadow --reset $shadow --batch --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    desc="Get active shadow instance's diff (after reset) (XML)"
    cmd="crm_shadow --diff --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    # Reset an inactive shadow instance with no active instance
    unset CIB_shadow

    desc="Reset shadow instance (no active instance)"
    cmd="crm_shadow --reset $shadow --batch"
    test_assert $CRM_EX_OK 0

    create_shadow_cib --create-empty
    unset CIB_shadow

    desc="Reset shadow instance (no active instance) (XML)"
    cmd="crm_shadow --reset $shadow --batch --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    # Reset an inactive shadow instance with an active instance
    export CIB_shadow="nonexistent_shadow"

    desc="Reset shadow instance (mismatch)"
    cmd="crm_shadow --reset $shadow --batch"
    test_assert $CRM_EX_USAGE 0

    desc="Reset shadow instance (mismatch) (force)"
    cmd="crm_shadow --reset $shadow --batch --force"
    test_assert $CRM_EX_OK 0

    create_shadow_cib --create-empty
    export CIB_shadow="nonexistent_shadow"

    desc="Reset shadow instance (mismatch) (XML)"
    cmd="crm_shadow --reset $shadow --batch --output-as=xml"
    test_assert_validate $CRM_EX_USAGE 0

    desc="Reset shadow instance (mismatch) (force) (XML)"
    cmd="crm_shadow --reset $shadow --batch --force --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    # Reset an active shadow instance when the CIB file is missing
    create_shadow_cib --create-empty
    export CIB_file="$test_home/cli/nonexistent_cib.xml"

    desc="Reset shadow instance (nonexistent CIB file)"
    cmd="crm_shadow --reset $CIB_shadow --batch"
    test_assert $CRM_EX_NOSUCH 0

    desc="Reset shadow instance (nonexistent CIB file) (XML)"
    cmd="crm_shadow --reset $CIB_shadow --batch --output-as=xml"
    test_assert_validate $CRM_EX_NOSUCH 0

    desc="Reset shadow instance (nonexistent CIB file) (force)"
    cmd="crm_shadow --reset $CIB_shadow --batch --force"
    test_assert $CRM_EX_NOSUCH 0

    desc="Reset shadow instance (nonexistent CIB file) (force) (XML)"
    cmd="crm_shadow --reset $CIB_shadow --batch --force --output-as=xml"
    test_assert_validate $CRM_EX_NOSUCH 0

    # Reset an active shadow instance whose shadow file is missing
    export CIB_file="$test_home/cli/crm_mon.xml"
    export CIB_shadow="$shadow"

    crm_shadow --delete "$shadow" --force >/dev/null 2>&1

    desc="Reset shadow instance (nonexistent shadow file)"
    cmd="crm_shadow --reset $CIB_shadow --batch"
    test_assert $CRM_EX_NOSUCH 0

    desc="Reset shadow instance (nonexistent shadow file) (force)"
    cmd="crm_shadow --reset $CIB_shadow --batch --force"
    test_assert $CRM_EX_OK 0

    crm_shadow --delete "$shadow" --force >/dev/null 2>&1

    desc="Reset shadow instance (nonexistent shadow file) (XML)"
    cmd="crm_shadow --reset $CIB_shadow --batch --output-as=xml"
    test_assert_validate $CRM_EX_NOSUCH 0

    desc="Reset shadow instance (nonexistent shadow file) (force) (XML)"
    cmd="crm_shadow --reset $CIB_shadow --batch --force --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    # Switch shadow instances
    # In batch mode, this only displays a message
    create_shadow_cib --create-empty

    # Makes no difference now, just future-proofing
    CIB_shadow="nonexistent_shadow"

    desc="Switch to new shadow instance"
    cmd="crm_shadow --switch $shadow --batch"
    test_assert $CRM_EX_OK 0

    CIB_shadow="nonexistent_shadow"

    desc="Switch to new shadow instance (XML)"
    cmd="crm_shadow --switch $shadow --batch --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    crm_shadow --delete "$shadow" --force >/dev/null 2>&1

    desc="Switch to nonexistent shadow instance"
    cmd="crm_shadow --switch $shadow --batch"
    test_assert $CRM_EX_NOSUCH 0

    desc="Switch to nonexistent shadow instance (force)"
    cmd="crm_shadow --switch $shadow --batch --force"
    test_assert $CRM_EX_NOSUCH 0

    desc="Switch to nonexistent shadow instance (XML)"
    cmd="crm_shadow --switch $shadow --batch --output-as=xml"
    test_assert_validate $CRM_EX_NOSUCH 0

    desc="Switch to nonexistent shadow instance (force) (XML)"
    cmd="crm_shadow --switch $shadow --batch --force --output-as=xml"
    test_assert_validate $CRM_EX_NOSUCH 0

    unset CIB_file
    unset CIB_shadow
    unset CIB_shadow_dir
}

INVALID_PERIODS=(
    "2019-01-01 00:00:00Z"              # Start with no end
    "2019-01-01 00:00:00Z/"             # Start with only a trailing slash
    "PT2S/P1M"                          # Two durations
    "2019-13-01 00:00:00Z/P1M"          # Out-of-range month
    "20191077T15/P1M"                   # Out-of-range day
    "2019-10-01T25:00:00Z/P1M"          # Out-of-range hour
    "2019-10-01T24:00:01Z/P1M"          # Hour 24 with anything but :00:00
    "PT5H/20191001T007000Z"             # Out-of-range minute
    "2019-10-01 00:00:80Z/P1M"          # Out-of-range second
    "2019-10-01 00:00:10 +25:00/P1M"    # Out-of-range offset hour
    "20191001T000010 -00:61/P1M"        # Out-of-range offset minute
    "P1Y/2019-02-29 00:00:00Z"          # Feb. 29 in non-leap-year
    "2019-01-01 00:00:00Z/P"            # Duration with no values
    "P1Z/2019-02-20 00:00:00Z"          # Invalid duration unit
    "P1YM/2019-02-20 00:00:00Z"         # No number for duration unit
)

function test_dates() {
    # Ensure invalid period specifications are rejected
    for spec in '' "${INVALID_PERIODS[@]}"; do
        desc="Invalid period - [$spec]"
        cmd="iso8601 -p \"$spec\""
        test_assert $CRM_EX_INVALID_PARAM 0
    done

    desc="2014-01-01 00:30:00 - 1 Hour"
    cmd="iso8601 -d '2014-01-01 00:30:00Z' -D P-1H -E '2013-12-31 23:30:00Z'"
    test_assert $CRM_EX_OK 0

    desc="Valid date - Feb 29 in leap year"
    cmd="iso8601 -d '2020-02-29 00:00:00Z' -E '2020-02-29 00:00:00Z'"
    test_assert $CRM_EX_OK 0

