Merge lp:~cjwatson/lazr.restful/scopes into lp:lazr.restful

[Colin Watson]

Add a new @scoped decorator.

This allows applications to tag methods with scope names and issue authentication tokens constrained to only be able to call methods with particular scopes. Scoped requests cannot currently use attributes, accessors, or mutators; this may change in future.

Launchpad will use this in conjunction with its new `AccessToken` table.

[Cristian Gonzalez (cristiangsp)]

Looks good. Also nice to see the documentation included. Good job!

review: Approve

[Ioana Lasc (ilasc)]

LGTM!

review: Approve

[William Grant (wgrant)]

review: Approve (code)

=== modified file 'NEWS.rst'
--- NEWS.rst	2021-09-13 15:23:15 +0000
+++ NEWS.rst	2021-10-06 10:26:55 +0000
@@ -2,6 +2,15 @@
 NEWS for lazr.restful
 =====================
 
+1.1.0
+=====
+
+- Add a new ``@scoped`` decorator to ``lazr.restful.declarations``, allowing
+  applications to tag methods with scope names and issue authentication
+  tokens constrained to only be able to call methods with particular scopes.
+  Scoped requests cannot currently use attributes, accessors, or mutators;
+  this may change in future.
+
 1.0.4 (2021-09-13)
 ==================
 

=== modified file 'src/lazr/restful/declarations.py'
--- src/lazr/restful/declarations.py	2021-02-16 16:51:35 +0000
+++ src/lazr/restful/declarations.py	2021-10-06 10:26:55 +0000
@@ -40,6 +40,7 @@
     'operation_returns_entry',
     'operation_returns_collection_of',
     'rename_parameters_as',
+    'scoped',
     'webservice_error',
     ]
 
@@ -1059,6 +1060,28 @@
         annotations['cache_for'] = self.duration
 
 
+class scoped(_method_annotator):
+    """Decorator assigning scopes to a method.
+
+    This may be used to grant authentication tokens that are only valid for
+    certain webservice operations.
+
+    The decorator takes a collection of scope names as positional arguments.
+    """
+
+    def __init__(self, *scopes):
+        for scope in scopes:
+            if not isinstance(scope, six.string_types):
+                raise TypeError(
+                    'Scope should be a string type, not %s' %
+                    scope.__class__.__name__)
+        self.scopes = scopes
+
+    def annotate_method(self, method, annotations):
+        """See `_method_annotator`."""
+        annotations['scopes'] = list(self.scopes)
+
+
 class export_read_operation(_export_operation):
     """Decorator marking a method for export as a read operation."""
     type = 'read_operation'
@@ -1315,7 +1338,7 @@
                     orig_name, 'context', accessor,
                     accessor_annotations, orig_iface)
             else:
-                prop = Passthrough(orig_name, 'context', orig_iface)
+                prop = _ScopeChecker(orig_name, 'context', orig_iface)
 
             adapter_dict[tags['as']] = prop
 
@@ -1359,11 +1382,40 @@
     return params
 
 
+def _check_request(context, required_scopes):
+    """Check whether the current request may call a particular method.
+
+    See `IWebServiceConfiguration.checkRequest`.
+    """
+    check_request = getattr(
+        getUtility(IWebServiceConfiguration), 'checkRequest', None)
+    if check_request is not None:
+        check_request(context, required_scopes)
+
+
+class _ScopeChecker(Passthrough):
+    """Check scopes before allowing access to properties."""
+
+    def __get__(self, inst, cls=None):
+        context = getattr(inst, self.contextvar)
+        if self.adaptation is not None:
+            context = self.adaptation(context)
+        _check_request(context, None)
+        return super(_ScopeChecker, self).__get__(inst, cls=cls)
+
+    def __set__(self, inst, value):
+        context = getattr(inst, self.contextvar)
+        if self.adaptation is not None:
+            context = self.adaptation(context)
+        _check_request(context, None)
+        return super(_ScopeChecker, self).__set__(inst, value)
+
+
 class _AccessorWrapper:
     """A wrapper class for properties with accessors.
 
