@Test
public void testGetAccess() {

    TopLevelDomain dom1 = createTopLevelDomainObject("AccessDom1",
            "Test Domain1", "testOrg", adminUser);
    zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1);
    Role role1 = createRoleObject("AccessDom1", "Role1", null, "user.user1",
            "user.user3");
    zms.putRole(mockDomRsrcCtx, "AccessDom1", "Role1", auditRef, role1);
    Role role2 = createRoleObject("AccessDom1", "Role2", null, "user.user2",
            "user.user3");
    zms.putRole(mockDomRsrcCtx, "AccessDom1", "Role2", auditRef, role2);
    Policy policy1 = createPolicyObject("AccessDom1", "Policy1", "Role1",
            "UPDATE", "AccessDom1:resource1", AssertionEffect.ALLOW);
    zms.putPolicy(mockDomRsrcCtx, "AccessDom1", "Policy1", auditRef, policy1);
    Policy policy2 = createPolicyObject("AccessDom1", "Policy2", "Role2",
            "CREATE", "AccessDom1:resource2", AssertionEffect.DENY);
    zms.putPolicy(mockDomRsrcCtx, "AccessDom1", "Policy2", auditRef, policy2);
    Policy policy3 = createPolicyObject("AccessDom1", "Policy3", "Role2",
            "*", "AccessDom1:resource3", AssertionEffect.ALLOW);
    zms.putPolicy(mockDomRsrcCtx, "AccessDom1", "Policy3", auditRef, policy3);
    Policy policy4 = createPolicyObject("AccessDom1", "Policy4", "Role2",
            "DELETE", "accessdom1:*", AssertionEffect.ALLOW);
    zms.putPolicy(mockDomRsrcCtx, "AccessDom1", "Policy4", auditRef, policy4);
    Policy policy5 = createPolicyObject("AccessDom1", "Policy5", "Role1",
            "READ", "accessdom1:*", AssertionEffect.ALLOW);
    zms.putPolicy(mockDomRsrcCtx, "AccessDom1", "Policy5", auditRef, policy5);
    Policy policy6 = createPolicyObject("AccessDom1", "Policy6", "Role1",
            "READ", "AccessDom1:resource6", AssertionEffect.DENY);
    zms.putPolicy(mockDomRsrcCtx, "AccessDom1", "Policy6", auditRef, policy6);
    // user1 and user3 have access to UPDATE/resource1
    Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority();
    Principal principal1 = principalAuthority.authenticate("v=U1;d=user;n=user1;s=signature",
            "10.11.12.13", "GET", null);
    ResourceContext rsrcCtx1 = createResourceContext(principal1);
    Principal principal2 = principalAuthority.authenticate("v=U1;d=user;n=user2;s=signature",
            "10.11.12.13", "GET", null);
    ResourceContext rsrcCtx2 = createResourceContext(principal2);
    Principal principal3 = principalAuthority.authenticate("v=U1;d=user;n=user3;s=signature",
            "10.11.12.13", "GET", null);
    ResourceContext rsrcCtx3 = createResourceContext(principal3);
    Access access = zms.getAccess(rsrcCtx1, "UPDATE", "AccessDom1:resource1",
            "AccessDom1", null);
    assertTrue(access.getGranted());
    access = zms.getAccess(rsrcCtx2, "UPDATE", "AccessDom1:resource1",
            "AccessDom1", null);
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx3, "UPDATE", "AccessDom1:resource1",
            "AccessDom1", null);
    assertTrue(access.getGranted());
    // same set as before with no trust domain field
    access = zms.getAccess(rsrcCtx1, "UPDATE", "AccessDom1:resource1",
            null, null);
    assertTrue(access.getGranted());
    access = zms.getAccess(rsrcCtx2, "UPDATE", "AccessDom1:resource1",
            null, null);
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx3, "UPDATE", "AccessDom1:resource1",
            null, null);
    assertTrue(access.getGranted());
    // all three have no access to CREATE action on resource1
    access = zms.getAccess(rsrcCtx1, "CREATE", "AccessDom1:resource1",
            "AccessDom1", null);
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx2, "CREATE", "AccessDom1:resource1",
            "AccessDom1", null);
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx3, "CREATE", "AccessDom1:resource1",
            "AccessDom1", null);
    assertFalse(access.getGranted());
    // all three have no access to invalid domain name on resource 1
    access = zms.getAccess(rsrcCtx1, "CREATE", "AccessDom1:resource1",
            "AccessDom2", null);
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx2, "CREATE", "AccessDom1:resource1",
            "AccessDom2", null);
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx3, "CREATE", "AccessDom1:resource1",
            "AccessDom2", null);
    assertFalse(access.getGranted());
    // same as before with no trust domain field
    access = zms.getAccess(rsrcCtx1, "CREATE", "AccessDom1:resource1",
            null, null);
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx2, "CREATE", "AccessDom1:resource1",
            null, null);
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx3, "CREATE", "AccessDom1:resource1",
            null, null);
    assertFalse(access.getGranted());
    // all three should have deny access to resource 2
    access = zms.getAccess(rsrcCtx1, "CREATE", "AccessDom1:resource2",
            "AccessDom1", null);
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx2, "CREATE", "AccessDom1:resource2",
            "AccessDom1", null);
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx3, "CREATE", "AccessDom1:resource2",
            "AccessDom1", null);
    assertFalse(access.getGranted());
    // user2 and user3 have access to CREATE(*)/resource 3
    access = zms.getAccess(rsrcCtx1, "CREATE", "AccessDom1:resource3",
            "AccessDom1", null);
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx2, "CREATE", "AccessDom1:resource3",
            "AccessDom1", null);
    assertTrue(access.getGranted());
    access = zms.getAccess(rsrcCtx3, "CREATE", "AccessDom1:resource3",
            "AccessDom1", null);
    assertTrue(access.getGranted());
    // user2 and user3 have access to UPDATE(*)/resource 3
    access = zms.getAccess(rsrcCtx1, "UPDATE", "AccessDom1:resource3",
            "AccessDom1", null);
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx2, "UPDATE", "AccessDom1:resource3",
            "AccessDom1", null);
    assertTrue(access.getGranted());
    access = zms.getAccess(rsrcCtx3, "UPDATE", "AccessDom1:resource3",
            "AccessDom1", null);
    assertTrue(access.getGranted());
    // user2 and user3 have access to DELETE/resource 4 (*)
    access = zms.getAccess(rsrcCtx1, "DELETE", "AccessDom1:resource4",
            "AccessDom1", null);
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx2, "DELETE", "AccessDom1:resource4",
            "AccessDom1", null);
    assertTrue(access.getGranted());
    access = zms.getAccess(rsrcCtx3, "DELETE", "AccessDom1:resource4",
            "AccessDom1", null);
    assertTrue(access.getGranted());
    // user1 should be able to read resource 5(*) but not resource 6
    // (explicit DENY)
    access = zms.getAccess(rsrcCtx1, "READ", "AccessDom1:resource5",
            "AccessDom1", null);
    assertTrue(access.getGranted());
    access = zms.getAccess(rsrcCtx1, "READ", "AccessDom1:resource6",
            "AccessDom1", null);
    assertFalse(access.getGranted());
    // we should get an exception since access is not allowed to be called
    // with user cookie - this api is only for functions that require a 
    // service or user tokens
    try {
        zms.access("READ", "AccessDom1:resource5", principal1, "AccessDom1");
    } catch (ResourceException ex) {
        assertEquals(400, ex.getCode());
    }
    zms.deleteTopLevelDomain(mockDomRsrcCtx, "AccessDom1", auditRef);
}