    desc="Valid date - using 'T' and offset"
    cmd="iso8601 -d '20191201T131211 -05:00' -E '2019-12-01 18:12:11Z'"
    test_assert $CRM_EX_OK 0

    desc="24:00:00 equivalent to 00:00:00 of next day"
    cmd="iso8601 -d '2019-12-31 24:00:00Z' -E '2020-01-01 00:00:00Z'"
    test_assert $CRM_EX_OK 0

    for y in 06 07 08 09 10 11 12 13 14 15 16 17 18 40; do
        desc="20$y-W01-7"
        cmd="iso8601 -d '20$y-W01-7 00Z'"
        test_assert $CRM_EX_OK 0

        desc="20$y-W01-7 - round-trip"
        cmd="iso8601 -d '20$y-W01-7 00Z' -W -E '20$y-W01-7 00:00:00Z'"
        test_assert $CRM_EX_OK 0

        desc="20$y-W01-1"
        cmd="iso8601 -d '20$y-W01-1 00Z'"
        test_assert $CRM_EX_OK 0

        desc="20$y-W01-1 - round-trip"
        cmd="iso8601 -d '20$y-W01-1 00Z' -W -E '20$y-W01-1 00:00:00Z'"
        test_assert $CRM_EX_OK 0
    done

    desc="2009-W53-07"
    cmd="iso8601 -d '2009-W53-7 00:00:00Z' -W -E '2009-W53-7 00:00:00Z'"
    test_assert $CRM_EX_OK 0

    desc="epoch + 2 Years 5 Months 6 Minutes"
    cmd="iso8601 -d 'epoch' -D P2Y5MT6M -E '1972-06-01 00:06:00Z'"
    test_assert $CRM_EX_OK 0

    desc="2009-01-31 + 1 Month"
    cmd="iso8601 -d '20090131T000000Z' -D P1M -E '2009-02-28 00:00:00Z'"
    test_assert $CRM_EX_OK 0

    desc="2009-01-31 + 2 Months"
    cmd="iso8601 -d '2009-01-31 00:00:00Z' -D P2M -E '2009-03-31 00:00:00Z'"
    test_assert $CRM_EX_OK 0

    desc="2009-01-31 + 3 Months"
    cmd="iso8601 -d '2009-01-31 00:00:00Z' -D P3M -E '2009-04-30 00:00:00Z'"
    test_assert $CRM_EX_OK 0

    desc="2009-03-31 - 1 Month"
    cmd="iso8601 -d '2009-03-31 01:00:00 +01:00' -D P-1M -E '2009-02-28 00:00:00Z'"
    test_assert $CRM_EX_OK 0

    desc="2038-01-01 + 3 Months"
    cmd="iso8601 -d '2038-01-01 00:00:00Z' -D P3M -E '2038-04-01 00:00:00Z'"
    test_assert $CRM_EX_OK 0
}

function test_acl_loop() {
    local TMPXML

    TMPXML="$1"

    # Make sure we're rejecting things for the right reasons
    orig_trace_fns="$PCMK_trace_functions"
    export PCMK_trace_functions=pcmk__check_acl,pcmk__apply_creation_acl

    CIB_user=root cibadmin --replace --xml-text '<resources/>'

    ### no ACL ###
    export CIB_user=unknownguy
    desc="$CIB_user: Query configuration"
    cmd="cibadmin -Q"
    test_assert $CRM_EX_INSUFFICIENT_PRIV 0

    desc="$CIB_user: Set enable-acl"
    cmd="crm_attribute -n enable-acl -v false"
    test_assert $CRM_EX_INSUFFICIENT_PRIV 0

    desc="$CIB_user: Set stonith-enabled"
    cmd="crm_attribute -n stonith-enabled -v false"
    test_assert $CRM_EX_INSUFFICIENT_PRIV 0

    desc="$CIB_user: Create a resource"
    cmd="cibadmin -C -o resources --xml-text '<primitive id=\"dummy\" class=\"ocf\" provider=\"pacemaker\" type=\"Dummy\"/>'"
    test_assert $CRM_EX_INSUFFICIENT_PRIV 0

    ### deny /cib permission ###
    export CIB_user=l33t-haxor
    desc="$CIB_user: Query configuration"
    cmd="cibadmin -Q"
    test_assert $CRM_EX_INSUFFICIENT_PRIV 0

    desc="$CIB_user: Set enable-acl"
    cmd="crm_attribute -n enable-acl -v false"
    test_assert $CRM_EX_INSUFFICIENT_PRIV 0

    desc="$CIB_user: Set stonith-enabled"
    cmd="crm_attribute -n stonith-enabled -v false"
    test_assert $CRM_EX_INSUFFICIENT_PRIV 0

    desc="$CIB_user: Create a resource"
    cmd="cibadmin -C -o resources --xml-text '<primitive id=\"dummy\" class=\"ocf\" provider=\"pacemaker\" type=\"Dummy\"/>'"
    test_assert $CRM_EX_INSUFFICIENT_PRIV 0

    ### observer role ###
    export CIB_user=niceguy
    desc="$CIB_user: Query configuration"
    cmd="cibadmin -Q"
    test_assert $CRM_EX_OK 0

    desc="$CIB_user: Set enable-acl"
    cmd="crm_attribute -n enable-acl -v false"
    test_assert $CRM_EX_INSUFFICIENT_PRIV 0

    desc="$CIB_user: Set stonith-enabled"
    cmd="crm_attribute -n stonith-enabled -v false"
    test_assert $CRM_EX_OK

    desc="$CIB_user: Create a resource"
    cmd="cibadmin -C -o resources --xml-text '<primitive id=\"dummy\" class=\"ocf\" provider=\"pacemaker\" type=\"Dummy\"/>'"
    test_assert $CRM_EX_INSUFFICIENT_PRIV 0

    export CIB_user=root
    desc="$CIB_user: Query configuration"
    cmd="cibadmin -Q"
    test_assert $CRM_EX_OK 0

    desc="$CIB_user: Set stonith-enabled"
    cmd="crm_attribute -n stonith-enabled -v true"
    test_assert $CRM_EX_OK

    desc="$CIB_user: Create a resource"
    cmd="cibadmin -C -o resources --xml-text '<primitive id=\"dummy\" class=\"ocf\" provider=\"pacemaker\" type=\"Dummy\"/>'"
    test_assert $CRM_EX_OK