     We define this separately from PropertyWithAccessor and
-    PropertyWithAccessorAndMutator to avoid multple inheritance issues.
+    PropertyWithAccessorAndMutator to avoid multiple inheritance issues.
     """
 
     def __get__(self, obj, *args):
@@ -1373,6 +1425,7 @@
         context = getattr(obj, self.contextvar)
         if self.adaptation is not None:
             context = self.adaptation(context)
+        _check_request(context, None)
         # Error checking code in accessor_for() guarantees that there
         # is one and only one non-fixed parameter for the accessor
         # method.
@@ -1383,7 +1436,7 @@
     """A wrapper class for properties with mutators.
 
     We define this separately from PropertyWithMutator and
-    PropertyWithAccessorAndMutator to avoid multple inheritance issues.
+    PropertyWithAccessorAndMutator to avoid multiple inheritance issues.
     """
 
     def __set__(self, obj, new_value):
@@ -1393,13 +1446,14 @@
         context = getattr(obj, self.contextvar)
         if self.adaptation is not None:
             context = self.adaptation(context)
+        _check_request(context, None)
         # Error checking code in mutator_for() guarantees that there
         # is one and only one non-fixed parameter for the mutator
         # method.
         getattr(context, self.mutator)(new_value, **params)
 
 
-class PropertyWithAccessor(_AccessorWrapper, Passthrough):
+class PropertyWithAccessor(_AccessorWrapper, _ScopeChecker):
     """A property with a accessor method."""
 
     def __init__(self, name, context, accessor, accessor_annotations,
@@ -1409,7 +1463,7 @@
         self.accessor_annotations = accessor_annotations
 
 
-class PropertyWithMutator(_MutatorWrapper, Passthrough):
+class PropertyWithMutator(_MutatorWrapper, _ScopeChecker):
     """A property with a mutator method."""
 
     def __init__(self, name, context, mutator, mutator_annotations,
@@ -1542,6 +1596,7 @@
                 'Cache-control', 'max-age=%i'
                 % self._export_info['cache_for'])
 
+        _check_request(self.context, self._export_info.get('scopes', []))
         result = self._getMethod()(**params)
         return self.encodeResult(result)
 
@@ -1613,6 +1668,7 @@
         raise AssertionError('Unknown method export type: %s' % operation_type)
 
     return_type = match['return_type']
+    scopes = match.get('scopes') or []
 
     name = _versioned_class_name(
         '%s_%s_%s' % (prefix, method.interface.__name__, match['as']),
@@ -1620,6 +1676,7 @@
     class_dict = {
         'params': tuple(match['params'].values()),
         'return_type': return_type,
+        'scopes': tuple(scopes),
         '_orig_iface': method.interface,
         '_export_info': match,
         '_method_name': method.__name__,

=== modified file 'src/lazr/restful/docs/webservice-declarations.rst'
--- src/lazr/restful/docs/webservice-declarations.rst	2021-02-16 16:51:35 +0000
+++ src/lazr/restful/docs/webservice-declarations.rst	2021-10-06 10:26:55 +0000
@@ -836,15 +836,32 @@
 utilities providing basic information about the web service. This one
 is just a dummy.
 
-    >>> from lazr.restful.testing.helpers import TestWebServiceConfiguration
     >>> from zope.component import provideUtility
+    >>> from zope.security.interfaces import Unauthorized
     >>> from lazr.restful.interfaces import IWebServiceConfiguration
+    >>> from lazr.restful.testing.helpers import TestWebServiceConfiguration
     >>> class MyWebServiceConfiguration(TestWebServiceConfiguration):
     ...     active_versions = ["beta", "1.0", "2.0", "3.0"]
     ...     last_version_with_mutator_named_operations = "1.0"
     ...     first_version_with_total_size_link = "2.0"
     ...     code_revision = "1.0b"
     ...     default_batch_size = 50
+    ...     _scopes = None
+    ...
+    ...     def checkRequest(self, obj, required_scopes):
+    ...         if self._scopes is not None:
+    ...             if not required_scopes:
+    ...                 raise Unauthorized(
+    ...                     'Current authentication only allows calling '
+    ...                     'scoped methods.')
+    ...             elif not any(
+    ...                     scope in required_scopes
+    ...                     for scope in self._scopes):
+    ...                 raise Unauthorized(
+    ...                     'Current authentication does not allow calling '
+    ...                     'this method (one of these scopes is required: '
+    ...                     '%s).' % ', '.join(
+    ...                         "'%s'" % scope for scope in required_scopes))
     >>> provideUtility(MyWebServiceConfiguration(), IWebServiceConfiguration)
 
 We must also set up the ability to create versioned requests. This web
@@ -1540,6 +1557,192 @@
     TypeError: A field can only have one mutator method for version
     (earliest version); set_value_2 makes two.
 
