@Test
public final void test_isPolicyResourceUnique() throws Exception {

	// if store does not contain any matching policies then check should succeed
	RangerPolicyResourceSignature signature = mock(RangerPolicyResourceSignature.class);
	String hash = "hash-1";
	when(signature.getSignature()).thenReturn(hash);
	when(_factory.createPolicyResourceSignature(_policy)).thenReturn(signature);
	when(_policy.getService()).thenReturn("service-name");
	List<RangerPolicy> policies = null;
	when(_store.getPoliciesByResourceSignature("service-name", hash, true)).thenReturn(policies);
	policies = new ArrayList<>();
	for (Action action : cu) {
		Assert.assertTrue(_validator.isPolicyResourceUnique(_policy, _failures, action));
		Assert.assertTrue(_validator.isPolicyResourceUnique(_policy, _failures, action));
	}
	/*
	 * If store has a policy with matching signature then the check should fail with appropriate error message.
	 * - For create any match is a problem
	 * - Signature check can never fail for disabled policies!
	 */
	RangerPolicy policy1 = mock(RangerPolicy.class); policies.add(policy1);
	when(_store.getPoliciesByResourceSignature("service-name", hash, true)).thenReturn(policies);
	when(_policy.getIsEnabled()).thenReturn(true); // ensure policy is enabled
	_failures.clear(); Assert.assertFalse(_validator.isPolicyResourceUnique(_policy, _failures, Action.CREATE));
	_utils.checkFailureForSemanticError(_failures, "resources");
	// same check should pass if the policy is disabled
	when(_policy.getIsEnabled()).thenReturn(false);
	_failures.clear(); Assert.assertTrue(_validator.isPolicyResourceUnique(_policy, _failures, Action.CREATE));
	Assert.assertTrue("failures collection wasn't empty!", _failures.isEmpty());
	// For Update match with itself is not a problem as long as it isn't itself, i.e. same id.
	when(_policy.getIsEnabled()).thenReturn(true); // ensure policy is enabled
	when(policy1.getId()).thenReturn(103L);
	when(_policy.getId()).thenReturn(103L);
	Assert.assertTrue(_validator.isPolicyResourceUnique(_policy, _failures, Action.UPDATE));
	
	// matching policy can't be some other policy (i.e. different id) because that implies a conflict.
	when(policy1.getId()).thenReturn(104L);
	Assert.assertFalse(_validator.isPolicyResourceUnique(_policy, _failures, Action.UPDATE));
	_utils.checkFailureForSemanticError(_failures, "resources");
	// same check should pass if the policy is disabled
	when(_policy.getIsEnabled()).thenReturn(false);
	_failures.clear(); Assert.assertTrue(_validator.isPolicyResourceUnique(_policy, _failures, Action.UPDATE));
	Assert.assertTrue("failures collection wasn't empty!", _failures.isEmpty());
	
	// And validation should never pass if there are more than one policies with matching signature, regardless of their ID!!
	RangerPolicy policy2 = mock(RangerPolicy.class);
	when(policy2.getId()).thenReturn(103L);  // has same id as the policy being tested (_policy)
	policies.add(policy2);
	when(_policy.getIsEnabled()).thenReturn(true); // ensure policy is enabled
	Assert.assertFalse(_validator.isPolicyResourceUnique(_policy, _failures, Action.UPDATE));
	_utils.checkFailureForSemanticError(_failures, "resources");
	// same check should pass if the policy is disabled
	when(_policy.getIsEnabled()).thenReturn(false);
	_failures.clear(); Assert.assertTrue(_validator.isPolicyResourceUnique(_policy, _failures, Action.UPDATE));
	Assert.assertTrue("failures collection wasn't empty!", _failures.isEmpty());
}