    ### deny /cib permission ###
    export CIB_user=l33t-haxor

    desc="$CIB_user: Create a resource meta attribute"
    cmd="crm_resource -r dummy --meta -p target-role -v Stopped"
    test_assert $CRM_EX_INSUFFICIENT_PRIV 0

    desc="$CIB_user: Query a resource meta attribute"
    cmd="crm_resource -r dummy --meta -g target-role"
    test_assert $CRM_EX_INSUFFICIENT_PRIV 0

    desc="$CIB_user: Remove a resource meta attribute"
    cmd="crm_resource -r dummy --meta -d target-role"
    test_assert $CRM_EX_INSUFFICIENT_PRIV 0

    ### observer role ###
    export CIB_user=niceguy

    desc="$CIB_user: Create a resource meta attribute"
    cmd="crm_resource -r dummy --meta -p target-role -v Stopped"
    test_assert $CRM_EX_OK

    desc="$CIB_user: Query a resource meta attribute"
    cmd="crm_resource -r dummy --meta -g target-role"
    test_assert $CRM_EX_OK

    desc="$CIB_user: Remove a resource meta attribute"
    cmd="crm_resource -r dummy --meta -d target-role"
    test_assert $CRM_EX_OK

    desc="$CIB_user: Create a resource meta attribute"
    cmd="crm_resource -r dummy --meta -p target-role -v Started"
    test_assert $CRM_EX_OK

    ### read //meta_attributes ###
    export CIB_user=badidea
    desc="$CIB_user: Query configuration - implied deny"
    cmd="cibadmin -Q"
    test_assert $CRM_EX_OK 0

    ### deny /cib, read //meta_attributes ###
    export CIB_user=betteridea
    desc="$CIB_user: Query configuration - explicit deny"
    cmd="cibadmin -Q"
    test_assert $CRM_EX_OK 0

    CIB_user=root cibadmin -Q > "$TMPXML"
    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --delete --xml-text '<acls/>'
    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql

    ### observer role ###
    export CIB_user=niceguy
    desc="$CIB_user: Replace - remove acls"
    cmd="cibadmin --replace --xml-file $TMPXML"
    test_assert $CRM_EX_INSUFFICIENT_PRIV 0

    CIB_user=root cibadmin -Q > "$TMPXML"
    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -C -o resources --xml-text '<primitive id="dummy2" class="ocf" provider="pacemaker" type="Dummy"/>'
    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql

    desc="$CIB_user: Replace - create resource"
    cmd="cibadmin --replace --xml-file $TMPXML"
    test_assert $CRM_EX_INSUFFICIENT_PRIV 0

    CIB_user=root cibadmin -Q > "$TMPXML"
    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" crm_attribute -n enable-acl -v false
    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql

    desc="$CIB_user: Replace - modify attribute (deny)"
    cmd="cibadmin --replace --xml-file $TMPXML"
    test_assert $CRM_EX_INSUFFICIENT_PRIV 0

    CIB_user=root cibadmin -Q > "$TMPXML"
    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --replace --xml-text '<nvpair id="cib-bootstrap-options-enable-acl" name="enable-acl"/>'
    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql

    desc="$CIB_user: Replace - delete attribute (deny)"
    cmd="cibadmin --replace --xml-file $TMPXML"
    test_assert $CRM_EX_INSUFFICIENT_PRIV 0

    CIB_user=root cibadmin -Q > "$TMPXML"
    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="nothing interesting"/>'
    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql

    desc="$CIB_user: Replace - create attribute (deny)"
    cmd="cibadmin --replace --xml-file $TMPXML"
    test_assert $CRM_EX_INSUFFICIENT_PRIV 0

    ### admin role ###
    CIB_user=bob
    CIB_user=root cibadmin -Q > "$TMPXML"
    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="nothing interesting"/>'
    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql

    desc="$CIB_user: Replace - create attribute (direct allow)"
    cmd="cibadmin --replace -o resources --xml-file $TMPXML"
    test_assert $CRM_EX_OK 0

    CIB_user=root cibadmin -Q > "$TMPXML"
    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="something interesting"/>'
    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql

    desc="$CIB_user: Replace - modify attribute (direct allow)"
    cmd="cibadmin --replace -o resources --xml-file $TMPXML"
    test_assert $CRM_EX_OK 0

    CIB_user=root cibadmin -Q > "$TMPXML"
    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --replace -o resources --xml-text '<primitive id="dummy" class="ocf" provider="pacemaker" type="Dummy"/>'
    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql

    desc="$CIB_user: Replace - delete attribute (direct allow)"
    cmd="cibadmin --replace -o resources --xml-file $TMPXML"
    test_assert $CRM_EX_OK 0

    ### super_user role ###
    export CIB_user=joe

    CIB_user=root cibadmin -Q > "$TMPXML"
    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="nothing interesting"/>'
    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql

    desc="$CIB_user: Replace - create attribute (inherited allow)"
    cmd="cibadmin --replace -o resources --xml-file $TMPXML"
    test_assert $CRM_EX_OK 0

    CIB_user=root cibadmin -Q > "$TMPXML"
    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="something interesting"/>'
    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql

    desc="$CIB_user: Replace - modify attribute (inherited allow)"
    cmd="cibadmin --replace -o resources --xml-file $TMPXML"
    test_assert $CRM_EX_OK 0

    CIB_user=root cibadmin -Q > "$TMPXML"
    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --replace -o resources --xml-text '<primitive id="dummy" class="ocf" provider="pacemaker" type="Dummy"/>'
    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql

    desc="$CIB_user: Replace - delete attribute (inherited allow)"
    cmd="cibadmin --replace -o resources --xml-file $TMPXML"
    test_assert $CRM_EX_OK 0

    ### rsc_writer role ###
    export CIB_user=mike

    CIB_user=root cibadmin -Q > "$TMPXML"
    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="nothing interesting"/>'
    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql

    desc="$CIB_user: Replace - create attribute (allow overrides deny)"
    cmd="cibadmin --replace -o resources --xml-file $TMPXML"
    test_assert $CRM_EX_OK 0

    CIB_user=root cibadmin -Q > "$TMPXML"
    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="something interesting"/>'
    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql

    desc="$CIB_user: Replace - modify attribute (allow overrides deny)"
    cmd="cibadmin --replace -o resources --xml-file $TMPXML"
    test_assert $CRM_EX_OK 0

    CIB_user=root cibadmin -Q > "$TMPXML"
    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --replace -o resources --xml-text '<primitive id="dummy" class="ocf" provider="pacemaker" type="Dummy"/>'
    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql

    desc="$CIB_user: Replace - delete attribute (allow overrides deny)"
    cmd="cibadmin --replace -o resources --xml-file $TMPXML"
    test_assert $CRM_EX_OK 0