+Scopes
+------
+
+A method can be tagged with a list of scope names.  If the user has
+authenticated in such a way as to limit their access to particular scopes
+(indicated by `IWebServiceConfiguration.checkRequest()`), then they can only
+call methods that declare at least one of the corresponding scopes.
+
+    >>> from lazr.restful.declarations import scoped
+    >>> from zope.component import getUtility
+
+    >>> @exported_as_webservice_entry()
+    ... class IScopedEntry(Interface):
+    ...
+    ...     value = exported(TextLine(readonly=False))
+    ...
+    ...     @scoped('read')
+    ...     @export_read_operation()
+    ...     def get_info():
+    ...         pass
+    ...
+    ...     @scoped('update')
+    ...     @export_write_operation()
+    ...     def do_update():
+    ...         pass
+    ...
+    ...     @scoped('read', 'update')
+    ...     @export_write_operation()
+    ...     def multiple_scopes():
+    ...         pass
+    ...
+    ...     @export_write_operation()
+    ...     def unscoped():
+    ...         pass
+
+    >>> @implementer(IScopedEntry)
+    ... class ScopedEntry(object):
+    ...
+    ...     value = 'initial'
+    ...
+    ...     def get_info(self):
+    ...         print('get_info called')
+    ...
+    ...     def do_update(self):
+    ...         print('do_update called')
+    ...
+    ...     def multiple_scopes(self):
+    ...         print('multiple_scopes called')
+    ...
+    ...     def unscoped(self):
+    ...         print('unscoped called')
+
+    >>> [(version, scoped_entry_interface)] = generate_entry_interfaces(
+    ...     IScopedEntry, [], 'beta')
+    >>> scoped_entry_adapter_factory = generate_entry_adapters(
+    ...     IScopedEntry, [], [(version, scoped_entry_interface)])[0].object
+
+    >>> get_info_method_adapter_factory = generate_operation_adapter(
+    ...     IScopedEntry['get_info'])
+    >>> IResourceGETOperation.implementedBy(get_info_method_adapter_factory)
+    True
+    >>> do_update_method_adapter_factory = generate_operation_adapter(
+    ...     IScopedEntry['do_update'])
+    >>> IResourcePOSTOperation.implementedBy(do_update_method_adapter_factory)
+    True
+    >>> multiple_scopes_method_adapter_factory = generate_operation_adapter(
+    ...     IScopedEntry['multiple_scopes'])
+    >>> IResourcePOSTOperation.implementedBy(
+    ...     multiple_scopes_method_adapter_factory)
+    True
+    >>> unscoped_method_adapter_factory = generate_operation_adapter(
+    ...     IScopedEntry['unscoped'])
+    >>> IResourcePOSTOperation.implementedBy(unscoped_method_adapter_factory)
+    True
+
+    >>> obj = ScopedEntry()
+    >>> request = FakeRequest(version='beta')
+    >>> scoped_entry_adapter = scoped_entry_adapter_factory(obj, request)
+    >>> get_info_method_adapter = (
+    ...     get_info_method_adapter_factory(obj, request))
+    >>> do_update_method_adapter = (
+    ...     do_update_method_adapter_factory(obj, request))
+    >>> multiple_scopes_method_adapter = (
+    ...     multiple_scopes_method_adapter_factory(obj, request))
+    >>> unscoped_method_adapter = (
+    ...     unscoped_method_adapter_factory(obj, request))
+
+A user with unscoped authentication can call any method, and get or set
+attributes.
+
+    >>> _ = get_info_method_adapter.call()
+    get_info called
+    >>> _ = do_update_method_adapter.call()
+    do_update called
+    >>> _ = multiple_scopes_method_adapter.call()
+    multiple_scopes called
+    >>> _ = unscoped_method_adapter.call()
+    unscoped called
+    >>> print(scoped_entry_adapter.value)
+    initial
+    >>> scoped_entry_adapter.value = 'set by unscoped user'
+
+A user with both scopes can call any method tagged with either scope, but
+can neither get nor set attributes.
+
