@Test
public final void testIsValid_happyPath() throws Exception {

	// valid policy has valid non-empty name and service name
	when(_policy.getService()).thenReturn("service-name");
	// service name exists
	RangerService service = mock(RangerService.class);
	when(service.getType()).thenReturn("service-type");
	when(service.getId()).thenReturn(2L);
	when(_store.getServiceByName("service-name")).thenReturn(service);
	// service points to a valid service-def
	_serviceDef = _utils.createServiceDefWithAccessTypes(accessTypes);
	when(_serviceDef.getName()).thenReturn("service-type");
	when(_store.getServiceDefByName("service-type")).thenReturn(_serviceDef);
	// a matching policy should exist for create when checked by id and not exist when checked by name.
	when(_store.getPolicy(7L)).thenReturn(null);
	RangerPolicy existingPolicy = mock(RangerPolicy.class);
	when(existingPolicy.getId()).thenReturn(8L);
	when(existingPolicy.getService()).thenReturn("service-name");
	when(_store.getPolicy(8L)).thenReturn(existingPolicy);
	// a matching policy should not exist for update.
	// valid policy can have empty set of policy items if audit is turned on
	// null value for audit is treated as audit on.
	// for now we want to turn any resource related checking off
	when(_policy.getResources()).thenReturn(null);
	for (Action action : cu) {
		for (Boolean auditEnabled : new Boolean[] { null, true } ) {
			for (boolean isAdmin : new boolean[] { true, false }) {
				when(_policy.getIsAuditEnabled()).thenReturn(auditEnabled);
				if (action == Action.CREATE) {
					when(_policy.getId()).thenReturn(7L);
					when(_policy.getName()).thenReturn("policy-name-1");
					when(_store.getPolicyId(service.getId(), _policy.getName(), _zoneId)).thenReturn(null);
					Assert.assertTrue("" + action + ", " + auditEnabled, _validator.isValid(_policy, action, isAdmin, _failures));
					Assert.assertTrue(_failures.isEmpty());
				} else {
					// update should work both when by-name is found or not, since nothing found by-name means name is being updated.
					when(_policy.getId()).thenReturn(8L);
					when(_policy.getName()).thenReturn("policy-name-1");
					Assert.assertTrue("" + action + ", " + auditEnabled, _validator.isValid(_policy, action, isAdmin, _failures));
					Assert.assertTrue(_failures.isEmpty());

					when(_policy.getName()).thenReturn("policy-name-2");
					when(_store.getPolicyId(service.getId(), _policy.getName(), _zoneId)).thenReturn(null);
					Assert.assertTrue("" + action + ", " + auditEnabled, _validator.isValid(_policy, action, isAdmin, _failures));
					Assert.assertTrue(_failures.isEmpty());
				}
			}
		}
	}
	// if audit is disabled then policy should have policy items and all of them should be valid
	List<RangerPolicyItem> policyItems = _utils.createPolicyItems(policyItemsData);
	when(_policy.getPolicyItems()).thenReturn(policyItems);
	when(_policy.getIsAuditEnabled()).thenReturn(false);
	for (Action action : cu) {
		for (boolean isAdmin : new boolean[] { true, false}) {
			if (action == Action.CREATE) {
				when(_policy.getId()).thenReturn(7L);
				when(_policy.getName()).thenReturn("policy-name-1");
			} else {
				when(_policy.getId()).thenReturn(8L);
				when(_policy.getName()).thenReturn("policy-name-2");
			}
			Assert.assertTrue("" + action , _validator.isValid(_policy, action, isAdmin, _failures));
			Assert.assertTrue(_failures.isEmpty());
		}
	}
	
	// above succeeded as service def did not have any resources on it, mandatory or otherwise.
	// policy should have all mandatory resources specified, and they should conform to the validation pattern in resource definition
	List<RangerResourceDef> resourceDefs = _utils.createResourceDefs(resourceDefData);
	when(_serviceDef.getResources()).thenReturn(resourceDefs);
	Map<String, RangerPolicyResource> resourceMap = _utils.createPolicyResourceMap(policyResourceMap_good);
	when(_policy.getResources()).thenReturn(resourceMap);
	// let's add some other policies in the store for this service that have a different signature
	// setup the signatures on the policies
	RangerPolicyResourceSignature policySignature = mock(RangerPolicyResourceSignature.class);
	when(_factory.createPolicyResourceSignature(_policy)).thenReturn(policySignature);
	// setup the store to indicate that no other policy exists with matching signature
	when(policySignature.getSignature()).thenReturn("hash-1");
	when(_store.getPoliciesByResourceSignature("service-name", "hash-1", true)).thenReturn(null);
	// we are reusing the same policies collection here -- which is fine
	for (Action action : cu) {
		if (action == Action.CREATE) {
			when(_policy.getId()).thenReturn(7L);
			when(_policy.getName()).thenReturn("policy-name-1");
		} else {
			when(_policy.getId()).thenReturn(8L);
			when(_policy.getName()).thenReturn("policy-name-2");
		}
		Assert.assertTrue("" + action , _validator.isValid(_policy, action, true, _failures)); // since policy resource has excludes admin privilages would be required
		Assert.assertTrue(_failures.isEmpty());
	}
}