    ### rsc_denied role ###
    export CIB_user=chris

    CIB_user=root cibadmin -Q > "$TMPXML"
    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="nothing interesting"/>'
    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql

    desc="$CIB_user: Replace - create attribute (deny overrides allow)"
    cmd="cibadmin --replace -o resources --xml-file $TMPXML"
    test_assert $CRM_EX_INSUFFICIENT_PRIV 0

    # Set as root since setting as chris failed
    CIB_user=root cibadmin --modify --xml-text '<primitive id="dummy" description="nothing interesting"/>'

    CIB_user=root cibadmin -Q > "$TMPXML"
    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="something interesting"/>'
    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql

    desc="$CIB_user: Replace - modify attribute (deny overrides allow)"
    cmd="cibadmin --replace -o resources --xml-file $TMPXML"
    test_assert $CRM_EX_INSUFFICIENT_PRIV 0

    # Set as root since setting as chris failed
    CIB_user=root cibadmin --modify --xml-text '<primitive id="dummy" description="something interesting"/>'

    CIB_user=root cibadmin -Q > "$TMPXML"
    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --replace -o resources --xml-text '<primitive id="dummy" class="ocf" provider="pacemaker" type="Dummy"/>'
    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql

    desc="$CIB_user: Replace - delete attribute (deny overrides allow)"
    cmd="cibadmin --replace -o resources --xml-file $TMPXML"
    test_assert $CRM_EX_INSUFFICIENT_PRIV 0

    export PCMK_trace_functions="$orig_trace_fns"
}

function test_acls() {
    local SHADOWPATH
    local TMPXML

    TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.acls.xml.XXXXXXXXXX)

    create_shadow_cib --create-empty pacemaker-1.3

    cat <<EOF > "$TMPXML"
    <acls>
      <acl_user id="l33t-haxor">
        <deny id="crook-nothing" xpath="/cib"/>
      </acl_user>
      <acl_user id="niceguy">
        <role_ref id="observer"/>
      </acl_user>
      <acl_user id="bob">
        <role_ref id="admin"/>
      </acl_user>
      <acl_user id="joe">
        <role_ref id="super_user"/>
      </acl_user>
      <acl_user id="mike">
        <role_ref id="rsc_writer"/>
      </acl_user>
      <acl_user id="chris">
        <role_ref id="rsc_denied"/>
      </acl_user>
      <acl_role id="observer">
        <read id="observer-read-1" xpath="/cib"/>
        <write id="observer-write-1" xpath="//nvpair[@name=&apos;stonith-enabled&apos;]"/>
        <write id="observer-write-2" xpath="//nvpair[@name=&apos;target-role&apos;]"/>
      </acl_role>
      <acl_role id="admin">
        <read id="admin-read-1" xpath="/cib"/>
        <write id="admin-write-1" xpath="//resources"/>
      </acl_role>
      <acl_role id="super_user">
        <write id="super_user-write-1" xpath="/cib"/>
      </acl_role>
      <acl_role id="rsc_writer">
        <deny id="rsc-writer-deny-1" xpath="/cib"/>
        <write id="rsc-writer-write-1" xpath="//resources"/>
      </acl_role>
      <acl_role id="rsc_denied">
        <write id="rsc-denied-write-1" xpath="/cib"/>
        <deny id="rsc-denied-deny-1" xpath="//resources"/>
      </acl_role>
    </acls>
EOF

    desc="Configure some ACLs"
    cmd="cibadmin -M -o acls --xml-file $TMPXML"
    test_assert $CRM_EX_OK

    desc="Enable ACLs"
    cmd="crm_attribute -n enable-acl -v true"
    test_assert $CRM_EX_OK

    desc="Set cluster option"
    cmd="crm_attribute -n no-quorum-policy -v ignore"
    test_assert $CRM_EX_OK

    desc="New ACL"
    cmd="cibadmin --create -o acls --xml-text '<acl_user id=\"badidea\"><read id=\"badidea-resources\" xpath=\"//meta_attributes\"/></acl_user>'"
    test_assert $CRM_EX_OK

    desc="Another ACL"
    cmd="cibadmin --create -o acls --xml-text '<acl_user id=\"betteridea\"><read id=\"betteridea-resources\" xpath=\"//meta_attributes\"/></acl_user>'"
    test_assert $CRM_EX_OK

    desc="Updated ACL"
    cmd="cibadmin --replace -o acls --xml-text '<acl_user id=\"betteridea\"><deny id=\"betteridea-nothing\" xpath=\"/cib\"/><read id=\"betteridea-resources\" xpath=\"//meta_attributes\"/></acl_user>'"
    test_assert $CRM_EX_OK

    test_acl_loop "$TMPXML"

    printf "\n\n    !#!#!#!#! Upgrading to latest CIB schema and re-testing !#!#!#!#!\n"
    printf "\nUpgrading to latest CIB schema and re-testing\n" 1>&2

    export CIB_user=root
    desc="$CIB_user: Upgrade to latest CIB schema"
    cmd="cibadmin --upgrade --force -V"
    test_assert $CRM_EX_OK

    reset_shadow_cib_version

    test_acl_loop "$TMPXML"

    unset CIB_shadow_dir
    rm -f "$TMPXML"
}

function test_validity() {
    local TMPGOOD
    local TMPBAD

    TMPGOOD=$(mktemp ${TMPDIR:-/tmp}/cts-cli.validity.good.xml.XXXXXXXXXX)
    TMPBAD=$(mktemp ${TMPDIR:-/tmp}/cts-cli.validity.bad.xml.XXXXXXXXXX)

    create_shadow_cib --create-empty pacemaker-1.2
    orig_trace_fns="$PCMK_trace_functions"
    export PCMK_trace_functions=apply_upgrade,update_validation

    cibadmin -C -o resources --xml-text '<primitive id="dummy1" class="ocf" provider="pacemaker" type="Dummy"/>'
    cibadmin -C -o resources --xml-text '<primitive id="dummy2" class="ocf" provider="pacemaker" type="Dummy"/>'
    cibadmin -C -o constraints --xml-text '<rsc_order id="ord_1-2" first="dummy1" first-action="start" then="dummy2"/>'
    cibadmin -Q > "$TMPGOOD"


    desc="Try to make resulting CIB invalid (enum violation)"
    cmd="cibadmin -M -o constraints --xml-text '<rsc_order id=\"ord_1-2\" first=\"dummy1\" first-action=\"break\" then=\"dummy2\"/>'"
    test_assert $CRM_EX_CONFIG

    sed 's|"start"|"break"|' "$TMPGOOD" > "$TMPBAD"
    desc="Run crm_simulate with invalid CIB (enum violation)"
    cmd="crm_simulate -x $TMPBAD -S"
    test_assert $CRM_EX_CONFIG 0