+    >>> config = getUtility(IWebServiceConfiguration)
+    >>> config._scopes = ['read', 'update']
+    >>> _ = get_info_method_adapter.call()
+    get_info called
+    >>> _ = do_update_method_adapter.call()
+    do_update called
+    >>> _ = multiple_scopes_method_adapter.call()
+    multiple_scopes called
+    >>> _ = unscoped_method_adapter.call()
+    ... # doctest: +IGNORE_EXCEPTION_MODULE_IN_PYTHON2
+    Traceback (most recent call last):
+      ...
+    zope.security.interfaces.Unauthorized: Current authentication only allows calling scoped methods.
+    >>> print(scoped_entry_adapter.value)
+    ... # doctest: +IGNORE_EXCEPTION_MODULE_IN_PYTHON2
+    Traceback (most recent call last):
+      ...
+    zope.security.interfaces.Unauthorized: Current authentication only allows calling scoped methods.
+    >>> scoped_entry_adapter.value = 'set by scoped user'
+    ... # doctest: +IGNORE_EXCEPTION_MODULE_IN_PYTHON2
+    Traceback (most recent call last):
+      ...
+    zope.security.interfaces.Unauthorized: Current authentication only allows calling scoped methods.
+
+A user with one scope can only call the methods tagged with that scope, and
+can neither get nor set attributes.
+
+    >>> config._scopes = ['read']
+    >>> _ = get_info_method_adapter.call()
+    get_info called
+    >>> _ = do_update_method_adapter.call()
+    ... # doctest: +IGNORE_EXCEPTION_MODULE_IN_PYTHON2
+    Traceback (most recent call last):
+      ...
+    zope.security.interfaces.Unauthorized: Current authentication does not allow calling this method (one of these scopes is required: 'update').
+    >>> _ = multiple_scopes_method_adapter.call()
+    multiple_scopes called
+    >>> _ = unscoped_method_adapter.call()
+    ... # doctest: +IGNORE_EXCEPTION_MODULE_IN_PYTHON2
+    Traceback (most recent call last):
+      ...
+    zope.security.interfaces.Unauthorized: Current authentication only allows calling scoped methods.
+    >>> print(scoped_entry_adapter.value)
+    ... # doctest: +IGNORE_EXCEPTION_MODULE_IN_PYTHON2
+    Traceback (most recent call last):
+      ...
+    zope.security.interfaces.Unauthorized: Current authentication only allows calling scoped methods.
+    >>> scoped_entry_adapter.value = 'set by scoped user'
+    ... # doctest: +IGNORE_EXCEPTION_MODULE_IN_PYTHON2
+    Traceback (most recent call last):
+      ...
+    zope.security.interfaces.Unauthorized: Current authentication only allows calling scoped methods.
+
+    >>> config._scopes = ['update']
+    >>> _ = get_info_method_adapter.call()
+    ... # doctest: +IGNORE_EXCEPTION_MODULE_IN_PYTHON2
+    Traceback (most recent call last):
+      ...
+    zope.security.interfaces.Unauthorized: Current authentication does not allow calling this method (one of these scopes is required: 'read').
+    >>> _ = do_update_method_adapter.call()
+    do_update called
+    >>> _ = multiple_scopes_method_adapter.call()
+    multiple_scopes called
+    >>> _ = unscoped_method_adapter.call()
+    ... # doctest: +IGNORE_EXCEPTION_MODULE_IN_PYTHON2
+    Traceback (most recent call last):
+      ...
+    zope.security.interfaces.Unauthorized: Current authentication only allows calling scoped methods.
+    >>> print(scoped_entry_adapter.value)
+    ... # doctest: +IGNORE_EXCEPTION_MODULE_IN_PYTHON2
+    Traceback (most recent call last):
+      ...
+    zope.security.interfaces.Unauthorized: Current authentication only allows calling scoped methods.
+    >>> scoped_entry_adapter.value = 'set by scoped user'
+    ... # doctest: +IGNORE_EXCEPTION_MODULE_IN_PYTHON2
+    Traceback (most recent call last):
+      ...
+    zope.security.interfaces.Unauthorized: Current authentication only allows calling scoped methods.
+
+    >>> config._scopes = None
+
 Read-only fields
 ----------------
 