    desc="Try to make resulting CIB invalid (unrecognized validate-with)"
    cmd="cibadmin -M --xml-text '<cib validate-with=\"pacemaker-9999.0\"/>'"
    test_assert $CRM_EX_CONFIG

    sed 's|"pacemaker-1.2"|"pacemaker-9999.0"|' "$TMPGOOD" > "$TMPBAD"
    desc="Run crm_simulate with invalid CIB (unrecognized validate-with)"
    cmd="crm_simulate -x $TMPBAD -S"
    test_assert $CRM_EX_CONFIG 0


    desc="Try to make resulting CIB invalid, but possibly recoverable (valid with X.Y+1)"
    cmd="cibadmin -C -o configuration --xml-text '<tags/>'"
    test_assert $CRM_EX_CONFIG

    sed 's|</configuration>|<tags/></configuration>|' "$TMPGOOD" > "$TMPBAD"
    desc="Run crm_simulate with invalid, but possibly recoverable CIB (valid with X.Y+1)"
    cmd="crm_simulate -x $TMPBAD -S"
    test_assert $CRM_EX_OK 0


    sed 's|[ 	][ 	]*validate-with="[^"]*"||' "$TMPGOOD" > "$TMPBAD"
    desc="Make resulting CIB valid, although without validate-with attribute"
    cmd="cibadmin -R --xml-file $TMPBAD"
    test_assert $CRM_EX_OK

    desc="Run crm_simulate with valid CIB, but without validate-with attribute"
    cmd="crm_simulate -x $TMPBAD -S"
    test_assert $CRM_EX_OK 0


    # this will just disable validation and accept the config, outputting
    # validation errors
    sed -e 's|[ 	][ 	]*validate-with="[^"]*"||' \
        -e 's|\([ 	][ 	]*epoch="[^"]*\)"|\10"|' -e 's|"start"|"break"|' \
        "$TMPGOOD" > "$TMPBAD"
    desc="Make resulting CIB invalid, and without validate-with attribute"
    cmd="cibadmin -R --xml-file $TMPBAD"
    test_assert $CRM_EX_OK

    desc="Run crm_simulate with invalid CIB, also without validate-with attribute"
    cmd="crm_simulate -x $TMPBAD -S"
    test_assert $CRM_EX_OK 0

    unset CIB_shadow_dir
    rm -f "$TMPGOOD" "$TMPBAD"
    export PCMK_trace_functions="$orig_trace_fns"
}

test_upgrade() {
    local TMPXML

    TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)

    create_shadow_cib --create-empty pacemaker-2.10
    orig_trace_fns="$PCMK_trace_functions"
    export PCMK_trace_functions=apply_upgrade,update_validation

    desc="Set stonith-enabled=false"
    cmd="crm_attribute -n stonith-enabled -v false"
    test_assert $CRM_EX_OK

    cat <<EOF > "$TMPXML"
    <resources>
      <primitive id="mySmartFuse" class="ocf" provider="experiment" type="SmartFuse">
        <operations>
          <op id="mySmartFuse-start" name="start" interval="0" timeout="40s"/>
          <op id="mySmartFuse-monitor-inputpower" name="monitor" interval="30s">
            <instance_attributes id="mySmartFuse-inputpower-instanceparams">
              <nvpair id="mySmartFuse-inputpower-requires" name="requires" value="inputpower"/>
            </instance_attributes>
          </op>
          <op id="mySmartFuse-monitor-outputpower" name="monitor" interval="2s">
            <instance_attributes id="mySmartFuse-outputpower-instanceparams">
              <nvpair id="mySmartFuse-outputpower-requires" name="requires" value="outputpower"/>
            </instance_attributes>
          </op>
        </operations>
        <instance_attributes id="mySmartFuse-params">
          <nvpair id="mySmartFuse-params-ip" name="ip" value="192.0.2.10"/>
        </instance_attributes>
	<!-- a bit hairy but valid -->
        <instance_attributes id-ref="mySmartFuse-outputpower-instanceparams"/>
      </primitive>
    </resources>
EOF

    desc="Configure the initial resource"
    cmd="cibadmin -M -o resources --xml-file $TMPXML"
    test_assert $CRM_EX_OK

    desc="Upgrade to latest CIB schema (trigger 2.10.xsl + the wrapping)"
    cmd="cibadmin --upgrade --force -V -V"
    test_assert $CRM_EX_OK

    desc="Query a resource instance attribute (shall survive)"
    cmd="crm_resource -r mySmartFuse -g requires"
    test_assert $CRM_EX_OK

    unset CIB_shadow_dir
    rm -f "$TMPXML"
    export PCMK_trace_functions="$orig_trace_fns"
}

test_rules() {
    local TMPXML

    create_shadow_cib --create-empty

    cibadmin -C -o crm_config --xml-text '<cluster_property_set id="cib-bootstrap-options"><nvpair id="cib-bootstrap-options-stonith-enabled" name="stonith-enabled" value="false"/></cluster_property_set>'
    cibadmin -C -o resources --xml-text '<primitive class="ocf" id="dummy" provider="heartbeat" type="Dummy" />'

    TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
    cat <<EOF > "$TMPXML"
<rsc_location id="cli-too-many-date-expressions" rsc="dummy">
  <rule id="cli-rule-too-many-date-expressions" score="INFINITY" boolean-op="or">
    <date_expression id="cli-date-expression-1" operation="gt" start="2020-01-01 01:00:00 -0500"/>
    <date_expression id="cli-date-expression-2" operation="lt" end="2019-01-01 01:00:00 -0500"/>
  </rule>
</rsc_location>
EOF

    cibadmin -C -o constraints -x "$TMPXML"
    rm -f "$TMPXML"

    TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
    cat <<EOF > "$TMPXML"
<rsc_location id="cli-prefer-dummy-expired" rsc="dummy">
  <rule id="cli-prefer-rule-dummy-expired" score="INFINITY">
    <date_expression id="cli-prefer-lifetime-end-dummy-expired" operation="lt" end="2019-01-01 12:00:00 -05:00"/>
  </rule>
</rsc_location>
EOF

    cibadmin -C -o constraints -x "$TMPXML"
    rm -f "$TMPXML"

    if [ "$(uname)" == "FreeBSD" ]; then
        tomorrow=$(date -v+1d +"%F %T %z")
    else
        tomorrow=$(date --date=tomorrow +"%F %T %z")
    fi

    TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
    cat <<EOF > "$TMPXML"
<rsc_location id="cli-prefer-dummy-not-yet" rsc="dummy">
  <rule id="cli-prefer-rule-dummy-not-yet" score="INFINITY">
    <date_expression id="cli-prefer-lifetime-end-dummy-not-yet" operation="gt" start="${tomorrow}"/>
  </rule>
</rsc_location>
EOF

    cibadmin -C -o constraints -x "$TMPXML"
    rm -f "$TMPXML"

    TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
    cat <<EOF > "$TMPXML"
<rsc_location id="cli-prefer-dummy-date_spec-only-years" rsc="dummy">
  <rule id="cli-prefer-rule-dummy-date_spec-only-years" score="INFINITY">
    <date_expression id="cli-prefer-dummy-date_spec-only-years-expr" operation="date_spec">
      <date_spec id="cli-prefer-dummy-date_spec-only-years-spec" years="2019"/>
    </date_expression>
  </rule>
</rsc_location>
EOF

    cibadmin -C -o constraints -x "$TMPXML"
    rm -f "$TMPXML"

    TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
    cat <<EOF > "$TMPXML"
<rsc_location id="cli-prefer-dummy-date_spec-without-years" rsc="dummy">
  <rule id="cli-prefer-rule-dummy-date_spec-without-years" score="INFINITY">
    <date_expression id="cli-prefer-dummy-date_spec-without-years-expr" operation="date_spec">
      <date_spec id="cli-prefer-dummy-date_spec-without-years-spec" hours="20" months="1,3,5,7"/>
    </date_expression>
  </rule>
</rsc_location>
EOF

    cibadmin -C -o constraints -x "$TMPXML"
    rm -f "$TMPXML"

    TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
    cat <<EOF > "$TMPXML"
<rsc_location id="cli-prefer-dummy-date_spec-years-moon" rsc="dummy">
  <rule id="cli-prefer-rule-dummy-date_spec-years-moon" score="INFINITY">
    <date_expression id="cli-prefer-dummy-date_spec-years-moon-expr" operation="date_spec">
      <date_spec id="cli-prefer-dummy-date_spec-years-moon-spec" years="2019" moon="1"/>
    </date_expression>
  </rule>
</rsc_location>
EOF

    cibadmin -C -o constraints -x "$TMPXML"
    rm -f "$TMPXML"

    TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
    cat <<EOF > "$TMPXML"
<rsc_location id="cli-no-date_expression" rsc="dummy">
  <rule id="cli-no-date_expression-rule" score="INFINITY">
    <expression id="ban-apache-expr" attribute="#uname" operation="eq" value="node3"/>
  </rule>
</rsc_location>
EOF

    cibadmin -C -o constraints -x "$TMPXML"
    rm -f "$TMPXML"

    desc="crm_rule given no arguments"
    cmd="crm_rule"
    test_assert $CRM_EX_USAGE 0

    desc="crm_rule given no arguments (XML)"
    cmd="crm_rule --output-as=xml"
    test_assert_validate $CRM_EX_USAGE 0

    desc="crm_rule given no rule to check"
    cmd="crm_rule -c"
    test_assert $CRM_EX_USAGE 0

    desc="crm_rule given no rule to check (XML)"
    cmd="crm_rule -c --output-as=xml"
    test_assert_validate $CRM_EX_USAGE 0

    desc="crm_rule given invalid input XML"
    cmd="crm_rule -c -r blahblah -X 'invalidxml'"
    test_assert $CRM_EX_DATAERR 0

    desc="crm_rule given invalid input XML (XML)"
    cmd="crm_rule -c -r blahblah -X 'invalidxml' --output-as=xml"
    test_assert_validate $CRM_EX_DATAERR 0

    desc="crm_rule given invalid input XML on stdin"
    cmd="echo 'invalidxml' | crm_rule -c -r blahblah -X -"
    test_assert $CRM_EX_DATAERR 0

    desc="crm_rule given invalid input XML on stdin (XML)"
    cmd="echo 'invalidxml' | crm_rule -c -r blahblah -X - --output-as=xml"
    test_assert_validate $CRM_EX_DATAERR 0

    desc="Try to check a rule that doesn't exist"
    cmd="crm_rule -c -r blahblah"
    test_assert $CRM_EX_NOSUCH

    desc="Try to check a rule that doesn't exist, with XML output"
    cmd="crm_rule -c -r blahblah --output-as=xml"
    test_assert_validate $CRM_EX_NOSUCH 0

    desc="Try to check a rule that has too many date_expressions"
    cmd="crm_rule -c -r cli-rule-too-many-date-expressions"
    test_assert $CRM_EX_UNIMPLEMENT_FEATURE 0

    desc="Try to check a rule that has too many date_expressions (XML)"
    cmd="crm_rule -c -r cli-rule-too-many-date-expressions --output-as=xml"
    test_assert_validate $CRM_EX_UNIMPLEMENT_FEATURE 0

    desc="Verify basic rule is expired"
    cmd="crm_rule -c -r cli-prefer-rule-dummy-expired"
    test_assert $CRM_EX_EXPIRED 0

    desc="Verify basic rule is expired, with XML output"
    cmd="crm_rule -c -r cli-prefer-rule-dummy-expired --output-as=xml"
    test_assert_validate $CRM_EX_EXPIRED 0

    desc="Verify basic rule worked in the past"
    cmd="crm_rule -c -r cli-prefer-rule-dummy-expired -d 20180101"
    test_assert $CRM_EX_OK 0

    desc="Verify basic rule worked in the past (XML)"
    cmd="crm_rule -c -r cli-prefer-rule-dummy-expired -d 20180101 --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    desc="Verify basic rule is not yet in effect"
    cmd="crm_rule -c -r cli-prefer-rule-dummy-not-yet"
    test_assert $CRM_EX_NOT_YET_IN_EFFECT 0

    desc="Verify basic rule is not yet in effect (XML)"
    cmd="crm_rule -c -r cli-prefer-rule-dummy-not-yet --output-as=xml"
    test_assert_validate $CRM_EX_NOT_YET_IN_EFFECT 0

    desc="Verify date_spec rule with years has expired"
    cmd="crm_rule -c -r cli-prefer-rule-dummy-date_spec-only-years"
    test_assert $CRM_EX_EXPIRED 0

    desc="Verify date_spec rule with years has expired (XML)"
    cmd="crm_rule -c -r cli-prefer-rule-dummy-date_spec-only-years --output-as=xml"
    test_assert_validate $CRM_EX_EXPIRED 0

    desc="Verify multiple rules at once"
    cmd="crm_rule -c -r cli-prefer-rule-dummy-not-yet -r cli-prefer-rule-dummy-date_spec-only-years"
    test_assert $CRM_EX_EXPIRED 0

    desc="Verify multiple rules at once, with XML output"
    cmd="crm_rule -c -r cli-prefer-rule-dummy-not-yet -r cli-prefer-rule-dummy-date_spec-only-years --output-as=xml"
    test_assert_validate $CRM_EX_EXPIRED 0