@@ -2593,7 +2796,7 @@
 IResourceOperation adapters named under the exported method names
 are also available for IBookSetOnSteroids and IBookOnSteroids.
 
-    >>> from zope.component import getGlobalSiteManager, getUtility
+    >>> from zope.component import getGlobalSiteManager
     >>> adapter_registry = getGlobalSiteManager().adapters
 
     >>> from lazr.restful.interfaces import IWebServiceClientRequest

=== modified file 'src/lazr/restful/interfaces/_rest.py'
--- src/lazr/restful/interfaces/_rest.py	2020-02-04 11:52:59 +0000
+++ src/lazr/restful/interfaces/_rest.py	2021-10-06 10:26:55 +0000
@@ -652,6 +652,26 @@
         value will be fed back into your code.
         """
 
+    def checkRequest(context, required_scopes):
+        """Check whether the current request may call a particular method.
+
+        Authenticated users may be limited to certain scopes, in which case
+        they will only be able to use methods with corresponding `@scoped`
+        decorators.  This method is called to check whether a call to a
+        method on `context` tagged with `required_scopes` should be allowed.
+        The return value is ignored; it only matters whether this raises a
+        `zope.security.interfaces.Unauthorized` exception.
+
+        For compatibility, if this method is unimplemented, it is treated as
+        if it did not raise an exception.
+
+        :param context: The context object.
+        :param required_scopes: A list of scope names for this method, or
+            None if the method is unscoped.
+        :raises zope.security.interfaces.Unauthorized: if the call should
+            not be allowed.
+        """
+
 
 class IUnmarshallingDoesntNeedValue(Interface):
     """A marker interface for unmarshallers that work without values.

=== modified file 'src/lazr/restful/tales.py'
--- src/lazr/restful/tales.py	2020-07-22 23:22:26 +0000
+++ src/lazr/restful/tales.py	2021-10-06 10:26:55 +0000
@@ -804,7 +804,13 @@
     @property
     def doc(self):
         """Human-readable documentation for this operation."""
-        return generate_wadl_doc(self.operation.__doc__)
+        docstring = self.operation.__doc__
+        # Hack scope information into the docstring for now.
+        scopes = getattr(self.operation, 'scopes', None)
+        if scopes:
+            docstring += '\n\nScopes: %s\n' % (
+                ', '.join("``%s``" % scope for scope in scopes))
+        return generate_wadl_doc(docstring)
 
     @property
     def has_return_type(self):

=== modified file 'src/lazr/restful/testing/webservice.py'
--- src/lazr/restful/testing/webservice.py	2021-05-20 20:44:54 +0000
+++ src/lazr/restful/testing/webservice.py	2021-10-06 10:26:55 +0000
@@ -47,6 +47,7 @@
 from zope.proxy import ProxyBase
 from zope.schema import TextLine
 from zope.security.checker import ProxyFactory
+from zope.security.interfaces import Unauthorized
 from zope.testing.cleanup import CleanUp
 from zope.traversing.browser.interfaces import IAbsoluteURL
 
@@ -565,6 +566,7 @@
     active_versions = ['1.0', '2.0']
     hostname = "webservice_test"
     last_version_with_mutator_named_operations = None
+    _scopes = None
 
     def createRequest(self, body_instream, environ):
         request = Request(body_instream, environ)
@@ -573,6 +575,19 @@
         tag_request_with_version_name(request, '2.0')
         return request
 
+    def checkRequest(self, obj, required_scopes):
+        if self._scopes is not None:
+            if not required_scopes:
+                raise Unauthorized(
+                    'Current authentication only allows calling '
+                    'scoped methods.')
+            elif not any(scope in required_scopes for scope in self._scopes):
+                raise Unauthorized(
+                    'Current authentication does not allow calling '
+                    'this method (one of these scopes is required: '
+                    '%s).'
+                    % ', '.join("'%s'" % scope for scope in required_scopes))
+
 
 class IWebServiceTestRequest10(IWebServiceClientRequest):
     """A marker interface for requests to the '1.0' web service."""