    desc="Verify date_spec rule with years is in effect"
    cmd="crm_rule -c -r cli-prefer-rule-dummy-date_spec-only-years -d 20190201"
    test_assert $CRM_EX_OK 0

    desc="Verify date_spec rule with years is in effect (XML)"
    cmd="crm_rule -c -r cli-prefer-rule-dummy-date_spec-only-years -d 20190201 --output-as=xml"
    test_assert_validate $CRM_EX_OK 0

    desc="Try to check a rule whose date_spec does not contain years="
    cmd="crm_rule -c -r cli-prefer-rule-dummy-date_spec-without-years"
    test_assert $CRM_EX_UNIMPLEMENT_FEATURE 0

    desc="Try to check a rule whose date_spec does not contain years= (XML)"
    cmd="crm_rule -c -r cli-prefer-rule-dummy-date_spec-without-years --output-as=xml"
    test_assert_validate $CRM_EX_UNIMPLEMENT_FEATURE 0

    desc="Try to check a rule whose date_spec contains years= and moon="
    cmd="crm_rule -c -r cli-prefer-rule-dummy-date_spec-years-moon"
    test_assert $CRM_EX_UNIMPLEMENT_FEATURE 0

    desc="Try to check a rule whose date_spec contains years= and moon= (XML)"
    cmd="crm_rule -c -r cli-prefer-rule-dummy-date_spec-years-moon --output-as=xml"
    test_assert_validate $CRM_EX_UNIMPLEMENT_FEATURE 0

    desc="Try to check a rule with no date_expression"
    cmd="crm_rule -c -r cli-no-date_expression-rule"
    test_assert $CRM_EX_UNIMPLEMENT_FEATURE 0

    desc="Try to check a rule with no date_expression (XML)"
    cmd="crm_rule -c -r cli-no-date_expression-rule --output-as=xml"
    test_assert_validate $CRM_EX_UNIMPLEMENT_FEATURE 0

    unset CIB_shadow_dir
}

# Ensure all command output is in portable locale for comparison
export LC_ALL="C"
test_access_render() {
    local TMPXML

    TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.access_render.xml.XXXXXXXXXX)
    export CIB_shadow_dir="${shadow_dir}"

    $VALGRIND_CMD crm_shadow --batch --force --create-empty $shadow 2>&1
    export CIB_shadow=$shadow

    # Create a test CIB that has ACL roles
    cat <<EOF > "$TMPXML"
    <acls>
      <acl_role id="role-deny-acls">
        <acl_permission id="deny-acls" kind="deny" xpath="/cib/configuration/acls"/>
        <acl_permission id="read-rest" kind="read" xpath="/cib"/>
      </acl_role>
      <acl_target id="tony">
        <role id="role-deny-acls"/>
      </acl_target>
    </acls>
EOF

    desc="Configure some ACLs"
    cmd="cibadmin -M -o acls --xml-file $TMPXML"
    test_assert $CRM_EX_OK

    desc="Enable ACLs"
    cmd="crm_attribute -n enable-acl -v true"
    test_assert $CRM_EX_OK

    unset CIB_user

    # Run cibadmin --show-access on the test CIB with different users (tony here)

    desc="An instance of ACLs render (into color)"
    cmd="cibadmin --force --show-access=color -Q --user tony"
    test_assert $CRM_EX_OK 0

    desc="An instance of ACLs render (into namespacing)"
    cmd="cibadmin --force --show-access=namespace -Q --user tony"
    test_assert $CRM_EX_OK 0

    desc="An instance of ACLs render (into text)"
    cmd="cibadmin --force --show-access=text -Q --user tony"
    test_assert $CRM_EX_OK 0

    unset CIB_shadow_dir
    rm -f "$TMPXML"
}

function test_feature_set() {
    create_shadow_cib --create-empty

    # Import the initial test CIB with non-mixed versions
    desc="Import the test CIB"
    cmd="cibadmin --replace --xml-file $test_home/cli/crm_mon-feature_set.xml"
    test_assert $CRM_EX_OK

    desc="Complete text output, no mixed status"
    cmd="crm_mon -1 --show-detail"
    test_assert $CRM_EX_OK 0

    desc="XML output, no mixed status"
    cmd="crm_mon --output-as=xml"
    test_assert $CRM_EX_OK 0

    # Modify the CIB to fake that the cluster has mixed versions
    desc="Fake inconsistent feature set"
    cmd="crm_attribute --node=cluster02 --name=#feature-set --update=3.15.0 --lifetime=reboot"
    test_assert $CRM_EX_OK

    desc="Complete text output, mixed status"
    cmd="crm_mon -1 --show-detail"
    test_assert $CRM_EX_OK 0

    desc="XML output, mixed status"
    cmd="crm_mon --output-as=xml"
    test_assert $CRM_EX_OK 0

    unset CIB_shadow_dir
}

# Process command-line arguments
while [ $# -gt 0 ]; do
    case "$1" in
        -t)
            tests="$2"
            shift 2
            ;;
        -V|--verbose)
            verbose=1
            shift
            ;;
        -v|--valgrind)
            export G_SLICE=always-malloc
            VALGRIND_CMD="valgrind $VALGRIND_OPTS"
            shift
            ;;
        -s)
            do_save=1
            shift
            ;;
        -p)
            export PATH="$2:$PATH"
            shift
            ;;
        --help)
            echo "$USAGE_TEXT"
            exit $CRM_EX_OK
            ;;
        *)
            echo "error: unknown option $1"
            echo
            echo "$USAGE_TEXT"
            exit $CRM_EX_USAGE
            ;;
    esac
done

for t in $tests; do
    case "$t" in
        agents) ;;
        daemons) ;;
        dates) ;;
        error_codes) ;;
        tools) ;;
        acls) ;;
        validity) ;;
        upgrade) ;;
        rules) ;;
        crm_mon) ;;
        feature_set) ;;
        *)
            echo "error: unknown test $t"
            echo
            echo "$USAGE_TEXT"
            exit $CRM_EX_USAGE
            ;;
    esac
done

XMLLINT_CMD=$(which xmllint 2>/dev/null)
if [ $? -ne 0 ]; then
    XMLLINT_CMD=""
    echo "xmllint is missing - install it to validate command output"
fi