=== modified file 'src/lazr/restful/tests/test_declarations.py'
--- src/lazr/restful/tests/test_declarations.py	2020-07-22 23:22:26 +0000
+++ src/lazr/restful/tests/test_declarations.py	2021-10-06 10:26:55 +0000
@@ -28,6 +28,7 @@
     MultiChecker,
     ProxyFactory,
     )
+from zope.security.interfaces import Unauthorized
 from zope.security.management import (
     endInteraction,
     newInteraction,
@@ -339,6 +340,37 @@
         self.assertEqual(
             'product', EntryAdapterUtility(adapter.__class__).singular_type)
 
+    def test_accessor_for_with_scopes(self):
+        # Users with scopes cannot use accessors.
+        self.product._branches = [
+            Branch('A branch'), Branch('Another branch')]
+        register_test_module('testmod', IBranch, IProduct, IHasBranches)
+        config = getUtility(IWebServiceConfiguration)
+        config._scopes = ['scope']
+        self.addCleanup(setattr, config, '_scopes', None)
+        adapter = getMultiAdapter(
+            (self.product, self.one_zero_request), IEntry)
+        exception = self.assertRaises(
+            Unauthorized, getattr, adapter, 'branches')
+        self.assertEqual(
+            'Current authentication only allows calling scoped methods.',
+            str(exception))
+
+    def test_mutator_for_with_scopes(self):
+        # Users with scopes cannot use mutators.
+        self.product._dev_branch = Branch('A product branch')
+        register_test_module('testmod', IBranch, IProduct, IHasBranches)
+        config = getUtility(IWebServiceConfiguration)
+        config._scopes = ['scope']
+        self.addCleanup(setattr, config, '_scopes', None)
+        adapter = getMultiAdapter(
+            (self.product, self.two_zero_request), IEntry)
+        exception = self.assertRaises(
+            Unauthorized, setattr, adapter, 'development_branch_20', None)
+        self.assertEqual(
+            'Current authentication only allows calling scoped methods.',
+            str(exception))
+
 
 class TestExportAsWebserviceEntry(testtools.TestCase):
     """Tests for export_as_webservice_entry."""

=== modified file 'src/lazr/restful/tests/test_webservice.py'
--- src/lazr/restful/tests/test_webservice.py	2021-01-21 00:36:11 +0000
+++ src/lazr/restful/tests/test_webservice.py	2021-10-06 10:26:55 +0000
@@ -61,9 +61,11 @@
     ResourceGETOperation,
     )
 from lazr.restful.declarations import (
+    export_read_operation,
     exported,
     exported_as_webservice_entry,
     LAZR_WEBSERVICE_NAME,
+    scoped,
     )
 from lazr.restful.testing.webservice import (
     create_web_service_request,
@@ -667,13 +669,20 @@
 class WadlAPITestCase(WebServiceTestCase):
     """Test the docstring generation."""
 
+    @exported_as_webservice_entry()
+    class IScopedEntry(Interface):
+        @scoped('test-scope')
+        @export_read_operation()
+        def test():
+            """A method with a scope."""
+
     # This one is used to test when docstrings are missing.
     @exported_as_webservice_entry()
     class IUndocumentedEntry(Interface):
         a_field = exported(TextLine())
 
     testmodule_objects = [
-        IGenericEntry, IGenericCollection, IUndocumentedEntry]
+        IGenericEntry, IGenericCollection, IScopedEntry, IUndocumentedEntry]
 
     def test_wadl_field_type(self):
         """Test the generated XSD field types for various fields."""
@@ -747,6 +756,23 @@
         self.assertTrue(len(doclines) > 3,
             'Missing the parameter table: %s' % "\n".join(doclines))
 
+    def test_wadl_operation_with_scopes_doc(self):
+        """Test the wadl:doc generated for an operation adapter."""
+        operation = get_operation_factory(self.IScopedEntry, 'test')
+        doclines = test_tales(
+            'operation/wadl_operation:doc', operation=operation).splitlines()
+        # Only compare the first three lines and the last one.
+        # we dont care about the formatting of the parameters table.
+        self.assertEqual([
+            '<wadl:doc xmlns="http://www.w3.org/1999/xhtml">',
+            '<p>A method with a scope.</p>',
+            '<p>Scopes: <tt class="rst-docutils literal"><span class="pre">'
+            'test-scope</span></tt></p>',
+            ], doclines[0:3])
+        self.assertEqual('</wadl:doc>', doclines[-1])
+        self.assertTrue(len(doclines) > 3,
+            'Missing the parameter table: %s' % "\n".join(doclines))
+
 
 class DuplicateNameTestCase(WebServiceTestCase):
     """Test AssertionError when two resources expose the same name.