# Check whether we're running from source directory
SRCDIR=$(dirname $test_home)
if [ -x "$SRCDIR/tools/crm_simulate" ]; then
    path_dirs="$SRCDIR/tools"
    for daemon in based controld fenced schedulerd; do
        if [ -x "$SRCDIR/daemons/$daemon/pacemaker-${daemon}" ]; then
            path_dirs="$path_dirs:$SRCDIR/daemons/$daemon"
        fi
    done
    export PATH="$path_dirs:$PATH"

    echo "Using local binaries from: ${path_dirs//:/ }"

    if [ -x "$SRCDIR/xml" ]; then
        export PCMK_schema_directory="$SRCDIR/xml"
        echo "Using local schemas from: $PCMK_schema_directory"
    fi
else
    export PATH="@CRM_DAEMON_DIR@:$PATH"
    export PCMK_schema_directory=@CRM_SCHEMA_DIRECTORY@
fi

for t in $tests; do
    echo "Testing $t"
    TMPFILE=$(mktemp ${TMPDIR:-/tmp}/cts-cli.$t.XXXXXXXXXX)
    eval TMPFILE_$t="$TMPFILE"
    test_$t > "$TMPFILE"

    # last-rc-change= is always numeric in the CIB. However, for the crm_mon
    # test we also need to compare against the XML output of the crm_mon
    # program. There, these are shown as human readable strings (like the
    # output of the `date` command).
    sed -e 's|\(<cib.*\) cib-last-written[^/]*/>|\1/>|' \
        -e 's|\(<cib.*\) cib-last-written[^/]*>|\1>|' \
        -e 's/Last updated: .*/Last updated:/' \
        -e 's/Last change: .*/Last change:/' \
        -e 's/(version .*)/(version)/' \
        -e 's/last_update time=\".*\"/last_update time=\"\"/' \
        -e 's/last_change time=\".*\"/last_change time=\"\"/' \
        -e 's/ api-version="[^"]*"/ api-version="X"/' \
        -e 's/ default="[^"]*"/ default=""/' \
        -e 's/ version="[^"]*"/ version=""/' \
        -e 's/request=\".*\(crm_[a-zA-Z0-9]*\)/request=\"\1/' \
        -e 's/crm_feature_set="[^"]*" //'\
        -e 's/validate-with="[^"]*" //'\
        -e 's/Created new pacemaker-.* configuration/Created new pacemaker configuration/'\
        -e 's/.*\(crm_time_parse_duration\)@.*\.c:[0-9][0-9]*)/\1/g' \
        -e 's/.*\(crm_time_parse_period\)@.*\.c:[0-9][0-9]*)/\1/g' \
        -e 's/.*\(crm_time_parse_sec\)@.*\.c:[0-9][0-9]*)/\1/g' \
        -e 's/.*\(log_xmllib_err\)@.*\.c:[0-9][0-9]*)/\1/g' \
        -e 's/.*\(parse_date\)@.*\.c:[0-9][0-9]*)/\1/g' \
        -e 's/.*\(pcmk__.*\)@.*\.c:[0-9][0-9]*)/\1/g' \
        -e 's/.*\(unpack_.*\)@.*\.c:[0-9][0-9]*)/\1/g' \
        -e 's/.*\(update_validation\)@.*\.c:[0-9][0-9]*)/\1/g' \
        -e 's/.*\(apply_upgrade\)@.*\.c:[0-9][0-9]*)/\1/g' \
        -e "s/ last-rc-change=['\"][-+A-Za-z0-9: ]*['\"],\{0,1\}//" \
        -e 's|^/tmp/cts-cli\.shadow\.[^/]*/|/tmp/cts-cli.shadow/|' \
        -e 's|"/tmp/cts-cli\.shadow\.[^/]*/|"/tmp/cts-cli.shadow/|' \
        -e 's|^/tmp/cts-cli\.validity\.bad.xml\.[^:]*:|validity.bad.xml:|'\
        -e 's/^Entity: line [0-9][0-9]*: //'\
        -e 's/\(validation ([0-9][0-9]* of \)[0-9][0-9]*\().*\)/\1X\2/' \
        -e 's/^Migration will take effect until: .*/Migration will take effect until:/' \
        -e 's/ end=\"[0-9][-+: 0-9]*Z*\"/ end=\"\"/' \
        -e 's/ start=\"[0-9][-+: 0-9]*Z*\"/ start=\"\"/' \
        -e 's/Device not configured/No such device or address/' \
        -e 's/\(Injecting attribute last-failure-ping#monitor_10000=\)[0-9]*/\1/' \
        -e 's/^lt-//' \
        -e 's/ocf::/ocf:/' \
        -e 's/Masters:/Promoted:/' \
        -e 's/Slaves:/Unpromoted:/' \
        -e 's/Master/Promoted/' \
        -e 's/Slave/Unpromoted/' \
        -e 's/\x1b/\\x1b/' \
        "$TMPFILE" > "${TMPFILE}.$$"
    mv -- "${TMPFILE}.$$" "$TMPFILE"

    if [ $do_save -eq 1 ]; then
        cp "$TMPFILE" $test_home/cli/regression.$t.exp
    fi
done

rm -rf "${shadow_dir}"
rm -f "${test_assert_outfile}"
rm -f "${test_assert_errfile}"
rm -f "${xmllint_outfile}"

failed=0

if [ $verbose -eq 1 ]; then
    echo -e "\n\nResults"
fi
for t in $tests; do
    eval TMPFILE="\$TMPFILE_$t"
    if [ $verbose -eq 1 ]; then
        diff -wu $test_home/cli/regression.$t.exp "$TMPFILE"
    else
        diff -w $test_home/cli/regression.$t.exp "$TMPFILE" >/dev/null 2>&1
    fi
    if [ $? -ne 0 ]; then
        failed=1
    fi
done

echo -e "\n\nSummary"
for t in $tests; do
    eval TMPFILE="\$TMPFILE_$t"
    grep -e '^\* \(Passed\|Failed\)' "$TMPFILE"
done

function print_or_remove_file() {

  eval TMPFILE="\$TMPFILE_$1"
  if [[ ! $(diff -wq $test_home/cli/regression.$1.exp "$TMPFILE") ]]; then
    rm -f "$TMPFILE"
  else
    echo "    $TMPFILE"
  fi
}

if [ $num_errors -ne 0 ] && [ $failed -ne 0 ]; then
    echo "$num_errors tests failed; see output in:"
    for t in $tests; do
      print_or_remove_file "$t"
    done
    exit $CRM_EX_ERROR
elif [ $num_errors -ne 0 ]; then
    echo "$num_errors tests failed"
    for t in $tests; do
      print_or_remove_file "$t"
    done
    exit $CRM_EX_ERROR
elif [ $failed -eq 1 ]; then
    echo "$num_passed tests passed but output was unexpected; see output in:"
    for t in $tests; do
      print_or_remove_file "$t"
    done
    exit $CRM_EX_DIGEST
else
    echo $num_passed tests passed
    for t in $tests; do
        eval TMPFILE="\$TMPFILE_$t"
        rm -f "$TMPFILE"
    done
    crm_shadow --force --delete $shadow >/dev/null 2>&1
    exit $CRM_EX_OK
fi